Linux Audio

Check our new training course

Loading...
v3.1
   1/*
   2 * MUSB OTG driver host support
   3 *
   4 * Copyright 2005 Mentor Graphics Corporation
   5 * Copyright (C) 2005-2006 by Texas Instruments
   6 * Copyright (C) 2006-2007 Nokia Corporation
   7 * Copyright (C) 2008-2009 MontaVista Software, Inc. <source@mvista.com>
   8 *
   9 * This program is free software; you can redistribute it and/or
  10 * modify it under the terms of the GNU General Public License
  11 * version 2 as published by the Free Software Foundation.
  12 *
  13 * This program is distributed in the hope that it will be useful, but
  14 * WITHOUT ANY WARRANTY; without even the implied warranty of
  15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16 * General Public License for more details.
  17 *
  18 * You should have received a copy of the GNU General Public License
  19 * along with this program; if not, write to the Free Software
  20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
  21 * 02110-1301 USA
  22 *
  23 * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
  24 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  25 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
  26 * NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  27 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  28 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
  29 * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
  30 * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  32 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  33 *
  34 */
  35
  36#include <linux/module.h>
  37#include <linux/kernel.h>
  38#include <linux/delay.h>
  39#include <linux/sched.h>
  40#include <linux/slab.h>
  41#include <linux/errno.h>
  42#include <linux/init.h>
  43#include <linux/list.h>
  44#include <linux/dma-mapping.h>
  45
  46#include "musb_core.h"
  47#include "musb_host.h"
  48
  49
  50/* MUSB HOST status 22-mar-2006
  51 *
  52 * - There's still lots of partial code duplication for fault paths, so
  53 *   they aren't handled as consistently as they need to be.
  54 *
  55 * - PIO mostly behaved when last tested.
  56 *     + including ep0, with all usbtest cases 9, 10
  57 *     + usbtest 14 (ep0out) doesn't seem to run at all
  58 *     + double buffered OUT/TX endpoints saw stalls(!) with certain usbtest
  59 *       configurations, but otherwise double buffering passes basic tests.
  60 *     + for 2.6.N, for N > ~10, needs API changes for hcd framework.
  61 *
  62 * - DMA (CPPI) ... partially behaves, not currently recommended
  63 *     + about 1/15 the speed of typical EHCI implementations (PCI)
  64 *     + RX, all too often reqpkt seems to misbehave after tx
  65 *     + TX, no known issues (other than evident silicon issue)
  66 *
  67 * - DMA (Mentor/OMAP) ...has at least toggle update problems
  68 *
  69 * - [23-feb-2009] minimal traffic scheduling to avoid bulk RX packet
  70 *   starvation ... nothing yet for TX, interrupt, or bulk.
  71 *
  72 * - Not tested with HNP, but some SRP paths seem to behave.
  73 *
  74 * NOTE 24-August-2006:
  75 *
  76 * - Bulk traffic finally uses both sides of hardware ep1, freeing up an
  77 *   extra endpoint for periodic use enabling hub + keybd + mouse.  That
  78 *   mostly works, except that with "usbnet" it's easy to trigger cases
  79 *   with "ping" where RX loses.  (a) ping to davinci, even "ping -f",
  80 *   fine; but (b) ping _from_ davinci, even "ping -c 1", ICMP RX loses
  81 *   although ARP RX wins.  (That test was done with a full speed link.)
  82 */
  83
  84
  85/*
  86 * NOTE on endpoint usage:
  87 *
  88 * CONTROL transfers all go through ep0.  BULK ones go through dedicated IN
  89 * and OUT endpoints ... hardware is dedicated for those "async" queue(s).
  90 * (Yes, bulk _could_ use more of the endpoints than that, and would even
  91 * benefit from it.)
  92 *
  93 * INTERUPPT and ISOCHRONOUS transfers are scheduled to the other endpoints.
  94 * So far that scheduling is both dumb and optimistic:  the endpoint will be
  95 * "claimed" until its software queue is no longer refilled.  No multiplexing
  96 * of transfers between endpoints, or anything clever.
  97 */
  98
 
 
 
 
 
  99
 100static void musb_ep_program(struct musb *musb, u8 epnum,
 101			struct urb *urb, int is_out,
 102			u8 *buf, u32 offset, u32 len);
 103
 104/*
 105 * Clear TX fifo. Needed to avoid BABBLE errors.
 106 */
 107static void musb_h_tx_flush_fifo(struct musb_hw_ep *ep)
 108{
 109	struct musb	*musb = ep->musb;
 110	void __iomem	*epio = ep->regs;
 111	u16		csr;
 112	u16		lastcsr = 0;
 113	int		retries = 1000;
 114
 115	csr = musb_readw(epio, MUSB_TXCSR);
 116	while (csr & MUSB_TXCSR_FIFONOTEMPTY) {
 117		if (csr != lastcsr)
 118			dev_dbg(musb->controller, "Host TX FIFONOTEMPTY csr: %02x\n", csr);
 119		lastcsr = csr;
 120		csr |= MUSB_TXCSR_FLUSHFIFO;
 121		musb_writew(epio, MUSB_TXCSR, csr);
 122		csr = musb_readw(epio, MUSB_TXCSR);
 123		if (WARN(retries-- < 1,
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 124				"Could not flush host TX%d fifo: csr: %04x\n",
 125				ep->epnum, csr))
 126			return;
 127		mdelay(1);
 128	}
 129}
 130
 131static void musb_h_ep0_flush_fifo(struct musb_hw_ep *ep)
 132{
 133	void __iomem	*epio = ep->regs;
 134	u16		csr;
 135	int		retries = 5;
 136
 137	/* scrub any data left in the fifo */
 138	do {
 139		csr = musb_readw(epio, MUSB_TXCSR);
 140		if (!(csr & (MUSB_CSR0_TXPKTRDY | MUSB_CSR0_RXPKTRDY)))
 141			break;
 142		musb_writew(epio, MUSB_TXCSR, MUSB_CSR0_FLUSHFIFO);
 143		csr = musb_readw(epio, MUSB_TXCSR);
 144		udelay(10);
 145	} while (--retries);
 146
 147	WARN(!retries, "Could not flush host TX%d fifo: csr: %04x\n",
 148			ep->epnum, csr);
 149
 150	/* and reset for the next transfer */
 151	musb_writew(epio, MUSB_TXCSR, 0);
 152}
 153
 154/*
 155 * Start transmit. Caller is responsible for locking shared resources.
 156 * musb must be locked.
 157 */
 158static inline void musb_h_tx_start(struct musb_hw_ep *ep)
 159{
 160	u16	txcsr;
 161
 162	/* NOTE: no locks here; caller should lock and select EP */
 163	if (ep->epnum) {
 164		txcsr = musb_readw(ep->regs, MUSB_TXCSR);
 165		txcsr |= MUSB_TXCSR_TXPKTRDY | MUSB_TXCSR_H_WZC_BITS;
 166		musb_writew(ep->regs, MUSB_TXCSR, txcsr);
 167	} else {
 168		txcsr = MUSB_CSR0_H_SETUPPKT | MUSB_CSR0_TXPKTRDY;
 169		musb_writew(ep->regs, MUSB_CSR0, txcsr);
 170	}
 171
 172}
 173
 174static inline void musb_h_tx_dma_start(struct musb_hw_ep *ep)
 175{
 176	u16	txcsr;
 177
 178	/* NOTE: no locks here; caller should lock and select EP */
 179	txcsr = musb_readw(ep->regs, MUSB_TXCSR);
 180	txcsr |= MUSB_TXCSR_DMAENAB | MUSB_TXCSR_H_WZC_BITS;
 181	if (is_cppi_enabled())
 182		txcsr |= MUSB_TXCSR_DMAMODE;
 183	musb_writew(ep->regs, MUSB_TXCSR, txcsr);
 184}
 185
 186static void musb_ep_set_qh(struct musb_hw_ep *ep, int is_in, struct musb_qh *qh)
 187{
 188	if (is_in != 0 || ep->is_shared_fifo)
 189		ep->in_qh  = qh;
 190	if (is_in == 0 || ep->is_shared_fifo)
 191		ep->out_qh = qh;
 192}
 193
 194static struct musb_qh *musb_ep_get_qh(struct musb_hw_ep *ep, int is_in)
 195{
 196	return is_in ? ep->in_qh : ep->out_qh;
 197}
 198
 199/*
 200 * Start the URB at the front of an endpoint's queue
 201 * end must be claimed from the caller.
 202 *
 203 * Context: controller locked, irqs blocked
 204 */
 205static void
 206musb_start_urb(struct musb *musb, int is_in, struct musb_qh *qh)
 207{
 208	u16			frame;
 209	u32			len;
 210	void __iomem		*mbase =  musb->mregs;
 211	struct urb		*urb = next_urb(qh);
 212	void			*buf = urb->transfer_buffer;
 213	u32			offset = 0;
 214	struct musb_hw_ep	*hw_ep = qh->hw_ep;
 215	unsigned		pipe = urb->pipe;
 216	u8			address = usb_pipedevice(pipe);
 217	int			epnum = hw_ep->epnum;
 218
 219	/* initialize software qh state */
 220	qh->offset = 0;
 221	qh->segsize = 0;
 222
 223	/* gather right source of data */
 224	switch (qh->type) {
 225	case USB_ENDPOINT_XFER_CONTROL:
 226		/* control transfers always start with SETUP */
 227		is_in = 0;
 228		musb->ep0_stage = MUSB_EP0_START;
 229		buf = urb->setup_packet;
 230		len = 8;
 231		break;
 232	case USB_ENDPOINT_XFER_ISOC:
 233		qh->iso_idx = 0;
 234		qh->frame = 0;
 235		offset = urb->iso_frame_desc[0].offset;
 236		len = urb->iso_frame_desc[0].length;
 237		break;
 238	default:		/* bulk, interrupt */
 239		/* actual_length may be nonzero on retry paths */
 240		buf = urb->transfer_buffer + urb->actual_length;
 241		len = urb->transfer_buffer_length - urb->actual_length;
 242	}
 243
 244	dev_dbg(musb->controller, "qh %p urb %p dev%d ep%d%s%s, hw_ep %d, %p/%d\n",
 245			qh, urb, address, qh->epnum,
 246			is_in ? "in" : "out",
 247			({char *s; switch (qh->type) {
 248			case USB_ENDPOINT_XFER_CONTROL:	s = ""; break;
 249			case USB_ENDPOINT_XFER_BULK:	s = "-bulk"; break;
 250			case USB_ENDPOINT_XFER_ISOC:	s = "-iso"; break;
 251			default:			s = "-intr"; break;
 252			}; s; }),
 253			epnum, buf + offset, len);
 254
 255	/* Configure endpoint */
 256	musb_ep_set_qh(hw_ep, is_in, qh);
 257	musb_ep_program(musb, epnum, urb, !is_in, buf, offset, len);
 258
 259	/* transmit may have more work: start it when it is time */
 260	if (is_in)
 261		return;
 262
 263	/* determine if the time is right for a periodic transfer */
 264	switch (qh->type) {
 265	case USB_ENDPOINT_XFER_ISOC:
 266	case USB_ENDPOINT_XFER_INT:
 267		dev_dbg(musb->controller, "check whether there's still time for periodic Tx\n");
 268		frame = musb_readw(mbase, MUSB_FRAME);
 269		/* FIXME this doesn't implement that scheduling policy ...
 270		 * or handle framecounter wrapping
 271		 */
 272		if ((urb->transfer_flags & URB_ISO_ASAP)
 273				|| (frame >= urb->start_frame)) {
 274			/* REVISIT the SOF irq handler shouldn't duplicate
 275			 * this code; and we don't init urb->start_frame...
 276			 */
 277			qh->frame = 0;
 278			goto start;
 279		} else {
 280			qh->frame = urb->start_frame;
 281			/* enable SOF interrupt so we can count down */
 282			dev_dbg(musb->controller, "SOF for %d\n", epnum);
 283#if 1 /* ifndef	CONFIG_ARCH_DAVINCI */
 284			musb_writeb(mbase, MUSB_INTRUSBE, 0xff);
 285#endif
 286		}
 287		break;
 288	default:
 289start:
 290		dev_dbg(musb->controller, "Start TX%d %s\n", epnum,
 291			hw_ep->tx_channel ? "dma" : "pio");
 292
 293		if (!hw_ep->tx_channel)
 294			musb_h_tx_start(hw_ep);
 295		else if (is_cppi_enabled() || tusb_dma_omap())
 296			musb_h_tx_dma_start(hw_ep);
 297	}
 298}
 299
 300/* Context: caller owns controller lock, IRQs are blocked */
 301static void musb_giveback(struct musb *musb, struct urb *urb, int status)
 302__releases(musb->lock)
 303__acquires(musb->lock)
 304{
 305	dev_dbg(musb->controller,
 306			"complete %p %pF (%d), dev%d ep%d%s, %d/%d\n",
 307			urb, urb->complete, status,
 308			usb_pipedevice(urb->pipe),
 309			usb_pipeendpoint(urb->pipe),
 310			usb_pipein(urb->pipe) ? "in" : "out",
 311			urb->actual_length, urb->transfer_buffer_length
 312			);
 313
 314	usb_hcd_unlink_urb_from_ep(musb_to_hcd(musb), urb);
 315	spin_unlock(&musb->lock);
 316	usb_hcd_giveback_urb(musb_to_hcd(musb), urb, status);
 317	spin_lock(&musb->lock);
 318}
 319
 320/* For bulk/interrupt endpoints only */
 321static inline void musb_save_toggle(struct musb_qh *qh, int is_in,
 322				    struct urb *urb)
 323{
 324	void __iomem		*epio = qh->hw_ep->regs;
 325	u16			csr;
 326
 327	/*
 328	 * FIXME: the current Mentor DMA code seems to have
 329	 * problems getting toggle correct.
 330	 */
 331
 332	if (is_in)
 333		csr = musb_readw(epio, MUSB_RXCSR) & MUSB_RXCSR_H_DATATOGGLE;
 334	else
 335		csr = musb_readw(epio, MUSB_TXCSR) & MUSB_TXCSR_H_DATATOGGLE;
 336
 337	usb_settoggle(urb->dev, qh->epnum, !is_in, csr ? 1 : 0);
 338}
 339
 340/*
 341 * Advance this hardware endpoint's queue, completing the specified URB and
 342 * advancing to either the next URB queued to that qh, or else invalidating
 343 * that qh and advancing to the next qh scheduled after the current one.
 344 *
 345 * Context: caller owns controller lock, IRQs are blocked
 346 */
 347static void musb_advance_schedule(struct musb *musb, struct urb *urb,
 348				  struct musb_hw_ep *hw_ep, int is_in)
 349{
 350	struct musb_qh		*qh = musb_ep_get_qh(hw_ep, is_in);
 351	struct musb_hw_ep	*ep = qh->hw_ep;
 352	int			ready = qh->is_ready;
 353	int			status;
 354
 355	status = (urb->status == -EINPROGRESS) ? 0 : urb->status;
 356
 357	/* save toggle eagerly, for paranoia */
 358	switch (qh->type) {
 359	case USB_ENDPOINT_XFER_BULK:
 360	case USB_ENDPOINT_XFER_INT:
 361		musb_save_toggle(qh, is_in, urb);
 362		break;
 363	case USB_ENDPOINT_XFER_ISOC:
 364		if (status == 0 && urb->error_count)
 365			status = -EXDEV;
 366		break;
 367	}
 368
 369	qh->is_ready = 0;
 370	musb_giveback(musb, urb, status);
 371	qh->is_ready = ready;
 372
 373	/* reclaim resources (and bandwidth) ASAP; deschedule it, and
 374	 * invalidate qh as soon as list_empty(&hep->urb_list)
 375	 */
 376	if (list_empty(&qh->hep->urb_list)) {
 377		struct list_head	*head;
 
 378
 379		if (is_in)
 380			ep->rx_reinit = 1;
 381		else
 
 
 
 
 382			ep->tx_reinit = 1;
 
 
 
 
 
 383
 384		/* Clobber old pointers to this qh */
 385		musb_ep_set_qh(ep, is_in, NULL);
 386		qh->hep->hcpriv = NULL;
 387
 388		switch (qh->type) {
 389
 390		case USB_ENDPOINT_XFER_CONTROL:
 391		case USB_ENDPOINT_XFER_BULK:
 392			/* fifo policy for these lists, except that NAKing
 393			 * should rotate a qh to the end (for fairness).
 394			 */
 395			if (qh->mux == 1) {
 396				head = qh->ring.prev;
 397				list_del(&qh->ring);
 398				kfree(qh);
 399				qh = first_qh(head);
 400				break;
 401			}
 402
 403		case USB_ENDPOINT_XFER_ISOC:
 404		case USB_ENDPOINT_XFER_INT:
 405			/* this is where periodic bandwidth should be
 406			 * de-allocated if it's tracked and allocated;
 407			 * and where we'd update the schedule tree...
 408			 */
 409			kfree(qh);
 410			qh = NULL;
 411			break;
 412		}
 413	}
 414
 415	if (qh != NULL && qh->is_ready) {
 416		dev_dbg(musb->controller, "... next ep%d %cX urb %p\n",
 417		    hw_ep->epnum, is_in ? 'R' : 'T', next_urb(qh));
 418		musb_start_urb(musb, is_in, qh);
 419	}
 420}
 421
 422static u16 musb_h_flush_rxfifo(struct musb_hw_ep *hw_ep, u16 csr)
 423{
 424	/* we don't want fifo to fill itself again;
 425	 * ignore dma (various models),
 426	 * leave toggle alone (may not have been saved yet)
 427	 */
 428	csr |= MUSB_RXCSR_FLUSHFIFO | MUSB_RXCSR_RXPKTRDY;
 429	csr &= ~(MUSB_RXCSR_H_REQPKT
 430		| MUSB_RXCSR_H_AUTOREQ
 431		| MUSB_RXCSR_AUTOCLEAR);
 432
 433	/* write 2x to allow double buffering */
 434	musb_writew(hw_ep->regs, MUSB_RXCSR, csr);
 435	musb_writew(hw_ep->regs, MUSB_RXCSR, csr);
 436
 437	/* flush writebuffer */
 438	return musb_readw(hw_ep->regs, MUSB_RXCSR);
 439}
 440
 441/*
 442 * PIO RX for a packet (or part of it).
 443 */
 444static bool
 445musb_host_packet_rx(struct musb *musb, struct urb *urb, u8 epnum, u8 iso_err)
 446{
 447	u16			rx_count;
 448	u8			*buf;
 449	u16			csr;
 450	bool			done = false;
 451	u32			length;
 452	int			do_flush = 0;
 453	struct musb_hw_ep	*hw_ep = musb->endpoints + epnum;
 454	void __iomem		*epio = hw_ep->regs;
 455	struct musb_qh		*qh = hw_ep->in_qh;
 456	int			pipe = urb->pipe;
 457	void			*buffer = urb->transfer_buffer;
 458
 459	/* musb_ep_select(mbase, epnum); */
 460	rx_count = musb_readw(epio, MUSB_RXCOUNT);
 461	dev_dbg(musb->controller, "RX%d count %d, buffer %p len %d/%d\n", epnum, rx_count,
 462			urb->transfer_buffer, qh->offset,
 463			urb->transfer_buffer_length);
 464
 465	/* unload FIFO */
 466	if (usb_pipeisoc(pipe)) {
 467		int					status = 0;
 468		struct usb_iso_packet_descriptor	*d;
 469
 470		if (iso_err) {
 471			status = -EILSEQ;
 472			urb->error_count++;
 473		}
 474
 475		d = urb->iso_frame_desc + qh->iso_idx;
 476		buf = buffer + d->offset;
 477		length = d->length;
 478		if (rx_count > length) {
 479			if (status == 0) {
 480				status = -EOVERFLOW;
 481				urb->error_count++;
 482			}
 483			dev_dbg(musb->controller, "** OVERFLOW %d into %d\n", rx_count, length);
 484			do_flush = 1;
 485		} else
 486			length = rx_count;
 487		urb->actual_length += length;
 488		d->actual_length = length;
 489
 490		d->status = status;
 491
 492		/* see if we are done */
 493		done = (++qh->iso_idx >= urb->number_of_packets);
 494	} else {
 495		/* non-isoch */
 496		buf = buffer + qh->offset;
 497		length = urb->transfer_buffer_length - qh->offset;
 498		if (rx_count > length) {
 499			if (urb->status == -EINPROGRESS)
 500				urb->status = -EOVERFLOW;
 501			dev_dbg(musb->controller, "** OVERFLOW %d into %d\n", rx_count, length);
 502			do_flush = 1;
 503		} else
 504			length = rx_count;
 505		urb->actual_length += length;
 506		qh->offset += length;
 507
 508		/* see if we are done */
 509		done = (urb->actual_length == urb->transfer_buffer_length)
 510			|| (rx_count < qh->maxpacket)
 511			|| (urb->status != -EINPROGRESS);
 512		if (done
 513				&& (urb->status == -EINPROGRESS)
 514				&& (urb->transfer_flags & URB_SHORT_NOT_OK)
 515				&& (urb->actual_length
 516					< urb->transfer_buffer_length))
 517			urb->status = -EREMOTEIO;
 518	}
 519
 520	musb_read_fifo(hw_ep, length, buf);
 521
 522	csr = musb_readw(epio, MUSB_RXCSR);
 523	csr |= MUSB_RXCSR_H_WZC_BITS;
 524	if (unlikely(do_flush))
 525		musb_h_flush_rxfifo(hw_ep, csr);
 526	else {
 527		/* REVISIT this assumes AUTOCLEAR is never set */
 528		csr &= ~(MUSB_RXCSR_RXPKTRDY | MUSB_RXCSR_H_REQPKT);
 529		if (!done)
 530			csr |= MUSB_RXCSR_H_REQPKT;
 531		musb_writew(epio, MUSB_RXCSR, csr);
 532	}
 533
 534	return done;
 535}
 536
 537/* we don't always need to reinit a given side of an endpoint...
 538 * when we do, use tx/rx reinit routine and then construct a new CSR
 539 * to address data toggle, NYET, and DMA or PIO.
 540 *
 541 * it's possible that driver bugs (especially for DMA) or aborting a
 542 * transfer might have left the endpoint busier than it should be.
 543 * the busy/not-empty tests are basically paranoia.
 544 */
 545static void
 546musb_rx_reinit(struct musb *musb, struct musb_qh *qh, struct musb_hw_ep *ep)
 547{
 
 548	u16	csr;
 549
 550	/* NOTE:  we know the "rx" fifo reinit never triggers for ep0.
 551	 * That always uses tx_reinit since ep0 repurposes TX register
 552	 * offsets; the initial SETUP packet is also a kind of OUT.
 553	 */
 554
 555	/* if programmed for Tx, put it in RX mode */
 556	if (ep->is_shared_fifo) {
 557		csr = musb_readw(ep->regs, MUSB_TXCSR);
 558		if (csr & MUSB_TXCSR_MODE) {
 559			musb_h_tx_flush_fifo(ep);
 560			csr = musb_readw(ep->regs, MUSB_TXCSR);
 561			musb_writew(ep->regs, MUSB_TXCSR,
 562				    csr | MUSB_TXCSR_FRCDATATOG);
 563		}
 564
 565		/*
 566		 * Clear the MODE bit (and everything else) to enable Rx.
 567		 * NOTE: we mustn't clear the DMAMODE bit before DMAENAB.
 568		 */
 569		if (csr & MUSB_TXCSR_DMAMODE)
 570			musb_writew(ep->regs, MUSB_TXCSR, MUSB_TXCSR_DMAMODE);
 571		musb_writew(ep->regs, MUSB_TXCSR, 0);
 572
 573	/* scrub all previous state, clearing toggle */
 574	} else {
 575		csr = musb_readw(ep->regs, MUSB_RXCSR);
 576		if (csr & MUSB_RXCSR_RXPKTRDY)
 577			WARNING("rx%d, packet/%d ready?\n", ep->epnum,
 578				musb_readw(ep->regs, MUSB_RXCOUNT));
 579
 580		musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG);
 581	}
 582
 583	/* target addr and (for multipoint) hub addr/port */
 584	if (musb->is_multipoint) {
 585		musb_write_rxfunaddr(ep->target_regs, qh->addr_reg);
 586		musb_write_rxhubaddr(ep->target_regs, qh->h_addr_reg);
 587		musb_write_rxhubport(ep->target_regs, qh->h_port_reg);
 588
 589	} else
 590		musb_writeb(musb->mregs, MUSB_FADDR, qh->addr_reg);
 591
 592	/* protocol/endpoint, interval/NAKlimit, i/o size */
 593	musb_writeb(ep->regs, MUSB_RXTYPE, qh->type_reg);
 594	musb_writeb(ep->regs, MUSB_RXINTERVAL, qh->intv_reg);
 595	/* NOTE: bulk combining rewrites high bits of maxpacket */
 596	/* Set RXMAXP with the FIFO size of the endpoint
 597	 * to disable double buffer mode.
 598	 */
 599	if (musb->double_buffer_not_ok)
 600		musb_writew(ep->regs, MUSB_RXMAXP, ep->max_packet_sz_rx);
 601	else
 602		musb_writew(ep->regs, MUSB_RXMAXP,
 603				qh->maxpacket | ((qh->hb_mult - 1) << 11));
 604
 605	ep->rx_reinit = 0;
 606}
 607
 608static bool musb_tx_dma_program(struct dma_controller *dma,
 609		struct musb_hw_ep *hw_ep, struct musb_qh *qh,
 610		struct urb *urb, u32 offset, u32 length)
 
 611{
 612	struct dma_channel	*channel = hw_ep->tx_channel;
 613	void __iomem		*epio = hw_ep->regs;
 614	u16			pkt_size = qh->maxpacket;
 615	u16			csr;
 616	u8			mode;
 617
 618#ifdef	CONFIG_USB_INVENTRA_DMA
 619	if (length > channel->max_len)
 620		length = channel->max_len;
 621
 622	csr = musb_readw(epio, MUSB_TXCSR);
 623	if (length > pkt_size) {
 624		mode = 1;
 625		csr |= MUSB_TXCSR_DMAMODE | MUSB_TXCSR_DMAENAB;
 626		/* autoset shouldn't be set in high bandwidth */
 627		if (qh->hb_mult == 1)
 
 
 
 
 
 
 
 
 
 
 628			csr |= MUSB_TXCSR_AUTOSET;
 629	} else {
 630		mode = 0;
 631		csr &= ~(MUSB_TXCSR_AUTOSET | MUSB_TXCSR_DMAMODE);
 632		csr |= MUSB_TXCSR_DMAENAB; /* against programmer's guide */
 633	}
 634	channel->desired_mode = mode;
 635	musb_writew(epio, MUSB_TXCSR, csr);
 636#else
 637	if (!is_cppi_enabled() && !tusb_dma_omap())
 638		return false;
 
 
 
 
 
 
 
 
 
 
 
 
 
 639
 640	channel->actual_len = 0;
 641
 642	/*
 643	 * TX uses "RNDIS" mode automatically but needs help
 644	 * to identify the zero-length-final-packet case.
 645	 */
 646	mode = (urb->transfer_flags & URB_ZERO_PACKET) ? 1 : 0;
 647#endif
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 648
 649	qh->segsize = length;
 650
 651	/*
 652	 * Ensure the data reaches to main memory before starting
 653	 * DMA transfer
 654	 */
 655	wmb();
 656
 657	if (!dma->channel_program(channel, pkt_size, mode,
 658			urb->transfer_dma + offset, length)) {
 
 
 
 659		dma->channel_release(channel);
 660		hw_ep->tx_channel = NULL;
 661
 662		csr = musb_readw(epio, MUSB_TXCSR);
 663		csr &= ~(MUSB_TXCSR_AUTOSET | MUSB_TXCSR_DMAENAB);
 664		musb_writew(epio, MUSB_TXCSR, csr | MUSB_TXCSR_H_WZC_BITS);
 665		return false;
 666	}
 667	return true;
 668}
 669
 670/*
 671 * Program an HDRC endpoint as per the given URB
 672 * Context: irqs blocked, controller lock held
 673 */
 674static void musb_ep_program(struct musb *musb, u8 epnum,
 675			struct urb *urb, int is_out,
 676			u8 *buf, u32 offset, u32 len)
 677{
 678	struct dma_controller	*dma_controller;
 679	struct dma_channel	*dma_channel;
 680	u8			dma_ok;
 681	void __iomem		*mbase = musb->mregs;
 682	struct musb_hw_ep	*hw_ep = musb->endpoints + epnum;
 683	void __iomem		*epio = hw_ep->regs;
 684	struct musb_qh		*qh = musb_ep_get_qh(hw_ep, !is_out);
 685	u16			packet_sz = qh->maxpacket;
 
 
 686
 687	dev_dbg(musb->controller, "%s hw%d urb %p spd%d dev%d ep%d%s "
 688				"h_addr%02x h_port%02x bytes %d\n",
 689			is_out ? "-->" : "<--",
 690			epnum, urb, urb->dev->speed,
 691			qh->addr_reg, qh->epnum, is_out ? "out" : "in",
 692			qh->h_addr_reg, qh->h_port_reg,
 693			len);
 694
 695	musb_ep_select(mbase, epnum);
 696
 
 
 
 
 
 
 
 
 697	/* candidate for DMA? */
 698	dma_controller = musb->dma_controller;
 699	if (is_dma_capable() && epnum && dma_controller) {
 700		dma_channel = is_out ? hw_ep->tx_channel : hw_ep->rx_channel;
 701		if (!dma_channel) {
 702			dma_channel = dma_controller->channel_alloc(
 703					dma_controller, hw_ep, is_out);
 704			if (is_out)
 705				hw_ep->tx_channel = dma_channel;
 706			else
 707				hw_ep->rx_channel = dma_channel;
 708		}
 709	} else
 710		dma_channel = NULL;
 711
 712	/* make sure we clear DMAEnab, autoSet bits from previous run */
 713
 714	/* OUT/transmit/EP0 or IN/receive? */
 715	if (is_out) {
 716		u16	csr;
 717		u16	int_txe;
 718		u16	load_count;
 719
 720		csr = musb_readw(epio, MUSB_TXCSR);
 721
 722		/* disable interrupt in case we flush */
 723		int_txe = musb_readw(mbase, MUSB_INTRTXE);
 724		musb_writew(mbase, MUSB_INTRTXE, int_txe & ~(1 << epnum));
 725
 726		/* general endpoint setup */
 727		if (epnum) {
 728			/* flush all old state, set default */
 729			musb_h_tx_flush_fifo(hw_ep);
 
 
 
 
 
 
 730
 731			/*
 732			 * We must not clear the DMAMODE bit before or in
 733			 * the same cycle with the DMAENAB bit, so we clear
 734			 * the latter first...
 735			 */
 736			csr &= ~(MUSB_TXCSR_H_NAKTIMEOUT
 737					| MUSB_TXCSR_AUTOSET
 738					| MUSB_TXCSR_DMAENAB
 739					| MUSB_TXCSR_FRCDATATOG
 740					| MUSB_TXCSR_H_RXSTALL
 741					| MUSB_TXCSR_H_ERROR
 742					| MUSB_TXCSR_TXPKTRDY
 743					);
 744			csr |= MUSB_TXCSR_MODE;
 745
 746			if (usb_gettoggle(urb->dev, qh->epnum, 1))
 747				csr |= MUSB_TXCSR_H_WR_DATATOGGLE
 748					| MUSB_TXCSR_H_DATATOGGLE;
 749			else
 750				csr |= MUSB_TXCSR_CLRDATATOG;
 
 
 751
 752			musb_writew(epio, MUSB_TXCSR, csr);
 753			/* REVISIT may need to clear FLUSHFIFO ... */
 754			csr &= ~MUSB_TXCSR_DMAMODE;
 755			musb_writew(epio, MUSB_TXCSR, csr);
 756			csr = musb_readw(epio, MUSB_TXCSR);
 757		} else {
 758			/* endpoint 0: just flush */
 759			musb_h_ep0_flush_fifo(hw_ep);
 760		}
 761
 762		/* target addr and (for multipoint) hub addr/port */
 763		if (musb->is_multipoint) {
 764			musb_write_txfunaddr(mbase, epnum, qh->addr_reg);
 765			musb_write_txhubaddr(mbase, epnum, qh->h_addr_reg);
 766			musb_write_txhubport(mbase, epnum, qh->h_port_reg);
 767/* FIXME if !epnum, do the same for RX ... */
 768		} else
 769			musb_writeb(mbase, MUSB_FADDR, qh->addr_reg);
 770
 771		/* protocol/endpoint/interval/NAKlimit */
 772		if (epnum) {
 773			musb_writeb(epio, MUSB_TXTYPE, qh->type_reg);
 774			if (musb->double_buffer_not_ok)
 775				musb_writew(epio, MUSB_TXMAXP,
 776						hw_ep->max_packet_sz_tx);
 777			else
 
 
 
 
 
 778				musb_writew(epio, MUSB_TXMAXP,
 779						qh->maxpacket |
 780						((qh->hb_mult - 1) << 11));
 
 781			musb_writeb(epio, MUSB_TXINTERVAL, qh->intv_reg);
 782		} else {
 783			musb_writeb(epio, MUSB_NAKLIMIT0, qh->intv_reg);
 784			if (musb->is_multipoint)
 785				musb_writeb(epio, MUSB_TYPE0,
 786						qh->type_reg);
 787		}
 788
 789		if (can_bulk_split(musb, qh->type))
 790			load_count = min((u32) hw_ep->max_packet_sz_tx,
 791						len);
 792		else
 793			load_count = min((u32) packet_sz, len);
 794
 795		if (dma_channel && musb_tx_dma_program(dma_controller,
 796					hw_ep, qh, urb, offset, len))
 797			load_count = 0;
 798
 799		if (load_count) {
 800			/* PIO to load FIFO */
 801			qh->segsize = load_count;
 802			musb_write_fifo(hw_ep, load_count, buf);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 803		}
 804
 805		/* re-enable interrupt */
 806		musb_writew(mbase, MUSB_INTRTXE, int_txe);
 807
 808	/* IN/receive */
 809	} else {
 810		u16	csr;
 811
 812		if (hw_ep->rx_reinit) {
 813			musb_rx_reinit(musb, qh, hw_ep);
 814
 815			/* init new state: toggle and NYET, maybe DMA later */
 816			if (usb_gettoggle(urb->dev, qh->epnum, 0))
 817				csr = MUSB_RXCSR_H_WR_DATATOGGLE
 818					| MUSB_RXCSR_H_DATATOGGLE;
 819			else
 820				csr = 0;
 821			if (qh->type == USB_ENDPOINT_XFER_INT)
 822				csr |= MUSB_RXCSR_DISNYET;
 823
 824		} else {
 825			csr = musb_readw(hw_ep->regs, MUSB_RXCSR);
 826
 827			if (csr & (MUSB_RXCSR_RXPKTRDY
 828					| MUSB_RXCSR_DMAENAB
 829					| MUSB_RXCSR_H_REQPKT))
 830				ERR("broken !rx_reinit, ep%d csr %04x\n",
 831						hw_ep->epnum, csr);
 832
 833			/* scrub any stale state, leaving toggle alone */
 834			csr &= MUSB_RXCSR_DISNYET;
 835		}
 836
 837		/* kick things off */
 838
 839		if ((is_cppi_enabled() || tusb_dma_omap()) && dma_channel) {
 840			/* Candidate for DMA */
 841			dma_channel->actual_len = 0L;
 842			qh->segsize = len;
 843
 844			/* AUTOREQ is in a DMA register */
 845			musb_writew(hw_ep->regs, MUSB_RXCSR, csr);
 846			csr = musb_readw(hw_ep->regs, MUSB_RXCSR);
 847
 848			/*
 849			 * Unless caller treats short RX transfers as
 850			 * errors, we dare not queue multiple transfers.
 851			 */
 852			dma_ok = dma_controller->channel_program(dma_channel,
 853					packet_sz, !(urb->transfer_flags &
 854						     URB_SHORT_NOT_OK),
 855					urb->transfer_dma + offset,
 856					qh->segsize);
 857			if (!dma_ok) {
 858				dma_controller->channel_release(dma_channel);
 859				hw_ep->rx_channel = dma_channel = NULL;
 860			} else
 861				csr |= MUSB_RXCSR_DMAENAB;
 862		}
 863
 864		csr |= MUSB_RXCSR_H_REQPKT;
 865		dev_dbg(musb->controller, "RXCSR%d := %04x\n", epnum, csr);
 866		musb_writew(hw_ep->regs, MUSB_RXCSR, csr);
 867		csr = musb_readw(hw_ep->regs, MUSB_RXCSR);
 868	}
 869}
 870
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 871
 872/*
 873 * Service the default endpoint (ep0) as host.
 874 * Return true until it's time to start the status stage.
 875 */
 876static bool musb_h_ep0_continue(struct musb *musb, u16 len, struct urb *urb)
 877{
 878	bool			 more = false;
 879	u8			*fifo_dest = NULL;
 880	u16			fifo_count = 0;
 881	struct musb_hw_ep	*hw_ep = musb->control_ep;
 882	struct musb_qh		*qh = hw_ep->in_qh;
 883	struct usb_ctrlrequest	*request;
 884
 885	switch (musb->ep0_stage) {
 886	case MUSB_EP0_IN:
 887		fifo_dest = urb->transfer_buffer + urb->actual_length;
 888		fifo_count = min_t(size_t, len, urb->transfer_buffer_length -
 889				   urb->actual_length);
 890		if (fifo_count < len)
 891			urb->status = -EOVERFLOW;
 892
 893		musb_read_fifo(hw_ep, fifo_count, fifo_dest);
 894
 895		urb->actual_length += fifo_count;
 896		if (len < qh->maxpacket) {
 897			/* always terminate on short read; it's
 898			 * rarely reported as an error.
 899			 */
 900		} else if (urb->actual_length <
 901				urb->transfer_buffer_length)
 902			more = true;
 903		break;
 904	case MUSB_EP0_START:
 905		request = (struct usb_ctrlrequest *) urb->setup_packet;
 906
 907		if (!request->wLength) {
 908			dev_dbg(musb->controller, "start no-DATA\n");
 909			break;
 910		} else if (request->bRequestType & USB_DIR_IN) {
 911			dev_dbg(musb->controller, "start IN-DATA\n");
 912			musb->ep0_stage = MUSB_EP0_IN;
 913			more = true;
 914			break;
 915		} else {
 916			dev_dbg(musb->controller, "start OUT-DATA\n");
 917			musb->ep0_stage = MUSB_EP0_OUT;
 918			more = true;
 919		}
 920		/* FALLTHROUGH */
 921	case MUSB_EP0_OUT:
 922		fifo_count = min_t(size_t, qh->maxpacket,
 923				   urb->transfer_buffer_length -
 924				   urb->actual_length);
 925		if (fifo_count) {
 926			fifo_dest = (u8 *) (urb->transfer_buffer
 927					+ urb->actual_length);
 928			dev_dbg(musb->controller, "Sending %d byte%s to ep0 fifo %p\n",
 929					fifo_count,
 930					(fifo_count == 1) ? "" : "s",
 931					fifo_dest);
 932			musb_write_fifo(hw_ep, fifo_count, fifo_dest);
 933
 934			urb->actual_length += fifo_count;
 935			more = true;
 936		}
 937		break;
 938	default:
 939		ERR("bogus ep0 stage %d\n", musb->ep0_stage);
 940		break;
 941	}
 942
 943	return more;
 944}
 945
 946/*
 947 * Handle default endpoint interrupt as host. Only called in IRQ time
 948 * from musb_interrupt().
 949 *
 950 * called with controller irqlocked
 951 */
 952irqreturn_t musb_h_ep0_irq(struct musb *musb)
 953{
 954	struct urb		*urb;
 955	u16			csr, len;
 956	int			status = 0;
 957	void __iomem		*mbase = musb->mregs;
 958	struct musb_hw_ep	*hw_ep = musb->control_ep;
 959	void __iomem		*epio = hw_ep->regs;
 960	struct musb_qh		*qh = hw_ep->in_qh;
 961	bool			complete = false;
 962	irqreturn_t		retval = IRQ_NONE;
 963
 964	/* ep0 only has one queue, "in" */
 965	urb = next_urb(qh);
 966
 967	musb_ep_select(mbase, 0);
 968	csr = musb_readw(epio, MUSB_CSR0);
 969	len = (csr & MUSB_CSR0_RXPKTRDY)
 970			? musb_readb(epio, MUSB_COUNT0)
 971			: 0;
 972
 973	dev_dbg(musb->controller, "<== csr0 %04x, qh %p, count %d, urb %p, stage %d\n",
 974		csr, qh, len, urb, musb->ep0_stage);
 975
 976	/* if we just did status stage, we are done */
 977	if (MUSB_EP0_STATUS == musb->ep0_stage) {
 978		retval = IRQ_HANDLED;
 979		complete = true;
 980	}
 981
 982	/* prepare status */
 983	if (csr & MUSB_CSR0_H_RXSTALL) {
 984		dev_dbg(musb->controller, "STALLING ENDPOINT\n");
 985		status = -EPIPE;
 986
 987	} else if (csr & MUSB_CSR0_H_ERROR) {
 988		dev_dbg(musb->controller, "no response, csr0 %04x\n", csr);
 989		status = -EPROTO;
 990
 991	} else if (csr & MUSB_CSR0_H_NAKTIMEOUT) {
 992		dev_dbg(musb->controller, "control NAK timeout\n");
 993
 994		/* NOTE:  this code path would be a good place to PAUSE a
 995		 * control transfer, if another one is queued, so that
 996		 * ep0 is more likely to stay busy.  That's already done
 997		 * for bulk RX transfers.
 998		 *
 999		 * if (qh->ring.next != &musb->control), then
1000		 * we have a candidate... NAKing is *NOT* an error
1001		 */
1002		musb_writew(epio, MUSB_CSR0, 0);
1003		retval = IRQ_HANDLED;
1004	}
1005
1006	if (status) {
1007		dev_dbg(musb->controller, "aborting\n");
1008		retval = IRQ_HANDLED;
1009		if (urb)
1010			urb->status = status;
1011		complete = true;
1012
1013		/* use the proper sequence to abort the transfer */
1014		if (csr & MUSB_CSR0_H_REQPKT) {
1015			csr &= ~MUSB_CSR0_H_REQPKT;
1016			musb_writew(epio, MUSB_CSR0, csr);
1017			csr &= ~MUSB_CSR0_H_NAKTIMEOUT;
1018			musb_writew(epio, MUSB_CSR0, csr);
1019		} else {
1020			musb_h_ep0_flush_fifo(hw_ep);
1021		}
1022
1023		musb_writeb(epio, MUSB_NAKLIMIT0, 0);
1024
1025		/* clear it */
1026		musb_writew(epio, MUSB_CSR0, 0);
1027	}
1028
1029	if (unlikely(!urb)) {
1030		/* stop endpoint since we have no place for its data, this
1031		 * SHOULD NEVER HAPPEN! */
1032		ERR("no URB for end 0\n");
1033
1034		musb_h_ep0_flush_fifo(hw_ep);
1035		goto done;
1036	}
1037
1038	if (!complete) {
1039		/* call common logic and prepare response */
1040		if (musb_h_ep0_continue(musb, len, urb)) {
1041			/* more packets required */
1042			csr = (MUSB_EP0_IN == musb->ep0_stage)
1043				?  MUSB_CSR0_H_REQPKT : MUSB_CSR0_TXPKTRDY;
1044		} else {
1045			/* data transfer complete; perform status phase */
1046			if (usb_pipeout(urb->pipe)
1047					|| !urb->transfer_buffer_length)
1048				csr = MUSB_CSR0_H_STATUSPKT
1049					| MUSB_CSR0_H_REQPKT;
1050			else
1051				csr = MUSB_CSR0_H_STATUSPKT
1052					| MUSB_CSR0_TXPKTRDY;
1053
 
 
 
1054			/* flag status stage */
1055			musb->ep0_stage = MUSB_EP0_STATUS;
1056
1057			dev_dbg(musb->controller, "ep0 STATUS, csr %04x\n", csr);
1058
1059		}
1060		musb_writew(epio, MUSB_CSR0, csr);
1061		retval = IRQ_HANDLED;
1062	} else
1063		musb->ep0_stage = MUSB_EP0_IDLE;
1064
1065	/* call completion handler if done */
1066	if (complete)
1067		musb_advance_schedule(musb, urb, hw_ep, 1);
1068done:
1069	return retval;
1070}
1071
1072
1073#ifdef CONFIG_USB_INVENTRA_DMA
1074
1075/* Host side TX (OUT) using Mentor DMA works as follows:
1076	submit_urb ->
1077		- if queue was empty, Program Endpoint
1078		- ... which starts DMA to fifo in mode 1 or 0
1079
1080	DMA Isr (transfer complete) -> TxAvail()
1081		- Stop DMA (~DmaEnab)	(<--- Alert ... currently happens
1082					only in musb_cleanup_urb)
1083		- TxPktRdy has to be set in mode 0 or for
1084			short packets in mode 1.
1085*/
1086
1087#endif
1088
1089/* Service a Tx-Available or dma completion irq for the endpoint */
1090void musb_host_tx(struct musb *musb, u8 epnum)
1091{
1092	int			pipe;
1093	bool			done = false;
1094	u16			tx_csr;
1095	size_t			length = 0;
1096	size_t			offset = 0;
1097	struct musb_hw_ep	*hw_ep = musb->endpoints + epnum;
1098	void __iomem		*epio = hw_ep->regs;
1099	struct musb_qh		*qh = hw_ep->out_qh;
1100	struct urb		*urb = next_urb(qh);
1101	u32			status = 0;
1102	void __iomem		*mbase = musb->mregs;
1103	struct dma_channel	*dma;
1104	bool			transfer_pending = false;
1105
1106	musb_ep_select(mbase, epnum);
1107	tx_csr = musb_readw(epio, MUSB_TXCSR);
1108
1109	/* with CPPI, DMA sometimes triggers "extra" irqs */
1110	if (!urb) {
1111		dev_dbg(musb->controller, "extra TX%d ready, csr %04x\n", epnum, tx_csr);
1112		return;
1113	}
1114
1115	pipe = urb->pipe;
1116	dma = is_dma_capable() ? hw_ep->tx_channel : NULL;
1117	dev_dbg(musb->controller, "OUT/TX%d end, csr %04x%s\n", epnum, tx_csr,
1118			dma ? ", dma" : "");
1119
1120	/* check for errors */
1121	if (tx_csr & MUSB_TXCSR_H_RXSTALL) {
1122		/* dma was disabled, fifo flushed */
1123		dev_dbg(musb->controller, "TX end %d stall\n", epnum);
1124
1125		/* stall; record URB status */
1126		status = -EPIPE;
1127
1128	} else if (tx_csr & MUSB_TXCSR_H_ERROR) {
1129		/* (NON-ISO) dma was disabled, fifo flushed */
1130		dev_dbg(musb->controller, "TX 3strikes on ep=%d\n", epnum);
1131
1132		status = -ETIMEDOUT;
1133
1134	} else if (tx_csr & MUSB_TXCSR_H_NAKTIMEOUT) {
1135		dev_dbg(musb->controller, "TX end=%d device not responding\n", epnum);
1136
1137		/* NOTE:  this code path would be a good place to PAUSE a
1138		 * transfer, if there's some other (nonperiodic) tx urb
1139		 * that could use this fifo.  (dma complicates it...)
1140		 * That's already done for bulk RX transfers.
1141		 *
1142		 * if (bulk && qh->ring.next != &musb->out_bulk), then
1143		 * we have a candidate... NAKing is *NOT* an error
1144		 */
1145		musb_ep_select(mbase, epnum);
1146		musb_writew(epio, MUSB_TXCSR,
1147				MUSB_TXCSR_H_WZC_BITS
1148				| MUSB_TXCSR_TXPKTRDY);
1149		return;
 
 
 
 
 
 
 
1150	}
1151
 
1152	if (status) {
1153		if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
1154			dma->status = MUSB_DMA_STATUS_CORE_ABORT;
1155			(void) musb->dma_controller->channel_abort(dma);
1156		}
1157
1158		/* do the proper sequence to abort the transfer in the
1159		 * usb core; the dma engine should already be stopped.
1160		 */
1161		musb_h_tx_flush_fifo(hw_ep);
1162		tx_csr &= ~(MUSB_TXCSR_AUTOSET
1163				| MUSB_TXCSR_DMAENAB
1164				| MUSB_TXCSR_H_ERROR
1165				| MUSB_TXCSR_H_RXSTALL
1166				| MUSB_TXCSR_H_NAKTIMEOUT
1167				);
1168
1169		musb_ep_select(mbase, epnum);
1170		musb_writew(epio, MUSB_TXCSR, tx_csr);
1171		/* REVISIT may need to clear FLUSHFIFO ... */
1172		musb_writew(epio, MUSB_TXCSR, tx_csr);
1173		musb_writeb(epio, MUSB_TXINTERVAL, 0);
1174
1175		done = true;
1176	}
1177
1178	/* second cppi case */
1179	if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
1180		dev_dbg(musb->controller, "extra TX%d ready, csr %04x\n", epnum, tx_csr);
1181		return;
1182	}
1183
1184	if (is_dma_capable() && dma && !status) {
1185		/*
1186		 * DMA has completed.  But if we're using DMA mode 1 (multi
1187		 * packet DMA), we need a terminal TXPKTRDY interrupt before
1188		 * we can consider this transfer completed, lest we trash
1189		 * its last packet when writing the next URB's data.  So we
1190		 * switch back to mode 0 to get that interrupt; we'll come
1191		 * back here once it happens.
1192		 */
1193		if (tx_csr & MUSB_TXCSR_DMAMODE) {
1194			/*
1195			 * We shouldn't clear DMAMODE with DMAENAB set; so
1196			 * clear them in a safe order.  That should be OK
1197			 * once TXPKTRDY has been set (and I've never seen
1198			 * it being 0 at this moment -- DMA interrupt latency
1199			 * is significant) but if it hasn't been then we have
1200			 * no choice but to stop being polite and ignore the
1201			 * programmer's guide... :-)
1202			 *
1203			 * Note that we must write TXCSR with TXPKTRDY cleared
1204			 * in order not to re-trigger the packet send (this bit
1205			 * can't be cleared by CPU), and there's another caveat:
1206			 * TXPKTRDY may be set shortly and then cleared in the
1207			 * double-buffered FIFO mode, so we do an extra TXCSR
1208			 * read for debouncing...
1209			 */
1210			tx_csr &= musb_readw(epio, MUSB_TXCSR);
1211			if (tx_csr & MUSB_TXCSR_TXPKTRDY) {
1212				tx_csr &= ~(MUSB_TXCSR_DMAENAB |
1213					    MUSB_TXCSR_TXPKTRDY);
1214				musb_writew(epio, MUSB_TXCSR,
1215					    tx_csr | MUSB_TXCSR_H_WZC_BITS);
1216			}
1217			tx_csr &= ~(MUSB_TXCSR_DMAMODE |
1218				    MUSB_TXCSR_TXPKTRDY);
1219			musb_writew(epio, MUSB_TXCSR,
1220				    tx_csr | MUSB_TXCSR_H_WZC_BITS);
1221
1222			/*
1223			 * There is no guarantee that we'll get an interrupt
1224			 * after clearing DMAMODE as we might have done this
1225			 * too late (after TXPKTRDY was cleared by controller).
1226			 * Re-read TXCSR as we have spoiled its previous value.
1227			 */
1228			tx_csr = musb_readw(epio, MUSB_TXCSR);
1229		}
1230
1231		/*
1232		 * We may get here from a DMA completion or TXPKTRDY interrupt.
1233		 * In any case, we must check the FIFO status here and bail out
1234		 * only if the FIFO still has data -- that should prevent the
1235		 * "missed" TXPKTRDY interrupts and deal with double-buffered
1236		 * FIFO mode too...
1237		 */
1238		if (tx_csr & (MUSB_TXCSR_FIFONOTEMPTY | MUSB_TXCSR_TXPKTRDY)) {
1239			dev_dbg(musb->controller, "DMA complete but packet still in FIFO, "
1240			    "CSR %04x\n", tx_csr);
1241			return;
1242		}
1243	}
1244
1245	if (!status || dma || usb_pipeisoc(pipe)) {
1246		if (dma)
1247			length = dma->actual_len;
1248		else
1249			length = qh->segsize;
1250		qh->offset += length;
1251
1252		if (usb_pipeisoc(pipe)) {
1253			struct usb_iso_packet_descriptor	*d;
1254
1255			d = urb->iso_frame_desc + qh->iso_idx;
1256			d->actual_length = length;
1257			d->status = status;
1258			if (++qh->iso_idx >= urb->number_of_packets) {
1259				done = true;
1260			} else {
1261				d++;
1262				offset = d->offset;
1263				length = d->length;
1264			}
1265		} else if (dma && urb->transfer_buffer_length == qh->offset) {
1266			done = true;
1267		} else {
1268			/* see if we need to send more data, or ZLP */
1269			if (qh->segsize < qh->maxpacket)
1270				done = true;
1271			else if (qh->offset == urb->transfer_buffer_length
1272					&& !(urb->transfer_flags
1273						& URB_ZERO_PACKET))
1274				done = true;
1275			if (!done) {
1276				offset = qh->offset;
1277				length = urb->transfer_buffer_length - offset;
1278				transfer_pending = true;
1279			}
1280		}
1281	}
1282
1283	/* urb->status != -EINPROGRESS means request has been faulted,
1284	 * so we must abort this transfer after cleanup
1285	 */
1286	if (urb->status != -EINPROGRESS) {
1287		done = true;
1288		if (status == 0)
1289			status = urb->status;
1290	}
1291
1292	if (done) {
1293		/* set status */
1294		urb->status = status;
1295		urb->actual_length = qh->offset;
1296		musb_advance_schedule(musb, urb, hw_ep, USB_DIR_OUT);
1297		return;
1298	} else if ((usb_pipeisoc(pipe) || transfer_pending) && dma) {
1299		if (musb_tx_dma_program(musb->dma_controller, hw_ep, qh, urb,
1300				offset, length)) {
1301			if (is_cppi_enabled() || tusb_dma_omap())
1302				musb_h_tx_dma_start(hw_ep);
1303			return;
1304		}
1305	} else	if (tx_csr & MUSB_TXCSR_DMAENAB) {
1306		dev_dbg(musb->controller, "not complete, but DMA enabled?\n");
1307		return;
1308	}
1309
1310	/*
1311	 * PIO: start next packet in this URB.
1312	 *
1313	 * REVISIT: some docs say that when hw_ep->tx_double_buffered,
1314	 * (and presumably, FIFO is not half-full) we should write *two*
1315	 * packets before updating TXCSR; other docs disagree...
1316	 */
1317	if (length > qh->maxpacket)
1318		length = qh->maxpacket;
1319	/* Unmap the buffer so that CPU can use it */
1320	usb_hcd_unmap_urb_for_dma(musb_to_hcd(musb), urb);
1321	musb_write_fifo(hw_ep, length, urb->transfer_buffer + offset);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1322	qh->segsize = length;
1323
 
 
 
 
 
1324	musb_ep_select(mbase, epnum);
1325	musb_writew(epio, MUSB_TXCSR,
1326			MUSB_TXCSR_H_WZC_BITS | MUSB_TXCSR_TXPKTRDY);
1327}
1328
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1329
1330#ifdef CONFIG_USB_INVENTRA_DMA
 
1331
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1332/* Host side RX (IN) using Mentor DMA works as follows:
1333	submit_urb ->
1334		- if queue was empty, ProgramEndpoint
1335		- first IN token is sent out (by setting ReqPkt)
1336	LinuxIsr -> RxReady()
1337	/\	=> first packet is received
1338	|	- Set in mode 0 (DmaEnab, ~ReqPkt)
1339	|		-> DMA Isr (transfer complete) -> RxReady()
1340	|		    - Ack receive (~RxPktRdy), turn off DMA (~DmaEnab)
1341	|		    - if urb not complete, send next IN token (ReqPkt)
1342	|			   |		else complete urb.
1343	|			   |
1344	---------------------------
1345 *
1346 * Nuances of mode 1:
1347 *	For short packets, no ack (+RxPktRdy) is sent automatically
1348 *	(even if AutoClear is ON)
1349 *	For full packets, ack (~RxPktRdy) and next IN token (+ReqPkt) is sent
1350 *	automatically => major problem, as collecting the next packet becomes
1351 *	difficult. Hence mode 1 is not used.
1352 *
1353 * REVISIT
1354 *	All we care about at this driver level is that
1355 *       (a) all URBs terminate with REQPKT cleared and fifo(s) empty;
1356 *       (b) termination conditions are: short RX, or buffer full;
1357 *       (c) fault modes include
1358 *           - iff URB_SHORT_NOT_OK, short RX status is -EREMOTEIO.
1359 *             (and that endpoint's dma queue stops immediately)
1360 *           - overflow (full, PLUS more bytes in the terminal packet)
1361 *
1362 *	So for example, usb-storage sets URB_SHORT_NOT_OK, and would
1363 *	thus be a great candidate for using mode 1 ... for all but the
1364 *	last packet of one URB's transfer.
1365 */
 
 
 
 
 
 
 
 
 
 
 
1366
1367#endif
1368
1369/* Schedule next QH from musb->in_bulk and move the current qh to
1370 * the end; avoids starvation for other endpoints.
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1371 */
1372static void musb_bulk_rx_nak_timeout(struct musb *musb, struct musb_hw_ep *ep)
1373{
1374	struct dma_channel	*dma;
1375	struct urb		*urb;
1376	void __iomem		*mbase = musb->mregs;
1377	void __iomem		*epio = ep->regs;
1378	struct musb_qh		*cur_qh, *next_qh;
1379	u16			rx_csr;
 
 
 
 
 
1380
1381	musb_ep_select(mbase, ep->epnum);
1382	dma = is_dma_capable() ? ep->rx_channel : NULL;
1383
1384	/* clear nak timeout bit */
1385	rx_csr = musb_readw(epio, MUSB_RXCSR);
1386	rx_csr |= MUSB_RXCSR_H_WZC_BITS;
1387	rx_csr &= ~MUSB_RXCSR_DATAERROR;
1388	musb_writew(epio, MUSB_RXCSR, rx_csr);
1389
1390	cur_qh = first_qh(&musb->in_bulk);
1391	if (cur_qh) {
1392		urb = next_urb(cur_qh);
1393		if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
1394			dma->status = MUSB_DMA_STATUS_CORE_ABORT;
1395			musb->dma_controller->channel_abort(dma);
1396			urb->actual_length += dma->actual_len;
1397			dma->actual_len = 0L;
1398		}
1399		musb_save_toggle(cur_qh, 1, urb);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1400
1401		/* move cur_qh to end of queue */
1402		list_move_tail(&cur_qh->ring, &musb->in_bulk);
 
1403
1404		/* get the next qh from musb->in_bulk */
1405		next_qh = first_qh(&musb->in_bulk);
 
 
 
1406
1407		/* set rx_reinit and schedule the next qh */
1408		ep->rx_reinit = 1;
1409		musb_start_urb(musb, 1, next_qh);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1410	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1411}
 
1412
1413/*
1414 * Service an RX interrupt for the given IN endpoint; docs cover bulk, iso,
1415 * and high-bandwidth IN transfer cases.
1416 */
1417void musb_host_rx(struct musb *musb, u8 epnum)
1418{
1419	struct urb		*urb;
1420	struct musb_hw_ep	*hw_ep = musb->endpoints + epnum;
 
1421	void __iomem		*epio = hw_ep->regs;
1422	struct musb_qh		*qh = hw_ep->in_qh;
1423	size_t			xfer_len;
1424	void __iomem		*mbase = musb->mregs;
1425	int			pipe;
1426	u16			rx_csr, val;
1427	bool			iso_err = false;
1428	bool			done = false;
1429	u32			status;
1430	struct dma_channel	*dma;
 
1431
1432	musb_ep_select(mbase, epnum);
1433
1434	urb = next_urb(qh);
1435	dma = is_dma_capable() ? hw_ep->rx_channel : NULL;
1436	status = 0;
1437	xfer_len = 0;
1438
1439	rx_csr = musb_readw(epio, MUSB_RXCSR);
1440	val = rx_csr;
1441
1442	if (unlikely(!urb)) {
1443		/* REVISIT -- THIS SHOULD NEVER HAPPEN ... but, at least
1444		 * usbtest #11 (unlinks) triggers it regularly, sometimes
1445		 * with fifo full.  (Only with DMA??)
1446		 */
1447		dev_dbg(musb->controller, "BOGUS RX%d ready, csr %04x, count %d\n", epnum, val,
1448			musb_readw(epio, MUSB_RXCOUNT));
1449		musb_h_flush_rxfifo(hw_ep, MUSB_RXCSR_CLRDATATOG);
1450		return;
1451	}
1452
1453	pipe = urb->pipe;
1454
1455	dev_dbg(musb->controller, "<== hw %d rxcsr %04x, urb actual %d (+dma %zu)\n",
1456		epnum, rx_csr, urb->actual_length,
1457		dma ? dma->actual_len : 0);
1458
1459	/* check for errors, concurrent stall & unlink is not really
1460	 * handled yet! */
1461	if (rx_csr & MUSB_RXCSR_H_RXSTALL) {
1462		dev_dbg(musb->controller, "RX end %d STALL\n", epnum);
1463
1464		/* stall; record URB status */
1465		status = -EPIPE;
1466
1467	} else if (rx_csr & MUSB_RXCSR_H_ERROR) {
1468		dev_dbg(musb->controller, "end %d RX proto error\n", epnum);
1469
1470		status = -EPROTO;
1471		musb_writeb(epio, MUSB_RXINTERVAL, 0);
1472
1473	} else if (rx_csr & MUSB_RXCSR_DATAERROR) {
1474
1475		if (USB_ENDPOINT_XFER_ISOC != qh->type) {
1476			dev_dbg(musb->controller, "RX end %d NAK timeout\n", epnum);
1477
1478			/* NOTE: NAKing is *NOT* an error, so we want to
1479			 * continue.  Except ... if there's a request for
1480			 * another QH, use that instead of starving it.
1481			 *
1482			 * Devices like Ethernet and serial adapters keep
1483			 * reads posted at all times, which will starve
1484			 * other devices without this logic.
1485			 */
1486			if (usb_pipebulk(urb->pipe)
1487					&& qh->mux == 1
1488					&& !list_is_singular(&musb->in_bulk)) {
1489				musb_bulk_rx_nak_timeout(musb, hw_ep);
1490				return;
1491			}
1492			musb_ep_select(mbase, epnum);
1493			rx_csr |= MUSB_RXCSR_H_WZC_BITS;
1494			rx_csr &= ~MUSB_RXCSR_DATAERROR;
1495			musb_writew(epio, MUSB_RXCSR, rx_csr);
1496
1497			goto finish;
1498		} else {
1499			dev_dbg(musb->controller, "RX end %d ISO data error\n", epnum);
1500			/* packet error reported later */
1501			iso_err = true;
1502		}
1503	} else if (rx_csr & MUSB_RXCSR_INCOMPRX) {
1504		dev_dbg(musb->controller, "end %d high bandwidth incomplete ISO packet RX\n",
1505				epnum);
1506		status = -EPROTO;
1507	}
1508
1509	/* faults abort the transfer */
1510	if (status) {
1511		/* clean up dma and collect transfer count */
1512		if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
1513			dma->status = MUSB_DMA_STATUS_CORE_ABORT;
1514			(void) musb->dma_controller->channel_abort(dma);
1515			xfer_len = dma->actual_len;
1516		}
1517		musb_h_flush_rxfifo(hw_ep, MUSB_RXCSR_CLRDATATOG);
1518		musb_writeb(epio, MUSB_RXINTERVAL, 0);
1519		done = true;
1520		goto finish;
1521	}
1522
1523	if (unlikely(dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY)) {
1524		/* SHOULD NEVER HAPPEN ... but at least DaVinci has done it */
1525		ERR("RX%d dma busy, csr %04x\n", epnum, rx_csr);
1526		goto finish;
1527	}
1528
1529	/* thorough shutdown for now ... given more precise fault handling
1530	 * and better queueing support, we might keep a DMA pipeline going
1531	 * while processing this irq for earlier completions.
1532	 */
1533
1534	/* FIXME this is _way_ too much in-line logic for Mentor DMA */
1535
1536#ifndef CONFIG_USB_INVENTRA_DMA
1537	if (rx_csr & MUSB_RXCSR_H_REQPKT)  {
1538		/* REVISIT this happened for a while on some short reads...
1539		 * the cleanup still needs investigation... looks bad...
1540		 * and also duplicates dma cleanup code above ... plus,
1541		 * shouldn't this be the "half full" double buffer case?
1542		 */
1543		if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
1544			dma->status = MUSB_DMA_STATUS_CORE_ABORT;
1545			(void) musb->dma_controller->channel_abort(dma);
1546			xfer_len = dma->actual_len;
1547			done = true;
1548		}
1549
1550		dev_dbg(musb->controller, "RXCSR%d %04x, reqpkt, len %zu%s\n", epnum, rx_csr,
1551				xfer_len, dma ? ", dma" : "");
1552		rx_csr &= ~MUSB_RXCSR_H_REQPKT;
1553
1554		musb_ep_select(mbase, epnum);
1555		musb_writew(epio, MUSB_RXCSR,
1556				MUSB_RXCSR_H_WZC_BITS | rx_csr);
1557	}
1558#endif
1559	if (dma && (rx_csr & MUSB_RXCSR_DMAENAB)) {
1560		xfer_len = dma->actual_len;
1561
1562		val &= ~(MUSB_RXCSR_DMAENAB
1563			| MUSB_RXCSR_H_AUTOREQ
1564			| MUSB_RXCSR_AUTOCLEAR
1565			| MUSB_RXCSR_RXPKTRDY);
1566		musb_writew(hw_ep->regs, MUSB_RXCSR, val);
1567
1568#ifdef CONFIG_USB_INVENTRA_DMA
1569		if (usb_pipeisoc(pipe)) {
1570			struct usb_iso_packet_descriptor *d;
1571
1572			d = urb->iso_frame_desc + qh->iso_idx;
1573			d->actual_length = xfer_len;
1574
1575			/* even if there was an error, we did the dma
1576			 * for iso_frame_desc->length
1577			 */
1578			if (d->status != -EILSEQ && d->status != -EOVERFLOW)
1579				d->status = 0;
1580
1581			if (++qh->iso_idx >= urb->number_of_packets)
1582				done = true;
1583			else
1584				done = false;
1585
1586		} else  {
1587		/* done if urb buffer is full or short packet is recd */
1588		done = (urb->actual_length + xfer_len >=
1589				urb->transfer_buffer_length
1590			|| dma->actual_len < qh->maxpacket);
1591		}
1592
1593		/* send IN token for next packet, without AUTOREQ */
1594		if (!done) {
1595			val |= MUSB_RXCSR_H_REQPKT;
1596			musb_writew(epio, MUSB_RXCSR,
1597				MUSB_RXCSR_H_WZC_BITS | val);
1598		}
1599
1600		dev_dbg(musb->controller, "ep %d dma %s, rxcsr %04x, rxcount %d\n", epnum,
1601			done ? "off" : "reset",
1602			musb_readw(epio, MUSB_RXCSR),
1603			musb_readw(epio, MUSB_RXCOUNT));
1604#else
1605		done = true;
1606#endif
1607	} else if (urb->status == -EINPROGRESS) {
1608		/* if no errors, be sure a packet is ready for unloading */
1609		if (unlikely(!(rx_csr & MUSB_RXCSR_RXPKTRDY))) {
1610			status = -EPROTO;
1611			ERR("Rx interrupt with no errors or packet!\n");
1612
1613			/* FIXME this is another "SHOULD NEVER HAPPEN" */
1614
1615/* SCRUB (RX) */
1616			/* do the proper sequence to abort the transfer */
1617			musb_ep_select(mbase, epnum);
1618			val &= ~MUSB_RXCSR_H_REQPKT;
1619			musb_writew(epio, MUSB_RXCSR, val);
1620			goto finish;
1621		}
1622
1623		/* we are expecting IN packets */
1624#ifdef CONFIG_USB_INVENTRA_DMA
1625		if (dma) {
1626			struct dma_controller	*c;
1627			u16			rx_count;
1628			int			ret, length;
1629			dma_addr_t		buf;
1630
1631			rx_count = musb_readw(epio, MUSB_RXCOUNT);
1632
1633			dev_dbg(musb->controller, "RX%d count %d, buffer 0x%x len %d/%d\n",
1634					epnum, rx_count,
1635					urb->transfer_dma
1636						+ urb->actual_length,
1637					qh->offset,
1638					urb->transfer_buffer_length);
1639
1640			c = musb->dma_controller;
1641
1642			if (usb_pipeisoc(pipe)) {
1643				int d_status = 0;
1644				struct usb_iso_packet_descriptor *d;
1645
1646				d = urb->iso_frame_desc + qh->iso_idx;
1647
1648				if (iso_err) {
1649					d_status = -EILSEQ;
1650					urb->error_count++;
1651				}
1652				if (rx_count > d->length) {
1653					if (d_status == 0) {
1654						d_status = -EOVERFLOW;
1655						urb->error_count++;
1656					}
1657					dev_dbg(musb->controller, "** OVERFLOW %d into %d\n",\
1658					    rx_count, d->length);
1659
1660					length = d->length;
1661				} else
1662					length = rx_count;
1663				d->status = d_status;
1664				buf = urb->transfer_dma + d->offset;
1665			} else {
1666				length = rx_count;
1667				buf = urb->transfer_dma +
1668						urb->actual_length;
1669			}
1670
1671			dma->desired_mode = 0;
1672#ifdef USE_MODE1
1673			/* because of the issue below, mode 1 will
1674			 * only rarely behave with correct semantics.
1675			 */
1676			if ((urb->transfer_flags &
1677						URB_SHORT_NOT_OK)
1678				&& (urb->transfer_buffer_length -
1679						urb->actual_length)
1680					> qh->maxpacket)
1681				dma->desired_mode = 1;
1682			if (rx_count < hw_ep->max_packet_sz_rx) {
1683				length = rx_count;
1684				dma->desired_mode = 0;
1685			} else {
1686				length = urb->transfer_buffer_length;
1687			}
1688#endif
1689
1690/* Disadvantage of using mode 1:
1691 *	It's basically usable only for mass storage class; essentially all
1692 *	other protocols also terminate transfers on short packets.
1693 *
1694 * Details:
1695 *	An extra IN token is sent at the end of the transfer (due to AUTOREQ)
1696 *	If you try to use mode 1 for (transfer_buffer_length - 512), and try
1697 *	to use the extra IN token to grab the last packet using mode 0, then
1698 *	the problem is that you cannot be sure when the device will send the
1699 *	last packet and RxPktRdy set. Sometimes the packet is recd too soon
1700 *	such that it gets lost when RxCSR is re-set at the end of the mode 1
1701 *	transfer, while sometimes it is recd just a little late so that if you
1702 *	try to configure for mode 0 soon after the mode 1 transfer is
1703 *	completed, you will find rxcount 0. Okay, so you might think why not
1704 *	wait for an interrupt when the pkt is recd. Well, you won't get any!
1705 */
1706
1707			val = musb_readw(epio, MUSB_RXCSR);
1708			val &= ~MUSB_RXCSR_H_REQPKT;
1709
1710			if (dma->desired_mode == 0)
1711				val &= ~MUSB_RXCSR_H_AUTOREQ;
1712			else
1713				val |= MUSB_RXCSR_H_AUTOREQ;
1714			val |= MUSB_RXCSR_DMAENAB;
1715
1716			/* autoclear shouldn't be set in high bandwidth */
1717			if (qh->hb_mult == 1)
1718				val |= MUSB_RXCSR_AUTOCLEAR;
1719
1720			musb_writew(epio, MUSB_RXCSR,
1721				MUSB_RXCSR_H_WZC_BITS | val);
1722
1723			/* REVISIT if when actual_length != 0,
1724			 * transfer_buffer_length needs to be
1725			 * adjusted first...
1726			 */
1727			ret = c->channel_program(
1728				dma, qh->maxpacket,
1729				dma->desired_mode, buf, length);
1730
1731			if (!ret) {
1732				c->channel_release(dma);
1733				hw_ep->rx_channel = NULL;
1734				dma = NULL;
1735				/* REVISIT reset CSR */
1736			}
1737		}
1738#endif	/* Mentor DMA */
1739
1740		if (!dma) {
1741			/* Unmap the buffer so that CPU can use it */
1742			usb_hcd_unmap_urb_for_dma(musb_to_hcd(musb), urb);
1743			done = musb_host_packet_rx(musb, urb,
1744					epnum, iso_err);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1745			dev_dbg(musb->controller, "read %spacket\n", done ? "last " : "");
1746		}
1747	}
1748
1749finish:
1750	urb->actual_length += xfer_len;
1751	qh->offset += xfer_len;
1752	if (done) {
 
 
 
1753		if (urb->status == -EINPROGRESS)
1754			urb->status = status;
1755		musb_advance_schedule(musb, urb, hw_ep, USB_DIR_IN);
1756	}
1757}
1758
1759/* schedule nodes correspond to peripheral endpoints, like an OHCI QH.
1760 * the software schedule associates multiple such nodes with a given
1761 * host side hardware endpoint + direction; scheduling may activate
1762 * that hardware endpoint.
1763 */
1764static int musb_schedule(
1765	struct musb		*musb,
1766	struct musb_qh		*qh,
1767	int			is_in)
1768{
1769	int			idle;
1770	int			best_diff;
1771	int			best_end, epnum;
1772	struct musb_hw_ep	*hw_ep = NULL;
1773	struct list_head	*head = NULL;
1774	u8			toggle;
1775	u8			txtype;
1776	struct urb		*urb = next_urb(qh);
1777
1778	/* use fixed hardware for control and bulk */
1779	if (qh->type == USB_ENDPOINT_XFER_CONTROL) {
1780		head = &musb->control;
1781		hw_ep = musb->control_ep;
1782		goto success;
1783	}
1784
1785	/* else, periodic transfers get muxed to other endpoints */
1786
1787	/*
1788	 * We know this qh hasn't been scheduled, so all we need to do
1789	 * is choose which hardware endpoint to put it on ...
1790	 *
1791	 * REVISIT what we really want here is a regular schedule tree
1792	 * like e.g. OHCI uses.
1793	 */
1794	best_diff = 4096;
1795	best_end = -1;
1796
1797	for (epnum = 1, hw_ep = musb->endpoints + 1;
1798			epnum < musb->nr_endpoints;
1799			epnum++, hw_ep++) {
1800		int	diff;
1801
1802		if (musb_ep_get_qh(hw_ep, is_in) != NULL)
1803			continue;
1804
1805		if (hw_ep == musb->bulk_ep)
1806			continue;
1807
1808		if (is_in)
1809			diff = hw_ep->max_packet_sz_rx;
1810		else
1811			diff = hw_ep->max_packet_sz_tx;
1812		diff -= (qh->maxpacket * qh->hb_mult);
1813
1814		if (diff >= 0 && best_diff > diff) {
1815
1816			/*
1817			 * Mentor controller has a bug in that if we schedule
1818			 * a BULK Tx transfer on an endpoint that had earlier
1819			 * handled ISOC then the BULK transfer has to start on
1820			 * a zero toggle.  If the BULK transfer starts on a 1
1821			 * toggle then this transfer will fail as the mentor
1822			 * controller starts the Bulk transfer on a 0 toggle
1823			 * irrespective of the programming of the toggle bits
1824			 * in the TXCSR register.  Check for this condition
1825			 * while allocating the EP for a Tx Bulk transfer.  If
1826			 * so skip this EP.
1827			 */
1828			hw_ep = musb->endpoints + epnum;
1829			toggle = usb_gettoggle(urb->dev, qh->epnum, !is_in);
1830			txtype = (musb_readb(hw_ep->regs, MUSB_TXTYPE)
1831					>> 4) & 0x3;
1832			if (!is_in && (qh->type == USB_ENDPOINT_XFER_BULK) &&
1833				toggle && (txtype == USB_ENDPOINT_XFER_ISOC))
1834				continue;
1835
1836			best_diff = diff;
1837			best_end = epnum;
1838		}
1839	}
1840	/* use bulk reserved ep1 if no other ep is free */
1841	if (best_end < 0 && qh->type == USB_ENDPOINT_XFER_BULK) {
1842		hw_ep = musb->bulk_ep;
1843		if (is_in)
1844			head = &musb->in_bulk;
1845		else
1846			head = &musb->out_bulk;
1847
1848		/* Enable bulk RX NAK timeout scheme when bulk requests are
1849		 * multiplexed.  This scheme doen't work in high speed to full
1850		 * speed scenario as NAK interrupts are not coming from a
1851		 * full speed device connected to a high speed device.
1852		 * NAK timeout interval is 8 (128 uframe or 16ms) for HS and
1853		 * 4 (8 frame or 8ms) for FS device.
1854		 */
1855		if (is_in && qh->dev)
1856			qh->intv_reg =
1857				(USB_SPEED_HIGH == qh->dev->speed) ? 8 : 4;
1858		goto success;
1859	} else if (best_end < 0) {
1860		return -ENOSPC;
1861	}
1862
1863	idle = 1;
1864	qh->mux = 0;
1865	hw_ep = musb->endpoints + best_end;
1866	dev_dbg(musb->controller, "qh %p periodic slot %d\n", qh, best_end);
1867success:
1868	if (head) {
1869		idle = list_empty(head);
1870		list_add_tail(&qh->ring, head);
1871		qh->mux = 1;
1872	}
1873	qh->hw_ep = hw_ep;
1874	qh->hep->hcpriv = qh;
1875	if (idle)
1876		musb_start_urb(musb, is_in, qh);
1877	return 0;
1878}
1879
1880static int musb_urb_enqueue(
1881	struct usb_hcd			*hcd,
1882	struct urb			*urb,
1883	gfp_t				mem_flags)
1884{
1885	unsigned long			flags;
1886	struct musb			*musb = hcd_to_musb(hcd);
1887	struct usb_host_endpoint	*hep = urb->ep;
1888	struct musb_qh			*qh;
1889	struct usb_endpoint_descriptor	*epd = &hep->desc;
1890	int				ret;
1891	unsigned			type_reg;
1892	unsigned			interval;
1893
1894	/* host role must be active */
1895	if (!is_host_active(musb) || !musb->is_active)
1896		return -ENODEV;
1897
1898	spin_lock_irqsave(&musb->lock, flags);
1899	ret = usb_hcd_link_urb_to_ep(hcd, urb);
1900	qh = ret ? NULL : hep->hcpriv;
1901	if (qh)
1902		urb->hcpriv = qh;
1903	spin_unlock_irqrestore(&musb->lock, flags);
1904
1905	/* DMA mapping was already done, if needed, and this urb is on
1906	 * hep->urb_list now ... so we're done, unless hep wasn't yet
1907	 * scheduled onto a live qh.
1908	 *
1909	 * REVISIT best to keep hep->hcpriv valid until the endpoint gets
1910	 * disabled, testing for empty qh->ring and avoiding qh setup costs
1911	 * except for the first urb queued after a config change.
1912	 */
1913	if (qh || ret)
1914		return ret;
1915
1916	/* Allocate and initialize qh, minimizing the work done each time
1917	 * hw_ep gets reprogrammed, or with irqs blocked.  Then schedule it.
1918	 *
1919	 * REVISIT consider a dedicated qh kmem_cache, so it's harder
1920	 * for bugs in other kernel code to break this driver...
1921	 */
1922	qh = kzalloc(sizeof *qh, mem_flags);
1923	if (!qh) {
1924		spin_lock_irqsave(&musb->lock, flags);
1925		usb_hcd_unlink_urb_from_ep(hcd, urb);
1926		spin_unlock_irqrestore(&musb->lock, flags);
1927		return -ENOMEM;
1928	}
1929
1930	qh->hep = hep;
1931	qh->dev = urb->dev;
1932	INIT_LIST_HEAD(&qh->ring);
1933	qh->is_ready = 1;
1934
1935	qh->maxpacket = le16_to_cpu(epd->wMaxPacketSize);
1936	qh->type = usb_endpoint_type(epd);
1937
1938	/* Bits 11 & 12 of wMaxPacketSize encode high bandwidth multiplier.
1939	 * Some musb cores don't support high bandwidth ISO transfers; and
1940	 * we don't (yet!) support high bandwidth interrupt transfers.
1941	 */
1942	qh->hb_mult = 1 + ((qh->maxpacket >> 11) & 0x03);
1943	if (qh->hb_mult > 1) {
1944		int ok = (qh->type == USB_ENDPOINT_XFER_ISOC);
1945
1946		if (ok)
1947			ok = (usb_pipein(urb->pipe) && musb->hb_iso_rx)
1948				|| (usb_pipeout(urb->pipe) && musb->hb_iso_tx);
1949		if (!ok) {
1950			ret = -EMSGSIZE;
1951			goto done;
1952		}
1953		qh->maxpacket &= 0x7ff;
1954	}
1955
1956	qh->epnum = usb_endpoint_num(epd);
1957
1958	/* NOTE: urb->dev->devnum is wrong during SET_ADDRESS */
1959	qh->addr_reg = (u8) usb_pipedevice(urb->pipe);
1960
1961	/* precompute rxtype/txtype/type0 register */
1962	type_reg = (qh->type << 4) | qh->epnum;
1963	switch (urb->dev->speed) {
1964	case USB_SPEED_LOW:
1965		type_reg |= 0xc0;
1966		break;
1967	case USB_SPEED_FULL:
1968		type_reg |= 0x80;
1969		break;
1970	default:
1971		type_reg |= 0x40;
1972	}
1973	qh->type_reg = type_reg;
1974
1975	/* Precompute RXINTERVAL/TXINTERVAL register */
1976	switch (qh->type) {
1977	case USB_ENDPOINT_XFER_INT:
1978		/*
1979		 * Full/low speeds use the  linear encoding,
1980		 * high speed uses the logarithmic encoding.
1981		 */
1982		if (urb->dev->speed <= USB_SPEED_FULL) {
1983			interval = max_t(u8, epd->bInterval, 1);
1984			break;
1985		}
1986		/* FALLTHROUGH */
1987	case USB_ENDPOINT_XFER_ISOC:
1988		/* ISO always uses logarithmic encoding */
1989		interval = min_t(u8, epd->bInterval, 16);
1990		break;
1991	default:
1992		/* REVISIT we actually want to use NAK limits, hinting to the
1993		 * transfer scheduling logic to try some other qh, e.g. try
1994		 * for 2 msec first:
1995		 *
1996		 * interval = (USB_SPEED_HIGH == urb->dev->speed) ? 16 : 2;
1997		 *
1998		 * The downside of disabling this is that transfer scheduling
1999		 * gets VERY unfair for nonperiodic transfers; a misbehaving
2000		 * peripheral could make that hurt.  That's perfectly normal
2001		 * for reads from network or serial adapters ... so we have
2002		 * partial NAKlimit support for bulk RX.
2003		 *
2004		 * The upside of disabling it is simpler transfer scheduling.
2005		 */
2006		interval = 0;
2007	}
2008	qh->intv_reg = interval;
2009
2010	/* precompute addressing for external hub/tt ports */
2011	if (musb->is_multipoint) {
2012		struct usb_device	*parent = urb->dev->parent;
2013
2014		if (parent != hcd->self.root_hub) {
2015			qh->h_addr_reg = (u8) parent->devnum;
2016
2017			/* set up tt info if needed */
2018			if (urb->dev->tt) {
2019				qh->h_port_reg = (u8) urb->dev->ttport;
2020				if (urb->dev->tt->hub)
2021					qh->h_addr_reg =
2022						(u8) urb->dev->tt->hub->devnum;
2023				if (urb->dev->tt->multi)
2024					qh->h_addr_reg |= 0x80;
2025			}
2026		}
2027	}
2028
2029	/* invariant: hep->hcpriv is null OR the qh that's already scheduled.
2030	 * until we get real dma queues (with an entry for each urb/buffer),
2031	 * we only have work to do in the former case.
2032	 */
2033	spin_lock_irqsave(&musb->lock, flags);
2034	if (hep->hcpriv) {
2035		/* some concurrent activity submitted another urb to hep...
2036		 * odd, rare, error prone, but legal.
2037		 */
2038		kfree(qh);
2039		qh = NULL;
2040		ret = 0;
2041	} else
2042		ret = musb_schedule(musb, qh,
2043				epd->bEndpointAddress & USB_ENDPOINT_DIR_MASK);
2044
2045	if (ret == 0) {
2046		urb->hcpriv = qh;
2047		/* FIXME set urb->start_frame for iso/intr, it's tested in
2048		 * musb_start_urb(), but otherwise only konicawc cares ...
2049		 */
2050	}
2051	spin_unlock_irqrestore(&musb->lock, flags);
2052
2053done:
2054	if (ret != 0) {
2055		spin_lock_irqsave(&musb->lock, flags);
2056		usb_hcd_unlink_urb_from_ep(hcd, urb);
2057		spin_unlock_irqrestore(&musb->lock, flags);
2058		kfree(qh);
2059	}
2060	return ret;
2061}
2062
2063
2064/*
2065 * abort a transfer that's at the head of a hardware queue.
2066 * called with controller locked, irqs blocked
2067 * that hardware queue advances to the next transfer, unless prevented
2068 */
2069static int musb_cleanup_urb(struct urb *urb, struct musb_qh *qh)
2070{
2071	struct musb_hw_ep	*ep = qh->hw_ep;
2072	struct musb		*musb = ep->musb;
2073	void __iomem		*epio = ep->regs;
2074	unsigned		hw_end = ep->epnum;
2075	void __iomem		*regs = ep->musb->mregs;
2076	int			is_in = usb_pipein(urb->pipe);
2077	int			status = 0;
2078	u16			csr;
2079
2080	musb_ep_select(regs, hw_end);
2081
2082	if (is_dma_capable()) {
2083		struct dma_channel	*dma;
2084
2085		dma = is_in ? ep->rx_channel : ep->tx_channel;
2086		if (dma) {
2087			status = ep->musb->dma_controller->channel_abort(dma);
2088			dev_dbg(musb->controller,
2089				"abort %cX%d DMA for urb %p --> %d\n",
2090				is_in ? 'R' : 'T', ep->epnum,
2091				urb, status);
2092			urb->actual_length += dma->actual_len;
2093		}
2094	}
2095
2096	/* turn off DMA requests, discard state, stop polling ... */
2097	if (is_in) {
2098		/* giveback saves bulk toggle */
2099		csr = musb_h_flush_rxfifo(ep, 0);
2100
2101		/* REVISIT we still get an irq; should likely clear the
2102		 * endpoint's irq status here to avoid bogus irqs.
2103		 * clearing that status is platform-specific...
2104		 */
2105	} else if (ep->epnum) {
2106		musb_h_tx_flush_fifo(ep);
2107		csr = musb_readw(epio, MUSB_TXCSR);
2108		csr &= ~(MUSB_TXCSR_AUTOSET
2109			| MUSB_TXCSR_DMAENAB
2110			| MUSB_TXCSR_H_RXSTALL
2111			| MUSB_TXCSR_H_NAKTIMEOUT
2112			| MUSB_TXCSR_H_ERROR
2113			| MUSB_TXCSR_TXPKTRDY);
2114		musb_writew(epio, MUSB_TXCSR, csr);
2115		/* REVISIT may need to clear FLUSHFIFO ... */
2116		musb_writew(epio, MUSB_TXCSR, csr);
2117		/* flush cpu writebuffer */
2118		csr = musb_readw(epio, MUSB_TXCSR);
2119	} else  {
2120		musb_h_ep0_flush_fifo(ep);
2121	}
2122	if (status == 0)
2123		musb_advance_schedule(ep->musb, urb, ep, is_in);
2124	return status;
2125}
2126
2127static int musb_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
2128{
2129	struct musb		*musb = hcd_to_musb(hcd);
2130	struct musb_qh		*qh;
2131	unsigned long		flags;
2132	int			is_in  = usb_pipein(urb->pipe);
2133	int			ret;
2134
2135	dev_dbg(musb->controller, "urb=%p, dev%d ep%d%s\n", urb,
2136			usb_pipedevice(urb->pipe),
2137			usb_pipeendpoint(urb->pipe),
2138			is_in ? "in" : "out");
2139
2140	spin_lock_irqsave(&musb->lock, flags);
2141	ret = usb_hcd_check_unlink_urb(hcd, urb, status);
2142	if (ret)
2143		goto done;
2144
2145	qh = urb->hcpriv;
2146	if (!qh)
2147		goto done;
2148
2149	/*
2150	 * Any URB not actively programmed into endpoint hardware can be
2151	 * immediately given back; that's any URB not at the head of an
2152	 * endpoint queue, unless someday we get real DMA queues.  And even
2153	 * if it's at the head, it might not be known to the hardware...
2154	 *
2155	 * Otherwise abort current transfer, pending DMA, etc.; urb->status
2156	 * has already been updated.  This is a synchronous abort; it'd be
2157	 * OK to hold off until after some IRQ, though.
2158	 *
2159	 * NOTE: qh is invalid unless !list_empty(&hep->urb_list)
2160	 */
2161	if (!qh->is_ready
2162			|| urb->urb_list.prev != &qh->hep->urb_list
2163			|| musb_ep_get_qh(qh->hw_ep, is_in) != qh) {
2164		int	ready = qh->is_ready;
2165
2166		qh->is_ready = 0;
2167		musb_giveback(musb, urb, 0);
2168		qh->is_ready = ready;
2169
2170		/* If nothing else (usually musb_giveback) is using it
2171		 * and its URB list has emptied, recycle this qh.
2172		 */
2173		if (ready && list_empty(&qh->hep->urb_list)) {
2174			qh->hep->hcpriv = NULL;
2175			list_del(&qh->ring);
2176			kfree(qh);
2177		}
2178	} else
2179		ret = musb_cleanup_urb(urb, qh);
2180done:
2181	spin_unlock_irqrestore(&musb->lock, flags);
2182	return ret;
2183}
2184
2185/* disable an endpoint */
2186static void
2187musb_h_disable(struct usb_hcd *hcd, struct usb_host_endpoint *hep)
2188{
2189	u8			is_in = hep->desc.bEndpointAddress & USB_DIR_IN;
2190	unsigned long		flags;
2191	struct musb		*musb = hcd_to_musb(hcd);
2192	struct musb_qh		*qh;
2193	struct urb		*urb;
2194
2195	spin_lock_irqsave(&musb->lock, flags);
2196
2197	qh = hep->hcpriv;
2198	if (qh == NULL)
2199		goto exit;
2200
2201	/* NOTE: qh is invalid unless !list_empty(&hep->urb_list) */
2202
2203	/* Kick the first URB off the hardware, if needed */
2204	qh->is_ready = 0;
2205	if (musb_ep_get_qh(qh->hw_ep, is_in) == qh) {
2206		urb = next_urb(qh);
2207
2208		/* make software (then hardware) stop ASAP */
2209		if (!urb->unlinked)
2210			urb->status = -ESHUTDOWN;
2211
2212		/* cleanup */
2213		musb_cleanup_urb(urb, qh);
2214
2215		/* Then nuke all the others ... and advance the
2216		 * queue on hw_ep (e.g. bulk ring) when we're done.
2217		 */
2218		while (!list_empty(&hep->urb_list)) {
2219			urb = next_urb(qh);
2220			urb->status = -ESHUTDOWN;
2221			musb_advance_schedule(musb, urb, qh->hw_ep, is_in);
2222		}
2223	} else {
2224		/* Just empty the queue; the hardware is busy with
2225		 * other transfers, and since !qh->is_ready nothing
2226		 * will activate any of these as it advances.
2227		 */
2228		while (!list_empty(&hep->urb_list))
2229			musb_giveback(musb, next_urb(qh), -ESHUTDOWN);
2230
2231		hep->hcpriv = NULL;
2232		list_del(&qh->ring);
2233		kfree(qh);
2234	}
2235exit:
2236	spin_unlock_irqrestore(&musb->lock, flags);
2237}
2238
2239static int musb_h_get_frame_number(struct usb_hcd *hcd)
2240{
2241	struct musb	*musb = hcd_to_musb(hcd);
2242
2243	return musb_readw(musb->mregs, MUSB_FRAME);
2244}
2245
2246static int musb_h_start(struct usb_hcd *hcd)
2247{
2248	struct musb	*musb = hcd_to_musb(hcd);
2249
2250	/* NOTE: musb_start() is called when the hub driver turns
2251	 * on port power, or when (OTG) peripheral starts.
2252	 */
2253	hcd->state = HC_STATE_RUNNING;
2254	musb->port1_status = 0;
2255	return 0;
2256}
2257
2258static void musb_h_stop(struct usb_hcd *hcd)
2259{
2260	musb_stop(hcd_to_musb(hcd));
2261	hcd->state = HC_STATE_HALT;
2262}
2263
2264static int musb_bus_suspend(struct usb_hcd *hcd)
2265{
2266	struct musb	*musb = hcd_to_musb(hcd);
2267	u8		devctl;
2268
 
 
2269	if (!is_host_active(musb))
2270		return 0;
2271
2272	switch (musb->xceiv->state) {
2273	case OTG_STATE_A_SUSPEND:
2274		return 0;
2275	case OTG_STATE_A_WAIT_VRISE:
2276		/* ID could be grounded even if there's no device
2277		 * on the other end of the cable.  NOTE that the
2278		 * A_WAIT_VRISE timers are messy with MUSB...
2279		 */
2280		devctl = musb_readb(musb->mregs, MUSB_DEVCTL);
2281		if ((devctl & MUSB_DEVCTL_VBUS) == MUSB_DEVCTL_VBUS)
2282			musb->xceiv->state = OTG_STATE_A_WAIT_BCON;
2283		break;
2284	default:
2285		break;
2286	}
2287
2288	if (musb->is_active) {
2289		WARNING("trying to suspend as %s while active\n",
2290				otg_state_string(musb->xceiv->state));
2291		return -EBUSY;
2292	} else
2293		return 0;
2294}
2295
2296static int musb_bus_resume(struct usb_hcd *hcd)
2297{
2298	/* resuming child port does the work */
 
 
 
 
 
2299	return 0;
2300}
2301
2302const struct hc_driver musb_hc_driver = {
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2303	.description		= "musb-hcd",
2304	.product_desc		= "MUSB HDRC host driver",
2305	.hcd_priv_size		= sizeof(struct musb),
2306	.flags			= HCD_USB2 | HCD_MEMORY,
2307
2308	/* not using irq handler or reset hooks from usbcore, since
2309	 * those must be shared with peripheral code for OTG configs
2310	 */
2311
2312	.start			= musb_h_start,
2313	.stop			= musb_h_stop,
2314
2315	.get_frame_number	= musb_h_get_frame_number,
2316
2317	.urb_enqueue		= musb_urb_enqueue,
2318	.urb_dequeue		= musb_urb_dequeue,
2319	.endpoint_disable	= musb_h_disable,
2320
 
 
 
 
 
2321	.hub_status_data	= musb_hub_status_data,
2322	.hub_control		= musb_hub_control,
2323	.bus_suspend		= musb_bus_suspend,
2324	.bus_resume		= musb_bus_resume,
2325	/* .start_port_reset	= NULL, */
2326	/* .hub_irq_enable	= NULL, */
2327};
v4.6
   1/*
   2 * MUSB OTG driver host support
   3 *
   4 * Copyright 2005 Mentor Graphics Corporation
   5 * Copyright (C) 2005-2006 by Texas Instruments
   6 * Copyright (C) 2006-2007 Nokia Corporation
   7 * Copyright (C) 2008-2009 MontaVista Software, Inc. <source@mvista.com>
   8 *
   9 * This program is free software; you can redistribute it and/or
  10 * modify it under the terms of the GNU General Public License
  11 * version 2 as published by the Free Software Foundation.
  12 *
  13 * This program is distributed in the hope that it will be useful, but
  14 * WITHOUT ANY WARRANTY; without even the implied warranty of
  15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16 * General Public License for more details.
  17 *
  18 * You should have received a copy of the GNU General Public License
  19 * along with this program; if not, write to the Free Software
  20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
  21 * 02110-1301 USA
  22 *
  23 * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
  24 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  25 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
  26 * NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  27 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  28 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
  29 * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
  30 * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  32 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  33 *
  34 */
  35
  36#include <linux/module.h>
  37#include <linux/kernel.h>
  38#include <linux/delay.h>
  39#include <linux/sched.h>
  40#include <linux/slab.h>
  41#include <linux/errno.h>
 
  42#include <linux/list.h>
  43#include <linux/dma-mapping.h>
  44
  45#include "musb_core.h"
  46#include "musb_host.h"
  47
 
  48/* MUSB HOST status 22-mar-2006
  49 *
  50 * - There's still lots of partial code duplication for fault paths, so
  51 *   they aren't handled as consistently as they need to be.
  52 *
  53 * - PIO mostly behaved when last tested.
  54 *     + including ep0, with all usbtest cases 9, 10
  55 *     + usbtest 14 (ep0out) doesn't seem to run at all
  56 *     + double buffered OUT/TX endpoints saw stalls(!) with certain usbtest
  57 *       configurations, but otherwise double buffering passes basic tests.
  58 *     + for 2.6.N, for N > ~10, needs API changes for hcd framework.
  59 *
  60 * - DMA (CPPI) ... partially behaves, not currently recommended
  61 *     + about 1/15 the speed of typical EHCI implementations (PCI)
  62 *     + RX, all too often reqpkt seems to misbehave after tx
  63 *     + TX, no known issues (other than evident silicon issue)
  64 *
  65 * - DMA (Mentor/OMAP) ...has at least toggle update problems
  66 *
  67 * - [23-feb-2009] minimal traffic scheduling to avoid bulk RX packet
  68 *   starvation ... nothing yet for TX, interrupt, or bulk.
  69 *
  70 * - Not tested with HNP, but some SRP paths seem to behave.
  71 *
  72 * NOTE 24-August-2006:
  73 *
  74 * - Bulk traffic finally uses both sides of hardware ep1, freeing up an
  75 *   extra endpoint for periodic use enabling hub + keybd + mouse.  That
  76 *   mostly works, except that with "usbnet" it's easy to trigger cases
  77 *   with "ping" where RX loses.  (a) ping to davinci, even "ping -f",
  78 *   fine; but (b) ping _from_ davinci, even "ping -c 1", ICMP RX loses
  79 *   although ARP RX wins.  (That test was done with a full speed link.)
  80 */
  81
  82
  83/*
  84 * NOTE on endpoint usage:
  85 *
  86 * CONTROL transfers all go through ep0.  BULK ones go through dedicated IN
  87 * and OUT endpoints ... hardware is dedicated for those "async" queue(s).
  88 * (Yes, bulk _could_ use more of the endpoints than that, and would even
  89 * benefit from it.)
  90 *
  91 * INTERUPPT and ISOCHRONOUS transfers are scheduled to the other endpoints.
  92 * So far that scheduling is both dumb and optimistic:  the endpoint will be
  93 * "claimed" until its software queue is no longer refilled.  No multiplexing
  94 * of transfers between endpoints, or anything clever.
  95 */
  96
  97struct musb *hcd_to_musb(struct usb_hcd *hcd)
  98{
  99	return *(struct musb **) hcd->hcd_priv;
 100}
 101
 102
 103static void musb_ep_program(struct musb *musb, u8 epnum,
 104			struct urb *urb, int is_out,
 105			u8 *buf, u32 offset, u32 len);
 106
 107/*
 108 * Clear TX fifo. Needed to avoid BABBLE errors.
 109 */
 110static void musb_h_tx_flush_fifo(struct musb_hw_ep *ep)
 111{
 112	struct musb	*musb = ep->musb;
 113	void __iomem	*epio = ep->regs;
 114	u16		csr;
 
 115	int		retries = 1000;
 116
 117	csr = musb_readw(epio, MUSB_TXCSR);
 118	while (csr & MUSB_TXCSR_FIFONOTEMPTY) {
 119		csr |= MUSB_TXCSR_FLUSHFIFO | MUSB_TXCSR_TXPKTRDY;
 
 
 
 120		musb_writew(epio, MUSB_TXCSR, csr);
 121		csr = musb_readw(epio, MUSB_TXCSR);
 122
 123		/*
 124		 * FIXME: sometimes the tx fifo flush failed, it has been
 125		 * observed during device disconnect on AM335x.
 126		 *
 127		 * To reproduce the issue, ensure tx urb(s) are queued when
 128		 * unplug the usb device which is connected to AM335x usb
 129		 * host port.
 130		 *
 131		 * I found using a usb-ethernet device and running iperf
 132		 * (client on AM335x) has very high chance to trigger it.
 133		 *
 134		 * Better to turn on dev_dbg() in musb_cleanup_urb() with
 135		 * CPPI enabled to see the issue when aborting the tx channel.
 136		 */
 137		if (dev_WARN_ONCE(musb->controller, retries-- < 1,
 138				"Could not flush host TX%d fifo: csr: %04x\n",
 139				ep->epnum, csr))
 140			return;
 
 141	}
 142}
 143
 144static void musb_h_ep0_flush_fifo(struct musb_hw_ep *ep)
 145{
 146	void __iomem	*epio = ep->regs;
 147	u16		csr;
 148	int		retries = 5;
 149
 150	/* scrub any data left in the fifo */
 151	do {
 152		csr = musb_readw(epio, MUSB_TXCSR);
 153		if (!(csr & (MUSB_CSR0_TXPKTRDY | MUSB_CSR0_RXPKTRDY)))
 154			break;
 155		musb_writew(epio, MUSB_TXCSR, MUSB_CSR0_FLUSHFIFO);
 156		csr = musb_readw(epio, MUSB_TXCSR);
 157		udelay(10);
 158	} while (--retries);
 159
 160	WARN(!retries, "Could not flush host TX%d fifo: csr: %04x\n",
 161			ep->epnum, csr);
 162
 163	/* and reset for the next transfer */
 164	musb_writew(epio, MUSB_TXCSR, 0);
 165}
 166
 167/*
 168 * Start transmit. Caller is responsible for locking shared resources.
 169 * musb must be locked.
 170 */
 171static inline void musb_h_tx_start(struct musb_hw_ep *ep)
 172{
 173	u16	txcsr;
 174
 175	/* NOTE: no locks here; caller should lock and select EP */
 176	if (ep->epnum) {
 177		txcsr = musb_readw(ep->regs, MUSB_TXCSR);
 178		txcsr |= MUSB_TXCSR_TXPKTRDY | MUSB_TXCSR_H_WZC_BITS;
 179		musb_writew(ep->regs, MUSB_TXCSR, txcsr);
 180	} else {
 181		txcsr = MUSB_CSR0_H_SETUPPKT | MUSB_CSR0_TXPKTRDY;
 182		musb_writew(ep->regs, MUSB_CSR0, txcsr);
 183	}
 184
 185}
 186
 187static inline void musb_h_tx_dma_start(struct musb_hw_ep *ep)
 188{
 189	u16	txcsr;
 190
 191	/* NOTE: no locks here; caller should lock and select EP */
 192	txcsr = musb_readw(ep->regs, MUSB_TXCSR);
 193	txcsr |= MUSB_TXCSR_DMAENAB | MUSB_TXCSR_H_WZC_BITS;
 194	if (is_cppi_enabled(ep->musb))
 195		txcsr |= MUSB_TXCSR_DMAMODE;
 196	musb_writew(ep->regs, MUSB_TXCSR, txcsr);
 197}
 198
 199static void musb_ep_set_qh(struct musb_hw_ep *ep, int is_in, struct musb_qh *qh)
 200{
 201	if (is_in != 0 || ep->is_shared_fifo)
 202		ep->in_qh  = qh;
 203	if (is_in == 0 || ep->is_shared_fifo)
 204		ep->out_qh = qh;
 205}
 206
 207static struct musb_qh *musb_ep_get_qh(struct musb_hw_ep *ep, int is_in)
 208{
 209	return is_in ? ep->in_qh : ep->out_qh;
 210}
 211
 212/*
 213 * Start the URB at the front of an endpoint's queue
 214 * end must be claimed from the caller.
 215 *
 216 * Context: controller locked, irqs blocked
 217 */
 218static void
 219musb_start_urb(struct musb *musb, int is_in, struct musb_qh *qh)
 220{
 221	u16			frame;
 222	u32			len;
 223	void __iomem		*mbase =  musb->mregs;
 224	struct urb		*urb = next_urb(qh);
 225	void			*buf = urb->transfer_buffer;
 226	u32			offset = 0;
 227	struct musb_hw_ep	*hw_ep = qh->hw_ep;
 228	unsigned		pipe = urb->pipe;
 229	u8			address = usb_pipedevice(pipe);
 230	int			epnum = hw_ep->epnum;
 231
 232	/* initialize software qh state */
 233	qh->offset = 0;
 234	qh->segsize = 0;
 235
 236	/* gather right source of data */
 237	switch (qh->type) {
 238	case USB_ENDPOINT_XFER_CONTROL:
 239		/* control transfers always start with SETUP */
 240		is_in = 0;
 241		musb->ep0_stage = MUSB_EP0_START;
 242		buf = urb->setup_packet;
 243		len = 8;
 244		break;
 245	case USB_ENDPOINT_XFER_ISOC:
 246		qh->iso_idx = 0;
 247		qh->frame = 0;
 248		offset = urb->iso_frame_desc[0].offset;
 249		len = urb->iso_frame_desc[0].length;
 250		break;
 251	default:		/* bulk, interrupt */
 252		/* actual_length may be nonzero on retry paths */
 253		buf = urb->transfer_buffer + urb->actual_length;
 254		len = urb->transfer_buffer_length - urb->actual_length;
 255	}
 256
 257	dev_dbg(musb->controller, "qh %p urb %p dev%d ep%d%s%s, hw_ep %d, %p/%d\n",
 258			qh, urb, address, qh->epnum,
 259			is_in ? "in" : "out",
 260			({char *s; switch (qh->type) {
 261			case USB_ENDPOINT_XFER_CONTROL:	s = ""; break;
 262			case USB_ENDPOINT_XFER_BULK:	s = "-bulk"; break;
 263			case USB_ENDPOINT_XFER_ISOC:	s = "-iso"; break;
 264			default:			s = "-intr"; break;
 265			} s; }),
 266			epnum, buf + offset, len);
 267
 268	/* Configure endpoint */
 269	musb_ep_set_qh(hw_ep, is_in, qh);
 270	musb_ep_program(musb, epnum, urb, !is_in, buf, offset, len);
 271
 272	/* transmit may have more work: start it when it is time */
 273	if (is_in)
 274		return;
 275
 276	/* determine if the time is right for a periodic transfer */
 277	switch (qh->type) {
 278	case USB_ENDPOINT_XFER_ISOC:
 279	case USB_ENDPOINT_XFER_INT:
 280		dev_dbg(musb->controller, "check whether there's still time for periodic Tx\n");
 281		frame = musb_readw(mbase, MUSB_FRAME);
 282		/* FIXME this doesn't implement that scheduling policy ...
 283		 * or handle framecounter wrapping
 284		 */
 285		if (1) {	/* Always assume URB_ISO_ASAP */
 
 286			/* REVISIT the SOF irq handler shouldn't duplicate
 287			 * this code; and we don't init urb->start_frame...
 288			 */
 289			qh->frame = 0;
 290			goto start;
 291		} else {
 292			qh->frame = urb->start_frame;
 293			/* enable SOF interrupt so we can count down */
 294			dev_dbg(musb->controller, "SOF for %d\n", epnum);
 295#if 1 /* ifndef	CONFIG_ARCH_DAVINCI */
 296			musb_writeb(mbase, MUSB_INTRUSBE, 0xff);
 297#endif
 298		}
 299		break;
 300	default:
 301start:
 302		dev_dbg(musb->controller, "Start TX%d %s\n", epnum,
 303			hw_ep->tx_channel ? "dma" : "pio");
 304
 305		if (!hw_ep->tx_channel)
 306			musb_h_tx_start(hw_ep);
 307		else if (is_cppi_enabled(musb) || tusb_dma_omap(musb))
 308			musb_h_tx_dma_start(hw_ep);
 309	}
 310}
 311
 312/* Context: caller owns controller lock, IRQs are blocked */
 313static void musb_giveback(struct musb *musb, struct urb *urb, int status)
 314__releases(musb->lock)
 315__acquires(musb->lock)
 316{
 317	dev_dbg(musb->controller,
 318			"complete %p %pF (%d), dev%d ep%d%s, %d/%d\n",
 319			urb, urb->complete, status,
 320			usb_pipedevice(urb->pipe),
 321			usb_pipeendpoint(urb->pipe),
 322			usb_pipein(urb->pipe) ? "in" : "out",
 323			urb->actual_length, urb->transfer_buffer_length
 324			);
 325
 326	usb_hcd_unlink_urb_from_ep(musb->hcd, urb);
 327	spin_unlock(&musb->lock);
 328	usb_hcd_giveback_urb(musb->hcd, urb, status);
 329	spin_lock(&musb->lock);
 330}
 331
 332/* For bulk/interrupt endpoints only */
 333static inline void musb_save_toggle(struct musb_qh *qh, int is_in,
 334				    struct urb *urb)
 335{
 336	void __iomem		*epio = qh->hw_ep->regs;
 337	u16			csr;
 338
 339	/*
 340	 * FIXME: the current Mentor DMA code seems to have
 341	 * problems getting toggle correct.
 342	 */
 343
 344	if (is_in)
 345		csr = musb_readw(epio, MUSB_RXCSR) & MUSB_RXCSR_H_DATATOGGLE;
 346	else
 347		csr = musb_readw(epio, MUSB_TXCSR) & MUSB_TXCSR_H_DATATOGGLE;
 348
 349	usb_settoggle(urb->dev, qh->epnum, !is_in, csr ? 1 : 0);
 350}
 351
 352/*
 353 * Advance this hardware endpoint's queue, completing the specified URB and
 354 * advancing to either the next URB queued to that qh, or else invalidating
 355 * that qh and advancing to the next qh scheduled after the current one.
 356 *
 357 * Context: caller owns controller lock, IRQs are blocked
 358 */
 359static void musb_advance_schedule(struct musb *musb, struct urb *urb,
 360				  struct musb_hw_ep *hw_ep, int is_in)
 361{
 362	struct musb_qh		*qh = musb_ep_get_qh(hw_ep, is_in);
 363	struct musb_hw_ep	*ep = qh->hw_ep;
 364	int			ready = qh->is_ready;
 365	int			status;
 366
 367	status = (urb->status == -EINPROGRESS) ? 0 : urb->status;
 368
 369	/* save toggle eagerly, for paranoia */
 370	switch (qh->type) {
 371	case USB_ENDPOINT_XFER_BULK:
 372	case USB_ENDPOINT_XFER_INT:
 373		musb_save_toggle(qh, is_in, urb);
 374		break;
 375	case USB_ENDPOINT_XFER_ISOC:
 376		if (status == 0 && urb->error_count)
 377			status = -EXDEV;
 378		break;
 379	}
 380
 381	qh->is_ready = 0;
 382	musb_giveback(musb, urb, status);
 383	qh->is_ready = ready;
 384
 385	/* reclaim resources (and bandwidth) ASAP; deschedule it, and
 386	 * invalidate qh as soon as list_empty(&hep->urb_list)
 387	 */
 388	if (list_empty(&qh->hep->urb_list)) {
 389		struct list_head	*head;
 390		struct dma_controller	*dma = musb->dma_controller;
 391
 392		if (is_in) {
 393			ep->rx_reinit = 1;
 394			if (ep->rx_channel) {
 395				dma->channel_release(ep->rx_channel);
 396				ep->rx_channel = NULL;
 397			}
 398		} else {
 399			ep->tx_reinit = 1;
 400			if (ep->tx_channel) {
 401				dma->channel_release(ep->tx_channel);
 402				ep->tx_channel = NULL;
 403			}
 404		}
 405
 406		/* Clobber old pointers to this qh */
 407		musb_ep_set_qh(ep, is_in, NULL);
 408		qh->hep->hcpriv = NULL;
 409
 410		switch (qh->type) {
 411
 412		case USB_ENDPOINT_XFER_CONTROL:
 413		case USB_ENDPOINT_XFER_BULK:
 414			/* fifo policy for these lists, except that NAKing
 415			 * should rotate a qh to the end (for fairness).
 416			 */
 417			if (qh->mux == 1) {
 418				head = qh->ring.prev;
 419				list_del(&qh->ring);
 420				kfree(qh);
 421				qh = first_qh(head);
 422				break;
 423			}
 424
 425		case USB_ENDPOINT_XFER_ISOC:
 426		case USB_ENDPOINT_XFER_INT:
 427			/* this is where periodic bandwidth should be
 428			 * de-allocated if it's tracked and allocated;
 429			 * and where we'd update the schedule tree...
 430			 */
 431			kfree(qh);
 432			qh = NULL;
 433			break;
 434		}
 435	}
 436
 437	if (qh != NULL && qh->is_ready) {
 438		dev_dbg(musb->controller, "... next ep%d %cX urb %p\n",
 439		    hw_ep->epnum, is_in ? 'R' : 'T', next_urb(qh));
 440		musb_start_urb(musb, is_in, qh);
 441	}
 442}
 443
 444static u16 musb_h_flush_rxfifo(struct musb_hw_ep *hw_ep, u16 csr)
 445{
 446	/* we don't want fifo to fill itself again;
 447	 * ignore dma (various models),
 448	 * leave toggle alone (may not have been saved yet)
 449	 */
 450	csr |= MUSB_RXCSR_FLUSHFIFO | MUSB_RXCSR_RXPKTRDY;
 451	csr &= ~(MUSB_RXCSR_H_REQPKT
 452		| MUSB_RXCSR_H_AUTOREQ
 453		| MUSB_RXCSR_AUTOCLEAR);
 454
 455	/* write 2x to allow double buffering */
 456	musb_writew(hw_ep->regs, MUSB_RXCSR, csr);
 457	musb_writew(hw_ep->regs, MUSB_RXCSR, csr);
 458
 459	/* flush writebuffer */
 460	return musb_readw(hw_ep->regs, MUSB_RXCSR);
 461}
 462
 463/*
 464 * PIO RX for a packet (or part of it).
 465 */
 466static bool
 467musb_host_packet_rx(struct musb *musb, struct urb *urb, u8 epnum, u8 iso_err)
 468{
 469	u16			rx_count;
 470	u8			*buf;
 471	u16			csr;
 472	bool			done = false;
 473	u32			length;
 474	int			do_flush = 0;
 475	struct musb_hw_ep	*hw_ep = musb->endpoints + epnum;
 476	void __iomem		*epio = hw_ep->regs;
 477	struct musb_qh		*qh = hw_ep->in_qh;
 478	int			pipe = urb->pipe;
 479	void			*buffer = urb->transfer_buffer;
 480
 481	/* musb_ep_select(mbase, epnum); */
 482	rx_count = musb_readw(epio, MUSB_RXCOUNT);
 483	dev_dbg(musb->controller, "RX%d count %d, buffer %p len %d/%d\n", epnum, rx_count,
 484			urb->transfer_buffer, qh->offset,
 485			urb->transfer_buffer_length);
 486
 487	/* unload FIFO */
 488	if (usb_pipeisoc(pipe)) {
 489		int					status = 0;
 490		struct usb_iso_packet_descriptor	*d;
 491
 492		if (iso_err) {
 493			status = -EILSEQ;
 494			urb->error_count++;
 495		}
 496
 497		d = urb->iso_frame_desc + qh->iso_idx;
 498		buf = buffer + d->offset;
 499		length = d->length;
 500		if (rx_count > length) {
 501			if (status == 0) {
 502				status = -EOVERFLOW;
 503				urb->error_count++;
 504			}
 505			dev_dbg(musb->controller, "** OVERFLOW %d into %d\n", rx_count, length);
 506			do_flush = 1;
 507		} else
 508			length = rx_count;
 509		urb->actual_length += length;
 510		d->actual_length = length;
 511
 512		d->status = status;
 513
 514		/* see if we are done */
 515		done = (++qh->iso_idx >= urb->number_of_packets);
 516	} else {
 517		/* non-isoch */
 518		buf = buffer + qh->offset;
 519		length = urb->transfer_buffer_length - qh->offset;
 520		if (rx_count > length) {
 521			if (urb->status == -EINPROGRESS)
 522				urb->status = -EOVERFLOW;
 523			dev_dbg(musb->controller, "** OVERFLOW %d into %d\n", rx_count, length);
 524			do_flush = 1;
 525		} else
 526			length = rx_count;
 527		urb->actual_length += length;
 528		qh->offset += length;
 529
 530		/* see if we are done */
 531		done = (urb->actual_length == urb->transfer_buffer_length)
 532			|| (rx_count < qh->maxpacket)
 533			|| (urb->status != -EINPROGRESS);
 534		if (done
 535				&& (urb->status == -EINPROGRESS)
 536				&& (urb->transfer_flags & URB_SHORT_NOT_OK)
 537				&& (urb->actual_length
 538					< urb->transfer_buffer_length))
 539			urb->status = -EREMOTEIO;
 540	}
 541
 542	musb_read_fifo(hw_ep, length, buf);
 543
 544	csr = musb_readw(epio, MUSB_RXCSR);
 545	csr |= MUSB_RXCSR_H_WZC_BITS;
 546	if (unlikely(do_flush))
 547		musb_h_flush_rxfifo(hw_ep, csr);
 548	else {
 549		/* REVISIT this assumes AUTOCLEAR is never set */
 550		csr &= ~(MUSB_RXCSR_RXPKTRDY | MUSB_RXCSR_H_REQPKT);
 551		if (!done)
 552			csr |= MUSB_RXCSR_H_REQPKT;
 553		musb_writew(epio, MUSB_RXCSR, csr);
 554	}
 555
 556	return done;
 557}
 558
 559/* we don't always need to reinit a given side of an endpoint...
 560 * when we do, use tx/rx reinit routine and then construct a new CSR
 561 * to address data toggle, NYET, and DMA or PIO.
 562 *
 563 * it's possible that driver bugs (especially for DMA) or aborting a
 564 * transfer might have left the endpoint busier than it should be.
 565 * the busy/not-empty tests are basically paranoia.
 566 */
 567static void
 568musb_rx_reinit(struct musb *musb, struct musb_qh *qh, u8 epnum)
 569{
 570	struct musb_hw_ep *ep = musb->endpoints + epnum;
 571	u16	csr;
 572
 573	/* NOTE:  we know the "rx" fifo reinit never triggers for ep0.
 574	 * That always uses tx_reinit since ep0 repurposes TX register
 575	 * offsets; the initial SETUP packet is also a kind of OUT.
 576	 */
 577
 578	/* if programmed for Tx, put it in RX mode */
 579	if (ep->is_shared_fifo) {
 580		csr = musb_readw(ep->regs, MUSB_TXCSR);
 581		if (csr & MUSB_TXCSR_MODE) {
 582			musb_h_tx_flush_fifo(ep);
 583			csr = musb_readw(ep->regs, MUSB_TXCSR);
 584			musb_writew(ep->regs, MUSB_TXCSR,
 585				    csr | MUSB_TXCSR_FRCDATATOG);
 586		}
 587
 588		/*
 589		 * Clear the MODE bit (and everything else) to enable Rx.
 590		 * NOTE: we mustn't clear the DMAMODE bit before DMAENAB.
 591		 */
 592		if (csr & MUSB_TXCSR_DMAMODE)
 593			musb_writew(ep->regs, MUSB_TXCSR, MUSB_TXCSR_DMAMODE);
 594		musb_writew(ep->regs, MUSB_TXCSR, 0);
 595
 596	/* scrub all previous state, clearing toggle */
 597	} else {
 598		csr = musb_readw(ep->regs, MUSB_RXCSR);
 599		if (csr & MUSB_RXCSR_RXPKTRDY)
 600			WARNING("rx%d, packet/%d ready?\n", ep->epnum,
 601				musb_readw(ep->regs, MUSB_RXCOUNT));
 602
 603		musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG);
 604	}
 605
 606	/* target addr and (for multipoint) hub addr/port */
 607	if (musb->is_multipoint) {
 608		musb_write_rxfunaddr(musb, epnum, qh->addr_reg);
 609		musb_write_rxhubaddr(musb, epnum, qh->h_addr_reg);
 610		musb_write_rxhubport(musb, epnum, qh->h_port_reg);
 
 611	} else
 612		musb_writeb(musb->mregs, MUSB_FADDR, qh->addr_reg);
 613
 614	/* protocol/endpoint, interval/NAKlimit, i/o size */
 615	musb_writeb(ep->regs, MUSB_RXTYPE, qh->type_reg);
 616	musb_writeb(ep->regs, MUSB_RXINTERVAL, qh->intv_reg);
 617	/* NOTE: bulk combining rewrites high bits of maxpacket */
 618	/* Set RXMAXP with the FIFO size of the endpoint
 619	 * to disable double buffer mode.
 620	 */
 621	if (musb->double_buffer_not_ok)
 622		musb_writew(ep->regs, MUSB_RXMAXP, ep->max_packet_sz_rx);
 623	else
 624		musb_writew(ep->regs, MUSB_RXMAXP,
 625				qh->maxpacket | ((qh->hb_mult - 1) << 11));
 626
 627	ep->rx_reinit = 0;
 628}
 629
 630static int musb_tx_dma_set_mode_mentor(struct dma_controller *dma,
 631		struct musb_hw_ep *hw_ep, struct musb_qh *qh,
 632		struct urb *urb, u32 offset,
 633		u32 *length, u8 *mode)
 634{
 635	struct dma_channel	*channel = hw_ep->tx_channel;
 636	void __iomem		*epio = hw_ep->regs;
 637	u16			pkt_size = qh->maxpacket;
 638	u16			csr;
 
 639
 640	if (*length > channel->max_len)
 641		*length = channel->max_len;
 
 642
 643	csr = musb_readw(epio, MUSB_TXCSR);
 644	if (*length > pkt_size) {
 645		*mode = 1;
 646		csr |= MUSB_TXCSR_DMAMODE | MUSB_TXCSR_DMAENAB;
 647		/* autoset shouldn't be set in high bandwidth */
 648		/*
 649		 * Enable Autoset according to table
 650		 * below
 651		 * bulk_split hb_mult	Autoset_Enable
 652		 *	0	1	Yes(Normal)
 653		 *	0	>1	No(High BW ISO)
 654		 *	1	1	Yes(HS bulk)
 655		 *	1	>1	Yes(FS bulk)
 656		 */
 657		if (qh->hb_mult == 1 || (qh->hb_mult > 1 &&
 658					can_bulk_split(hw_ep->musb, qh->type)))
 659			csr |= MUSB_TXCSR_AUTOSET;
 660	} else {
 661		*mode = 0;
 662		csr &= ~(MUSB_TXCSR_AUTOSET | MUSB_TXCSR_DMAMODE);
 663		csr |= MUSB_TXCSR_DMAENAB; /* against programmer's guide */
 664	}
 665	channel->desired_mode = *mode;
 666	musb_writew(epio, MUSB_TXCSR, csr);
 667
 668	return 0;
 669}
 670
 671static int musb_tx_dma_set_mode_cppi_tusb(struct dma_controller *dma,
 672					  struct musb_hw_ep *hw_ep,
 673					  struct musb_qh *qh,
 674					  struct urb *urb,
 675					  u32 offset,
 676					  u32 *length,
 677					  u8 *mode)
 678{
 679	struct dma_channel *channel = hw_ep->tx_channel;
 680
 681	if (!is_cppi_enabled(hw_ep->musb) && !tusb_dma_omap(hw_ep->musb))
 682		return -ENODEV;
 683
 684	channel->actual_len = 0;
 685
 686	/*
 687	 * TX uses "RNDIS" mode automatically but needs help
 688	 * to identify the zero-length-final-packet case.
 689	 */
 690	*mode = (urb->transfer_flags & URB_ZERO_PACKET) ? 1 : 0;
 691
 692	return 0;
 693}
 694
 695static bool musb_tx_dma_program(struct dma_controller *dma,
 696		struct musb_hw_ep *hw_ep, struct musb_qh *qh,
 697		struct urb *urb, u32 offset, u32 length)
 698{
 699	struct dma_channel	*channel = hw_ep->tx_channel;
 700	u16			pkt_size = qh->maxpacket;
 701	u8			mode;
 702	int			res;
 703
 704	if (musb_dma_inventra(hw_ep->musb) || musb_dma_ux500(hw_ep->musb))
 705		res = musb_tx_dma_set_mode_mentor(dma, hw_ep, qh, urb,
 706						 offset, &length, &mode);
 707	else
 708		res = musb_tx_dma_set_mode_cppi_tusb(dma, hw_ep, qh, urb,
 709						     offset, &length, &mode);
 710	if (res)
 711		return false;
 712
 713	qh->segsize = length;
 714
 715	/*
 716	 * Ensure the data reaches to main memory before starting
 717	 * DMA transfer
 718	 */
 719	wmb();
 720
 721	if (!dma->channel_program(channel, pkt_size, mode,
 722			urb->transfer_dma + offset, length)) {
 723		void __iomem *epio = hw_ep->regs;
 724		u16 csr;
 725
 726		dma->channel_release(channel);
 727		hw_ep->tx_channel = NULL;
 728
 729		csr = musb_readw(epio, MUSB_TXCSR);
 730		csr &= ~(MUSB_TXCSR_AUTOSET | MUSB_TXCSR_DMAENAB);
 731		musb_writew(epio, MUSB_TXCSR, csr | MUSB_TXCSR_H_WZC_BITS);
 732		return false;
 733	}
 734	return true;
 735}
 736
 737/*
 738 * Program an HDRC endpoint as per the given URB
 739 * Context: irqs blocked, controller lock held
 740 */
 741static void musb_ep_program(struct musb *musb, u8 epnum,
 742			struct urb *urb, int is_out,
 743			u8 *buf, u32 offset, u32 len)
 744{
 745	struct dma_controller	*dma_controller;
 746	struct dma_channel	*dma_channel;
 747	u8			dma_ok;
 748	void __iomem		*mbase = musb->mregs;
 749	struct musb_hw_ep	*hw_ep = musb->endpoints + epnum;
 750	void __iomem		*epio = hw_ep->regs;
 751	struct musb_qh		*qh = musb_ep_get_qh(hw_ep, !is_out);
 752	u16			packet_sz = qh->maxpacket;
 753	u8			use_dma = 1;
 754	u16			csr;
 755
 756	dev_dbg(musb->controller, "%s hw%d urb %p spd%d dev%d ep%d%s "
 757				"h_addr%02x h_port%02x bytes %d\n",
 758			is_out ? "-->" : "<--",
 759			epnum, urb, urb->dev->speed,
 760			qh->addr_reg, qh->epnum, is_out ? "out" : "in",
 761			qh->h_addr_reg, qh->h_port_reg,
 762			len);
 763
 764	musb_ep_select(mbase, epnum);
 765
 766	if (is_out && !len) {
 767		use_dma = 0;
 768		csr = musb_readw(epio, MUSB_TXCSR);
 769		csr &= ~MUSB_TXCSR_DMAENAB;
 770		musb_writew(epio, MUSB_TXCSR, csr);
 771		hw_ep->tx_channel = NULL;
 772	}
 773
 774	/* candidate for DMA? */
 775	dma_controller = musb->dma_controller;
 776	if (use_dma && is_dma_capable() && epnum && dma_controller) {
 777		dma_channel = is_out ? hw_ep->tx_channel : hw_ep->rx_channel;
 778		if (!dma_channel) {
 779			dma_channel = dma_controller->channel_alloc(
 780					dma_controller, hw_ep, is_out);
 781			if (is_out)
 782				hw_ep->tx_channel = dma_channel;
 783			else
 784				hw_ep->rx_channel = dma_channel;
 785		}
 786	} else
 787		dma_channel = NULL;
 788
 789	/* make sure we clear DMAEnab, autoSet bits from previous run */
 790
 791	/* OUT/transmit/EP0 or IN/receive? */
 792	if (is_out) {
 793		u16	csr;
 794		u16	int_txe;
 795		u16	load_count;
 796
 797		csr = musb_readw(epio, MUSB_TXCSR);
 798
 799		/* disable interrupt in case we flush */
 800		int_txe = musb->intrtxe;
 801		musb_writew(mbase, MUSB_INTRTXE, int_txe & ~(1 << epnum));
 802
 803		/* general endpoint setup */
 804		if (epnum) {
 805			/* flush all old state, set default */
 806			/*
 807			 * We could be flushing valid
 808			 * packets in double buffering
 809			 * case
 810			 */
 811			if (!hw_ep->tx_double_buffered)
 812				musb_h_tx_flush_fifo(hw_ep);
 813
 814			/*
 815			 * We must not clear the DMAMODE bit before or in
 816			 * the same cycle with the DMAENAB bit, so we clear
 817			 * the latter first...
 818			 */
 819			csr &= ~(MUSB_TXCSR_H_NAKTIMEOUT
 820					| MUSB_TXCSR_AUTOSET
 821					| MUSB_TXCSR_DMAENAB
 822					| MUSB_TXCSR_FRCDATATOG
 823					| MUSB_TXCSR_H_RXSTALL
 824					| MUSB_TXCSR_H_ERROR
 825					| MUSB_TXCSR_TXPKTRDY
 826					);
 827			csr |= MUSB_TXCSR_MODE;
 828
 829			if (!hw_ep->tx_double_buffered) {
 830				if (usb_gettoggle(urb->dev, qh->epnum, 1))
 831					csr |= MUSB_TXCSR_H_WR_DATATOGGLE
 832						| MUSB_TXCSR_H_DATATOGGLE;
 833				else
 834					csr |= MUSB_TXCSR_CLRDATATOG;
 835			}
 836
 837			musb_writew(epio, MUSB_TXCSR, csr);
 838			/* REVISIT may need to clear FLUSHFIFO ... */
 839			csr &= ~MUSB_TXCSR_DMAMODE;
 840			musb_writew(epio, MUSB_TXCSR, csr);
 841			csr = musb_readw(epio, MUSB_TXCSR);
 842		} else {
 843			/* endpoint 0: just flush */
 844			musb_h_ep0_flush_fifo(hw_ep);
 845		}
 846
 847		/* target addr and (for multipoint) hub addr/port */
 848		if (musb->is_multipoint) {
 849			musb_write_txfunaddr(musb, epnum, qh->addr_reg);
 850			musb_write_txhubaddr(musb, epnum, qh->h_addr_reg);
 851			musb_write_txhubport(musb, epnum, qh->h_port_reg);
 852/* FIXME if !epnum, do the same for RX ... */
 853		} else
 854			musb_writeb(mbase, MUSB_FADDR, qh->addr_reg);
 855
 856		/* protocol/endpoint/interval/NAKlimit */
 857		if (epnum) {
 858			musb_writeb(epio, MUSB_TXTYPE, qh->type_reg);
 859			if (musb->double_buffer_not_ok) {
 860				musb_writew(epio, MUSB_TXMAXP,
 861						hw_ep->max_packet_sz_tx);
 862			} else if (can_bulk_split(musb, qh->type)) {
 863				qh->hb_mult = hw_ep->max_packet_sz_tx
 864						/ packet_sz;
 865				musb_writew(epio, MUSB_TXMAXP, packet_sz
 866					| ((qh->hb_mult) - 1) << 11);
 867			} else {
 868				musb_writew(epio, MUSB_TXMAXP,
 869						qh->maxpacket |
 870						((qh->hb_mult - 1) << 11));
 871			}
 872			musb_writeb(epio, MUSB_TXINTERVAL, qh->intv_reg);
 873		} else {
 874			musb_writeb(epio, MUSB_NAKLIMIT0, qh->intv_reg);
 875			if (musb->is_multipoint)
 876				musb_writeb(epio, MUSB_TYPE0,
 877						qh->type_reg);
 878		}
 879
 880		if (can_bulk_split(musb, qh->type))
 881			load_count = min((u32) hw_ep->max_packet_sz_tx,
 882						len);
 883		else
 884			load_count = min((u32) packet_sz, len);
 885
 886		if (dma_channel && musb_tx_dma_program(dma_controller,
 887					hw_ep, qh, urb, offset, len))
 888			load_count = 0;
 889
 890		if (load_count) {
 891			/* PIO to load FIFO */
 892			qh->segsize = load_count;
 893			if (!buf) {
 894				sg_miter_start(&qh->sg_miter, urb->sg, 1,
 895						SG_MITER_ATOMIC
 896						| SG_MITER_FROM_SG);
 897				if (!sg_miter_next(&qh->sg_miter)) {
 898					dev_err(musb->controller,
 899							"error: sg"
 900							"list empty\n");
 901					sg_miter_stop(&qh->sg_miter);
 902					goto finish;
 903				}
 904				buf = qh->sg_miter.addr + urb->sg->offset +
 905					urb->actual_length;
 906				load_count = min_t(u32, load_count,
 907						qh->sg_miter.length);
 908				musb_write_fifo(hw_ep, load_count, buf);
 909				qh->sg_miter.consumed = load_count;
 910				sg_miter_stop(&qh->sg_miter);
 911			} else
 912				musb_write_fifo(hw_ep, load_count, buf);
 913		}
 914finish:
 915		/* re-enable interrupt */
 916		musb_writew(mbase, MUSB_INTRTXE, int_txe);
 917
 918	/* IN/receive */
 919	} else {
 920		u16	csr;
 921
 922		if (hw_ep->rx_reinit) {
 923			musb_rx_reinit(musb, qh, epnum);
 924
 925			/* init new state: toggle and NYET, maybe DMA later */
 926			if (usb_gettoggle(urb->dev, qh->epnum, 0))
 927				csr = MUSB_RXCSR_H_WR_DATATOGGLE
 928					| MUSB_RXCSR_H_DATATOGGLE;
 929			else
 930				csr = 0;
 931			if (qh->type == USB_ENDPOINT_XFER_INT)
 932				csr |= MUSB_RXCSR_DISNYET;
 933
 934		} else {
 935			csr = musb_readw(hw_ep->regs, MUSB_RXCSR);
 936
 937			if (csr & (MUSB_RXCSR_RXPKTRDY
 938					| MUSB_RXCSR_DMAENAB
 939					| MUSB_RXCSR_H_REQPKT))
 940				ERR("broken !rx_reinit, ep%d csr %04x\n",
 941						hw_ep->epnum, csr);
 942
 943			/* scrub any stale state, leaving toggle alone */
 944			csr &= MUSB_RXCSR_DISNYET;
 945		}
 946
 947		/* kick things off */
 948
 949		if ((is_cppi_enabled(musb) || tusb_dma_omap(musb)) && dma_channel) {
 950			/* Candidate for DMA */
 951			dma_channel->actual_len = 0L;
 952			qh->segsize = len;
 953
 954			/* AUTOREQ is in a DMA register */
 955			musb_writew(hw_ep->regs, MUSB_RXCSR, csr);
 956			csr = musb_readw(hw_ep->regs, MUSB_RXCSR);
 957
 958			/*
 959			 * Unless caller treats short RX transfers as
 960			 * errors, we dare not queue multiple transfers.
 961			 */
 962			dma_ok = dma_controller->channel_program(dma_channel,
 963					packet_sz, !(urb->transfer_flags &
 964						     URB_SHORT_NOT_OK),
 965					urb->transfer_dma + offset,
 966					qh->segsize);
 967			if (!dma_ok) {
 968				dma_controller->channel_release(dma_channel);
 969				hw_ep->rx_channel = dma_channel = NULL;
 970			} else
 971				csr |= MUSB_RXCSR_DMAENAB;
 972		}
 973
 974		csr |= MUSB_RXCSR_H_REQPKT;
 975		dev_dbg(musb->controller, "RXCSR%d := %04x\n", epnum, csr);
 976		musb_writew(hw_ep->regs, MUSB_RXCSR, csr);
 977		csr = musb_readw(hw_ep->regs, MUSB_RXCSR);
 978	}
 979}
 980
 981/* Schedule next QH from musb->in_bulk/out_bulk and move the current qh to
 982 * the end; avoids starvation for other endpoints.
 983 */
 984static void musb_bulk_nak_timeout(struct musb *musb, struct musb_hw_ep *ep,
 985	int is_in)
 986{
 987	struct dma_channel	*dma;
 988	struct urb		*urb;
 989	void __iomem		*mbase = musb->mregs;
 990	void __iomem		*epio = ep->regs;
 991	struct musb_qh		*cur_qh, *next_qh;
 992	u16			rx_csr, tx_csr;
 993
 994	musb_ep_select(mbase, ep->epnum);
 995	if (is_in) {
 996		dma = is_dma_capable() ? ep->rx_channel : NULL;
 997
 998		/* clear nak timeout bit */
 999		rx_csr = musb_readw(epio, MUSB_RXCSR);
1000		rx_csr |= MUSB_RXCSR_H_WZC_BITS;
1001		rx_csr &= ~MUSB_RXCSR_DATAERROR;
1002		musb_writew(epio, MUSB_RXCSR, rx_csr);
1003
1004		cur_qh = first_qh(&musb->in_bulk);
1005	} else {
1006		dma = is_dma_capable() ? ep->tx_channel : NULL;
1007
1008		/* clear nak timeout bit */
1009		tx_csr = musb_readw(epio, MUSB_TXCSR);
1010		tx_csr |= MUSB_TXCSR_H_WZC_BITS;
1011		tx_csr &= ~MUSB_TXCSR_H_NAKTIMEOUT;
1012		musb_writew(epio, MUSB_TXCSR, tx_csr);
1013
1014		cur_qh = first_qh(&musb->out_bulk);
1015	}
1016	if (cur_qh) {
1017		urb = next_urb(cur_qh);
1018		if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
1019			dma->status = MUSB_DMA_STATUS_CORE_ABORT;
1020			musb->dma_controller->channel_abort(dma);
1021			urb->actual_length += dma->actual_len;
1022			dma->actual_len = 0L;
1023		}
1024		musb_save_toggle(cur_qh, is_in, urb);
1025
1026		if (is_in) {
1027			/* move cur_qh to end of queue */
1028			list_move_tail(&cur_qh->ring, &musb->in_bulk);
1029
1030			/* get the next qh from musb->in_bulk */
1031			next_qh = first_qh(&musb->in_bulk);
1032
1033			/* set rx_reinit and schedule the next qh */
1034			ep->rx_reinit = 1;
1035		} else {
1036			/* move cur_qh to end of queue */
1037			list_move_tail(&cur_qh->ring, &musb->out_bulk);
1038
1039			/* get the next qh from musb->out_bulk */
1040			next_qh = first_qh(&musb->out_bulk);
1041
1042			/* set tx_reinit and schedule the next qh */
1043			ep->tx_reinit = 1;
1044		}
1045		musb_start_urb(musb, is_in, next_qh);
1046	}
1047}
1048
1049/*
1050 * Service the default endpoint (ep0) as host.
1051 * Return true until it's time to start the status stage.
1052 */
1053static bool musb_h_ep0_continue(struct musb *musb, u16 len, struct urb *urb)
1054{
1055	bool			 more = false;
1056	u8			*fifo_dest = NULL;
1057	u16			fifo_count = 0;
1058	struct musb_hw_ep	*hw_ep = musb->control_ep;
1059	struct musb_qh		*qh = hw_ep->in_qh;
1060	struct usb_ctrlrequest	*request;
1061
1062	switch (musb->ep0_stage) {
1063	case MUSB_EP0_IN:
1064		fifo_dest = urb->transfer_buffer + urb->actual_length;
1065		fifo_count = min_t(size_t, len, urb->transfer_buffer_length -
1066				   urb->actual_length);
1067		if (fifo_count < len)
1068			urb->status = -EOVERFLOW;
1069
1070		musb_read_fifo(hw_ep, fifo_count, fifo_dest);
1071
1072		urb->actual_length += fifo_count;
1073		if (len < qh->maxpacket) {
1074			/* always terminate on short read; it's
1075			 * rarely reported as an error.
1076			 */
1077		} else if (urb->actual_length <
1078				urb->transfer_buffer_length)
1079			more = true;
1080		break;
1081	case MUSB_EP0_START:
1082		request = (struct usb_ctrlrequest *) urb->setup_packet;
1083
1084		if (!request->wLength) {
1085			dev_dbg(musb->controller, "start no-DATA\n");
1086			break;
1087		} else if (request->bRequestType & USB_DIR_IN) {
1088			dev_dbg(musb->controller, "start IN-DATA\n");
1089			musb->ep0_stage = MUSB_EP0_IN;
1090			more = true;
1091			break;
1092		} else {
1093			dev_dbg(musb->controller, "start OUT-DATA\n");
1094			musb->ep0_stage = MUSB_EP0_OUT;
1095			more = true;
1096		}
1097		/* FALLTHROUGH */
1098	case MUSB_EP0_OUT:
1099		fifo_count = min_t(size_t, qh->maxpacket,
1100				   urb->transfer_buffer_length -
1101				   urb->actual_length);
1102		if (fifo_count) {
1103			fifo_dest = (u8 *) (urb->transfer_buffer
1104					+ urb->actual_length);
1105			dev_dbg(musb->controller, "Sending %d byte%s to ep0 fifo %p\n",
1106					fifo_count,
1107					(fifo_count == 1) ? "" : "s",
1108					fifo_dest);
1109			musb_write_fifo(hw_ep, fifo_count, fifo_dest);
1110
1111			urb->actual_length += fifo_count;
1112			more = true;
1113		}
1114		break;
1115	default:
1116		ERR("bogus ep0 stage %d\n", musb->ep0_stage);
1117		break;
1118	}
1119
1120	return more;
1121}
1122
1123/*
1124 * Handle default endpoint interrupt as host. Only called in IRQ time
1125 * from musb_interrupt().
1126 *
1127 * called with controller irqlocked
1128 */
1129irqreturn_t musb_h_ep0_irq(struct musb *musb)
1130{
1131	struct urb		*urb;
1132	u16			csr, len;
1133	int			status = 0;
1134	void __iomem		*mbase = musb->mregs;
1135	struct musb_hw_ep	*hw_ep = musb->control_ep;
1136	void __iomem		*epio = hw_ep->regs;
1137	struct musb_qh		*qh = hw_ep->in_qh;
1138	bool			complete = false;
1139	irqreturn_t		retval = IRQ_NONE;
1140
1141	/* ep0 only has one queue, "in" */
1142	urb = next_urb(qh);
1143
1144	musb_ep_select(mbase, 0);
1145	csr = musb_readw(epio, MUSB_CSR0);
1146	len = (csr & MUSB_CSR0_RXPKTRDY)
1147			? musb_readb(epio, MUSB_COUNT0)
1148			: 0;
1149
1150	dev_dbg(musb->controller, "<== csr0 %04x, qh %p, count %d, urb %p, stage %d\n",
1151		csr, qh, len, urb, musb->ep0_stage);
1152
1153	/* if we just did status stage, we are done */
1154	if (MUSB_EP0_STATUS == musb->ep0_stage) {
1155		retval = IRQ_HANDLED;
1156		complete = true;
1157	}
1158
1159	/* prepare status */
1160	if (csr & MUSB_CSR0_H_RXSTALL) {
1161		dev_dbg(musb->controller, "STALLING ENDPOINT\n");
1162		status = -EPIPE;
1163
1164	} else if (csr & MUSB_CSR0_H_ERROR) {
1165		dev_dbg(musb->controller, "no response, csr0 %04x\n", csr);
1166		status = -EPROTO;
1167
1168	} else if (csr & MUSB_CSR0_H_NAKTIMEOUT) {
1169		dev_dbg(musb->controller, "control NAK timeout\n");
1170
1171		/* NOTE:  this code path would be a good place to PAUSE a
1172		 * control transfer, if another one is queued, so that
1173		 * ep0 is more likely to stay busy.  That's already done
1174		 * for bulk RX transfers.
1175		 *
1176		 * if (qh->ring.next != &musb->control), then
1177		 * we have a candidate... NAKing is *NOT* an error
1178		 */
1179		musb_writew(epio, MUSB_CSR0, 0);
1180		retval = IRQ_HANDLED;
1181	}
1182
1183	if (status) {
1184		dev_dbg(musb->controller, "aborting\n");
1185		retval = IRQ_HANDLED;
1186		if (urb)
1187			urb->status = status;
1188		complete = true;
1189
1190		/* use the proper sequence to abort the transfer */
1191		if (csr & MUSB_CSR0_H_REQPKT) {
1192			csr &= ~MUSB_CSR0_H_REQPKT;
1193			musb_writew(epio, MUSB_CSR0, csr);
1194			csr &= ~MUSB_CSR0_H_NAKTIMEOUT;
1195			musb_writew(epio, MUSB_CSR0, csr);
1196		} else {
1197			musb_h_ep0_flush_fifo(hw_ep);
1198		}
1199
1200		musb_writeb(epio, MUSB_NAKLIMIT0, 0);
1201
1202		/* clear it */
1203		musb_writew(epio, MUSB_CSR0, 0);
1204	}
1205
1206	if (unlikely(!urb)) {
1207		/* stop endpoint since we have no place for its data, this
1208		 * SHOULD NEVER HAPPEN! */
1209		ERR("no URB for end 0\n");
1210
1211		musb_h_ep0_flush_fifo(hw_ep);
1212		goto done;
1213	}
1214
1215	if (!complete) {
1216		/* call common logic and prepare response */
1217		if (musb_h_ep0_continue(musb, len, urb)) {
1218			/* more packets required */
1219			csr = (MUSB_EP0_IN == musb->ep0_stage)
1220				?  MUSB_CSR0_H_REQPKT : MUSB_CSR0_TXPKTRDY;
1221		} else {
1222			/* data transfer complete; perform status phase */
1223			if (usb_pipeout(urb->pipe)
1224					|| !urb->transfer_buffer_length)
1225				csr = MUSB_CSR0_H_STATUSPKT
1226					| MUSB_CSR0_H_REQPKT;
1227			else
1228				csr = MUSB_CSR0_H_STATUSPKT
1229					| MUSB_CSR0_TXPKTRDY;
1230
1231			/* disable ping token in status phase */
1232			csr |= MUSB_CSR0_H_DIS_PING;
1233
1234			/* flag status stage */
1235			musb->ep0_stage = MUSB_EP0_STATUS;
1236
1237			dev_dbg(musb->controller, "ep0 STATUS, csr %04x\n", csr);
1238
1239		}
1240		musb_writew(epio, MUSB_CSR0, csr);
1241		retval = IRQ_HANDLED;
1242	} else
1243		musb->ep0_stage = MUSB_EP0_IDLE;
1244
1245	/* call completion handler if done */
1246	if (complete)
1247		musb_advance_schedule(musb, urb, hw_ep, 1);
1248done:
1249	return retval;
1250}
1251
1252
1253#ifdef CONFIG_USB_INVENTRA_DMA
1254
1255/* Host side TX (OUT) using Mentor DMA works as follows:
1256	submit_urb ->
1257		- if queue was empty, Program Endpoint
1258		- ... which starts DMA to fifo in mode 1 or 0
1259
1260	DMA Isr (transfer complete) -> TxAvail()
1261		- Stop DMA (~DmaEnab)	(<--- Alert ... currently happens
1262					only in musb_cleanup_urb)
1263		- TxPktRdy has to be set in mode 0 or for
1264			short packets in mode 1.
1265*/
1266
1267#endif
1268
1269/* Service a Tx-Available or dma completion irq for the endpoint */
1270void musb_host_tx(struct musb *musb, u8 epnum)
1271{
1272	int			pipe;
1273	bool			done = false;
1274	u16			tx_csr;
1275	size_t			length = 0;
1276	size_t			offset = 0;
1277	struct musb_hw_ep	*hw_ep = musb->endpoints + epnum;
1278	void __iomem		*epio = hw_ep->regs;
1279	struct musb_qh		*qh = hw_ep->out_qh;
1280	struct urb		*urb = next_urb(qh);
1281	u32			status = 0;
1282	void __iomem		*mbase = musb->mregs;
1283	struct dma_channel	*dma;
1284	bool			transfer_pending = false;
1285
1286	musb_ep_select(mbase, epnum);
1287	tx_csr = musb_readw(epio, MUSB_TXCSR);
1288
1289	/* with CPPI, DMA sometimes triggers "extra" irqs */
1290	if (!urb) {
1291		dev_dbg(musb->controller, "extra TX%d ready, csr %04x\n", epnum, tx_csr);
1292		return;
1293	}
1294
1295	pipe = urb->pipe;
1296	dma = is_dma_capable() ? hw_ep->tx_channel : NULL;
1297	dev_dbg(musb->controller, "OUT/TX%d end, csr %04x%s\n", epnum, tx_csr,
1298			dma ? ", dma" : "");
1299
1300	/* check for errors */
1301	if (tx_csr & MUSB_TXCSR_H_RXSTALL) {
1302		/* dma was disabled, fifo flushed */
1303		dev_dbg(musb->controller, "TX end %d stall\n", epnum);
1304
1305		/* stall; record URB status */
1306		status = -EPIPE;
1307
1308	} else if (tx_csr & MUSB_TXCSR_H_ERROR) {
1309		/* (NON-ISO) dma was disabled, fifo flushed */
1310		dev_dbg(musb->controller, "TX 3strikes on ep=%d\n", epnum);
1311
1312		status = -ETIMEDOUT;
1313
1314	} else if (tx_csr & MUSB_TXCSR_H_NAKTIMEOUT) {
1315		if (USB_ENDPOINT_XFER_BULK == qh->type && qh->mux == 1
1316				&& !list_is_singular(&musb->out_bulk)) {
1317			dev_dbg(musb->controller,
1318				"NAK timeout on TX%d ep\n", epnum);
1319			musb_bulk_nak_timeout(musb, hw_ep, 0);
1320		} else {
1321			dev_dbg(musb->controller,
1322				"TX end=%d device not responding\n", epnum);
1323			/* NOTE:  this code path would be a good place to PAUSE a
1324			 * transfer, if there's some other (nonperiodic) tx urb
1325			 * that could use this fifo.  (dma complicates it...)
1326			 * That's already done for bulk RX transfers.
1327			 *
1328			 * if (bulk && qh->ring.next != &musb->out_bulk), then
1329			 * we have a candidate... NAKing is *NOT* an error
1330			 */
1331			musb_ep_select(mbase, epnum);
1332			musb_writew(epio, MUSB_TXCSR,
1333					MUSB_TXCSR_H_WZC_BITS
1334					| MUSB_TXCSR_TXPKTRDY);
1335		}
1336			return;
1337	}
1338
1339done:
1340	if (status) {
1341		if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
1342			dma->status = MUSB_DMA_STATUS_CORE_ABORT;
1343			musb->dma_controller->channel_abort(dma);
1344		}
1345
1346		/* do the proper sequence to abort the transfer in the
1347		 * usb core; the dma engine should already be stopped.
1348		 */
1349		musb_h_tx_flush_fifo(hw_ep);
1350		tx_csr &= ~(MUSB_TXCSR_AUTOSET
1351				| MUSB_TXCSR_DMAENAB
1352				| MUSB_TXCSR_H_ERROR
1353				| MUSB_TXCSR_H_RXSTALL
1354				| MUSB_TXCSR_H_NAKTIMEOUT
1355				);
1356
1357		musb_ep_select(mbase, epnum);
1358		musb_writew(epio, MUSB_TXCSR, tx_csr);
1359		/* REVISIT may need to clear FLUSHFIFO ... */
1360		musb_writew(epio, MUSB_TXCSR, tx_csr);
1361		musb_writeb(epio, MUSB_TXINTERVAL, 0);
1362
1363		done = true;
1364	}
1365
1366	/* second cppi case */
1367	if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
1368		dev_dbg(musb->controller, "extra TX%d ready, csr %04x\n", epnum, tx_csr);
1369		return;
1370	}
1371
1372	if (is_dma_capable() && dma && !status) {
1373		/*
1374		 * DMA has completed.  But if we're using DMA mode 1 (multi
1375		 * packet DMA), we need a terminal TXPKTRDY interrupt before
1376		 * we can consider this transfer completed, lest we trash
1377		 * its last packet when writing the next URB's data.  So we
1378		 * switch back to mode 0 to get that interrupt; we'll come
1379		 * back here once it happens.
1380		 */
1381		if (tx_csr & MUSB_TXCSR_DMAMODE) {
1382			/*
1383			 * We shouldn't clear DMAMODE with DMAENAB set; so
1384			 * clear them in a safe order.  That should be OK
1385			 * once TXPKTRDY has been set (and I've never seen
1386			 * it being 0 at this moment -- DMA interrupt latency
1387			 * is significant) but if it hasn't been then we have
1388			 * no choice but to stop being polite and ignore the
1389			 * programmer's guide... :-)
1390			 *
1391			 * Note that we must write TXCSR with TXPKTRDY cleared
1392			 * in order not to re-trigger the packet send (this bit
1393			 * can't be cleared by CPU), and there's another caveat:
1394			 * TXPKTRDY may be set shortly and then cleared in the
1395			 * double-buffered FIFO mode, so we do an extra TXCSR
1396			 * read for debouncing...
1397			 */
1398			tx_csr &= musb_readw(epio, MUSB_TXCSR);
1399			if (tx_csr & MUSB_TXCSR_TXPKTRDY) {
1400				tx_csr &= ~(MUSB_TXCSR_DMAENAB |
1401					    MUSB_TXCSR_TXPKTRDY);
1402				musb_writew(epio, MUSB_TXCSR,
1403					    tx_csr | MUSB_TXCSR_H_WZC_BITS);
1404			}
1405			tx_csr &= ~(MUSB_TXCSR_DMAMODE |
1406				    MUSB_TXCSR_TXPKTRDY);
1407			musb_writew(epio, MUSB_TXCSR,
1408				    tx_csr | MUSB_TXCSR_H_WZC_BITS);
1409
1410			/*
1411			 * There is no guarantee that we'll get an interrupt
1412			 * after clearing DMAMODE as we might have done this
1413			 * too late (after TXPKTRDY was cleared by controller).
1414			 * Re-read TXCSR as we have spoiled its previous value.
1415			 */
1416			tx_csr = musb_readw(epio, MUSB_TXCSR);
1417		}
1418
1419		/*
1420		 * We may get here from a DMA completion or TXPKTRDY interrupt.
1421		 * In any case, we must check the FIFO status here and bail out
1422		 * only if the FIFO still has data -- that should prevent the
1423		 * "missed" TXPKTRDY interrupts and deal with double-buffered
1424		 * FIFO mode too...
1425		 */
1426		if (tx_csr & (MUSB_TXCSR_FIFONOTEMPTY | MUSB_TXCSR_TXPKTRDY)) {
1427			dev_dbg(musb->controller, "DMA complete but packet still in FIFO, "
1428			    "CSR %04x\n", tx_csr);
1429			return;
1430		}
1431	}
1432
1433	if (!status || dma || usb_pipeisoc(pipe)) {
1434		if (dma)
1435			length = dma->actual_len;
1436		else
1437			length = qh->segsize;
1438		qh->offset += length;
1439
1440		if (usb_pipeisoc(pipe)) {
1441			struct usb_iso_packet_descriptor	*d;
1442
1443			d = urb->iso_frame_desc + qh->iso_idx;
1444			d->actual_length = length;
1445			d->status = status;
1446			if (++qh->iso_idx >= urb->number_of_packets) {
1447				done = true;
1448			} else {
1449				d++;
1450				offset = d->offset;
1451				length = d->length;
1452			}
1453		} else if (dma && urb->transfer_buffer_length == qh->offset) {
1454			done = true;
1455		} else {
1456			/* see if we need to send more data, or ZLP */
1457			if (qh->segsize < qh->maxpacket)
1458				done = true;
1459			else if (qh->offset == urb->transfer_buffer_length
1460					&& !(urb->transfer_flags
1461						& URB_ZERO_PACKET))
1462				done = true;
1463			if (!done) {
1464				offset = qh->offset;
1465				length = urb->transfer_buffer_length - offset;
1466				transfer_pending = true;
1467			}
1468		}
1469	}
1470
1471	/* urb->status != -EINPROGRESS means request has been faulted,
1472	 * so we must abort this transfer after cleanup
1473	 */
1474	if (urb->status != -EINPROGRESS) {
1475		done = true;
1476		if (status == 0)
1477			status = urb->status;
1478	}
1479
1480	if (done) {
1481		/* set status */
1482		urb->status = status;
1483		urb->actual_length = qh->offset;
1484		musb_advance_schedule(musb, urb, hw_ep, USB_DIR_OUT);
1485		return;
1486	} else if ((usb_pipeisoc(pipe) || transfer_pending) && dma) {
1487		if (musb_tx_dma_program(musb->dma_controller, hw_ep, qh, urb,
1488				offset, length)) {
1489			if (is_cppi_enabled(musb) || tusb_dma_omap(musb))
1490				musb_h_tx_dma_start(hw_ep);
1491			return;
1492		}
1493	} else	if (tx_csr & MUSB_TXCSR_DMAENAB) {
1494		dev_dbg(musb->controller, "not complete, but DMA enabled?\n");
1495		return;
1496	}
1497
1498	/*
1499	 * PIO: start next packet in this URB.
1500	 *
1501	 * REVISIT: some docs say that when hw_ep->tx_double_buffered,
1502	 * (and presumably, FIFO is not half-full) we should write *two*
1503	 * packets before updating TXCSR; other docs disagree...
1504	 */
1505	if (length > qh->maxpacket)
1506		length = qh->maxpacket;
1507	/* Unmap the buffer so that CPU can use it */
1508	usb_hcd_unmap_urb_for_dma(musb->hcd, urb);
1509
1510	/*
1511	 * We need to map sg if the transfer_buffer is
1512	 * NULL.
1513	 */
1514	if (!urb->transfer_buffer)
1515		qh->use_sg = true;
1516
1517	if (qh->use_sg) {
1518		/* sg_miter_start is already done in musb_ep_program */
1519		if (!sg_miter_next(&qh->sg_miter)) {
1520			dev_err(musb->controller, "error: sg list empty\n");
1521			sg_miter_stop(&qh->sg_miter);
1522			status = -EINVAL;
1523			goto done;
1524		}
1525		urb->transfer_buffer = qh->sg_miter.addr;
1526		length = min_t(u32, length, qh->sg_miter.length);
1527		musb_write_fifo(hw_ep, length, urb->transfer_buffer);
1528		qh->sg_miter.consumed = length;
1529		sg_miter_stop(&qh->sg_miter);
1530	} else {
1531		musb_write_fifo(hw_ep, length, urb->transfer_buffer + offset);
1532	}
1533
1534	qh->segsize = length;
1535
1536	if (qh->use_sg) {
1537		if (offset + length >= urb->transfer_buffer_length)
1538			qh->use_sg = false;
1539	}
1540
1541	musb_ep_select(mbase, epnum);
1542	musb_writew(epio, MUSB_TXCSR,
1543			MUSB_TXCSR_H_WZC_BITS | MUSB_TXCSR_TXPKTRDY);
1544}
1545
1546#ifdef CONFIG_USB_TI_CPPI41_DMA
1547/* Seems to set up ISO for cppi41 and not advance len. See commit c57c41d */
1548static int musb_rx_dma_iso_cppi41(struct dma_controller *dma,
1549				  struct musb_hw_ep *hw_ep,
1550				  struct musb_qh *qh,
1551				  struct urb *urb,
1552				  size_t len)
1553{
1554	struct dma_channel *channel = hw_ep->tx_channel;
1555	void __iomem *epio = hw_ep->regs;
1556	dma_addr_t *buf;
1557	u32 length, res;
1558	u16 val;
1559
1560	buf = (void *)urb->iso_frame_desc[qh->iso_idx].offset +
1561		(u32)urb->transfer_dma;
1562
1563	length = urb->iso_frame_desc[qh->iso_idx].length;
1564
1565	val = musb_readw(epio, MUSB_RXCSR);
1566	val |= MUSB_RXCSR_DMAENAB;
1567	musb_writew(hw_ep->regs, MUSB_RXCSR, val);
1568
1569	res = dma->channel_program(channel, qh->maxpacket, 0,
1570				   (u32)buf, length);
1571
1572	return res;
1573}
1574#else
1575static inline int musb_rx_dma_iso_cppi41(struct dma_controller *dma,
1576					 struct musb_hw_ep *hw_ep,
1577					 struct musb_qh *qh,
1578					 struct urb *urb,
1579					 size_t len)
1580{
1581	return false;
1582}
1583#endif
1584
1585#if defined(CONFIG_USB_INVENTRA_DMA) || defined(CONFIG_USB_UX500_DMA) || \
1586	defined(CONFIG_USB_TI_CPPI41_DMA)
1587/* Host side RX (IN) using Mentor DMA works as follows:
1588	submit_urb ->
1589		- if queue was empty, ProgramEndpoint
1590		- first IN token is sent out (by setting ReqPkt)
1591	LinuxIsr -> RxReady()
1592	/\	=> first packet is received
1593	|	- Set in mode 0 (DmaEnab, ~ReqPkt)
1594	|		-> DMA Isr (transfer complete) -> RxReady()
1595	|		    - Ack receive (~RxPktRdy), turn off DMA (~DmaEnab)
1596	|		    - if urb not complete, send next IN token (ReqPkt)
1597	|			   |		else complete urb.
1598	|			   |
1599	---------------------------
1600 *
1601 * Nuances of mode 1:
1602 *	For short packets, no ack (+RxPktRdy) is sent automatically
1603 *	(even if AutoClear is ON)
1604 *	For full packets, ack (~RxPktRdy) and next IN token (+ReqPkt) is sent
1605 *	automatically => major problem, as collecting the next packet becomes
1606 *	difficult. Hence mode 1 is not used.
1607 *
1608 * REVISIT
1609 *	All we care about at this driver level is that
1610 *       (a) all URBs terminate with REQPKT cleared and fifo(s) empty;
1611 *       (b) termination conditions are: short RX, or buffer full;
1612 *       (c) fault modes include
1613 *           - iff URB_SHORT_NOT_OK, short RX status is -EREMOTEIO.
1614 *             (and that endpoint's dma queue stops immediately)
1615 *           - overflow (full, PLUS more bytes in the terminal packet)
1616 *
1617 *	So for example, usb-storage sets URB_SHORT_NOT_OK, and would
1618 *	thus be a great candidate for using mode 1 ... for all but the
1619 *	last packet of one URB's transfer.
1620 */
1621static int musb_rx_dma_inventra_cppi41(struct dma_controller *dma,
1622				       struct musb_hw_ep *hw_ep,
1623				       struct musb_qh *qh,
1624				       struct urb *urb,
1625				       size_t len)
1626{
1627	struct dma_channel *channel = hw_ep->rx_channel;
1628	void __iomem *epio = hw_ep->regs;
1629	u16 val;
1630	int pipe;
1631	bool done;
1632
1633	pipe = urb->pipe;
1634
1635	if (usb_pipeisoc(pipe)) {
1636		struct usb_iso_packet_descriptor *d;
1637
1638		d = urb->iso_frame_desc + qh->iso_idx;
1639		d->actual_length = len;
1640
1641		/* even if there was an error, we did the dma
1642		 * for iso_frame_desc->length
1643		 */
1644		if (d->status != -EILSEQ && d->status != -EOVERFLOW)
1645			d->status = 0;
1646
1647		if (++qh->iso_idx >= urb->number_of_packets) {
1648			done = true;
1649		} else {
1650			/* REVISIT: Why ignore return value here? */
1651			if (musb_dma_cppi41(hw_ep->musb))
1652				done = musb_rx_dma_iso_cppi41(dma, hw_ep, qh,
1653							      urb, len);
1654			done = false;
1655		}
1656
1657	} else  {
1658		/* done if urb buffer is full or short packet is recd */
1659		done = (urb->actual_length + len >=
1660			urb->transfer_buffer_length
1661			|| channel->actual_len < qh->maxpacket
1662			|| channel->rx_packet_done);
1663	}
1664
1665	/* send IN token for next packet, without AUTOREQ */
1666	if (!done) {
1667		val = musb_readw(epio, MUSB_RXCSR);
1668		val |= MUSB_RXCSR_H_REQPKT;
1669		musb_writew(epio, MUSB_RXCSR, MUSB_RXCSR_H_WZC_BITS | val);
1670	}
1671
1672	return done;
1673}
1674
1675/* Disadvantage of using mode 1:
1676 *	It's basically usable only for mass storage class; essentially all
1677 *	other protocols also terminate transfers on short packets.
1678 *
1679 * Details:
1680 *	An extra IN token is sent at the end of the transfer (due to AUTOREQ)
1681 *	If you try to use mode 1 for (transfer_buffer_length - 512), and try
1682 *	to use the extra IN token to grab the last packet using mode 0, then
1683 *	the problem is that you cannot be sure when the device will send the
1684 *	last packet and RxPktRdy set. Sometimes the packet is recd too soon
1685 *	such that it gets lost when RxCSR is re-set at the end of the mode 1
1686 *	transfer, while sometimes it is recd just a little late so that if you
1687 *	try to configure for mode 0 soon after the mode 1 transfer is
1688 *	completed, you will find rxcount 0. Okay, so you might think why not
1689 *	wait for an interrupt when the pkt is recd. Well, you won't get any!
1690 */
1691static int musb_rx_dma_in_inventra_cppi41(struct dma_controller *dma,
1692					  struct musb_hw_ep *hw_ep,
1693					  struct musb_qh *qh,
1694					  struct urb *urb,
1695					  size_t len,
1696					  u8 iso_err)
1697{
1698	struct musb *musb = hw_ep->musb;
1699	void __iomem *epio = hw_ep->regs;
1700	struct dma_channel *channel = hw_ep->rx_channel;
1701	u16 rx_count, val;
1702	int length, pipe, done;
1703	dma_addr_t buf;
1704
1705	rx_count = musb_readw(epio, MUSB_RXCOUNT);
1706	pipe = urb->pipe;
1707
1708	if (usb_pipeisoc(pipe)) {
1709		int d_status = 0;
1710		struct usb_iso_packet_descriptor *d;
 
 
1711
1712		d = urb->iso_frame_desc + qh->iso_idx;
1713
1714		if (iso_err) {
1715			d_status = -EILSEQ;
1716			urb->error_count++;
 
 
 
1717		}
1718		if (rx_count > d->length) {
1719			if (d_status == 0) {
1720				d_status = -EOVERFLOW;
1721				urb->error_count++;
1722			}
1723			dev_dbg(musb->controller, "** OVERFLOW %d into %d\n",
1724				rx_count, d->length);
1725
1726			length = d->length;
1727		} else
1728			length = rx_count;
1729		d->status = d_status;
1730		buf = urb->transfer_dma + d->offset;
1731	} else {
1732		length = rx_count;
1733		buf = urb->transfer_dma + urb->actual_length;
1734	}
1735
1736	channel->desired_mode = 0;
1737#ifdef USE_MODE1
1738	/* because of the issue below, mode 1 will
1739	 * only rarely behave with correct semantics.
1740	 */
1741	if ((urb->transfer_flags & URB_SHORT_NOT_OK)
1742	    && (urb->transfer_buffer_length - urb->actual_length)
1743	    > qh->maxpacket)
1744		channel->desired_mode = 1;
1745	if (rx_count < hw_ep->max_packet_sz_rx) {
1746		length = rx_count;
1747		channel->desired_mode = 0;
1748	} else {
1749		length = urb->transfer_buffer_length;
1750	}
1751#endif
1752
1753	/* See comments above on disadvantages of using mode 1 */
1754	val = musb_readw(epio, MUSB_RXCSR);
1755	val &= ~MUSB_RXCSR_H_REQPKT;
1756
1757	if (channel->desired_mode == 0)
1758		val &= ~MUSB_RXCSR_H_AUTOREQ;
1759	else
1760		val |= MUSB_RXCSR_H_AUTOREQ;
1761	val |= MUSB_RXCSR_DMAENAB;
1762
1763	/* autoclear shouldn't be set in high bandwidth */
1764	if (qh->hb_mult == 1)
1765		val |= MUSB_RXCSR_AUTOCLEAR;
1766
1767	musb_writew(epio, MUSB_RXCSR, MUSB_RXCSR_H_WZC_BITS | val);
1768
1769	/* REVISIT if when actual_length != 0,
1770	 * transfer_buffer_length needs to be
1771	 * adjusted first...
1772	 */
1773	done = dma->channel_program(channel, qh->maxpacket,
1774				   channel->desired_mode,
1775				   buf, length);
1776
1777	if (!done) {
1778		dma->channel_release(channel);
1779		hw_ep->rx_channel = NULL;
1780		channel = NULL;
1781		val = musb_readw(epio, MUSB_RXCSR);
1782		val &= ~(MUSB_RXCSR_DMAENAB
1783			 | MUSB_RXCSR_H_AUTOREQ
1784			 | MUSB_RXCSR_AUTOCLEAR);
1785		musb_writew(epio, MUSB_RXCSR, val);
1786	}
1787
1788	return done;
1789}
1790#else
1791static inline int musb_rx_dma_inventra_cppi41(struct dma_controller *dma,
1792					      struct musb_hw_ep *hw_ep,
1793					      struct musb_qh *qh,
1794					      struct urb *urb,
1795					      size_t len)
1796{
1797	return false;
1798}
1799
1800static inline int musb_rx_dma_in_inventra_cppi41(struct dma_controller *dma,
1801						 struct musb_hw_ep *hw_ep,
1802						 struct musb_qh *qh,
1803						 struct urb *urb,
1804						 size_t len,
1805						 u8 iso_err)
1806{
1807	return false;
1808}
1809#endif
1810
1811/*
1812 * Service an RX interrupt for the given IN endpoint; docs cover bulk, iso,
1813 * and high-bandwidth IN transfer cases.
1814 */
1815void musb_host_rx(struct musb *musb, u8 epnum)
1816{
1817	struct urb		*urb;
1818	struct musb_hw_ep	*hw_ep = musb->endpoints + epnum;
1819	struct dma_controller	*c = musb->dma_controller;
1820	void __iomem		*epio = hw_ep->regs;
1821	struct musb_qh		*qh = hw_ep->in_qh;
1822	size_t			xfer_len;
1823	void __iomem		*mbase = musb->mregs;
1824	int			pipe;
1825	u16			rx_csr, val;
1826	bool			iso_err = false;
1827	bool			done = false;
1828	u32			status;
1829	struct dma_channel	*dma;
1830	unsigned int sg_flags = SG_MITER_ATOMIC | SG_MITER_TO_SG;
1831
1832	musb_ep_select(mbase, epnum);
1833
1834	urb = next_urb(qh);
1835	dma = is_dma_capable() ? hw_ep->rx_channel : NULL;
1836	status = 0;
1837	xfer_len = 0;
1838
1839	rx_csr = musb_readw(epio, MUSB_RXCSR);
1840	val = rx_csr;
1841
1842	if (unlikely(!urb)) {
1843		/* REVISIT -- THIS SHOULD NEVER HAPPEN ... but, at least
1844		 * usbtest #11 (unlinks) triggers it regularly, sometimes
1845		 * with fifo full.  (Only with DMA??)
1846		 */
1847		dev_dbg(musb->controller, "BOGUS RX%d ready, csr %04x, count %d\n", epnum, val,
1848			musb_readw(epio, MUSB_RXCOUNT));
1849		musb_h_flush_rxfifo(hw_ep, MUSB_RXCSR_CLRDATATOG);
1850		return;
1851	}
1852
1853	pipe = urb->pipe;
1854
1855	dev_dbg(musb->controller, "<== hw %d rxcsr %04x, urb actual %d (+dma %zu)\n",
1856		epnum, rx_csr, urb->actual_length,
1857		dma ? dma->actual_len : 0);
1858
1859	/* check for errors, concurrent stall & unlink is not really
1860	 * handled yet! */
1861	if (rx_csr & MUSB_RXCSR_H_RXSTALL) {
1862		dev_dbg(musb->controller, "RX end %d STALL\n", epnum);
1863
1864		/* stall; record URB status */
1865		status = -EPIPE;
1866
1867	} else if (rx_csr & MUSB_RXCSR_H_ERROR) {
1868		dev_dbg(musb->controller, "end %d RX proto error\n", epnum);
1869
1870		status = -EPROTO;
1871		musb_writeb(epio, MUSB_RXINTERVAL, 0);
1872
1873	} else if (rx_csr & MUSB_RXCSR_DATAERROR) {
1874
1875		if (USB_ENDPOINT_XFER_ISOC != qh->type) {
1876			dev_dbg(musb->controller, "RX end %d NAK timeout\n", epnum);
1877
1878			/* NOTE: NAKing is *NOT* an error, so we want to
1879			 * continue.  Except ... if there's a request for
1880			 * another QH, use that instead of starving it.
1881			 *
1882			 * Devices like Ethernet and serial adapters keep
1883			 * reads posted at all times, which will starve
1884			 * other devices without this logic.
1885			 */
1886			if (usb_pipebulk(urb->pipe)
1887					&& qh->mux == 1
1888					&& !list_is_singular(&musb->in_bulk)) {
1889				musb_bulk_nak_timeout(musb, hw_ep, 1);
1890				return;
1891			}
1892			musb_ep_select(mbase, epnum);
1893			rx_csr |= MUSB_RXCSR_H_WZC_BITS;
1894			rx_csr &= ~MUSB_RXCSR_DATAERROR;
1895			musb_writew(epio, MUSB_RXCSR, rx_csr);
1896
1897			goto finish;
1898		} else {
1899			dev_dbg(musb->controller, "RX end %d ISO data error\n", epnum);
1900			/* packet error reported later */
1901			iso_err = true;
1902		}
1903	} else if (rx_csr & MUSB_RXCSR_INCOMPRX) {
1904		dev_dbg(musb->controller, "end %d high bandwidth incomplete ISO packet RX\n",
1905				epnum);
1906		status = -EPROTO;
1907	}
1908
1909	/* faults abort the transfer */
1910	if (status) {
1911		/* clean up dma and collect transfer count */
1912		if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
1913			dma->status = MUSB_DMA_STATUS_CORE_ABORT;
1914			musb->dma_controller->channel_abort(dma);
1915			xfer_len = dma->actual_len;
1916		}
1917		musb_h_flush_rxfifo(hw_ep, MUSB_RXCSR_CLRDATATOG);
1918		musb_writeb(epio, MUSB_RXINTERVAL, 0);
1919		done = true;
1920		goto finish;
1921	}
1922
1923	if (unlikely(dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY)) {
1924		/* SHOULD NEVER HAPPEN ... but at least DaVinci has done it */
1925		ERR("RX%d dma busy, csr %04x\n", epnum, rx_csr);
1926		goto finish;
1927	}
1928
1929	/* thorough shutdown for now ... given more precise fault handling
1930	 * and better queueing support, we might keep a DMA pipeline going
1931	 * while processing this irq for earlier completions.
1932	 */
1933
1934	/* FIXME this is _way_ too much in-line logic for Mentor DMA */
1935	if (!musb_dma_inventra(musb) && !musb_dma_ux500(musb) &&
1936	    (rx_csr & MUSB_RXCSR_H_REQPKT)) {
 
1937		/* REVISIT this happened for a while on some short reads...
1938		 * the cleanup still needs investigation... looks bad...
1939		 * and also duplicates dma cleanup code above ... plus,
1940		 * shouldn't this be the "half full" double buffer case?
1941		 */
1942		if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
1943			dma->status = MUSB_DMA_STATUS_CORE_ABORT;
1944			musb->dma_controller->channel_abort(dma);
1945			xfer_len = dma->actual_len;
1946			done = true;
1947		}
1948
1949		dev_dbg(musb->controller, "RXCSR%d %04x, reqpkt, len %zu%s\n", epnum, rx_csr,
1950				xfer_len, dma ? ", dma" : "");
1951		rx_csr &= ~MUSB_RXCSR_H_REQPKT;
1952
1953		musb_ep_select(mbase, epnum);
1954		musb_writew(epio, MUSB_RXCSR,
1955				MUSB_RXCSR_H_WZC_BITS | rx_csr);
1956	}
1957
1958	if (dma && (rx_csr & MUSB_RXCSR_DMAENAB)) {
1959		xfer_len = dma->actual_len;
1960
1961		val &= ~(MUSB_RXCSR_DMAENAB
1962			| MUSB_RXCSR_H_AUTOREQ
1963			| MUSB_RXCSR_AUTOCLEAR
1964			| MUSB_RXCSR_RXPKTRDY);
1965		musb_writew(hw_ep->regs, MUSB_RXCSR, val);
1966
1967		if (musb_dma_inventra(musb) || musb_dma_ux500(musb) ||
1968		    musb_dma_cppi41(musb)) {
1969			    done = musb_rx_dma_inventra_cppi41(c, hw_ep, qh, urb, xfer_len);
1970			    dev_dbg(hw_ep->musb->controller,
1971				    "ep %d dma %s, rxcsr %04x, rxcount %d\n",
1972				    epnum, done ? "off" : "reset",
1973				    musb_readw(epio, MUSB_RXCSR),
1974				    musb_readw(epio, MUSB_RXCOUNT));
1975		} else {
1976			done = true;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1977		}
1978
 
 
 
 
 
 
 
1979	} else if (urb->status == -EINPROGRESS) {
1980		/* if no errors, be sure a packet is ready for unloading */
1981		if (unlikely(!(rx_csr & MUSB_RXCSR_RXPKTRDY))) {
1982			status = -EPROTO;
1983			ERR("Rx interrupt with no errors or packet!\n");
1984
1985			/* FIXME this is another "SHOULD NEVER HAPPEN" */
1986
1987/* SCRUB (RX) */
1988			/* do the proper sequence to abort the transfer */
1989			musb_ep_select(mbase, epnum);
1990			val &= ~MUSB_RXCSR_H_REQPKT;
1991			musb_writew(epio, MUSB_RXCSR, val);
1992			goto finish;
1993		}
1994
1995		/* we are expecting IN packets */
1996		if ((musb_dma_inventra(musb) || musb_dma_ux500(musb) ||
1997		    musb_dma_cppi41(musb)) && dma) {
1998			dev_dbg(hw_ep->musb->controller,
1999				"RX%d count %d, buffer 0x%llx len %d/%d\n",
2000				epnum, musb_readw(epio, MUSB_RXCOUNT),
2001				(unsigned long long) urb->transfer_dma
2002				+ urb->actual_length,
2003				qh->offset,
2004				urb->transfer_buffer_length);
2005
2006			if (musb_rx_dma_in_inventra_cppi41(c, hw_ep, qh, urb,
2007							   xfer_len, iso_err))
2008				goto finish;
2009			else
2010				dev_err(musb->controller, "error: rx_dma failed\n");
2011		}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2012
2013		if (!dma) {
2014			unsigned int received_len;
2015
2016			/* Unmap the buffer so that CPU can use it */
2017			usb_hcd_unmap_urb_for_dma(musb->hcd, urb);
 
 
 
2018
2019			/*
2020			 * We need to map sg if the transfer_buffer is
2021			 * NULL.
 
 
 
 
 
 
 
2022			 */
2023			if (!urb->transfer_buffer) {
2024				qh->use_sg = true;
2025				sg_miter_start(&qh->sg_miter, urb->sg, 1,
2026						sg_flags);
 
 
 
 
 
2027			}
 
 
2028
2029			if (qh->use_sg) {
2030				if (!sg_miter_next(&qh->sg_miter)) {
2031					dev_err(musb->controller, "error: sg list empty\n");
2032					sg_miter_stop(&qh->sg_miter);
2033					status = -EINVAL;
2034					done = true;
2035					goto finish;
2036				}
2037				urb->transfer_buffer = qh->sg_miter.addr;
2038				received_len = urb->actual_length;
2039				qh->offset = 0x0;
2040				done = musb_host_packet_rx(musb, urb, epnum,
2041						iso_err);
2042				/* Calculate the number of bytes received */
2043				received_len = urb->actual_length -
2044					received_len;
2045				qh->sg_miter.consumed = received_len;
2046				sg_miter_stop(&qh->sg_miter);
2047			} else {
2048				done = musb_host_packet_rx(musb, urb,
2049						epnum, iso_err);
2050			}
2051			dev_dbg(musb->controller, "read %spacket\n", done ? "last " : "");
2052		}
2053	}
2054
2055finish:
2056	urb->actual_length += xfer_len;
2057	qh->offset += xfer_len;
2058	if (done) {
2059		if (qh->use_sg)
2060			qh->use_sg = false;
2061
2062		if (urb->status == -EINPROGRESS)
2063			urb->status = status;
2064		musb_advance_schedule(musb, urb, hw_ep, USB_DIR_IN);
2065	}
2066}
2067
2068/* schedule nodes correspond to peripheral endpoints, like an OHCI QH.
2069 * the software schedule associates multiple such nodes with a given
2070 * host side hardware endpoint + direction; scheduling may activate
2071 * that hardware endpoint.
2072 */
2073static int musb_schedule(
2074	struct musb		*musb,
2075	struct musb_qh		*qh,
2076	int			is_in)
2077{
2078	int			idle = 0;
2079	int			best_diff;
2080	int			best_end, epnum;
2081	struct musb_hw_ep	*hw_ep = NULL;
2082	struct list_head	*head = NULL;
2083	u8			toggle;
2084	u8			txtype;
2085	struct urb		*urb = next_urb(qh);
2086
2087	/* use fixed hardware for control and bulk */
2088	if (qh->type == USB_ENDPOINT_XFER_CONTROL) {
2089		head = &musb->control;
2090		hw_ep = musb->control_ep;
2091		goto success;
2092	}
2093
2094	/* else, periodic transfers get muxed to other endpoints */
2095
2096	/*
2097	 * We know this qh hasn't been scheduled, so all we need to do
2098	 * is choose which hardware endpoint to put it on ...
2099	 *
2100	 * REVISIT what we really want here is a regular schedule tree
2101	 * like e.g. OHCI uses.
2102	 */
2103	best_diff = 4096;
2104	best_end = -1;
2105
2106	for (epnum = 1, hw_ep = musb->endpoints + 1;
2107			epnum < musb->nr_endpoints;
2108			epnum++, hw_ep++) {
2109		int	diff;
2110
2111		if (musb_ep_get_qh(hw_ep, is_in) != NULL)
2112			continue;
2113
2114		if (hw_ep == musb->bulk_ep)
2115			continue;
2116
2117		if (is_in)
2118			diff = hw_ep->max_packet_sz_rx;
2119		else
2120			diff = hw_ep->max_packet_sz_tx;
2121		diff -= (qh->maxpacket * qh->hb_mult);
2122
2123		if (diff >= 0 && best_diff > diff) {
2124
2125			/*
2126			 * Mentor controller has a bug in that if we schedule
2127			 * a BULK Tx transfer on an endpoint that had earlier
2128			 * handled ISOC then the BULK transfer has to start on
2129			 * a zero toggle.  If the BULK transfer starts on a 1
2130			 * toggle then this transfer will fail as the mentor
2131			 * controller starts the Bulk transfer on a 0 toggle
2132			 * irrespective of the programming of the toggle bits
2133			 * in the TXCSR register.  Check for this condition
2134			 * while allocating the EP for a Tx Bulk transfer.  If
2135			 * so skip this EP.
2136			 */
2137			hw_ep = musb->endpoints + epnum;
2138			toggle = usb_gettoggle(urb->dev, qh->epnum, !is_in);
2139			txtype = (musb_readb(hw_ep->regs, MUSB_TXTYPE)
2140					>> 4) & 0x3;
2141			if (!is_in && (qh->type == USB_ENDPOINT_XFER_BULK) &&
2142				toggle && (txtype == USB_ENDPOINT_XFER_ISOC))
2143				continue;
2144
2145			best_diff = diff;
2146			best_end = epnum;
2147		}
2148	}
2149	/* use bulk reserved ep1 if no other ep is free */
2150	if (best_end < 0 && qh->type == USB_ENDPOINT_XFER_BULK) {
2151		hw_ep = musb->bulk_ep;
2152		if (is_in)
2153			head = &musb->in_bulk;
2154		else
2155			head = &musb->out_bulk;
2156
2157		/* Enable bulk RX/TX NAK timeout scheme when bulk requests are
2158		 * multiplexed. This scheme does not work in high speed to full
2159		 * speed scenario as NAK interrupts are not coming from a
2160		 * full speed device connected to a high speed device.
2161		 * NAK timeout interval is 8 (128 uframe or 16ms) for HS and
2162		 * 4 (8 frame or 8ms) for FS device.
2163		 */
2164		if (qh->dev)
2165			qh->intv_reg =
2166				(USB_SPEED_HIGH == qh->dev->speed) ? 8 : 4;
2167		goto success;
2168	} else if (best_end < 0) {
2169		return -ENOSPC;
2170	}
2171
2172	idle = 1;
2173	qh->mux = 0;
2174	hw_ep = musb->endpoints + best_end;
2175	dev_dbg(musb->controller, "qh %p periodic slot %d\n", qh, best_end);
2176success:
2177	if (head) {
2178		idle = list_empty(head);
2179		list_add_tail(&qh->ring, head);
2180		qh->mux = 1;
2181	}
2182	qh->hw_ep = hw_ep;
2183	qh->hep->hcpriv = qh;
2184	if (idle)
2185		musb_start_urb(musb, is_in, qh);
2186	return 0;
2187}
2188
2189static int musb_urb_enqueue(
2190	struct usb_hcd			*hcd,
2191	struct urb			*urb,
2192	gfp_t				mem_flags)
2193{
2194	unsigned long			flags;
2195	struct musb			*musb = hcd_to_musb(hcd);
2196	struct usb_host_endpoint	*hep = urb->ep;
2197	struct musb_qh			*qh;
2198	struct usb_endpoint_descriptor	*epd = &hep->desc;
2199	int				ret;
2200	unsigned			type_reg;
2201	unsigned			interval;
2202
2203	/* host role must be active */
2204	if (!is_host_active(musb) || !musb->is_active)
2205		return -ENODEV;
2206
2207	spin_lock_irqsave(&musb->lock, flags);
2208	ret = usb_hcd_link_urb_to_ep(hcd, urb);
2209	qh = ret ? NULL : hep->hcpriv;
2210	if (qh)
2211		urb->hcpriv = qh;
2212	spin_unlock_irqrestore(&musb->lock, flags);
2213
2214	/* DMA mapping was already done, if needed, and this urb is on
2215	 * hep->urb_list now ... so we're done, unless hep wasn't yet
2216	 * scheduled onto a live qh.
2217	 *
2218	 * REVISIT best to keep hep->hcpriv valid until the endpoint gets
2219	 * disabled, testing for empty qh->ring and avoiding qh setup costs
2220	 * except for the first urb queued after a config change.
2221	 */
2222	if (qh || ret)
2223		return ret;
2224
2225	/* Allocate and initialize qh, minimizing the work done each time
2226	 * hw_ep gets reprogrammed, or with irqs blocked.  Then schedule it.
2227	 *
2228	 * REVISIT consider a dedicated qh kmem_cache, so it's harder
2229	 * for bugs in other kernel code to break this driver...
2230	 */
2231	qh = kzalloc(sizeof *qh, mem_flags);
2232	if (!qh) {
2233		spin_lock_irqsave(&musb->lock, flags);
2234		usb_hcd_unlink_urb_from_ep(hcd, urb);
2235		spin_unlock_irqrestore(&musb->lock, flags);
2236		return -ENOMEM;
2237	}
2238
2239	qh->hep = hep;
2240	qh->dev = urb->dev;
2241	INIT_LIST_HEAD(&qh->ring);
2242	qh->is_ready = 1;
2243
2244	qh->maxpacket = usb_endpoint_maxp(epd);
2245	qh->type = usb_endpoint_type(epd);
2246
2247	/* Bits 11 & 12 of wMaxPacketSize encode high bandwidth multiplier.
2248	 * Some musb cores don't support high bandwidth ISO transfers; and
2249	 * we don't (yet!) support high bandwidth interrupt transfers.
2250	 */
2251	qh->hb_mult = 1 + ((qh->maxpacket >> 11) & 0x03);
2252	if (qh->hb_mult > 1) {
2253		int ok = (qh->type == USB_ENDPOINT_XFER_ISOC);
2254
2255		if (ok)
2256			ok = (usb_pipein(urb->pipe) && musb->hb_iso_rx)
2257				|| (usb_pipeout(urb->pipe) && musb->hb_iso_tx);
2258		if (!ok) {
2259			ret = -EMSGSIZE;
2260			goto done;
2261		}
2262		qh->maxpacket &= 0x7ff;
2263	}
2264
2265	qh->epnum = usb_endpoint_num(epd);
2266
2267	/* NOTE: urb->dev->devnum is wrong during SET_ADDRESS */
2268	qh->addr_reg = (u8) usb_pipedevice(urb->pipe);
2269
2270	/* precompute rxtype/txtype/type0 register */
2271	type_reg = (qh->type << 4) | qh->epnum;
2272	switch (urb->dev->speed) {
2273	case USB_SPEED_LOW:
2274		type_reg |= 0xc0;
2275		break;
2276	case USB_SPEED_FULL:
2277		type_reg |= 0x80;
2278		break;
2279	default:
2280		type_reg |= 0x40;
2281	}
2282	qh->type_reg = type_reg;
2283
2284	/* Precompute RXINTERVAL/TXINTERVAL register */
2285	switch (qh->type) {
2286	case USB_ENDPOINT_XFER_INT:
2287		/*
2288		 * Full/low speeds use the  linear encoding,
2289		 * high speed uses the logarithmic encoding.
2290		 */
2291		if (urb->dev->speed <= USB_SPEED_FULL) {
2292			interval = max_t(u8, epd->bInterval, 1);
2293			break;
2294		}
2295		/* FALLTHROUGH */
2296	case USB_ENDPOINT_XFER_ISOC:
2297		/* ISO always uses logarithmic encoding */
2298		interval = min_t(u8, epd->bInterval, 16);
2299		break;
2300	default:
2301		/* REVISIT we actually want to use NAK limits, hinting to the
2302		 * transfer scheduling logic to try some other qh, e.g. try
2303		 * for 2 msec first:
2304		 *
2305		 * interval = (USB_SPEED_HIGH == urb->dev->speed) ? 16 : 2;
2306		 *
2307		 * The downside of disabling this is that transfer scheduling
2308		 * gets VERY unfair for nonperiodic transfers; a misbehaving
2309		 * peripheral could make that hurt.  That's perfectly normal
2310		 * for reads from network or serial adapters ... so we have
2311		 * partial NAKlimit support for bulk RX.
2312		 *
2313		 * The upside of disabling it is simpler transfer scheduling.
2314		 */
2315		interval = 0;
2316	}
2317	qh->intv_reg = interval;
2318
2319	/* precompute addressing for external hub/tt ports */
2320	if (musb->is_multipoint) {
2321		struct usb_device	*parent = urb->dev->parent;
2322
2323		if (parent != hcd->self.root_hub) {
2324			qh->h_addr_reg = (u8) parent->devnum;
2325
2326			/* set up tt info if needed */
2327			if (urb->dev->tt) {
2328				qh->h_port_reg = (u8) urb->dev->ttport;
2329				if (urb->dev->tt->hub)
2330					qh->h_addr_reg =
2331						(u8) urb->dev->tt->hub->devnum;
2332				if (urb->dev->tt->multi)
2333					qh->h_addr_reg |= 0x80;
2334			}
2335		}
2336	}
2337
2338	/* invariant: hep->hcpriv is null OR the qh that's already scheduled.
2339	 * until we get real dma queues (with an entry for each urb/buffer),
2340	 * we only have work to do in the former case.
2341	 */
2342	spin_lock_irqsave(&musb->lock, flags);
2343	if (hep->hcpriv || !next_urb(qh)) {
2344		/* some concurrent activity submitted another urb to hep...
2345		 * odd, rare, error prone, but legal.
2346		 */
2347		kfree(qh);
2348		qh = NULL;
2349		ret = 0;
2350	} else
2351		ret = musb_schedule(musb, qh,
2352				epd->bEndpointAddress & USB_ENDPOINT_DIR_MASK);
2353
2354	if (ret == 0) {
2355		urb->hcpriv = qh;
2356		/* FIXME set urb->start_frame for iso/intr, it's tested in
2357		 * musb_start_urb(), but otherwise only konicawc cares ...
2358		 */
2359	}
2360	spin_unlock_irqrestore(&musb->lock, flags);
2361
2362done:
2363	if (ret != 0) {
2364		spin_lock_irqsave(&musb->lock, flags);
2365		usb_hcd_unlink_urb_from_ep(hcd, urb);
2366		spin_unlock_irqrestore(&musb->lock, flags);
2367		kfree(qh);
2368	}
2369	return ret;
2370}
2371
2372
2373/*
2374 * abort a transfer that's at the head of a hardware queue.
2375 * called with controller locked, irqs blocked
2376 * that hardware queue advances to the next transfer, unless prevented
2377 */
2378static int musb_cleanup_urb(struct urb *urb, struct musb_qh *qh)
2379{
2380	struct musb_hw_ep	*ep = qh->hw_ep;
2381	struct musb		*musb = ep->musb;
2382	void __iomem		*epio = ep->regs;
2383	unsigned		hw_end = ep->epnum;
2384	void __iomem		*regs = ep->musb->mregs;
2385	int			is_in = usb_pipein(urb->pipe);
2386	int			status = 0;
2387	u16			csr;
2388
2389	musb_ep_select(regs, hw_end);
2390
2391	if (is_dma_capable()) {
2392		struct dma_channel	*dma;
2393
2394		dma = is_in ? ep->rx_channel : ep->tx_channel;
2395		if (dma) {
2396			status = ep->musb->dma_controller->channel_abort(dma);
2397			dev_dbg(musb->controller,
2398				"abort %cX%d DMA for urb %p --> %d\n",
2399				is_in ? 'R' : 'T', ep->epnum,
2400				urb, status);
2401			urb->actual_length += dma->actual_len;
2402		}
2403	}
2404
2405	/* turn off DMA requests, discard state, stop polling ... */
2406	if (ep->epnum && is_in) {
2407		/* giveback saves bulk toggle */
2408		csr = musb_h_flush_rxfifo(ep, 0);
2409
2410		/* REVISIT we still get an irq; should likely clear the
2411		 * endpoint's irq status here to avoid bogus irqs.
2412		 * clearing that status is platform-specific...
2413		 */
2414	} else if (ep->epnum) {
2415		musb_h_tx_flush_fifo(ep);
2416		csr = musb_readw(epio, MUSB_TXCSR);
2417		csr &= ~(MUSB_TXCSR_AUTOSET
2418			| MUSB_TXCSR_DMAENAB
2419			| MUSB_TXCSR_H_RXSTALL
2420			| MUSB_TXCSR_H_NAKTIMEOUT
2421			| MUSB_TXCSR_H_ERROR
2422			| MUSB_TXCSR_TXPKTRDY);
2423		musb_writew(epio, MUSB_TXCSR, csr);
2424		/* REVISIT may need to clear FLUSHFIFO ... */
2425		musb_writew(epio, MUSB_TXCSR, csr);
2426		/* flush cpu writebuffer */
2427		csr = musb_readw(epio, MUSB_TXCSR);
2428	} else  {
2429		musb_h_ep0_flush_fifo(ep);
2430	}
2431	if (status == 0)
2432		musb_advance_schedule(ep->musb, urb, ep, is_in);
2433	return status;
2434}
2435
2436static int musb_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
2437{
2438	struct musb		*musb = hcd_to_musb(hcd);
2439	struct musb_qh		*qh;
2440	unsigned long		flags;
2441	int			is_in  = usb_pipein(urb->pipe);
2442	int			ret;
2443
2444	dev_dbg(musb->controller, "urb=%p, dev%d ep%d%s\n", urb,
2445			usb_pipedevice(urb->pipe),
2446			usb_pipeendpoint(urb->pipe),
2447			is_in ? "in" : "out");
2448
2449	spin_lock_irqsave(&musb->lock, flags);
2450	ret = usb_hcd_check_unlink_urb(hcd, urb, status);
2451	if (ret)
2452		goto done;
2453
2454	qh = urb->hcpriv;
2455	if (!qh)
2456		goto done;
2457
2458	/*
2459	 * Any URB not actively programmed into endpoint hardware can be
2460	 * immediately given back; that's any URB not at the head of an
2461	 * endpoint queue, unless someday we get real DMA queues.  And even
2462	 * if it's at the head, it might not be known to the hardware...
2463	 *
2464	 * Otherwise abort current transfer, pending DMA, etc.; urb->status
2465	 * has already been updated.  This is a synchronous abort; it'd be
2466	 * OK to hold off until after some IRQ, though.
2467	 *
2468	 * NOTE: qh is invalid unless !list_empty(&hep->urb_list)
2469	 */
2470	if (!qh->is_ready
2471			|| urb->urb_list.prev != &qh->hep->urb_list
2472			|| musb_ep_get_qh(qh->hw_ep, is_in) != qh) {
2473		int	ready = qh->is_ready;
2474
2475		qh->is_ready = 0;
2476		musb_giveback(musb, urb, 0);
2477		qh->is_ready = ready;
2478
2479		/* If nothing else (usually musb_giveback) is using it
2480		 * and its URB list has emptied, recycle this qh.
2481		 */
2482		if (ready && list_empty(&qh->hep->urb_list)) {
2483			qh->hep->hcpriv = NULL;
2484			list_del(&qh->ring);
2485			kfree(qh);
2486		}
2487	} else
2488		ret = musb_cleanup_urb(urb, qh);
2489done:
2490	spin_unlock_irqrestore(&musb->lock, flags);
2491	return ret;
2492}
2493
2494/* disable an endpoint */
2495static void
2496musb_h_disable(struct usb_hcd *hcd, struct usb_host_endpoint *hep)
2497{
2498	u8			is_in = hep->desc.bEndpointAddress & USB_DIR_IN;
2499	unsigned long		flags;
2500	struct musb		*musb = hcd_to_musb(hcd);
2501	struct musb_qh		*qh;
2502	struct urb		*urb;
2503
2504	spin_lock_irqsave(&musb->lock, flags);
2505
2506	qh = hep->hcpriv;
2507	if (qh == NULL)
2508		goto exit;
2509
2510	/* NOTE: qh is invalid unless !list_empty(&hep->urb_list) */
2511
2512	/* Kick the first URB off the hardware, if needed */
2513	qh->is_ready = 0;
2514	if (musb_ep_get_qh(qh->hw_ep, is_in) == qh) {
2515		urb = next_urb(qh);
2516
2517		/* make software (then hardware) stop ASAP */
2518		if (!urb->unlinked)
2519			urb->status = -ESHUTDOWN;
2520
2521		/* cleanup */
2522		musb_cleanup_urb(urb, qh);
2523
2524		/* Then nuke all the others ... and advance the
2525		 * queue on hw_ep (e.g. bulk ring) when we're done.
2526		 */
2527		while (!list_empty(&hep->urb_list)) {
2528			urb = next_urb(qh);
2529			urb->status = -ESHUTDOWN;
2530			musb_advance_schedule(musb, urb, qh->hw_ep, is_in);
2531		}
2532	} else {
2533		/* Just empty the queue; the hardware is busy with
2534		 * other transfers, and since !qh->is_ready nothing
2535		 * will activate any of these as it advances.
2536		 */
2537		while (!list_empty(&hep->urb_list))
2538			musb_giveback(musb, next_urb(qh), -ESHUTDOWN);
2539
2540		hep->hcpriv = NULL;
2541		list_del(&qh->ring);
2542		kfree(qh);
2543	}
2544exit:
2545	spin_unlock_irqrestore(&musb->lock, flags);
2546}
2547
2548static int musb_h_get_frame_number(struct usb_hcd *hcd)
2549{
2550	struct musb	*musb = hcd_to_musb(hcd);
2551
2552	return musb_readw(musb->mregs, MUSB_FRAME);
2553}
2554
2555static int musb_h_start(struct usb_hcd *hcd)
2556{
2557	struct musb	*musb = hcd_to_musb(hcd);
2558
2559	/* NOTE: musb_start() is called when the hub driver turns
2560	 * on port power, or when (OTG) peripheral starts.
2561	 */
2562	hcd->state = HC_STATE_RUNNING;
2563	musb->port1_status = 0;
2564	return 0;
2565}
2566
2567static void musb_h_stop(struct usb_hcd *hcd)
2568{
2569	musb_stop(hcd_to_musb(hcd));
2570	hcd->state = HC_STATE_HALT;
2571}
2572
2573static int musb_bus_suspend(struct usb_hcd *hcd)
2574{
2575	struct musb	*musb = hcd_to_musb(hcd);
2576	u8		devctl;
2577
2578	musb_port_suspend(musb, true);
2579
2580	if (!is_host_active(musb))
2581		return 0;
2582
2583	switch (musb->xceiv->otg->state) {
2584	case OTG_STATE_A_SUSPEND:
2585		return 0;
2586	case OTG_STATE_A_WAIT_VRISE:
2587		/* ID could be grounded even if there's no device
2588		 * on the other end of the cable.  NOTE that the
2589		 * A_WAIT_VRISE timers are messy with MUSB...
2590		 */
2591		devctl = musb_readb(musb->mregs, MUSB_DEVCTL);
2592		if ((devctl & MUSB_DEVCTL_VBUS) == MUSB_DEVCTL_VBUS)
2593			musb->xceiv->otg->state = OTG_STATE_A_WAIT_BCON;
2594		break;
2595	default:
2596		break;
2597	}
2598
2599	if (musb->is_active) {
2600		WARNING("trying to suspend as %s while active\n",
2601				usb_otg_state_string(musb->xceiv->otg->state));
2602		return -EBUSY;
2603	} else
2604		return 0;
2605}
2606
2607static int musb_bus_resume(struct usb_hcd *hcd)
2608{
2609	struct musb *musb = hcd_to_musb(hcd);
2610
2611	if (musb->config &&
2612	    musb->config->host_port_deassert_reset_at_resume)
2613		musb_port_reset(musb, false);
2614
2615	return 0;
2616}
2617
2618#ifndef CONFIG_MUSB_PIO_ONLY
2619
2620#define MUSB_USB_DMA_ALIGN 4
2621
2622struct musb_temp_buffer {
2623	void *kmalloc_ptr;
2624	void *old_xfer_buffer;
2625	u8 data[0];
2626};
2627
2628static void musb_free_temp_buffer(struct urb *urb)
2629{
2630	enum dma_data_direction dir;
2631	struct musb_temp_buffer *temp;
2632	size_t length;
2633
2634	if (!(urb->transfer_flags & URB_ALIGNED_TEMP_BUFFER))
2635		return;
2636
2637	dir = usb_urb_dir_in(urb) ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
2638
2639	temp = container_of(urb->transfer_buffer, struct musb_temp_buffer,
2640			    data);
2641
2642	if (dir == DMA_FROM_DEVICE) {
2643		if (usb_pipeisoc(urb->pipe))
2644			length = urb->transfer_buffer_length;
2645		else
2646			length = urb->actual_length;
2647
2648		memcpy(temp->old_xfer_buffer, temp->data, length);
2649	}
2650	urb->transfer_buffer = temp->old_xfer_buffer;
2651	kfree(temp->kmalloc_ptr);
2652
2653	urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER;
2654}
2655
2656static int musb_alloc_temp_buffer(struct urb *urb, gfp_t mem_flags)
2657{
2658	enum dma_data_direction dir;
2659	struct musb_temp_buffer *temp;
2660	void *kmalloc_ptr;
2661	size_t kmalloc_size;
2662
2663	if (urb->num_sgs || urb->sg ||
2664	    urb->transfer_buffer_length == 0 ||
2665	    !((uintptr_t)urb->transfer_buffer & (MUSB_USB_DMA_ALIGN - 1)))
2666		return 0;
2667
2668	dir = usb_urb_dir_in(urb) ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
2669
2670	/* Allocate a buffer with enough padding for alignment */
2671	kmalloc_size = urb->transfer_buffer_length +
2672		sizeof(struct musb_temp_buffer) + MUSB_USB_DMA_ALIGN - 1;
2673
2674	kmalloc_ptr = kmalloc(kmalloc_size, mem_flags);
2675	if (!kmalloc_ptr)
2676		return -ENOMEM;
2677
2678	/* Position our struct temp_buffer such that data is aligned */
2679	temp = PTR_ALIGN(kmalloc_ptr, MUSB_USB_DMA_ALIGN);
2680
2681
2682	temp->kmalloc_ptr = kmalloc_ptr;
2683	temp->old_xfer_buffer = urb->transfer_buffer;
2684	if (dir == DMA_TO_DEVICE)
2685		memcpy(temp->data, urb->transfer_buffer,
2686		       urb->transfer_buffer_length);
2687	urb->transfer_buffer = temp->data;
2688
2689	urb->transfer_flags |= URB_ALIGNED_TEMP_BUFFER;
2690
2691	return 0;
2692}
2693
2694static int musb_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
2695				      gfp_t mem_flags)
2696{
2697	struct musb	*musb = hcd_to_musb(hcd);
2698	int ret;
2699
2700	/*
2701	 * The DMA engine in RTL1.8 and above cannot handle
2702	 * DMA addresses that are not aligned to a 4 byte boundary.
2703	 * For such engine implemented (un)map_urb_for_dma hooks.
2704	 * Do not use these hooks for RTL<1.8
2705	 */
2706	if (musb->hwvers < MUSB_HWVERS_1800)
2707		return usb_hcd_map_urb_for_dma(hcd, urb, mem_flags);
2708
2709	ret = musb_alloc_temp_buffer(urb, mem_flags);
2710	if (ret)
2711		return ret;
2712
2713	ret = usb_hcd_map_urb_for_dma(hcd, urb, mem_flags);
2714	if (ret)
2715		musb_free_temp_buffer(urb);
2716
2717	return ret;
2718}
2719
2720static void musb_unmap_urb_for_dma(struct usb_hcd *hcd, struct urb *urb)
2721{
2722	struct musb	*musb = hcd_to_musb(hcd);
2723
2724	usb_hcd_unmap_urb_for_dma(hcd, urb);
2725
2726	/* Do not use this hook for RTL<1.8 (see description above) */
2727	if (musb->hwvers < MUSB_HWVERS_1800)
2728		return;
2729
2730	musb_free_temp_buffer(urb);
2731}
2732#endif /* !CONFIG_MUSB_PIO_ONLY */
2733
2734static const struct hc_driver musb_hc_driver = {
2735	.description		= "musb-hcd",
2736	.product_desc		= "MUSB HDRC host driver",
2737	.hcd_priv_size		= sizeof(struct musb *),
2738	.flags			= HCD_USB2 | HCD_MEMORY,
2739
2740	/* not using irq handler or reset hooks from usbcore, since
2741	 * those must be shared with peripheral code for OTG configs
2742	 */
2743
2744	.start			= musb_h_start,
2745	.stop			= musb_h_stop,
2746
2747	.get_frame_number	= musb_h_get_frame_number,
2748
2749	.urb_enqueue		= musb_urb_enqueue,
2750	.urb_dequeue		= musb_urb_dequeue,
2751	.endpoint_disable	= musb_h_disable,
2752
2753#ifndef CONFIG_MUSB_PIO_ONLY
2754	.map_urb_for_dma	= musb_map_urb_for_dma,
2755	.unmap_urb_for_dma	= musb_unmap_urb_for_dma,
2756#endif
2757
2758	.hub_status_data	= musb_hub_status_data,
2759	.hub_control		= musb_hub_control,
2760	.bus_suspend		= musb_bus_suspend,
2761	.bus_resume		= musb_bus_resume,
2762	/* .start_port_reset	= NULL, */
2763	/* .hub_irq_enable	= NULL, */
2764};
2765
2766int musb_host_alloc(struct musb *musb)
2767{
2768	struct device	*dev = musb->controller;
2769
2770	/* usbcore sets dev->driver_data to hcd, and sometimes uses that... */
2771	musb->hcd = usb_create_hcd(&musb_hc_driver, dev, dev_name(dev));
2772	if (!musb->hcd)
2773		return -EINVAL;
2774
2775	*musb->hcd->hcd_priv = (unsigned long) musb;
2776	musb->hcd->self.uses_pio_for_control = 1;
2777	musb->hcd->uses_new_polling = 1;
2778	musb->hcd->has_tt = 1;
2779
2780	return 0;
2781}
2782
2783void musb_host_cleanup(struct musb *musb)
2784{
2785	if (musb->port_mode == MUSB_PORT_MODE_GADGET)
2786		return;
2787	usb_remove_hcd(musb->hcd);
2788}
2789
2790void musb_host_free(struct musb *musb)
2791{
2792	usb_put_hcd(musb->hcd);
2793}
2794
2795int musb_host_setup(struct musb *musb, int power_budget)
2796{
2797	int ret;
2798	struct usb_hcd *hcd = musb->hcd;
2799
2800	MUSB_HST_MODE(musb);
2801	musb->xceiv->otg->default_a = 1;
2802	musb->xceiv->otg->state = OTG_STATE_A_IDLE;
2803
2804	otg_set_host(musb->xceiv->otg, &hcd->self);
2805	hcd->self.otg_port = 1;
2806	musb->xceiv->otg->host = &hcd->self;
2807	hcd->power_budget = 2 * (power_budget ? : 250);
2808
2809	ret = usb_add_hcd(hcd, 0, 0);
2810	if (ret < 0)
2811		return ret;
2812
2813	device_wakeup_enable(hcd->self.controller);
2814	return 0;
2815}
2816
2817void musb_host_resume_root_hub(struct musb *musb)
2818{
2819	usb_hcd_resume_root_hub(musb->hcd);
2820}
2821
2822void musb_host_poke_root_hub(struct musb *musb)
2823{
2824	MUSB_HST_MODE(musb);
2825	if (musb->hcd->status_urb)
2826		usb_hcd_poll_rh_status(musb->hcd);
2827	else
2828		usb_hcd_resume_root_hub(musb->hcd);
2829}