1 /*
2  * c67x00-sched.c: Cypress C67X00 USB Host Controller Driver - TD scheduling
3  *
4  * Copyright (C) 2006-2008 Barco N.V.
5  *    Derived from the Cypress cy7c67200/300 ezusb linux driver and
6  *    based on multiple host controller drivers inside the linux kernel.
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License as published by
10  * the Free Software Foundation; either version 2 of the License, or
11  * (at your option) any later version.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, write to the Free Software
20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
21  * MA  02110-1301  USA.
22  */
23 
24 #include <linux/kthread.h>
25 #include <linux/slab.h>
26 
27 #include "c67x00.h"
28 #include "c67x00-hcd.h"
29 
30 /*
31  * These are the stages for a control urb, they are kept
32  * in both urb->interval and td->privdata.
33  */
34 #define SETUP_STAGE		0
35 #define DATA_STAGE		1
36 #define STATUS_STAGE		2
37 
38 /* -------------------------------------------------------------------------- */
39 
40 /**
41  * struct c67x00_ep_data: Host endpoint data structure
42  */
43 struct c67x00_ep_data {
44 	struct list_head queue;
45 	struct list_head node;
46 	struct usb_host_endpoint *hep;
47 	struct usb_device *dev;
48 	u16 next_frame;		/* For int/isoc transactions */
49 };
50 
51 /**
52  * struct c67x00_td
53  *
54  * Hardware parts are little endiannes, SW in CPU endianess.
55  */
56 struct c67x00_td {
57 	/* HW specific part */
58 	__le16 ly_base_addr;	/* Bytes 0-1 */
59 	__le16 port_length;	/* Bytes 2-3 */
60 	u8 pid_ep;		/* Byte 4 */
61 	u8 dev_addr;		/* Byte 5 */
62 	u8 ctrl_reg;		/* Byte 6 */
63 	u8 status;		/* Byte 7 */
64 	u8 retry_cnt;		/* Byte 8 */
65 #define TT_OFFSET		2
66 #define TT_CONTROL		0
67 #define TT_ISOCHRONOUS		1
68 #define TT_BULK			2
69 #define TT_INTERRUPT		3
70 	u8 residue;		/* Byte 9 */
71 	__le16 next_td_addr;	/* Bytes 10-11 */
72 	/* SW part */
73 	struct list_head td_list;
74 	u16 td_addr;
75 	void *data;
76 	struct urb *urb;
77 	unsigned long privdata;
78 
79 	/* These are needed for handling the toggle bits:
80 	 * an urb can be dequeued while a td is in progress
81 	 * after checking the td, the toggle bit might need to
82 	 * be fixed */
83 	struct c67x00_ep_data *ep_data;
84 	unsigned int pipe;
85 };
86 
87 struct c67x00_urb_priv {
88 	struct list_head hep_node;
89 	struct urb *urb;
90 	int port;
91 	int cnt;		/* packet number for isoc */
92 	int status;
93 	struct c67x00_ep_data *ep_data;
94 };
95 
96 #define td_udev(td)	((td)->ep_data->dev)
97 
98 #define CY_TD_SIZE		12
99 
100 #define TD_PIDEP_OFFSET		0x04
101 #define TD_PIDEPMASK_PID	0xF0
102 #define TD_PIDEPMASK_EP		0x0F
103 #define TD_PORTLENMASK_DL	0x03FF
104 #define TD_PORTLENMASK_PN	0xC000
105 
106 #define TD_STATUS_OFFSET	0x07
107 #define TD_STATUSMASK_ACK	0x01
108 #define TD_STATUSMASK_ERR	0x02
109 #define TD_STATUSMASK_TMOUT	0x04
110 #define TD_STATUSMASK_SEQ	0x08
111 #define TD_STATUSMASK_SETUP	0x10
112 #define TD_STATUSMASK_OVF	0x20
113 #define TD_STATUSMASK_NAK	0x40
114 #define TD_STATUSMASK_STALL	0x80
115 
116 #define TD_ERROR_MASK		(TD_STATUSMASK_ERR | TD_STATUSMASK_TMOUT | \
117 				 TD_STATUSMASK_STALL)
118 
119 #define TD_RETRYCNT_OFFSET	0x08
120 #define TD_RETRYCNTMASK_ACT_FLG	0x10
121 #define TD_RETRYCNTMASK_TX_TYPE	0x0C
122 #define TD_RETRYCNTMASK_RTY_CNT	0x03
123 
124 #define TD_RESIDUE_OVERFLOW	0x80
125 
126 #define TD_PID_IN		0x90
127 
128 /* Residue: signed 8bits, neg -> OVERFLOW, pos -> UNDERFLOW */
129 #define td_residue(td)		((__s8)(td->residue))
130 #define td_ly_base_addr(td)	(__le16_to_cpu((td)->ly_base_addr))
131 #define td_port_length(td)	(__le16_to_cpu((td)->port_length))
132 #define td_next_td_addr(td)	(__le16_to_cpu((td)->next_td_addr))
133 
134 #define td_active(td)		((td)->retry_cnt & TD_RETRYCNTMASK_ACT_FLG)
135 #define td_length(td)		(td_port_length(td) & TD_PORTLENMASK_DL)
136 
137 #define td_sequence_ok(td)	(!td->status || \
138 				 (!(td->status & TD_STATUSMASK_SEQ) ==	\
139 				  !(td->ctrl_reg & SEQ_SEL)))
140 
141 #define td_acked(td)		(!td->status || \
142 				 (td->status & TD_STATUSMASK_ACK))
143 #define td_actual_bytes(td)	(td_length(td) - td_residue(td))
144 
145 /* -------------------------------------------------------------------------- */
146 
147 /**
148  * dbg_td - Dump the contents of the TD
149  */
150 static void dbg_td(struct c67x00_hcd *c67x00, struct c67x00_td *td, char *msg)
151 {
152 	struct device *dev = c67x00_hcd_dev(c67x00);
153 
154 	dev_dbg(dev, "### %s at 0x%04x\n", msg, td->td_addr);
155 	dev_dbg(dev, "urb:      0x%p\n", td->urb);
156 	dev_dbg(dev, "endpoint:   %4d\n", usb_pipeendpoint(td->pipe));
157 	dev_dbg(dev, "pipeout:    %4d\n", usb_pipeout(td->pipe));
158 	dev_dbg(dev, "ly_base_addr: 0x%04x\n", td_ly_base_addr(td));
159 	dev_dbg(dev, "port_length:  0x%04x\n", td_port_length(td));
160 	dev_dbg(dev, "pid_ep:         0x%02x\n", td->pid_ep);
161 	dev_dbg(dev, "dev_addr:       0x%02x\n", td->dev_addr);
162 	dev_dbg(dev, "ctrl_reg:       0x%02x\n", td->ctrl_reg);
163 	dev_dbg(dev, "status:         0x%02x\n", td->status);
164 	dev_dbg(dev, "retry_cnt:      0x%02x\n", td->retry_cnt);
165 	dev_dbg(dev, "residue:        0x%02x\n", td->residue);
166 	dev_dbg(dev, "next_td_addr: 0x%04x\n", td_next_td_addr(td));
167 	dev_dbg(dev, "data: %*ph\n", td_length(td), td->data);
168 }
169 
170 /* -------------------------------------------------------------------------- */
171 /* Helper functions */
172 
173 static inline u16 c67x00_get_current_frame_number(struct c67x00_hcd *c67x00)
174 {
175 	return c67x00_ll_husb_get_frame(c67x00->sie) & HOST_FRAME_MASK;
176 }
177 
178 /**
179  * frame_add
180  * Software wraparound for framenumbers.
181  */
182 static inline u16 frame_add(u16 a, u16 b)
183 {
184 	return (a + b) & HOST_FRAME_MASK;
185 }
186 
187 /**
188  * frame_after - is frame a after frame b
189  */
190 static inline int frame_after(u16 a, u16 b)
191 {
192 	return ((HOST_FRAME_MASK + a - b) & HOST_FRAME_MASK) <
193 	    (HOST_FRAME_MASK / 2);
194 }
195 
196 /**
197  * frame_after_eq - is frame a after or equal to frame b
198  */
199 static inline int frame_after_eq(u16 a, u16 b)
200 {
201 	return ((HOST_FRAME_MASK + 1 + a - b) & HOST_FRAME_MASK) <
202 	    (HOST_FRAME_MASK / 2);
203 }
204 
205 /* -------------------------------------------------------------------------- */
206 
207 /**
208  * c67x00_release_urb - remove link from all tds to this urb
209  * Disconnects the urb from it's tds, so that it can be given back.
210  * pre: urb->hcpriv != NULL
211  */
212 static void c67x00_release_urb(struct c67x00_hcd *c67x00, struct urb *urb)
213 {
214 	struct c67x00_td *td;
215 	struct c67x00_urb_priv *urbp;
216 
217 	BUG_ON(!urb);
218 
219 	c67x00->urb_count--;
220 
221 	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
222 		c67x00->urb_iso_count--;
223 		if (c67x00->urb_iso_count == 0)
224 			c67x00->max_frame_bw = MAX_FRAME_BW_STD;
225 	}
226 
227 	/* TODO this might be not so efficient when we've got many urbs!
228 	 * Alternatives:
229 	 *   * only clear when needed
230 	 *   * keep a list of tds with each urbp
231 	 */
232 	list_for_each_entry(td, &c67x00->td_list, td_list)
233 		if (urb == td->urb)
234 			td->urb = NULL;
235 
236 	urbp = urb->hcpriv;
237 	urb->hcpriv = NULL;
238 	list_del(&urbp->hep_node);
239 	kfree(urbp);
240 }
241 
242 /* -------------------------------------------------------------------------- */
243 
244 static struct c67x00_ep_data *
245 c67x00_ep_data_alloc(struct c67x00_hcd *c67x00, struct urb *urb)
246 {
247 	struct usb_host_endpoint *hep = urb->ep;
248 	struct c67x00_ep_data *ep_data;
249 	int type;
250 
251 	c67x00->current_frame = c67x00_get_current_frame_number(c67x00);
252 
253 	/* Check if endpoint already has a c67x00_ep_data struct allocated */
254 	if (hep->hcpriv) {
255 		ep_data = hep->hcpriv;
256 		if (frame_after(c67x00->current_frame, ep_data->next_frame))
257 			ep_data->next_frame =
258 			    frame_add(c67x00->current_frame, 1);
259 		return hep->hcpriv;
260 	}
261 
262 	/* Allocate and initialize a new c67x00 endpoint data structure */
263 	ep_data = kzalloc(sizeof(*ep_data), GFP_ATOMIC);
264 	if (!ep_data)
265 		return NULL;
266 
267 	INIT_LIST_HEAD(&ep_data->queue);
268 	INIT_LIST_HEAD(&ep_data->node);
269 	ep_data->hep = hep;
270 
271 	/* hold a reference to udev as long as this endpoint lives,
272 	 * this is needed to possibly fix the data toggle */
273 	ep_data->dev = usb_get_dev(urb->dev);
274 	hep->hcpriv = ep_data;
275 
276 	/* For ISOC and INT endpoints, start ASAP: */
277 	ep_data->next_frame = frame_add(c67x00->current_frame, 1);
278 
279 	/* Add the endpoint data to one of the pipe lists; must be added
280 	   in order of endpoint address */
281 	type = usb_pipetype(urb->pipe);
282 	if (list_empty(&ep_data->node)) {
283 		list_add(&ep_data->node, &c67x00->list[type]);
284 	} else {
285 		struct c67x00_ep_data *prev;
286 
287 		list_for_each_entry(prev, &c67x00->list[type], node) {
288 			if (prev->hep->desc.bEndpointAddress >
289 			    hep->desc.bEndpointAddress) {
290 				list_add(&ep_data->node, prev->node.prev);
291 				break;
292 			}
293 		}
294 	}
295 
296 	return ep_data;
297 }
298 
299 static int c67x00_ep_data_free(struct usb_host_endpoint *hep)
300 {
301 	struct c67x00_ep_data *ep_data = hep->hcpriv;
302 
303 	if (!ep_data)
304 		return 0;
305 
306 	if (!list_empty(&ep_data->queue))
307 		return -EBUSY;
308 
309 	usb_put_dev(ep_data->dev);
310 	list_del(&ep_data->queue);
311 	list_del(&ep_data->node);
312 
313 	kfree(ep_data);
314 	hep->hcpriv = NULL;
315 
316 	return 0;
317 }
318 
319 void c67x00_endpoint_disable(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
320 {
321 	struct c67x00_hcd *c67x00 = hcd_to_c67x00_hcd(hcd);
322 	unsigned long flags;
323 
324 	if (!list_empty(&ep->urb_list))
325 		dev_warn(c67x00_hcd_dev(c67x00), "error: urb list not empty\n");
326 
327 	spin_lock_irqsave(&c67x00->lock, flags);
328 
329 	/* loop waiting for all transfers in the endpoint queue to complete */
330 	while (c67x00_ep_data_free(ep)) {
331 		/* Drop the lock so we can sleep waiting for the hardware */
332 		spin_unlock_irqrestore(&c67x00->lock, flags);
333 
334 		/* it could happen that we reinitialize this completion, while
335 		 * somebody was waiting for that completion.  The timeout and
336 		 * while loop handle such cases, but this might be improved */
337 		reinit_completion(&c67x00->endpoint_disable);
338 		c67x00_sched_kick(c67x00);
339 		wait_for_completion_timeout(&c67x00->endpoint_disable, 1 * HZ);
340 
341 		spin_lock_irqsave(&c67x00->lock, flags);
342 	}
343 
344 	spin_unlock_irqrestore(&c67x00->lock, flags);
345 }
346 
347 /* -------------------------------------------------------------------------- */
348 
349 static inline int get_root_port(struct usb_device *dev)
350 {
351 	while (dev->parent->parent)
352 		dev = dev->parent;
353 	return dev->portnum;
354 }
355 
356 int c67x00_urb_enqueue(struct usb_hcd *hcd,
357 		       struct urb *urb, gfp_t mem_flags)
358 {
359 	int ret;
360 	unsigned long flags;
361 	struct c67x00_urb_priv *urbp;
362 	struct c67x00_hcd *c67x00 = hcd_to_c67x00_hcd(hcd);
363 	int port = get_root_port(urb->dev)-1;
364 
365 	/* Allocate and initialize urb private data */
366 	urbp = kzalloc(sizeof(*urbp), mem_flags);
367 	if (!urbp) {
368 		ret = -ENOMEM;
369 		goto err_urbp;
370 	}
371 
372 	spin_lock_irqsave(&c67x00->lock, flags);
373 
374 	/* Make sure host controller is running */
375 	if (!HC_IS_RUNNING(hcd->state)) {
376 		ret = -ENODEV;
377 		goto err_not_linked;
378 	}
379 
380 	ret = usb_hcd_link_urb_to_ep(hcd, urb);
381 	if (ret)
382 		goto err_not_linked;
383 
384 	INIT_LIST_HEAD(&urbp->hep_node);
385 	urbp->urb = urb;
386 	urbp->port = port;
387 
388 	urbp->ep_data = c67x00_ep_data_alloc(c67x00, urb);
389 
390 	if (!urbp->ep_data) {
391 		ret = -ENOMEM;
392 		goto err_epdata;
393 	}
394 
395 	/* TODO claim bandwidth with usb_claim_bandwidth?
396 	 * also release it somewhere! */
397 
398 	urb->hcpriv = urbp;
399 
400 	urb->actual_length = 0;	/* Nothing received/transmitted yet */
401 
402 	switch (usb_pipetype(urb->pipe)) {
403 	case PIPE_CONTROL:
404 		urb->interval = SETUP_STAGE;
405 		break;
406 	case PIPE_INTERRUPT:
407 		break;
408 	case PIPE_BULK:
409 		break;
410 	case PIPE_ISOCHRONOUS:
411 		if (c67x00->urb_iso_count == 0)
412 			c67x00->max_frame_bw = MAX_FRAME_BW_ISO;
413 		c67x00->urb_iso_count++;
414 		/* Assume always URB_ISO_ASAP, FIXME */
415 		if (list_empty(&urbp->ep_data->queue))
416 			urb->start_frame = urbp->ep_data->next_frame;
417 		else {
418 			/* Go right after the last one */
419 			struct urb *last_urb;
420 
421 			last_urb = list_entry(urbp->ep_data->queue.prev,
422 					      struct c67x00_urb_priv,
423 					      hep_node)->urb;
424 			urb->start_frame =
425 			    frame_add(last_urb->start_frame,
426 				      last_urb->number_of_packets *
427 				      last_urb->interval);
428 		}
429 		urbp->cnt = 0;
430 		break;
431 	}
432 
433 	/* Add the URB to the endpoint queue */
434 	list_add_tail(&urbp->hep_node, &urbp->ep_data->queue);
435 
436 	/* If this is the only URB, kick start the controller */
437 	if (!c67x00->urb_count++)
438 		c67x00_ll_hpi_enable_sofeop(c67x00->sie);
439 
440 	c67x00_sched_kick(c67x00);
441 	spin_unlock_irqrestore(&c67x00->lock, flags);
442 
443 	return 0;
444 
445 err_epdata:
446 	usb_hcd_unlink_urb_from_ep(hcd, urb);
447 err_not_linked:
448 	spin_unlock_irqrestore(&c67x00->lock, flags);
449 	kfree(urbp);
450 err_urbp:
451 
452 	return ret;
453 }
454 
455 int c67x00_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
456 {
457 	struct c67x00_hcd *c67x00 = hcd_to_c67x00_hcd(hcd);
458 	unsigned long flags;
459 	int rc;
460 
461 	spin_lock_irqsave(&c67x00->lock, flags);
462 	rc = usb_hcd_check_unlink_urb(hcd, urb, status);
463 	if (rc)
464 		goto done;
465 
466 	c67x00_release_urb(c67x00, urb);
467 	usb_hcd_unlink_urb_from_ep(hcd, urb);
468 
469 	spin_unlock(&c67x00->lock);
470 	usb_hcd_giveback_urb(hcd, urb, status);
471 	spin_lock(&c67x00->lock);
472 
473 	spin_unlock_irqrestore(&c67x00->lock, flags);
474 
475 	return 0;
476 
477  done:
478 	spin_unlock_irqrestore(&c67x00->lock, flags);
479 	return rc;
480 }
481 
482 /* -------------------------------------------------------------------------- */
483 
484 /*
485  * pre: c67x00 locked, urb unlocked
486  */
487 static void
488 c67x00_giveback_urb(struct c67x00_hcd *c67x00, struct urb *urb, int status)
489 {
490 	struct c67x00_urb_priv *urbp;
491 
492 	if (!urb)
493 		return;
494 
495 	urbp = urb->hcpriv;
496 	urbp->status = status;
497 
498 	list_del_init(&urbp->hep_node);
499 
500 	c67x00_release_urb(c67x00, urb);
501 	usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb);
502 	spin_unlock(&c67x00->lock);
503 	usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
504 	spin_lock(&c67x00->lock);
505 }
506 
507 /* -------------------------------------------------------------------------- */
508 
509 static int c67x00_claim_frame_bw(struct c67x00_hcd *c67x00, struct urb *urb,
510 				 int len, int periodic)
511 {
512 	struct c67x00_urb_priv *urbp = urb->hcpriv;
513 	int bit_time;
514 
515 	/* According to the C67x00 BIOS user manual, page 3-18,19, the
516 	 * following calculations provide the full speed bit times for
517 	 * a transaction.
518 	 *
519 	 * FS(in)	= 112.5 +  9.36*BC + HOST_DELAY
520 	 * FS(in,iso)	=  90.5 +  9.36*BC + HOST_DELAY
521 	 * FS(out)	= 112.5 +  9.36*BC + HOST_DELAY
522 	 * FS(out,iso)	=  78.4 +  9.36*BC + HOST_DELAY
523 	 * LS(in)	= 802.4 + 75.78*BC + HOST_DELAY
524 	 * LS(out)	= 802.6 + 74.67*BC + HOST_DELAY
525 	 *
526 	 * HOST_DELAY == 106 for the c67200 and c67300.
527 	 */
528 
529 	/* make calculations in 1/100 bit times to maintain resolution */
530 	if (urbp->ep_data->dev->speed == USB_SPEED_LOW) {
531 		/* Low speed pipe */
532 		if (usb_pipein(urb->pipe))
533 			bit_time = 80240 + 7578*len;
534 		else
535 			bit_time = 80260 + 7467*len;
536 	} else {
537 		/* FS pipes */
538 		if (usb_pipeisoc(urb->pipe))
539 			bit_time = usb_pipein(urb->pipe) ? 9050 : 7840;
540 		else
541 			bit_time = 11250;
542 		bit_time += 936*len;
543 	}
544 
545 	/* Scale back down to integer bit times.  Use a host delay of 106.
546 	 * (this is the only place it is used) */
547 	bit_time = ((bit_time+50) / 100) + 106;
548 
549 	if (unlikely(bit_time + c67x00->bandwidth_allocated >=
550 		     c67x00->max_frame_bw))
551 		return -EMSGSIZE;
552 
553 	if (unlikely(c67x00->next_td_addr + CY_TD_SIZE >=
554 		     c67x00->td_base_addr + SIE_TD_SIZE))
555 		return -EMSGSIZE;
556 
557 	if (unlikely(c67x00->next_buf_addr + len >=
558 		     c67x00->buf_base_addr + SIE_TD_BUF_SIZE))
559 		return -EMSGSIZE;
560 
561 	if (periodic) {
562 		if (unlikely(bit_time + c67x00->periodic_bw_allocated >=
563 			     MAX_PERIODIC_BW(c67x00->max_frame_bw)))
564 			return -EMSGSIZE;
565 		c67x00->periodic_bw_allocated += bit_time;
566 	}
567 
568 	c67x00->bandwidth_allocated += bit_time;
569 	return 0;
570 }
571 
572 /* -------------------------------------------------------------------------- */
573 
574 /**
575  * td_addr and buf_addr must be word aligned
576  */
577 static int c67x00_create_td(struct c67x00_hcd *c67x00, struct urb *urb,
578 			    void *data, int len, int pid, int toggle,
579 			    unsigned long privdata)
580 {
581 	struct c67x00_td *td;
582 	struct c67x00_urb_priv *urbp = urb->hcpriv;
583 	const __u8 active_flag = 1, retry_cnt = 3;
584 	__u8 cmd = 0;
585 	int tt = 0;
586 
587 	if (c67x00_claim_frame_bw(c67x00, urb, len, usb_pipeisoc(urb->pipe)
588 				  || usb_pipeint(urb->pipe)))
589 		return -EMSGSIZE;	/* Not really an error, but expected */
590 
591 	td = kzalloc(sizeof(*td), GFP_ATOMIC);
592 	if (!td)
593 		return -ENOMEM;
594 
595 	td->pipe = urb->pipe;
596 	td->ep_data = urbp->ep_data;
597 
598 	if ((td_udev(td)->speed == USB_SPEED_LOW) &&
599 	    !(c67x00->low_speed_ports & (1 << urbp->port)))
600 		cmd |= PREAMBLE_EN;
601 
602 	switch (usb_pipetype(td->pipe)) {
603 	case PIPE_ISOCHRONOUS:
604 		tt = TT_ISOCHRONOUS;
605 		cmd |= ISO_EN;
606 		break;
607 	case PIPE_CONTROL:
608 		tt = TT_CONTROL;
609 		break;
610 	case PIPE_BULK:
611 		tt = TT_BULK;
612 		break;
613 	case PIPE_INTERRUPT:
614 		tt = TT_INTERRUPT;
615 		break;
616 	}
617 
618 	if (toggle)
619 		cmd |= SEQ_SEL;
620 
621 	cmd |= ARM_EN;
622 
623 	/* SW part */
624 	td->td_addr = c67x00->next_td_addr;
625 	c67x00->next_td_addr = c67x00->next_td_addr + CY_TD_SIZE;
626 
627 	/* HW part */
628 	td->ly_base_addr = __cpu_to_le16(c67x00->next_buf_addr);
629 	td->port_length = __cpu_to_le16((c67x00->sie->sie_num << 15) |
630 					(urbp->port << 14) | (len & 0x3FF));
631 	td->pid_ep = ((pid & 0xF) << TD_PIDEP_OFFSET) |
632 	    (usb_pipeendpoint(td->pipe) & 0xF);
633 	td->dev_addr = usb_pipedevice(td->pipe) & 0x7F;
634 	td->ctrl_reg = cmd;
635 	td->status = 0;
636 	td->retry_cnt = (tt << TT_OFFSET) | (active_flag << 4) | retry_cnt;
637 	td->residue = 0;
638 	td->next_td_addr = __cpu_to_le16(c67x00->next_td_addr);
639 
640 	/* SW part */
641 	td->data = data;
642 	td->urb = urb;
643 	td->privdata = privdata;
644 
645 	c67x00->next_buf_addr += (len + 1) & ~0x01;	/* properly align */
646 
647 	list_add_tail(&td->td_list, &c67x00->td_list);
648 	return 0;
649 }
650 
651 static inline void c67x00_release_td(struct c67x00_td *td)
652 {
653 	list_del_init(&td->td_list);
654 	kfree(td);
655 }
656 
657 /* -------------------------------------------------------------------------- */
658 
659 static int c67x00_add_data_urb(struct c67x00_hcd *c67x00, struct urb *urb)
660 {
661 	int remaining;
662 	int toggle;
663 	int pid;
664 	int ret = 0;
665 	int maxps;
666 	int need_empty;
667 
668 	toggle = usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe),
669 			       usb_pipeout(urb->pipe));
670 	remaining = urb->transfer_buffer_length - urb->actual_length;
671 
672 	maxps = usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe));
673 
674 	need_empty = (urb->transfer_flags & URB_ZERO_PACKET) &&
675 	    usb_pipeout(urb->pipe) && !(remaining % maxps);
676 
677 	while (remaining || need_empty) {
678 		int len;
679 		char *td_buf;
680 
681 		len = (remaining > maxps) ? maxps : remaining;
682 		if (!len)
683 			need_empty = 0;
684 
685 		pid = usb_pipeout(urb->pipe) ? USB_PID_OUT : USB_PID_IN;
686 		td_buf = urb->transfer_buffer + urb->transfer_buffer_length -
687 		    remaining;
688 		ret = c67x00_create_td(c67x00, urb, td_buf, len, pid, toggle,
689 				       DATA_STAGE);
690 		if (ret)
691 			return ret;	/* td wasn't created */
692 
693 		toggle ^= 1;
694 		remaining -= len;
695 		if (usb_pipecontrol(urb->pipe))
696 			break;
697 	}
698 
699 	return 0;
700 }
701 
702 /**
703  * return 0 in case more bandwidth is available, else errorcode
704  */
705 static int c67x00_add_ctrl_urb(struct c67x00_hcd *c67x00, struct urb *urb)
706 {
707 	int ret;
708 	int pid;
709 
710 	switch (urb->interval) {
711 	default:
712 	case SETUP_STAGE:
713 		ret = c67x00_create_td(c67x00, urb, urb->setup_packet,
714 				       8, USB_PID_SETUP, 0, SETUP_STAGE);
715 		if (ret)
716 			return ret;
717 		urb->interval = SETUP_STAGE;
718 		usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
719 			      usb_pipeout(urb->pipe), 1);
720 		break;
721 	case DATA_STAGE:
722 		if (urb->transfer_buffer_length) {
723 			ret = c67x00_add_data_urb(c67x00, urb);
724 			if (ret)
725 				return ret;
726 			break;
727 		}		/* else fallthrough */
728 	case STATUS_STAGE:
729 		pid = !usb_pipeout(urb->pipe) ? USB_PID_OUT : USB_PID_IN;
730 		ret = c67x00_create_td(c67x00, urb, NULL, 0, pid, 1,
731 				       STATUS_STAGE);
732 		if (ret)
733 			return ret;
734 		break;
735 	}
736 
737 	return 0;
738 }
739 
740 /*
741  * return 0 in case more bandwidth is available, else errorcode
742  */
743 static int c67x00_add_int_urb(struct c67x00_hcd *c67x00, struct urb *urb)
744 {
745 	struct c67x00_urb_priv *urbp = urb->hcpriv;
746 
747 	if (frame_after_eq(c67x00->current_frame, urbp->ep_data->next_frame)) {
748 		urbp->ep_data->next_frame =
749 		    frame_add(urbp->ep_data->next_frame, urb->interval);
750 		return c67x00_add_data_urb(c67x00, urb);
751 	}
752 	return 0;
753 }
754 
755 static int c67x00_add_iso_urb(struct c67x00_hcd *c67x00, struct urb *urb)
756 {
757 	struct c67x00_urb_priv *urbp = urb->hcpriv;
758 
759 	if (frame_after_eq(c67x00->current_frame, urbp->ep_data->next_frame)) {
760 		char *td_buf;
761 		int len, pid, ret;
762 
763 		BUG_ON(urbp->cnt >= urb->number_of_packets);
764 
765 		td_buf = urb->transfer_buffer +
766 		    urb->iso_frame_desc[urbp->cnt].offset;
767 		len = urb->iso_frame_desc[urbp->cnt].length;
768 		pid = usb_pipeout(urb->pipe) ? USB_PID_OUT : USB_PID_IN;
769 
770 		ret = c67x00_create_td(c67x00, urb, td_buf, len, pid, 0,
771 				       urbp->cnt);
772 		if (ret) {
773 			dev_dbg(c67x00_hcd_dev(c67x00), "create failed: %d\n",
774 				ret);
775 			urb->iso_frame_desc[urbp->cnt].actual_length = 0;
776 			urb->iso_frame_desc[urbp->cnt].status = ret;
777 			if (urbp->cnt + 1 == urb->number_of_packets)
778 				c67x00_giveback_urb(c67x00, urb, 0);
779 		}
780 
781 		urbp->ep_data->next_frame =
782 		    frame_add(urbp->ep_data->next_frame, urb->interval);
783 		urbp->cnt++;
784 	}
785 	return 0;
786 }
787 
788 /* -------------------------------------------------------------------------- */
789 
790 static void c67x00_fill_from_list(struct c67x00_hcd *c67x00, int type,
791 				  int (*add)(struct c67x00_hcd *, struct urb *))
792 {
793 	struct c67x00_ep_data *ep_data;
794 	struct urb *urb;
795 
796 	/* traverse every endpoint on the list */
797 	list_for_each_entry(ep_data, &c67x00->list[type], node) {
798 		if (!list_empty(&ep_data->queue)) {
799 			/* and add the first urb */
800 			/* isochronous transfer rely on this */
801 			urb = list_entry(ep_data->queue.next,
802 					 struct c67x00_urb_priv,
803 					 hep_node)->urb;
804 			add(c67x00, urb);
805 		}
806 	}
807 }
808 
809 static void c67x00_fill_frame(struct c67x00_hcd *c67x00)
810 {
811 	struct c67x00_td *td, *ttd;
812 
813 	/* Check if we can proceed */
814 	if (!list_empty(&c67x00->td_list)) {
815 		dev_warn(c67x00_hcd_dev(c67x00),
816 			 "TD list not empty! This should not happen!\n");
817 		list_for_each_entry_safe(td, ttd, &c67x00->td_list, td_list) {
818 			dbg_td(c67x00, td, "Unprocessed td");
819 			c67x00_release_td(td);
820 		}
821 	}
822 
823 	/* Reinitialize variables */
824 	c67x00->bandwidth_allocated = 0;
825 	c67x00->periodic_bw_allocated = 0;
826 
827 	c67x00->next_td_addr = c67x00->td_base_addr;
828 	c67x00->next_buf_addr = c67x00->buf_base_addr;
829 
830 	/* Fill the list */
831 	c67x00_fill_from_list(c67x00, PIPE_ISOCHRONOUS, c67x00_add_iso_urb);
832 	c67x00_fill_from_list(c67x00, PIPE_INTERRUPT, c67x00_add_int_urb);
833 	c67x00_fill_from_list(c67x00, PIPE_CONTROL, c67x00_add_ctrl_urb);
834 	c67x00_fill_from_list(c67x00, PIPE_BULK, c67x00_add_data_urb);
835 }
836 
837 /* -------------------------------------------------------------------------- */
838 
839 /**
840  * Get TD from C67X00
841  */
842 static inline void
843 c67x00_parse_td(struct c67x00_hcd *c67x00, struct c67x00_td *td)
844 {
845 	c67x00_ll_read_mem_le16(c67x00->sie->dev,
846 				td->td_addr, td, CY_TD_SIZE);
847 
848 	if (usb_pipein(td->pipe) && td_actual_bytes(td))
849 		c67x00_ll_read_mem_le16(c67x00->sie->dev, td_ly_base_addr(td),
850 					td->data, td_actual_bytes(td));
851 }
852 
853 static int c67x00_td_to_error(struct c67x00_hcd *c67x00, struct c67x00_td *td)
854 {
855 	if (td->status & TD_STATUSMASK_ERR) {
856 		dbg_td(c67x00, td, "ERROR_FLAG");
857 		return -EILSEQ;
858 	}
859 	if (td->status & TD_STATUSMASK_STALL) {
860 		/* dbg_td(c67x00, td, "STALL"); */
861 		return -EPIPE;
862 	}
863 	if (td->status & TD_STATUSMASK_TMOUT) {
864 		dbg_td(c67x00, td, "TIMEOUT");
865 		return -ETIMEDOUT;
866 	}
867 
868 	return 0;
869 }
870 
871 static inline int c67x00_end_of_data(struct c67x00_td *td)
872 {
873 	int maxps, need_empty, remaining;
874 	struct urb *urb = td->urb;
875 	int act_bytes;
876 
877 	act_bytes = td_actual_bytes(td);
878 
879 	if (unlikely(!act_bytes))
880 		return 1;	/* This was an empty packet */
881 
882 	maxps = usb_maxpacket(td_udev(td), td->pipe, usb_pipeout(td->pipe));
883 
884 	if (unlikely(act_bytes < maxps))
885 		return 1;	/* Smaller then full packet */
886 
887 	remaining = urb->transfer_buffer_length - urb->actual_length;
888 	need_empty = (urb->transfer_flags & URB_ZERO_PACKET) &&
889 	    usb_pipeout(urb->pipe) && !(remaining % maxps);
890 
891 	if (unlikely(!remaining && !need_empty))
892 		return 1;
893 
894 	return 0;
895 }
896 
897 /* -------------------------------------------------------------------------- */
898 
899 /* Remove all td's from the list which come
900  * after last_td and are meant for the same pipe.
901  * This is used when a short packet has occurred */
902 static inline void c67x00_clear_pipe(struct c67x00_hcd *c67x00,
903 				     struct c67x00_td *last_td)
904 {
905 	struct c67x00_td *td, *tmp;
906 	td = last_td;
907 	tmp = last_td;
908 	while (td->td_list.next != &c67x00->td_list) {
909 		td = list_entry(td->td_list.next, struct c67x00_td, td_list);
910 		if (td->pipe == last_td->pipe) {
911 			c67x00_release_td(td);
912 			td = tmp;
913 		}
914 		tmp = td;
915 	}
916 }
917 
918 /* -------------------------------------------------------------------------- */
919 
920 static void c67x00_handle_successful_td(struct c67x00_hcd *c67x00,
921 					struct c67x00_td *td)
922 {
923 	struct urb *urb = td->urb;
924 
925 	if (!urb)
926 		return;
927 
928 	urb->actual_length += td_actual_bytes(td);
929 
930 	switch (usb_pipetype(td->pipe)) {
931 		/* isochronous tds are handled separately */
932 	case PIPE_CONTROL:
933 		switch (td->privdata) {
934 		case SETUP_STAGE:
935 			urb->interval =
936 			    urb->transfer_buffer_length ?
937 			    DATA_STAGE : STATUS_STAGE;
938 			/* Don't count setup_packet with normal data: */
939 			urb->actual_length = 0;
940 			break;
941 
942 		case DATA_STAGE:
943 			if (c67x00_end_of_data(td)) {
944 				urb->interval = STATUS_STAGE;
945 				c67x00_clear_pipe(c67x00, td);
946 			}
947 			break;
948 
949 		case STATUS_STAGE:
950 			urb->interval = 0;
951 			c67x00_giveback_urb(c67x00, urb, 0);
952 			break;
953 		}
954 		break;
955 
956 	case PIPE_INTERRUPT:
957 	case PIPE_BULK:
958 		if (unlikely(c67x00_end_of_data(td))) {
959 			c67x00_clear_pipe(c67x00, td);
960 			c67x00_giveback_urb(c67x00, urb, 0);
961 		}
962 		break;
963 	}
964 }
965 
966 static void c67x00_handle_isoc(struct c67x00_hcd *c67x00, struct c67x00_td *td)
967 {
968 	struct urb *urb = td->urb;
969 	struct c67x00_urb_priv *urbp;
970 	int cnt;
971 
972 	if (!urb)
973 		return;
974 
975 	urbp = urb->hcpriv;
976 	cnt = td->privdata;
977 
978 	if (td->status & TD_ERROR_MASK)
979 		urb->error_count++;
980 
981 	urb->iso_frame_desc[cnt].actual_length = td_actual_bytes(td);
982 	urb->iso_frame_desc[cnt].status = c67x00_td_to_error(c67x00, td);
983 	if (cnt + 1 == urb->number_of_packets)	/* Last packet */
984 		c67x00_giveback_urb(c67x00, urb, 0);
985 }
986 
987 /* -------------------------------------------------------------------------- */
988 
989 /**
990  * c67x00_check_td_list - handle tds which have been processed by the c67x00
991  * pre: current_td == 0
992  */
993 static inline void c67x00_check_td_list(struct c67x00_hcd *c67x00)
994 {
995 	struct c67x00_td *td, *tmp;
996 	struct urb *urb;
997 	int ack_ok;
998 	int clear_endpoint;
999 
1000 	list_for_each_entry_safe(td, tmp, &c67x00->td_list, td_list) {
1001 		/* get the TD */
1002 		c67x00_parse_td(c67x00, td);
1003 		urb = td->urb;	/* urb can be NULL! */
1004 		ack_ok = 0;
1005 		clear_endpoint = 1;
1006 
1007 		/* Handle isochronous transfers separately */
1008 		if (usb_pipeisoc(td->pipe)) {
1009 			clear_endpoint = 0;
1010 			c67x00_handle_isoc(c67x00, td);
1011 			goto cont;
1012 		}
1013 
1014 		/* When an error occurs, all td's for that pipe go into an
1015 		 * inactive state. This state matches successful transfers so
1016 		 * we must make sure not to service them. */
1017 		if (td->status & TD_ERROR_MASK) {
1018 			c67x00_giveback_urb(c67x00, urb,
1019 					    c67x00_td_to_error(c67x00, td));
1020 			goto cont;
1021 		}
1022 
1023 		if ((td->status & TD_STATUSMASK_NAK) || !td_sequence_ok(td) ||
1024 		    !td_acked(td))
1025 			goto cont;
1026 
1027 		/* Sequence ok and acked, don't need to fix toggle */
1028 		ack_ok = 1;
1029 
1030 		if (unlikely(td->status & TD_STATUSMASK_OVF)) {
1031 			if (td_residue(td) & TD_RESIDUE_OVERFLOW) {
1032 				/* Overflow */
1033 				c67x00_giveback_urb(c67x00, urb, -EOVERFLOW);
1034 				goto cont;
1035 			}
1036 		}
1037 
1038 		clear_endpoint = 0;
1039 		c67x00_handle_successful_td(c67x00, td);
1040 
1041 cont:
1042 		if (clear_endpoint)
1043 			c67x00_clear_pipe(c67x00, td);
1044 		if (ack_ok)
1045 			usb_settoggle(td_udev(td), usb_pipeendpoint(td->pipe),
1046 				      usb_pipeout(td->pipe),
1047 				      !(td->ctrl_reg & SEQ_SEL));
1048 		/* next in list could have been removed, due to clear_pipe! */
1049 		tmp = list_entry(td->td_list.next, typeof(*td), td_list);
1050 		c67x00_release_td(td);
1051 	}
1052 }
1053 
1054 /* -------------------------------------------------------------------------- */
1055 
1056 static inline int c67x00_all_tds_processed(struct c67x00_hcd *c67x00)
1057 {
1058 	/* If all tds are processed, we can check the previous frame (if
1059 	 * there was any) and start our next frame.
1060 	 */
1061 	return !c67x00_ll_husb_get_current_td(c67x00->sie);
1062 }
1063 
1064 /**
1065  * Send td to C67X00
1066  */
1067 static void c67x00_send_td(struct c67x00_hcd *c67x00, struct c67x00_td *td)
1068 {
1069 	int len = td_length(td);
1070 
1071 	if (len && ((td->pid_ep & TD_PIDEPMASK_PID) != TD_PID_IN))
1072 		c67x00_ll_write_mem_le16(c67x00->sie->dev, td_ly_base_addr(td),
1073 					 td->data, len);
1074 
1075 	c67x00_ll_write_mem_le16(c67x00->sie->dev,
1076 				 td->td_addr, td, CY_TD_SIZE);
1077 }
1078 
1079 static void c67x00_send_frame(struct c67x00_hcd *c67x00)
1080 {
1081 	struct c67x00_td *td;
1082 
1083 	if (list_empty(&c67x00->td_list))
1084 		dev_warn(c67x00_hcd_dev(c67x00),
1085 			 "%s: td list should not be empty here!\n",
1086 			 __func__);
1087 
1088 	list_for_each_entry(td, &c67x00->td_list, td_list) {
1089 		if (td->td_list.next == &c67x00->td_list)
1090 			td->next_td_addr = 0;	/* Last td in list */
1091 
1092 		c67x00_send_td(c67x00, td);
1093 	}
1094 
1095 	c67x00_ll_husb_set_current_td(c67x00->sie, c67x00->td_base_addr);
1096 }
1097 
1098 /* -------------------------------------------------------------------------- */
1099 
1100 /**
1101  * c67x00_do_work - Schedulers state machine
1102  */
1103 static void c67x00_do_work(struct c67x00_hcd *c67x00)
1104 {
1105 	spin_lock(&c67x00->lock);
1106 	/* Make sure all tds are processed */
1107 	if (!c67x00_all_tds_processed(c67x00))
1108 		goto out;
1109 
1110 	c67x00_check_td_list(c67x00);
1111 
1112 	/* no td's are being processed (current == 0)
1113 	 * and all have been "checked" */
1114 	complete(&c67x00->endpoint_disable);
1115 
1116 	if (!list_empty(&c67x00->td_list))
1117 		goto out;
1118 
1119 	c67x00->current_frame = c67x00_get_current_frame_number(c67x00);
1120 	if (c67x00->current_frame == c67x00->last_frame)
1121 		goto out;	/* Don't send tds in same frame */
1122 	c67x00->last_frame = c67x00->current_frame;
1123 
1124 	/* If no urbs are scheduled, our work is done */
1125 	if (!c67x00->urb_count) {
1126 		c67x00_ll_hpi_disable_sofeop(c67x00->sie);
1127 		goto out;
1128 	}
1129 
1130 	c67x00_fill_frame(c67x00);
1131 	if (!list_empty(&c67x00->td_list))
1132 		/* TD's have been added to the frame */
1133 		c67x00_send_frame(c67x00);
1134 
1135  out:
1136 	spin_unlock(&c67x00->lock);
1137 }
1138 
1139 /* -------------------------------------------------------------------------- */
1140 
1141 static void c67x00_sched_tasklet(unsigned long __c67x00)
1142 {
1143 	struct c67x00_hcd *c67x00 = (struct c67x00_hcd *)__c67x00;
1144 	c67x00_do_work(c67x00);
1145 }
1146 
1147 void c67x00_sched_kick(struct c67x00_hcd *c67x00)
1148 {
1149 	tasklet_hi_schedule(&c67x00->tasklet);
1150 }
1151 
1152 int c67x00_sched_start_scheduler(struct c67x00_hcd *c67x00)
1153 {
1154 	tasklet_init(&c67x00->tasklet, c67x00_sched_tasklet,
1155 		     (unsigned long)c67x00);
1156 	return 0;
1157 }
1158 
1159 void c67x00_sched_stop_scheduler(struct c67x00_hcd *c67x00)
1160 {
1161 	tasklet_kill(&c67x00->tasklet);
1162 }
1163