1/*
   2 * Copyright (C) 2001-2004 by David Brownell
   3 *
   4 * This program is free software; you can redistribute it and/or modify it
   5 * under the terms of the GNU General Public License as published by the
   6 * Free Software Foundation; either version 2 of the License, or (at your
   7 * option) any later version.
   8 *
   9 * This program is distributed in the hope that it will be useful, but
  10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  11 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12 * for more details.
  13 *
  14 * You should have received a copy of the GNU General Public License
  15 * along with this program; if not, write to the Free Software Foundation,
  16 * Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  17 */
  18
  19/* this file is part of ehci-hcd.c */
  20
  21/*-------------------------------------------------------------------------*/
  22
  23/*
  24 * EHCI hardware queue manipulation ... the core.  QH/QTD manipulation.
  25 *
  26 * Control, bulk, and interrupt traffic all use "qh" lists.  They list "qtd"
  27 * entries describing USB transactions, max 16-20kB/entry (with 4kB-aligned
  28 * buffers needed for the larger number).  We use one QH per endpoint, queue
  29 * multiple urbs (all three types) per endpoint.  URBs may need several qtds.
  30 *
  31 * ISO traffic uses "ISO TD" (itd, and sitd) records, and (along with
  32 * interrupts) needs careful scheduling.  Performance improvements can be
  33 * an ongoing challenge.  That's in "ehci-sched.c".
  34 *
  35 * USB 1.1 devices are handled (a) by "companion" OHCI or UHCI root hubs,
  36 * or otherwise through transaction translators (TTs) in USB 2.0 hubs using
  37 * (b) special fields in qh entries or (c) split iso entries.  TTs will
  38 * buffer low/full speed data so the host collects it at high speed.
  39 */
  40
  41/*-------------------------------------------------------------------------*/
  42
  43/* fill a qtd, returning how much of the buffer we were able to queue up */
  44
  45static int
  46qtd_fill(struct ehci_hcd *ehci, struct ehci_qtd *qtd, dma_addr_t buf,
  47		  size_t len, int token, int maxpacket)
  48{
  49	int	i, count;
  50	u64	addr = buf;
 
  51
  52	/* one buffer entry per 4K ... first might be short or unaligned */
  53	qtd->hw_buf[0] = cpu_to_hc32(ehci, (u32)addr);
  54	qtd->hw_buf_hi[0] = cpu_to_hc32(ehci, (u32)(addr >> 32));
  55	count = 0x1000 - (buf & 0x0fff);	/* rest of that page */
  56	if (likely (len < count))		/* ... iff needed */
  57		count = len;
  58	else {
  59		buf +=  0x1000;
  60		buf &= ~0x0fff;
  61
  62		/* per-qtd limit: from 16K to 20K (best alignment) */
  63		for (i = 1; count < len && i < 5; i++) {
  64			addr = buf;
  65			qtd->hw_buf[i] = cpu_to_hc32(ehci, (u32)addr);
  66			qtd->hw_buf_hi[i] = cpu_to_hc32(ehci,
  67					(u32)(addr >> 32));
  68			buf += 0x1000;
  69			if ((count + 0x1000) < len)
  70				count += 0x1000;
  71			else
  72				count = len;
  73		}
  74
  75		/* short packets may only terminate transfers */
  76		if (count != len)
  77			count -= (count % maxpacket);
  78	}
  79	qtd->hw_token = cpu_to_hc32(ehci, (count << 16) | token);
  80	qtd->length = count;
  81
  82	return count;
  83}
  84
  85/*-------------------------------------------------------------------------*/
  86
  87static inline void
  88qh_update (struct ehci_hcd *ehci, struct ehci_qh *qh, struct ehci_qtd *qtd)
  89{
  90	struct ehci_qh_hw *hw = qh->hw;
  91
  92	/* writes to an active overlay are unsafe */
  93	WARN_ON(qh->qh_state != QH_STATE_IDLE);
  94
  95	hw->hw_qtd_next = QTD_NEXT(ehci, qtd->qtd_dma);
  96	hw->hw_alt_next = EHCI_LIST_END(ehci);
  97
  98	/* Except for control endpoints, we make hardware maintain data
  99	 * toggle (like OHCI) ... here (re)initialize the toggle in the QH,
 100	 * and set the pseudo-toggle in udev. Only usb_clear_halt() will
 101	 * ever clear it.
 102	 */
 103	if (!(hw->hw_info1 & cpu_to_hc32(ehci, QH_TOGGLE_CTL))) {
 104		unsigned	is_out, epnum;
 105
 106		is_out = qh->is_out;
 107		epnum = (hc32_to_cpup(ehci, &hw->hw_info1) >> 8) & 0x0f;
 108		if (unlikely(!usb_gettoggle(qh->ps.udev, epnum, is_out))) {
 109			hw->hw_token &= ~cpu_to_hc32(ehci, QTD_TOGGLE);
 110			usb_settoggle(qh->ps.udev, epnum, is_out, 1);
 111		}
 112	}
 113
 114	hw->hw_token &= cpu_to_hc32(ehci, QTD_TOGGLE | QTD_STS_PING);
 115}
 116
 117/* if it weren't for a common silicon quirk (writing the dummy into the qh
 118 * overlay, so qh->hw_token wrongly becomes inactive/halted), only fault
 119 * recovery (including urb dequeue) would need software changes to a QH...
 120 */
 121static void
 122qh_refresh (struct ehci_hcd *ehci, struct ehci_qh *qh)
 123{
 124	struct ehci_qtd *qtd;
 125
 126	qtd = list_entry(qh->qtd_list.next, struct ehci_qtd, qtd_list);
 127
 128	/*
 129	 * first qtd may already be partially processed.
 130	 * If we come here during unlink, the QH overlay region
 131	 * might have reference to the just unlinked qtd. The
 132	 * qtd is updated in qh_completions(). Update the QH
 133	 * overlay here.
 134	 */
 135	if (qh->hw->hw_token & ACTIVE_BIT(ehci)) {
 136		qh->hw->hw_qtd_next = qtd->hw_next;
 137		if (qh->should_be_inactive)
 138			ehci_warn(ehci, "qh %p should be inactive!\n", qh);
 139	} else {
 140		qh_update(ehci, qh, qtd);
 141	}
 142	qh->should_be_inactive = 0;
 143}
 144
 145/*-------------------------------------------------------------------------*/
 146
 147static void qh_link_async(struct ehci_hcd *ehci, struct ehci_qh *qh);
 148
 149static void ehci_clear_tt_buffer_complete(struct usb_hcd *hcd,
 150		struct usb_host_endpoint *ep)
 151{
 152	struct ehci_hcd		*ehci = hcd_to_ehci(hcd);
 153	struct ehci_qh		*qh = ep->hcpriv;
 154	unsigned long		flags;
 155
 156	spin_lock_irqsave(&ehci->lock, flags);
 157	qh->clearing_tt = 0;
 158	if (qh->qh_state == QH_STATE_IDLE && !list_empty(&qh->qtd_list)
 159			&& ehci->rh_state == EHCI_RH_RUNNING)
 160		qh_link_async(ehci, qh);
 161	spin_unlock_irqrestore(&ehci->lock, flags);
 162}
 163
 164static void ehci_clear_tt_buffer(struct ehci_hcd *ehci, struct ehci_qh *qh,
 165		struct urb *urb, u32 token)
 166{
 167
 168	/* If an async split transaction gets an error or is unlinked,
 169	 * the TT buffer may be left in an indeterminate state.  We
 170	 * have to clear the TT buffer.
 171	 *
 172	 * Note: this routine is never called for Isochronous transfers.
 173	 */
 174	if (urb->dev->tt && !usb_pipeint(urb->pipe) && !qh->clearing_tt) {
 175#ifdef CONFIG_DYNAMIC_DEBUG
 176		struct usb_device *tt = urb->dev->tt->hub;
 177		dev_dbg(&tt->dev,
 178			"clear tt buffer port %d, a%d ep%d t%08x\n",
 179			urb->dev->ttport, urb->dev->devnum,
 180			usb_pipeendpoint(urb->pipe), token);
 181#endif /* CONFIG_DYNAMIC_DEBUG */
 182		if (!ehci_is_TDI(ehci)
 183				|| urb->dev->tt->hub !=
 184				   ehci_to_hcd(ehci)->self.root_hub) {
 185			if (usb_hub_clear_tt_buffer(urb) == 0)
 186				qh->clearing_tt = 1;
 187		} else {
 188
 189			/* REVISIT ARC-derived cores don't clear the root
 190			 * hub TT buffer in this way...
 191			 */
 192		}
 193	}
 194}
 195
 196static int qtd_copy_status (
 197	struct ehci_hcd *ehci,
 198	struct urb *urb,
 199	size_t length,
 200	u32 token
 201)
 202{
 203	int	status = -EINPROGRESS;
 204
 205	/* count IN/OUT bytes, not SETUP (even short packets) */
 206	if (likely (QTD_PID (token) != 2))
 207		urb->actual_length += length - QTD_LENGTH (token);
 208
 209	/* don't modify error codes */
 210	if (unlikely(urb->unlinked))
 211		return status;
 212
 213	/* force cleanup after short read; not always an error */
 214	if (unlikely (IS_SHORT_READ (token)))
 215		status = -EREMOTEIO;
 216
 217	/* serious "can't proceed" faults reported by the hardware */
 218	if (token & QTD_STS_HALT) {
 219		if (token & QTD_STS_BABBLE) {
 220			/* FIXME "must" disable babbling device's port too */
 221			status = -EOVERFLOW;
 
 
 
 
 
 
 
 222		/* CERR nonzero + halt --> stall */
 223		} else if (QTD_CERR(token)) {
 224			status = -EPIPE;
 225
 226		/* In theory, more than one of the following bits can be set
 227		 * since they are sticky and the transaction is retried.
 228		 * Which to test first is rather arbitrary.
 229		 */
 230		} else if (token & QTD_STS_MMF) {
 231			/* fs/ls interrupt xfer missed the complete-split */
 232			status = -EPROTO;
 233		} else if (token & QTD_STS_DBE) {
 234			status = (QTD_PID (token) == 1) /* IN ? */
 235				? -ENOSR  /* hc couldn't read data */
 236				: -ECOMM; /* hc couldn't write data */
 237		} else if (token & QTD_STS_XACT) {
 238			/* timeout, bad CRC, wrong PID, etc */
 239			ehci_dbg(ehci, "devpath %s ep%d%s 3strikes\n",
 240				urb->dev->devpath,
 241				usb_pipeendpoint(urb->pipe),
 242				usb_pipein(urb->pipe) ? "in" : "out");
 243			status = -EPROTO;
 244		} else {	/* unknown */
 245			status = -EPROTO;
 246		}
 247	}
 248
 249	return status;
 250}
 251
 252static void
 253ehci_urb_done(struct ehci_hcd *ehci, struct urb *urb, int status)
 254{
 255	if (usb_pipetype(urb->pipe) == PIPE_INTERRUPT) {
 256		/* ... update hc-wide periodic stats */
 257		ehci_to_hcd(ehci)->self.bandwidth_int_reqs--;
 258	}
 259
 260	if (unlikely(urb->unlinked)) {
 261		COUNT(ehci->stats.unlink);
 262	} else {
 263		/* report non-error and short read status as zero */
 264		if (status == -EINPROGRESS || status == -EREMOTEIO)
 265			status = 0;
 266		COUNT(ehci->stats.complete);
 267	}
 268
 269#ifdef EHCI_URB_TRACE
 270	ehci_dbg (ehci,
 271		"%s %s urb %p ep%d%s status %d len %d/%d\n",
 272		__func__, urb->dev->devpath, urb,
 273		usb_pipeendpoint (urb->pipe),
 274		usb_pipein (urb->pipe) ? "in" : "out",
 275		status,
 276		urb->actual_length, urb->transfer_buffer_length);
 277#endif
 278
 279	usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
 280	usb_hcd_giveback_urb(ehci_to_hcd(ehci), urb, status);
 281}
 282
 283static int qh_schedule (struct ehci_hcd *ehci, struct ehci_qh *qh);
 284
 285/*
 286 * Process and free completed qtds for a qh, returning URBs to drivers.
 287 * Chases up to qh->hw_current.  Returns nonzero if the caller should
 288 * unlink qh.
 289 */
 290static unsigned
 291qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
 292{
 293	struct ehci_qtd		*last, *end = qh->dummy;
 294	struct list_head	*entry, *tmp;
 295	int			last_status;
 296	int			stopped;
 297	u8			state;
 298	struct ehci_qh_hw	*hw = qh->hw;
 299
 300	/* completions (or tasks on other cpus) must never clobber HALT
 301	 * till we've gone through and cleaned everything up, even when
 302	 * they add urbs to this qh's queue or mark them for unlinking.
 303	 *
 304	 * NOTE:  unlinking expects to be done in queue order.
 305	 *
 306	 * It's a bug for qh->qh_state to be anything other than
 307	 * QH_STATE_IDLE, unless our caller is scan_async() or
 308	 * scan_intr().
 309	 */
 310	state = qh->qh_state;
 311	qh->qh_state = QH_STATE_COMPLETING;
 312	stopped = (state == QH_STATE_IDLE);
 313
 314 rescan:
 315	last = NULL;
 316	last_status = -EINPROGRESS;
 317	qh->dequeue_during_giveback = 0;
 318
 319	/* remove de-activated QTDs from front of queue.
 320	 * after faults (including short reads), cleanup this urb
 321	 * then let the queue advance.
 322	 * if queue is stopped, handles unlinks.
 323	 */
 324	list_for_each_safe (entry, tmp, &qh->qtd_list) {
 325		struct ehci_qtd	*qtd;
 326		struct urb	*urb;
 327		u32		token = 0;
 328
 329		qtd = list_entry (entry, struct ehci_qtd, qtd_list);
 330		urb = qtd->urb;
 331
 332		/* clean up any state from previous QTD ...*/
 333		if (last) {
 334			if (likely (last->urb != urb)) {
 335				ehci_urb_done(ehci, last->urb, last_status);
 336				last_status = -EINPROGRESS;
 337			}
 338			ehci_qtd_free (ehci, last);
 339			last = NULL;
 340		}
 341
 342		/* ignore urbs submitted during completions we reported */
 343		if (qtd == end)
 344			break;
 345
 346		/* hardware copies qtd out of qh overlay */
 347		rmb ();
 348		token = hc32_to_cpu(ehci, qtd->hw_token);
 349
 350		/* always clean up qtds the hc de-activated */
 351 retry_xacterr:
 352		if ((token & QTD_STS_ACTIVE) == 0) {
 353
 354			/* Report Data Buffer Error: non-fatal but useful */
 355			if (token & QTD_STS_DBE)
 356				ehci_dbg(ehci,
 357					"detected DataBufferErr for urb %p ep%d%s len %d, qtd %p [qh %p]\n",
 358					urb,
 359					usb_endpoint_num(&urb->ep->desc),
 360					usb_endpoint_dir_in(&urb->ep->desc) ? "in" : "out",
 361					urb->transfer_buffer_length,
 362					qtd,
 363					qh);
 364
 365			/* on STALL, error, and short reads this urb must
 366			 * complete and all its qtds must be recycled.
 367			 */
 368			if ((token & QTD_STS_HALT) != 0) {
 369
 370				/* retry transaction errors until we
 371				 * reach the software xacterr limit
 372				 */
 373				if ((token & QTD_STS_XACT) &&
 374						QTD_CERR(token) == 0 &&
 375						++qh->xacterrs < QH_XACTERR_MAX &&
 376						!urb->unlinked) {
 377					ehci_dbg(ehci,
 378	"detected XactErr len %zu/%zu retry %d\n",
 379	qtd->length - QTD_LENGTH(token), qtd->length, qh->xacterrs);
 380
 381					/* reset the token in the qtd and the
 382					 * qh overlay (which still contains
 383					 * the qtd) so that we pick up from
 384					 * where we left off
 385					 */
 386					token &= ~QTD_STS_HALT;
 387					token |= QTD_STS_ACTIVE |
 388							(EHCI_TUNE_CERR << 10);
 389					qtd->hw_token = cpu_to_hc32(ehci,
 390							token);
 391					wmb();
 392					hw->hw_token = cpu_to_hc32(ehci,
 393							token);
 394					goto retry_xacterr;
 395				}
 396				stopped = 1;
 397				qh->unlink_reason |= QH_UNLINK_HALTED;
 398
 399			/* magic dummy for some short reads; qh won't advance.
 400			 * that silicon quirk can kick in with this dummy too.
 401			 *
 402			 * other short reads won't stop the queue, including
 403			 * control transfers (status stage handles that) or
 404			 * most other single-qtd reads ... the queue stops if
 405			 * URB_SHORT_NOT_OK was set so the driver submitting
 406			 * the urbs could clean it up.
 407			 */
 408			} else if (IS_SHORT_READ (token)
 409					&& !(qtd->hw_alt_next
 410						& EHCI_LIST_END(ehci))) {
 411				stopped = 1;
 412				qh->unlink_reason |= QH_UNLINK_SHORT_READ;
 413			}
 414
 415		/* stop scanning when we reach qtds the hc is using */
 416		} else if (likely (!stopped
 417				&& ehci->rh_state >= EHCI_RH_RUNNING)) {
 418			break;
 419
 420		/* scan the whole queue for unlinks whenever it stops */
 421		} else {
 422			stopped = 1;
 423
 424			/* cancel everything if we halt, suspend, etc */
 425			if (ehci->rh_state < EHCI_RH_RUNNING) {
 426				last_status = -ESHUTDOWN;
 427				qh->unlink_reason |= QH_UNLINK_SHUTDOWN;
 428			}
 429
 430			/* this qtd is active; skip it unless a previous qtd
 431			 * for its urb faulted, or its urb was canceled.
 432			 */
 433			else if (last_status == -EINPROGRESS && !urb->unlinked)
 434				continue;
 435
 436			/*
 437			 * If this was the active qtd when the qh was unlinked
 438			 * and the overlay's token is active, then the overlay
 439			 * hasn't been written back to the qtd yet so use its
 440			 * token instead of the qtd's.  After the qtd is
 441			 * processed and removed, the overlay won't be valid
 442			 * any more.
 443			 */
 444			if (state == QH_STATE_IDLE &&
 445					qh->qtd_list.next == &qtd->qtd_list &&
 446					(hw->hw_token & ACTIVE_BIT(ehci))) {
 447				token = hc32_to_cpu(ehci, hw->hw_token);
 448				hw->hw_token &= ~ACTIVE_BIT(ehci);
 449				qh->should_be_inactive = 1;
 450
 451				/* An unlink may leave an incomplete
 452				 * async transaction in the TT buffer.
 453				 * We have to clear it.
 454				 */
 455				ehci_clear_tt_buffer(ehci, qh, urb, token);
 456			}
 457		}
 458
 459		/* unless we already know the urb's status, collect qtd status
 460		 * and update count of bytes transferred.  in common short read
 461		 * cases with only one data qtd (including control transfers),
 462		 * queue processing won't halt.  but with two or more qtds (for
 463		 * example, with a 32 KB transfer), when the first qtd gets a
 464		 * short read the second must be removed by hand.
 465		 */
 466		if (last_status == -EINPROGRESS) {
 467			last_status = qtd_copy_status(ehci, urb,
 468					qtd->length, token);
 469			if (last_status == -EREMOTEIO
 470					&& (qtd->hw_alt_next
 471						& EHCI_LIST_END(ehci)))
 472				last_status = -EINPROGRESS;
 473
 474			/* As part of low/full-speed endpoint-halt processing
 475			 * we must clear the TT buffer (11.17.5).
 476			 */
 477			if (unlikely(last_status != -EINPROGRESS &&
 478					last_status != -EREMOTEIO)) {
 479				/* The TT's in some hubs malfunction when they
 480				 * receive this request following a STALL (they
 481				 * stop sending isochronous packets).  Since a
 482				 * STALL can't leave the TT buffer in a busy
 483				 * state (if you believe Figures 11-48 - 11-51
 484				 * in the USB 2.0 spec), we won't clear the TT
 485				 * buffer in this case.  Strictly speaking this
 486				 * is a violation of the spec.
 487				 */
 488				if (last_status != -EPIPE)
 489					ehci_clear_tt_buffer(ehci, qh, urb,
 490							token);
 491			}
 492		}
 493
 494		/* if we're removing something not at the queue head,
 495		 * patch the hardware queue pointer.
 496		 */
 497		if (stopped && qtd->qtd_list.prev != &qh->qtd_list) {
 498			last = list_entry (qtd->qtd_list.prev,
 499					struct ehci_qtd, qtd_list);
 500			last->hw_next = qtd->hw_next;
 501		}
 502
 503		/* remove qtd; it's recycled after possible urb completion */
 504		list_del (&qtd->qtd_list);
 505		last = qtd;
 506
 507		/* reinit the xacterr counter for the next qtd */
 508		qh->xacterrs = 0;
 509	}
 510
 511	/* last urb's completion might still need calling */
 512	if (likely (last != NULL)) {
 513		ehci_urb_done(ehci, last->urb, last_status);
 514		ehci_qtd_free (ehci, last);
 515	}
 516
 517	/* Do we need to rescan for URBs dequeued during a giveback? */
 518	if (unlikely(qh->dequeue_during_giveback)) {
 519		/* If the QH is already unlinked, do the rescan now. */
 520		if (state == QH_STATE_IDLE)
 521			goto rescan;
 522
 523		/* Otherwise the caller must unlink the QH. */
 524	}
 525
 526	/* restore original state; caller must unlink or relink */
 527	qh->qh_state = state;
 528
 529	/* be sure the hardware's done with the qh before refreshing
 530	 * it after fault cleanup, or recovering from silicon wrongly
 531	 * overlaying the dummy qtd (which reduces DMA chatter).
 532	 *
 533	 * We won't refresh a QH that's linked (after the HC
 534	 * stopped the queue).  That avoids a race:
 535	 *  - HC reads first part of QH;
 536	 *  - CPU updates that first part and the token;
 537	 *  - HC reads rest of that QH, including token
 538	 * Result:  HC gets an inconsistent image, and then
 539	 * DMAs to/from the wrong memory (corrupting it).
 540	 *
 541	 * That should be rare for interrupt transfers,
 542	 * except maybe high bandwidth ...
 543	 */
 544	if (stopped != 0 || hw->hw_qtd_next == EHCI_LIST_END(ehci))
 545		qh->unlink_reason |= QH_UNLINK_DUMMY_OVERLAY;
 546
 547	/* Let the caller know if the QH needs to be unlinked. */
 548	return qh->unlink_reason;
 549}
 550
 551/*-------------------------------------------------------------------------*/
 552
 553// high bandwidth multiplier, as encoded in highspeed endpoint descriptors
 554#define hb_mult(wMaxPacketSize) (1 + (((wMaxPacketSize) >> 11) & 0x03))
 555// ... and packet size, for any kind of endpoint descriptor
 556#define max_packet(wMaxPacketSize) ((wMaxPacketSize) & 0x07ff)
 557
 558/*
 559 * reverse of qh_urb_transaction:  free a list of TDs.
 560 * used for cleanup after errors, before HC sees an URB's TDs.
 561 */
 562static void qtd_list_free (
 563	struct ehci_hcd		*ehci,
 564	struct urb		*urb,
 565	struct list_head	*qtd_list
 566) {
 567	struct list_head	*entry, *temp;
 568
 569	list_for_each_safe (entry, temp, qtd_list) {
 570		struct ehci_qtd	*qtd;
 571
 572		qtd = list_entry (entry, struct ehci_qtd, qtd_list);
 573		list_del (&qtd->qtd_list);
 574		ehci_qtd_free (ehci, qtd);
 575	}
 576}
 577
 578/*
 579 * create a list of filled qtds for this URB; won't link into qh.
 580 */
 581static struct list_head *
 582qh_urb_transaction (
 583	struct ehci_hcd		*ehci,
 584	struct urb		*urb,
 585	struct list_head	*head,
 586	gfp_t			flags
 587) {
 588	struct ehci_qtd		*qtd, *qtd_prev;
 589	dma_addr_t		buf;
 590	int			len, this_sg_len, maxpacket;
 591	int			is_input;
 592	u32			token;
 593	int			i;
 594	struct scatterlist	*sg;
 595
 596	/*
 597	 * URBs map to sequences of QTDs:  one logical transaction
 598	 */
 599	qtd = ehci_qtd_alloc (ehci, flags);
 600	if (unlikely (!qtd))
 601		return NULL;
 602	list_add_tail (&qtd->qtd_list, head);
 603	qtd->urb = urb;
 604
 605	token = QTD_STS_ACTIVE;
 606	token |= (EHCI_TUNE_CERR << 10);
 607	/* for split transactions, SplitXState initialized to zero */
 608
 609	len = urb->transfer_buffer_length;
 610	is_input = usb_pipein (urb->pipe);
 611	if (usb_pipecontrol (urb->pipe)) {
 612		/* SETUP pid */
 613		qtd_fill(ehci, qtd, urb->setup_dma,
 614				sizeof (struct usb_ctrlrequest),
 615				token | (2 /* "setup" */ << 8), 8);
 616
 617		/* ... and always at least one more pid */
 618		token ^= QTD_TOGGLE;
 619		qtd_prev = qtd;
 620		qtd = ehci_qtd_alloc (ehci, flags);
 621		if (unlikely (!qtd))
 622			goto cleanup;
 623		qtd->urb = urb;
 624		qtd_prev->hw_next = QTD_NEXT(ehci, qtd->qtd_dma);
 625		list_add_tail (&qtd->qtd_list, head);
 626
 627		/* for zero length DATA stages, STATUS is always IN */
 628		if (len == 0)
 629			token |= (1 /* "in" */ << 8);
 630	}
 631
 632	/*
 633	 * data transfer stage:  buffer setup
 634	 */
 635	i = urb->num_mapped_sgs;
 636	if (len > 0 && i > 0) {
 637		sg = urb->sg;
 638		buf = sg_dma_address(sg);
 639
 640		/* urb->transfer_buffer_length may be smaller than the
 641		 * size of the scatterlist (or vice versa)
 642		 */
 643		this_sg_len = min_t(int, sg_dma_len(sg), len);
 644	} else {
 645		sg = NULL;
 646		buf = urb->transfer_dma;
 647		this_sg_len = len;
 648	}
 649
 650	if (is_input)
 651		token |= (1 /* "in" */ << 8);
 652	/* else it's already initted to "out" pid (0 << 8) */
 653
 654	maxpacket = max_packet(usb_maxpacket(urb->dev, urb->pipe, !is_input));
 655
 656	/*
 657	 * buffer gets wrapped in one or more qtds;
 658	 * last one may be "short" (including zero len)
 659	 * and may serve as a control status ack
 660	 */
 661	for (;;) {
 662		int this_qtd_len;
 663
 664		this_qtd_len = qtd_fill(ehci, qtd, buf, this_sg_len, token,
 665				maxpacket);
 666		this_sg_len -= this_qtd_len;
 667		len -= this_qtd_len;
 668		buf += this_qtd_len;
 669
 670		/*
 671		 * short reads advance to a "magic" dummy instead of the next
 672		 * qtd ... that forces the queue to stop, for manual cleanup.
 673		 * (this will usually be overridden later.)
 674		 */
 675		if (is_input)
 676			qtd->hw_alt_next = ehci->async->hw->hw_alt_next;
 677
 678		/* qh makes control packets use qtd toggle; maybe switch it */
 679		if ((maxpacket & (this_qtd_len + (maxpacket - 1))) == 0)
 680			token ^= QTD_TOGGLE;
 681
 682		if (likely(this_sg_len <= 0)) {
 683			if (--i <= 0 || len <= 0)
 684				break;
 685			sg = sg_next(sg);
 686			buf = sg_dma_address(sg);
 687			this_sg_len = min_t(int, sg_dma_len(sg), len);
 688		}
 689
 690		qtd_prev = qtd;
 691		qtd = ehci_qtd_alloc (ehci, flags);
 692		if (unlikely (!qtd))
 693			goto cleanup;
 694		qtd->urb = urb;
 695		qtd_prev->hw_next = QTD_NEXT(ehci, qtd->qtd_dma);
 696		list_add_tail (&qtd->qtd_list, head);
 697	}
 698
 699	/*
 700	 * unless the caller requires manual cleanup after short reads,
 701	 * have the alt_next mechanism keep the queue running after the
 702	 * last data qtd (the only one, for control and most other cases).
 703	 */
 704	if (likely ((urb->transfer_flags & URB_SHORT_NOT_OK) == 0
 705				|| usb_pipecontrol (urb->pipe)))
 706		qtd->hw_alt_next = EHCI_LIST_END(ehci);
 707
 708	/*
 709	 * control requests may need a terminating data "status" ack;
 710	 * other OUT ones may need a terminating short packet
 711	 * (zero length).
 712	 */
 713	if (likely (urb->transfer_buffer_length != 0)) {
 714		int	one_more = 0;
 715
 716		if (usb_pipecontrol (urb->pipe)) {
 717			one_more = 1;
 718			token ^= 0x0100;	/* "in" <--> "out"  */
 719			token |= QTD_TOGGLE;	/* force DATA1 */
 720		} else if (usb_pipeout(urb->pipe)
 721				&& (urb->transfer_flags & URB_ZERO_PACKET)
 722				&& !(urb->transfer_buffer_length % maxpacket)) {
 723			one_more = 1;
 724		}
 725		if (one_more) {
 726			qtd_prev = qtd;
 727			qtd = ehci_qtd_alloc (ehci, flags);
 728			if (unlikely (!qtd))
 729				goto cleanup;
 730			qtd->urb = urb;
 731			qtd_prev->hw_next = QTD_NEXT(ehci, qtd->qtd_dma);
 732			list_add_tail (&qtd->qtd_list, head);
 733
 734			/* never any data in such packets */
 735			qtd_fill(ehci, qtd, 0, 0, token, 0);
 736		}
 737	}
 738
 739	/* by default, enable interrupt on urb completion */
 740	if (likely (!(urb->transfer_flags & URB_NO_INTERRUPT)))
 741		qtd->hw_token |= cpu_to_hc32(ehci, QTD_IOC);
 742	return head;
 743
 744cleanup:
 745	qtd_list_free (ehci, urb, head);
 746	return NULL;
 747}
 748
 749/*-------------------------------------------------------------------------*/
 750
 751// Would be best to create all qh's from config descriptors,
 752// when each interface/altsetting is established.  Unlink
 753// any previous qh and cancel its urbs first; endpoints are
 754// implicitly reset then (data toggle too).
 755// That'd mean updating how usbcore talks to HCDs. (2.7?)
 756
 757
 758/*
 759 * Each QH holds a qtd list; a QH is used for everything except iso.
 760 *
 761 * For interrupt urbs, the scheduler must set the microframe scheduling
 762 * mask(s) each time the QH gets scheduled.  For highspeed, that's
 763 * just one microframe in the s-mask.  For split interrupt transactions
 764 * there are additional complications: c-mask, maybe FSTNs.
 765 */
 766static struct ehci_qh *
 767qh_make (
 768	struct ehci_hcd		*ehci,
 769	struct urb		*urb,
 770	gfp_t			flags
 771) {
 772	struct ehci_qh		*qh = ehci_qh_alloc (ehci, flags);
 
 773	u32			info1 = 0, info2 = 0;
 774	int			is_input, type;
 775	int			maxp = 0;
 
 776	struct usb_tt		*tt = urb->dev->tt;
 777	struct ehci_qh_hw	*hw;
 778
 779	if (!qh)
 780		return qh;
 781
 782	/*
 783	 * init endpoint/device data for this QH
 784	 */
 785	info1 |= usb_pipeendpoint (urb->pipe) << 8;
 786	info1 |= usb_pipedevice (urb->pipe) << 0;
 787
 788	is_input = usb_pipein (urb->pipe);
 789	type = usb_pipetype (urb->pipe);
 790	maxp = usb_maxpacket (urb->dev, urb->pipe, !is_input);
 
 
 791
 792	/* 1024 byte maxpacket is a hardware ceiling.  High bandwidth
 793	 * acts like up to 3KB, but is built from smaller packets.
 794	 */
 795	if (max_packet(maxp) > 1024) {
 796		ehci_dbg(ehci, "bogus qh maxpacket %d\n", max_packet(maxp));
 797		goto done;
 798	}
 799
 800	/* Compute interrupt scheduling parameters just once, and save.
 801	 * - allowing for high bandwidth, how many nsec/uframe are used?
 802	 * - split transactions need a second CSPLIT uframe; same question
 803	 * - splits also need a schedule gap (for full/low speed I/O)
 804	 * - qh has a polling interval
 805	 *
 806	 * For control/bulk requests, the HC or TT handles these.
 807	 */
 808	if (type == PIPE_INTERRUPT) {
 809		unsigned	tmp;
 810
 811		qh->ps.usecs = NS_TO_US(usb_calc_bus_time(USB_SPEED_HIGH,
 812				is_input, 0,
 813				hb_mult(maxp) * max_packet(maxp)));
 814		qh->ps.phase = NO_FRAME;
 815
 816		if (urb->dev->speed == USB_SPEED_HIGH) {
 817			qh->ps.c_usecs = 0;
 818			qh->gap_uf = 0;
 819
 820			if (urb->interval > 1 && urb->interval < 8) {
 821				/* NOTE interval 2 or 4 uframes could work.
 822				 * But interval 1 scheduling is simpler, and
 823				 * includes high bandwidth.
 824				 */
 825				urb->interval = 1;
 826			} else if (urb->interval > ehci->periodic_size << 3) {
 827				urb->interval = ehci->periodic_size << 3;
 828			}
 829			qh->ps.period = urb->interval >> 3;
 830
 831			/* period for bandwidth allocation */
 832			tmp = min_t(unsigned, EHCI_BANDWIDTH_SIZE,
 833					1 << (urb->ep->desc.bInterval - 1));
 834
 835			/* Allow urb->interval to override */
 836			qh->ps.bw_uperiod = min_t(unsigned, tmp, urb->interval);
 837			qh->ps.bw_period = qh->ps.bw_uperiod >> 3;
 838		} else {
 839			int		think_time;
 840
 841			/* gap is f(FS/LS transfer times) */
 842			qh->gap_uf = 1 + usb_calc_bus_time (urb->dev->speed,
 843					is_input, 0, maxp) / (125 * 1000);
 844
 845			/* FIXME this just approximates SPLIT/CSPLIT times */
 846			if (is_input) {		// SPLIT, gap, CSPLIT+DATA
 847				qh->ps.c_usecs = qh->ps.usecs + HS_USECS(0);
 848				qh->ps.usecs = HS_USECS(1);
 849			} else {		// SPLIT+DATA, gap, CSPLIT
 850				qh->ps.usecs += HS_USECS(1);
 851				qh->ps.c_usecs = HS_USECS(0);
 852			}
 853
 854			think_time = tt ? tt->think_time : 0;
 855			qh->ps.tt_usecs = NS_TO_US(think_time +
 856					usb_calc_bus_time (urb->dev->speed,
 857					is_input, 0, max_packet (maxp)));
 858			if (urb->interval > ehci->periodic_size)
 859				urb->interval = ehci->periodic_size;
 860			qh->ps.period = urb->interval;
 861
 862			/* period for bandwidth allocation */
 863			tmp = min_t(unsigned, EHCI_BANDWIDTH_FRAMES,
 864					urb->ep->desc.bInterval);
 865			tmp = rounddown_pow_of_two(tmp);
 866
 867			/* Allow urb->interval to override */
 868			qh->ps.bw_period = min_t(unsigned, tmp, urb->interval);
 869			qh->ps.bw_uperiod = qh->ps.bw_period << 3;
 870		}
 871	}
 872
 873	/* support for tt scheduling, and access to toggles */
 874	qh->ps.udev = urb->dev;
 875	qh->ps.ep = urb->ep;
 876
 877	/* using TT? */
 878	switch (urb->dev->speed) {
 879	case USB_SPEED_LOW:
 880		info1 |= QH_LOW_SPEED;
 881		/* FALL THROUGH */
 882
 883	case USB_SPEED_FULL:
 884		/* EPS 0 means "full" */
 885		if (type != PIPE_INTERRUPT)
 886			info1 |= (EHCI_TUNE_RL_TT << 28);
 887		if (type == PIPE_CONTROL) {
 888			info1 |= QH_CONTROL_EP;		/* for TT */
 889			info1 |= QH_TOGGLE_CTL;		/* toggle from qtd */
 890		}
 891		info1 |= maxp << 16;
 892
 893		info2 |= (EHCI_TUNE_MULT_TT << 30);
 894
 895		/* Some Freescale processors have an erratum in which the
 896		 * port number in the queue head was 0..N-1 instead of 1..N.
 897		 */
 898		if (ehci_has_fsl_portno_bug(ehci))
 899			info2 |= (urb->dev->ttport-1) << 23;
 900		else
 901			info2 |= urb->dev->ttport << 23;
 902
 903		/* set the address of the TT; for TDI's integrated
 904		 * root hub tt, leave it zeroed.
 905		 */
 906		if (tt && tt->hub != ehci_to_hcd(ehci)->self.root_hub)
 907			info2 |= tt->hub->devnum << 16;
 908
 909		/* NOTE:  if (PIPE_INTERRUPT) { scheduler sets c-mask } */
 910
 911		break;
 912
 913	case USB_SPEED_HIGH:		/* no TT involved */
 914		info1 |= QH_HIGH_SPEED;
 915		if (type == PIPE_CONTROL) {
 916			info1 |= (EHCI_TUNE_RL_HS << 28);
 917			info1 |= 64 << 16;	/* usb2 fixed maxpacket */
 918			info1 |= QH_TOGGLE_CTL;	/* toggle from qtd */
 919			info2 |= (EHCI_TUNE_MULT_HS << 30);
 920		} else if (type == PIPE_BULK) {
 921			info1 |= (EHCI_TUNE_RL_HS << 28);
 922			/* The USB spec says that high speed bulk endpoints
 923			 * always use 512 byte maxpacket.  But some device
 924			 * vendors decided to ignore that, and MSFT is happy
 925			 * to help them do so.  So now people expect to use
 926			 * such nonconformant devices with Linux too; sigh.
 927			 */
 928			info1 |= max_packet(maxp) << 16;
 929			info2 |= (EHCI_TUNE_MULT_HS << 30);
 930		} else {		/* PIPE_INTERRUPT */
 931			info1 |= max_packet (maxp) << 16;
 932			info2 |= hb_mult (maxp) << 30;
 933		}
 934		break;
 935	default:
 936		ehci_dbg(ehci, "bogus dev %p speed %d\n", urb->dev,
 937			urb->dev->speed);
 938done:
 939		qh_destroy(ehci, qh);
 940		return NULL;
 941	}
 942
 943	/* NOTE:  if (PIPE_INTERRUPT) { scheduler sets s-mask } */
 944
 945	/* init as live, toggle clear */
 946	qh->qh_state = QH_STATE_IDLE;
 947	hw = qh->hw;
 948	hw->hw_info1 = cpu_to_hc32(ehci, info1);
 949	hw->hw_info2 = cpu_to_hc32(ehci, info2);
 950	qh->is_out = !is_input;
 951	usb_settoggle (urb->dev, usb_pipeendpoint (urb->pipe), !is_input, 1);
 952	return qh;
 953}
 954
 955/*-------------------------------------------------------------------------*/
 956
 957static void enable_async(struct ehci_hcd *ehci)
 958{
 959	if (ehci->async_count++)
 960		return;
 961
 962	/* Stop waiting to turn off the async schedule */
 963	ehci->enabled_hrtimer_events &= ~BIT(EHCI_HRTIMER_DISABLE_ASYNC);
 964
 965	/* Don't start the schedule until ASS is 0 */
 966	ehci_poll_ASS(ehci);
 967	turn_on_io_watchdog(ehci);
 968}
 969
 970static void disable_async(struct ehci_hcd *ehci)
 971{
 972	if (--ehci->async_count)
 973		return;
 974
 975	/* The async schedule and unlink lists are supposed to be empty */
 976	WARN_ON(ehci->async->qh_next.qh || !list_empty(&ehci->async_unlink) ||
 977			!list_empty(&ehci->async_idle));
 978
 979	/* Don't turn off the schedule until ASS is 1 */
 980	ehci_poll_ASS(ehci);
 981}
 982
 983/* move qh (and its qtds) onto async queue; maybe enable queue.  */
 984
 985static void qh_link_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
 986{
 987	__hc32		dma = QH_NEXT(ehci, qh->qh_dma);
 988	struct ehci_qh	*head;
 989
 990	/* Don't link a QH if there's a Clear-TT-Buffer pending */
 991	if (unlikely(qh->clearing_tt))
 992		return;
 993
 994	WARN_ON(qh->qh_state != QH_STATE_IDLE);
 995
 996	/* clear halt and/or toggle; and maybe recover from silicon quirk */
 997	qh_refresh(ehci, qh);
 998
 999	/* splice right after start */
1000	head = ehci->async;
1001	qh->qh_next = head->qh_next;
1002	qh->hw->hw_next = head->hw->hw_next;
1003	wmb ();
1004
1005	head->qh_next.qh = qh;
1006	head->hw->hw_next = dma;
1007
1008	qh->qh_state = QH_STATE_LINKED;
1009	qh->xacterrs = 0;
1010	qh->unlink_reason = 0;
1011	/* qtd completions reported later by interrupt */
1012
1013	enable_async(ehci);
1014}
1015
1016/*-------------------------------------------------------------------------*/
1017
1018/*
1019 * For control/bulk/interrupt, return QH with these TDs appended.
1020 * Allocates and initializes the QH if necessary.
1021 * Returns null if it can't allocate a QH it needs to.
1022 * If the QH has TDs (urbs) already, that's great.
1023 */
1024static struct ehci_qh *qh_append_tds (
1025	struct ehci_hcd		*ehci,
1026	struct urb		*urb,
1027	struct list_head	*qtd_list,
1028	int			epnum,
1029	void			**ptr
1030)
1031{
1032	struct ehci_qh		*qh = NULL;
1033	__hc32			qh_addr_mask = cpu_to_hc32(ehci, 0x7f);
1034
1035	qh = (struct ehci_qh *) *ptr;
1036	if (unlikely (qh == NULL)) {
1037		/* can't sleep here, we have ehci->lock... */
1038		qh = qh_make (ehci, urb, GFP_ATOMIC);
1039		*ptr = qh;
1040	}
1041	if (likely (qh != NULL)) {
1042		struct ehci_qtd	*qtd;
1043
1044		if (unlikely (list_empty (qtd_list)))
1045			qtd = NULL;
1046		else
1047			qtd = list_entry (qtd_list->next, struct ehci_qtd,
1048					qtd_list);
1049
1050		/* control qh may need patching ... */
1051		if (unlikely (epnum == 0)) {
1052
1053                        /* usb_reset_device() briefly reverts to address 0 */
1054                        if (usb_pipedevice (urb->pipe) == 0)
1055				qh->hw->hw_info1 &= ~qh_addr_mask;
1056		}
1057
1058		/* just one way to queue requests: swap with the dummy qtd.
1059		 * only hc or qh_refresh() ever modify the overlay.
1060		 */
1061		if (likely (qtd != NULL)) {
1062			struct ehci_qtd		*dummy;
1063			dma_addr_t		dma;
1064			__hc32			token;
1065
1066			/* to avoid racing the HC, use the dummy td instead of
1067			 * the first td of our list (becomes new dummy).  both
1068			 * tds stay deactivated until we're done, when the
1069			 * HC is allowed to fetch the old dummy (4.10.2).
1070			 */
1071			token = qtd->hw_token;
1072			qtd->hw_token = HALT_BIT(ehci);
1073
1074			dummy = qh->dummy;
1075
1076			dma = dummy->qtd_dma;
1077			*dummy = *qtd;
1078			dummy->qtd_dma = dma;
1079
1080			list_del (&qtd->qtd_list);
1081			list_add (&dummy->qtd_list, qtd_list);
1082			list_splice_tail(qtd_list, &qh->qtd_list);
1083
1084			ehci_qtd_init(ehci, qtd, qtd->qtd_dma);
1085			qh->dummy = qtd;
1086
1087			/* hc must see the new dummy at list end */
1088			dma = qtd->qtd_dma;
1089			qtd = list_entry (qh->qtd_list.prev,
1090					struct ehci_qtd, qtd_list);
1091			qtd->hw_next = QTD_NEXT(ehci, dma);
1092
1093			/* let the hc process these next qtds */
1094			wmb ();
1095			dummy->hw_token = token;
1096
1097			urb->hcpriv = qh;
1098		}
1099	}
1100	return qh;
1101}
1102
1103/*-------------------------------------------------------------------------*/
1104
1105static int
1106submit_async (
1107	struct ehci_hcd		*ehci,
1108	struct urb		*urb,
1109	struct list_head	*qtd_list,
1110	gfp_t			mem_flags
1111) {
1112	int			epnum;
1113	unsigned long		flags;
1114	struct ehci_qh		*qh = NULL;
1115	int			rc;
1116
1117	epnum = urb->ep->desc.bEndpointAddress;
1118
1119#ifdef EHCI_URB_TRACE
1120	{
1121		struct ehci_qtd *qtd;
1122		qtd = list_entry(qtd_list->next, struct ehci_qtd, qtd_list);
1123		ehci_dbg(ehci,
1124			 "%s %s urb %p ep%d%s len %d, qtd %p [qh %p]\n",
1125			 __func__, urb->dev->devpath, urb,
1126			 epnum & 0x0f, (epnum & USB_DIR_IN) ? "in" : "out",
1127			 urb->transfer_buffer_length,
1128			 qtd, urb->ep->hcpriv);
1129	}
1130#endif
1131
1132	spin_lock_irqsave (&ehci->lock, flags);
1133	if (unlikely(!HCD_HW_ACCESSIBLE(ehci_to_hcd(ehci)))) {
1134		rc = -ESHUTDOWN;
1135		goto done;
1136	}
1137	rc = usb_hcd_link_urb_to_ep(ehci_to_hcd(ehci), urb);
1138	if (unlikely(rc))
1139		goto done;
1140
1141	qh = qh_append_tds(ehci, urb, qtd_list, epnum, &urb->ep->hcpriv);
1142	if (unlikely(qh == NULL)) {
1143		usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
1144		rc = -ENOMEM;
1145		goto done;
1146	}
1147
1148	/* Control/bulk operations through TTs don't need scheduling,
1149	 * the HC and TT handle it when the TT has a buffer ready.
1150	 */
1151	if (likely (qh->qh_state == QH_STATE_IDLE))
1152		qh_link_async(ehci, qh);
1153 done:
1154	spin_unlock_irqrestore (&ehci->lock, flags);
1155	if (unlikely (qh == NULL))
1156		qtd_list_free (ehci, urb, qtd_list);
1157	return rc;
1158}
1159
1160/*-------------------------------------------------------------------------*/
1161#ifdef CONFIG_USB_HCD_TEST_MODE
1162/*
1163 * This function creates the qtds and submits them for the
1164 * SINGLE_STEP_SET_FEATURE Test.
1165 * This is done in two parts: first SETUP req for GetDesc is sent then
1166 * 15 seconds later, the IN stage for GetDesc starts to req data from dev
1167 *
1168 * is_setup : i/p arguement decides which of the two stage needs to be
1169 * performed; TRUE - SETUP and FALSE - IN+STATUS
1170 * Returns 0 if success
1171 */
1172static int submit_single_step_set_feature(
1173	struct usb_hcd  *hcd,
1174	struct urb      *urb,
1175	int             is_setup
1176) {
1177	struct ehci_hcd		*ehci = hcd_to_ehci(hcd);
1178	struct list_head	qtd_list;
1179	struct list_head	*head;
1180
1181	struct ehci_qtd		*qtd, *qtd_prev;
1182	dma_addr_t		buf;
1183	int			len, maxpacket;
1184	u32			token;
1185
1186	INIT_LIST_HEAD(&qtd_list);
1187	head = &qtd_list;
1188
1189	/* URBs map to sequences of QTDs:  one logical transaction */
1190	qtd = ehci_qtd_alloc(ehci, GFP_KERNEL);
1191	if (unlikely(!qtd))
1192		return -1;
1193	list_add_tail(&qtd->qtd_list, head);
1194	qtd->urb = urb;
1195
1196	token = QTD_STS_ACTIVE;
1197	token |= (EHCI_TUNE_CERR << 10);
1198
1199	len = urb->transfer_buffer_length;
1200	/*
1201	 * Check if the request is to perform just the SETUP stage (getDesc)
1202	 * as in SINGLE_STEP_SET_FEATURE test, DATA stage (IN) happens
1203	 * 15 secs after the setup
1204	 */
1205	if (is_setup) {
1206		/* SETUP pid */
1207		qtd_fill(ehci, qtd, urb->setup_dma,
1208				sizeof(struct usb_ctrlrequest),
1209				token | (2 /* "setup" */ << 8), 8);
1210
1211		submit_async(ehci, urb, &qtd_list, GFP_ATOMIC);
1212		return 0; /*Return now; we shall come back after 15 seconds*/
1213	}
1214
1215	/*
1216	 * IN: data transfer stage:  buffer setup : start the IN txn phase for
1217	 * the get_Desc SETUP which was sent 15seconds back
1218	 */
1219	token ^= QTD_TOGGLE;   /*We need to start IN with DATA-1 Pid-sequence*/
1220	buf = urb->transfer_dma;
1221
1222	token |= (1 /* "in" */ << 8);  /*This is IN stage*/
1223
1224	maxpacket = max_packet(usb_maxpacket(urb->dev, urb->pipe, 0));
1225
1226	qtd_fill(ehci, qtd, buf, len, token, maxpacket);
1227
1228	/*
1229	 * Our IN phase shall always be a short read; so keep the queue running
1230	 * and let it advance to the next qtd which zero length OUT status
1231	 */
1232	qtd->hw_alt_next = EHCI_LIST_END(ehci);
1233
1234	/* STATUS stage for GetDesc control request */
1235	token ^= 0x0100;        /* "in" <--> "out"  */
1236	token |= QTD_TOGGLE;    /* force DATA1 */
1237
1238	qtd_prev = qtd;
1239	qtd = ehci_qtd_alloc(ehci, GFP_ATOMIC);
1240	if (unlikely(!qtd))
1241		goto cleanup;
1242	qtd->urb = urb;
1243	qtd_prev->hw_next = QTD_NEXT(ehci, qtd->qtd_dma);
1244	list_add_tail(&qtd->qtd_list, head);
1245
1246	/* dont fill any data in such packets */
1247	qtd_fill(ehci, qtd, 0, 0, token, 0);
1248
1249	/* by default, enable interrupt on urb completion */
1250	if (likely(!(urb->transfer_flags & URB_NO_INTERRUPT)))
1251		qtd->hw_token |= cpu_to_hc32(ehci, QTD_IOC);
1252
1253	submit_async(ehci, urb, &qtd_list, GFP_KERNEL);
1254
1255	return 0;
1256
1257cleanup:
1258	qtd_list_free(ehci, urb, head);
1259	return -1;
1260}
1261#endif /* CONFIG_USB_HCD_TEST_MODE */
1262
1263/*-------------------------------------------------------------------------*/
1264
1265static void single_unlink_async(struct ehci_hcd *ehci, struct ehci_qh *qh)
1266{
1267	struct ehci_qh		*prev;
1268
1269	/* Add to the end of the list of QHs waiting for the next IAAD */
1270	qh->qh_state = QH_STATE_UNLINK_WAIT;
1271	list_add_tail(&qh->unlink_node, &ehci->async_unlink);
1272
1273	/* Unlink it from the schedule */
1274	prev = ehci->async;
1275	while (prev->qh_next.qh != qh)
1276		prev = prev->qh_next.qh;
1277
1278	prev->hw->hw_next = qh->hw->hw_next;
1279	prev->qh_next = qh->qh_next;
1280	if (ehci->qh_scan_next == qh)
1281		ehci->qh_scan_next = qh->qh_next.qh;
1282}
1283
1284static void start_iaa_cycle(struct ehci_hcd *ehci)
1285{
1286	/* If the controller isn't running, we don't have to wait for it */
1287	if (unlikely(ehci->rh_state < EHCI_RH_RUNNING)) {
1288		end_unlink_async(ehci);
1289
1290	/* Otherwise start a new IAA cycle if one isn't already running */
1291	} else if (ehci->rh_state == EHCI_RH_RUNNING &&
1292			!ehci->iaa_in_progress) {
1293
1294		/* Make sure the unlinks are all visible to the hardware */
1295		wmb();
1296
1297		ehci_writel(ehci, ehci->command | CMD_IAAD,
1298				&ehci->regs->command);
1299		ehci_readl(ehci, &ehci->regs->command);
1300		ehci->iaa_in_progress = true;
1301		ehci_enable_event(ehci, EHCI_HRTIMER_IAA_WATCHDOG, true);
1302	}
1303}
1304
1305static void end_iaa_cycle(struct ehci_hcd *ehci)
1306{
1307	if (ehci->has_synopsys_hc_bug)
1308		ehci_writel(ehci, (u32) ehci->async->qh_dma,
1309			    &ehci->regs->async_next);
1310
1311	/* The current IAA cycle has ended */
1312	ehci->iaa_in_progress = false;
1313
1314	end_unlink_async(ehci);
1315}
1316
1317/* See if the async qh for the qtds being unlinked are now gone from the HC */
1318
1319static void end_unlink_async(struct ehci_hcd *ehci)
1320{
1321	struct ehci_qh		*qh;
1322	bool			early_exit;
1323
1324	if (list_empty(&ehci->async_unlink))
1325		return;
1326	qh = list_first_entry(&ehci->async_unlink, struct ehci_qh,
1327			unlink_node);	/* QH whose IAA cycle just ended */
1328
1329	/*
1330	 * If async_unlinking is set then this routine is already running,
1331	 * either on the stack or on another CPU.
1332	 */
1333	early_exit = ehci->async_unlinking;
1334
1335	/* If the controller isn't running, process all the waiting QHs */
1336	if (ehci->rh_state < EHCI_RH_RUNNING)
1337		list_splice_tail_init(&ehci->async_unlink, &ehci->async_idle);
1338
1339	/*
1340	 * Intel (?) bug: The HC can write back the overlay region even
1341	 * after the IAA interrupt occurs.  In self-defense, always go
1342	 * through two IAA cycles for each QH.
1343	 */
1344	else if (qh->qh_state == QH_STATE_UNLINK) {
1345		/*
1346		 * Second IAA cycle has finished.  Process only the first
1347		 * waiting QH (NVIDIA (?) bug).
1348		 */
1349		list_move_tail(&qh->unlink_node, &ehci->async_idle);
1350	}
1351
1352	/*
1353	 * AMD/ATI (?) bug: The HC can continue to use an active QH long
1354	 * after the IAA interrupt occurs.  To prevent problems, QHs that
1355	 * may still be active will wait until 2 ms have passed with no
1356	 * change to the hw_current and hw_token fields (this delay occurs
1357	 * between the two IAA cycles).
1358	 *
1359	 * The EHCI spec (4.8.2) says that active QHs must not be removed
1360	 * from the async schedule and recommends waiting until the QH
1361	 * goes inactive.  This is ridiculous because the QH will _never_
1362	 * become inactive if the endpoint NAKs indefinitely.
1363	 */
1364
1365	/* Some reasons for unlinking guarantee the QH can't be active */
1366	else if (qh->unlink_reason & (QH_UNLINK_HALTED |
1367			QH_UNLINK_SHORT_READ | QH_UNLINK_DUMMY_OVERLAY))
1368		goto DelayDone;
1369
1370	/* The QH can't be active if the queue was and still is empty... */
1371	else if	((qh->unlink_reason & QH_UNLINK_QUEUE_EMPTY) &&
1372			list_empty(&qh->qtd_list))
1373		goto DelayDone;
1374
1375	/* ... or if the QH has halted */
1376	else if	(qh->hw->hw_token & cpu_to_hc32(ehci, QTD_STS_HALT))
1377		goto DelayDone;
1378
1379	/* Otherwise we have to wait until the QH stops changing */
1380	else {
1381		__hc32		qh_current, qh_token;
1382
1383		qh_current = qh->hw->hw_current;
1384		qh_token = qh->hw->hw_token;
1385		if (qh_current != ehci->old_current ||
1386				qh_token != ehci->old_token) {
1387			ehci->old_current = qh_current;
1388			ehci->old_token = qh_token;
1389			ehci_enable_event(ehci,
1390					EHCI_HRTIMER_ACTIVE_UNLINK, true);
1391			return;
1392		}
1393 DelayDone:
1394		qh->qh_state = QH_STATE_UNLINK;
1395		early_exit = true;
1396	}
1397	ehci->old_current = ~0;		/* Prepare for next QH */
1398
1399	/* Start a new IAA cycle if any QHs are waiting for it */
1400	if (!list_empty(&ehci->async_unlink))
1401		start_iaa_cycle(ehci);
1402
1403	/*
1404	 * Don't allow nesting or concurrent calls,
1405	 * or wait for the second IAA cycle for the next QH.
1406	 */
1407	if (early_exit)
1408		return;
1409
1410	/* Process the idle QHs */
1411	ehci->async_unlinking = true;
1412	while (!list_empty(&ehci->async_idle)) {
1413		qh = list_first_entry(&ehci->async_idle, struct ehci_qh,
1414				unlink_node);
1415		list_del(&qh->unlink_node);
1416
1417		qh->qh_state = QH_STATE_IDLE;
1418		qh->qh_next.qh = NULL;
1419
1420		if (!list_empty(&qh->qtd_list))
1421			qh_completions(ehci, qh);
1422		if (!list_empty(&qh->qtd_list) &&
1423				ehci->rh_state == EHCI_RH_RUNNING)
1424			qh_link_async(ehci, qh);
1425		disable_async(ehci);
1426	}
1427	ehci->async_unlinking = false;
1428}
1429
1430static void start_unlink_async(struct ehci_hcd *ehci, struct ehci_qh *qh);
1431
1432static void unlink_empty_async(struct ehci_hcd *ehci)
1433{
1434	struct ehci_qh		*qh;
1435	struct ehci_qh		*qh_to_unlink = NULL;
1436	int			count = 0;
1437
1438	/* Find the last async QH which has been empty for a timer cycle */
1439	for (qh = ehci->async->qh_next.qh; qh; qh = qh->qh_next.qh) {
1440		if (list_empty(&qh->qtd_list) &&
1441				qh->qh_state == QH_STATE_LINKED) {
1442			++count;
1443			if (qh->unlink_cycle != ehci->async_unlink_cycle)
1444				qh_to_unlink = qh;
1445		}
1446	}
1447
1448	/* If nothing else is being unlinked, unlink the last empty QH */
1449	if (list_empty(&ehci->async_unlink) && qh_to_unlink) {
1450		qh_to_unlink->unlink_reason |= QH_UNLINK_QUEUE_EMPTY;
1451		start_unlink_async(ehci, qh_to_unlink);
1452		--count;
1453	}
1454
1455	/* Other QHs will be handled later */
1456	if (count > 0) {
1457		ehci_enable_event(ehci, EHCI_HRTIMER_ASYNC_UNLINKS, true);
1458		++ehci->async_unlink_cycle;
1459	}
1460}
1461
1462#ifdef	CONFIG_PM
1463
1464/* The root hub is suspended; unlink all the async QHs */
1465static void unlink_empty_async_suspended(struct ehci_hcd *ehci)
1466{
1467	struct ehci_qh		*qh;
1468
1469	while (ehci->async->qh_next.qh) {
1470		qh = ehci->async->qh_next.qh;
1471		WARN_ON(!list_empty(&qh->qtd_list));
1472		single_unlink_async(ehci, qh);
1473	}
1474}
1475
1476#endif
1477
1478/* makes sure the async qh will become idle */
1479/* caller must own ehci->lock */
1480
1481static void start_unlink_async(struct ehci_hcd *ehci, struct ehci_qh *qh)
1482{
1483	/* If the QH isn't linked then there's nothing we can do. */
1484	if (qh->qh_state != QH_STATE_LINKED)
1485		return;
1486
1487	single_unlink_async(ehci, qh);
1488	start_iaa_cycle(ehci);
1489}
1490
1491/*-------------------------------------------------------------------------*/
1492
1493static void scan_async (struct ehci_hcd *ehci)
1494{
1495	struct ehci_qh		*qh;
1496	bool			check_unlinks_later = false;
1497
1498	ehci->qh_scan_next = ehci->async->qh_next.qh;
1499	while (ehci->qh_scan_next) {
1500		qh = ehci->qh_scan_next;
1501		ehci->qh_scan_next = qh->qh_next.qh;
1502
1503		/* clean any finished work for this qh */
1504		if (!list_empty(&qh->qtd_list)) {
1505			int temp;
1506
1507			/*
1508			 * Unlinks could happen here; completion reporting
1509			 * drops the lock.  That's why ehci->qh_scan_next
1510			 * always holds the next qh to scan; if the next qh
1511			 * gets unlinked then ehci->qh_scan_next is adjusted
1512			 * in single_unlink_async().
1513			 */
1514			temp = qh_completions(ehci, qh);
1515			if (unlikely(temp)) {
1516				start_unlink_async(ehci, qh);
1517			} else if (list_empty(&qh->qtd_list)
1518					&& qh->qh_state == QH_STATE_LINKED) {
1519				qh->unlink_cycle = ehci->async_unlink_cycle;
1520				check_unlinks_later = true;
1521			}
1522		}
1523	}
1524
1525	/*
1526	 * Unlink empty entries, reducing DMA usage as well
1527	 * as HCD schedule-scanning costs.  Delay for any qh
1528	 * we just scanned, there's a not-unusual case that it
1529	 * doesn't stay idle for long.
1530	 */
1531	if (check_unlinks_later && ehci->rh_state == EHCI_RH_RUNNING &&
1532			!(ehci->enabled_hrtimer_events &
1533				BIT(EHCI_HRTIMER_ASYNC_UNLINKS))) {
1534		ehci_enable_event(ehci, EHCI_HRTIMER_ASYNC_UNLINKS, true);
1535		++ehci->async_unlink_cycle;
1536	}
1537}