xref: /openbmc/linux/drivers/usb/host/oxu210hp-hcd.c (revision abe9af53)
1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * Copyright (c) 2008 Rodolfo Giometti <giometti@linux.it>
4  * Copyright (c) 2008 Eurotech S.p.A. <info@eurtech.it>
5  *
6  * This code is *strongly* based on EHCI-HCD code by David Brownell since
7  * the chip is a quasi-EHCI compatible.
8  */
9 
10 #include <linux/module.h>
11 #include <linux/pci.h>
12 #include <linux/dmapool.h>
13 #include <linux/kernel.h>
14 #include <linux/delay.h>
15 #include <linux/ioport.h>
16 #include <linux/sched.h>
17 #include <linux/slab.h>
18 #include <linux/errno.h>
19 #include <linux/timer.h>
20 #include <linux/list.h>
21 #include <linux/interrupt.h>
22 #include <linux/usb.h>
23 #include <linux/usb/hcd.h>
24 #include <linux/moduleparam.h>
25 #include <linux/dma-mapping.h>
26 #include <linux/io.h>
27 #include <linux/iopoll.h>
28 
29 #include <asm/irq.h>
30 #include <asm/unaligned.h>
31 
32 #include <linux/irq.h>
33 #include <linux/platform_device.h>
34 
35 #define DRIVER_VERSION "0.0.50"
36 
37 #define OXU_DEVICEID			0x00
38 	#define OXU_REV_MASK		0xffff0000
39 	#define OXU_REV_SHIFT		16
40 	#define OXU_REV_2100		0x2100
41 	#define OXU_BO_SHIFT		8
42 	#define OXU_BO_MASK		(0x3 << OXU_BO_SHIFT)
43 	#define OXU_MAJ_REV_SHIFT	4
44 	#define OXU_MAJ_REV_MASK	(0xf << OXU_MAJ_REV_SHIFT)
45 	#define OXU_MIN_REV_SHIFT	0
46 	#define OXU_MIN_REV_MASK	(0xf << OXU_MIN_REV_SHIFT)
47 #define OXU_HOSTIFCONFIG		0x04
48 #define OXU_SOFTRESET			0x08
49 	#define OXU_SRESET		(1 << 0)
50 
51 #define OXU_PIOBURSTREADCTRL		0x0C
52 
53 #define OXU_CHIPIRQSTATUS		0x10
54 #define OXU_CHIPIRQEN_SET		0x14
55 #define OXU_CHIPIRQEN_CLR		0x18
56 	#define OXU_USBSPHLPWUI		0x00000080
57 	#define OXU_USBOTGLPWUI		0x00000040
58 	#define OXU_USBSPHI		0x00000002
59 	#define OXU_USBOTGI		0x00000001
60 
61 #define OXU_CLKCTRL_SET			0x1C
62 	#define OXU_SYSCLKEN		0x00000008
63 	#define OXU_USBSPHCLKEN		0x00000002
64 	#define OXU_USBOTGCLKEN		0x00000001
65 
66 #define OXU_ASO				0x68
67 	#define OXU_SPHPOEN		0x00000100
68 	#define OXU_OVRCCURPUPDEN	0x00000800
69 	#define OXU_ASO_OP		(1 << 10)
70 	#define OXU_COMPARATOR		0x000004000
71 
72 #define OXU_USBMODE			0x1A8
73 	#define OXU_VBPS		0x00000020
74 	#define OXU_ES_LITTLE		0x00000000
75 	#define OXU_CM_HOST_ONLY	0x00000003
76 
77 /*
78  * Proper EHCI structs & defines
79  */
80 
81 /* Magic numbers that can affect system performance */
82 #define EHCI_TUNE_CERR		3	/* 0-3 qtd retries; 0 == don't stop */
83 #define EHCI_TUNE_RL_HS		4	/* nak throttle; see 4.9 */
84 #define EHCI_TUNE_RL_TT		0
85 #define EHCI_TUNE_MULT_HS	1	/* 1-3 transactions/uframe; 4.10.3 */
86 #define EHCI_TUNE_MULT_TT	1
87 #define EHCI_TUNE_FLS		2	/* (small) 256 frame schedule */
88 
89 struct oxu_hcd;
90 
91 /* EHCI register interface, corresponds to EHCI Revision 0.95 specification */
92 
93 /* Section 2.2 Host Controller Capability Registers */
94 struct ehci_caps {
95 	/* these fields are specified as 8 and 16 bit registers,
96 	 * but some hosts can't perform 8 or 16 bit PCI accesses.
97 	 */
98 	u32		hc_capbase;
99 #define HC_LENGTH(p)		(((p)>>00)&0x00ff)	/* bits 7:0 */
100 #define HC_VERSION(p)		(((p)>>16)&0xffff)	/* bits 31:16 */
101 	u32		hcs_params;     /* HCSPARAMS - offset 0x4 */
102 #define HCS_DEBUG_PORT(p)	(((p)>>20)&0xf)	/* bits 23:20, debug port? */
103 #define HCS_INDICATOR(p)	((p)&(1 << 16))	/* true: has port indicators */
104 #define HCS_N_CC(p)		(((p)>>12)&0xf)	/* bits 15:12, #companion HCs */
105 #define HCS_N_PCC(p)		(((p)>>8)&0xf)	/* bits 11:8, ports per CC */
106 #define HCS_PORTROUTED(p)	((p)&(1 << 7))	/* true: port routing */
107 #define HCS_PPC(p)		((p)&(1 << 4))	/* true: port power control */
108 #define HCS_N_PORTS(p)		(((p)>>0)&0xf)	/* bits 3:0, ports on HC */
109 
110 	u32		hcc_params;      /* HCCPARAMS - offset 0x8 */
111 #define HCC_EXT_CAPS(p)		(((p)>>8)&0xff)	/* for pci extended caps */
112 #define HCC_ISOC_CACHE(p)       ((p)&(1 << 7))  /* true: can cache isoc frame */
113 #define HCC_ISOC_THRES(p)       (((p)>>4)&0x7)  /* bits 6:4, uframes cached */
114 #define HCC_CANPARK(p)		((p)&(1 << 2))  /* true: can park on async qh */
115 #define HCC_PGM_FRAMELISTLEN(p) ((p)&(1 << 1))  /* true: periodic_size changes*/
116 #define HCC_64BIT_ADDR(p)       ((p)&(1))       /* true: can use 64-bit addr */
117 	u8		portroute[8];	 /* nibbles for routing - offset 0xC */
118 } __packed;
119 
120 
121 /* Section 2.3 Host Controller Operational Registers */
122 struct ehci_regs {
123 	/* USBCMD: offset 0x00 */
124 	u32		command;
125 /* 23:16 is r/w intr rate, in microframes; default "8" == 1/msec */
126 #define CMD_PARK	(1<<11)		/* enable "park" on async qh */
127 #define CMD_PARK_CNT(c)	(((c)>>8)&3)	/* how many transfers to park for */
128 #define CMD_LRESET	(1<<7)		/* partial reset (no ports, etc) */
129 #define CMD_IAAD	(1<<6)		/* "doorbell" interrupt async advance */
130 #define CMD_ASE		(1<<5)		/* async schedule enable */
131 #define CMD_PSE		(1<<4)		/* periodic schedule enable */
132 /* 3:2 is periodic frame list size */
133 #define CMD_RESET	(1<<1)		/* reset HC not bus */
134 #define CMD_RUN		(1<<0)		/* start/stop HC */
135 
136 	/* USBSTS: offset 0x04 */
137 	u32		status;
138 #define STS_ASS		(1<<15)		/* Async Schedule Status */
139 #define STS_PSS		(1<<14)		/* Periodic Schedule Status */
140 #define STS_RECL	(1<<13)		/* Reclamation */
141 #define STS_HALT	(1<<12)		/* Not running (any reason) */
142 /* some bits reserved */
143 	/* these STS_* flags are also intr_enable bits (USBINTR) */
144 #define STS_IAA		(1<<5)		/* Interrupted on async advance */
145 #define STS_FATAL	(1<<4)		/* such as some PCI access errors */
146 #define STS_FLR		(1<<3)		/* frame list rolled over */
147 #define STS_PCD		(1<<2)		/* port change detect */
148 #define STS_ERR		(1<<1)		/* "error" completion (overflow, ...) */
149 #define STS_INT		(1<<0)		/* "normal" completion (short, ...) */
150 
151 #define INTR_MASK (STS_IAA | STS_FATAL | STS_PCD | STS_ERR | STS_INT)
152 
153 	/* USBINTR: offset 0x08 */
154 	u32		intr_enable;
155 
156 	/* FRINDEX: offset 0x0C */
157 	u32		frame_index;	/* current microframe number */
158 	/* CTRLDSSEGMENT: offset 0x10 */
159 	u32		segment;	/* address bits 63:32 if needed */
160 	/* PERIODICLISTBASE: offset 0x14 */
161 	u32		frame_list;	/* points to periodic list */
162 	/* ASYNCLISTADDR: offset 0x18 */
163 	u32		async_next;	/* address of next async queue head */
164 
165 	u32		reserved[9];
166 
167 	/* CONFIGFLAG: offset 0x40 */
168 	u32		configured_flag;
169 #define FLAG_CF		(1<<0)		/* true: we'll support "high speed" */
170 
171 	/* PORTSC: offset 0x44 */
172 	u32		port_status[0];	/* up to N_PORTS */
173 /* 31:23 reserved */
174 #define PORT_WKOC_E	(1<<22)		/* wake on overcurrent (enable) */
175 #define PORT_WKDISC_E	(1<<21)		/* wake on disconnect (enable) */
176 #define PORT_WKCONN_E	(1<<20)		/* wake on connect (enable) */
177 /* 19:16 for port testing */
178 #define PORT_LED_OFF	(0<<14)
179 #define PORT_LED_AMBER	(1<<14)
180 #define PORT_LED_GREEN	(2<<14)
181 #define PORT_LED_MASK	(3<<14)
182 #define PORT_OWNER	(1<<13)		/* true: companion hc owns this port */
183 #define PORT_POWER	(1<<12)		/* true: has power (see PPC) */
184 #define PORT_USB11(x) (((x)&(3<<10)) == (1<<10))	/* USB 1.1 device */
185 /* 11:10 for detecting lowspeed devices (reset vs release ownership) */
186 /* 9 reserved */
187 #define PORT_RESET	(1<<8)		/* reset port */
188 #define PORT_SUSPEND	(1<<7)		/* suspend port */
189 #define PORT_RESUME	(1<<6)		/* resume it */
190 #define PORT_OCC	(1<<5)		/* over current change */
191 #define PORT_OC		(1<<4)		/* over current active */
192 #define PORT_PEC	(1<<3)		/* port enable change */
193 #define PORT_PE		(1<<2)		/* port enable */
194 #define PORT_CSC	(1<<1)		/* connect status change */
195 #define PORT_CONNECT	(1<<0)		/* device connected */
196 #define PORT_RWC_BITS   (PORT_CSC | PORT_PEC | PORT_OCC)
197 } __packed;
198 
199 /* Appendix C, Debug port ... intended for use with special "debug devices"
200  * that can help if there's no serial console.  (nonstandard enumeration.)
201  */
202 struct ehci_dbg_port {
203 	u32	control;
204 #define DBGP_OWNER	(1<<30)
205 #define DBGP_ENABLED	(1<<28)
206 #define DBGP_DONE	(1<<16)
207 #define DBGP_INUSE	(1<<10)
208 #define DBGP_ERRCODE(x)	(((x)>>7)&0x07)
209 #	define DBGP_ERR_BAD	1
210 #	define DBGP_ERR_SIGNAL	2
211 #define DBGP_ERROR	(1<<6)
212 #define DBGP_GO		(1<<5)
213 #define DBGP_OUT	(1<<4)
214 #define DBGP_LEN(x)	(((x)>>0)&0x0f)
215 	u32	pids;
216 #define DBGP_PID_GET(x)		(((x)>>16)&0xff)
217 #define DBGP_PID_SET(data, tok)	(((data)<<8)|(tok))
218 	u32	data03;
219 	u32	data47;
220 	u32	address;
221 #define DBGP_EPADDR(dev, ep)	(((dev)<<8)|(ep))
222 } __packed;
223 
224 #define	QTD_NEXT(dma)	cpu_to_le32((u32)dma)
225 
226 /*
227  * EHCI Specification 0.95 Section 3.5
228  * QTD: describe data transfer components (buffer, direction, ...)
229  * See Fig 3-6 "Queue Element Transfer Descriptor Block Diagram".
230  *
231  * These are associated only with "QH" (Queue Head) structures,
232  * used with control, bulk, and interrupt transfers.
233  */
234 struct ehci_qtd {
235 	/* first part defined by EHCI spec */
236 	__le32			hw_next;		/* see EHCI 3.5.1 */
237 	__le32			hw_alt_next;		/* see EHCI 3.5.2 */
238 	__le32			hw_token;		/* see EHCI 3.5.3 */
239 #define	QTD_TOGGLE	(1 << 31)	/* data toggle */
240 #define	QTD_LENGTH(tok)	(((tok)>>16) & 0x7fff)
241 #define	QTD_IOC		(1 << 15)	/* interrupt on complete */
242 #define	QTD_CERR(tok)	(((tok)>>10) & 0x3)
243 #define	QTD_PID(tok)	(((tok)>>8) & 0x3)
244 #define	QTD_STS_ACTIVE	(1 << 7)	/* HC may execute this */
245 #define	QTD_STS_HALT	(1 << 6)	/* halted on error */
246 #define	QTD_STS_DBE	(1 << 5)	/* data buffer error (in HC) */
247 #define	QTD_STS_BABBLE	(1 << 4)	/* device was babbling (qtd halted) */
248 #define	QTD_STS_XACT	(1 << 3)	/* device gave illegal response */
249 #define	QTD_STS_MMF	(1 << 2)	/* incomplete split transaction */
250 #define	QTD_STS_STS	(1 << 1)	/* split transaction state */
251 #define	QTD_STS_PING	(1 << 0)	/* issue PING? */
252 	__le32			hw_buf[5];		/* see EHCI 3.5.4 */
253 	__le32			hw_buf_hi[5];		/* Appendix B */
254 
255 	/* the rest is HCD-private */
256 	dma_addr_t		qtd_dma;		/* qtd address */
257 	struct list_head	qtd_list;		/* sw qtd list */
258 	struct urb		*urb;			/* qtd's urb */
259 	size_t			length;			/* length of buffer */
260 
261 	u32			qtd_buffer_len;
262 	void			*buffer;
263 	dma_addr_t		buffer_dma;
264 	void			*transfer_buffer;
265 	void			*transfer_dma;
266 } __aligned(32);
267 
268 /* mask NakCnt+T in qh->hw_alt_next */
269 #define QTD_MASK cpu_to_le32 (~0x1f)
270 
271 #define IS_SHORT_READ(token) (QTD_LENGTH(token) != 0 && QTD_PID(token) == 1)
272 
273 /* Type tag from {qh, itd, sitd, fstn}->hw_next */
274 #define Q_NEXT_TYPE(dma) ((dma) & cpu_to_le32 (3 << 1))
275 
276 /* values for that type tag */
277 #define Q_TYPE_QH	cpu_to_le32 (1 << 1)
278 
279 /* next async queue entry, or pointer to interrupt/periodic QH */
280 #define	QH_NEXT(dma)	(cpu_to_le32(((u32)dma)&~0x01f)|Q_TYPE_QH)
281 
282 /* for periodic/async schedules and qtd lists, mark end of list */
283 #define	EHCI_LIST_END	cpu_to_le32(1) /* "null pointer" to hw */
284 
285 /*
286  * Entries in periodic shadow table are pointers to one of four kinds
287  * of data structure.  That's dictated by the hardware; a type tag is
288  * encoded in the low bits of the hardware's periodic schedule.  Use
289  * Q_NEXT_TYPE to get the tag.
290  *
291  * For entries in the async schedule, the type tag always says "qh".
292  */
293 union ehci_shadow {
294 	struct ehci_qh		*qh;		/* Q_TYPE_QH */
295 	__le32			*hw_next;	/* (all types) */
296 	void			*ptr;
297 };
298 
299 /*
300  * EHCI Specification 0.95 Section 3.6
301  * QH: describes control/bulk/interrupt endpoints
302  * See Fig 3-7 "Queue Head Structure Layout".
303  *
304  * These appear in both the async and (for interrupt) periodic schedules.
305  */
306 
307 struct ehci_qh {
308 	/* first part defined by EHCI spec */
309 	__le32			hw_next;	 /* see EHCI 3.6.1 */
310 	__le32			hw_info1;	/* see EHCI 3.6.2 */
311 #define	QH_HEAD		0x00008000
312 	__le32			hw_info2;	/* see EHCI 3.6.2 */
313 #define	QH_SMASK	0x000000ff
314 #define	QH_CMASK	0x0000ff00
315 #define	QH_HUBADDR	0x007f0000
316 #define	QH_HUBPORT	0x3f800000
317 #define	QH_MULT		0xc0000000
318 	__le32			hw_current;	 /* qtd list - see EHCI 3.6.4 */
319 
320 	/* qtd overlay (hardware parts of a struct ehci_qtd) */
321 	__le32			hw_qtd_next;
322 	__le32			hw_alt_next;
323 	__le32			hw_token;
324 	__le32			hw_buf[5];
325 	__le32			hw_buf_hi[5];
326 
327 	/* the rest is HCD-private */
328 	dma_addr_t		qh_dma;		/* address of qh */
329 	union ehci_shadow	qh_next;	/* ptr to qh; or periodic */
330 	struct list_head	qtd_list;	/* sw qtd list */
331 	struct ehci_qtd		*dummy;
332 	struct ehci_qh		*reclaim;	/* next to reclaim */
333 
334 	struct oxu_hcd		*oxu;
335 	struct kref		kref;
336 	unsigned int		stamp;
337 
338 	u8			qh_state;
339 #define	QH_STATE_LINKED		1		/* HC sees this */
340 #define	QH_STATE_UNLINK		2		/* HC may still see this */
341 #define	QH_STATE_IDLE		3		/* HC doesn't see this */
342 #define	QH_STATE_UNLINK_WAIT	4		/* LINKED and on reclaim q */
343 #define	QH_STATE_COMPLETING	5		/* don't touch token.HALT */
344 
345 	/* periodic schedule info */
346 	u8			usecs;		/* intr bandwidth */
347 	u8			gap_uf;		/* uframes split/csplit gap */
348 	u8			c_usecs;	/* ... split completion bw */
349 	u16			tt_usecs;	/* tt downstream bandwidth */
350 	unsigned short		period;		/* polling interval */
351 	unsigned short		start;		/* where polling starts */
352 #define NO_FRAME ((unsigned short)~0)			/* pick new start */
353 	struct usb_device	*dev;		/* access to TT */
354 } __aligned(32);
355 
356 /*
357  * Proper OXU210HP structs
358  */
359 
360 #define OXU_OTG_CORE_OFFSET	0x00400
361 #define OXU_OTG_CAP_OFFSET	(OXU_OTG_CORE_OFFSET + 0x100)
362 #define OXU_SPH_CORE_OFFSET	0x00800
363 #define OXU_SPH_CAP_OFFSET	(OXU_SPH_CORE_OFFSET + 0x100)
364 
365 #define OXU_OTG_MEM		0xE000
366 #define OXU_SPH_MEM		0x16000
367 
368 /* Only how many elements & element structure are specifies here. */
369 /* 2 host controllers are enabled - total size <= 28 kbytes */
370 #define	DEFAULT_I_TDPS		1024
371 #define QHEAD_NUM		16
372 #define QTD_NUM			32
373 #define SITD_NUM		8
374 #define MURB_NUM		8
375 
376 #define BUFFER_NUM		8
377 #define BUFFER_SIZE		512
378 
379 struct oxu_info {
380 	struct usb_hcd *hcd[2];
381 };
382 
383 struct oxu_buf {
384 	u8			buffer[BUFFER_SIZE];
385 } __aligned(BUFFER_SIZE);
386 
387 struct oxu_onchip_mem {
388 	struct oxu_buf		db_pool[BUFFER_NUM];
389 
390 	u32			frame_list[DEFAULT_I_TDPS];
391 	struct ehci_qh		qh_pool[QHEAD_NUM];
392 	struct ehci_qtd		qtd_pool[QTD_NUM];
393 } __aligned(4 << 10);
394 
395 #define	EHCI_MAX_ROOT_PORTS	15		/* see HCS_N_PORTS */
396 
397 struct oxu_murb {
398 	struct urb		urb;
399 	struct urb		*main;
400 	u8			last;
401 };
402 
403 struct oxu_hcd {				/* one per controller */
404 	unsigned int		is_otg:1;
405 
406 	u8			qh_used[QHEAD_NUM];
407 	u8			qtd_used[QTD_NUM];
408 	u8			db_used[BUFFER_NUM];
409 	u8			murb_used[MURB_NUM];
410 
411 	struct oxu_onchip_mem	__iomem *mem;
412 	spinlock_t		mem_lock;
413 
414 	struct timer_list	urb_timer;
415 
416 	struct ehci_caps __iomem *caps;
417 	struct ehci_regs __iomem *regs;
418 
419 	u32			hcs_params;	/* cached register copy */
420 	spinlock_t		lock;
421 
422 	/* async schedule support */
423 	struct ehci_qh		*async;
424 	struct ehci_qh		*reclaim;
425 	unsigned int		reclaim_ready:1;
426 	unsigned int		scanning:1;
427 
428 	/* periodic schedule support */
429 	unsigned int		periodic_size;
430 	__le32			*periodic;	/* hw periodic table */
431 	dma_addr_t		periodic_dma;
432 	unsigned int		i_thresh;	/* uframes HC might cache */
433 
434 	union ehci_shadow	*pshadow;	/* mirror hw periodic table */
435 	int			next_uframe;	/* scan periodic, start here */
436 	unsigned int		periodic_sched;	/* periodic activity count */
437 
438 	/* per root hub port */
439 	unsigned long		reset_done[EHCI_MAX_ROOT_PORTS];
440 	/* bit vectors (one bit per port) */
441 	unsigned long		bus_suspended;	/* which ports were
442 						 * already suspended at the
443 						 * start of a bus suspend
444 						 */
445 	unsigned long		companion_ports;/* which ports are dedicated
446 						 * to the companion controller
447 						 */
448 
449 	struct timer_list	watchdog;
450 	unsigned long		actions;
451 	unsigned int		stamp;
452 	unsigned long		next_statechange;
453 	u32			command;
454 
455 	/* SILICON QUIRKS */
456 	struct list_head	urb_list;	/* this is the head to urb
457 						 * queue that didn't get enough
458 						 * resources
459 						 */
460 	struct oxu_murb		*murb_pool;	/* murb per split big urb */
461 	unsigned int		urb_len;
462 
463 	u8			sbrn;		/* packed release number */
464 };
465 
466 #define EHCI_IAA_JIFFIES	(HZ/100)	/* arbitrary; ~10 msec */
467 #define EHCI_IO_JIFFIES		(HZ/10)		/* io watchdog > irq_thresh */
468 #define EHCI_ASYNC_JIFFIES      (HZ/20)		/* async idle timeout */
469 #define EHCI_SHRINK_JIFFIES     (HZ/200)	/* async qh unlink delay */
470 
471 enum ehci_timer_action {
472 	TIMER_IO_WATCHDOG,
473 	TIMER_IAA_WATCHDOG,
474 	TIMER_ASYNC_SHRINK,
475 	TIMER_ASYNC_OFF,
476 };
477 
478 /*
479  * Main defines
480  */
481 
482 #define oxu_dbg(oxu, fmt, args...) \
483 		dev_dbg(oxu_to_hcd(oxu)->self.controller , fmt , ## args)
484 #define oxu_err(oxu, fmt, args...) \
485 		dev_err(oxu_to_hcd(oxu)->self.controller , fmt , ## args)
486 #define oxu_info(oxu, fmt, args...) \
487 		dev_info(oxu_to_hcd(oxu)->self.controller , fmt , ## args)
488 
489 #ifdef CONFIG_DYNAMIC_DEBUG
490 #define DEBUG
491 #endif
492 
493 static inline struct usb_hcd *oxu_to_hcd(struct oxu_hcd *oxu)
494 {
495 	return container_of((void *) oxu, struct usb_hcd, hcd_priv);
496 }
497 
498 static inline struct oxu_hcd *hcd_to_oxu(struct usb_hcd *hcd)
499 {
500 	return (struct oxu_hcd *) (hcd->hcd_priv);
501 }
502 
503 /*
504  * Debug stuff
505  */
506 
507 #undef OXU_URB_TRACE
508 #undef OXU_VERBOSE_DEBUG
509 
510 #ifdef OXU_VERBOSE_DEBUG
511 #define oxu_vdbg			oxu_dbg
512 #else
513 #define oxu_vdbg(oxu, fmt, args...)	/* Nop */
514 #endif
515 
516 #ifdef DEBUG
517 
518 static int __attribute__((__unused__))
519 dbg_status_buf(char *buf, unsigned len, const char *label, u32 status)
520 {
521 	return scnprintf(buf, len, "%s%sstatus %04x%s%s%s%s%s%s%s%s%s%s",
522 		label, label[0] ? " " : "", status,
523 		(status & STS_ASS) ? " Async" : "",
524 		(status & STS_PSS) ? " Periodic" : "",
525 		(status & STS_RECL) ? " Recl" : "",
526 		(status & STS_HALT) ? " Halt" : "",
527 		(status & STS_IAA) ? " IAA" : "",
528 		(status & STS_FATAL) ? " FATAL" : "",
529 		(status & STS_FLR) ? " FLR" : "",
530 		(status & STS_PCD) ? " PCD" : "",
531 		(status & STS_ERR) ? " ERR" : "",
532 		(status & STS_INT) ? " INT" : ""
533 		);
534 }
535 
536 static int __attribute__((__unused__))
537 dbg_intr_buf(char *buf, unsigned len, const char *label, u32 enable)
538 {
539 	return scnprintf(buf, len, "%s%sintrenable %02x%s%s%s%s%s%s",
540 		label, label[0] ? " " : "", enable,
541 		(enable & STS_IAA) ? " IAA" : "",
542 		(enable & STS_FATAL) ? " FATAL" : "",
543 		(enable & STS_FLR) ? " FLR" : "",
544 		(enable & STS_PCD) ? " PCD" : "",
545 		(enable & STS_ERR) ? " ERR" : "",
546 		(enable & STS_INT) ? " INT" : ""
547 		);
548 }
549 
550 static const char *const fls_strings[] =
551     { "1024", "512", "256", "??" };
552 
553 static int dbg_command_buf(char *buf, unsigned len,
554 				const char *label, u32 command)
555 {
556 	return scnprintf(buf, len,
557 		"%s%scommand %06x %s=%d ithresh=%d%s%s%s%s period=%s%s %s",
558 		label, label[0] ? " " : "", command,
559 		(command & CMD_PARK) ? "park" : "(park)",
560 		CMD_PARK_CNT(command),
561 		(command >> 16) & 0x3f,
562 		(command & CMD_LRESET) ? " LReset" : "",
563 		(command & CMD_IAAD) ? " IAAD" : "",
564 		(command & CMD_ASE) ? " Async" : "",
565 		(command & CMD_PSE) ? " Periodic" : "",
566 		fls_strings[(command >> 2) & 0x3],
567 		(command & CMD_RESET) ? " Reset" : "",
568 		(command & CMD_RUN) ? "RUN" : "HALT"
569 		);
570 }
571 
572 static int dbg_port_buf(char *buf, unsigned len, const char *label,
573 				int port, u32 status)
574 {
575 	char	*sig;
576 
577 	/* signaling state */
578 	switch (status & (3 << 10)) {
579 	case 0 << 10:
580 		sig = "se0";
581 		break;
582 	case 1 << 10:
583 		sig = "k";	/* low speed */
584 		break;
585 	case 2 << 10:
586 		sig = "j";
587 		break;
588 	default:
589 		sig = "?";
590 		break;
591 	}
592 
593 	return scnprintf(buf, len,
594 		"%s%sport %d status %06x%s%s sig=%s%s%s%s%s%s%s%s%s%s",
595 		label, label[0] ? " " : "", port, status,
596 		(status & PORT_POWER) ? " POWER" : "",
597 		(status & PORT_OWNER) ? " OWNER" : "",
598 		sig,
599 		(status & PORT_RESET) ? " RESET" : "",
600 		(status & PORT_SUSPEND) ? " SUSPEND" : "",
601 		(status & PORT_RESUME) ? " RESUME" : "",
602 		(status & PORT_OCC) ? " OCC" : "",
603 		(status & PORT_OC) ? " OC" : "",
604 		(status & PORT_PEC) ? " PEC" : "",
605 		(status & PORT_PE) ? " PE" : "",
606 		(status & PORT_CSC) ? " CSC" : "",
607 		(status & PORT_CONNECT) ? " CONNECT" : ""
608 	    );
609 }
610 
611 #else
612 
613 static inline int __attribute__((__unused__))
614 dbg_status_buf(char *buf, unsigned len, const char *label, u32 status)
615 { return 0; }
616 
617 static inline int __attribute__((__unused__))
618 dbg_command_buf(char *buf, unsigned len, const char *label, u32 command)
619 { return 0; }
620 
621 static inline int __attribute__((__unused__))
622 dbg_intr_buf(char *buf, unsigned len, const char *label, u32 enable)
623 { return 0; }
624 
625 static inline int __attribute__((__unused__))
626 dbg_port_buf(char *buf, unsigned len, const char *label, int port, u32 status)
627 { return 0; }
628 
629 #endif /* DEBUG */
630 
631 /* functions have the "wrong" filename when they're output... */
632 #define dbg_status(oxu, label, status) { \
633 	char _buf[80]; \
634 	dbg_status_buf(_buf, sizeof _buf, label, status); \
635 	oxu_dbg(oxu, "%s\n", _buf); \
636 }
637 
638 #define dbg_cmd(oxu, label, command) { \
639 	char _buf[80]; \
640 	dbg_command_buf(_buf, sizeof _buf, label, command); \
641 	oxu_dbg(oxu, "%s\n", _buf); \
642 }
643 
644 #define dbg_port(oxu, label, port, status) { \
645 	char _buf[80]; \
646 	dbg_port_buf(_buf, sizeof _buf, label, port, status); \
647 	oxu_dbg(oxu, "%s\n", _buf); \
648 }
649 
650 /*
651  * Module parameters
652  */
653 
654 /* Initial IRQ latency: faster than hw default */
655 static int log2_irq_thresh;			/* 0 to 6 */
656 module_param(log2_irq_thresh, int, S_IRUGO);
657 MODULE_PARM_DESC(log2_irq_thresh, "log2 IRQ latency, 1-64 microframes");
658 
659 /* Initial park setting: slower than hw default */
660 static unsigned park;
661 module_param(park, uint, S_IRUGO);
662 MODULE_PARM_DESC(park, "park setting; 1-3 back-to-back async packets");
663 
664 /* For flakey hardware, ignore overcurrent indicators */
665 static bool ignore_oc;
666 module_param(ignore_oc, bool, S_IRUGO);
667 MODULE_PARM_DESC(ignore_oc, "ignore bogus hardware overcurrent indications");
668 
669 
670 static void ehci_work(struct oxu_hcd *oxu);
671 static int oxu_hub_control(struct usb_hcd *hcd,
672 				u16 typeReq, u16 wValue, u16 wIndex,
673 				char *buf, u16 wLength);
674 
675 /*
676  * Local functions
677  */
678 
679 /* Low level read/write registers functions */
680 static inline u32 oxu_readl(void __iomem *base, u32 reg)
681 {
682 	return readl(base + reg);
683 }
684 
685 static inline void oxu_writel(void __iomem *base, u32 reg, u32 val)
686 {
687 	writel(val, base + reg);
688 }
689 
690 static inline void timer_action_done(struct oxu_hcd *oxu,
691 					enum ehci_timer_action action)
692 {
693 	clear_bit(action, &oxu->actions);
694 }
695 
696 static inline void timer_action(struct oxu_hcd *oxu,
697 					enum ehci_timer_action action)
698 {
699 	if (!test_and_set_bit(action, &oxu->actions)) {
700 		unsigned long t;
701 
702 		switch (action) {
703 		case TIMER_IAA_WATCHDOG:
704 			t = EHCI_IAA_JIFFIES;
705 			break;
706 		case TIMER_IO_WATCHDOG:
707 			t = EHCI_IO_JIFFIES;
708 			break;
709 		case TIMER_ASYNC_OFF:
710 			t = EHCI_ASYNC_JIFFIES;
711 			break;
712 		case TIMER_ASYNC_SHRINK:
713 		default:
714 			t = EHCI_SHRINK_JIFFIES;
715 			break;
716 		}
717 		t += jiffies;
718 		/* all timings except IAA watchdog can be overridden.
719 		 * async queue SHRINK often precedes IAA.  while it's ready
720 		 * to go OFF neither can matter, and afterwards the IO
721 		 * watchdog stops unless there's still periodic traffic.
722 		 */
723 		if (action != TIMER_IAA_WATCHDOG
724 				&& t > oxu->watchdog.expires
725 				&& timer_pending(&oxu->watchdog))
726 			return;
727 		mod_timer(&oxu->watchdog, t);
728 	}
729 }
730 
731 /*
732  * handshake - spin reading hc until handshake completes or fails
733  * @ptr: address of hc register to be read
734  * @mask: bits to look at in result of read
735  * @done: value of those bits when handshake succeeds
736  * @usec: timeout in microseconds
737  *
738  * Returns negative errno, or zero on success
739  *
740  * Success happens when the "mask" bits have the specified value (hardware
741  * handshake done).  There are two failure modes:  "usec" have passed (major
742  * hardware flakeout), or the register reads as all-ones (hardware removed).
743  *
744  * That last failure should_only happen in cases like physical cardbus eject
745  * before driver shutdown. But it also seems to be caused by bugs in cardbus
746  * bridge shutdown:  shutting down the bridge before the devices using it.
747  */
748 static int handshake(struct oxu_hcd *oxu, void __iomem *ptr,
749 					u32 mask, u32 done, int usec)
750 {
751 	u32 result;
752 	int ret;
753 
754 	ret = readl_poll_timeout_atomic(ptr, result,
755 					((result & mask) == done ||
756 					 result == U32_MAX),
757 					1, usec);
758 	if (result == U32_MAX)		/* card removed */
759 		return -ENODEV;
760 
761 	return ret;
762 }
763 
764 /* Force HC to halt state from unknown (EHCI spec section 2.3) */
765 static int ehci_halt(struct oxu_hcd *oxu)
766 {
767 	u32	temp = readl(&oxu->regs->status);
768 
769 	/* disable any irqs left enabled by previous code */
770 	writel(0, &oxu->regs->intr_enable);
771 
772 	if ((temp & STS_HALT) != 0)
773 		return 0;
774 
775 	temp = readl(&oxu->regs->command);
776 	temp &= ~CMD_RUN;
777 	writel(temp, &oxu->regs->command);
778 	return handshake(oxu, &oxu->regs->status,
779 			  STS_HALT, STS_HALT, 16 * 125);
780 }
781 
782 /* Put TDI/ARC silicon into EHCI mode */
783 static void tdi_reset(struct oxu_hcd *oxu)
784 {
785 	u32 __iomem *reg_ptr;
786 	u32 tmp;
787 
788 	reg_ptr = (u32 __iomem *)(((u8 __iomem *)oxu->regs) + 0x68);
789 	tmp = readl(reg_ptr);
790 	tmp |= 0x3;
791 	writel(tmp, reg_ptr);
792 }
793 
794 /* Reset a non-running (STS_HALT == 1) controller */
795 static int ehci_reset(struct oxu_hcd *oxu)
796 {
797 	int	retval;
798 	u32	command = readl(&oxu->regs->command);
799 
800 	command |= CMD_RESET;
801 	dbg_cmd(oxu, "reset", command);
802 	writel(command, &oxu->regs->command);
803 	oxu_to_hcd(oxu)->state = HC_STATE_HALT;
804 	oxu->next_statechange = jiffies;
805 	retval = handshake(oxu, &oxu->regs->command,
806 			    CMD_RESET, 0, 250 * 1000);
807 
808 	if (retval)
809 		return retval;
810 
811 	tdi_reset(oxu);
812 
813 	return retval;
814 }
815 
816 /* Idle the controller (from running) */
817 static void ehci_quiesce(struct oxu_hcd *oxu)
818 {
819 	u32	temp;
820 
821 #ifdef DEBUG
822 	BUG_ON(!HC_IS_RUNNING(oxu_to_hcd(oxu)->state));
823 #endif
824 
825 	/* wait for any schedule enables/disables to take effect */
826 	temp = readl(&oxu->regs->command) << 10;
827 	temp &= STS_ASS | STS_PSS;
828 	if (handshake(oxu, &oxu->regs->status, STS_ASS | STS_PSS,
829 				temp, 16 * 125) != 0) {
830 		oxu_to_hcd(oxu)->state = HC_STATE_HALT;
831 		return;
832 	}
833 
834 	/* then disable anything that's still active */
835 	temp = readl(&oxu->regs->command);
836 	temp &= ~(CMD_ASE | CMD_IAAD | CMD_PSE);
837 	writel(temp, &oxu->regs->command);
838 
839 	/* hardware can take 16 microframes to turn off ... */
840 	if (handshake(oxu, &oxu->regs->status, STS_ASS | STS_PSS,
841 				0, 16 * 125) != 0) {
842 		oxu_to_hcd(oxu)->state = HC_STATE_HALT;
843 		return;
844 	}
845 }
846 
847 static int check_reset_complete(struct oxu_hcd *oxu, int index,
848 				u32 __iomem *status_reg, int port_status)
849 {
850 	if (!(port_status & PORT_CONNECT)) {
851 		oxu->reset_done[index] = 0;
852 		return port_status;
853 	}
854 
855 	/* if reset finished and it's still not enabled -- handoff */
856 	if (!(port_status & PORT_PE)) {
857 		oxu_dbg(oxu, "Failed to enable port %d on root hub TT\n",
858 				index+1);
859 		return port_status;
860 	} else
861 		oxu_dbg(oxu, "port %d high speed\n", index + 1);
862 
863 	return port_status;
864 }
865 
866 static void ehci_hub_descriptor(struct oxu_hcd *oxu,
867 				struct usb_hub_descriptor *desc)
868 {
869 	int ports = HCS_N_PORTS(oxu->hcs_params);
870 	u16 temp;
871 
872 	desc->bDescriptorType = USB_DT_HUB;
873 	desc->bPwrOn2PwrGood = 10;	/* oxu 1.0, 2.3.9 says 20ms max */
874 	desc->bHubContrCurrent = 0;
875 
876 	desc->bNbrPorts = ports;
877 	temp = 1 + (ports / 8);
878 	desc->bDescLength = 7 + 2 * temp;
879 
880 	/* ports removable, and usb 1.0 legacy PortPwrCtrlMask */
881 	memset(&desc->u.hs.DeviceRemovable[0], 0, temp);
882 	memset(&desc->u.hs.DeviceRemovable[temp], 0xff, temp);
883 
884 	temp = HUB_CHAR_INDV_PORT_OCPM;	/* per-port overcurrent reporting */
885 	if (HCS_PPC(oxu->hcs_params))
886 		temp |= HUB_CHAR_INDV_PORT_LPSM; /* per-port power control */
887 	else
888 		temp |= HUB_CHAR_NO_LPSM; /* no power switching */
889 	desc->wHubCharacteristics = (__force __u16)cpu_to_le16(temp);
890 }
891 
892 
893 /* Allocate an OXU210HP on-chip memory data buffer
894  *
895  * An on-chip memory data buffer is required for each OXU210HP USB transfer.
896  * Each transfer descriptor has one or more on-chip memory data buffers.
897  *
898  * Data buffers are allocated from a fix sized pool of data blocks.
899  * To minimise fragmentation and give reasonable memory utlisation,
900  * data buffers are allocated with sizes the power of 2 multiples of
901  * the block size, starting on an address a multiple of the allocated size.
902  *
903  * FIXME: callers of this function require a buffer to be allocated for
904  * len=0. This is a waste of on-chip memory and should be fix. Then this
905  * function should be changed to not allocate a buffer for len=0.
906  */
907 static int oxu_buf_alloc(struct oxu_hcd *oxu, struct ehci_qtd *qtd, int len)
908 {
909 	int n_blocks;	/* minium blocks needed to hold len */
910 	int a_blocks;	/* blocks allocated */
911 	int i, j;
912 
913 	/* Don't allocte bigger than supported */
914 	if (len > BUFFER_SIZE * BUFFER_NUM) {
915 		oxu_err(oxu, "buffer too big (%d)\n", len);
916 		return -ENOMEM;
917 	}
918 
919 	spin_lock(&oxu->mem_lock);
920 
921 	/* Number of blocks needed to hold len */
922 	n_blocks = (len + BUFFER_SIZE - 1) / BUFFER_SIZE;
923 
924 	/* Round the number of blocks up to the power of 2 */
925 	for (a_blocks = 1; a_blocks < n_blocks; a_blocks <<= 1)
926 		;
927 
928 	/* Find a suitable available data buffer */
929 	for (i = 0; i < BUFFER_NUM;
930 			i += max(a_blocks, (int)oxu->db_used[i])) {
931 
932 		/* Check all the required blocks are available */
933 		for (j = 0; j < a_blocks; j++)
934 			if (oxu->db_used[i + j])
935 				break;
936 
937 		if (j != a_blocks)
938 			continue;
939 
940 		/* Allocate blocks found! */
941 		qtd->buffer = (void *) &oxu->mem->db_pool[i];
942 		qtd->buffer_dma = virt_to_phys(qtd->buffer);
943 
944 		qtd->qtd_buffer_len = BUFFER_SIZE * a_blocks;
945 		oxu->db_used[i] = a_blocks;
946 
947 		spin_unlock(&oxu->mem_lock);
948 
949 		return 0;
950 	}
951 
952 	/* Failed */
953 
954 	spin_unlock(&oxu->mem_lock);
955 
956 	return -ENOMEM;
957 }
958 
959 static void oxu_buf_free(struct oxu_hcd *oxu, struct ehci_qtd *qtd)
960 {
961 	int index;
962 
963 	spin_lock(&oxu->mem_lock);
964 
965 	index = (qtd->buffer - (void *) &oxu->mem->db_pool[0])
966 							 / BUFFER_SIZE;
967 	oxu->db_used[index] = 0;
968 	qtd->qtd_buffer_len = 0;
969 	qtd->buffer_dma = 0;
970 	qtd->buffer = NULL;
971 
972 	spin_unlock(&oxu->mem_lock);
973 }
974 
975 static inline void ehci_qtd_init(struct ehci_qtd *qtd, dma_addr_t dma)
976 {
977 	memset(qtd, 0, sizeof *qtd);
978 	qtd->qtd_dma = dma;
979 	qtd->hw_token = cpu_to_le32(QTD_STS_HALT);
980 	qtd->hw_next = EHCI_LIST_END;
981 	qtd->hw_alt_next = EHCI_LIST_END;
982 	INIT_LIST_HEAD(&qtd->qtd_list);
983 }
984 
985 static inline void oxu_qtd_free(struct oxu_hcd *oxu, struct ehci_qtd *qtd)
986 {
987 	int index;
988 
989 	if (qtd->buffer)
990 		oxu_buf_free(oxu, qtd);
991 
992 	spin_lock(&oxu->mem_lock);
993 
994 	index = qtd - &oxu->mem->qtd_pool[0];
995 	oxu->qtd_used[index] = 0;
996 
997 	spin_unlock(&oxu->mem_lock);
998 }
999 
1000 static struct ehci_qtd *ehci_qtd_alloc(struct oxu_hcd *oxu)
1001 {
1002 	int i;
1003 	struct ehci_qtd *qtd = NULL;
1004 
1005 	spin_lock(&oxu->mem_lock);
1006 
1007 	for (i = 0; i < QTD_NUM; i++)
1008 		if (!oxu->qtd_used[i])
1009 			break;
1010 
1011 	if (i < QTD_NUM) {
1012 		qtd = (struct ehci_qtd *) &oxu->mem->qtd_pool[i];
1013 		memset(qtd, 0, sizeof *qtd);
1014 
1015 		qtd->hw_token = cpu_to_le32(QTD_STS_HALT);
1016 		qtd->hw_next = EHCI_LIST_END;
1017 		qtd->hw_alt_next = EHCI_LIST_END;
1018 		INIT_LIST_HEAD(&qtd->qtd_list);
1019 
1020 		qtd->qtd_dma = virt_to_phys(qtd);
1021 
1022 		oxu->qtd_used[i] = 1;
1023 	}
1024 
1025 	spin_unlock(&oxu->mem_lock);
1026 
1027 	return qtd;
1028 }
1029 
1030 static void oxu_qh_free(struct oxu_hcd *oxu, struct ehci_qh *qh)
1031 {
1032 	int index;
1033 
1034 	spin_lock(&oxu->mem_lock);
1035 
1036 	index = qh - &oxu->mem->qh_pool[0];
1037 	oxu->qh_used[index] = 0;
1038 
1039 	spin_unlock(&oxu->mem_lock);
1040 }
1041 
1042 static void qh_destroy(struct kref *kref)
1043 {
1044 	struct ehci_qh *qh = container_of(kref, struct ehci_qh, kref);
1045 	struct oxu_hcd *oxu = qh->oxu;
1046 
1047 	/* clean qtds first, and know this is not linked */
1048 	if (!list_empty(&qh->qtd_list) || qh->qh_next.ptr) {
1049 		oxu_dbg(oxu, "unused qh not empty!\n");
1050 		BUG();
1051 	}
1052 	if (qh->dummy)
1053 		oxu_qtd_free(oxu, qh->dummy);
1054 	oxu_qh_free(oxu, qh);
1055 }
1056 
1057 static struct ehci_qh *oxu_qh_alloc(struct oxu_hcd *oxu)
1058 {
1059 	int i;
1060 	struct ehci_qh *qh = NULL;
1061 
1062 	spin_lock(&oxu->mem_lock);
1063 
1064 	for (i = 0; i < QHEAD_NUM; i++)
1065 		if (!oxu->qh_used[i])
1066 			break;
1067 
1068 	if (i < QHEAD_NUM) {
1069 		qh = (struct ehci_qh *) &oxu->mem->qh_pool[i];
1070 		memset(qh, 0, sizeof *qh);
1071 
1072 		kref_init(&qh->kref);
1073 		qh->oxu = oxu;
1074 		qh->qh_dma = virt_to_phys(qh);
1075 		INIT_LIST_HEAD(&qh->qtd_list);
1076 
1077 		/* dummy td enables safe urb queuing */
1078 		qh->dummy = ehci_qtd_alloc(oxu);
1079 		if (qh->dummy == NULL) {
1080 			oxu_dbg(oxu, "no dummy td\n");
1081 			oxu->qh_used[i] = 0;
1082 			qh = NULL;
1083 			goto unlock;
1084 		}
1085 
1086 		oxu->qh_used[i] = 1;
1087 	}
1088 unlock:
1089 	spin_unlock(&oxu->mem_lock);
1090 
1091 	return qh;
1092 }
1093 
1094 /* to share a qh (cpu threads, or hc) */
1095 static inline struct ehci_qh *qh_get(struct ehci_qh *qh)
1096 {
1097 	kref_get(&qh->kref);
1098 	return qh;
1099 }
1100 
1101 static inline void qh_put(struct ehci_qh *qh)
1102 {
1103 	kref_put(&qh->kref, qh_destroy);
1104 }
1105 
1106 static void oxu_murb_free(struct oxu_hcd *oxu, struct oxu_murb *murb)
1107 {
1108 	int index;
1109 
1110 	spin_lock(&oxu->mem_lock);
1111 
1112 	index = murb - &oxu->murb_pool[0];
1113 	oxu->murb_used[index] = 0;
1114 
1115 	spin_unlock(&oxu->mem_lock);
1116 }
1117 
1118 static struct oxu_murb *oxu_murb_alloc(struct oxu_hcd *oxu)
1119 
1120 {
1121 	int i;
1122 	struct oxu_murb *murb = NULL;
1123 
1124 	spin_lock(&oxu->mem_lock);
1125 
1126 	for (i = 0; i < MURB_NUM; i++)
1127 		if (!oxu->murb_used[i])
1128 			break;
1129 
1130 	if (i < MURB_NUM) {
1131 		murb = &(oxu->murb_pool)[i];
1132 
1133 		oxu->murb_used[i] = 1;
1134 	}
1135 
1136 	spin_unlock(&oxu->mem_lock);
1137 
1138 	return murb;
1139 }
1140 
1141 /* The queue heads and transfer descriptors are managed from pools tied
1142  * to each of the "per device" structures.
1143  * This is the initialisation and cleanup code.
1144  */
1145 static void ehci_mem_cleanup(struct oxu_hcd *oxu)
1146 {
1147 	kfree(oxu->murb_pool);
1148 	oxu->murb_pool = NULL;
1149 
1150 	if (oxu->async)
1151 		qh_put(oxu->async);
1152 	oxu->async = NULL;
1153 
1154 	del_timer(&oxu->urb_timer);
1155 
1156 	oxu->periodic = NULL;
1157 
1158 	/* shadow periodic table */
1159 	kfree(oxu->pshadow);
1160 	oxu->pshadow = NULL;
1161 }
1162 
1163 /* Remember to add cleanup code (above) if you add anything here.
1164  */
1165 static int ehci_mem_init(struct oxu_hcd *oxu, gfp_t flags)
1166 {
1167 	int i;
1168 
1169 	for (i = 0; i < oxu->periodic_size; i++)
1170 		oxu->mem->frame_list[i] = EHCI_LIST_END;
1171 	for (i = 0; i < QHEAD_NUM; i++)
1172 		oxu->qh_used[i] = 0;
1173 	for (i = 0; i < QTD_NUM; i++)
1174 		oxu->qtd_used[i] = 0;
1175 
1176 	oxu->murb_pool = kcalloc(MURB_NUM, sizeof(struct oxu_murb), flags);
1177 	if (!oxu->murb_pool)
1178 		goto fail;
1179 
1180 	for (i = 0; i < MURB_NUM; i++)
1181 		oxu->murb_used[i] = 0;
1182 
1183 	oxu->async = oxu_qh_alloc(oxu);
1184 	if (!oxu->async)
1185 		goto fail;
1186 
1187 	oxu->periodic = (__le32 *) &oxu->mem->frame_list;
1188 	oxu->periodic_dma = virt_to_phys(oxu->periodic);
1189 
1190 	for (i = 0; i < oxu->periodic_size; i++)
1191 		oxu->periodic[i] = EHCI_LIST_END;
1192 
1193 	/* software shadow of hardware table */
1194 	oxu->pshadow = kcalloc(oxu->periodic_size, sizeof(void *), flags);
1195 	if (oxu->pshadow != NULL)
1196 		return 0;
1197 
1198 fail:
1199 	oxu_dbg(oxu, "couldn't init memory\n");
1200 	ehci_mem_cleanup(oxu);
1201 	return -ENOMEM;
1202 }
1203 
1204 /* Fill a qtd, returning how much of the buffer we were able to queue up.
1205  */
1206 static int qtd_fill(struct ehci_qtd *qtd, dma_addr_t buf, size_t len,
1207 				int token, int maxpacket)
1208 {
1209 	int i, count;
1210 	u64 addr = buf;
1211 
1212 	/* one buffer entry per 4K ... first might be short or unaligned */
1213 	qtd->hw_buf[0] = cpu_to_le32((u32)addr);
1214 	qtd->hw_buf_hi[0] = cpu_to_le32((u32)(addr >> 32));
1215 	count = 0x1000 - (buf & 0x0fff);	/* rest of that page */
1216 	if (likely(len < count))		/* ... iff needed */
1217 		count = len;
1218 	else {
1219 		buf +=  0x1000;
1220 		buf &= ~0x0fff;
1221 
1222 		/* per-qtd limit: from 16K to 20K (best alignment) */
1223 		for (i = 1; count < len && i < 5; i++) {
1224 			addr = buf;
1225 			qtd->hw_buf[i] = cpu_to_le32((u32)addr);
1226 			qtd->hw_buf_hi[i] = cpu_to_le32((u32)(addr >> 32));
1227 			buf += 0x1000;
1228 			if ((count + 0x1000) < len)
1229 				count += 0x1000;
1230 			else
1231 				count = len;
1232 		}
1233 
1234 		/* short packets may only terminate transfers */
1235 		if (count != len)
1236 			count -= (count % maxpacket);
1237 	}
1238 	qtd->hw_token = cpu_to_le32((count << 16) | token);
1239 	qtd->length = count;
1240 
1241 	return count;
1242 }
1243 
1244 static inline void qh_update(struct oxu_hcd *oxu,
1245 				struct ehci_qh *qh, struct ehci_qtd *qtd)
1246 {
1247 	/* writes to an active overlay are unsafe */
1248 	BUG_ON(qh->qh_state != QH_STATE_IDLE);
1249 
1250 	qh->hw_qtd_next = QTD_NEXT(qtd->qtd_dma);
1251 	qh->hw_alt_next = EHCI_LIST_END;
1252 
1253 	/* Except for control endpoints, we make hardware maintain data
1254 	 * toggle (like OHCI) ... here (re)initialize the toggle in the QH,
1255 	 * and set the pseudo-toggle in udev. Only usb_clear_halt() will
1256 	 * ever clear it.
1257 	 */
1258 	if (!(qh->hw_info1 & cpu_to_le32(1 << 14))) {
1259 		unsigned	is_out, epnum;
1260 
1261 		is_out = !(qtd->hw_token & cpu_to_le32(1 << 8));
1262 		epnum = (le32_to_cpup(&qh->hw_info1) >> 8) & 0x0f;
1263 		if (unlikely(!usb_gettoggle(qh->dev, epnum, is_out))) {
1264 			qh->hw_token &= ~cpu_to_le32(QTD_TOGGLE);
1265 			usb_settoggle(qh->dev, epnum, is_out, 1);
1266 		}
1267 	}
1268 
1269 	/* HC must see latest qtd and qh data before we clear ACTIVE+HALT */
1270 	wmb();
1271 	qh->hw_token &= cpu_to_le32(QTD_TOGGLE | QTD_STS_PING);
1272 }
1273 
1274 /* If it weren't for a common silicon quirk (writing the dummy into the qh
1275  * overlay, so qh->hw_token wrongly becomes inactive/halted), only fault
1276  * recovery (including urb dequeue) would need software changes to a QH...
1277  */
1278 static void qh_refresh(struct oxu_hcd *oxu, struct ehci_qh *qh)
1279 {
1280 	struct ehci_qtd *qtd;
1281 
1282 	if (list_empty(&qh->qtd_list))
1283 		qtd = qh->dummy;
1284 	else {
1285 		qtd = list_entry(qh->qtd_list.next,
1286 				struct ehci_qtd, qtd_list);
1287 		/* first qtd may already be partially processed */
1288 		if (cpu_to_le32(qtd->qtd_dma) == qh->hw_current)
1289 			qtd = NULL;
1290 	}
1291 
1292 	if (qtd)
1293 		qh_update(oxu, qh, qtd);
1294 }
1295 
1296 static void qtd_copy_status(struct oxu_hcd *oxu, struct urb *urb,
1297 				size_t length, u32 token)
1298 {
1299 	/* count IN/OUT bytes, not SETUP (even short packets) */
1300 	if (likely(QTD_PID(token) != 2))
1301 		urb->actual_length += length - QTD_LENGTH(token);
1302 
1303 	/* don't modify error codes */
1304 	if (unlikely(urb->status != -EINPROGRESS))
1305 		return;
1306 
1307 	/* force cleanup after short read; not always an error */
1308 	if (unlikely(IS_SHORT_READ(token)))
1309 		urb->status = -EREMOTEIO;
1310 
1311 	/* serious "can't proceed" faults reported by the hardware */
1312 	if (token & QTD_STS_HALT) {
1313 		if (token & QTD_STS_BABBLE) {
1314 			/* FIXME "must" disable babbling device's port too */
1315 			urb->status = -EOVERFLOW;
1316 		} else if (token & QTD_STS_MMF) {
1317 			/* fs/ls interrupt xfer missed the complete-split */
1318 			urb->status = -EPROTO;
1319 		} else if (token & QTD_STS_DBE) {
1320 			urb->status = (QTD_PID(token) == 1) /* IN ? */
1321 				? -ENOSR  /* hc couldn't read data */
1322 				: -ECOMM; /* hc couldn't write data */
1323 		} else if (token & QTD_STS_XACT) {
1324 			/* timeout, bad crc, wrong PID, etc; retried */
1325 			if (QTD_CERR(token))
1326 				urb->status = -EPIPE;
1327 			else {
1328 				oxu_dbg(oxu, "devpath %s ep%d%s 3strikes\n",
1329 					urb->dev->devpath,
1330 					usb_pipeendpoint(urb->pipe),
1331 					usb_pipein(urb->pipe) ? "in" : "out");
1332 				urb->status = -EPROTO;
1333 			}
1334 		/* CERR nonzero + no errors + halt --> stall */
1335 		} else if (QTD_CERR(token))
1336 			urb->status = -EPIPE;
1337 		else	/* unknown */
1338 			urb->status = -EPROTO;
1339 
1340 		oxu_vdbg(oxu, "dev%d ep%d%s qtd token %08x --> status %d\n",
1341 			usb_pipedevice(urb->pipe),
1342 			usb_pipeendpoint(urb->pipe),
1343 			usb_pipein(urb->pipe) ? "in" : "out",
1344 			token, urb->status);
1345 	}
1346 }
1347 
1348 static void ehci_urb_done(struct oxu_hcd *oxu, struct urb *urb)
1349 __releases(oxu->lock)
1350 __acquires(oxu->lock)
1351 {
1352 	if (likely(urb->hcpriv != NULL)) {
1353 		struct ehci_qh	*qh = (struct ehci_qh *) urb->hcpriv;
1354 
1355 		/* S-mask in a QH means it's an interrupt urb */
1356 		if ((qh->hw_info2 & cpu_to_le32(QH_SMASK)) != 0) {
1357 
1358 			/* ... update hc-wide periodic stats (for usbfs) */
1359 			oxu_to_hcd(oxu)->self.bandwidth_int_reqs--;
1360 		}
1361 		qh_put(qh);
1362 	}
1363 
1364 	urb->hcpriv = NULL;
1365 	switch (urb->status) {
1366 	case -EINPROGRESS:		/* success */
1367 		urb->status = 0;
1368 	default:			/* fault */
1369 		break;
1370 	case -EREMOTEIO:		/* fault or normal */
1371 		if (!(urb->transfer_flags & URB_SHORT_NOT_OK))
1372 			urb->status = 0;
1373 		break;
1374 	case -ECONNRESET:		/* canceled */
1375 	case -ENOENT:
1376 		break;
1377 	}
1378 
1379 #ifdef OXU_URB_TRACE
1380 	oxu_dbg(oxu, "%s %s urb %p ep%d%s status %d len %d/%d\n",
1381 		__func__, urb->dev->devpath, urb,
1382 		usb_pipeendpoint(urb->pipe),
1383 		usb_pipein(urb->pipe) ? "in" : "out",
1384 		urb->status,
1385 		urb->actual_length, urb->transfer_buffer_length);
1386 #endif
1387 
1388 	/* complete() can reenter this HCD */
1389 	spin_unlock(&oxu->lock);
1390 	usb_hcd_giveback_urb(oxu_to_hcd(oxu), urb, urb->status);
1391 	spin_lock(&oxu->lock);
1392 }
1393 
1394 static void start_unlink_async(struct oxu_hcd *oxu, struct ehci_qh *qh);
1395 static void unlink_async(struct oxu_hcd *oxu, struct ehci_qh *qh);
1396 
1397 static void intr_deschedule(struct oxu_hcd *oxu, struct ehci_qh *qh);
1398 static int qh_schedule(struct oxu_hcd *oxu, struct ehci_qh *qh);
1399 
1400 #define HALT_BIT cpu_to_le32(QTD_STS_HALT)
1401 
1402 /* Process and free completed qtds for a qh, returning URBs to drivers.
1403  * Chases up to qh->hw_current.  Returns number of completions called,
1404  * indicating how much "real" work we did.
1405  */
1406 static unsigned qh_completions(struct oxu_hcd *oxu, struct ehci_qh *qh)
1407 {
1408 	struct ehci_qtd *last = NULL, *end = qh->dummy;
1409 	struct ehci_qtd	*qtd, *tmp;
1410 	int stopped;
1411 	unsigned count = 0;
1412 	int do_status = 0;
1413 	u8 state;
1414 	struct oxu_murb *murb = NULL;
1415 
1416 	if (unlikely(list_empty(&qh->qtd_list)))
1417 		return count;
1418 
1419 	/* completions (or tasks on other cpus) must never clobber HALT
1420 	 * till we've gone through and cleaned everything up, even when
1421 	 * they add urbs to this qh's queue or mark them for unlinking.
1422 	 *
1423 	 * NOTE:  unlinking expects to be done in queue order.
1424 	 */
1425 	state = qh->qh_state;
1426 	qh->qh_state = QH_STATE_COMPLETING;
1427 	stopped = (state == QH_STATE_IDLE);
1428 
1429 	/* remove de-activated QTDs from front of queue.
1430 	 * after faults (including short reads), cleanup this urb
1431 	 * then let the queue advance.
1432 	 * if queue is stopped, handles unlinks.
1433 	 */
1434 	list_for_each_entry_safe(qtd, tmp, &qh->qtd_list, qtd_list) {
1435 		struct urb *urb;
1436 		u32 token = 0;
1437 
1438 		urb = qtd->urb;
1439 
1440 		/* Clean up any state from previous QTD ...*/
1441 		if (last) {
1442 			if (likely(last->urb != urb)) {
1443 				if (last->urb->complete == NULL) {
1444 					murb = (struct oxu_murb *) last->urb;
1445 					last->urb = murb->main;
1446 					if (murb->last) {
1447 						ehci_urb_done(oxu, last->urb);
1448 						count++;
1449 					}
1450 					oxu_murb_free(oxu, murb);
1451 				} else {
1452 					ehci_urb_done(oxu, last->urb);
1453 					count++;
1454 				}
1455 			}
1456 			oxu_qtd_free(oxu, last);
1457 			last = NULL;
1458 		}
1459 
1460 		/* ignore urbs submitted during completions we reported */
1461 		if (qtd == end)
1462 			break;
1463 
1464 		/* hardware copies qtd out of qh overlay */
1465 		rmb();
1466 		token = le32_to_cpu(qtd->hw_token);
1467 
1468 		/* always clean up qtds the hc de-activated */
1469 		if ((token & QTD_STS_ACTIVE) == 0) {
1470 
1471 			if ((token & QTD_STS_HALT) != 0) {
1472 				stopped = 1;
1473 
1474 			/* magic dummy for some short reads; qh won't advance.
1475 			 * that silicon quirk can kick in with this dummy too.
1476 			 */
1477 			} else if (IS_SHORT_READ(token) &&
1478 					!(qtd->hw_alt_next & EHCI_LIST_END)) {
1479 				stopped = 1;
1480 				goto halt;
1481 			}
1482 
1483 		/* stop scanning when we reach qtds the hc is using */
1484 		} else if (likely(!stopped &&
1485 				HC_IS_RUNNING(oxu_to_hcd(oxu)->state))) {
1486 			break;
1487 
1488 		} else {
1489 			stopped = 1;
1490 
1491 			if (unlikely(!HC_IS_RUNNING(oxu_to_hcd(oxu)->state)))
1492 				urb->status = -ESHUTDOWN;
1493 
1494 			/* ignore active urbs unless some previous qtd
1495 			 * for the urb faulted (including short read) or
1496 			 * its urb was canceled.  we may patch qh or qtds.
1497 			 */
1498 			if (likely(urb->status == -EINPROGRESS))
1499 				continue;
1500 
1501 			/* issue status after short control reads */
1502 			if (unlikely(do_status != 0)
1503 					&& QTD_PID(token) == 0 /* OUT */) {
1504 				do_status = 0;
1505 				continue;
1506 			}
1507 
1508 			/* token in overlay may be most current */
1509 			if (state == QH_STATE_IDLE
1510 					&& cpu_to_le32(qtd->qtd_dma)
1511 						== qh->hw_current)
1512 				token = le32_to_cpu(qh->hw_token);
1513 
1514 			/* force halt for unlinked or blocked qh, so we'll
1515 			 * patch the qh later and so that completions can't
1516 			 * activate it while we "know" it's stopped.
1517 			 */
1518 			if ((HALT_BIT & qh->hw_token) == 0) {
1519 halt:
1520 				qh->hw_token |= HALT_BIT;
1521 				wmb();
1522 			}
1523 		}
1524 
1525 		/* Remove it from the queue */
1526 		qtd_copy_status(oxu, urb->complete ?
1527 					urb : ((struct oxu_murb *) urb)->main,
1528 				qtd->length, token);
1529 		if ((usb_pipein(qtd->urb->pipe)) &&
1530 				(NULL != qtd->transfer_buffer))
1531 			memcpy(qtd->transfer_buffer, qtd->buffer, qtd->length);
1532 		do_status = (urb->status == -EREMOTEIO)
1533 				&& usb_pipecontrol(urb->pipe);
1534 
1535 		if (stopped && qtd->qtd_list.prev != &qh->qtd_list) {
1536 			last = list_entry(qtd->qtd_list.prev,
1537 					struct ehci_qtd, qtd_list);
1538 			last->hw_next = qtd->hw_next;
1539 		}
1540 		list_del(&qtd->qtd_list);
1541 		last = qtd;
1542 	}
1543 
1544 	/* last urb's completion might still need calling */
1545 	if (likely(last != NULL)) {
1546 		if (last->urb->complete == NULL) {
1547 			murb = (struct oxu_murb *) last->urb;
1548 			last->urb = murb->main;
1549 			if (murb->last) {
1550 				ehci_urb_done(oxu, last->urb);
1551 				count++;
1552 			}
1553 			oxu_murb_free(oxu, murb);
1554 		} else {
1555 			ehci_urb_done(oxu, last->urb);
1556 			count++;
1557 		}
1558 		oxu_qtd_free(oxu, last);
1559 	}
1560 
1561 	/* restore original state; caller must unlink or relink */
1562 	qh->qh_state = state;
1563 
1564 	/* be sure the hardware's done with the qh before refreshing
1565 	 * it after fault cleanup, or recovering from silicon wrongly
1566 	 * overlaying the dummy qtd (which reduces DMA chatter).
1567 	 */
1568 	if (stopped != 0 || qh->hw_qtd_next == EHCI_LIST_END) {
1569 		switch (state) {
1570 		case QH_STATE_IDLE:
1571 			qh_refresh(oxu, qh);
1572 			break;
1573 		case QH_STATE_LINKED:
1574 			/* should be rare for periodic transfers,
1575 			 * except maybe high bandwidth ...
1576 			 */
1577 			if ((cpu_to_le32(QH_SMASK)
1578 					& qh->hw_info2) != 0) {
1579 				intr_deschedule(oxu, qh);
1580 				(void) qh_schedule(oxu, qh);
1581 			} else
1582 				unlink_async(oxu, qh);
1583 			break;
1584 		/* otherwise, unlink already started */
1585 		}
1586 	}
1587 
1588 	return count;
1589 }
1590 
1591 /* High bandwidth multiplier, as encoded in highspeed endpoint descriptors */
1592 #define hb_mult(wMaxPacketSize)		(1 + (((wMaxPacketSize) >> 11) & 0x03))
1593 /* ... and packet size, for any kind of endpoint descriptor */
1594 #define max_packet(wMaxPacketSize)	((wMaxPacketSize) & 0x07ff)
1595 
1596 /* Reverse of qh_urb_transaction: free a list of TDs.
1597  * used for cleanup after errors, before HC sees an URB's TDs.
1598  */
1599 static void qtd_list_free(struct oxu_hcd *oxu,
1600 				struct urb *urb, struct list_head *head)
1601 {
1602 	struct ehci_qtd	*qtd, *temp;
1603 
1604 	list_for_each_entry_safe(qtd, temp, head, qtd_list) {
1605 		list_del(&qtd->qtd_list);
1606 		oxu_qtd_free(oxu, qtd);
1607 	}
1608 }
1609 
1610 /* Create a list of filled qtds for this URB; won't link into qh.
1611  */
1612 static struct list_head *qh_urb_transaction(struct oxu_hcd *oxu,
1613 						struct urb *urb,
1614 						struct list_head *head,
1615 						gfp_t flags)
1616 {
1617 	struct ehci_qtd	*qtd, *qtd_prev;
1618 	dma_addr_t buf;
1619 	int len, maxpacket;
1620 	int is_input;
1621 	u32 token;
1622 	void *transfer_buf = NULL;
1623 	int ret;
1624 
1625 	/*
1626 	 * URBs map to sequences of QTDs: one logical transaction
1627 	 */
1628 	qtd = ehci_qtd_alloc(oxu);
1629 	if (unlikely(!qtd))
1630 		return NULL;
1631 	list_add_tail(&qtd->qtd_list, head);
1632 	qtd->urb = urb;
1633 
1634 	token = QTD_STS_ACTIVE;
1635 	token |= (EHCI_TUNE_CERR << 10);
1636 	/* for split transactions, SplitXState initialized to zero */
1637 
1638 	len = urb->transfer_buffer_length;
1639 	is_input = usb_pipein(urb->pipe);
1640 	if (!urb->transfer_buffer && urb->transfer_buffer_length && is_input)
1641 		urb->transfer_buffer = phys_to_virt(urb->transfer_dma);
1642 
1643 	if (usb_pipecontrol(urb->pipe)) {
1644 		/* SETUP pid */
1645 		ret = oxu_buf_alloc(oxu, qtd, sizeof(struct usb_ctrlrequest));
1646 		if (ret)
1647 			goto cleanup;
1648 
1649 		qtd_fill(qtd, qtd->buffer_dma, sizeof(struct usb_ctrlrequest),
1650 				token | (2 /* "setup" */ << 8), 8);
1651 		memcpy(qtd->buffer, qtd->urb->setup_packet,
1652 				sizeof(struct usb_ctrlrequest));
1653 
1654 		/* ... and always at least one more pid */
1655 		token ^= QTD_TOGGLE;
1656 		qtd_prev = qtd;
1657 		qtd = ehci_qtd_alloc(oxu);
1658 		if (unlikely(!qtd))
1659 			goto cleanup;
1660 		qtd->urb = urb;
1661 		qtd_prev->hw_next = QTD_NEXT(qtd->qtd_dma);
1662 		list_add_tail(&qtd->qtd_list, head);
1663 
1664 		/* for zero length DATA stages, STATUS is always IN */
1665 		if (len == 0)
1666 			token |= (1 /* "in" */ << 8);
1667 	}
1668 
1669 	/*
1670 	 * Data transfer stage: buffer setup
1671 	 */
1672 
1673 	ret = oxu_buf_alloc(oxu, qtd, len);
1674 	if (ret)
1675 		goto cleanup;
1676 
1677 	buf = qtd->buffer_dma;
1678 	transfer_buf = urb->transfer_buffer;
1679 
1680 	if (!is_input)
1681 		memcpy(qtd->buffer, qtd->urb->transfer_buffer, len);
1682 
1683 	if (is_input)
1684 		token |= (1 /* "in" */ << 8);
1685 	/* else it's already initted to "out" pid (0 << 8) */
1686 
1687 	maxpacket = max_packet(usb_maxpacket(urb->dev, urb->pipe, !is_input));
1688 
1689 	/*
1690 	 * buffer gets wrapped in one or more qtds;
1691 	 * last one may be "short" (including zero len)
1692 	 * and may serve as a control status ack
1693 	 */
1694 	for (;;) {
1695 		int this_qtd_len;
1696 
1697 		this_qtd_len = qtd_fill(qtd, buf, len, token, maxpacket);
1698 		qtd->transfer_buffer = transfer_buf;
1699 		len -= this_qtd_len;
1700 		buf += this_qtd_len;
1701 		transfer_buf += this_qtd_len;
1702 		if (is_input)
1703 			qtd->hw_alt_next = oxu->async->hw_alt_next;
1704 
1705 		/* qh makes control packets use qtd toggle; maybe switch it */
1706 		if ((maxpacket & (this_qtd_len + (maxpacket - 1))) == 0)
1707 			token ^= QTD_TOGGLE;
1708 
1709 		if (likely(len <= 0))
1710 			break;
1711 
1712 		qtd_prev = qtd;
1713 		qtd = ehci_qtd_alloc(oxu);
1714 		if (unlikely(!qtd))
1715 			goto cleanup;
1716 		if (likely(len > 0)) {
1717 			ret = oxu_buf_alloc(oxu, qtd, len);
1718 			if (ret)
1719 				goto cleanup;
1720 		}
1721 		qtd->urb = urb;
1722 		qtd_prev->hw_next = QTD_NEXT(qtd->qtd_dma);
1723 		list_add_tail(&qtd->qtd_list, head);
1724 	}
1725 
1726 	/* unless the bulk/interrupt caller wants a chance to clean
1727 	 * up after short reads, hc should advance qh past this urb
1728 	 */
1729 	if (likely((urb->transfer_flags & URB_SHORT_NOT_OK) == 0
1730 				|| usb_pipecontrol(urb->pipe)))
1731 		qtd->hw_alt_next = EHCI_LIST_END;
1732 
1733 	/*
1734 	 * control requests may need a terminating data "status" ack;
1735 	 * bulk ones may need a terminating short packet (zero length).
1736 	 */
1737 	if (likely(urb->transfer_buffer_length != 0)) {
1738 		int	one_more = 0;
1739 
1740 		if (usb_pipecontrol(urb->pipe)) {
1741 			one_more = 1;
1742 			token ^= 0x0100;	/* "in" <--> "out"  */
1743 			token |= QTD_TOGGLE;	/* force DATA1 */
1744 		} else if (usb_pipebulk(urb->pipe)
1745 				&& (urb->transfer_flags & URB_ZERO_PACKET)
1746 				&& !(urb->transfer_buffer_length % maxpacket)) {
1747 			one_more = 1;
1748 		}
1749 		if (one_more) {
1750 			qtd_prev = qtd;
1751 			qtd = ehci_qtd_alloc(oxu);
1752 			if (unlikely(!qtd))
1753 				goto cleanup;
1754 			qtd->urb = urb;
1755 			qtd_prev->hw_next = QTD_NEXT(qtd->qtd_dma);
1756 			list_add_tail(&qtd->qtd_list, head);
1757 
1758 			/* never any data in such packets */
1759 			qtd_fill(qtd, 0, 0, token, 0);
1760 		}
1761 	}
1762 
1763 	/* by default, enable interrupt on urb completion */
1764 	qtd->hw_token |= cpu_to_le32(QTD_IOC);
1765 	return head;
1766 
1767 cleanup:
1768 	qtd_list_free(oxu, urb, head);
1769 	return NULL;
1770 }
1771 
1772 /* Each QH holds a qtd list; a QH is used for everything except iso.
1773  *
1774  * For interrupt urbs, the scheduler must set the microframe scheduling
1775  * mask(s) each time the QH gets scheduled.  For highspeed, that's
1776  * just one microframe in the s-mask.  For split interrupt transactions
1777  * there are additional complications: c-mask, maybe FSTNs.
1778  */
1779 static struct ehci_qh *qh_make(struct oxu_hcd *oxu,
1780 				struct urb *urb, gfp_t flags)
1781 {
1782 	struct ehci_qh *qh = oxu_qh_alloc(oxu);
1783 	u32 info1 = 0, info2 = 0;
1784 	int is_input, type;
1785 	int maxp = 0;
1786 
1787 	if (!qh)
1788 		return qh;
1789 
1790 	/*
1791 	 * init endpoint/device data for this QH
1792 	 */
1793 	info1 |= usb_pipeendpoint(urb->pipe) << 8;
1794 	info1 |= usb_pipedevice(urb->pipe) << 0;
1795 
1796 	is_input = usb_pipein(urb->pipe);
1797 	type = usb_pipetype(urb->pipe);
1798 	maxp = usb_maxpacket(urb->dev, urb->pipe, !is_input);
1799 
1800 	/* Compute interrupt scheduling parameters just once, and save.
1801 	 * - allowing for high bandwidth, how many nsec/uframe are used?
1802 	 * - split transactions need a second CSPLIT uframe; same question
1803 	 * - splits also need a schedule gap (for full/low speed I/O)
1804 	 * - qh has a polling interval
1805 	 *
1806 	 * For control/bulk requests, the HC or TT handles these.
1807 	 */
1808 	if (type == PIPE_INTERRUPT) {
1809 		qh->usecs = NS_TO_US(usb_calc_bus_time(USB_SPEED_HIGH,
1810 								is_input, 0,
1811 				hb_mult(maxp) * max_packet(maxp)));
1812 		qh->start = NO_FRAME;
1813 
1814 		if (urb->dev->speed == USB_SPEED_HIGH) {
1815 			qh->c_usecs = 0;
1816 			qh->gap_uf = 0;
1817 
1818 			qh->period = urb->interval >> 3;
1819 			if (qh->period == 0 && urb->interval != 1) {
1820 				/* NOTE interval 2 or 4 uframes could work.
1821 				 * But interval 1 scheduling is simpler, and
1822 				 * includes high bandwidth.
1823 				 */
1824 				oxu_dbg(oxu, "intr period %d uframes, NYET!\n",
1825 					urb->interval);
1826 				goto done;
1827 			}
1828 		} else {
1829 			struct usb_tt	*tt = urb->dev->tt;
1830 			int		think_time;
1831 
1832 			/* gap is f(FS/LS transfer times) */
1833 			qh->gap_uf = 1 + usb_calc_bus_time(urb->dev->speed,
1834 					is_input, 0, maxp) / (125 * 1000);
1835 
1836 			/* FIXME this just approximates SPLIT/CSPLIT times */
1837 			if (is_input) {		/* SPLIT, gap, CSPLIT+DATA */
1838 				qh->c_usecs = qh->usecs + HS_USECS(0);
1839 				qh->usecs = HS_USECS(1);
1840 			} else {		/* SPLIT+DATA, gap, CSPLIT */
1841 				qh->usecs += HS_USECS(1);
1842 				qh->c_usecs = HS_USECS(0);
1843 			}
1844 
1845 			think_time = tt ? tt->think_time : 0;
1846 			qh->tt_usecs = NS_TO_US(think_time +
1847 					usb_calc_bus_time(urb->dev->speed,
1848 					is_input, 0, max_packet(maxp)));
1849 			qh->period = urb->interval;
1850 		}
1851 	}
1852 
1853 	/* support for tt scheduling, and access to toggles */
1854 	qh->dev = urb->dev;
1855 
1856 	/* using TT? */
1857 	switch (urb->dev->speed) {
1858 	case USB_SPEED_LOW:
1859 		info1 |= (1 << 12);	/* EPS "low" */
1860 		fallthrough;
1861 
1862 	case USB_SPEED_FULL:
1863 		/* EPS 0 means "full" */
1864 		if (type != PIPE_INTERRUPT)
1865 			info1 |= (EHCI_TUNE_RL_TT << 28);
1866 		if (type == PIPE_CONTROL) {
1867 			info1 |= (1 << 27);	/* for TT */
1868 			info1 |= 1 << 14;	/* toggle from qtd */
1869 		}
1870 		info1 |= maxp << 16;
1871 
1872 		info2 |= (EHCI_TUNE_MULT_TT << 30);
1873 		info2 |= urb->dev->ttport << 23;
1874 
1875 		/* NOTE:  if (PIPE_INTERRUPT) { scheduler sets c-mask } */
1876 
1877 		break;
1878 
1879 	case USB_SPEED_HIGH:		/* no TT involved */
1880 		info1 |= (2 << 12);	/* EPS "high" */
1881 		if (type == PIPE_CONTROL) {
1882 			info1 |= (EHCI_TUNE_RL_HS << 28);
1883 			info1 |= 64 << 16;	/* usb2 fixed maxpacket */
1884 			info1 |= 1 << 14;	/* toggle from qtd */
1885 			info2 |= (EHCI_TUNE_MULT_HS << 30);
1886 		} else if (type == PIPE_BULK) {
1887 			info1 |= (EHCI_TUNE_RL_HS << 28);
1888 			info1 |= 512 << 16;	/* usb2 fixed maxpacket */
1889 			info2 |= (EHCI_TUNE_MULT_HS << 30);
1890 		} else {		/* PIPE_INTERRUPT */
1891 			info1 |= max_packet(maxp) << 16;
1892 			info2 |= hb_mult(maxp) << 30;
1893 		}
1894 		break;
1895 	default:
1896 		oxu_dbg(oxu, "bogus dev %p speed %d\n", urb->dev, urb->dev->speed);
1897 done:
1898 		qh_put(qh);
1899 		return NULL;
1900 	}
1901 
1902 	/* NOTE:  if (PIPE_INTERRUPT) { scheduler sets s-mask } */
1903 
1904 	/* init as live, toggle clear, advance to dummy */
1905 	qh->qh_state = QH_STATE_IDLE;
1906 	qh->hw_info1 = cpu_to_le32(info1);
1907 	qh->hw_info2 = cpu_to_le32(info2);
1908 	usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe), !is_input, 1);
1909 	qh_refresh(oxu, qh);
1910 	return qh;
1911 }
1912 
1913 /* Move qh (and its qtds) onto async queue; maybe enable queue.
1914  */
1915 static void qh_link_async(struct oxu_hcd *oxu, struct ehci_qh *qh)
1916 {
1917 	__le32 dma = QH_NEXT(qh->qh_dma);
1918 	struct ehci_qh *head;
1919 
1920 	/* (re)start the async schedule? */
1921 	head = oxu->async;
1922 	timer_action_done(oxu, TIMER_ASYNC_OFF);
1923 	if (!head->qh_next.qh) {
1924 		u32	cmd = readl(&oxu->regs->command);
1925 
1926 		if (!(cmd & CMD_ASE)) {
1927 			/* in case a clear of CMD_ASE didn't take yet */
1928 			(void)handshake(oxu, &oxu->regs->status,
1929 					STS_ASS, 0, 150);
1930 			cmd |= CMD_ASE | CMD_RUN;
1931 			writel(cmd, &oxu->regs->command);
1932 			oxu_to_hcd(oxu)->state = HC_STATE_RUNNING;
1933 			/* posted write need not be known to HC yet ... */
1934 		}
1935 	}
1936 
1937 	/* clear halt and/or toggle; and maybe recover from silicon quirk */
1938 	if (qh->qh_state == QH_STATE_IDLE)
1939 		qh_refresh(oxu, qh);
1940 
1941 	/* splice right after start */
1942 	qh->qh_next = head->qh_next;
1943 	qh->hw_next = head->hw_next;
1944 	wmb();
1945 
1946 	head->qh_next.qh = qh;
1947 	head->hw_next = dma;
1948 
1949 	qh->qh_state = QH_STATE_LINKED;
1950 	/* qtd completions reported later by interrupt */
1951 }
1952 
1953 #define	QH_ADDR_MASK	cpu_to_le32(0x7f)
1954 
1955 /*
1956  * For control/bulk/interrupt, return QH with these TDs appended.
1957  * Allocates and initializes the QH if necessary.
1958  * Returns null if it can't allocate a QH it needs to.
1959  * If the QH has TDs (urbs) already, that's great.
1960  */
1961 static struct ehci_qh *qh_append_tds(struct oxu_hcd *oxu,
1962 				struct urb *urb, struct list_head *qtd_list,
1963 				int epnum, void	**ptr)
1964 {
1965 	struct ehci_qh *qh = NULL;
1966 
1967 	qh = (struct ehci_qh *) *ptr;
1968 	if (unlikely(qh == NULL)) {
1969 		/* can't sleep here, we have oxu->lock... */
1970 		qh = qh_make(oxu, urb, GFP_ATOMIC);
1971 		*ptr = qh;
1972 	}
1973 	if (likely(qh != NULL)) {
1974 		struct ehci_qtd	*qtd;
1975 
1976 		if (unlikely(list_empty(qtd_list)))
1977 			qtd = NULL;
1978 		else
1979 			qtd = list_entry(qtd_list->next, struct ehci_qtd,
1980 					qtd_list);
1981 
1982 		/* control qh may need patching ... */
1983 		if (unlikely(epnum == 0)) {
1984 
1985 			/* usb_reset_device() briefly reverts to address 0 */
1986 			if (usb_pipedevice(urb->pipe) == 0)
1987 				qh->hw_info1 &= ~QH_ADDR_MASK;
1988 		}
1989 
1990 		/* just one way to queue requests: swap with the dummy qtd.
1991 		 * only hc or qh_refresh() ever modify the overlay.
1992 		 */
1993 		if (likely(qtd != NULL)) {
1994 			struct ehci_qtd	*dummy;
1995 			dma_addr_t dma;
1996 			__le32 token;
1997 
1998 			/* to avoid racing the HC, use the dummy td instead of
1999 			 * the first td of our list (becomes new dummy).  both
2000 			 * tds stay deactivated until we're done, when the
2001 			 * HC is allowed to fetch the old dummy (4.10.2).
2002 			 */
2003 			token = qtd->hw_token;
2004 			qtd->hw_token = HALT_BIT;
2005 			wmb();
2006 			dummy = qh->dummy;
2007 
2008 			dma = dummy->qtd_dma;
2009 			*dummy = *qtd;
2010 			dummy->qtd_dma = dma;
2011 
2012 			list_del(&qtd->qtd_list);
2013 			list_add(&dummy->qtd_list, qtd_list);
2014 			list_splice(qtd_list, qh->qtd_list.prev);
2015 
2016 			ehci_qtd_init(qtd, qtd->qtd_dma);
2017 			qh->dummy = qtd;
2018 
2019 			/* hc must see the new dummy at list end */
2020 			dma = qtd->qtd_dma;
2021 			qtd = list_entry(qh->qtd_list.prev,
2022 					struct ehci_qtd, qtd_list);
2023 			qtd->hw_next = QTD_NEXT(dma);
2024 
2025 			/* let the hc process these next qtds */
2026 			dummy->hw_token = (token & ~(0x80));
2027 			wmb();
2028 			dummy->hw_token = token;
2029 
2030 			urb->hcpriv = qh_get(qh);
2031 		}
2032 	}
2033 	return qh;
2034 }
2035 
2036 static int submit_async(struct oxu_hcd	*oxu, struct urb *urb,
2037 			struct list_head *qtd_list, gfp_t mem_flags)
2038 {
2039 	int epnum = urb->ep->desc.bEndpointAddress;
2040 	unsigned long flags;
2041 	struct ehci_qh *qh = NULL;
2042 	int rc = 0;
2043 #ifdef OXU_URB_TRACE
2044 	struct ehci_qtd	*qtd;
2045 
2046 	qtd = list_entry(qtd_list->next, struct ehci_qtd, qtd_list);
2047 
2048 	oxu_dbg(oxu, "%s %s urb %p ep%d%s len %d, qtd %p [qh %p]\n",
2049 		__func__, urb->dev->devpath, urb,
2050 		epnum & 0x0f, (epnum & USB_DIR_IN) ? "in" : "out",
2051 		urb->transfer_buffer_length,
2052 		qtd, urb->ep->hcpriv);
2053 #endif
2054 
2055 	spin_lock_irqsave(&oxu->lock, flags);
2056 	if (unlikely(!HCD_HW_ACCESSIBLE(oxu_to_hcd(oxu)))) {
2057 		rc = -ESHUTDOWN;
2058 		goto done;
2059 	}
2060 
2061 	qh = qh_append_tds(oxu, urb, qtd_list, epnum, &urb->ep->hcpriv);
2062 	if (unlikely(qh == NULL)) {
2063 		rc = -ENOMEM;
2064 		goto done;
2065 	}
2066 
2067 	/* Control/bulk operations through TTs don't need scheduling,
2068 	 * the HC and TT handle it when the TT has a buffer ready.
2069 	 */
2070 	if (likely(qh->qh_state == QH_STATE_IDLE))
2071 		qh_link_async(oxu, qh_get(qh));
2072 done:
2073 	spin_unlock_irqrestore(&oxu->lock, flags);
2074 	if (unlikely(qh == NULL))
2075 		qtd_list_free(oxu, urb, qtd_list);
2076 	return rc;
2077 }
2078 
2079 /* The async qh for the qtds being reclaimed are now unlinked from the HC */
2080 
2081 static void end_unlink_async(struct oxu_hcd *oxu)
2082 {
2083 	struct ehci_qh *qh = oxu->reclaim;
2084 	struct ehci_qh *next;
2085 
2086 	timer_action_done(oxu, TIMER_IAA_WATCHDOG);
2087 
2088 	qh->qh_state = QH_STATE_IDLE;
2089 	qh->qh_next.qh = NULL;
2090 	qh_put(qh);			/* refcount from reclaim */
2091 
2092 	/* other unlink(s) may be pending (in QH_STATE_UNLINK_WAIT) */
2093 	next = qh->reclaim;
2094 	oxu->reclaim = next;
2095 	oxu->reclaim_ready = 0;
2096 	qh->reclaim = NULL;
2097 
2098 	qh_completions(oxu, qh);
2099 
2100 	if (!list_empty(&qh->qtd_list)
2101 			&& HC_IS_RUNNING(oxu_to_hcd(oxu)->state))
2102 		qh_link_async(oxu, qh);
2103 	else {
2104 		qh_put(qh);		/* refcount from async list */
2105 
2106 		/* it's not free to turn the async schedule on/off; leave it
2107 		 * active but idle for a while once it empties.
2108 		 */
2109 		if (HC_IS_RUNNING(oxu_to_hcd(oxu)->state)
2110 				&& oxu->async->qh_next.qh == NULL)
2111 			timer_action(oxu, TIMER_ASYNC_OFF);
2112 	}
2113 
2114 	if (next) {
2115 		oxu->reclaim = NULL;
2116 		start_unlink_async(oxu, next);
2117 	}
2118 }
2119 
2120 /* makes sure the async qh will become idle */
2121 /* caller must own oxu->lock */
2122 
2123 static void start_unlink_async(struct oxu_hcd *oxu, struct ehci_qh *qh)
2124 {
2125 	int cmd = readl(&oxu->regs->command);
2126 	struct ehci_qh *prev;
2127 
2128 #ifdef DEBUG
2129 	assert_spin_locked(&oxu->lock);
2130 	BUG_ON(oxu->reclaim || (qh->qh_state != QH_STATE_LINKED
2131 				&& qh->qh_state != QH_STATE_UNLINK_WAIT));
2132 #endif
2133 
2134 	/* stop async schedule right now? */
2135 	if (unlikely(qh == oxu->async)) {
2136 		/* can't get here without STS_ASS set */
2137 		if (oxu_to_hcd(oxu)->state != HC_STATE_HALT
2138 				&& !oxu->reclaim) {
2139 			/* ... and CMD_IAAD clear */
2140 			writel(cmd & ~CMD_ASE, &oxu->regs->command);
2141 			wmb();
2142 			/* handshake later, if we need to */
2143 			timer_action_done(oxu, TIMER_ASYNC_OFF);
2144 		}
2145 		return;
2146 	}
2147 
2148 	qh->qh_state = QH_STATE_UNLINK;
2149 	oxu->reclaim = qh = qh_get(qh);
2150 
2151 	prev = oxu->async;
2152 	while (prev->qh_next.qh != qh)
2153 		prev = prev->qh_next.qh;
2154 
2155 	prev->hw_next = qh->hw_next;
2156 	prev->qh_next = qh->qh_next;
2157 	wmb();
2158 
2159 	if (unlikely(oxu_to_hcd(oxu)->state == HC_STATE_HALT)) {
2160 		/* if (unlikely(qh->reclaim != 0))
2161 		 *	this will recurse, probably not much
2162 		 */
2163 		end_unlink_async(oxu);
2164 		return;
2165 	}
2166 
2167 	oxu->reclaim_ready = 0;
2168 	cmd |= CMD_IAAD;
2169 	writel(cmd, &oxu->regs->command);
2170 	(void) readl(&oxu->regs->command);
2171 	timer_action(oxu, TIMER_IAA_WATCHDOG);
2172 }
2173 
2174 static void scan_async(struct oxu_hcd *oxu)
2175 {
2176 	struct ehci_qh *qh;
2177 	enum ehci_timer_action action = TIMER_IO_WATCHDOG;
2178 
2179 	if (!++(oxu->stamp))
2180 		oxu->stamp++;
2181 	timer_action_done(oxu, TIMER_ASYNC_SHRINK);
2182 rescan:
2183 	qh = oxu->async->qh_next.qh;
2184 	if (likely(qh != NULL)) {
2185 		do {
2186 			/* clean any finished work for this qh */
2187 			if (!list_empty(&qh->qtd_list)
2188 					&& qh->stamp != oxu->stamp) {
2189 				int temp;
2190 
2191 				/* unlinks could happen here; completion
2192 				 * reporting drops the lock.  rescan using
2193 				 * the latest schedule, but don't rescan
2194 				 * qhs we already finished (no looping).
2195 				 */
2196 				qh = qh_get(qh);
2197 				qh->stamp = oxu->stamp;
2198 				temp = qh_completions(oxu, qh);
2199 				qh_put(qh);
2200 				if (temp != 0)
2201 					goto rescan;
2202 			}
2203 
2204 			/* unlink idle entries, reducing HC PCI usage as well
2205 			 * as HCD schedule-scanning costs.  delay for any qh
2206 			 * we just scanned, there's a not-unusual case that it
2207 			 * doesn't stay idle for long.
2208 			 * (plus, avoids some kind of re-activation race.)
2209 			 */
2210 			if (list_empty(&qh->qtd_list)) {
2211 				if (qh->stamp == oxu->stamp)
2212 					action = TIMER_ASYNC_SHRINK;
2213 				else if (!oxu->reclaim
2214 					    && qh->qh_state == QH_STATE_LINKED)
2215 					start_unlink_async(oxu, qh);
2216 			}
2217 
2218 			qh = qh->qh_next.qh;
2219 		} while (qh);
2220 	}
2221 	if (action == TIMER_ASYNC_SHRINK)
2222 		timer_action(oxu, TIMER_ASYNC_SHRINK);
2223 }
2224 
2225 /*
2226  * periodic_next_shadow - return "next" pointer on shadow list
2227  * @periodic: host pointer to qh/itd/sitd
2228  * @tag: hardware tag for type of this record
2229  */
2230 static union ehci_shadow *periodic_next_shadow(union ehci_shadow *periodic,
2231 						__le32 tag)
2232 {
2233 	switch (tag) {
2234 	default:
2235 	case Q_TYPE_QH:
2236 		return &periodic->qh->qh_next;
2237 	}
2238 }
2239 
2240 /* caller must hold oxu->lock */
2241 static void periodic_unlink(struct oxu_hcd *oxu, unsigned frame, void *ptr)
2242 {
2243 	union ehci_shadow *prev_p = &oxu->pshadow[frame];
2244 	__le32 *hw_p = &oxu->periodic[frame];
2245 	union ehci_shadow here = *prev_p;
2246 
2247 	/* find predecessor of "ptr"; hw and shadow lists are in sync */
2248 	while (here.ptr && here.ptr != ptr) {
2249 		prev_p = periodic_next_shadow(prev_p, Q_NEXT_TYPE(*hw_p));
2250 		hw_p = here.hw_next;
2251 		here = *prev_p;
2252 	}
2253 	/* an interrupt entry (at list end) could have been shared */
2254 	if (!here.ptr)
2255 		return;
2256 
2257 	/* update shadow and hardware lists ... the old "next" pointers
2258 	 * from ptr may still be in use, the caller updates them.
2259 	 */
2260 	*prev_p = *periodic_next_shadow(&here, Q_NEXT_TYPE(*hw_p));
2261 	*hw_p = *here.hw_next;
2262 }
2263 
2264 /* how many of the uframe's 125 usecs are allocated? */
2265 static unsigned short periodic_usecs(struct oxu_hcd *oxu,
2266 					unsigned frame, unsigned uframe)
2267 {
2268 	__le32 *hw_p = &oxu->periodic[frame];
2269 	union ehci_shadow *q = &oxu->pshadow[frame];
2270 	unsigned usecs = 0;
2271 
2272 	while (q->ptr) {
2273 		switch (Q_NEXT_TYPE(*hw_p)) {
2274 		case Q_TYPE_QH:
2275 		default:
2276 			/* is it in the S-mask? */
2277 			if (q->qh->hw_info2 & cpu_to_le32(1 << uframe))
2278 				usecs += q->qh->usecs;
2279 			/* ... or C-mask? */
2280 			if (q->qh->hw_info2 & cpu_to_le32(1 << (8 + uframe)))
2281 				usecs += q->qh->c_usecs;
2282 			hw_p = &q->qh->hw_next;
2283 			q = &q->qh->qh_next;
2284 			break;
2285 		}
2286 	}
2287 #ifdef DEBUG
2288 	if (usecs > 100)
2289 		oxu_err(oxu, "uframe %d sched overrun: %d usecs\n",
2290 						frame * 8 + uframe, usecs);
2291 #endif
2292 	return usecs;
2293 }
2294 
2295 static int enable_periodic(struct oxu_hcd *oxu)
2296 {
2297 	u32 cmd;
2298 	int status;
2299 
2300 	/* did clearing PSE did take effect yet?
2301 	 * takes effect only at frame boundaries...
2302 	 */
2303 	status = handshake(oxu, &oxu->regs->status, STS_PSS, 0, 9 * 125);
2304 	if (status != 0) {
2305 		oxu_to_hcd(oxu)->state = HC_STATE_HALT;
2306 		usb_hc_died(oxu_to_hcd(oxu));
2307 		return status;
2308 	}
2309 
2310 	cmd = readl(&oxu->regs->command) | CMD_PSE;
2311 	writel(cmd, &oxu->regs->command);
2312 	/* posted write ... PSS happens later */
2313 	oxu_to_hcd(oxu)->state = HC_STATE_RUNNING;
2314 
2315 	/* make sure ehci_work scans these */
2316 	oxu->next_uframe = readl(&oxu->regs->frame_index)
2317 		% (oxu->periodic_size << 3);
2318 	return 0;
2319 }
2320 
2321 static int disable_periodic(struct oxu_hcd *oxu)
2322 {
2323 	u32 cmd;
2324 	int status;
2325 
2326 	/* did setting PSE not take effect yet?
2327 	 * takes effect only at frame boundaries...
2328 	 */
2329 	status = handshake(oxu, &oxu->regs->status, STS_PSS, STS_PSS, 9 * 125);
2330 	if (status != 0) {
2331 		oxu_to_hcd(oxu)->state = HC_STATE_HALT;
2332 		usb_hc_died(oxu_to_hcd(oxu));
2333 		return status;
2334 	}
2335 
2336 	cmd = readl(&oxu->regs->command) & ~CMD_PSE;
2337 	writel(cmd, &oxu->regs->command);
2338 	/* posted write ... */
2339 
2340 	oxu->next_uframe = -1;
2341 	return 0;
2342 }
2343 
2344 /* periodic schedule slots have iso tds (normal or split) first, then a
2345  * sparse tree for active interrupt transfers.
2346  *
2347  * this just links in a qh; caller guarantees uframe masks are set right.
2348  * no FSTN support (yet; oxu 0.96+)
2349  */
2350 static int qh_link_periodic(struct oxu_hcd *oxu, struct ehci_qh *qh)
2351 {
2352 	unsigned i;
2353 	unsigned period = qh->period;
2354 
2355 	dev_dbg(&qh->dev->dev,
2356 		"link qh%d-%04x/%p start %d [%d/%d us]\n",
2357 		period, le32_to_cpup(&qh->hw_info2) & (QH_CMASK | QH_SMASK),
2358 		qh, qh->start, qh->usecs, qh->c_usecs);
2359 
2360 	/* high bandwidth, or otherwise every microframe */
2361 	if (period == 0)
2362 		period = 1;
2363 
2364 	for (i = qh->start; i < oxu->periodic_size; i += period) {
2365 		union ehci_shadow	*prev = &oxu->pshadow[i];
2366 		__le32			*hw_p = &oxu->periodic[i];
2367 		union ehci_shadow	here = *prev;
2368 		__le32			type = 0;
2369 
2370 		/* skip the iso nodes at list head */
2371 		while (here.ptr) {
2372 			type = Q_NEXT_TYPE(*hw_p);
2373 			if (type == Q_TYPE_QH)
2374 				break;
2375 			prev = periodic_next_shadow(prev, type);
2376 			hw_p = &here.qh->hw_next;
2377 			here = *prev;
2378 		}
2379 
2380 		/* sorting each branch by period (slow-->fast)
2381 		 * enables sharing interior tree nodes
2382 		 */
2383 		while (here.ptr && qh != here.qh) {
2384 			if (qh->period > here.qh->period)
2385 				break;
2386 			prev = &here.qh->qh_next;
2387 			hw_p = &here.qh->hw_next;
2388 			here = *prev;
2389 		}
2390 		/* link in this qh, unless some earlier pass did that */
2391 		if (qh != here.qh) {
2392 			qh->qh_next = here;
2393 			if (here.qh)
2394 				qh->hw_next = *hw_p;
2395 			wmb();
2396 			prev->qh = qh;
2397 			*hw_p = QH_NEXT(qh->qh_dma);
2398 		}
2399 	}
2400 	qh->qh_state = QH_STATE_LINKED;
2401 	qh_get(qh);
2402 
2403 	/* update per-qh bandwidth for usbfs */
2404 	oxu_to_hcd(oxu)->self.bandwidth_allocated += qh->period
2405 		? ((qh->usecs + qh->c_usecs) / qh->period)
2406 		: (qh->usecs * 8);
2407 
2408 	/* maybe enable periodic schedule processing */
2409 	if (!oxu->periodic_sched++)
2410 		return enable_periodic(oxu);
2411 
2412 	return 0;
2413 }
2414 
2415 static void qh_unlink_periodic(struct oxu_hcd *oxu, struct ehci_qh *qh)
2416 {
2417 	unsigned i;
2418 	unsigned period;
2419 
2420 	/* FIXME:
2421 	 *   IF this isn't high speed
2422 	 *   and this qh is active in the current uframe
2423 	 *   (and overlay token SplitXstate is false?)
2424 	 * THEN
2425 	 *   qh->hw_info1 |= cpu_to_le32(1 << 7 "ignore");
2426 	 */
2427 
2428 	/* high bandwidth, or otherwise part of every microframe */
2429 	period = qh->period;
2430 	if (period == 0)
2431 		period = 1;
2432 
2433 	for (i = qh->start; i < oxu->periodic_size; i += period)
2434 		periodic_unlink(oxu, i, qh);
2435 
2436 	/* update per-qh bandwidth for usbfs */
2437 	oxu_to_hcd(oxu)->self.bandwidth_allocated -= qh->period
2438 		? ((qh->usecs + qh->c_usecs) / qh->period)
2439 		: (qh->usecs * 8);
2440 
2441 	dev_dbg(&qh->dev->dev,
2442 		"unlink qh%d-%04x/%p start %d [%d/%d us]\n",
2443 		qh->period,
2444 		le32_to_cpup(&qh->hw_info2) & (QH_CMASK | QH_SMASK),
2445 		qh, qh->start, qh->usecs, qh->c_usecs);
2446 
2447 	/* qh->qh_next still "live" to HC */
2448 	qh->qh_state = QH_STATE_UNLINK;
2449 	qh->qh_next.ptr = NULL;
2450 	qh_put(qh);
2451 
2452 	/* maybe turn off periodic schedule */
2453 	oxu->periodic_sched--;
2454 	if (!oxu->periodic_sched)
2455 		(void) disable_periodic(oxu);
2456 }
2457 
2458 static void intr_deschedule(struct oxu_hcd *oxu, struct ehci_qh *qh)
2459 {
2460 	unsigned wait;
2461 
2462 	qh_unlink_periodic(oxu, qh);
2463 
2464 	/* simple/paranoid:  always delay, expecting the HC needs to read
2465 	 * qh->hw_next or finish a writeback after SPLIT/CSPLIT ... and
2466 	 * expect hub_wq to clean up after any CSPLITs we won't issue.
2467 	 * active high speed queues may need bigger delays...
2468 	 */
2469 	if (list_empty(&qh->qtd_list)
2470 		|| (cpu_to_le32(QH_CMASK) & qh->hw_info2) != 0)
2471 		wait = 2;
2472 	else
2473 		wait = 55;	/* worst case: 3 * 1024 */
2474 
2475 	udelay(wait);
2476 	qh->qh_state = QH_STATE_IDLE;
2477 	qh->hw_next = EHCI_LIST_END;
2478 	wmb();
2479 }
2480 
2481 static int check_period(struct oxu_hcd *oxu,
2482 			unsigned frame, unsigned uframe,
2483 			unsigned period, unsigned usecs)
2484 {
2485 	int claimed;
2486 
2487 	/* complete split running into next frame?
2488 	 * given FSTN support, we could sometimes check...
2489 	 */
2490 	if (uframe >= 8)
2491 		return 0;
2492 
2493 	/*
2494 	 * 80% periodic == 100 usec/uframe available
2495 	 * convert "usecs we need" to "max already claimed"
2496 	 */
2497 	usecs = 100 - usecs;
2498 
2499 	/* we "know" 2 and 4 uframe intervals were rejected; so
2500 	 * for period 0, check _every_ microframe in the schedule.
2501 	 */
2502 	if (unlikely(period == 0)) {
2503 		do {
2504 			for (uframe = 0; uframe < 7; uframe++) {
2505 				claimed = periodic_usecs(oxu, frame, uframe);
2506 				if (claimed > usecs)
2507 					return 0;
2508 			}
2509 		} while ((frame += 1) < oxu->periodic_size);
2510 
2511 	/* just check the specified uframe, at that period */
2512 	} else {
2513 		do {
2514 			claimed = periodic_usecs(oxu, frame, uframe);
2515 			if (claimed > usecs)
2516 				return 0;
2517 		} while ((frame += period) < oxu->periodic_size);
2518 	}
2519 
2520 	return 1;
2521 }
2522 
2523 static int check_intr_schedule(struct oxu_hcd	*oxu,
2524 				unsigned frame, unsigned uframe,
2525 				const struct ehci_qh *qh, __le32 *c_maskp)
2526 {
2527 	int retval = -ENOSPC;
2528 
2529 	if (qh->c_usecs && uframe >= 6)		/* FSTN territory? */
2530 		goto done;
2531 
2532 	if (!check_period(oxu, frame, uframe, qh->period, qh->usecs))
2533 		goto done;
2534 	if (!qh->c_usecs) {
2535 		retval = 0;
2536 		*c_maskp = 0;
2537 		goto done;
2538 	}
2539 
2540 done:
2541 	return retval;
2542 }
2543 
2544 /* "first fit" scheduling policy used the first time through,
2545  * or when the previous schedule slot can't be re-used.
2546  */
2547 static int qh_schedule(struct oxu_hcd *oxu, struct ehci_qh *qh)
2548 {
2549 	int		status;
2550 	unsigned	uframe;
2551 	__le32		c_mask;
2552 	unsigned	frame;		/* 0..(qh->period - 1), or NO_FRAME */
2553 
2554 	qh_refresh(oxu, qh);
2555 	qh->hw_next = EHCI_LIST_END;
2556 	frame = qh->start;
2557 
2558 	/* reuse the previous schedule slots, if we can */
2559 	if (frame < qh->period) {
2560 		uframe = ffs(le32_to_cpup(&qh->hw_info2) & QH_SMASK);
2561 		status = check_intr_schedule(oxu, frame, --uframe,
2562 				qh, &c_mask);
2563 	} else {
2564 		uframe = 0;
2565 		c_mask = 0;
2566 		status = -ENOSPC;
2567 	}
2568 
2569 	/* else scan the schedule to find a group of slots such that all
2570 	 * uframes have enough periodic bandwidth available.
2571 	 */
2572 	if (status) {
2573 		/* "normal" case, uframing flexible except with splits */
2574 		if (qh->period) {
2575 			frame = qh->period - 1;
2576 			do {
2577 				for (uframe = 0; uframe < 8; uframe++) {
2578 					status = check_intr_schedule(oxu,
2579 							frame, uframe, qh,
2580 							&c_mask);
2581 					if (status == 0)
2582 						break;
2583 				}
2584 			} while (status && frame--);
2585 
2586 		/* qh->period == 0 means every uframe */
2587 		} else {
2588 			frame = 0;
2589 			status = check_intr_schedule(oxu, 0, 0, qh, &c_mask);
2590 		}
2591 		if (status)
2592 			goto done;
2593 		qh->start = frame;
2594 
2595 		/* reset S-frame and (maybe) C-frame masks */
2596 		qh->hw_info2 &= cpu_to_le32(~(QH_CMASK | QH_SMASK));
2597 		qh->hw_info2 |= qh->period
2598 			? cpu_to_le32(1 << uframe)
2599 			: cpu_to_le32(QH_SMASK);
2600 		qh->hw_info2 |= c_mask;
2601 	} else
2602 		oxu_dbg(oxu, "reused qh %p schedule\n", qh);
2603 
2604 	/* stuff into the periodic schedule */
2605 	status = qh_link_periodic(oxu, qh);
2606 done:
2607 	return status;
2608 }
2609 
2610 static int intr_submit(struct oxu_hcd *oxu, struct urb *urb,
2611 			struct list_head *qtd_list, gfp_t mem_flags)
2612 {
2613 	unsigned epnum;
2614 	unsigned long flags;
2615 	struct ehci_qh *qh;
2616 	int status = 0;
2617 	struct list_head	empty;
2618 
2619 	/* get endpoint and transfer/schedule data */
2620 	epnum = urb->ep->desc.bEndpointAddress;
2621 
2622 	spin_lock_irqsave(&oxu->lock, flags);
2623 
2624 	if (unlikely(!HCD_HW_ACCESSIBLE(oxu_to_hcd(oxu)))) {
2625 		status = -ESHUTDOWN;
2626 		goto done;
2627 	}
2628 
2629 	/* get qh and force any scheduling errors */
2630 	INIT_LIST_HEAD(&empty);
2631 	qh = qh_append_tds(oxu, urb, &empty, epnum, &urb->ep->hcpriv);
2632 	if (qh == NULL) {
2633 		status = -ENOMEM;
2634 		goto done;
2635 	}
2636 	if (qh->qh_state == QH_STATE_IDLE) {
2637 		status = qh_schedule(oxu, qh);
2638 		if (status != 0)
2639 			goto done;
2640 	}
2641 
2642 	/* then queue the urb's tds to the qh */
2643 	qh = qh_append_tds(oxu, urb, qtd_list, epnum, &urb->ep->hcpriv);
2644 	BUG_ON(qh == NULL);
2645 
2646 	/* ... update usbfs periodic stats */
2647 	oxu_to_hcd(oxu)->self.bandwidth_int_reqs++;
2648 
2649 done:
2650 	spin_unlock_irqrestore(&oxu->lock, flags);
2651 	if (status)
2652 		qtd_list_free(oxu, urb, qtd_list);
2653 
2654 	return status;
2655 }
2656 
2657 static inline int itd_submit(struct oxu_hcd *oxu, struct urb *urb,
2658 						gfp_t mem_flags)
2659 {
2660 	oxu_dbg(oxu, "iso support is missing!\n");
2661 	return -ENOSYS;
2662 }
2663 
2664 static inline int sitd_submit(struct oxu_hcd *oxu, struct urb *urb,
2665 						gfp_t mem_flags)
2666 {
2667 	oxu_dbg(oxu, "split iso support is missing!\n");
2668 	return -ENOSYS;
2669 }
2670 
2671 static void scan_periodic(struct oxu_hcd *oxu)
2672 {
2673 	unsigned frame, clock, now_uframe, mod;
2674 	unsigned modified;
2675 
2676 	mod = oxu->periodic_size << 3;
2677 
2678 	/*
2679 	 * When running, scan from last scan point up to "now"
2680 	 * else clean up by scanning everything that's left.
2681 	 * Touches as few pages as possible:  cache-friendly.
2682 	 */
2683 	now_uframe = oxu->next_uframe;
2684 	if (HC_IS_RUNNING(oxu_to_hcd(oxu)->state))
2685 		clock = readl(&oxu->regs->frame_index);
2686 	else
2687 		clock = now_uframe + mod - 1;
2688 	clock %= mod;
2689 
2690 	for (;;) {
2691 		union ehci_shadow	q, *q_p;
2692 		__le32			type, *hw_p;
2693 
2694 		/* don't scan past the live uframe */
2695 		frame = now_uframe >> 3;
2696 		if (frame != (clock >> 3)) {
2697 			/* safe to scan the whole frame at once */
2698 			now_uframe |= 0x07;
2699 		}
2700 
2701 restart:
2702 		/* scan each element in frame's queue for completions */
2703 		q_p = &oxu->pshadow[frame];
2704 		hw_p = &oxu->periodic[frame];
2705 		q.ptr = q_p->ptr;
2706 		type = Q_NEXT_TYPE(*hw_p);
2707 		modified = 0;
2708 
2709 		while (q.ptr != NULL) {
2710 			union ehci_shadow temp;
2711 
2712 			switch (type) {
2713 			case Q_TYPE_QH:
2714 				/* handle any completions */
2715 				temp.qh = qh_get(q.qh);
2716 				type = Q_NEXT_TYPE(q.qh->hw_next);
2717 				q = q.qh->qh_next;
2718 				modified = qh_completions(oxu, temp.qh);
2719 				if (unlikely(list_empty(&temp.qh->qtd_list)))
2720 					intr_deschedule(oxu, temp.qh);
2721 				qh_put(temp.qh);
2722 				break;
2723 			default:
2724 				oxu_dbg(oxu, "corrupt type %d frame %d shadow %p\n",
2725 					type, frame, q.ptr);
2726 				q.ptr = NULL;
2727 			}
2728 
2729 			/* assume completion callbacks modify the queue */
2730 			if (unlikely(modified))
2731 				goto restart;
2732 		}
2733 
2734 		/* Stop when we catch up to the HC */
2735 
2736 		/* FIXME:  this assumes we won't get lapped when
2737 		 * latencies climb; that should be rare, but...
2738 		 * detect it, and just go all the way around.
2739 		 * FLR might help detect this case, so long as latencies
2740 		 * don't exceed periodic_size msec (default 1.024 sec).
2741 		 */
2742 
2743 		/* FIXME: likewise assumes HC doesn't halt mid-scan */
2744 
2745 		if (now_uframe == clock) {
2746 			unsigned	now;
2747 
2748 			if (!HC_IS_RUNNING(oxu_to_hcd(oxu)->state))
2749 				break;
2750 			oxu->next_uframe = now_uframe;
2751 			now = readl(&oxu->regs->frame_index) % mod;
2752 			if (now_uframe == now)
2753 				break;
2754 
2755 			/* rescan the rest of this frame, then ... */
2756 			clock = now;
2757 		} else {
2758 			now_uframe++;
2759 			now_uframe %= mod;
2760 		}
2761 	}
2762 }
2763 
2764 /* On some systems, leaving remote wakeup enabled prevents system shutdown.
2765  * The firmware seems to think that powering off is a wakeup event!
2766  * This routine turns off remote wakeup and everything else, on all ports.
2767  */
2768 static void ehci_turn_off_all_ports(struct oxu_hcd *oxu)
2769 {
2770 	int port = HCS_N_PORTS(oxu->hcs_params);
2771 
2772 	while (port--)
2773 		writel(PORT_RWC_BITS, &oxu->regs->port_status[port]);
2774 }
2775 
2776 static void ehci_port_power(struct oxu_hcd *oxu, int is_on)
2777 {
2778 	unsigned port;
2779 
2780 	if (!HCS_PPC(oxu->hcs_params))
2781 		return;
2782 
2783 	oxu_dbg(oxu, "...power%s ports...\n", is_on ? "up" : "down");
2784 	for (port = HCS_N_PORTS(oxu->hcs_params); port > 0; ) {
2785 		if (is_on)
2786 			oxu_hub_control(oxu_to_hcd(oxu), SetPortFeature,
2787 				USB_PORT_FEAT_POWER, port--, NULL, 0);
2788 		else
2789 			oxu_hub_control(oxu_to_hcd(oxu), ClearPortFeature,
2790 				USB_PORT_FEAT_POWER, port--, NULL, 0);
2791 	}
2792 
2793 	msleep(20);
2794 }
2795 
2796 /* Called from some interrupts, timers, and so on.
2797  * It calls driver completion functions, after dropping oxu->lock.
2798  */
2799 static void ehci_work(struct oxu_hcd *oxu)
2800 {
2801 	timer_action_done(oxu, TIMER_IO_WATCHDOG);
2802 	if (oxu->reclaim_ready)
2803 		end_unlink_async(oxu);
2804 
2805 	/* another CPU may drop oxu->lock during a schedule scan while
2806 	 * it reports urb completions.  this flag guards against bogus
2807 	 * attempts at re-entrant schedule scanning.
2808 	 */
2809 	if (oxu->scanning)
2810 		return;
2811 	oxu->scanning = 1;
2812 	scan_async(oxu);
2813 	if (oxu->next_uframe != -1)
2814 		scan_periodic(oxu);
2815 	oxu->scanning = 0;
2816 
2817 	/* the IO watchdog guards against hardware or driver bugs that
2818 	 * misplace IRQs, and should let us run completely without IRQs.
2819 	 * such lossage has been observed on both VT6202 and VT8235.
2820 	 */
2821 	if (HC_IS_RUNNING(oxu_to_hcd(oxu)->state) &&
2822 			(oxu->async->qh_next.ptr != NULL ||
2823 			 oxu->periodic_sched != 0))
2824 		timer_action(oxu, TIMER_IO_WATCHDOG);
2825 }
2826 
2827 static void unlink_async(struct oxu_hcd *oxu, struct ehci_qh *qh)
2828 {
2829 	/* if we need to use IAA and it's busy, defer */
2830 	if (qh->qh_state == QH_STATE_LINKED
2831 			&& oxu->reclaim
2832 			&& HC_IS_RUNNING(oxu_to_hcd(oxu)->state)) {
2833 		struct ehci_qh		*last;
2834 
2835 		for (last = oxu->reclaim;
2836 				last->reclaim;
2837 				last = last->reclaim)
2838 			continue;
2839 		qh->qh_state = QH_STATE_UNLINK_WAIT;
2840 		last->reclaim = qh;
2841 
2842 	/* bypass IAA if the hc can't care */
2843 	} else if (!HC_IS_RUNNING(oxu_to_hcd(oxu)->state) && oxu->reclaim)
2844 		end_unlink_async(oxu);
2845 
2846 	/* something else might have unlinked the qh by now */
2847 	if (qh->qh_state == QH_STATE_LINKED)
2848 		start_unlink_async(oxu, qh);
2849 }
2850 
2851 /*
2852  * USB host controller methods
2853  */
2854 
2855 static irqreturn_t oxu210_hcd_irq(struct usb_hcd *hcd)
2856 {
2857 	struct oxu_hcd *oxu = hcd_to_oxu(hcd);
2858 	u32 status, pcd_status = 0;
2859 	int bh;
2860 
2861 	spin_lock(&oxu->lock);
2862 
2863 	status = readl(&oxu->regs->status);
2864 
2865 	/* e.g. cardbus physical eject */
2866 	if (status == ~(u32) 0) {
2867 		oxu_dbg(oxu, "device removed\n");
2868 		goto dead;
2869 	}
2870 
2871 	/* Shared IRQ? */
2872 	status &= INTR_MASK;
2873 	if (!status || unlikely(hcd->state == HC_STATE_HALT)) {
2874 		spin_unlock(&oxu->lock);
2875 		return IRQ_NONE;
2876 	}
2877 
2878 	/* clear (just) interrupts */
2879 	writel(status, &oxu->regs->status);
2880 	readl(&oxu->regs->command);	/* unblock posted write */
2881 	bh = 0;
2882 
2883 #ifdef OXU_VERBOSE_DEBUG
2884 	/* unrequested/ignored: Frame List Rollover */
2885 	dbg_status(oxu, "irq", status);
2886 #endif
2887 
2888 	/* INT, ERR, and IAA interrupt rates can be throttled */
2889 
2890 	/* normal [4.15.1.2] or error [4.15.1.1] completion */
2891 	if (likely((status & (STS_INT|STS_ERR)) != 0))
2892 		bh = 1;
2893 
2894 	/* complete the unlinking of some qh [4.15.2.3] */
2895 	if (status & STS_IAA) {
2896 		oxu->reclaim_ready = 1;
2897 		bh = 1;
2898 	}
2899 
2900 	/* remote wakeup [4.3.1] */
2901 	if (status & STS_PCD) {
2902 		unsigned i = HCS_N_PORTS(oxu->hcs_params);
2903 		pcd_status = status;
2904 
2905 		/* resume root hub? */
2906 		if (!(readl(&oxu->regs->command) & CMD_RUN))
2907 			usb_hcd_resume_root_hub(hcd);
2908 
2909 		while (i--) {
2910 			int pstatus = readl(&oxu->regs->port_status[i]);
2911 
2912 			if (pstatus & PORT_OWNER)
2913 				continue;
2914 			if (!(pstatus & PORT_RESUME)
2915 					|| oxu->reset_done[i] != 0)
2916 				continue;
2917 
2918 			/* start USB_RESUME_TIMEOUT resume signaling from this
2919 			 * port, and make hub_wq collect PORT_STAT_C_SUSPEND to
2920 			 * stop that signaling.
2921 			 */
2922 			oxu->reset_done[i] = jiffies +
2923 				msecs_to_jiffies(USB_RESUME_TIMEOUT);
2924 			oxu_dbg(oxu, "port %d remote wakeup\n", i + 1);
2925 			mod_timer(&hcd->rh_timer, oxu->reset_done[i]);
2926 		}
2927 	}
2928 
2929 	/* PCI errors [4.15.2.4] */
2930 	if (unlikely((status & STS_FATAL) != 0)) {
2931 		/* bogus "fatal" IRQs appear on some chips... why?  */
2932 		status = readl(&oxu->regs->status);
2933 		dbg_cmd(oxu, "fatal", readl(&oxu->regs->command));
2934 		dbg_status(oxu, "fatal", status);
2935 		if (status & STS_HALT) {
2936 			oxu_err(oxu, "fatal error\n");
2937 dead:
2938 			ehci_reset(oxu);
2939 			writel(0, &oxu->regs->configured_flag);
2940 			usb_hc_died(hcd);
2941 			/* generic layer kills/unlinks all urbs, then
2942 			 * uses oxu_stop to clean up the rest
2943 			 */
2944 			bh = 1;
2945 		}
2946 	}
2947 
2948 	if (bh)
2949 		ehci_work(oxu);
2950 	spin_unlock(&oxu->lock);
2951 	if (pcd_status & STS_PCD)
2952 		usb_hcd_poll_rh_status(hcd);
2953 	return IRQ_HANDLED;
2954 }
2955 
2956 static irqreturn_t oxu_irq(struct usb_hcd *hcd)
2957 {
2958 	struct oxu_hcd *oxu = hcd_to_oxu(hcd);
2959 	int ret = IRQ_HANDLED;
2960 
2961 	u32 status = oxu_readl(hcd->regs, OXU_CHIPIRQSTATUS);
2962 	u32 enable = oxu_readl(hcd->regs, OXU_CHIPIRQEN_SET);
2963 
2964 	/* Disable all interrupt */
2965 	oxu_writel(hcd->regs, OXU_CHIPIRQEN_CLR, enable);
2966 
2967 	if ((oxu->is_otg && (status & OXU_USBOTGI)) ||
2968 		(!oxu->is_otg && (status & OXU_USBSPHI)))
2969 		oxu210_hcd_irq(hcd);
2970 	else
2971 		ret = IRQ_NONE;
2972 
2973 	/* Enable all interrupt back */
2974 	oxu_writel(hcd->regs, OXU_CHIPIRQEN_SET, enable);
2975 
2976 	return ret;
2977 }
2978 
2979 static void oxu_watchdog(struct timer_list *t)
2980 {
2981 	struct oxu_hcd	*oxu = from_timer(oxu, t, watchdog);
2982 	unsigned long flags;
2983 
2984 	spin_lock_irqsave(&oxu->lock, flags);
2985 
2986 	/* lost IAA irqs wedge things badly; seen with a vt8235 */
2987 	if (oxu->reclaim) {
2988 		u32 status = readl(&oxu->regs->status);
2989 		if (status & STS_IAA) {
2990 			oxu_vdbg(oxu, "lost IAA\n");
2991 			writel(STS_IAA, &oxu->regs->status);
2992 			oxu->reclaim_ready = 1;
2993 		}
2994 	}
2995 
2996 	/* stop async processing after it's idled a bit */
2997 	if (test_bit(TIMER_ASYNC_OFF, &oxu->actions))
2998 		start_unlink_async(oxu, oxu->async);
2999 
3000 	/* oxu could run by timer, without IRQs ... */
3001 	ehci_work(oxu);
3002 
3003 	spin_unlock_irqrestore(&oxu->lock, flags);
3004 }
3005 
3006 /* One-time init, only for memory state.
3007  */
3008 static int oxu_hcd_init(struct usb_hcd *hcd)
3009 {
3010 	struct oxu_hcd *oxu = hcd_to_oxu(hcd);
3011 	u32 temp;
3012 	int retval;
3013 	u32 hcc_params;
3014 
3015 	spin_lock_init(&oxu->lock);
3016 
3017 	timer_setup(&oxu->watchdog, oxu_watchdog, 0);
3018 
3019 	/*
3020 	 * hw default: 1K periodic list heads, one per frame.
3021 	 * periodic_size can shrink by USBCMD update if hcc_params allows.
3022 	 */
3023 	oxu->periodic_size = DEFAULT_I_TDPS;
3024 	retval = ehci_mem_init(oxu, GFP_KERNEL);
3025 	if (retval < 0)
3026 		return retval;
3027 
3028 	/* controllers may cache some of the periodic schedule ... */
3029 	hcc_params = readl(&oxu->caps->hcc_params);
3030 	if (HCC_ISOC_CACHE(hcc_params))		/* full frame cache */
3031 		oxu->i_thresh = 8;
3032 	else					/* N microframes cached */
3033 		oxu->i_thresh = 2 + HCC_ISOC_THRES(hcc_params);
3034 
3035 	oxu->reclaim = NULL;
3036 	oxu->reclaim_ready = 0;
3037 	oxu->next_uframe = -1;
3038 
3039 	/*
3040 	 * dedicate a qh for the async ring head, since we couldn't unlink
3041 	 * a 'real' qh without stopping the async schedule [4.8].  use it
3042 	 * as the 'reclamation list head' too.
3043 	 * its dummy is used in hw_alt_next of many tds, to prevent the qh
3044 	 * from automatically advancing to the next td after short reads.
3045 	 */
3046 	oxu->async->qh_next.qh = NULL;
3047 	oxu->async->hw_next = QH_NEXT(oxu->async->qh_dma);
3048 	oxu->async->hw_info1 = cpu_to_le32(QH_HEAD);
3049 	oxu->async->hw_token = cpu_to_le32(QTD_STS_HALT);
3050 	oxu->async->hw_qtd_next = EHCI_LIST_END;
3051 	oxu->async->qh_state = QH_STATE_LINKED;
3052 	oxu->async->hw_alt_next = QTD_NEXT(oxu->async->dummy->qtd_dma);
3053 
3054 	/* clear interrupt enables, set irq latency */
3055 	if (log2_irq_thresh < 0 || log2_irq_thresh > 6)
3056 		log2_irq_thresh = 0;
3057 	temp = 1 << (16 + log2_irq_thresh);
3058 	if (HCC_CANPARK(hcc_params)) {
3059 		/* HW default park == 3, on hardware that supports it (like
3060 		 * NVidia and ALI silicon), maximizes throughput on the async
3061 		 * schedule by avoiding QH fetches between transfers.
3062 		 *
3063 		 * With fast usb storage devices and NForce2, "park" seems to
3064 		 * make problems:  throughput reduction (!), data errors...
3065 		 */
3066 		if (park) {
3067 			park = min(park, (unsigned) 3);
3068 			temp |= CMD_PARK;
3069 			temp |= park << 8;
3070 		}
3071 		oxu_dbg(oxu, "park %d\n", park);
3072 	}
3073 	if (HCC_PGM_FRAMELISTLEN(hcc_params)) {
3074 		/* periodic schedule size can be smaller than default */
3075 		temp &= ~(3 << 2);
3076 		temp |= (EHCI_TUNE_FLS << 2);
3077 	}
3078 	oxu->command = temp;
3079 
3080 	return 0;
3081 }
3082 
3083 /* Called during probe() after chip reset completes.
3084  */
3085 static int oxu_reset(struct usb_hcd *hcd)
3086 {
3087 	struct oxu_hcd *oxu = hcd_to_oxu(hcd);
3088 
3089 	spin_lock_init(&oxu->mem_lock);
3090 	INIT_LIST_HEAD(&oxu->urb_list);
3091 	oxu->urb_len = 0;
3092 
3093 	if (oxu->is_otg) {
3094 		oxu->caps = hcd->regs + OXU_OTG_CAP_OFFSET;
3095 		oxu->regs = hcd->regs + OXU_OTG_CAP_OFFSET + \
3096 			HC_LENGTH(readl(&oxu->caps->hc_capbase));
3097 
3098 		oxu->mem = hcd->regs + OXU_SPH_MEM;
3099 	} else {
3100 		oxu->caps = hcd->regs + OXU_SPH_CAP_OFFSET;
3101 		oxu->regs = hcd->regs + OXU_SPH_CAP_OFFSET + \
3102 			HC_LENGTH(readl(&oxu->caps->hc_capbase));
3103 
3104 		oxu->mem = hcd->regs + OXU_OTG_MEM;
3105 	}
3106 
3107 	oxu->hcs_params = readl(&oxu->caps->hcs_params);
3108 	oxu->sbrn = 0x20;
3109 
3110 	return oxu_hcd_init(hcd);
3111 }
3112 
3113 static int oxu_run(struct usb_hcd *hcd)
3114 {
3115 	struct oxu_hcd *oxu = hcd_to_oxu(hcd);
3116 	int retval;
3117 	u32 temp, hcc_params;
3118 
3119 	hcd->uses_new_polling = 1;
3120 
3121 	/* EHCI spec section 4.1 */
3122 	retval = ehci_reset(oxu);
3123 	if (retval != 0) {
3124 		ehci_mem_cleanup(oxu);
3125 		return retval;
3126 	}
3127 	writel(oxu->periodic_dma, &oxu->regs->frame_list);
3128 	writel((u32) oxu->async->qh_dma, &oxu->regs->async_next);
3129 
3130 	/* hcc_params controls whether oxu->regs->segment must (!!!)
3131 	 * be used; it constrains QH/ITD/SITD and QTD locations.
3132 	 * dma_pool consistent memory always uses segment zero.
3133 	 * streaming mappings for I/O buffers, like pci_map_single(),
3134 	 * can return segments above 4GB, if the device allows.
3135 	 *
3136 	 * NOTE:  the dma mask is visible through dev->dma_mask, so
3137 	 * drivers can pass this info along ... like NETIF_F_HIGHDMA,
3138 	 * Scsi_Host.highmem_io, and so forth.  It's readonly to all
3139 	 * host side drivers though.
3140 	 */
3141 	hcc_params = readl(&oxu->caps->hcc_params);
3142 	if (HCC_64BIT_ADDR(hcc_params))
3143 		writel(0, &oxu->regs->segment);
3144 
3145 	oxu->command &= ~(CMD_LRESET | CMD_IAAD | CMD_PSE |
3146 				CMD_ASE | CMD_RESET);
3147 	oxu->command |= CMD_RUN;
3148 	writel(oxu->command, &oxu->regs->command);
3149 	dbg_cmd(oxu, "init", oxu->command);
3150 
3151 	/*
3152 	 * Start, enabling full USB 2.0 functionality ... usb 1.1 devices
3153 	 * are explicitly handed to companion controller(s), so no TT is
3154 	 * involved with the root hub.  (Except where one is integrated,
3155 	 * and there's no companion controller unless maybe for USB OTG.)
3156 	 */
3157 	hcd->state = HC_STATE_RUNNING;
3158 	writel(FLAG_CF, &oxu->regs->configured_flag);
3159 	readl(&oxu->regs->command);	/* unblock posted writes */
3160 
3161 	temp = HC_VERSION(readl(&oxu->caps->hc_capbase));
3162 	oxu_info(oxu, "USB %x.%x started, quasi-EHCI %x.%02x, driver %s%s\n",
3163 		((oxu->sbrn & 0xf0)>>4), (oxu->sbrn & 0x0f),
3164 		temp >> 8, temp & 0xff, DRIVER_VERSION,
3165 		ignore_oc ? ", overcurrent ignored" : "");
3166 
3167 	writel(INTR_MASK, &oxu->regs->intr_enable); /* Turn On Interrupts */
3168 
3169 	return 0;
3170 }
3171 
3172 static void oxu_stop(struct usb_hcd *hcd)
3173 {
3174 	struct oxu_hcd *oxu = hcd_to_oxu(hcd);
3175 
3176 	/* Turn off port power on all root hub ports. */
3177 	ehci_port_power(oxu, 0);
3178 
3179 	/* no more interrupts ... */
3180 	del_timer_sync(&oxu->watchdog);
3181 
3182 	spin_lock_irq(&oxu->lock);
3183 	if (HC_IS_RUNNING(hcd->state))
3184 		ehci_quiesce(oxu);
3185 
3186 	ehci_reset(oxu);
3187 	writel(0, &oxu->regs->intr_enable);
3188 	spin_unlock_irq(&oxu->lock);
3189 
3190 	/* let companion controllers work when we aren't */
3191 	writel(0, &oxu->regs->configured_flag);
3192 
3193 	/* root hub is shut down separately (first, when possible) */
3194 	spin_lock_irq(&oxu->lock);
3195 	if (oxu->async)
3196 		ehci_work(oxu);
3197 	spin_unlock_irq(&oxu->lock);
3198 	ehci_mem_cleanup(oxu);
3199 
3200 	dbg_status(oxu, "oxu_stop completed", readl(&oxu->regs->status));
3201 }
3202 
3203 /* Kick in for silicon on any bus (not just pci, etc).
3204  * This forcibly disables dma and IRQs, helping kexec and other cases
3205  * where the next system software may expect clean state.
3206  */
3207 static void oxu_shutdown(struct usb_hcd *hcd)
3208 {
3209 	struct oxu_hcd *oxu = hcd_to_oxu(hcd);
3210 
3211 	(void) ehci_halt(oxu);
3212 	ehci_turn_off_all_ports(oxu);
3213 
3214 	/* make BIOS/etc use companion controller during reboot */
3215 	writel(0, &oxu->regs->configured_flag);
3216 
3217 	/* unblock posted writes */
3218 	readl(&oxu->regs->configured_flag);
3219 }
3220 
3221 /* Non-error returns are a promise to giveback() the urb later
3222  * we drop ownership so next owner (or urb unlink) can get it
3223  *
3224  * urb + dev is in hcd.self.controller.urb_list
3225  * we're queueing TDs onto software and hardware lists
3226  *
3227  * hcd-specific init for hcpriv hasn't been done yet
3228  *
3229  * NOTE:  control, bulk, and interrupt share the same code to append TDs
3230  * to a (possibly active) QH, and the same QH scanning code.
3231  */
3232 static int __oxu_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
3233 				gfp_t mem_flags)
3234 {
3235 	struct oxu_hcd *oxu = hcd_to_oxu(hcd);
3236 	struct list_head qtd_list;
3237 
3238 	INIT_LIST_HEAD(&qtd_list);
3239 
3240 	switch (usb_pipetype(urb->pipe)) {
3241 	case PIPE_CONTROL:
3242 	case PIPE_BULK:
3243 	default:
3244 		if (!qh_urb_transaction(oxu, urb, &qtd_list, mem_flags))
3245 			return -ENOMEM;
3246 		return submit_async(oxu, urb, &qtd_list, mem_flags);
3247 
3248 	case PIPE_INTERRUPT:
3249 		if (!qh_urb_transaction(oxu, urb, &qtd_list, mem_flags))
3250 			return -ENOMEM;
3251 		return intr_submit(oxu, urb, &qtd_list, mem_flags);
3252 
3253 	case PIPE_ISOCHRONOUS:
3254 		if (urb->dev->speed == USB_SPEED_HIGH)
3255 			return itd_submit(oxu, urb, mem_flags);
3256 		else
3257 			return sitd_submit(oxu, urb, mem_flags);
3258 	}
3259 }
3260 
3261 /* This function is responsible for breaking URBs with big data size
3262  * into smaller size and processing small urbs in sequence.
3263  */
3264 static int oxu_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
3265 				gfp_t mem_flags)
3266 {
3267 	struct oxu_hcd *oxu = hcd_to_oxu(hcd);
3268 	int num, rem;
3269 	void *transfer_buffer;
3270 	struct urb *murb;
3271 	int i, ret;
3272 
3273 	/* If not bulk pipe just enqueue the URB */
3274 	if (!usb_pipebulk(urb->pipe))
3275 		return __oxu_urb_enqueue(hcd, urb, mem_flags);
3276 
3277 	/* Otherwise we should verify the USB transfer buffer size! */
3278 	transfer_buffer = urb->transfer_buffer;
3279 
3280 	num = urb->transfer_buffer_length / 4096;
3281 	rem = urb->transfer_buffer_length % 4096;
3282 	if (rem != 0)
3283 		num++;
3284 
3285 	/* If URB is smaller than 4096 bytes just enqueue it! */
3286 	if (num == 1)
3287 		return __oxu_urb_enqueue(hcd, urb, mem_flags);
3288 
3289 	/* Ok, we have more job to do! :) */
3290 
3291 	for (i = 0; i < num - 1; i++) {
3292 		/* Get free micro URB poll till a free urb is received */
3293 
3294 		do {
3295 			murb = (struct urb *) oxu_murb_alloc(oxu);
3296 			if (!murb)
3297 				schedule();
3298 		} while (!murb);
3299 
3300 		/* Coping the urb */
3301 		memcpy(murb, urb, sizeof(struct urb));
3302 
3303 		murb->transfer_buffer_length = 4096;
3304 		murb->transfer_buffer = transfer_buffer + i * 4096;
3305 
3306 		/* Null pointer for the encodes that this is a micro urb */
3307 		murb->complete = NULL;
3308 
3309 		((struct oxu_murb *) murb)->main = urb;
3310 		((struct oxu_murb *) murb)->last = 0;
3311 
3312 		/* This loop is to guarantee urb to be processed when there's
3313 		 * not enough resources at a particular time by retrying.
3314 		 */
3315 		do {
3316 			ret  = __oxu_urb_enqueue(hcd, murb, mem_flags);
3317 			if (ret)
3318 				schedule();
3319 		} while (ret);
3320 	}
3321 
3322 	/* Last urb requires special handling  */
3323 
3324 	/* Get free micro URB poll till a free urb is received */
3325 	do {
3326 		murb = (struct urb *) oxu_murb_alloc(oxu);
3327 		if (!murb)
3328 			schedule();
3329 	} while (!murb);
3330 
3331 	/* Coping the urb */
3332 	memcpy(murb, urb, sizeof(struct urb));
3333 
3334 	murb->transfer_buffer_length = rem > 0 ? rem : 4096;
3335 	murb->transfer_buffer = transfer_buffer + (num - 1) * 4096;
3336 
3337 	/* Null pointer for the encodes that this is a micro urb */
3338 	murb->complete = NULL;
3339 
3340 	((struct oxu_murb *) murb)->main = urb;
3341 	((struct oxu_murb *) murb)->last = 1;
3342 
3343 	do {
3344 		ret = __oxu_urb_enqueue(hcd, murb, mem_flags);
3345 		if (ret)
3346 			schedule();
3347 	} while (ret);
3348 
3349 	return ret;
3350 }
3351 
3352 /* Remove from hardware lists.
3353  * Completions normally happen asynchronously
3354  */
3355 static int oxu_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
3356 {
3357 	struct oxu_hcd *oxu = hcd_to_oxu(hcd);
3358 	struct ehci_qh *qh;
3359 	unsigned long flags;
3360 
3361 	spin_lock_irqsave(&oxu->lock, flags);
3362 	switch (usb_pipetype(urb->pipe)) {
3363 	case PIPE_CONTROL:
3364 	case PIPE_BULK:
3365 	default:
3366 		qh = (struct ehci_qh *) urb->hcpriv;
3367 		if (!qh)
3368 			break;
3369 		unlink_async(oxu, qh);
3370 		break;
3371 
3372 	case PIPE_INTERRUPT:
3373 		qh = (struct ehci_qh *) urb->hcpriv;
3374 		if (!qh)
3375 			break;
3376 		switch (qh->qh_state) {
3377 		case QH_STATE_LINKED:
3378 			intr_deschedule(oxu, qh);
3379 			fallthrough;
3380 		case QH_STATE_IDLE:
3381 			qh_completions(oxu, qh);
3382 			break;
3383 		default:
3384 			oxu_dbg(oxu, "bogus qh %p state %d\n",
3385 					qh, qh->qh_state);
3386 			goto done;
3387 		}
3388 
3389 		/* reschedule QH iff another request is queued */
3390 		if (!list_empty(&qh->qtd_list)
3391 				&& HC_IS_RUNNING(hcd->state)) {
3392 			int status;
3393 
3394 			status = qh_schedule(oxu, qh);
3395 			spin_unlock_irqrestore(&oxu->lock, flags);
3396 
3397 			if (status != 0) {
3398 				/* shouldn't happen often, but ...
3399 				 * FIXME kill those tds' urbs
3400 				 */
3401 				dev_err(hcd->self.controller,
3402 					"can't reschedule qh %p, err %d\n", qh,
3403 					status);
3404 			}
3405 			return status;
3406 		}
3407 		break;
3408 	}
3409 done:
3410 	spin_unlock_irqrestore(&oxu->lock, flags);
3411 	return 0;
3412 }
3413 
3414 /* Bulk qh holds the data toggle */
3415 static void oxu_endpoint_disable(struct usb_hcd *hcd,
3416 					struct usb_host_endpoint *ep)
3417 {
3418 	struct oxu_hcd *oxu = hcd_to_oxu(hcd);
3419 	unsigned long		flags;
3420 	struct ehci_qh		*qh, *tmp;
3421 
3422 	/* ASSERT:  any requests/urbs are being unlinked */
3423 	/* ASSERT:  nobody can be submitting urbs for this any more */
3424 
3425 rescan:
3426 	spin_lock_irqsave(&oxu->lock, flags);
3427 	qh = ep->hcpriv;
3428 	if (!qh)
3429 		goto done;
3430 
3431 	/* endpoints can be iso streams.  for now, we don't
3432 	 * accelerate iso completions ... so spin a while.
3433 	 */
3434 	if (qh->hw_info1 == 0) {
3435 		oxu_vdbg(oxu, "iso delay\n");
3436 		goto idle_timeout;
3437 	}
3438 
3439 	if (!HC_IS_RUNNING(hcd->state))
3440 		qh->qh_state = QH_STATE_IDLE;
3441 	switch (qh->qh_state) {
3442 	case QH_STATE_LINKED:
3443 		for (tmp = oxu->async->qh_next.qh;
3444 				tmp && tmp != qh;
3445 				tmp = tmp->qh_next.qh)
3446 			continue;
3447 		/* periodic qh self-unlinks on empty */
3448 		if (!tmp)
3449 			goto nogood;
3450 		unlink_async(oxu, qh);
3451 		fallthrough;
3452 	case QH_STATE_UNLINK:		/* wait for hw to finish? */
3453 idle_timeout:
3454 		spin_unlock_irqrestore(&oxu->lock, flags);
3455 		schedule_timeout_uninterruptible(1);
3456 		goto rescan;
3457 	case QH_STATE_IDLE:		/* fully unlinked */
3458 		if (list_empty(&qh->qtd_list)) {
3459 			qh_put(qh);
3460 			break;
3461 		}
3462 		fallthrough;
3463 	default:
3464 nogood:
3465 		/* caller was supposed to have unlinked any requests;
3466 		 * that's not our job.  just leak this memory.
3467 		 */
3468 		oxu_err(oxu, "qh %p (#%02x) state %d%s\n",
3469 			qh, ep->desc.bEndpointAddress, qh->qh_state,
3470 			list_empty(&qh->qtd_list) ? "" : "(has tds)");
3471 		break;
3472 	}
3473 	ep->hcpriv = NULL;
3474 done:
3475 	spin_unlock_irqrestore(&oxu->lock, flags);
3476 }
3477 
3478 static int oxu_get_frame(struct usb_hcd *hcd)
3479 {
3480 	struct oxu_hcd *oxu = hcd_to_oxu(hcd);
3481 
3482 	return (readl(&oxu->regs->frame_index) >> 3) %
3483 		oxu->periodic_size;
3484 }
3485 
3486 /* Build "status change" packet (one or two bytes) from HC registers */
3487 static int oxu_hub_status_data(struct usb_hcd *hcd, char *buf)
3488 {
3489 	struct oxu_hcd *oxu = hcd_to_oxu(hcd);
3490 	u32 temp, mask, status = 0;
3491 	int ports, i, retval = 1;
3492 	unsigned long flags;
3493 
3494 	/* if !PM, root hub timers won't get shut down ... */
3495 	if (!HC_IS_RUNNING(hcd->state))
3496 		return 0;
3497 
3498 	/* init status to no-changes */
3499 	buf[0] = 0;
3500 	ports = HCS_N_PORTS(oxu->hcs_params);
3501 	if (ports > 7) {
3502 		buf[1] = 0;
3503 		retval++;
3504 	}
3505 
3506 	/* Some boards (mostly VIA?) report bogus overcurrent indications,
3507 	 * causing massive log spam unless we completely ignore them.  It
3508 	 * may be relevant that VIA VT8235 controllers, where PORT_POWER is
3509 	 * always set, seem to clear PORT_OCC and PORT_CSC when writing to
3510 	 * PORT_POWER; that's surprising, but maybe within-spec.
3511 	 */
3512 	if (!ignore_oc)
3513 		mask = PORT_CSC | PORT_PEC | PORT_OCC;
3514 	else
3515 		mask = PORT_CSC | PORT_PEC;
3516 
3517 	/* no hub change reports (bit 0) for now (power, ...) */
3518 
3519 	/* port N changes (bit N)? */
3520 	spin_lock_irqsave(&oxu->lock, flags);
3521 	for (i = 0; i < ports; i++) {
3522 		temp = readl(&oxu->regs->port_status[i]);
3523 
3524 		/*
3525 		 * Return status information even for ports with OWNER set.
3526 		 * Otherwise hub_wq wouldn't see the disconnect event when a
3527 		 * high-speed device is switched over to the companion
3528 		 * controller by the user.
3529 		 */
3530 
3531 		if (!(temp & PORT_CONNECT))
3532 			oxu->reset_done[i] = 0;
3533 		if ((temp & mask) != 0 || ((temp & PORT_RESUME) != 0 &&
3534 				time_after_eq(jiffies, oxu->reset_done[i]))) {
3535 			if (i < 7)
3536 				buf[0] |= 1 << (i + 1);
3537 			else
3538 				buf[1] |= 1 << (i - 7);
3539 			status = STS_PCD;
3540 		}
3541 	}
3542 	/* FIXME autosuspend idle root hubs */
3543 	spin_unlock_irqrestore(&oxu->lock, flags);
3544 	return status ? retval : 0;
3545 }
3546 
3547 /* Returns the speed of a device attached to a port on the root hub. */
3548 static inline unsigned int oxu_port_speed(struct oxu_hcd *oxu,
3549 						unsigned int portsc)
3550 {
3551 	switch ((portsc >> 26) & 3) {
3552 	case 0:
3553 		return 0;
3554 	case 1:
3555 		return USB_PORT_STAT_LOW_SPEED;
3556 	case 2:
3557 	default:
3558 		return USB_PORT_STAT_HIGH_SPEED;
3559 	}
3560 }
3561 
3562 #define	PORT_WAKE_BITS	(PORT_WKOC_E|PORT_WKDISC_E|PORT_WKCONN_E)
3563 static int oxu_hub_control(struct usb_hcd *hcd, u16 typeReq,
3564 				u16 wValue, u16 wIndex, char *buf, u16 wLength)
3565 {
3566 	struct oxu_hcd *oxu = hcd_to_oxu(hcd);
3567 	int ports = HCS_N_PORTS(oxu->hcs_params);
3568 	u32 __iomem *status_reg = &oxu->regs->port_status[wIndex - 1];
3569 	u32 temp, status;
3570 	unsigned long	flags;
3571 	int retval = 0;
3572 	unsigned selector;
3573 
3574 	/*
3575 	 * FIXME:  support SetPortFeatures USB_PORT_FEAT_INDICATOR.
3576 	 * HCS_INDICATOR may say we can change LEDs to off/amber/green.
3577 	 * (track current state ourselves) ... blink for diagnostics,
3578 	 * power, "this is the one", etc.  EHCI spec supports this.
3579 	 */
3580 
3581 	spin_lock_irqsave(&oxu->lock, flags);
3582 	switch (typeReq) {
3583 	case ClearHubFeature:
3584 		switch (wValue) {
3585 		case C_HUB_LOCAL_POWER:
3586 		case C_HUB_OVER_CURRENT:
3587 			/* no hub-wide feature/status flags */
3588 			break;
3589 		default:
3590 			goto error;
3591 		}
3592 		break;
3593 	case ClearPortFeature:
3594 		if (!wIndex || wIndex > ports)
3595 			goto error;
3596 		wIndex--;
3597 		temp = readl(status_reg);
3598 
3599 		/*
3600 		 * Even if OWNER is set, so the port is owned by the
3601 		 * companion controller, hub_wq needs to be able to clear
3602 		 * the port-change status bits (especially
3603 		 * USB_PORT_STAT_C_CONNECTION).
3604 		 */
3605 
3606 		switch (wValue) {
3607 		case USB_PORT_FEAT_ENABLE:
3608 			writel(temp & ~PORT_PE, status_reg);
3609 			break;
3610 		case USB_PORT_FEAT_C_ENABLE:
3611 			writel((temp & ~PORT_RWC_BITS) | PORT_PEC, status_reg);
3612 			break;
3613 		case USB_PORT_FEAT_SUSPEND:
3614 			if (temp & PORT_RESET)
3615 				goto error;
3616 			if (temp & PORT_SUSPEND) {
3617 				if ((temp & PORT_PE) == 0)
3618 					goto error;
3619 				/* resume signaling for 20 msec */
3620 				temp &= ~(PORT_RWC_BITS | PORT_WAKE_BITS);
3621 				writel(temp | PORT_RESUME, status_reg);
3622 				oxu->reset_done[wIndex] = jiffies
3623 						+ msecs_to_jiffies(20);
3624 			}
3625 			break;
3626 		case USB_PORT_FEAT_C_SUSPEND:
3627 			/* we auto-clear this feature */
3628 			break;
3629 		case USB_PORT_FEAT_POWER:
3630 			if (HCS_PPC(oxu->hcs_params))
3631 				writel(temp & ~(PORT_RWC_BITS | PORT_POWER),
3632 					  status_reg);
3633 			break;
3634 		case USB_PORT_FEAT_C_CONNECTION:
3635 			writel((temp & ~PORT_RWC_BITS) | PORT_CSC, status_reg);
3636 			break;
3637 		case USB_PORT_FEAT_C_OVER_CURRENT:
3638 			writel((temp & ~PORT_RWC_BITS) | PORT_OCC, status_reg);
3639 			break;
3640 		case USB_PORT_FEAT_C_RESET:
3641 			/* GetPortStatus clears reset */
3642 			break;
3643 		default:
3644 			goto error;
3645 		}
3646 		readl(&oxu->regs->command);	/* unblock posted write */
3647 		break;
3648 	case GetHubDescriptor:
3649 		ehci_hub_descriptor(oxu, (struct usb_hub_descriptor *)
3650 			buf);
3651 		break;
3652 	case GetHubStatus:
3653 		/* no hub-wide feature/status flags */
3654 		memset(buf, 0, 4);
3655 		break;
3656 	case GetPortStatus:
3657 		if (!wIndex || wIndex > ports)
3658 			goto error;
3659 		wIndex--;
3660 		status = 0;
3661 		temp = readl(status_reg);
3662 
3663 		/* wPortChange bits */
3664 		if (temp & PORT_CSC)
3665 			status |= USB_PORT_STAT_C_CONNECTION << 16;
3666 		if (temp & PORT_PEC)
3667 			status |= USB_PORT_STAT_C_ENABLE << 16;
3668 		if ((temp & PORT_OCC) && !ignore_oc)
3669 			status |= USB_PORT_STAT_C_OVERCURRENT << 16;
3670 
3671 		/* whoever resumes must GetPortStatus to complete it!! */
3672 		if (temp & PORT_RESUME) {
3673 
3674 			/* Remote Wakeup received? */
3675 			if (!oxu->reset_done[wIndex]) {
3676 				/* resume signaling for 20 msec */
3677 				oxu->reset_done[wIndex] = jiffies
3678 						+ msecs_to_jiffies(20);
3679 				/* check the port again */
3680 				mod_timer(&oxu_to_hcd(oxu)->rh_timer,
3681 						oxu->reset_done[wIndex]);
3682 			}
3683 
3684 			/* resume completed? */
3685 			else if (time_after_eq(jiffies,
3686 					oxu->reset_done[wIndex])) {
3687 				status |= USB_PORT_STAT_C_SUSPEND << 16;
3688 				oxu->reset_done[wIndex] = 0;
3689 
3690 				/* stop resume signaling */
3691 				temp = readl(status_reg);
3692 				writel(temp & ~(PORT_RWC_BITS | PORT_RESUME),
3693 					status_reg);
3694 				retval = handshake(oxu, status_reg,
3695 					   PORT_RESUME, 0, 2000 /* 2msec */);
3696 				if (retval != 0) {
3697 					oxu_err(oxu,
3698 						"port %d resume error %d\n",
3699 						wIndex + 1, retval);
3700 					goto error;
3701 				}
3702 				temp &= ~(PORT_SUSPEND|PORT_RESUME|(3<<10));
3703 			}
3704 		}
3705 
3706 		/* whoever resets must GetPortStatus to complete it!! */
3707 		if ((temp & PORT_RESET)
3708 				&& time_after_eq(jiffies,
3709 					oxu->reset_done[wIndex])) {
3710 			status |= USB_PORT_STAT_C_RESET << 16;
3711 			oxu->reset_done[wIndex] = 0;
3712 
3713 			/* force reset to complete */
3714 			writel(temp & ~(PORT_RWC_BITS | PORT_RESET),
3715 					status_reg);
3716 			/* REVISIT:  some hardware needs 550+ usec to clear
3717 			 * this bit; seems too long to spin routinely...
3718 			 */
3719 			retval = handshake(oxu, status_reg,
3720 					PORT_RESET, 0, 750);
3721 			if (retval != 0) {
3722 				oxu_err(oxu, "port %d reset error %d\n",
3723 					wIndex + 1, retval);
3724 				goto error;
3725 			}
3726 
3727 			/* see what we found out */
3728 			temp = check_reset_complete(oxu, wIndex, status_reg,
3729 					readl(status_reg));
3730 		}
3731 
3732 		/* transfer dedicated ports to the companion hc */
3733 		if ((temp & PORT_CONNECT) &&
3734 				test_bit(wIndex, &oxu->companion_ports)) {
3735 			temp &= ~PORT_RWC_BITS;
3736 			temp |= PORT_OWNER;
3737 			writel(temp, status_reg);
3738 			oxu_dbg(oxu, "port %d --> companion\n", wIndex + 1);
3739 			temp = readl(status_reg);
3740 		}
3741 
3742 		/*
3743 		 * Even if OWNER is set, there's no harm letting hub_wq
3744 		 * see the wPortStatus values (they should all be 0 except
3745 		 * for PORT_POWER anyway).
3746 		 */
3747 
3748 		if (temp & PORT_CONNECT) {
3749 			status |= USB_PORT_STAT_CONNECTION;
3750 			/* status may be from integrated TT */
3751 			status |= oxu_port_speed(oxu, temp);
3752 		}
3753 		if (temp & PORT_PE)
3754 			status |= USB_PORT_STAT_ENABLE;
3755 		if (temp & (PORT_SUSPEND|PORT_RESUME))
3756 			status |= USB_PORT_STAT_SUSPEND;
3757 		if (temp & PORT_OC)
3758 			status |= USB_PORT_STAT_OVERCURRENT;
3759 		if (temp & PORT_RESET)
3760 			status |= USB_PORT_STAT_RESET;
3761 		if (temp & PORT_POWER)
3762 			status |= USB_PORT_STAT_POWER;
3763 
3764 #ifndef	OXU_VERBOSE_DEBUG
3765 	if (status & ~0xffff)	/* only if wPortChange is interesting */
3766 #endif
3767 		dbg_port(oxu, "GetStatus", wIndex + 1, temp);
3768 		put_unaligned(cpu_to_le32(status), (__le32 *) buf);
3769 		break;
3770 	case SetHubFeature:
3771 		switch (wValue) {
3772 		case C_HUB_LOCAL_POWER:
3773 		case C_HUB_OVER_CURRENT:
3774 			/* no hub-wide feature/status flags */
3775 			break;
3776 		default:
3777 			goto error;
3778 		}
3779 		break;
3780 	case SetPortFeature:
3781 		selector = wIndex >> 8;
3782 		wIndex &= 0xff;
3783 		if (!wIndex || wIndex > ports)
3784 			goto error;
3785 		wIndex--;
3786 		temp = readl(status_reg);
3787 		if (temp & PORT_OWNER)
3788 			break;
3789 
3790 		temp &= ~PORT_RWC_BITS;
3791 		switch (wValue) {
3792 		case USB_PORT_FEAT_SUSPEND:
3793 			if ((temp & PORT_PE) == 0
3794 					|| (temp & PORT_RESET) != 0)
3795 				goto error;
3796 			if (device_may_wakeup(&hcd->self.root_hub->dev))
3797 				temp |= PORT_WAKE_BITS;
3798 			writel(temp | PORT_SUSPEND, status_reg);
3799 			break;
3800 		case USB_PORT_FEAT_POWER:
3801 			if (HCS_PPC(oxu->hcs_params))
3802 				writel(temp | PORT_POWER, status_reg);
3803 			break;
3804 		case USB_PORT_FEAT_RESET:
3805 			if (temp & PORT_RESUME)
3806 				goto error;
3807 			/* line status bits may report this as low speed,
3808 			 * which can be fine if this root hub has a
3809 			 * transaction translator built in.
3810 			 */
3811 			oxu_vdbg(oxu, "port %d reset\n", wIndex + 1);
3812 			temp |= PORT_RESET;
3813 			temp &= ~PORT_PE;
3814 
3815 			/*
3816 			 * caller must wait, then call GetPortStatus
3817 			 * usb 2.0 spec says 50 ms resets on root
3818 			 */
3819 			oxu->reset_done[wIndex] = jiffies
3820 					+ msecs_to_jiffies(50);
3821 			writel(temp, status_reg);
3822 			break;
3823 
3824 		/* For downstream facing ports (these):  one hub port is put
3825 		 * into test mode according to USB2 11.24.2.13, then the hub
3826 		 * must be reset (which for root hub now means rmmod+modprobe,
3827 		 * or else system reboot).  See EHCI 2.3.9 and 4.14 for info
3828 		 * about the EHCI-specific stuff.
3829 		 */
3830 		case USB_PORT_FEAT_TEST:
3831 			if (!selector || selector > 5)
3832 				goto error;
3833 			ehci_quiesce(oxu);
3834 			ehci_halt(oxu);
3835 			temp |= selector << 16;
3836 			writel(temp, status_reg);
3837 			break;
3838 
3839 		default:
3840 			goto error;
3841 		}
3842 		readl(&oxu->regs->command);	/* unblock posted writes */
3843 		break;
3844 
3845 	default:
3846 error:
3847 		/* "stall" on error */
3848 		retval = -EPIPE;
3849 	}
3850 	spin_unlock_irqrestore(&oxu->lock, flags);
3851 	return retval;
3852 }
3853 
3854 #ifdef CONFIG_PM
3855 
3856 static int oxu_bus_suspend(struct usb_hcd *hcd)
3857 {
3858 	struct oxu_hcd *oxu = hcd_to_oxu(hcd);
3859 	int port;
3860 	int mask;
3861 
3862 	oxu_dbg(oxu, "suspend root hub\n");
3863 
3864 	if (time_before(jiffies, oxu->next_statechange))
3865 		msleep(5);
3866 
3867 	port = HCS_N_PORTS(oxu->hcs_params);
3868 	spin_lock_irq(&oxu->lock);
3869 
3870 	/* stop schedules, clean any completed work */
3871 	if (HC_IS_RUNNING(hcd->state)) {
3872 		ehci_quiesce(oxu);
3873 		hcd->state = HC_STATE_QUIESCING;
3874 	}
3875 	oxu->command = readl(&oxu->regs->command);
3876 	if (oxu->reclaim)
3877 		oxu->reclaim_ready = 1;
3878 	ehci_work(oxu);
3879 
3880 	/* Unlike other USB host controller types, EHCI doesn't have
3881 	 * any notion of "global" or bus-wide suspend.  The driver has
3882 	 * to manually suspend all the active unsuspended ports, and
3883 	 * then manually resume them in the bus_resume() routine.
3884 	 */
3885 	oxu->bus_suspended = 0;
3886 	while (port--) {
3887 		u32 __iomem *reg = &oxu->regs->port_status[port];
3888 		u32 t1 = readl(reg) & ~PORT_RWC_BITS;
3889 		u32 t2 = t1;
3890 
3891 		/* keep track of which ports we suspend */
3892 		if ((t1 & PORT_PE) && !(t1 & PORT_OWNER) &&
3893 				!(t1 & PORT_SUSPEND)) {
3894 			t2 |= PORT_SUSPEND;
3895 			set_bit(port, &oxu->bus_suspended);
3896 		}
3897 
3898 		/* enable remote wakeup on all ports */
3899 		if (device_may_wakeup(&hcd->self.root_hub->dev))
3900 			t2 |= PORT_WKOC_E|PORT_WKDISC_E|PORT_WKCONN_E;
3901 		else
3902 			t2 &= ~(PORT_WKOC_E|PORT_WKDISC_E|PORT_WKCONN_E);
3903 
3904 		if (t1 != t2) {
3905 			oxu_vdbg(oxu, "port %d, %08x -> %08x\n",
3906 				port + 1, t1, t2);
3907 			writel(t2, reg);
3908 		}
3909 	}
3910 
3911 	/* turn off now-idle HC */
3912 	del_timer_sync(&oxu->watchdog);
3913 	ehci_halt(oxu);
3914 	hcd->state = HC_STATE_SUSPENDED;
3915 
3916 	/* allow remote wakeup */
3917 	mask = INTR_MASK;
3918 	if (!device_may_wakeup(&hcd->self.root_hub->dev))
3919 		mask &= ~STS_PCD;
3920 	writel(mask, &oxu->regs->intr_enable);
3921 	readl(&oxu->regs->intr_enable);
3922 
3923 	oxu->next_statechange = jiffies + msecs_to_jiffies(10);
3924 	spin_unlock_irq(&oxu->lock);
3925 	return 0;
3926 }
3927 
3928 /* Caller has locked the root hub, and should reset/reinit on error */
3929 static int oxu_bus_resume(struct usb_hcd *hcd)
3930 {
3931 	struct oxu_hcd *oxu = hcd_to_oxu(hcd);
3932 	u32 temp;
3933 	int i;
3934 
3935 	if (time_before(jiffies, oxu->next_statechange))
3936 		msleep(5);
3937 	spin_lock_irq(&oxu->lock);
3938 
3939 	/* Ideally and we've got a real resume here, and no port's power
3940 	 * was lost.  (For PCI, that means Vaux was maintained.)  But we
3941 	 * could instead be restoring a swsusp snapshot -- so that BIOS was
3942 	 * the last user of the controller, not reset/pm hardware keeping
3943 	 * state we gave to it.
3944 	 */
3945 	temp = readl(&oxu->regs->intr_enable);
3946 	oxu_dbg(oxu, "resume root hub%s\n", temp ? "" : " after power loss");
3947 
3948 	/* at least some APM implementations will try to deliver
3949 	 * IRQs right away, so delay them until we're ready.
3950 	 */
3951 	writel(0, &oxu->regs->intr_enable);
3952 
3953 	/* re-init operational registers */
3954 	writel(0, &oxu->regs->segment);
3955 	writel(oxu->periodic_dma, &oxu->regs->frame_list);
3956 	writel((u32) oxu->async->qh_dma, &oxu->regs->async_next);
3957 
3958 	/* restore CMD_RUN, framelist size, and irq threshold */
3959 	writel(oxu->command, &oxu->regs->command);
3960 
3961 	/* Some controller/firmware combinations need a delay during which
3962 	 * they set up the port statuses.  See Bugzilla #8190. */
3963 	mdelay(8);
3964 
3965 	/* manually resume the ports we suspended during bus_suspend() */
3966 	i = HCS_N_PORTS(oxu->hcs_params);
3967 	while (i--) {
3968 		temp = readl(&oxu->regs->port_status[i]);
3969 		temp &= ~(PORT_RWC_BITS
3970 			| PORT_WKOC_E | PORT_WKDISC_E | PORT_WKCONN_E);
3971 		if (test_bit(i, &oxu->bus_suspended) && (temp & PORT_SUSPEND)) {
3972 			oxu->reset_done[i] = jiffies + msecs_to_jiffies(20);
3973 			temp |= PORT_RESUME;
3974 		}
3975 		writel(temp, &oxu->regs->port_status[i]);
3976 	}
3977 	i = HCS_N_PORTS(oxu->hcs_params);
3978 	mdelay(20);
3979 	while (i--) {
3980 		temp = readl(&oxu->regs->port_status[i]);
3981 		if (test_bit(i, &oxu->bus_suspended) && (temp & PORT_SUSPEND)) {
3982 			temp &= ~(PORT_RWC_BITS | PORT_RESUME);
3983 			writel(temp, &oxu->regs->port_status[i]);
3984 			oxu_vdbg(oxu, "resumed port %d\n", i + 1);
3985 		}
3986 	}
3987 	(void) readl(&oxu->regs->command);
3988 
3989 	/* maybe re-activate the schedule(s) */
3990 	temp = 0;
3991 	if (oxu->async->qh_next.qh)
3992 		temp |= CMD_ASE;
3993 	if (oxu->periodic_sched)
3994 		temp |= CMD_PSE;
3995 	if (temp) {
3996 		oxu->command |= temp;
3997 		writel(oxu->command, &oxu->regs->command);
3998 	}
3999 
4000 	oxu->next_statechange = jiffies + msecs_to_jiffies(5);
4001 	hcd->state = HC_STATE_RUNNING;
4002 
4003 	/* Now we can safely re-enable irqs */
4004 	writel(INTR_MASK, &oxu->regs->intr_enable);
4005 
4006 	spin_unlock_irq(&oxu->lock);
4007 	return 0;
4008 }
4009 
4010 #else
4011 
4012 static int oxu_bus_suspend(struct usb_hcd *hcd)
4013 {
4014 	return 0;
4015 }
4016 
4017 static int oxu_bus_resume(struct usb_hcd *hcd)
4018 {
4019 	return 0;
4020 }
4021 
4022 #endif	/* CONFIG_PM */
4023 
4024 static const struct hc_driver oxu_hc_driver = {
4025 	.description =		"oxu210hp_hcd",
4026 	.product_desc =		"oxu210hp HCD",
4027 	.hcd_priv_size =	sizeof(struct oxu_hcd),
4028 
4029 	/*
4030 	 * Generic hardware linkage
4031 	 */
4032 	.irq =			oxu_irq,
4033 	.flags =		HCD_MEMORY | HCD_USB2,
4034 
4035 	/*
4036 	 * Basic lifecycle operations
4037 	 */
4038 	.reset =		oxu_reset,
4039 	.start =		oxu_run,
4040 	.stop =			oxu_stop,
4041 	.shutdown =		oxu_shutdown,
4042 
4043 	/*
4044 	 * Managing i/o requests and associated device resources
4045 	 */
4046 	.urb_enqueue =		oxu_urb_enqueue,
4047 	.urb_dequeue =		oxu_urb_dequeue,
4048 	.endpoint_disable =	oxu_endpoint_disable,
4049 
4050 	/*
4051 	 * Scheduling support
4052 	 */
4053 	.get_frame_number =	oxu_get_frame,
4054 
4055 	/*
4056 	 * Root hub support
4057 	 */
4058 	.hub_status_data =	oxu_hub_status_data,
4059 	.hub_control =		oxu_hub_control,
4060 	.bus_suspend =		oxu_bus_suspend,
4061 	.bus_resume =		oxu_bus_resume,
4062 };
4063 
4064 /*
4065  * Module stuff
4066  */
4067 
4068 static void oxu_configuration(struct platform_device *pdev, void __iomem *base)
4069 {
4070 	u32 tmp;
4071 
4072 	/* Initialize top level registers.
4073 	 * First write ever
4074 	 */
4075 	oxu_writel(base, OXU_HOSTIFCONFIG, 0x0000037D);
4076 	oxu_writel(base, OXU_SOFTRESET, OXU_SRESET);
4077 	oxu_writel(base, OXU_HOSTIFCONFIG, 0x0000037D);
4078 
4079 	tmp = oxu_readl(base, OXU_PIOBURSTREADCTRL);
4080 	oxu_writel(base, OXU_PIOBURSTREADCTRL, tmp | 0x0040);
4081 
4082 	oxu_writel(base, OXU_ASO, OXU_SPHPOEN | OXU_OVRCCURPUPDEN |
4083 					OXU_COMPARATOR | OXU_ASO_OP);
4084 
4085 	tmp = oxu_readl(base, OXU_CLKCTRL_SET);
4086 	oxu_writel(base, OXU_CLKCTRL_SET, tmp | OXU_SYSCLKEN | OXU_USBOTGCLKEN);
4087 
4088 	/* Clear all top interrupt enable */
4089 	oxu_writel(base, OXU_CHIPIRQEN_CLR, 0xff);
4090 
4091 	/* Clear all top interrupt status */
4092 	oxu_writel(base, OXU_CHIPIRQSTATUS, 0xff);
4093 
4094 	/* Enable all needed top interrupt except OTG SPH core */
4095 	oxu_writel(base, OXU_CHIPIRQEN_SET, OXU_USBSPHLPWUI | OXU_USBOTGLPWUI);
4096 }
4097 
4098 static int oxu_verify_id(struct platform_device *pdev, void __iomem *base)
4099 {
4100 	u32 id;
4101 	static const char * const bo[] = {
4102 		"reserved",
4103 		"128-pin LQFP",
4104 		"84-pin TFBGA",
4105 		"reserved",
4106 	};
4107 
4108 	/* Read controller signature register to find a match */
4109 	id = oxu_readl(base, OXU_DEVICEID);
4110 	dev_info(&pdev->dev, "device ID %x\n", id);
4111 	if ((id & OXU_REV_MASK) != (OXU_REV_2100 << OXU_REV_SHIFT))
4112 		return -1;
4113 
4114 	dev_info(&pdev->dev, "found device %x %s (%04x:%04x)\n",
4115 		id >> OXU_REV_SHIFT,
4116 		bo[(id & OXU_BO_MASK) >> OXU_BO_SHIFT],
4117 		(id & OXU_MAJ_REV_MASK) >> OXU_MAJ_REV_SHIFT,
4118 		(id & OXU_MIN_REV_MASK) >> OXU_MIN_REV_SHIFT);
4119 
4120 	return 0;
4121 }
4122 
4123 static const struct hc_driver oxu_hc_driver;
4124 static struct usb_hcd *oxu_create(struct platform_device *pdev,
4125 				unsigned long memstart, unsigned long memlen,
4126 				void __iomem *base, int irq, int otg)
4127 {
4128 	struct device *dev = &pdev->dev;
4129 
4130 	struct usb_hcd *hcd;
4131 	struct oxu_hcd *oxu;
4132 	int ret;
4133 
4134 	/* Set endian mode and host mode */
4135 	oxu_writel(base + (otg ? OXU_OTG_CORE_OFFSET : OXU_SPH_CORE_OFFSET),
4136 				OXU_USBMODE,
4137 				OXU_CM_HOST_ONLY | OXU_ES_LITTLE | OXU_VBPS);
4138 
4139 	hcd = usb_create_hcd(&oxu_hc_driver, dev,
4140 				otg ? "oxu210hp_otg" : "oxu210hp_sph");
4141 	if (!hcd)
4142 		return ERR_PTR(-ENOMEM);
4143 
4144 	hcd->rsrc_start = memstart;
4145 	hcd->rsrc_len = memlen;
4146 	hcd->regs = base;
4147 	hcd->irq = irq;
4148 	hcd->state = HC_STATE_HALT;
4149 
4150 	oxu = hcd_to_oxu(hcd);
4151 	oxu->is_otg = otg;
4152 
4153 	ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
4154 	if (ret < 0)
4155 		return ERR_PTR(ret);
4156 
4157 	device_wakeup_enable(hcd->self.controller);
4158 	return hcd;
4159 }
4160 
4161 static int oxu_init(struct platform_device *pdev,
4162 				unsigned long memstart, unsigned long memlen,
4163 				void __iomem *base, int irq)
4164 {
4165 	struct oxu_info *info = platform_get_drvdata(pdev);
4166 	struct usb_hcd *hcd;
4167 	int ret;
4168 
4169 	/* First time configuration at start up */
4170 	oxu_configuration(pdev, base);
4171 
4172 	ret = oxu_verify_id(pdev, base);
4173 	if (ret) {
4174 		dev_err(&pdev->dev, "no devices found!\n");
4175 		return -ENODEV;
4176 	}
4177 
4178 	/* Create the OTG controller */
4179 	hcd = oxu_create(pdev, memstart, memlen, base, irq, 1);
4180 	if (IS_ERR(hcd)) {
4181 		dev_err(&pdev->dev, "cannot create OTG controller!\n");
4182 		ret = PTR_ERR(hcd);
4183 		goto error_create_otg;
4184 	}
4185 	info->hcd[0] = hcd;
4186 
4187 	/* Create the SPH host controller */
4188 	hcd = oxu_create(pdev, memstart, memlen, base, irq, 0);
4189 	if (IS_ERR(hcd)) {
4190 		dev_err(&pdev->dev, "cannot create SPH controller!\n");
4191 		ret = PTR_ERR(hcd);
4192 		goto error_create_sph;
4193 	}
4194 	info->hcd[1] = hcd;
4195 
4196 	oxu_writel(base, OXU_CHIPIRQEN_SET,
4197 		oxu_readl(base, OXU_CHIPIRQEN_SET) | 3);
4198 
4199 	return 0;
4200 
4201 error_create_sph:
4202 	usb_remove_hcd(info->hcd[0]);
4203 	usb_put_hcd(info->hcd[0]);
4204 
4205 error_create_otg:
4206 	return ret;
4207 }
4208 
4209 static int oxu_drv_probe(struct platform_device *pdev)
4210 {
4211 	struct resource *res;
4212 	void __iomem *base;
4213 	unsigned long memstart, memlen;
4214 	int irq, ret;
4215 	struct oxu_info *info;
4216 
4217 	if (usb_disabled())
4218 		return -ENODEV;
4219 
4220 	/*
4221 	 * Get the platform resources
4222 	 */
4223 	res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
4224 	if (!res) {
4225 		dev_err(&pdev->dev,
4226 			"no IRQ! Check %s setup!\n", dev_name(&pdev->dev));
4227 		return -ENODEV;
4228 	}
4229 	irq = res->start;
4230 	dev_dbg(&pdev->dev, "IRQ resource %d\n", irq);
4231 
4232 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
4233 	base = devm_ioremap_resource(&pdev->dev, res);
4234 	if (IS_ERR(base)) {
4235 		ret = PTR_ERR(base);
4236 		goto error;
4237 	}
4238 	memstart = res->start;
4239 	memlen = resource_size(res);
4240 
4241 	ret = irq_set_irq_type(irq, IRQF_TRIGGER_FALLING);
4242 	if (ret) {
4243 		dev_err(&pdev->dev, "error setting irq type\n");
4244 		ret = -EFAULT;
4245 		goto error;
4246 	}
4247 
4248 	/* Allocate a driver data struct to hold useful info for both
4249 	 * SPH & OTG devices
4250 	 */
4251 	info = devm_kzalloc(&pdev->dev, sizeof(struct oxu_info), GFP_KERNEL);
4252 	if (!info) {
4253 		ret = -EFAULT;
4254 		goto error;
4255 	}
4256 	platform_set_drvdata(pdev, info);
4257 
4258 	ret = oxu_init(pdev, memstart, memlen, base, irq);
4259 	if (ret < 0) {
4260 		dev_dbg(&pdev->dev, "cannot init USB devices\n");
4261 		goto error;
4262 	}
4263 
4264 	dev_info(&pdev->dev, "devices enabled and running\n");
4265 	platform_set_drvdata(pdev, info);
4266 
4267 	return 0;
4268 
4269 error:
4270 	dev_err(&pdev->dev, "init %s fail, %d\n", dev_name(&pdev->dev), ret);
4271 	return ret;
4272 }
4273 
4274 static void oxu_remove(struct platform_device *pdev, struct usb_hcd *hcd)
4275 {
4276 	usb_remove_hcd(hcd);
4277 	usb_put_hcd(hcd);
4278 }
4279 
4280 static int oxu_drv_remove(struct platform_device *pdev)
4281 {
4282 	struct oxu_info *info = platform_get_drvdata(pdev);
4283 
4284 	oxu_remove(pdev, info->hcd[0]);
4285 	oxu_remove(pdev, info->hcd[1]);
4286 
4287 	return 0;
4288 }
4289 
4290 static void oxu_drv_shutdown(struct platform_device *pdev)
4291 {
4292 	oxu_drv_remove(pdev);
4293 }
4294 
4295 #if 0
4296 /* FIXME: TODO */
4297 static int oxu_drv_suspend(struct device *dev)
4298 {
4299 	struct platform_device *pdev = to_platform_device(dev);
4300 	struct usb_hcd *hcd = dev_get_drvdata(dev);
4301 
4302 	return 0;
4303 }
4304 
4305 static int oxu_drv_resume(struct device *dev)
4306 {
4307 	struct platform_device *pdev = to_platform_device(dev);
4308 	struct usb_hcd *hcd = dev_get_drvdata(dev);
4309 
4310 	return 0;
4311 }
4312 #else
4313 #define oxu_drv_suspend	NULL
4314 #define oxu_drv_resume	NULL
4315 #endif
4316 
4317 static struct platform_driver oxu_driver = {
4318 	.probe		= oxu_drv_probe,
4319 	.remove		= oxu_drv_remove,
4320 	.shutdown	= oxu_drv_shutdown,
4321 	.suspend	= oxu_drv_suspend,
4322 	.resume		= oxu_drv_resume,
4323 	.driver = {
4324 		.name = "oxu210hp-hcd",
4325 		.bus = &platform_bus_type
4326 	}
4327 };
4328 
4329 module_platform_driver(oxu_driver);
4330 
4331 MODULE_DESCRIPTION("Oxford OXU210HP HCD driver - ver. " DRIVER_VERSION);
4332 MODULE_AUTHOR("Rodolfo Giometti <giometti@linux.it>");
4333 MODULE_LICENSE("GPL");
4334