]> err.no Git - linux-2.6/blob - drivers/usb/host/ohci-q.c
ALSA: ASoC: Fix double free and memory leak in many codec drivers
[linux-2.6] / drivers / usb / host / ohci-q.c
1 /*
2  * OHCI HCD (Host Controller Driver) for USB.
3  *
4  * (C) Copyright 1999 Roman Weissgaerber <weissg@vienna.at>
5  * (C) Copyright 2000-2002 David Brownell <dbrownell@users.sourceforge.net>
6  *
7  * This file is licenced under the GPL.
8  */
9
10 #include <linux/irq.h>
11
12 static void urb_free_priv (struct ohci_hcd *hc, urb_priv_t *urb_priv)
13 {
14         int             last = urb_priv->length - 1;
15
16         if (last >= 0) {
17                 int             i;
18                 struct td       *td;
19
20                 for (i = 0; i <= last; i++) {
21                         td = urb_priv->td [i];
22                         if (td)
23                                 td_free (hc, td);
24                 }
25         }
26
27         list_del (&urb_priv->pending);
28         kfree (urb_priv);
29 }
30
31 /*-------------------------------------------------------------------------*/
32
33 /*
34  * URB goes back to driver, and isn't reissued.
35  * It's completely gone from HC data structures.
36  * PRECONDITION:  ohci lock held, irqs blocked.
37  */
38 static void
39 finish_urb(struct ohci_hcd *ohci, struct urb *urb, int status)
40 __releases(ohci->lock)
41 __acquires(ohci->lock)
42 {
43         // ASSERT (urb->hcpriv != 0);
44
45         urb_free_priv (ohci, urb->hcpriv);
46         if (likely(status == -EINPROGRESS))
47                 status = 0;
48
49         switch (usb_pipetype (urb->pipe)) {
50         case PIPE_ISOCHRONOUS:
51                 ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs--;
52                 break;
53         case PIPE_INTERRUPT:
54                 ohci_to_hcd(ohci)->self.bandwidth_int_reqs--;
55                 break;
56         }
57
58 #ifdef OHCI_VERBOSE_DEBUG
59         urb_print(urb, "RET", usb_pipeout (urb->pipe), status);
60 #endif
61
62         /* urb->complete() can reenter this HCD */
63         usb_hcd_unlink_urb_from_ep(ohci_to_hcd(ohci), urb);
64         spin_unlock (&ohci->lock);
65         usb_hcd_giveback_urb(ohci_to_hcd(ohci), urb, status);
66         spin_lock (&ohci->lock);
67
68         /* stop periodic dma if it's not needed */
69         if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0
70                         && ohci_to_hcd(ohci)->self.bandwidth_int_reqs == 0) {
71                 ohci->hc_control &= ~(OHCI_CTRL_PLE|OHCI_CTRL_IE);
72                 ohci_writel (ohci, ohci->hc_control, &ohci->regs->control);
73         }
74 }
75
76
77 /*-------------------------------------------------------------------------*
78  * ED handling functions
79  *-------------------------------------------------------------------------*/
80
81 /* search for the right schedule branch to use for a periodic ed.
82  * does some load balancing; returns the branch, or negative errno.
83  */
84 static int balance (struct ohci_hcd *ohci, int interval, int load)
85 {
86         int     i, branch = -ENOSPC;
87
88         /* iso periods can be huge; iso tds specify frame numbers */
89         if (interval > NUM_INTS)
90                 interval = NUM_INTS;
91
92         /* search for the least loaded schedule branch of that period
93          * that has enough bandwidth left unreserved.
94          */
95         for (i = 0; i < interval ; i++) {
96                 if (branch < 0 || ohci->load [branch] > ohci->load [i]) {
97                         int     j;
98
99                         /* usb 1.1 says 90% of one frame */
100                         for (j = i; j < NUM_INTS; j += interval) {
101                                 if ((ohci->load [j] + load) > 900)
102                                         break;
103                         }
104                         if (j < NUM_INTS)
105                                 continue;
106                         branch = i;
107                 }
108         }
109         return branch;
110 }
111
112 /*-------------------------------------------------------------------------*/
113
114 /* both iso and interrupt requests have periods; this routine puts them
115  * into the schedule tree in the apppropriate place.  most iso devices use
116  * 1msec periods, but that's not required.
117  */
118 static void periodic_link (struct ohci_hcd *ohci, struct ed *ed)
119 {
120         unsigned        i;
121
122         ohci_vdbg (ohci, "link %sed %p branch %d [%dus.], interval %d\n",
123                 (ed->hwINFO & cpu_to_hc32 (ohci, ED_ISO)) ? "iso " : "",
124                 ed, ed->branch, ed->load, ed->interval);
125
126         for (i = ed->branch; i < NUM_INTS; i += ed->interval) {
127                 struct ed       **prev = &ohci->periodic [i];
128                 __hc32          *prev_p = &ohci->hcca->int_table [i];
129                 struct ed       *here = *prev;
130
131                 /* sorting each branch by period (slow before fast)
132                  * lets us share the faster parts of the tree.
133                  * (plus maybe: put interrupt eds before iso)
134                  */
135                 while (here && ed != here) {
136                         if (ed->interval > here->interval)
137                                 break;
138                         prev = &here->ed_next;
139                         prev_p = &here->hwNextED;
140                         here = *prev;
141                 }
142                 if (ed != here) {
143                         ed->ed_next = here;
144                         if (here)
145                                 ed->hwNextED = *prev_p;
146                         wmb ();
147                         *prev = ed;
148                         *prev_p = cpu_to_hc32(ohci, ed->dma);
149                         wmb();
150                 }
151                 ohci->load [i] += ed->load;
152         }
153         ohci_to_hcd(ohci)->self.bandwidth_allocated += ed->load / ed->interval;
154 }
155
156 /* link an ed into one of the HC chains */
157
158 static int ed_schedule (struct ohci_hcd *ohci, struct ed *ed)
159 {
160         int     branch;
161
162         ed->state = ED_OPER;
163         ed->ed_prev = NULL;
164         ed->ed_next = NULL;
165         ed->hwNextED = 0;
166         if (quirk_zfmicro(ohci)
167                         && (ed->type == PIPE_INTERRUPT)
168                         && !(ohci->eds_scheduled++))
169                 mod_timer(&ohci->unlink_watchdog, round_jiffies(jiffies + HZ));
170         wmb ();
171
172         /* we care about rm_list when setting CLE/BLE in case the HC was at
173          * work on some TD when CLE/BLE was turned off, and isn't quiesced
174          * yet.  finish_unlinks() restarts as needed, some upcoming INTR_SF.
175          *
176          * control and bulk EDs are doubly linked (ed_next, ed_prev), but
177          * periodic ones are singly linked (ed_next). that's because the
178          * periodic schedule encodes a tree like figure 3-5 in the ohci
179          * spec:  each qh can have several "previous" nodes, and the tree
180          * doesn't have unused/idle descriptors.
181          */
182         switch (ed->type) {
183         case PIPE_CONTROL:
184                 if (ohci->ed_controltail == NULL) {
185                         WARN_ON (ohci->hc_control & OHCI_CTRL_CLE);
186                         ohci_writel (ohci, ed->dma,
187                                         &ohci->regs->ed_controlhead);
188                 } else {
189                         ohci->ed_controltail->ed_next = ed;
190                         ohci->ed_controltail->hwNextED = cpu_to_hc32 (ohci,
191                                                                 ed->dma);
192                 }
193                 ed->ed_prev = ohci->ed_controltail;
194                 if (!ohci->ed_controltail && !ohci->ed_rm_list) {
195                         wmb();
196                         ohci->hc_control |= OHCI_CTRL_CLE;
197                         ohci_writel (ohci, 0, &ohci->regs->ed_controlcurrent);
198                         ohci_writel (ohci, ohci->hc_control,
199                                         &ohci->regs->control);
200                 }
201                 ohci->ed_controltail = ed;
202                 break;
203
204         case PIPE_BULK:
205                 if (ohci->ed_bulktail == NULL) {
206                         WARN_ON (ohci->hc_control & OHCI_CTRL_BLE);
207                         ohci_writel (ohci, ed->dma, &ohci->regs->ed_bulkhead);
208                 } else {
209                         ohci->ed_bulktail->ed_next = ed;
210                         ohci->ed_bulktail->hwNextED = cpu_to_hc32 (ohci,
211                                                                 ed->dma);
212                 }
213                 ed->ed_prev = ohci->ed_bulktail;
214                 if (!ohci->ed_bulktail && !ohci->ed_rm_list) {
215                         wmb();
216                         ohci->hc_control |= OHCI_CTRL_BLE;
217                         ohci_writel (ohci, 0, &ohci->regs->ed_bulkcurrent);
218                         ohci_writel (ohci, ohci->hc_control,
219                                         &ohci->regs->control);
220                 }
221                 ohci->ed_bulktail = ed;
222                 break;
223
224         // case PIPE_INTERRUPT:
225         // case PIPE_ISOCHRONOUS:
226         default:
227                 branch = balance (ohci, ed->interval, ed->load);
228                 if (branch < 0) {
229                         ohci_dbg (ohci,
230                                 "ERR %d, interval %d msecs, load %d\n",
231                                 branch, ed->interval, ed->load);
232                         // FIXME if there are TDs queued, fail them!
233                         return branch;
234                 }
235                 ed->branch = branch;
236                 periodic_link (ohci, ed);
237         }
238
239         /* the HC may not see the schedule updates yet, but if it does
240          * then they'll be properly ordered.
241          */
242         return 0;
243 }
244
245 /*-------------------------------------------------------------------------*/
246
247 /* scan the periodic table to find and unlink this ED */
248 static void periodic_unlink (struct ohci_hcd *ohci, struct ed *ed)
249 {
250         int     i;
251
252         for (i = ed->branch; i < NUM_INTS; i += ed->interval) {
253                 struct ed       *temp;
254                 struct ed       **prev = &ohci->periodic [i];
255                 __hc32          *prev_p = &ohci->hcca->int_table [i];
256
257                 while (*prev && (temp = *prev) != ed) {
258                         prev_p = &temp->hwNextED;
259                         prev = &temp->ed_next;
260                 }
261                 if (*prev) {
262                         *prev_p = ed->hwNextED;
263                         *prev = ed->ed_next;
264                 }
265                 ohci->load [i] -= ed->load;
266         }
267         ohci_to_hcd(ohci)->self.bandwidth_allocated -= ed->load / ed->interval;
268
269         ohci_vdbg (ohci, "unlink %sed %p branch %d [%dus.], interval %d\n",
270                 (ed->hwINFO & cpu_to_hc32 (ohci, ED_ISO)) ? "iso " : "",
271                 ed, ed->branch, ed->load, ed->interval);
272 }
273
274 /* unlink an ed from one of the HC chains.
275  * just the link to the ed is unlinked.
276  * the link from the ed still points to another operational ed or 0
277  * so the HC can eventually finish the processing of the unlinked ed
278  * (assuming it already started that, which needn't be true).
279  *
280  * ED_UNLINK is a transient state: the HC may still see this ED, but soon
281  * it won't.  ED_SKIP means the HC will finish its current transaction,
282  * but won't start anything new.  The TD queue may still grow; device
283  * drivers don't know about this HCD-internal state.
284  *
285  * When the HC can't see the ED, something changes ED_UNLINK to one of:
286  *
287  *  - ED_OPER: when there's any request queued, the ED gets rescheduled
288  *    immediately.  HC should be working on them.
289  *
290  *  - ED_IDLE:  when there's no TD queue. there's no reason for the HC
291  *    to care about this ED; safe to disable the endpoint.
292  *
293  * When finish_unlinks() runs later, after SOF interrupt, it will often
294  * complete one or more URB unlinks before making that state change.
295  */
296 static void ed_deschedule (struct ohci_hcd *ohci, struct ed *ed)
297 {
298         ed->hwINFO |= cpu_to_hc32 (ohci, ED_SKIP);
299         wmb ();
300         ed->state = ED_UNLINK;
301
302         /* To deschedule something from the control or bulk list, just
303          * clear CLE/BLE and wait.  There's no safe way to scrub out list
304          * head/current registers until later, and "later" isn't very
305          * tightly specified.  Figure 6-5 and Section 6.4.2.2 show how
306          * the HC is reading the ED queues (while we modify them).
307          *
308          * For now, ed_schedule() is "later".  It might be good paranoia
309          * to scrub those registers in finish_unlinks(), in case of bugs
310          * that make the HC try to use them.
311          */
312         switch (ed->type) {
313         case PIPE_CONTROL:
314                 /* remove ED from the HC's list: */
315                 if (ed->ed_prev == NULL) {
316                         if (!ed->hwNextED) {
317                                 ohci->hc_control &= ~OHCI_CTRL_CLE;
318                                 ohci_writel (ohci, ohci->hc_control,
319                                                 &ohci->regs->control);
320                                 // a ohci_readl() later syncs CLE with the HC
321                         } else
322                                 ohci_writel (ohci,
323                                         hc32_to_cpup (ohci, &ed->hwNextED),
324                                         &ohci->regs->ed_controlhead);
325                 } else {
326                         ed->ed_prev->ed_next = ed->ed_next;
327                         ed->ed_prev->hwNextED = ed->hwNextED;
328                 }
329                 /* remove ED from the HCD's list: */
330                 if (ohci->ed_controltail == ed) {
331                         ohci->ed_controltail = ed->ed_prev;
332                         if (ohci->ed_controltail)
333                                 ohci->ed_controltail->ed_next = NULL;
334                 } else if (ed->ed_next) {
335                         ed->ed_next->ed_prev = ed->ed_prev;
336                 }
337                 break;
338
339         case PIPE_BULK:
340                 /* remove ED from the HC's list: */
341                 if (ed->ed_prev == NULL) {
342                         if (!ed->hwNextED) {
343                                 ohci->hc_control &= ~OHCI_CTRL_BLE;
344                                 ohci_writel (ohci, ohci->hc_control,
345                                                 &ohci->regs->control);
346                                 // a ohci_readl() later syncs BLE with the HC
347                         } else
348                                 ohci_writel (ohci,
349                                         hc32_to_cpup (ohci, &ed->hwNextED),
350                                         &ohci->regs->ed_bulkhead);
351                 } else {
352                         ed->ed_prev->ed_next = ed->ed_next;
353                         ed->ed_prev->hwNextED = ed->hwNextED;
354                 }
355                 /* remove ED from the HCD's list: */
356                 if (ohci->ed_bulktail == ed) {
357                         ohci->ed_bulktail = ed->ed_prev;
358                         if (ohci->ed_bulktail)
359                                 ohci->ed_bulktail->ed_next = NULL;
360                 } else if (ed->ed_next) {
361                         ed->ed_next->ed_prev = ed->ed_prev;
362                 }
363                 break;
364
365         // case PIPE_INTERRUPT:
366         // case PIPE_ISOCHRONOUS:
367         default:
368                 periodic_unlink (ohci, ed);
369                 break;
370         }
371 }
372
373
374 /*-------------------------------------------------------------------------*/
375
376 /* get and maybe (re)init an endpoint. init _should_ be done only as part
377  * of enumeration, usb_set_configuration() or usb_set_interface().
378  */
379 static struct ed *ed_get (
380         struct ohci_hcd         *ohci,
381         struct usb_host_endpoint *ep,
382         struct usb_device       *udev,
383         unsigned int            pipe,
384         int                     interval
385 ) {
386         struct ed               *ed;
387         unsigned long           flags;
388
389         spin_lock_irqsave (&ohci->lock, flags);
390
391         if (!(ed = ep->hcpriv)) {
392                 struct td       *td;
393                 int             is_out;
394                 u32             info;
395
396                 ed = ed_alloc (ohci, GFP_ATOMIC);
397                 if (!ed) {
398                         /* out of memory */
399                         goto done;
400                 }
401
402                 /* dummy td; end of td list for ed */
403                 td = td_alloc (ohci, GFP_ATOMIC);
404                 if (!td) {
405                         /* out of memory */
406                         ed_free (ohci, ed);
407                         ed = NULL;
408                         goto done;
409                 }
410                 ed->dummy = td;
411                 ed->hwTailP = cpu_to_hc32 (ohci, td->td_dma);
412                 ed->hwHeadP = ed->hwTailP;      /* ED_C, ED_H zeroed */
413                 ed->state = ED_IDLE;
414
415                 is_out = !(ep->desc.bEndpointAddress & USB_DIR_IN);
416
417                 /* FIXME usbcore changes dev->devnum before SET_ADDRESS
418                  * suceeds ... otherwise we wouldn't need "pipe".
419                  */
420                 info = usb_pipedevice (pipe);
421                 ed->type = usb_pipetype(pipe);
422
423                 info |= (ep->desc.bEndpointAddress & ~USB_DIR_IN) << 7;
424                 info |= le16_to_cpu(ep->desc.wMaxPacketSize) << 16;
425                 if (udev->speed == USB_SPEED_LOW)
426                         info |= ED_LOWSPEED;
427                 /* only control transfers store pids in tds */
428                 if (ed->type != PIPE_CONTROL) {
429                         info |= is_out ? ED_OUT : ED_IN;
430                         if (ed->type != PIPE_BULK) {
431                                 /* periodic transfers... */
432                                 if (ed->type == PIPE_ISOCHRONOUS)
433                                         info |= ED_ISO;
434                                 else if (interval > 32) /* iso can be bigger */
435                                         interval = 32;
436                                 ed->interval = interval;
437                                 ed->load = usb_calc_bus_time (
438                                         udev->speed, !is_out,
439                                         ed->type == PIPE_ISOCHRONOUS,
440                                         le16_to_cpu(ep->desc.wMaxPacketSize))
441                                                 / 1000;
442                         }
443                 }
444                 ed->hwINFO = cpu_to_hc32(ohci, info);
445
446                 ep->hcpriv = ed;
447         }
448
449 done:
450         spin_unlock_irqrestore (&ohci->lock, flags);
451         return ed;
452 }
453
454 /*-------------------------------------------------------------------------*/
455
456 /* request unlinking of an endpoint from an operational HC.
457  * put the ep on the rm_list
458  * real work is done at the next start frame (SF) hardware interrupt
459  * caller guarantees HCD is running, so hardware access is safe,
460  * and that ed->state is ED_OPER
461  */
462 static void start_ed_unlink (struct ohci_hcd *ohci, struct ed *ed)
463 {
464         ed->hwINFO |= cpu_to_hc32 (ohci, ED_DEQUEUE);
465         ed_deschedule (ohci, ed);
466
467         /* rm_list is just singly linked, for simplicity */
468         ed->ed_next = ohci->ed_rm_list;
469         ed->ed_prev = NULL;
470         ohci->ed_rm_list = ed;
471
472         /* enable SOF interrupt */
473         ohci_writel (ohci, OHCI_INTR_SF, &ohci->regs->intrstatus);
474         ohci_writel (ohci, OHCI_INTR_SF, &ohci->regs->intrenable);
475         // flush those writes, and get latest HCCA contents
476         (void) ohci_readl (ohci, &ohci->regs->control);
477
478         /* SF interrupt might get delayed; record the frame counter value that
479          * indicates when the HC isn't looking at it, so concurrent unlinks
480          * behave.  frame_no wraps every 2^16 msec, and changes right before
481          * SF is triggered.
482          */
483         ed->tick = ohci_frame_no(ohci) + 1;
484
485 }
486
487 /*-------------------------------------------------------------------------*
488  * TD handling functions
489  *-------------------------------------------------------------------------*/
490
491 /* enqueue next TD for this URB (OHCI spec 5.2.8.2) */
492
493 static void
494 td_fill (struct ohci_hcd *ohci, u32 info,
495         dma_addr_t data, int len,
496         struct urb *urb, int index)
497 {
498         struct td               *td, *td_pt;
499         struct urb_priv         *urb_priv = urb->hcpriv;
500         int                     is_iso = info & TD_ISO;
501         int                     hash;
502
503         // ASSERT (index < urb_priv->length);
504
505         /* aim for only one interrupt per urb.  mostly applies to control
506          * and iso; other urbs rarely need more than one TD per urb.
507          * this way, only final tds (or ones with an error) cause IRQs.
508          * at least immediately; use DI=6 in case any control request is
509          * tempted to die part way through.  (and to force the hc to flush
510          * its donelist soonish, even on unlink paths.)
511          *
512          * NOTE: could delay interrupts even for the last TD, and get fewer
513          * interrupts ... increasing per-urb latency by sharing interrupts.
514          * Drivers that queue bulk urbs may request that behavior.
515          */
516         if (index != (urb_priv->length - 1)
517                         || (urb->transfer_flags & URB_NO_INTERRUPT))
518                 info |= TD_DI_SET (6);
519
520         /* use this td as the next dummy */
521         td_pt = urb_priv->td [index];
522
523         /* fill the old dummy TD */
524         td = urb_priv->td [index] = urb_priv->ed->dummy;
525         urb_priv->ed->dummy = td_pt;
526
527         td->ed = urb_priv->ed;
528         td->next_dl_td = NULL;
529         td->index = index;
530         td->urb = urb;
531         td->data_dma = data;
532         if (!len)
533                 data = 0;
534
535         td->hwINFO = cpu_to_hc32 (ohci, info);
536         if (is_iso) {
537                 td->hwCBP = cpu_to_hc32 (ohci, data & 0xFFFFF000);
538                 *ohci_hwPSWp(ohci, td, 0) = cpu_to_hc16 (ohci,
539                                                 (data & 0x0FFF) | 0xE000);
540                 td->ed->last_iso = info & 0xffff;
541         } else {
542                 td->hwCBP = cpu_to_hc32 (ohci, data);
543         }
544         if (data)
545                 td->hwBE = cpu_to_hc32 (ohci, data + len - 1);
546         else
547                 td->hwBE = 0;
548         td->hwNextTD = cpu_to_hc32 (ohci, td_pt->td_dma);
549
550         /* append to queue */
551         list_add_tail (&td->td_list, &td->ed->td_list);
552
553         /* hash it for later reverse mapping */
554         hash = TD_HASH_FUNC (td->td_dma);
555         td->td_hash = ohci->td_hash [hash];
556         ohci->td_hash [hash] = td;
557
558         /* HC might read the TD (or cachelines) right away ... */
559         wmb ();
560         td->ed->hwTailP = td->hwNextTD;
561 }
562
563 /*-------------------------------------------------------------------------*/
564
565 /* Prepare all TDs of a transfer, and queue them onto the ED.
566  * Caller guarantees HC is active.
567  * Usually the ED is already on the schedule, so TDs might be
568  * processed as soon as they're queued.
569  */
570 static void td_submit_urb (
571         struct ohci_hcd *ohci,
572         struct urb      *urb
573 ) {
574         struct urb_priv *urb_priv = urb->hcpriv;
575         dma_addr_t      data;
576         int             data_len = urb->transfer_buffer_length;
577         int             cnt = 0;
578         u32             info = 0;
579         int             is_out = usb_pipeout (urb->pipe);
580         int             periodic = 0;
581
582         /* OHCI handles the bulk/interrupt data toggles itself.  We just
583          * use the device toggle bits for resetting, and rely on the fact
584          * that resetting toggle is meaningless if the endpoint is active.
585          */
586         if (!usb_gettoggle (urb->dev, usb_pipeendpoint (urb->pipe), is_out)) {
587                 usb_settoggle (urb->dev, usb_pipeendpoint (urb->pipe),
588                         is_out, 1);
589                 urb_priv->ed->hwHeadP &= ~cpu_to_hc32 (ohci, ED_C);
590         }
591
592         urb_priv->td_cnt = 0;
593         list_add (&urb_priv->pending, &ohci->pending);
594
595         if (data_len)
596                 data = urb->transfer_dma;
597         else
598                 data = 0;
599
600         /* NOTE:  TD_CC is set so we can tell which TDs the HC processed by
601          * using TD_CC_GET, as well as by seeing them on the done list.
602          * (CC = NotAccessed ... 0x0F, or 0x0E in PSWs for ISO.)
603          */
604         switch (urb_priv->ed->type) {
605
606         /* Bulk and interrupt are identical except for where in the schedule
607          * their EDs live.
608          */
609         case PIPE_INTERRUPT:
610                 /* ... and periodic urbs have extra accounting */
611                 periodic = ohci_to_hcd(ohci)->self.bandwidth_int_reqs++ == 0
612                         && ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0;
613                 /* FALLTHROUGH */
614         case PIPE_BULK:
615                 info = is_out
616                         ? TD_T_TOGGLE | TD_CC | TD_DP_OUT
617                         : TD_T_TOGGLE | TD_CC | TD_DP_IN;
618                 /* TDs _could_ transfer up to 8K each */
619                 while (data_len > 4096) {
620                         td_fill (ohci, info, data, 4096, urb, cnt);
621                         data += 4096;
622                         data_len -= 4096;
623                         cnt++;
624                 }
625                 /* maybe avoid ED halt on final TD short read */
626                 if (!(urb->transfer_flags & URB_SHORT_NOT_OK))
627                         info |= TD_R;
628                 td_fill (ohci, info, data, data_len, urb, cnt);
629                 cnt++;
630                 if ((urb->transfer_flags & URB_ZERO_PACKET)
631                                 && cnt < urb_priv->length) {
632                         td_fill (ohci, info, 0, 0, urb, cnt);
633                         cnt++;
634                 }
635                 /* maybe kickstart bulk list */
636                 if (urb_priv->ed->type == PIPE_BULK) {
637                         wmb ();
638                         ohci_writel (ohci, OHCI_BLF, &ohci->regs->cmdstatus);
639                 }
640                 break;
641
642         /* control manages DATA0/DATA1 toggle per-request; SETUP resets it,
643          * any DATA phase works normally, and the STATUS ack is special.
644          */
645         case PIPE_CONTROL:
646                 info = TD_CC | TD_DP_SETUP | TD_T_DATA0;
647                 td_fill (ohci, info, urb->setup_dma, 8, urb, cnt++);
648                 if (data_len > 0) {
649                         info = TD_CC | TD_R | TD_T_DATA1;
650                         info |= is_out ? TD_DP_OUT : TD_DP_IN;
651                         /* NOTE:  mishandles transfers >8K, some >4K */
652                         td_fill (ohci, info, data, data_len, urb, cnt++);
653                 }
654                 info = (is_out || data_len == 0)
655                         ? TD_CC | TD_DP_IN | TD_T_DATA1
656                         : TD_CC | TD_DP_OUT | TD_T_DATA1;
657                 td_fill (ohci, info, data, 0, urb, cnt++);
658                 /* maybe kickstart control list */
659                 wmb ();
660                 ohci_writel (ohci, OHCI_CLF, &ohci->regs->cmdstatus);
661                 break;
662
663         /* ISO has no retransmit, so no toggle; and it uses special TDs.
664          * Each TD could handle multiple consecutive frames (interval 1);
665          * we could often reduce the number of TDs here.
666          */
667         case PIPE_ISOCHRONOUS:
668                 for (cnt = 0; cnt < urb->number_of_packets; cnt++) {
669                         int     frame = urb->start_frame;
670
671                         // FIXME scheduling should handle frame counter
672                         // roll-around ... exotic case (and OHCI has
673                         // a 2^16 iso range, vs other HCs max of 2^10)
674                         frame += cnt * urb->interval;
675                         frame &= 0xffff;
676                         td_fill (ohci, TD_CC | TD_ISO | frame,
677                                 data + urb->iso_frame_desc [cnt].offset,
678                                 urb->iso_frame_desc [cnt].length, urb, cnt);
679                 }
680                 periodic = ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs++ == 0
681                         && ohci_to_hcd(ohci)->self.bandwidth_int_reqs == 0;
682                 break;
683         }
684
685         /* start periodic dma if needed */
686         if (periodic) {
687                 wmb ();
688                 ohci->hc_control |= OHCI_CTRL_PLE|OHCI_CTRL_IE;
689                 ohci_writel (ohci, ohci->hc_control, &ohci->regs->control);
690         }
691
692         // ASSERT (urb_priv->length == cnt);
693 }
694
695 /*-------------------------------------------------------------------------*
696  * Done List handling functions
697  *-------------------------------------------------------------------------*/
698
699 /* calculate transfer length/status and update the urb */
700 static int td_done(struct ohci_hcd *ohci, struct urb *urb, struct td *td)
701 {
702         u32     tdINFO = hc32_to_cpup (ohci, &td->hwINFO);
703         int     cc = 0;
704         int     status = -EINPROGRESS;
705
706         list_del (&td->td_list);
707
708         /* ISO ... drivers see per-TD length/status */
709         if (tdINFO & TD_ISO) {
710                 u16     tdPSW = ohci_hwPSW(ohci, td, 0);
711                 int     dlen = 0;
712
713                 /* NOTE:  assumes FC in tdINFO == 0, and that
714                  * only the first of 0..MAXPSW psws is used.
715                  */
716
717                 cc = (tdPSW >> 12) & 0xF;
718                 if (tdINFO & TD_CC)     /* hc didn't touch? */
719                         return status;
720
721                 if (usb_pipeout (urb->pipe))
722                         dlen = urb->iso_frame_desc [td->index].length;
723                 else {
724                         /* short reads are always OK for ISO */
725                         if (cc == TD_DATAUNDERRUN)
726                                 cc = TD_CC_NOERROR;
727                         dlen = tdPSW & 0x3ff;
728                 }
729                 urb->actual_length += dlen;
730                 urb->iso_frame_desc [td->index].actual_length = dlen;
731                 urb->iso_frame_desc [td->index].status = cc_to_error [cc];
732
733                 if (cc != TD_CC_NOERROR)
734                         ohci_vdbg (ohci,
735                                 "urb %p iso td %p (%d) len %d cc %d\n",
736                                 urb, td, 1 + td->index, dlen, cc);
737
738         /* BULK, INT, CONTROL ... drivers see aggregate length/status,
739          * except that "setup" bytes aren't counted and "short" transfers
740          * might not be reported as errors.
741          */
742         } else {
743                 int     type = usb_pipetype (urb->pipe);
744                 u32     tdBE = hc32_to_cpup (ohci, &td->hwBE);
745
746                 cc = TD_CC_GET (tdINFO);
747
748                 /* update packet status if needed (short is normally ok) */
749                 if (cc == TD_DATAUNDERRUN
750                                 && !(urb->transfer_flags & URB_SHORT_NOT_OK))
751                         cc = TD_CC_NOERROR;
752                 if (cc != TD_CC_NOERROR && cc < 0x0E)
753                         status = cc_to_error[cc];
754
755                 /* count all non-empty packets except control SETUP packet */
756                 if ((type != PIPE_CONTROL || td->index != 0) && tdBE != 0) {
757                         if (td->hwCBP == 0)
758                                 urb->actual_length += tdBE - td->data_dma + 1;
759                         else
760                                 urb->actual_length +=
761                                           hc32_to_cpup (ohci, &td->hwCBP)
762                                         - td->data_dma;
763                 }
764
765                 if (cc != TD_CC_NOERROR && cc < 0x0E)
766                         ohci_vdbg (ohci,
767                                 "urb %p td %p (%d) cc %d, len=%d/%d\n",
768                                 urb, td, 1 + td->index, cc,
769                                 urb->actual_length,
770                                 urb->transfer_buffer_length);
771         }
772         return status;
773 }
774
775 /*-------------------------------------------------------------------------*/
776
777 static void ed_halted(struct ohci_hcd *ohci, struct td *td, int cc)
778 {
779         struct urb              *urb = td->urb;
780         urb_priv_t              *urb_priv = urb->hcpriv;
781         struct ed               *ed = td->ed;
782         struct list_head        *tmp = td->td_list.next;
783         __hc32                  toggle = ed->hwHeadP & cpu_to_hc32 (ohci, ED_C);
784
785         /* clear ed halt; this is the td that caused it, but keep it inactive
786          * until its urb->complete() has a chance to clean up.
787          */
788         ed->hwINFO |= cpu_to_hc32 (ohci, ED_SKIP);
789         wmb ();
790         ed->hwHeadP &= ~cpu_to_hc32 (ohci, ED_H);
791
792         /* Get rid of all later tds from this urb.  We don't have
793          * to be careful: no errors and nothing was transferred.
794          * Also patch the ed so it looks as if those tds completed normally.
795          */
796         while (tmp != &ed->td_list) {
797                 struct td       *next;
798
799                 next = list_entry (tmp, struct td, td_list);
800                 tmp = next->td_list.next;
801
802                 if (next->urb != urb)
803                         break;
804
805                 /* NOTE: if multi-td control DATA segments get supported,
806                  * this urb had one of them, this td wasn't the last td
807                  * in that segment (TD_R clear), this ed halted because
808                  * of a short read, _and_ URB_SHORT_NOT_OK is clear ...
809                  * then we need to leave the control STATUS packet queued
810                  * and clear ED_SKIP.
811                  */
812
813                 list_del(&next->td_list);
814                 urb_priv->td_cnt++;
815                 ed->hwHeadP = next->hwNextTD | toggle;
816         }
817
818         /* help for troubleshooting:  report anything that
819          * looks odd ... that doesn't include protocol stalls
820          * (or maybe some other things)
821          */
822         switch (cc) {
823         case TD_DATAUNDERRUN:
824                 if ((urb->transfer_flags & URB_SHORT_NOT_OK) == 0)
825                         break;
826                 /* fallthrough */
827         case TD_CC_STALL:
828                 if (usb_pipecontrol (urb->pipe))
829                         break;
830                 /* fallthrough */
831         default:
832                 ohci_dbg (ohci,
833                         "urb %p path %s ep%d%s %08x cc %d --> status %d\n",
834                         urb, urb->dev->devpath,
835                         usb_pipeendpoint (urb->pipe),
836                         usb_pipein (urb->pipe) ? "in" : "out",
837                         hc32_to_cpu (ohci, td->hwINFO),
838                         cc, cc_to_error [cc]);
839         }
840 }
841
842 /* replies to the request have to be on a FIFO basis so
843  * we unreverse the hc-reversed done-list
844  */
845 static struct td *dl_reverse_done_list (struct ohci_hcd *ohci)
846 {
847         u32             td_dma;
848         struct td       *td_rev = NULL;
849         struct td       *td = NULL;
850
851         td_dma = hc32_to_cpup (ohci, &ohci->hcca->done_head);
852         ohci->hcca->done_head = 0;
853         wmb();
854
855         /* get TD from hc's singly linked list, and
856          * prepend to ours.  ed->td_list changes later.
857          */
858         while (td_dma) {
859                 int             cc;
860
861                 td = dma_to_td (ohci, td_dma);
862                 if (!td) {
863                         ohci_err (ohci, "bad entry %8x\n", td_dma);
864                         break;
865                 }
866
867                 td->hwINFO |= cpu_to_hc32 (ohci, TD_DONE);
868                 cc = TD_CC_GET (hc32_to_cpup (ohci, &td->hwINFO));
869
870                 /* Non-iso endpoints can halt on error; un-halt,
871                  * and dequeue any other TDs from this urb.
872                  * No other TD could have caused the halt.
873                  */
874                 if (cc != TD_CC_NOERROR
875                                 && (td->ed->hwHeadP & cpu_to_hc32 (ohci, ED_H)))
876                         ed_halted(ohci, td, cc);
877
878                 td->next_dl_td = td_rev;
879                 td_rev = td;
880                 td_dma = hc32_to_cpup (ohci, &td->hwNextTD);
881         }
882         return td_rev;
883 }
884
885 /*-------------------------------------------------------------------------*/
886
887 /* there are some urbs/eds to unlink; called in_irq(), with HCD locked */
888 static void
889 finish_unlinks (struct ohci_hcd *ohci, u16 tick)
890 {
891         struct ed       *ed, **last;
892
893 rescan_all:
894         for (last = &ohci->ed_rm_list, ed = *last; ed != NULL; ed = *last) {
895                 struct list_head        *entry, *tmp;
896                 int                     completed, modified;
897                 __hc32                  *prev;
898
899                 /* only take off EDs that the HC isn't using, accounting for
900                  * frame counter wraps and EDs with partially retired TDs
901                  */
902                 if (likely (HC_IS_RUNNING(ohci_to_hcd(ohci)->state))) {
903                         if (tick_before (tick, ed->tick)) {
904 skip_ed:
905                                 last = &ed->ed_next;
906                                 continue;
907                         }
908
909                         if (!list_empty (&ed->td_list)) {
910                                 struct td       *td;
911                                 u32             head;
912
913                                 td = list_entry (ed->td_list.next, struct td,
914                                                         td_list);
915                                 head = hc32_to_cpu (ohci, ed->hwHeadP) &
916                                                                 TD_MASK;
917
918                                 /* INTR_WDH may need to clean up first */
919                                 if (td->td_dma != head) {
920                                         if (ed == ohci->ed_to_check)
921                                                 ohci->ed_to_check = NULL;
922                                         else
923                                                 goto skip_ed;
924                                 }
925                         }
926                 }
927
928                 /* reentrancy:  if we drop the schedule lock, someone might
929                  * have modified this list.  normally it's just prepending
930                  * entries (which we'd ignore), but paranoia won't hurt.
931                  */
932                 *last = ed->ed_next;
933                 ed->ed_next = NULL;
934                 modified = 0;
935
936                 /* unlink urbs as requested, but rescan the list after
937                  * we call a completion since it might have unlinked
938                  * another (earlier) urb
939                  *
940                  * When we get here, the HC doesn't see this ed.  But it
941                  * must not be rescheduled until all completed URBs have
942                  * been given back to the driver.
943                  */
944 rescan_this:
945                 completed = 0;
946                 prev = &ed->hwHeadP;
947                 list_for_each_safe (entry, tmp, &ed->td_list) {
948                         struct td       *td;
949                         struct urb      *urb;
950                         urb_priv_t      *urb_priv;
951                         __hc32          savebits;
952                         u32             tdINFO;
953
954                         td = list_entry (entry, struct td, td_list);
955                         urb = td->urb;
956                         urb_priv = td->urb->hcpriv;
957
958                         if (!urb->unlinked) {
959                                 prev = &td->hwNextTD;
960                                 continue;
961                         }
962
963                         /* patch pointer hc uses */
964                         savebits = *prev & ~cpu_to_hc32 (ohci, TD_MASK);
965                         *prev = td->hwNextTD | savebits;
966
967                         /* If this was unlinked, the TD may not have been
968                          * retired ... so manually save the data toggle.
969                          * The controller ignores the value we save for
970                          * control and ISO endpoints.
971                          */
972                         tdINFO = hc32_to_cpup(ohci, &td->hwINFO);
973                         if ((tdINFO & TD_T) == TD_T_DATA0)
974                                 ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_C);
975                         else if ((tdINFO & TD_T) == TD_T_DATA1)
976                                 ed->hwHeadP |= cpu_to_hc32(ohci, ED_C);
977
978                         /* HC may have partly processed this TD */
979                         td_done (ohci, urb, td);
980                         urb_priv->td_cnt++;
981
982                         /* if URB is done, clean up */
983                         if (urb_priv->td_cnt == urb_priv->length) {
984                                 modified = completed = 1;
985                                 finish_urb(ohci, urb, 0);
986                         }
987                 }
988                 if (completed && !list_empty (&ed->td_list))
989                         goto rescan_this;
990
991                 /* ED's now officially unlinked, hc doesn't see */
992                 ed->state = ED_IDLE;
993                 if (quirk_zfmicro(ohci) && ed->type == PIPE_INTERRUPT)
994                         ohci->eds_scheduled--;
995                 ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_H);
996                 ed->hwNextED = 0;
997                 wmb ();
998                 ed->hwINFO &= ~cpu_to_hc32 (ohci, ED_SKIP | ED_DEQUEUE);
999
1000                 /* but if there's work queued, reschedule */
1001                 if (!list_empty (&ed->td_list)) {
1002                         if (HC_IS_RUNNING(ohci_to_hcd(ohci)->state))
1003                                 ed_schedule (ohci, ed);
1004                 }
1005
1006                 if (modified)
1007                         goto rescan_all;
1008         }
1009
1010         /* maybe reenable control and bulk lists */
1011         if (HC_IS_RUNNING(ohci_to_hcd(ohci)->state)
1012                         && ohci_to_hcd(ohci)->state != HC_STATE_QUIESCING
1013                         && !ohci->ed_rm_list) {
1014                 u32     command = 0, control = 0;
1015
1016                 if (ohci->ed_controltail) {
1017                         command |= OHCI_CLF;
1018                         if (quirk_zfmicro(ohci))
1019                                 mdelay(1);
1020                         if (!(ohci->hc_control & OHCI_CTRL_CLE)) {
1021                                 control |= OHCI_CTRL_CLE;
1022                                 ohci_writel (ohci, 0,
1023                                         &ohci->regs->ed_controlcurrent);
1024                         }
1025                 }
1026                 if (ohci->ed_bulktail) {
1027                         command |= OHCI_BLF;
1028                         if (quirk_zfmicro(ohci))
1029                                 mdelay(1);
1030                         if (!(ohci->hc_control & OHCI_CTRL_BLE)) {
1031                                 control |= OHCI_CTRL_BLE;
1032                                 ohci_writel (ohci, 0,
1033                                         &ohci->regs->ed_bulkcurrent);
1034                         }
1035                 }
1036
1037                 /* CLE/BLE to enable, CLF/BLF to (maybe) kickstart */
1038                 if (control) {
1039                         ohci->hc_control |= control;
1040                         if (quirk_zfmicro(ohci))
1041                                 mdelay(1);
1042                         ohci_writel (ohci, ohci->hc_control,
1043                                         &ohci->regs->control);
1044                 }
1045                 if (command) {
1046                         if (quirk_zfmicro(ohci))
1047                                 mdelay(1);
1048                         ohci_writel (ohci, command, &ohci->regs->cmdstatus);
1049                 }
1050         }
1051 }
1052
1053
1054
1055 /*-------------------------------------------------------------------------*/
1056
1057 /*
1058  * Used to take back a TD from the host controller. This would normally be
1059  * called from within dl_done_list, however it may be called directly if the
1060  * HC no longer sees the TD and it has not appeared on the donelist (after
1061  * two frames).  This bug has been observed on ZF Micro systems.
1062  */
1063 static void takeback_td(struct ohci_hcd *ohci, struct td *td)
1064 {
1065         struct urb      *urb = td->urb;
1066         urb_priv_t      *urb_priv = urb->hcpriv;
1067         struct ed       *ed = td->ed;
1068         int             status;
1069
1070         /* update URB's length and status from TD */
1071         status = td_done(ohci, urb, td);
1072         urb_priv->td_cnt++;
1073
1074         /* If all this urb's TDs are done, call complete() */
1075         if (urb_priv->td_cnt == urb_priv->length)
1076                 finish_urb(ohci, urb, status);
1077
1078         /* clean schedule:  unlink EDs that are no longer busy */
1079         if (list_empty(&ed->td_list)) {
1080                 if (ed->state == ED_OPER)
1081                         start_ed_unlink(ohci, ed);
1082
1083         /* ... reenabling halted EDs only after fault cleanup */
1084         } else if ((ed->hwINFO & cpu_to_hc32(ohci, ED_SKIP | ED_DEQUEUE))
1085                         == cpu_to_hc32(ohci, ED_SKIP)) {
1086                 td = list_entry(ed->td_list.next, struct td, td_list);
1087                 if (!(td->hwINFO & cpu_to_hc32(ohci, TD_DONE))) {
1088                         ed->hwINFO &= ~cpu_to_hc32(ohci, ED_SKIP);
1089                         /* ... hc may need waking-up */
1090                         switch (ed->type) {
1091                         case PIPE_CONTROL:
1092                                 ohci_writel(ohci, OHCI_CLF,
1093                                                 &ohci->regs->cmdstatus);
1094                                 break;
1095                         case PIPE_BULK:
1096                                 ohci_writel(ohci, OHCI_BLF,
1097                                                 &ohci->regs->cmdstatus);
1098                                 break;
1099                         }
1100                 }
1101         }
1102 }
1103
1104 /*
1105  * Process normal completions (error or success) and clean the schedules.
1106  *
1107  * This is the main path for handing urbs back to drivers.  The only other
1108  * normal path is finish_unlinks(), which unlinks URBs using ed_rm_list,
1109  * instead of scanning the (re-reversed) donelist as this does.  There's
1110  * an abnormal path too, handling a quirk in some Compaq silicon:  URBs
1111  * with TDs that appear to be orphaned are directly reclaimed.
1112  */
1113 static void
1114 dl_done_list (struct ohci_hcd *ohci)
1115 {
1116         struct td       *td = dl_reverse_done_list (ohci);
1117
1118         while (td) {
1119                 struct td       *td_next = td->next_dl_td;
1120                 takeback_td(ohci, td);
1121                 td = td_next;
1122         }
1123 }