1 /*
2  * c67x00-sched.c: Cypress C67X00 USB Host Controller Driver - TD scheduling
3  *
4  * Copyright (C) 2006-2008 Barco N.V.
5  *    Derived from the Cypress cy7c67200/300 ezusb linux driver and
6  *    based on multiple host controller drivers inside the linux kernel.
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License as published by
10  * the Free Software Foundation; either version 2 of the License, or
11  * (at your option) any later version.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, write to the Free Software
20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
21  * MA  02110-1301  USA.
22  */
23 
24 #include <linux/kthread.h>
25 #include <linux/slab.h>
26 
27 #include "c67x00.h"
28 #include "c67x00-hcd.h"
29 
30 /*
31  * These are the stages for a control urb, they are kept
32  * in both urb->interval and td->privdata.
33  */
34 #define SETUP_STAGE		0
35 #define DATA_STAGE		1
36 #define STATUS_STAGE		2
37 
38 /* -------------------------------------------------------------------------- */
39 
40 /**
41  * struct c67x00_ep_data: Host endpoint data structure
42  */
43 struct c67x00_ep_data {
44 	struct list_head queue;
45 	struct list_head node;
46 	struct usb_host_endpoint *hep;
47 	struct usb_device *dev;
48 	u16 next_frame;		/* For int/isoc transactions */
49 };
50 
51 /**
52  * struct c67x00_td
53  *
54  * Hardware parts are little endiannes, SW in CPU endianess.
55  */
56 struct c67x00_td {
57 	/* HW specific part */
58 	__le16 ly_base_addr;	/* Bytes 0-1 */
59 	__le16 port_length;	/* Bytes 2-3 */
60 	u8 pid_ep;		/* Byte 4 */
61 	u8 dev_addr;		/* Byte 5 */
62 	u8 ctrl_reg;		/* Byte 6 */
63 	u8 status;		/* Byte 7 */
64 	u8 retry_cnt;		/* Byte 8 */
65 #define TT_OFFSET		2
66 #define TT_CONTROL		0
67 #define TT_ISOCHRONOUS		1
68 #define TT_BULK			2
69 #define TT_INTERRUPT		3
70 	u8 residue;		/* Byte 9 */
71 	__le16 next_td_addr;	/* Bytes 10-11 */
72 	/* SW part */
73 	struct list_head td_list;
74 	u16 td_addr;
75 	void *data;
76 	struct urb *urb;
77 	unsigned long privdata;
78 
79 	/* These are needed for handling the toggle bits:
80 	 * an urb can be dequeued while a td is in progress
81 	 * after checking the td, the toggle bit might need to
82 	 * be fixed */
83 	struct c67x00_ep_data *ep_data;
84 	unsigned int pipe;
85 };
86 
87 struct c67x00_urb_priv {
88 	struct list_head hep_node;
89 	struct urb *urb;
90 	int port;
91 	int cnt;		/* packet number for isoc */
92 	int status;
93 	struct c67x00_ep_data *ep_data;
94 };
95 
96 #define td_udev(td)	((td)->ep_data->dev)
97 
98 #define CY_TD_SIZE		12
99 
100 #define TD_PIDEP_OFFSET		0x04
101 #define TD_PIDEPMASK_PID	0xF0
102 #define TD_PIDEPMASK_EP		0x0F
103 #define TD_PORTLENMASK_DL	0x03FF
104 #define TD_PORTLENMASK_PN	0xC000
105 
106 #define TD_STATUS_OFFSET	0x07
107 #define TD_STATUSMASK_ACK	0x01
108 #define TD_STATUSMASK_ERR	0x02
109 #define TD_STATUSMASK_TMOUT	0x04
110 #define TD_STATUSMASK_SEQ	0x08
111 #define TD_STATUSMASK_SETUP	0x10
112 #define TD_STATUSMASK_OVF	0x20
113 #define TD_STATUSMASK_NAK	0x40
114 #define TD_STATUSMASK_STALL	0x80
115 
116 #define TD_ERROR_MASK		(TD_STATUSMASK_ERR | TD_STATUSMASK_TMOUT | \
117 				 TD_STATUSMASK_STALL)
118 
119 #define TD_RETRYCNT_OFFSET	0x08
120 #define TD_RETRYCNTMASK_ACT_FLG	0x10
121 #define TD_RETRYCNTMASK_TX_TYPE	0x0C
122 #define TD_RETRYCNTMASK_RTY_CNT	0x03
123 
124 #define TD_RESIDUE_OVERFLOW	0x80
125 
126 #define TD_PID_IN		0x90
127 
128 /* Residue: signed 8bits, neg -> OVERFLOW, pos -> UNDERFLOW */
129 #define td_residue(td)		((__s8)(td->residue))
130 #define td_ly_base_addr(td)	(__le16_to_cpu((td)->ly_base_addr))
131 #define td_port_length(td)	(__le16_to_cpu((td)->port_length))
132 #define td_next_td_addr(td)	(__le16_to_cpu((td)->next_td_addr))
133 
134 #define td_active(td)		((td)->retry_cnt & TD_RETRYCNTMASK_ACT_FLG)
135 #define td_length(td)		(td_port_length(td) & TD_PORTLENMASK_DL)
136 
137 #define td_sequence_ok(td)	(!td->status || \
138 				 (!(td->status & TD_STATUSMASK_SEQ) ==	\
139 				  !(td->ctrl_reg & SEQ_SEL)))
140 
141 #define td_acked(td)		(!td->status || \
142 				 (td->status & TD_STATUSMASK_ACK))
143 #define td_actual_bytes(td)	(td_length(td) - td_residue(td))
144 
145 /* -------------------------------------------------------------------------- */
146 
147 #ifdef DEBUG
148 
149 /**
150  * dbg_td - Dump the contents of the TD
151  */
152 static void dbg_td(struct c67x00_hcd *c67x00, struct c67x00_td *td, char *msg)
153 {
154 	struct device *dev = c67x00_hcd_dev(c67x00);
155 
156 	dev_dbg(dev, "### %s at 0x%04x\n", msg, td->td_addr);
157 	dev_dbg(dev, "urb:      0x%p\n", td->urb);
158 	dev_dbg(dev, "endpoint:   %4d\n", usb_pipeendpoint(td->pipe));
159 	dev_dbg(dev, "pipeout:    %4d\n", usb_pipeout(td->pipe));
160 	dev_dbg(dev, "ly_base_addr: 0x%04x\n", td_ly_base_addr(td));
161 	dev_dbg(dev, "port_length:  0x%04x\n", td_port_length(td));
162 	dev_dbg(dev, "pid_ep:         0x%02x\n", td->pid_ep);
163 	dev_dbg(dev, "dev_addr:       0x%02x\n", td->dev_addr);
164 	dev_dbg(dev, "ctrl_reg:       0x%02x\n", td->ctrl_reg);
165 	dev_dbg(dev, "status:         0x%02x\n", td->status);
166 	dev_dbg(dev, "retry_cnt:      0x%02x\n", td->retry_cnt);
167 	dev_dbg(dev, "residue:        0x%02x\n", td->residue);
168 	dev_dbg(dev, "next_td_addr: 0x%04x\n", td_next_td_addr(td));
169 	dev_dbg(dev, "data:");
170 	print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 16, 1,
171 		       td->data, td_length(td), 1);
172 }
173 #else				/* DEBUG */
174 
175 static inline void
176 dbg_td(struct c67x00_hcd *c67x00, struct c67x00_td *td, char *msg) { }
177 
178 #endif				/* DEBUG */
179 
180 /* -------------------------------------------------------------------------- */
181 /* Helper functions */
182 
183 static inline u16 c67x00_get_current_frame_number(struct c67x00_hcd *c67x00)
184 {
185 	return c67x00_ll_husb_get_frame(c67x00->sie) & HOST_FRAME_MASK;
186 }
187 
188 /**
189  * frame_add
190  * Software wraparound for framenumbers.
191  */
192 static inline u16 frame_add(u16 a, u16 b)
193 {
194 	return (a + b) & HOST_FRAME_MASK;
195 }
196 
197 /**
198  * frame_after - is frame a after frame b
199  */
200 static inline int frame_after(u16 a, u16 b)
201 {
202 	return ((HOST_FRAME_MASK + a - b) & HOST_FRAME_MASK) <
203 	    (HOST_FRAME_MASK / 2);
204 }
205 
206 /**
207  * frame_after_eq - is frame a after or equal to frame b
208  */
209 static inline int frame_after_eq(u16 a, u16 b)
210 {
211 	return ((HOST_FRAME_MASK + 1 + a - b) & HOST_FRAME_MASK) <
212 	    (HOST_FRAME_MASK / 2);
213 }
214 
215 /* -------------------------------------------------------------------------- */
216 
217 /**
218  * c67x00_release_urb - remove link from all tds to this urb
219  * Disconnects the urb from it's tds, so that it can be given back.
220  * pre: urb->hcpriv != NULL
221  */
222 static void c67x00_release_urb(struct c67x00_hcd *c67x00, struct urb *urb)
223 {
224 	struct c67x00_td *td;
225 	struct c67x00_urb_priv *urbp;
226 
227 	BUG_ON(!urb);
228 
229 	c67x00->urb_count--;
230 
231 	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
232 		c67x00->urb_iso_count--;
233 		if (c67x00->urb_iso_count == 0)
234 			c67x00->max_frame_bw = MAX_FRAME_BW_STD;
235 	}
236 
237 	/* TODO this might be not so efficient when we've got many urbs!
238 	 * Alternatives:
239 	 *   * only clear when needed
240 	 *   * keep a list of tds with each urbp
241 	 */
242 	list_for_each_entry(td, &c67x00->td_list, td_list)
243 		if (urb == td->urb)
244 			td->urb = NULL;
245 
246 	urbp = urb->hcpriv;
247 	urb->hcpriv = NULL;
248 	list_del(&urbp->hep_node);
249 	kfree(urbp);
250 }
251 
252 /* -------------------------------------------------------------------------- */
253 
254 static struct c67x00_ep_data *
255 c67x00_ep_data_alloc(struct c67x00_hcd *c67x00, struct urb *urb)
256 {
257 	struct usb_host_endpoint *hep = urb->ep;
258 	struct c67x00_ep_data *ep_data;
259 	int type;
260 
261 	c67x00->current_frame = c67x00_get_current_frame_number(c67x00);
262 
263 	/* Check if endpoint already has a c67x00_ep_data struct allocated */
264 	if (hep->hcpriv) {
265 		ep_data = hep->hcpriv;
266 		if (frame_after(c67x00->current_frame, ep_data->next_frame))
267 			ep_data->next_frame =
268 			    frame_add(c67x00->current_frame, 1);
269 		return hep->hcpriv;
270 	}
271 
272 	/* Allocate and initialize a new c67x00 endpoint data structure */
273 	ep_data = kzalloc(sizeof(*ep_data), GFP_ATOMIC);
274 	if (!ep_data)
275 		return NULL;
276 
277 	INIT_LIST_HEAD(&ep_data->queue);
278 	INIT_LIST_HEAD(&ep_data->node);
279 	ep_data->hep = hep;
280 
281 	/* hold a reference to udev as long as this endpoint lives,
282 	 * this is needed to possibly fix the data toggle */
283 	ep_data->dev = usb_get_dev(urb->dev);
284 	hep->hcpriv = ep_data;
285 
286 	/* For ISOC and INT endpoints, start ASAP: */
287 	ep_data->next_frame = frame_add(c67x00->current_frame, 1);
288 
289 	/* Add the endpoint data to one of the pipe lists; must be added
290 	   in order of endpoint address */
291 	type = usb_pipetype(urb->pipe);
292 	if (list_empty(&ep_data->node)) {
293 		list_add(&ep_data->node, &c67x00->list[type]);
294 	} else {
295 		struct c67x00_ep_data *prev;
296 
297 		list_for_each_entry(prev, &c67x00->list[type], node) {
298 			if (prev->hep->desc.bEndpointAddress >
299 			    hep->desc.bEndpointAddress) {
300 				list_add(&ep_data->node, prev->node.prev);
301 				break;
302 			}
303 		}
304 	}
305 
306 	return ep_data;
307 }
308 
309 static int c67x00_ep_data_free(struct usb_host_endpoint *hep)
310 {
311 	struct c67x00_ep_data *ep_data = hep->hcpriv;
312 
313 	if (!ep_data)
314 		return 0;
315 
316 	if (!list_empty(&ep_data->queue))
317 		return -EBUSY;
318 
319 	usb_put_dev(ep_data->dev);
320 	list_del(&ep_data->queue);
321 	list_del(&ep_data->node);
322 
323 	kfree(ep_data);
324 	hep->hcpriv = NULL;
325 
326 	return 0;
327 }
328 
329 void c67x00_endpoint_disable(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
330 {
331 	struct c67x00_hcd *c67x00 = hcd_to_c67x00_hcd(hcd);
332 	unsigned long flags;
333 
334 	if (!list_empty(&ep->urb_list))
335 		dev_warn(c67x00_hcd_dev(c67x00), "error: urb list not empty\n");
336 
337 	spin_lock_irqsave(&c67x00->lock, flags);
338 
339 	/* loop waiting for all transfers in the endpoint queue to complete */
340 	while (c67x00_ep_data_free(ep)) {
341 		/* Drop the lock so we can sleep waiting for the hardware */
342 		spin_unlock_irqrestore(&c67x00->lock, flags);
343 
344 		/* it could happen that we reinitialize this completion, while
345 		 * somebody was waiting for that completion.  The timeout and
346 		 * while loop handle such cases, but this might be improved */
347 		reinit_completion(&c67x00->endpoint_disable);
348 		c67x00_sched_kick(c67x00);
349 		wait_for_completion_timeout(&c67x00->endpoint_disable, 1 * HZ);
350 
351 		spin_lock_irqsave(&c67x00->lock, flags);
352 	}
353 
354 	spin_unlock_irqrestore(&c67x00->lock, flags);
355 }
356 
357 /* -------------------------------------------------------------------------- */
358 
359 static inline int get_root_port(struct usb_device *dev)
360 {
361 	while (dev->parent->parent)
362 		dev = dev->parent;
363 	return dev->portnum;
364 }
365 
366 int c67x00_urb_enqueue(struct usb_hcd *hcd,
367 		       struct urb *urb, gfp_t mem_flags)
368 {
369 	int ret;
370 	unsigned long flags;
371 	struct c67x00_urb_priv *urbp;
372 	struct c67x00_hcd *c67x00 = hcd_to_c67x00_hcd(hcd);
373 	int port = get_root_port(urb->dev)-1;
374 
375 	spin_lock_irqsave(&c67x00->lock, flags);
376 
377 	/* Make sure host controller is running */
378 	if (!HC_IS_RUNNING(hcd->state)) {
379 		ret = -ENODEV;
380 		goto err_not_linked;
381 	}
382 
383 	ret = usb_hcd_link_urb_to_ep(hcd, urb);
384 	if (ret)
385 		goto err_not_linked;
386 
387 	/* Allocate and initialize urb private data */
388 	urbp = kzalloc(sizeof(*urbp), mem_flags);
389 	if (!urbp) {
390 		ret = -ENOMEM;
391 		goto err_urbp;
392 	}
393 
394 	INIT_LIST_HEAD(&urbp->hep_node);
395 	urbp->urb = urb;
396 	urbp->port = port;
397 
398 	urbp->ep_data = c67x00_ep_data_alloc(c67x00, urb);
399 
400 	if (!urbp->ep_data) {
401 		ret = -ENOMEM;
402 		goto err_epdata;
403 	}
404 
405 	/* TODO claim bandwidth with usb_claim_bandwidth?
406 	 * also release it somewhere! */
407 
408 	urb->hcpriv = urbp;
409 
410 	urb->actual_length = 0;	/* Nothing received/transmitted yet */
411 
412 	switch (usb_pipetype(urb->pipe)) {
413 	case PIPE_CONTROL:
414 		urb->interval = SETUP_STAGE;
415 		break;
416 	case PIPE_INTERRUPT:
417 		break;
418 	case PIPE_BULK:
419 		break;
420 	case PIPE_ISOCHRONOUS:
421 		if (c67x00->urb_iso_count == 0)
422 			c67x00->max_frame_bw = MAX_FRAME_BW_ISO;
423 		c67x00->urb_iso_count++;
424 		/* Assume always URB_ISO_ASAP, FIXME */
425 		if (list_empty(&urbp->ep_data->queue))
426 			urb->start_frame = urbp->ep_data->next_frame;
427 		else {
428 			/* Go right after the last one */
429 			struct urb *last_urb;
430 
431 			last_urb = list_entry(urbp->ep_data->queue.prev,
432 					      struct c67x00_urb_priv,
433 					      hep_node)->urb;
434 			urb->start_frame =
435 			    frame_add(last_urb->start_frame,
436 				      last_urb->number_of_packets *
437 				      last_urb->interval);
438 		}
439 		urbp->cnt = 0;
440 		break;
441 	}
442 
443 	/* Add the URB to the endpoint queue */
444 	list_add_tail(&urbp->hep_node, &urbp->ep_data->queue);
445 
446 	/* If this is the only URB, kick start the controller */
447 	if (!c67x00->urb_count++)
448 		c67x00_ll_hpi_enable_sofeop(c67x00->sie);
449 
450 	c67x00_sched_kick(c67x00);
451 	spin_unlock_irqrestore(&c67x00->lock, flags);
452 
453 	return 0;
454 
455 err_epdata:
456 	kfree(urbp);
457 err_urbp:
458 	usb_hcd_unlink_urb_from_ep(hcd, urb);
459 err_not_linked:
460 	spin_unlock_irqrestore(&c67x00->lock, flags);
461 
462 	return ret;
463 }
464 
465 int c67x00_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
466 {
467 	struct c67x00_hcd *c67x00 = hcd_to_c67x00_hcd(hcd);
468 	unsigned long flags;
469 	int rc;
470 
471 	spin_lock_irqsave(&c67x00->lock, flags);
472 	rc = usb_hcd_check_unlink_urb(hcd, urb, status);
473 	if (rc)
474 		goto done;
475 
476 	c67x00_release_urb(c67x00, urb);
477 	usb_hcd_unlink_urb_from_ep(hcd, urb);
478 
479 	spin_unlock(&c67x00->lock);
480 	usb_hcd_giveback_urb(hcd, urb, status);
481 	spin_lock(&c67x00->lock);
482 
483 	spin_unlock_irqrestore(&c67x00->lock, flags);
484 
485 	return 0;
486 
487  done:
488 	spin_unlock_irqrestore(&c67x00->lock, flags);
489 	return rc;
490 }
491 
492 /* -------------------------------------------------------------------------- */
493 
494 /*
495  * pre: c67x00 locked, urb unlocked
496  */
497 static void
498 c67x00_giveback_urb(struct c67x00_hcd *c67x00, struct urb *urb, int status)
499 {
500 	struct c67x00_urb_priv *urbp;
501 
502 	if (!urb)
503 		return;
504 
505 	urbp = urb->hcpriv;
506 	urbp->status = status;
507 
508 	list_del_init(&urbp->hep_node);
509 
510 	c67x00_release_urb(c67x00, urb);
511 	usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb);
512 	spin_unlock(&c67x00->lock);
513 	usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
514 	spin_lock(&c67x00->lock);
515 }
516 
517 /* -------------------------------------------------------------------------- */
518 
519 static int c67x00_claim_frame_bw(struct c67x00_hcd *c67x00, struct urb *urb,
520 				 int len, int periodic)
521 {
522 	struct c67x00_urb_priv *urbp = urb->hcpriv;
523 	int bit_time;
524 
525 	/* According to the C67x00 BIOS user manual, page 3-18,19, the
526 	 * following calculations provide the full speed bit times for
527 	 * a transaction.
528 	 *
529 	 * FS(in)	= 112.5 +  9.36*BC + HOST_DELAY
530 	 * FS(in,iso)	=  90.5 +  9.36*BC + HOST_DELAY
531 	 * FS(out)	= 112.5 +  9.36*BC + HOST_DELAY
532 	 * FS(out,iso)	=  78.4 +  9.36*BC + HOST_DELAY
533 	 * LS(in)	= 802.4 + 75.78*BC + HOST_DELAY
534 	 * LS(out)	= 802.6 + 74.67*BC + HOST_DELAY
535 	 *
536 	 * HOST_DELAY == 106 for the c67200 and c67300.
537 	 */
538 
539 	/* make calculations in 1/100 bit times to maintain resolution */
540 	if (urbp->ep_data->dev->speed == USB_SPEED_LOW) {
541 		/* Low speed pipe */
542 		if (usb_pipein(urb->pipe))
543 			bit_time = 80240 + 7578*len;
544 		else
545 			bit_time = 80260 + 7467*len;
546 	} else {
547 		/* FS pipes */
548 		if (usb_pipeisoc(urb->pipe))
549 			bit_time = usb_pipein(urb->pipe) ? 9050 : 7840;
550 		else
551 			bit_time = 11250;
552 		bit_time += 936*len;
553 	}
554 
555 	/* Scale back down to integer bit times.  Use a host delay of 106.
556 	 * (this is the only place it is used) */
557 	bit_time = ((bit_time+50) / 100) + 106;
558 
559 	if (unlikely(bit_time + c67x00->bandwidth_allocated >=
560 		     c67x00->max_frame_bw))
561 		return -EMSGSIZE;
562 
563 	if (unlikely(c67x00->next_td_addr + CY_TD_SIZE >=
564 		     c67x00->td_base_addr + SIE_TD_SIZE))
565 		return -EMSGSIZE;
566 
567 	if (unlikely(c67x00->next_buf_addr + len >=
568 		     c67x00->buf_base_addr + SIE_TD_BUF_SIZE))
569 		return -EMSGSIZE;
570 
571 	if (periodic) {
572 		if (unlikely(bit_time + c67x00->periodic_bw_allocated >=
573 			     MAX_PERIODIC_BW(c67x00->max_frame_bw)))
574 			return -EMSGSIZE;
575 		c67x00->periodic_bw_allocated += bit_time;
576 	}
577 
578 	c67x00->bandwidth_allocated += bit_time;
579 	return 0;
580 }
581 
582 /* -------------------------------------------------------------------------- */
583 
584 /**
585  * td_addr and buf_addr must be word aligned
586  */
587 static int c67x00_create_td(struct c67x00_hcd *c67x00, struct urb *urb,
588 			    void *data, int len, int pid, int toggle,
589 			    unsigned long privdata)
590 {
591 	struct c67x00_td *td;
592 	struct c67x00_urb_priv *urbp = urb->hcpriv;
593 	const __u8 active_flag = 1, retry_cnt = 3;
594 	__u8 cmd = 0;
595 	int tt = 0;
596 
597 	if (c67x00_claim_frame_bw(c67x00, urb, len, usb_pipeisoc(urb->pipe)
598 				  || usb_pipeint(urb->pipe)))
599 		return -EMSGSIZE;	/* Not really an error, but expected */
600 
601 	td = kzalloc(sizeof(*td), GFP_ATOMIC);
602 	if (!td)
603 		return -ENOMEM;
604 
605 	td->pipe = urb->pipe;
606 	td->ep_data = urbp->ep_data;
607 
608 	if ((td_udev(td)->speed == USB_SPEED_LOW) &&
609 	    !(c67x00->low_speed_ports & (1 << urbp->port)))
610 		cmd |= PREAMBLE_EN;
611 
612 	switch (usb_pipetype(td->pipe)) {
613 	case PIPE_ISOCHRONOUS:
614 		tt = TT_ISOCHRONOUS;
615 		cmd |= ISO_EN;
616 		break;
617 	case PIPE_CONTROL:
618 		tt = TT_CONTROL;
619 		break;
620 	case PIPE_BULK:
621 		tt = TT_BULK;
622 		break;
623 	case PIPE_INTERRUPT:
624 		tt = TT_INTERRUPT;
625 		break;
626 	}
627 
628 	if (toggle)
629 		cmd |= SEQ_SEL;
630 
631 	cmd |= ARM_EN;
632 
633 	/* SW part */
634 	td->td_addr = c67x00->next_td_addr;
635 	c67x00->next_td_addr = c67x00->next_td_addr + CY_TD_SIZE;
636 
637 	/* HW part */
638 	td->ly_base_addr = __cpu_to_le16(c67x00->next_buf_addr);
639 	td->port_length = __cpu_to_le16((c67x00->sie->sie_num << 15) |
640 					(urbp->port << 14) | (len & 0x3FF));
641 	td->pid_ep = ((pid & 0xF) << TD_PIDEP_OFFSET) |
642 	    (usb_pipeendpoint(td->pipe) & 0xF);
643 	td->dev_addr = usb_pipedevice(td->pipe) & 0x7F;
644 	td->ctrl_reg = cmd;
645 	td->status = 0;
646 	td->retry_cnt = (tt << TT_OFFSET) | (active_flag << 4) | retry_cnt;
647 	td->residue = 0;
648 	td->next_td_addr = __cpu_to_le16(c67x00->next_td_addr);
649 
650 	/* SW part */
651 	td->data = data;
652 	td->urb = urb;
653 	td->privdata = privdata;
654 
655 	c67x00->next_buf_addr += (len + 1) & ~0x01;	/* properly align */
656 
657 	list_add_tail(&td->td_list, &c67x00->td_list);
658 	return 0;
659 }
660 
661 static inline void c67x00_release_td(struct c67x00_td *td)
662 {
663 	list_del_init(&td->td_list);
664 	kfree(td);
665 }
666 
667 /* -------------------------------------------------------------------------- */
668 
669 static int c67x00_add_data_urb(struct c67x00_hcd *c67x00, struct urb *urb)
670 {
671 	int remaining;
672 	int toggle;
673 	int pid;
674 	int ret = 0;
675 	int maxps;
676 	int need_empty;
677 
678 	toggle = usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe),
679 			       usb_pipeout(urb->pipe));
680 	remaining = urb->transfer_buffer_length - urb->actual_length;
681 
682 	maxps = usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe));
683 
684 	need_empty = (urb->transfer_flags & URB_ZERO_PACKET) &&
685 	    usb_pipeout(urb->pipe) && !(remaining % maxps);
686 
687 	while (remaining || need_empty) {
688 		int len;
689 		char *td_buf;
690 
691 		len = (remaining > maxps) ? maxps : remaining;
692 		if (!len)
693 			need_empty = 0;
694 
695 		pid = usb_pipeout(urb->pipe) ? USB_PID_OUT : USB_PID_IN;
696 		td_buf = urb->transfer_buffer + urb->transfer_buffer_length -
697 		    remaining;
698 		ret = c67x00_create_td(c67x00, urb, td_buf, len, pid, toggle,
699 				       DATA_STAGE);
700 		if (ret)
701 			return ret;	/* td wasn't created */
702 
703 		toggle ^= 1;
704 		remaining -= len;
705 		if (usb_pipecontrol(urb->pipe))
706 			break;
707 	}
708 
709 	return 0;
710 }
711 
712 /**
713  * return 0 in case more bandwidth is available, else errorcode
714  */
715 static int c67x00_add_ctrl_urb(struct c67x00_hcd *c67x00, struct urb *urb)
716 {
717 	int ret;
718 	int pid;
719 
720 	switch (urb->interval) {
721 	default:
722 	case SETUP_STAGE:
723 		ret = c67x00_create_td(c67x00, urb, urb->setup_packet,
724 				       8, USB_PID_SETUP, 0, SETUP_STAGE);
725 		if (ret)
726 			return ret;
727 		urb->interval = SETUP_STAGE;
728 		usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
729 			      usb_pipeout(urb->pipe), 1);
730 		break;
731 	case DATA_STAGE:
732 		if (urb->transfer_buffer_length) {
733 			ret = c67x00_add_data_urb(c67x00, urb);
734 			if (ret)
735 				return ret;
736 			break;
737 		}		/* else fallthrough */
738 	case STATUS_STAGE:
739 		pid = !usb_pipeout(urb->pipe) ? USB_PID_OUT : USB_PID_IN;
740 		ret = c67x00_create_td(c67x00, urb, NULL, 0, pid, 1,
741 				       STATUS_STAGE);
742 		if (ret)
743 			return ret;
744 		break;
745 	}
746 
747 	return 0;
748 }
749 
750 /*
751  * return 0 in case more bandwidth is available, else errorcode
752  */
753 static int c67x00_add_int_urb(struct c67x00_hcd *c67x00, struct urb *urb)
754 {
755 	struct c67x00_urb_priv *urbp = urb->hcpriv;
756 
757 	if (frame_after_eq(c67x00->current_frame, urbp->ep_data->next_frame)) {
758 		urbp->ep_data->next_frame =
759 		    frame_add(urbp->ep_data->next_frame, urb->interval);
760 		return c67x00_add_data_urb(c67x00, urb);
761 	}
762 	return 0;
763 }
764 
765 static int c67x00_add_iso_urb(struct c67x00_hcd *c67x00, struct urb *urb)
766 {
767 	struct c67x00_urb_priv *urbp = urb->hcpriv;
768 
769 	if (frame_after_eq(c67x00->current_frame, urbp->ep_data->next_frame)) {
770 		char *td_buf;
771 		int len, pid, ret;
772 
773 		BUG_ON(urbp->cnt >= urb->number_of_packets);
774 
775 		td_buf = urb->transfer_buffer +
776 		    urb->iso_frame_desc[urbp->cnt].offset;
777 		len = urb->iso_frame_desc[urbp->cnt].length;
778 		pid = usb_pipeout(urb->pipe) ? USB_PID_OUT : USB_PID_IN;
779 
780 		ret = c67x00_create_td(c67x00, urb, td_buf, len, pid, 0,
781 				       urbp->cnt);
782 		if (ret) {
783 			printk(KERN_DEBUG "create failed: %d\n", ret);
784 			urb->iso_frame_desc[urbp->cnt].actual_length = 0;
785 			urb->iso_frame_desc[urbp->cnt].status = ret;
786 			if (urbp->cnt + 1 == urb->number_of_packets)
787 				c67x00_giveback_urb(c67x00, urb, 0);
788 		}
789 
790 		urbp->ep_data->next_frame =
791 		    frame_add(urbp->ep_data->next_frame, urb->interval);
792 		urbp->cnt++;
793 	}
794 	return 0;
795 }
796 
797 /* -------------------------------------------------------------------------- */
798 
799 static void c67x00_fill_from_list(struct c67x00_hcd *c67x00, int type,
800 				  int (*add)(struct c67x00_hcd *, struct urb *))
801 {
802 	struct c67x00_ep_data *ep_data;
803 	struct urb *urb;
804 
805 	/* traverse every endpoint on the list */
806 	list_for_each_entry(ep_data, &c67x00->list[type], node) {
807 		if (!list_empty(&ep_data->queue)) {
808 			/* and add the first urb */
809 			/* isochronous transfer rely on this */
810 			urb = list_entry(ep_data->queue.next,
811 					 struct c67x00_urb_priv,
812 					 hep_node)->urb;
813 			add(c67x00, urb);
814 		}
815 	}
816 }
817 
818 static void c67x00_fill_frame(struct c67x00_hcd *c67x00)
819 {
820 	struct c67x00_td *td, *ttd;
821 
822 	/* Check if we can proceed */
823 	if (!list_empty(&c67x00->td_list)) {
824 		dev_warn(c67x00_hcd_dev(c67x00),
825 			 "TD list not empty! This should not happen!\n");
826 		list_for_each_entry_safe(td, ttd, &c67x00->td_list, td_list) {
827 			dbg_td(c67x00, td, "Unprocessed td");
828 			c67x00_release_td(td);
829 		}
830 	}
831 
832 	/* Reinitialize variables */
833 	c67x00->bandwidth_allocated = 0;
834 	c67x00->periodic_bw_allocated = 0;
835 
836 	c67x00->next_td_addr = c67x00->td_base_addr;
837 	c67x00->next_buf_addr = c67x00->buf_base_addr;
838 
839 	/* Fill the list */
840 	c67x00_fill_from_list(c67x00, PIPE_ISOCHRONOUS, c67x00_add_iso_urb);
841 	c67x00_fill_from_list(c67x00, PIPE_INTERRUPT, c67x00_add_int_urb);
842 	c67x00_fill_from_list(c67x00, PIPE_CONTROL, c67x00_add_ctrl_urb);
843 	c67x00_fill_from_list(c67x00, PIPE_BULK, c67x00_add_data_urb);
844 }
845 
846 /* -------------------------------------------------------------------------- */
847 
848 /**
849  * Get TD from C67X00
850  */
851 static inline void
852 c67x00_parse_td(struct c67x00_hcd *c67x00, struct c67x00_td *td)
853 {
854 	c67x00_ll_read_mem_le16(c67x00->sie->dev,
855 				td->td_addr, td, CY_TD_SIZE);
856 
857 	if (usb_pipein(td->pipe) && td_actual_bytes(td))
858 		c67x00_ll_read_mem_le16(c67x00->sie->dev, td_ly_base_addr(td),
859 					td->data, td_actual_bytes(td));
860 }
861 
862 static int c67x00_td_to_error(struct c67x00_hcd *c67x00, struct c67x00_td *td)
863 {
864 	if (td->status & TD_STATUSMASK_ERR) {
865 		dbg_td(c67x00, td, "ERROR_FLAG");
866 		return -EILSEQ;
867 	}
868 	if (td->status & TD_STATUSMASK_STALL) {
869 		/* dbg_td(c67x00, td, "STALL"); */
870 		return -EPIPE;
871 	}
872 	if (td->status & TD_STATUSMASK_TMOUT) {
873 		dbg_td(c67x00, td, "TIMEOUT");
874 		return -ETIMEDOUT;
875 	}
876 
877 	return 0;
878 }
879 
880 static inline int c67x00_end_of_data(struct c67x00_td *td)
881 {
882 	int maxps, need_empty, remaining;
883 	struct urb *urb = td->urb;
884 	int act_bytes;
885 
886 	act_bytes = td_actual_bytes(td);
887 
888 	if (unlikely(!act_bytes))
889 		return 1;	/* This was an empty packet */
890 
891 	maxps = usb_maxpacket(td_udev(td), td->pipe, usb_pipeout(td->pipe));
892 
893 	if (unlikely(act_bytes < maxps))
894 		return 1;	/* Smaller then full packet */
895 
896 	remaining = urb->transfer_buffer_length - urb->actual_length;
897 	need_empty = (urb->transfer_flags & URB_ZERO_PACKET) &&
898 	    usb_pipeout(urb->pipe) && !(remaining % maxps);
899 
900 	if (unlikely(!remaining && !need_empty))
901 		return 1;
902 
903 	return 0;
904 }
905 
906 /* -------------------------------------------------------------------------- */
907 
908 /* Remove all td's from the list which come
909  * after last_td and are meant for the same pipe.
910  * This is used when a short packet has occurred */
911 static inline void c67x00_clear_pipe(struct c67x00_hcd *c67x00,
912 				     struct c67x00_td *last_td)
913 {
914 	struct c67x00_td *td, *tmp;
915 	td = last_td;
916 	tmp = last_td;
917 	while (td->td_list.next != &c67x00->td_list) {
918 		td = list_entry(td->td_list.next, struct c67x00_td, td_list);
919 		if (td->pipe == last_td->pipe) {
920 			c67x00_release_td(td);
921 			td = tmp;
922 		}
923 		tmp = td;
924 	}
925 }
926 
927 /* -------------------------------------------------------------------------- */
928 
929 static void c67x00_handle_successful_td(struct c67x00_hcd *c67x00,
930 					struct c67x00_td *td)
931 {
932 	struct urb *urb = td->urb;
933 
934 	if (!urb)
935 		return;
936 
937 	urb->actual_length += td_actual_bytes(td);
938 
939 	switch (usb_pipetype(td->pipe)) {
940 		/* isochronous tds are handled separately */
941 	case PIPE_CONTROL:
942 		switch (td->privdata) {
943 		case SETUP_STAGE:
944 			urb->interval =
945 			    urb->transfer_buffer_length ?
946 			    DATA_STAGE : STATUS_STAGE;
947 			/* Don't count setup_packet with normal data: */
948 			urb->actual_length = 0;
949 			break;
950 
951 		case DATA_STAGE:
952 			if (c67x00_end_of_data(td)) {
953 				urb->interval = STATUS_STAGE;
954 				c67x00_clear_pipe(c67x00, td);
955 			}
956 			break;
957 
958 		case STATUS_STAGE:
959 			urb->interval = 0;
960 			c67x00_giveback_urb(c67x00, urb, 0);
961 			break;
962 		}
963 		break;
964 
965 	case PIPE_INTERRUPT:
966 	case PIPE_BULK:
967 		if (unlikely(c67x00_end_of_data(td))) {
968 			c67x00_clear_pipe(c67x00, td);
969 			c67x00_giveback_urb(c67x00, urb, 0);
970 		}
971 		break;
972 	}
973 }
974 
975 static void c67x00_handle_isoc(struct c67x00_hcd *c67x00, struct c67x00_td *td)
976 {
977 	struct urb *urb = td->urb;
978 	struct c67x00_urb_priv *urbp;
979 	int cnt;
980 
981 	if (!urb)
982 		return;
983 
984 	urbp = urb->hcpriv;
985 	cnt = td->privdata;
986 
987 	if (td->status & TD_ERROR_MASK)
988 		urb->error_count++;
989 
990 	urb->iso_frame_desc[cnt].actual_length = td_actual_bytes(td);
991 	urb->iso_frame_desc[cnt].status = c67x00_td_to_error(c67x00, td);
992 	if (cnt + 1 == urb->number_of_packets)	/* Last packet */
993 		c67x00_giveback_urb(c67x00, urb, 0);
994 }
995 
996 /* -------------------------------------------------------------------------- */
997 
998 /**
999  * c67x00_check_td_list - handle tds which have been processed by the c67x00
1000  * pre: current_td == 0
1001  */
1002 static inline void c67x00_check_td_list(struct c67x00_hcd *c67x00)
1003 {
1004 	struct c67x00_td *td, *tmp;
1005 	struct urb *urb;
1006 	int ack_ok;
1007 	int clear_endpoint;
1008 
1009 	list_for_each_entry_safe(td, tmp, &c67x00->td_list, td_list) {
1010 		/* get the TD */
1011 		c67x00_parse_td(c67x00, td);
1012 		urb = td->urb;	/* urb can be NULL! */
1013 		ack_ok = 0;
1014 		clear_endpoint = 1;
1015 
1016 		/* Handle isochronous transfers separately */
1017 		if (usb_pipeisoc(td->pipe)) {
1018 			clear_endpoint = 0;
1019 			c67x00_handle_isoc(c67x00, td);
1020 			goto cont;
1021 		}
1022 
1023 		/* When an error occurs, all td's for that pipe go into an
1024 		 * inactive state. This state matches successful transfers so
1025 		 * we must make sure not to service them. */
1026 		if (td->status & TD_ERROR_MASK) {
1027 			c67x00_giveback_urb(c67x00, urb,
1028 					    c67x00_td_to_error(c67x00, td));
1029 			goto cont;
1030 		}
1031 
1032 		if ((td->status & TD_STATUSMASK_NAK) || !td_sequence_ok(td) ||
1033 		    !td_acked(td))
1034 			goto cont;
1035 
1036 		/* Sequence ok and acked, don't need to fix toggle */
1037 		ack_ok = 1;
1038 
1039 		if (unlikely(td->status & TD_STATUSMASK_OVF)) {
1040 			if (td_residue(td) & TD_RESIDUE_OVERFLOW) {
1041 				/* Overflow */
1042 				c67x00_giveback_urb(c67x00, urb, -EOVERFLOW);
1043 				goto cont;
1044 			}
1045 		}
1046 
1047 		clear_endpoint = 0;
1048 		c67x00_handle_successful_td(c67x00, td);
1049 
1050 cont:
1051 		if (clear_endpoint)
1052 			c67x00_clear_pipe(c67x00, td);
1053 		if (ack_ok)
1054 			usb_settoggle(td_udev(td), usb_pipeendpoint(td->pipe),
1055 				      usb_pipeout(td->pipe),
1056 				      !(td->ctrl_reg & SEQ_SEL));
1057 		/* next in list could have been removed, due to clear_pipe! */
1058 		tmp = list_entry(td->td_list.next, typeof(*td), td_list);
1059 		c67x00_release_td(td);
1060 	}
1061 }
1062 
1063 /* -------------------------------------------------------------------------- */
1064 
1065 static inline int c67x00_all_tds_processed(struct c67x00_hcd *c67x00)
1066 {
1067 	/* If all tds are processed, we can check the previous frame (if
1068 	 * there was any) and start our next frame.
1069 	 */
1070 	return !c67x00_ll_husb_get_current_td(c67x00->sie);
1071 }
1072 
1073 /**
1074  * Send td to C67X00
1075  */
1076 static void c67x00_send_td(struct c67x00_hcd *c67x00, struct c67x00_td *td)
1077 {
1078 	int len = td_length(td);
1079 
1080 	if (len && ((td->pid_ep & TD_PIDEPMASK_PID) != TD_PID_IN))
1081 		c67x00_ll_write_mem_le16(c67x00->sie->dev, td_ly_base_addr(td),
1082 					 td->data, len);
1083 
1084 	c67x00_ll_write_mem_le16(c67x00->sie->dev,
1085 				 td->td_addr, td, CY_TD_SIZE);
1086 }
1087 
1088 static void c67x00_send_frame(struct c67x00_hcd *c67x00)
1089 {
1090 	struct c67x00_td *td;
1091 
1092 	if (list_empty(&c67x00->td_list))
1093 		dev_warn(c67x00_hcd_dev(c67x00),
1094 			 "%s: td list should not be empty here!\n",
1095 			 __func__);
1096 
1097 	list_for_each_entry(td, &c67x00->td_list, td_list) {
1098 		if (td->td_list.next == &c67x00->td_list)
1099 			td->next_td_addr = 0;	/* Last td in list */
1100 
1101 		c67x00_send_td(c67x00, td);
1102 	}
1103 
1104 	c67x00_ll_husb_set_current_td(c67x00->sie, c67x00->td_base_addr);
1105 }
1106 
1107 /* -------------------------------------------------------------------------- */
1108 
1109 /**
1110  * c67x00_do_work - Schedulers state machine
1111  */
1112 static void c67x00_do_work(struct c67x00_hcd *c67x00)
1113 {
1114 	spin_lock(&c67x00->lock);
1115 	/* Make sure all tds are processed */
1116 	if (!c67x00_all_tds_processed(c67x00))
1117 		goto out;
1118 
1119 	c67x00_check_td_list(c67x00);
1120 
1121 	/* no td's are being processed (current == 0)
1122 	 * and all have been "checked" */
1123 	complete(&c67x00->endpoint_disable);
1124 
1125 	if (!list_empty(&c67x00->td_list))
1126 		goto out;
1127 
1128 	c67x00->current_frame = c67x00_get_current_frame_number(c67x00);
1129 	if (c67x00->current_frame == c67x00->last_frame)
1130 		goto out;	/* Don't send tds in same frame */
1131 	c67x00->last_frame = c67x00->current_frame;
1132 
1133 	/* If no urbs are scheduled, our work is done */
1134 	if (!c67x00->urb_count) {
1135 		c67x00_ll_hpi_disable_sofeop(c67x00->sie);
1136 		goto out;
1137 	}
1138 
1139 	c67x00_fill_frame(c67x00);
1140 	if (!list_empty(&c67x00->td_list))
1141 		/* TD's have been added to the frame */
1142 		c67x00_send_frame(c67x00);
1143 
1144  out:
1145 	spin_unlock(&c67x00->lock);
1146 }
1147 
1148 /* -------------------------------------------------------------------------- */
1149 
1150 static void c67x00_sched_tasklet(unsigned long __c67x00)
1151 {
1152 	struct c67x00_hcd *c67x00 = (struct c67x00_hcd *)__c67x00;
1153 	c67x00_do_work(c67x00);
1154 }
1155 
1156 void c67x00_sched_kick(struct c67x00_hcd *c67x00)
1157 {
1158 	tasklet_hi_schedule(&c67x00->tasklet);
1159 }
1160 
1161 int c67x00_sched_start_scheduler(struct c67x00_hcd *c67x00)
1162 {
1163 	tasklet_init(&c67x00->tasklet, c67x00_sched_tasklet,
1164 		     (unsigned long)c67x00);
1165 	return 0;
1166 }
1167 
1168 void c67x00_sched_stop_scheduler(struct c67x00_hcd *c67x00)
1169 {
1170 	tasklet_kill(&c67x00->tasklet);
1171 }
1172