xref: /openbmc/linux/drivers/usb/host/xhci-mem.c (revision 26cc5cb0)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * xHCI host controller driver
4  *
5  * Copyright (C) 2008 Intel Corp.
6  *
7  * Author: Sarah Sharp
8  * Some code borrowed from the Linux EHCI driver.
9  */
10 
11 #include <linux/usb.h>
12 #include <linux/overflow.h>
13 #include <linux/pci.h>
14 #include <linux/slab.h>
15 #include <linux/dmapool.h>
16 #include <linux/dma-mapping.h>
17 
18 #include "xhci.h"
19 #include "xhci-trace.h"
20 #include "xhci-debugfs.h"
21 
22 /*
23  * Allocates a generic ring segment from the ring pool, sets the dma address,
24  * initializes the segment to zero, and sets the private next pointer to NULL.
25  *
26  * Section 4.11.1.1:
27  * "All components of all Command and Transfer TRBs shall be initialized to '0'"
28  */
29 static struct xhci_segment *xhci_segment_alloc(struct xhci_hcd *xhci,
30 					       unsigned int cycle_state,
31 					       unsigned int max_packet,
32 					       gfp_t flags)
33 {
34 	struct xhci_segment *seg;
35 	dma_addr_t	dma;
36 	int		i;
37 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
38 
39 	seg = kzalloc_node(sizeof(*seg), flags, dev_to_node(dev));
40 	if (!seg)
41 		return NULL;
42 
43 	seg->trbs = dma_pool_zalloc(xhci->segment_pool, flags, &dma);
44 	if (!seg->trbs) {
45 		kfree(seg);
46 		return NULL;
47 	}
48 
49 	if (max_packet) {
50 		seg->bounce_buf = kzalloc_node(max_packet, flags,
51 					dev_to_node(dev));
52 		if (!seg->bounce_buf) {
53 			dma_pool_free(xhci->segment_pool, seg->trbs, dma);
54 			kfree(seg);
55 			return NULL;
56 		}
57 	}
58 	/* If the cycle state is 0, set the cycle bit to 1 for all the TRBs */
59 	if (cycle_state == 0) {
60 		for (i = 0; i < TRBS_PER_SEGMENT; i++)
61 			seg->trbs[i].link.control = cpu_to_le32(TRB_CYCLE);
62 	}
63 	seg->dma = dma;
64 	seg->next = NULL;
65 
66 	return seg;
67 }
68 
69 static void xhci_segment_free(struct xhci_hcd *xhci, struct xhci_segment *seg)
70 {
71 	if (seg->trbs) {
72 		dma_pool_free(xhci->segment_pool, seg->trbs, seg->dma);
73 		seg->trbs = NULL;
74 	}
75 	kfree(seg->bounce_buf);
76 	kfree(seg);
77 }
78 
79 static void xhci_free_segments_for_ring(struct xhci_hcd *xhci,
80 				struct xhci_segment *first)
81 {
82 	struct xhci_segment *seg;
83 
84 	seg = first->next;
85 	while (seg != first) {
86 		struct xhci_segment *next = seg->next;
87 		xhci_segment_free(xhci, seg);
88 		seg = next;
89 	}
90 	xhci_segment_free(xhci, first);
91 }
92 
93 /*
94  * Make the prev segment point to the next segment.
95  *
96  * Change the last TRB in the prev segment to be a Link TRB which points to the
97  * DMA address of the next segment.  The caller needs to set any Link TRB
98  * related flags, such as End TRB, Toggle Cycle, and no snoop.
99  */
100 static void xhci_link_segments(struct xhci_segment *prev,
101 			       struct xhci_segment *next,
102 			       enum xhci_ring_type type, bool chain_links)
103 {
104 	u32 val;
105 
106 	if (!prev || !next)
107 		return;
108 	prev->next = next;
109 	if (type != TYPE_EVENT) {
110 		prev->trbs[TRBS_PER_SEGMENT-1].link.segment_ptr =
111 			cpu_to_le64(next->dma);
112 
113 		/* Set the last TRB in the segment to have a TRB type ID of Link TRB */
114 		val = le32_to_cpu(prev->trbs[TRBS_PER_SEGMENT-1].link.control);
115 		val &= ~TRB_TYPE_BITMASK;
116 		val |= TRB_TYPE(TRB_LINK);
117 		if (chain_links)
118 			val |= TRB_CHAIN;
119 		prev->trbs[TRBS_PER_SEGMENT-1].link.control = cpu_to_le32(val);
120 	}
121 }
122 
123 /*
124  * Link the ring to the new segments.
125  * Set Toggle Cycle for the new ring if needed.
126  */
127 static void xhci_link_rings(struct xhci_hcd *xhci, struct xhci_ring *ring,
128 		struct xhci_segment *first, struct xhci_segment *last,
129 		unsigned int num_segs)
130 {
131 	struct xhci_segment *next;
132 	bool chain_links;
133 
134 	if (!ring || !first || !last)
135 		return;
136 
137 	/* Set chain bit for 0.95 hosts, and for isoc rings on AMD 0.96 host */
138 	chain_links = !!(xhci_link_trb_quirk(xhci) ||
139 			 (ring->type == TYPE_ISOC &&
140 			  (xhci->quirks & XHCI_AMD_0x96_HOST)));
141 
142 	next = ring->enq_seg->next;
143 	xhci_link_segments(ring->enq_seg, first, ring->type, chain_links);
144 	xhci_link_segments(last, next, ring->type, chain_links);
145 	ring->num_segs += num_segs;
146 
147 	if (ring->type != TYPE_EVENT && ring->enq_seg == ring->last_seg) {
148 		ring->last_seg->trbs[TRBS_PER_SEGMENT-1].link.control
149 			&= ~cpu_to_le32(LINK_TOGGLE);
150 		last->trbs[TRBS_PER_SEGMENT-1].link.control
151 			|= cpu_to_le32(LINK_TOGGLE);
152 		ring->last_seg = last;
153 	}
154 }
155 
156 /*
157  * We need a radix tree for mapping physical addresses of TRBs to which stream
158  * ID they belong to.  We need to do this because the host controller won't tell
159  * us which stream ring the TRB came from.  We could store the stream ID in an
160  * event data TRB, but that doesn't help us for the cancellation case, since the
161  * endpoint may stop before it reaches that event data TRB.
162  *
163  * The radix tree maps the upper portion of the TRB DMA address to a ring
164  * segment that has the same upper portion of DMA addresses.  For example, say I
165  * have segments of size 1KB, that are always 1KB aligned.  A segment may
166  * start at 0x10c91000 and end at 0x10c913f0.  If I use the upper 10 bits, the
167  * key to the stream ID is 0x43244.  I can use the DMA address of the TRB to
168  * pass the radix tree a key to get the right stream ID:
169  *
170  *	0x10c90fff >> 10 = 0x43243
171  *	0x10c912c0 >> 10 = 0x43244
172  *	0x10c91400 >> 10 = 0x43245
173  *
174  * Obviously, only those TRBs with DMA addresses that are within the segment
175  * will make the radix tree return the stream ID for that ring.
176  *
177  * Caveats for the radix tree:
178  *
179  * The radix tree uses an unsigned long as a key pair.  On 32-bit systems, an
180  * unsigned long will be 32-bits; on a 64-bit system an unsigned long will be
181  * 64-bits.  Since we only request 32-bit DMA addresses, we can use that as the
182  * key on 32-bit or 64-bit systems (it would also be fine if we asked for 64-bit
183  * PCI DMA addresses on a 64-bit system).  There might be a problem on 32-bit
184  * extended systems (where the DMA address can be bigger than 32-bits),
185  * if we allow the PCI dma mask to be bigger than 32-bits.  So don't do that.
186  */
187 static int xhci_insert_segment_mapping(struct radix_tree_root *trb_address_map,
188 		struct xhci_ring *ring,
189 		struct xhci_segment *seg,
190 		gfp_t mem_flags)
191 {
192 	unsigned long key;
193 	int ret;
194 
195 	key = (unsigned long)(seg->dma >> TRB_SEGMENT_SHIFT);
196 	/* Skip any segments that were already added. */
197 	if (radix_tree_lookup(trb_address_map, key))
198 		return 0;
199 
200 	ret = radix_tree_maybe_preload(mem_flags);
201 	if (ret)
202 		return ret;
203 	ret = radix_tree_insert(trb_address_map,
204 			key, ring);
205 	radix_tree_preload_end();
206 	return ret;
207 }
208 
209 static void xhci_remove_segment_mapping(struct radix_tree_root *trb_address_map,
210 		struct xhci_segment *seg)
211 {
212 	unsigned long key;
213 
214 	key = (unsigned long)(seg->dma >> TRB_SEGMENT_SHIFT);
215 	if (radix_tree_lookup(trb_address_map, key))
216 		radix_tree_delete(trb_address_map, key);
217 }
218 
219 static int xhci_update_stream_segment_mapping(
220 		struct radix_tree_root *trb_address_map,
221 		struct xhci_ring *ring,
222 		struct xhci_segment *first_seg,
223 		struct xhci_segment *last_seg,
224 		gfp_t mem_flags)
225 {
226 	struct xhci_segment *seg;
227 	struct xhci_segment *failed_seg;
228 	int ret;
229 
230 	if (WARN_ON_ONCE(trb_address_map == NULL))
231 		return 0;
232 
233 	seg = first_seg;
234 	do {
235 		ret = xhci_insert_segment_mapping(trb_address_map,
236 				ring, seg, mem_flags);
237 		if (ret)
238 			goto remove_streams;
239 		if (seg == last_seg)
240 			return 0;
241 		seg = seg->next;
242 	} while (seg != first_seg);
243 
244 	return 0;
245 
246 remove_streams:
247 	failed_seg = seg;
248 	seg = first_seg;
249 	do {
250 		xhci_remove_segment_mapping(trb_address_map, seg);
251 		if (seg == failed_seg)
252 			return ret;
253 		seg = seg->next;
254 	} while (seg != first_seg);
255 
256 	return ret;
257 }
258 
259 static void xhci_remove_stream_mapping(struct xhci_ring *ring)
260 {
261 	struct xhci_segment *seg;
262 
263 	if (WARN_ON_ONCE(ring->trb_address_map == NULL))
264 		return;
265 
266 	seg = ring->first_seg;
267 	do {
268 		xhci_remove_segment_mapping(ring->trb_address_map, seg);
269 		seg = seg->next;
270 	} while (seg != ring->first_seg);
271 }
272 
273 static int xhci_update_stream_mapping(struct xhci_ring *ring, gfp_t mem_flags)
274 {
275 	return xhci_update_stream_segment_mapping(ring->trb_address_map, ring,
276 			ring->first_seg, ring->last_seg, mem_flags);
277 }
278 
279 /* XXX: Do we need the hcd structure in all these functions? */
280 void xhci_ring_free(struct xhci_hcd *xhci, struct xhci_ring *ring)
281 {
282 	if (!ring)
283 		return;
284 
285 	trace_xhci_ring_free(ring);
286 
287 	if (ring->first_seg) {
288 		if (ring->type == TYPE_STREAM)
289 			xhci_remove_stream_mapping(ring);
290 		xhci_free_segments_for_ring(xhci, ring->first_seg);
291 	}
292 
293 	kfree(ring);
294 }
295 
296 void xhci_initialize_ring_info(struct xhci_ring *ring,
297 			       unsigned int cycle_state)
298 {
299 	/* The ring is empty, so the enqueue pointer == dequeue pointer */
300 	ring->enqueue = ring->first_seg->trbs;
301 	ring->enq_seg = ring->first_seg;
302 	ring->dequeue = ring->enqueue;
303 	ring->deq_seg = ring->first_seg;
304 	/* The ring is initialized to 0. The producer must write 1 to the cycle
305 	 * bit to handover ownership of the TRB, so PCS = 1.  The consumer must
306 	 * compare CCS to the cycle bit to check ownership, so CCS = 1.
307 	 *
308 	 * New rings are initialized with cycle state equal to 1; if we are
309 	 * handling ring expansion, set the cycle state equal to the old ring.
310 	 */
311 	ring->cycle_state = cycle_state;
312 
313 	/*
314 	 * Each segment has a link TRB, and leave an extra TRB for SW
315 	 * accounting purpose
316 	 */
317 	ring->num_trbs_free = ring->num_segs * (TRBS_PER_SEGMENT - 1) - 1;
318 }
319 
320 /* Allocate segments and link them for a ring */
321 static int xhci_alloc_segments_for_ring(struct xhci_hcd *xhci,
322 		struct xhci_segment **first, struct xhci_segment **last,
323 		unsigned int num_segs, unsigned int cycle_state,
324 		enum xhci_ring_type type, unsigned int max_packet, gfp_t flags)
325 {
326 	struct xhci_segment *prev;
327 	bool chain_links;
328 
329 	/* Set chain bit for 0.95 hosts, and for isoc rings on AMD 0.96 host */
330 	chain_links = !!(xhci_link_trb_quirk(xhci) ||
331 			 (type == TYPE_ISOC &&
332 			  (xhci->quirks & XHCI_AMD_0x96_HOST)));
333 
334 	prev = xhci_segment_alloc(xhci, cycle_state, max_packet, flags);
335 	if (!prev)
336 		return -ENOMEM;
337 	num_segs--;
338 
339 	*first = prev;
340 	while (num_segs > 0) {
341 		struct xhci_segment	*next;
342 
343 		next = xhci_segment_alloc(xhci, cycle_state, max_packet, flags);
344 		if (!next) {
345 			prev = *first;
346 			while (prev) {
347 				next = prev->next;
348 				xhci_segment_free(xhci, prev);
349 				prev = next;
350 			}
351 			return -ENOMEM;
352 		}
353 		xhci_link_segments(prev, next, type, chain_links);
354 
355 		prev = next;
356 		num_segs--;
357 	}
358 	xhci_link_segments(prev, *first, type, chain_links);
359 	*last = prev;
360 
361 	return 0;
362 }
363 
364 /*
365  * Create a new ring with zero or more segments.
366  *
367  * Link each segment together into a ring.
368  * Set the end flag and the cycle toggle bit on the last segment.
369  * See section 4.9.1 and figures 15 and 16.
370  */
371 struct xhci_ring *xhci_ring_alloc(struct xhci_hcd *xhci,
372 		unsigned int num_segs, unsigned int cycle_state,
373 		enum xhci_ring_type type, unsigned int max_packet, gfp_t flags)
374 {
375 	struct xhci_ring	*ring;
376 	int ret;
377 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
378 
379 	ring = kzalloc_node(sizeof(*ring), flags, dev_to_node(dev));
380 	if (!ring)
381 		return NULL;
382 
383 	ring->num_segs = num_segs;
384 	ring->bounce_buf_len = max_packet;
385 	INIT_LIST_HEAD(&ring->td_list);
386 	ring->type = type;
387 	if (num_segs == 0)
388 		return ring;
389 
390 	ret = xhci_alloc_segments_for_ring(xhci, &ring->first_seg,
391 			&ring->last_seg, num_segs, cycle_state, type,
392 			max_packet, flags);
393 	if (ret)
394 		goto fail;
395 
396 	/* Only event ring does not use link TRB */
397 	if (type != TYPE_EVENT) {
398 		/* See section 4.9.2.1 and 6.4.4.1 */
399 		ring->last_seg->trbs[TRBS_PER_SEGMENT - 1].link.control |=
400 			cpu_to_le32(LINK_TOGGLE);
401 	}
402 	xhci_initialize_ring_info(ring, cycle_state);
403 	trace_xhci_ring_alloc(ring);
404 	return ring;
405 
406 fail:
407 	kfree(ring);
408 	return NULL;
409 }
410 
411 void xhci_free_endpoint_ring(struct xhci_hcd *xhci,
412 		struct xhci_virt_device *virt_dev,
413 		unsigned int ep_index)
414 {
415 	xhci_ring_free(xhci, virt_dev->eps[ep_index].ring);
416 	virt_dev->eps[ep_index].ring = NULL;
417 }
418 
419 /*
420  * Expand an existing ring.
421  * Allocate a new ring which has same segment numbers and link the two rings.
422  */
423 int xhci_ring_expansion(struct xhci_hcd *xhci, struct xhci_ring *ring,
424 				unsigned int num_new_segs, gfp_t flags)
425 {
426 	struct xhci_segment	*first;
427 	struct xhci_segment	*last;
428 	int			ret;
429 
430 	ret = xhci_alloc_segments_for_ring(xhci, &first, &last,
431 			num_new_segs, ring->cycle_state, ring->type,
432 			ring->bounce_buf_len, flags);
433 	if (ret)
434 		return -ENOMEM;
435 
436 	if (ring->type == TYPE_STREAM)
437 		ret = xhci_update_stream_segment_mapping(ring->trb_address_map,
438 						ring, first, last, flags);
439 	if (ret) {
440 		struct xhci_segment *next;
441 		do {
442 			next = first->next;
443 			xhci_segment_free(xhci, first);
444 			if (first == last)
445 				break;
446 			first = next;
447 		} while (true);
448 		return ret;
449 	}
450 
451 	xhci_link_rings(xhci, ring, first, last, num_new_segs);
452 	trace_xhci_ring_expansion(ring);
453 	xhci_dbg_trace(xhci, trace_xhci_dbg_ring_expansion,
454 			"ring expansion succeed, now has %d segments",
455 			ring->num_segs);
456 
457 	return 0;
458 }
459 
460 struct xhci_container_ctx *xhci_alloc_container_ctx(struct xhci_hcd *xhci,
461 						    int type, gfp_t flags)
462 {
463 	struct xhci_container_ctx *ctx;
464 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
465 
466 	if ((type != XHCI_CTX_TYPE_DEVICE) && (type != XHCI_CTX_TYPE_INPUT))
467 		return NULL;
468 
469 	ctx = kzalloc_node(sizeof(*ctx), flags, dev_to_node(dev));
470 	if (!ctx)
471 		return NULL;
472 
473 	ctx->type = type;
474 	ctx->size = HCC_64BYTE_CONTEXT(xhci->hcc_params) ? 2048 : 1024;
475 	if (type == XHCI_CTX_TYPE_INPUT)
476 		ctx->size += CTX_SIZE(xhci->hcc_params);
477 
478 	ctx->bytes = dma_pool_zalloc(xhci->device_pool, flags, &ctx->dma);
479 	if (!ctx->bytes) {
480 		kfree(ctx);
481 		return NULL;
482 	}
483 	return ctx;
484 }
485 
486 void xhci_free_container_ctx(struct xhci_hcd *xhci,
487 			     struct xhci_container_ctx *ctx)
488 {
489 	if (!ctx)
490 		return;
491 	dma_pool_free(xhci->device_pool, ctx->bytes, ctx->dma);
492 	kfree(ctx);
493 }
494 
495 struct xhci_input_control_ctx *xhci_get_input_control_ctx(
496 					      struct xhci_container_ctx *ctx)
497 {
498 	if (ctx->type != XHCI_CTX_TYPE_INPUT)
499 		return NULL;
500 
501 	return (struct xhci_input_control_ctx *)ctx->bytes;
502 }
503 
504 struct xhci_slot_ctx *xhci_get_slot_ctx(struct xhci_hcd *xhci,
505 					struct xhci_container_ctx *ctx)
506 {
507 	if (ctx->type == XHCI_CTX_TYPE_DEVICE)
508 		return (struct xhci_slot_ctx *)ctx->bytes;
509 
510 	return (struct xhci_slot_ctx *)
511 		(ctx->bytes + CTX_SIZE(xhci->hcc_params));
512 }
513 
514 struct xhci_ep_ctx *xhci_get_ep_ctx(struct xhci_hcd *xhci,
515 				    struct xhci_container_ctx *ctx,
516 				    unsigned int ep_index)
517 {
518 	/* increment ep index by offset of start of ep ctx array */
519 	ep_index++;
520 	if (ctx->type == XHCI_CTX_TYPE_INPUT)
521 		ep_index++;
522 
523 	return (struct xhci_ep_ctx *)
524 		(ctx->bytes + (ep_index * CTX_SIZE(xhci->hcc_params)));
525 }
526 EXPORT_SYMBOL_GPL(xhci_get_ep_ctx);
527 
528 /***************** Streams structures manipulation *************************/
529 
530 static void xhci_free_stream_ctx(struct xhci_hcd *xhci,
531 		unsigned int num_stream_ctxs,
532 		struct xhci_stream_ctx *stream_ctx, dma_addr_t dma)
533 {
534 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
535 	size_t size = sizeof(struct xhci_stream_ctx) * num_stream_ctxs;
536 
537 	if (size > MEDIUM_STREAM_ARRAY_SIZE)
538 		dma_free_coherent(dev, size, stream_ctx, dma);
539 	else if (size > SMALL_STREAM_ARRAY_SIZE)
540 		dma_pool_free(xhci->medium_streams_pool, stream_ctx, dma);
541 	else
542 		dma_pool_free(xhci->small_streams_pool, stream_ctx, dma);
543 }
544 
545 /*
546  * The stream context array for each endpoint with bulk streams enabled can
547  * vary in size, based on:
548  *  - how many streams the endpoint supports,
549  *  - the maximum primary stream array size the host controller supports,
550  *  - and how many streams the device driver asks for.
551  *
552  * The stream context array must be a power of 2, and can be as small as
553  * 64 bytes or as large as 1MB.
554  */
555 static struct xhci_stream_ctx *xhci_alloc_stream_ctx(struct xhci_hcd *xhci,
556 		unsigned int num_stream_ctxs, dma_addr_t *dma,
557 		gfp_t mem_flags)
558 {
559 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
560 	size_t size = size_mul(sizeof(struct xhci_stream_ctx), num_stream_ctxs);
561 
562 	if (size > MEDIUM_STREAM_ARRAY_SIZE)
563 		return dma_alloc_coherent(dev, size, dma, mem_flags);
564 	if (size > SMALL_STREAM_ARRAY_SIZE)
565 		return dma_pool_zalloc(xhci->medium_streams_pool, mem_flags, dma);
566 	else
567 		return dma_pool_zalloc(xhci->small_streams_pool, mem_flags, dma);
568 }
569 
570 struct xhci_ring *xhci_dma_to_transfer_ring(
571 		struct xhci_virt_ep *ep,
572 		u64 address)
573 {
574 	if (ep->ep_state & EP_HAS_STREAMS)
575 		return radix_tree_lookup(&ep->stream_info->trb_address_map,
576 				address >> TRB_SEGMENT_SHIFT);
577 	return ep->ring;
578 }
579 
580 /*
581  * Change an endpoint's internal structure so it supports stream IDs.  The
582  * number of requested streams includes stream 0, which cannot be used by device
583  * drivers.
584  *
585  * The number of stream contexts in the stream context array may be bigger than
586  * the number of streams the driver wants to use.  This is because the number of
587  * stream context array entries must be a power of two.
588  */
589 struct xhci_stream_info *xhci_alloc_stream_info(struct xhci_hcd *xhci,
590 		unsigned int num_stream_ctxs,
591 		unsigned int num_streams,
592 		unsigned int max_packet, gfp_t mem_flags)
593 {
594 	struct xhci_stream_info *stream_info;
595 	u32 cur_stream;
596 	struct xhci_ring *cur_ring;
597 	u64 addr;
598 	int ret;
599 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
600 
601 	xhci_dbg(xhci, "Allocating %u streams and %u stream context array entries.\n",
602 			num_streams, num_stream_ctxs);
603 	if (xhci->cmd_ring_reserved_trbs == MAX_RSVD_CMD_TRBS) {
604 		xhci_dbg(xhci, "Command ring has no reserved TRBs available\n");
605 		return NULL;
606 	}
607 	xhci->cmd_ring_reserved_trbs++;
608 
609 	stream_info = kzalloc_node(sizeof(*stream_info), mem_flags,
610 			dev_to_node(dev));
611 	if (!stream_info)
612 		goto cleanup_trbs;
613 
614 	stream_info->num_streams = num_streams;
615 	stream_info->num_stream_ctxs = num_stream_ctxs;
616 
617 	/* Initialize the array of virtual pointers to stream rings. */
618 	stream_info->stream_rings = kcalloc_node(
619 			num_streams, sizeof(struct xhci_ring *), mem_flags,
620 			dev_to_node(dev));
621 	if (!stream_info->stream_rings)
622 		goto cleanup_info;
623 
624 	/* Initialize the array of DMA addresses for stream rings for the HW. */
625 	stream_info->stream_ctx_array = xhci_alloc_stream_ctx(xhci,
626 			num_stream_ctxs, &stream_info->ctx_array_dma,
627 			mem_flags);
628 	if (!stream_info->stream_ctx_array)
629 		goto cleanup_ring_array;
630 
631 	/* Allocate everything needed to free the stream rings later */
632 	stream_info->free_streams_command =
633 		xhci_alloc_command_with_ctx(xhci, true, mem_flags);
634 	if (!stream_info->free_streams_command)
635 		goto cleanup_ctx;
636 
637 	INIT_RADIX_TREE(&stream_info->trb_address_map, GFP_ATOMIC);
638 
639 	/* Allocate rings for all the streams that the driver will use,
640 	 * and add their segment DMA addresses to the radix tree.
641 	 * Stream 0 is reserved.
642 	 */
643 
644 	for (cur_stream = 1; cur_stream < num_streams; cur_stream++) {
645 		stream_info->stream_rings[cur_stream] =
646 			xhci_ring_alloc(xhci, 2, 1, TYPE_STREAM, max_packet,
647 					mem_flags);
648 		cur_ring = stream_info->stream_rings[cur_stream];
649 		if (!cur_ring)
650 			goto cleanup_rings;
651 		cur_ring->stream_id = cur_stream;
652 		cur_ring->trb_address_map = &stream_info->trb_address_map;
653 		/* Set deq ptr, cycle bit, and stream context type */
654 		addr = cur_ring->first_seg->dma |
655 			SCT_FOR_CTX(SCT_PRI_TR) |
656 			cur_ring->cycle_state;
657 		stream_info->stream_ctx_array[cur_stream].stream_ring =
658 			cpu_to_le64(addr);
659 		xhci_dbg(xhci, "Setting stream %d ring ptr to 0x%08llx\n", cur_stream, addr);
660 
661 		ret = xhci_update_stream_mapping(cur_ring, mem_flags);
662 		if (ret) {
663 			xhci_ring_free(xhci, cur_ring);
664 			stream_info->stream_rings[cur_stream] = NULL;
665 			goto cleanup_rings;
666 		}
667 	}
668 	/* Leave the other unused stream ring pointers in the stream context
669 	 * array initialized to zero.  This will cause the xHC to give us an
670 	 * error if the device asks for a stream ID we don't have setup (if it
671 	 * was any other way, the host controller would assume the ring is
672 	 * "empty" and wait forever for data to be queued to that stream ID).
673 	 */
674 
675 	return stream_info;
676 
677 cleanup_rings:
678 	for (cur_stream = 1; cur_stream < num_streams; cur_stream++) {
679 		cur_ring = stream_info->stream_rings[cur_stream];
680 		if (cur_ring) {
681 			xhci_ring_free(xhci, cur_ring);
682 			stream_info->stream_rings[cur_stream] = NULL;
683 		}
684 	}
685 	xhci_free_command(xhci, stream_info->free_streams_command);
686 cleanup_ctx:
687 	xhci_free_stream_ctx(xhci,
688 		stream_info->num_stream_ctxs,
689 		stream_info->stream_ctx_array,
690 		stream_info->ctx_array_dma);
691 cleanup_ring_array:
692 	kfree(stream_info->stream_rings);
693 cleanup_info:
694 	kfree(stream_info);
695 cleanup_trbs:
696 	xhci->cmd_ring_reserved_trbs--;
697 	return NULL;
698 }
699 /*
700  * Sets the MaxPStreams field and the Linear Stream Array field.
701  * Sets the dequeue pointer to the stream context array.
702  */
703 void xhci_setup_streams_ep_input_ctx(struct xhci_hcd *xhci,
704 		struct xhci_ep_ctx *ep_ctx,
705 		struct xhci_stream_info *stream_info)
706 {
707 	u32 max_primary_streams;
708 	/* MaxPStreams is the number of stream context array entries, not the
709 	 * number we're actually using.  Must be in 2^(MaxPstreams + 1) format.
710 	 * fls(0) = 0, fls(0x1) = 1, fls(0x10) = 2, fls(0x100) = 3, etc.
711 	 */
712 	max_primary_streams = fls(stream_info->num_stream_ctxs) - 2;
713 	xhci_dbg_trace(xhci,  trace_xhci_dbg_context_change,
714 			"Setting number of stream ctx array entries to %u",
715 			1 << (max_primary_streams + 1));
716 	ep_ctx->ep_info &= cpu_to_le32(~EP_MAXPSTREAMS_MASK);
717 	ep_ctx->ep_info |= cpu_to_le32(EP_MAXPSTREAMS(max_primary_streams)
718 				       | EP_HAS_LSA);
719 	ep_ctx->deq  = cpu_to_le64(stream_info->ctx_array_dma);
720 }
721 
722 /*
723  * Sets the MaxPStreams field and the Linear Stream Array field to 0.
724  * Reinstalls the "normal" endpoint ring (at its previous dequeue mark,
725  * not at the beginning of the ring).
726  */
727 void xhci_setup_no_streams_ep_input_ctx(struct xhci_ep_ctx *ep_ctx,
728 		struct xhci_virt_ep *ep)
729 {
730 	dma_addr_t addr;
731 	ep_ctx->ep_info &= cpu_to_le32(~(EP_MAXPSTREAMS_MASK | EP_HAS_LSA));
732 	addr = xhci_trb_virt_to_dma(ep->ring->deq_seg, ep->ring->dequeue);
733 	ep_ctx->deq  = cpu_to_le64(addr | ep->ring->cycle_state);
734 }
735 
736 /* Frees all stream contexts associated with the endpoint,
737  *
738  * Caller should fix the endpoint context streams fields.
739  */
740 void xhci_free_stream_info(struct xhci_hcd *xhci,
741 		struct xhci_stream_info *stream_info)
742 {
743 	int cur_stream;
744 	struct xhci_ring *cur_ring;
745 
746 	if (!stream_info)
747 		return;
748 
749 	for (cur_stream = 1; cur_stream < stream_info->num_streams;
750 			cur_stream++) {
751 		cur_ring = stream_info->stream_rings[cur_stream];
752 		if (cur_ring) {
753 			xhci_ring_free(xhci, cur_ring);
754 			stream_info->stream_rings[cur_stream] = NULL;
755 		}
756 	}
757 	xhci_free_command(xhci, stream_info->free_streams_command);
758 	xhci->cmd_ring_reserved_trbs--;
759 	if (stream_info->stream_ctx_array)
760 		xhci_free_stream_ctx(xhci,
761 				stream_info->num_stream_ctxs,
762 				stream_info->stream_ctx_array,
763 				stream_info->ctx_array_dma);
764 
765 	kfree(stream_info->stream_rings);
766 	kfree(stream_info);
767 }
768 
769 
770 /***************** Device context manipulation *************************/
771 
772 static void xhci_free_tt_info(struct xhci_hcd *xhci,
773 		struct xhci_virt_device *virt_dev,
774 		int slot_id)
775 {
776 	struct list_head *tt_list_head;
777 	struct xhci_tt_bw_info *tt_info, *next;
778 	bool slot_found = false;
779 
780 	/* If the device never made it past the Set Address stage,
781 	 * it may not have the real_port set correctly.
782 	 */
783 	if (virt_dev->real_port == 0 ||
784 			virt_dev->real_port > HCS_MAX_PORTS(xhci->hcs_params1)) {
785 		xhci_dbg(xhci, "Bad real port.\n");
786 		return;
787 	}
788 
789 	tt_list_head = &(xhci->rh_bw[virt_dev->real_port - 1].tts);
790 	list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) {
791 		/* Multi-TT hubs will have more than one entry */
792 		if (tt_info->slot_id == slot_id) {
793 			slot_found = true;
794 			list_del(&tt_info->tt_list);
795 			kfree(tt_info);
796 		} else if (slot_found) {
797 			break;
798 		}
799 	}
800 }
801 
802 int xhci_alloc_tt_info(struct xhci_hcd *xhci,
803 		struct xhci_virt_device *virt_dev,
804 		struct usb_device *hdev,
805 		struct usb_tt *tt, gfp_t mem_flags)
806 {
807 	struct xhci_tt_bw_info		*tt_info;
808 	unsigned int			num_ports;
809 	int				i, j;
810 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
811 
812 	if (!tt->multi)
813 		num_ports = 1;
814 	else
815 		num_ports = hdev->maxchild;
816 
817 	for (i = 0; i < num_ports; i++, tt_info++) {
818 		struct xhci_interval_bw_table *bw_table;
819 
820 		tt_info = kzalloc_node(sizeof(*tt_info), mem_flags,
821 				dev_to_node(dev));
822 		if (!tt_info)
823 			goto free_tts;
824 		INIT_LIST_HEAD(&tt_info->tt_list);
825 		list_add(&tt_info->tt_list,
826 				&xhci->rh_bw[virt_dev->real_port - 1].tts);
827 		tt_info->slot_id = virt_dev->udev->slot_id;
828 		if (tt->multi)
829 			tt_info->ttport = i+1;
830 		bw_table = &tt_info->bw_table;
831 		for (j = 0; j < XHCI_MAX_INTERVAL; j++)
832 			INIT_LIST_HEAD(&bw_table->interval_bw[j].endpoints);
833 	}
834 	return 0;
835 
836 free_tts:
837 	xhci_free_tt_info(xhci, virt_dev, virt_dev->udev->slot_id);
838 	return -ENOMEM;
839 }
840 
841 
842 /* All the xhci_tds in the ring's TD list should be freed at this point.
843  * Should be called with xhci->lock held if there is any chance the TT lists
844  * will be manipulated by the configure endpoint, allocate device, or update
845  * hub functions while this function is removing the TT entries from the list.
846  */
847 void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id)
848 {
849 	struct xhci_virt_device *dev;
850 	int i;
851 	int old_active_eps = 0;
852 
853 	/* Slot ID 0 is reserved */
854 	if (slot_id == 0 || !xhci->devs[slot_id])
855 		return;
856 
857 	dev = xhci->devs[slot_id];
858 
859 	xhci->dcbaa->dev_context_ptrs[slot_id] = 0;
860 	if (!dev)
861 		return;
862 
863 	trace_xhci_free_virt_device(dev);
864 
865 	if (dev->tt_info)
866 		old_active_eps = dev->tt_info->active_eps;
867 
868 	for (i = 0; i < 31; i++) {
869 		if (dev->eps[i].ring)
870 			xhci_ring_free(xhci, dev->eps[i].ring);
871 		if (dev->eps[i].stream_info)
872 			xhci_free_stream_info(xhci,
873 					dev->eps[i].stream_info);
874 		/*
875 		 * Endpoints are normally deleted from the bandwidth list when
876 		 * endpoints are dropped, before device is freed.
877 		 * If host is dying or being removed then endpoints aren't
878 		 * dropped cleanly, so delete the endpoint from list here.
879 		 * Only applicable for hosts with software bandwidth checking.
880 		 */
881 
882 		if (!list_empty(&dev->eps[i].bw_endpoint_list)) {
883 			list_del_init(&dev->eps[i].bw_endpoint_list);
884 			xhci_dbg(xhci, "Slot %u endpoint %u not removed from BW list!\n",
885 				 slot_id, i);
886 		}
887 	}
888 	/* If this is a hub, free the TT(s) from the TT list */
889 	xhci_free_tt_info(xhci, dev, slot_id);
890 	/* If necessary, update the number of active TTs on this root port */
891 	xhci_update_tt_active_eps(xhci, dev, old_active_eps);
892 
893 	if (dev->in_ctx)
894 		xhci_free_container_ctx(xhci, dev->in_ctx);
895 	if (dev->out_ctx)
896 		xhci_free_container_ctx(xhci, dev->out_ctx);
897 
898 	if (dev->udev && dev->udev->slot_id)
899 		dev->udev->slot_id = 0;
900 	kfree(xhci->devs[slot_id]);
901 	xhci->devs[slot_id] = NULL;
902 }
903 
904 /*
905  * Free a virt_device structure.
906  * If the virt_device added a tt_info (a hub) and has children pointing to
907  * that tt_info, then free the child first. Recursive.
908  * We can't rely on udev at this point to find child-parent relationships.
909  */
910 static void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id)
911 {
912 	struct xhci_virt_device *vdev;
913 	struct list_head *tt_list_head;
914 	struct xhci_tt_bw_info *tt_info, *next;
915 	int i;
916 
917 	vdev = xhci->devs[slot_id];
918 	if (!vdev)
919 		return;
920 
921 	if (vdev->real_port == 0 ||
922 			vdev->real_port > HCS_MAX_PORTS(xhci->hcs_params1)) {
923 		xhci_dbg(xhci, "Bad vdev->real_port.\n");
924 		goto out;
925 	}
926 
927 	tt_list_head = &(xhci->rh_bw[vdev->real_port - 1].tts);
928 	list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) {
929 		/* is this a hub device that added a tt_info to the tts list */
930 		if (tt_info->slot_id == slot_id) {
931 			/* are any devices using this tt_info? */
932 			for (i = 1; i < HCS_MAX_SLOTS(xhci->hcs_params1); i++) {
933 				vdev = xhci->devs[i];
934 				if (vdev && (vdev->tt_info == tt_info))
935 					xhci_free_virt_devices_depth_first(
936 						xhci, i);
937 			}
938 		}
939 	}
940 out:
941 	/* we are now at a leaf device */
942 	xhci_debugfs_remove_slot(xhci, slot_id);
943 	xhci_free_virt_device(xhci, slot_id);
944 }
945 
946 int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
947 		struct usb_device *udev, gfp_t flags)
948 {
949 	struct xhci_virt_device *dev;
950 	int i;
951 
952 	/* Slot ID 0 is reserved */
953 	if (slot_id == 0 || xhci->devs[slot_id]) {
954 		xhci_warn(xhci, "Bad Slot ID %d\n", slot_id);
955 		return 0;
956 	}
957 
958 	dev = kzalloc(sizeof(*dev), flags);
959 	if (!dev)
960 		return 0;
961 
962 	dev->slot_id = slot_id;
963 
964 	/* Allocate the (output) device context that will be used in the HC. */
965 	dev->out_ctx = xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_DEVICE, flags);
966 	if (!dev->out_ctx)
967 		goto fail;
968 
969 	xhci_dbg(xhci, "Slot %d output ctx = 0x%pad (dma)\n", slot_id, &dev->out_ctx->dma);
970 
971 	/* Allocate the (input) device context for address device command */
972 	dev->in_ctx = xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_INPUT, flags);
973 	if (!dev->in_ctx)
974 		goto fail;
975 
976 	xhci_dbg(xhci, "Slot %d input ctx = 0x%pad (dma)\n", slot_id, &dev->in_ctx->dma);
977 
978 	/* Initialize the cancellation and bandwidth list for each ep */
979 	for (i = 0; i < 31; i++) {
980 		dev->eps[i].ep_index = i;
981 		dev->eps[i].vdev = dev;
982 		dev->eps[i].xhci = xhci;
983 		INIT_LIST_HEAD(&dev->eps[i].cancelled_td_list);
984 		INIT_LIST_HEAD(&dev->eps[i].bw_endpoint_list);
985 	}
986 
987 	/* Allocate endpoint 0 ring */
988 	dev->eps[0].ring = xhci_ring_alloc(xhci, 2, 1, TYPE_CTRL, 0, flags);
989 	if (!dev->eps[0].ring)
990 		goto fail;
991 
992 	dev->udev = udev;
993 
994 	/* Point to output device context in dcbaa. */
995 	xhci->dcbaa->dev_context_ptrs[slot_id] = cpu_to_le64(dev->out_ctx->dma);
996 	xhci_dbg(xhci, "Set slot id %d dcbaa entry %p to 0x%llx\n",
997 		 slot_id,
998 		 &xhci->dcbaa->dev_context_ptrs[slot_id],
999 		 le64_to_cpu(xhci->dcbaa->dev_context_ptrs[slot_id]));
1000 
1001 	trace_xhci_alloc_virt_device(dev);
1002 
1003 	xhci->devs[slot_id] = dev;
1004 
1005 	return 1;
1006 fail:
1007 
1008 	if (dev->in_ctx)
1009 		xhci_free_container_ctx(xhci, dev->in_ctx);
1010 	if (dev->out_ctx)
1011 		xhci_free_container_ctx(xhci, dev->out_ctx);
1012 	kfree(dev);
1013 
1014 	return 0;
1015 }
1016 
1017 void xhci_copy_ep0_dequeue_into_input_ctx(struct xhci_hcd *xhci,
1018 		struct usb_device *udev)
1019 {
1020 	struct xhci_virt_device *virt_dev;
1021 	struct xhci_ep_ctx	*ep0_ctx;
1022 	struct xhci_ring	*ep_ring;
1023 
1024 	virt_dev = xhci->devs[udev->slot_id];
1025 	ep0_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, 0);
1026 	ep_ring = virt_dev->eps[0].ring;
1027 	/*
1028 	 * FIXME we don't keep track of the dequeue pointer very well after a
1029 	 * Set TR dequeue pointer, so we're setting the dequeue pointer of the
1030 	 * host to our enqueue pointer.  This should only be called after a
1031 	 * configured device has reset, so all control transfers should have
1032 	 * been completed or cancelled before the reset.
1033 	 */
1034 	ep0_ctx->deq = cpu_to_le64(xhci_trb_virt_to_dma(ep_ring->enq_seg,
1035 							ep_ring->enqueue)
1036 				   | ep_ring->cycle_state);
1037 }
1038 
1039 /*
1040  * The xHCI roothub may have ports of differing speeds in any order in the port
1041  * status registers.
1042  *
1043  * The xHCI hardware wants to know the roothub port number that the USB device
1044  * is attached to (or the roothub port its ancestor hub is attached to).  All we
1045  * know is the index of that port under either the USB 2.0 or the USB 3.0
1046  * roothub, but that doesn't give us the real index into the HW port status
1047  * registers. Call xhci_find_raw_port_number() to get real index.
1048  */
1049 static u32 xhci_find_real_port_number(struct xhci_hcd *xhci,
1050 		struct usb_device *udev)
1051 {
1052 	struct usb_device *top_dev;
1053 	struct usb_hcd *hcd;
1054 
1055 	if (udev->speed >= USB_SPEED_SUPER)
1056 		hcd = xhci_get_usb3_hcd(xhci);
1057 	else
1058 		hcd = xhci->main_hcd;
1059 
1060 	for (top_dev = udev; top_dev->parent && top_dev->parent->parent;
1061 			top_dev = top_dev->parent)
1062 		/* Found device below root hub */;
1063 
1064 	return	xhci_find_raw_port_number(hcd, top_dev->portnum);
1065 }
1066 
1067 /* Setup an xHCI virtual device for a Set Address command */
1068 int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *udev)
1069 {
1070 	struct xhci_virt_device *dev;
1071 	struct xhci_ep_ctx	*ep0_ctx;
1072 	struct xhci_slot_ctx    *slot_ctx;
1073 	u32			port_num;
1074 	u32			max_packets;
1075 	struct usb_device *top_dev;
1076 
1077 	dev = xhci->devs[udev->slot_id];
1078 	/* Slot ID 0 is reserved */
1079 	if (udev->slot_id == 0 || !dev) {
1080 		xhci_warn(xhci, "Slot ID %d is not assigned to this device\n",
1081 				udev->slot_id);
1082 		return -EINVAL;
1083 	}
1084 	ep0_ctx = xhci_get_ep_ctx(xhci, dev->in_ctx, 0);
1085 	slot_ctx = xhci_get_slot_ctx(xhci, dev->in_ctx);
1086 
1087 	/* 3) Only the control endpoint is valid - one endpoint context */
1088 	slot_ctx->dev_info |= cpu_to_le32(LAST_CTX(1) | udev->route);
1089 	switch (udev->speed) {
1090 	case USB_SPEED_SUPER_PLUS:
1091 		slot_ctx->dev_info |= cpu_to_le32(SLOT_SPEED_SSP);
1092 		max_packets = MAX_PACKET(512);
1093 		break;
1094 	case USB_SPEED_SUPER:
1095 		slot_ctx->dev_info |= cpu_to_le32(SLOT_SPEED_SS);
1096 		max_packets = MAX_PACKET(512);
1097 		break;
1098 	case USB_SPEED_HIGH:
1099 		slot_ctx->dev_info |= cpu_to_le32(SLOT_SPEED_HS);
1100 		max_packets = MAX_PACKET(64);
1101 		break;
1102 	/* USB core guesses at a 64-byte max packet first for FS devices */
1103 	case USB_SPEED_FULL:
1104 		slot_ctx->dev_info |= cpu_to_le32(SLOT_SPEED_FS);
1105 		max_packets = MAX_PACKET(64);
1106 		break;
1107 	case USB_SPEED_LOW:
1108 		slot_ctx->dev_info |= cpu_to_le32(SLOT_SPEED_LS);
1109 		max_packets = MAX_PACKET(8);
1110 		break;
1111 	default:
1112 		/* Speed was set earlier, this shouldn't happen. */
1113 		return -EINVAL;
1114 	}
1115 	/* Find the root hub port this device is under */
1116 	port_num = xhci_find_real_port_number(xhci, udev);
1117 	if (!port_num)
1118 		return -EINVAL;
1119 	slot_ctx->dev_info2 |= cpu_to_le32(ROOT_HUB_PORT(port_num));
1120 	/* Set the port number in the virtual_device to the faked port number */
1121 	for (top_dev = udev; top_dev->parent && top_dev->parent->parent;
1122 			top_dev = top_dev->parent)
1123 		/* Found device below root hub */;
1124 	dev->fake_port = top_dev->portnum;
1125 	dev->real_port = port_num;
1126 	xhci_dbg(xhci, "Set root hub portnum to %d\n", port_num);
1127 	xhci_dbg(xhci, "Set fake root hub portnum to %d\n", dev->fake_port);
1128 
1129 	/* Find the right bandwidth table that this device will be a part of.
1130 	 * If this is a full speed device attached directly to a root port (or a
1131 	 * decendent of one), it counts as a primary bandwidth domain, not a
1132 	 * secondary bandwidth domain under a TT.  An xhci_tt_info structure
1133 	 * will never be created for the HS root hub.
1134 	 */
1135 	if (!udev->tt || !udev->tt->hub->parent) {
1136 		dev->bw_table = &xhci->rh_bw[port_num - 1].bw_table;
1137 	} else {
1138 		struct xhci_root_port_bw_info *rh_bw;
1139 		struct xhci_tt_bw_info *tt_bw;
1140 
1141 		rh_bw = &xhci->rh_bw[port_num - 1];
1142 		/* Find the right TT. */
1143 		list_for_each_entry(tt_bw, &rh_bw->tts, tt_list) {
1144 			if (tt_bw->slot_id != udev->tt->hub->slot_id)
1145 				continue;
1146 
1147 			if (!dev->udev->tt->multi ||
1148 					(udev->tt->multi &&
1149 					 tt_bw->ttport == dev->udev->ttport)) {
1150 				dev->bw_table = &tt_bw->bw_table;
1151 				dev->tt_info = tt_bw;
1152 				break;
1153 			}
1154 		}
1155 		if (!dev->tt_info)
1156 			xhci_warn(xhci, "WARN: Didn't find a matching TT\n");
1157 	}
1158 
1159 	/* Is this a LS/FS device under an external HS hub? */
1160 	if (udev->tt && udev->tt->hub->parent) {
1161 		slot_ctx->tt_info = cpu_to_le32(udev->tt->hub->slot_id |
1162 						(udev->ttport << 8));
1163 		if (udev->tt->multi)
1164 			slot_ctx->dev_info |= cpu_to_le32(DEV_MTT);
1165 	}
1166 	xhci_dbg(xhci, "udev->tt = %p\n", udev->tt);
1167 	xhci_dbg(xhci, "udev->ttport = 0x%x\n", udev->ttport);
1168 
1169 	/* Step 4 - ring already allocated */
1170 	/* Step 5 */
1171 	ep0_ctx->ep_info2 = cpu_to_le32(EP_TYPE(CTRL_EP));
1172 
1173 	/* EP 0 can handle "burst" sizes of 1, so Max Burst Size field is 0 */
1174 	ep0_ctx->ep_info2 |= cpu_to_le32(MAX_BURST(0) | ERROR_COUNT(3) |
1175 					 max_packets);
1176 
1177 	ep0_ctx->deq = cpu_to_le64(dev->eps[0].ring->first_seg->dma |
1178 				   dev->eps[0].ring->cycle_state);
1179 
1180 	trace_xhci_setup_addressable_virt_device(dev);
1181 
1182 	/* Steps 7 and 8 were done in xhci_alloc_virt_device() */
1183 
1184 	return 0;
1185 }
1186 
1187 /*
1188  * Convert interval expressed as 2^(bInterval - 1) == interval into
1189  * straight exponent value 2^n == interval.
1190  *
1191  */
1192 static unsigned int xhci_parse_exponent_interval(struct usb_device *udev,
1193 		struct usb_host_endpoint *ep)
1194 {
1195 	unsigned int interval;
1196 
1197 	interval = clamp_val(ep->desc.bInterval, 1, 16) - 1;
1198 	if (interval != ep->desc.bInterval - 1)
1199 		dev_warn(&udev->dev,
1200 			 "ep %#x - rounding interval to %d %sframes\n",
1201 			 ep->desc.bEndpointAddress,
1202 			 1 << interval,
1203 			 udev->speed == USB_SPEED_FULL ? "" : "micro");
1204 
1205 	if (udev->speed == USB_SPEED_FULL) {
1206 		/*
1207 		 * Full speed isoc endpoints specify interval in frames,
1208 		 * not microframes. We are using microframes everywhere,
1209 		 * so adjust accordingly.
1210 		 */
1211 		interval += 3;	/* 1 frame = 2^3 uframes */
1212 	}
1213 
1214 	return interval;
1215 }
1216 
1217 /*
1218  * Convert bInterval expressed in microframes (in 1-255 range) to exponent of
1219  * microframes, rounded down to nearest power of 2.
1220  */
1221 static unsigned int xhci_microframes_to_exponent(struct usb_device *udev,
1222 		struct usb_host_endpoint *ep, unsigned int desc_interval,
1223 		unsigned int min_exponent, unsigned int max_exponent)
1224 {
1225 	unsigned int interval;
1226 
1227 	interval = fls(desc_interval) - 1;
1228 	interval = clamp_val(interval, min_exponent, max_exponent);
1229 	if ((1 << interval) != desc_interval)
1230 		dev_dbg(&udev->dev,
1231 			 "ep %#x - rounding interval to %d microframes, ep desc says %d microframes\n",
1232 			 ep->desc.bEndpointAddress,
1233 			 1 << interval,
1234 			 desc_interval);
1235 
1236 	return interval;
1237 }
1238 
1239 static unsigned int xhci_parse_microframe_interval(struct usb_device *udev,
1240 		struct usb_host_endpoint *ep)
1241 {
1242 	if (ep->desc.bInterval == 0)
1243 		return 0;
1244 	return xhci_microframes_to_exponent(udev, ep,
1245 			ep->desc.bInterval, 0, 15);
1246 }
1247 
1248 
1249 static unsigned int xhci_parse_frame_interval(struct usb_device *udev,
1250 		struct usb_host_endpoint *ep)
1251 {
1252 	return xhci_microframes_to_exponent(udev, ep,
1253 			ep->desc.bInterval * 8, 3, 10);
1254 }
1255 
1256 /* Return the polling or NAK interval.
1257  *
1258  * The polling interval is expressed in "microframes".  If xHCI's Interval field
1259  * is set to N, it will service the endpoint every 2^(Interval)*125us.
1260  *
1261  * The NAK interval is one NAK per 1 to 255 microframes, or no NAKs if interval
1262  * is set to 0.
1263  */
1264 static unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
1265 		struct usb_host_endpoint *ep)
1266 {
1267 	unsigned int interval = 0;
1268 
1269 	switch (udev->speed) {
1270 	case USB_SPEED_HIGH:
1271 		/* Max NAK rate */
1272 		if (usb_endpoint_xfer_control(&ep->desc) ||
1273 		    usb_endpoint_xfer_bulk(&ep->desc)) {
1274 			interval = xhci_parse_microframe_interval(udev, ep);
1275 			break;
1276 		}
1277 		fallthrough;	/* SS and HS isoc/int have same decoding */
1278 
1279 	case USB_SPEED_SUPER_PLUS:
1280 	case USB_SPEED_SUPER:
1281 		if (usb_endpoint_xfer_int(&ep->desc) ||
1282 		    usb_endpoint_xfer_isoc(&ep->desc)) {
1283 			interval = xhci_parse_exponent_interval(udev, ep);
1284 		}
1285 		break;
1286 
1287 	case USB_SPEED_FULL:
1288 		if (usb_endpoint_xfer_isoc(&ep->desc)) {
1289 			interval = xhci_parse_exponent_interval(udev, ep);
1290 			break;
1291 		}
1292 		/*
1293 		 * Fall through for interrupt endpoint interval decoding
1294 		 * since it uses the same rules as low speed interrupt
1295 		 * endpoints.
1296 		 */
1297 		fallthrough;
1298 
1299 	case USB_SPEED_LOW:
1300 		if (usb_endpoint_xfer_int(&ep->desc) ||
1301 		    usb_endpoint_xfer_isoc(&ep->desc)) {
1302 
1303 			interval = xhci_parse_frame_interval(udev, ep);
1304 		}
1305 		break;
1306 
1307 	default:
1308 		BUG();
1309 	}
1310 	return interval;
1311 }
1312 
1313 /* The "Mult" field in the endpoint context is only set for SuperSpeed isoc eps.
1314  * High speed endpoint descriptors can define "the number of additional
1315  * transaction opportunities per microframe", but that goes in the Max Burst
1316  * endpoint context field.
1317  */
1318 static u32 xhci_get_endpoint_mult(struct usb_device *udev,
1319 		struct usb_host_endpoint *ep)
1320 {
1321 	if (udev->speed < USB_SPEED_SUPER ||
1322 			!usb_endpoint_xfer_isoc(&ep->desc))
1323 		return 0;
1324 	return ep->ss_ep_comp.bmAttributes;
1325 }
1326 
1327 static u32 xhci_get_endpoint_max_burst(struct usb_device *udev,
1328 				       struct usb_host_endpoint *ep)
1329 {
1330 	/* Super speed and Plus have max burst in ep companion desc */
1331 	if (udev->speed >= USB_SPEED_SUPER)
1332 		return ep->ss_ep_comp.bMaxBurst;
1333 
1334 	if (udev->speed == USB_SPEED_HIGH &&
1335 	    (usb_endpoint_xfer_isoc(&ep->desc) ||
1336 	     usb_endpoint_xfer_int(&ep->desc)))
1337 		return usb_endpoint_maxp_mult(&ep->desc) - 1;
1338 
1339 	return 0;
1340 }
1341 
1342 static u32 xhci_get_endpoint_type(struct usb_host_endpoint *ep)
1343 {
1344 	int in;
1345 
1346 	in = usb_endpoint_dir_in(&ep->desc);
1347 
1348 	switch (usb_endpoint_type(&ep->desc)) {
1349 	case USB_ENDPOINT_XFER_CONTROL:
1350 		return CTRL_EP;
1351 	case USB_ENDPOINT_XFER_BULK:
1352 		return in ? BULK_IN_EP : BULK_OUT_EP;
1353 	case USB_ENDPOINT_XFER_ISOC:
1354 		return in ? ISOC_IN_EP : ISOC_OUT_EP;
1355 	case USB_ENDPOINT_XFER_INT:
1356 		return in ? INT_IN_EP : INT_OUT_EP;
1357 	}
1358 	return 0;
1359 }
1360 
1361 /* Return the maximum endpoint service interval time (ESIT) payload.
1362  * Basically, this is the maxpacket size, multiplied by the burst size
1363  * and mult size.
1364  */
1365 static u32 xhci_get_max_esit_payload(struct usb_device *udev,
1366 		struct usb_host_endpoint *ep)
1367 {
1368 	int max_burst;
1369 	int max_packet;
1370 
1371 	/* Only applies for interrupt or isochronous endpoints */
1372 	if (usb_endpoint_xfer_control(&ep->desc) ||
1373 			usb_endpoint_xfer_bulk(&ep->desc))
1374 		return 0;
1375 
1376 	/* SuperSpeedPlus Isoc ep sending over 48k per esit */
1377 	if ((udev->speed >= USB_SPEED_SUPER_PLUS) &&
1378 	    USB_SS_SSP_ISOC_COMP(ep->ss_ep_comp.bmAttributes))
1379 		return le32_to_cpu(ep->ssp_isoc_ep_comp.dwBytesPerInterval);
1380 
1381 	/* SuperSpeed or SuperSpeedPlus Isoc ep with less than 48k per esit */
1382 	if (udev->speed >= USB_SPEED_SUPER)
1383 		return le16_to_cpu(ep->ss_ep_comp.wBytesPerInterval);
1384 
1385 	max_packet = usb_endpoint_maxp(&ep->desc);
1386 	max_burst = usb_endpoint_maxp_mult(&ep->desc);
1387 	/* A 0 in max burst means 1 transfer per ESIT */
1388 	return max_packet * max_burst;
1389 }
1390 
1391 /* Set up an endpoint with one ring segment.  Do not allocate stream rings.
1392  * Drivers will have to call usb_alloc_streams() to do that.
1393  */
1394 int xhci_endpoint_init(struct xhci_hcd *xhci,
1395 		struct xhci_virt_device *virt_dev,
1396 		struct usb_device *udev,
1397 		struct usb_host_endpoint *ep,
1398 		gfp_t mem_flags)
1399 {
1400 	unsigned int ep_index;
1401 	struct xhci_ep_ctx *ep_ctx;
1402 	struct xhci_ring *ep_ring;
1403 	unsigned int max_packet;
1404 	enum xhci_ring_type ring_type;
1405 	u32 max_esit_payload;
1406 	u32 endpoint_type;
1407 	unsigned int max_burst;
1408 	unsigned int interval;
1409 	unsigned int mult;
1410 	unsigned int avg_trb_len;
1411 	unsigned int err_count = 0;
1412 
1413 	ep_index = xhci_get_endpoint_index(&ep->desc);
1414 	ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
1415 
1416 	endpoint_type = xhci_get_endpoint_type(ep);
1417 	if (!endpoint_type)
1418 		return -EINVAL;
1419 
1420 	ring_type = usb_endpoint_type(&ep->desc);
1421 
1422 	/*
1423 	 * Get values to fill the endpoint context, mostly from ep descriptor.
1424 	 * The average TRB buffer lengt for bulk endpoints is unclear as we
1425 	 * have no clue on scatter gather list entry size. For Isoc and Int,
1426 	 * set it to max available. See xHCI 1.1 spec 4.14.1.1 for details.
1427 	 */
1428 	max_esit_payload = xhci_get_max_esit_payload(udev, ep);
1429 	interval = xhci_get_endpoint_interval(udev, ep);
1430 
1431 	/* Periodic endpoint bInterval limit quirk */
1432 	if (usb_endpoint_xfer_int(&ep->desc) ||
1433 	    usb_endpoint_xfer_isoc(&ep->desc)) {
1434 		if ((xhci->quirks & XHCI_LIMIT_ENDPOINT_INTERVAL_7) &&
1435 		    udev->speed >= USB_SPEED_HIGH &&
1436 		    interval >= 7) {
1437 			interval = 6;
1438 		}
1439 	}
1440 
1441 	mult = xhci_get_endpoint_mult(udev, ep);
1442 	max_packet = usb_endpoint_maxp(&ep->desc);
1443 	max_burst = xhci_get_endpoint_max_burst(udev, ep);
1444 	avg_trb_len = max_esit_payload;
1445 
1446 	/* FIXME dig Mult and streams info out of ep companion desc */
1447 
1448 	/* Allow 3 retries for everything but isoc, set CErr = 3 */
1449 	if (!usb_endpoint_xfer_isoc(&ep->desc))
1450 		err_count = 3;
1451 	/* HS bulk max packet should be 512, FS bulk supports 8, 16, 32 or 64 */
1452 	if (usb_endpoint_xfer_bulk(&ep->desc)) {
1453 		if (udev->speed == USB_SPEED_HIGH)
1454 			max_packet = 512;
1455 		if (udev->speed == USB_SPEED_FULL) {
1456 			max_packet = rounddown_pow_of_two(max_packet);
1457 			max_packet = clamp_val(max_packet, 8, 64);
1458 		}
1459 	}
1460 	/* xHCI 1.0 and 1.1 indicates that ctrl ep avg TRB Length should be 8 */
1461 	if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version >= 0x100)
1462 		avg_trb_len = 8;
1463 	/* xhci 1.1 with LEC support doesn't use mult field, use RsvdZ */
1464 	if ((xhci->hci_version > 0x100) && HCC2_LEC(xhci->hcc_params2))
1465 		mult = 0;
1466 
1467 	/* Set up the endpoint ring */
1468 	virt_dev->eps[ep_index].new_ring =
1469 		xhci_ring_alloc(xhci, 2, 1, ring_type, max_packet, mem_flags);
1470 	if (!virt_dev->eps[ep_index].new_ring)
1471 		return -ENOMEM;
1472 
1473 	virt_dev->eps[ep_index].skip = false;
1474 	ep_ring = virt_dev->eps[ep_index].new_ring;
1475 
1476 	/* Fill the endpoint context */
1477 	ep_ctx->ep_info = cpu_to_le32(EP_MAX_ESIT_PAYLOAD_HI(max_esit_payload) |
1478 				      EP_INTERVAL(interval) |
1479 				      EP_MULT(mult));
1480 	ep_ctx->ep_info2 = cpu_to_le32(EP_TYPE(endpoint_type) |
1481 				       MAX_PACKET(max_packet) |
1482 				       MAX_BURST(max_burst) |
1483 				       ERROR_COUNT(err_count));
1484 	ep_ctx->deq = cpu_to_le64(ep_ring->first_seg->dma |
1485 				  ep_ring->cycle_state);
1486 
1487 	ep_ctx->tx_info = cpu_to_le32(EP_MAX_ESIT_PAYLOAD_LO(max_esit_payload) |
1488 				      EP_AVG_TRB_LENGTH(avg_trb_len));
1489 
1490 	return 0;
1491 }
1492 
1493 void xhci_endpoint_zero(struct xhci_hcd *xhci,
1494 		struct xhci_virt_device *virt_dev,
1495 		struct usb_host_endpoint *ep)
1496 {
1497 	unsigned int ep_index;
1498 	struct xhci_ep_ctx *ep_ctx;
1499 
1500 	ep_index = xhci_get_endpoint_index(&ep->desc);
1501 	ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
1502 
1503 	ep_ctx->ep_info = 0;
1504 	ep_ctx->ep_info2 = 0;
1505 	ep_ctx->deq = 0;
1506 	ep_ctx->tx_info = 0;
1507 	/* Don't free the endpoint ring until the set interface or configuration
1508 	 * request succeeds.
1509 	 */
1510 }
1511 
1512 void xhci_clear_endpoint_bw_info(struct xhci_bw_info *bw_info)
1513 {
1514 	bw_info->ep_interval = 0;
1515 	bw_info->mult = 0;
1516 	bw_info->num_packets = 0;
1517 	bw_info->max_packet_size = 0;
1518 	bw_info->type = 0;
1519 	bw_info->max_esit_payload = 0;
1520 }
1521 
1522 void xhci_update_bw_info(struct xhci_hcd *xhci,
1523 		struct xhci_container_ctx *in_ctx,
1524 		struct xhci_input_control_ctx *ctrl_ctx,
1525 		struct xhci_virt_device *virt_dev)
1526 {
1527 	struct xhci_bw_info *bw_info;
1528 	struct xhci_ep_ctx *ep_ctx;
1529 	unsigned int ep_type;
1530 	int i;
1531 
1532 	for (i = 1; i < 31; i++) {
1533 		bw_info = &virt_dev->eps[i].bw_info;
1534 
1535 		/* We can't tell what endpoint type is being dropped, but
1536 		 * unconditionally clearing the bandwidth info for non-periodic
1537 		 * endpoints should be harmless because the info will never be
1538 		 * set in the first place.
1539 		 */
1540 		if (!EP_IS_ADDED(ctrl_ctx, i) && EP_IS_DROPPED(ctrl_ctx, i)) {
1541 			/* Dropped endpoint */
1542 			xhci_clear_endpoint_bw_info(bw_info);
1543 			continue;
1544 		}
1545 
1546 		if (EP_IS_ADDED(ctrl_ctx, i)) {
1547 			ep_ctx = xhci_get_ep_ctx(xhci, in_ctx, i);
1548 			ep_type = CTX_TO_EP_TYPE(le32_to_cpu(ep_ctx->ep_info2));
1549 
1550 			/* Ignore non-periodic endpoints */
1551 			if (ep_type != ISOC_OUT_EP && ep_type != INT_OUT_EP &&
1552 					ep_type != ISOC_IN_EP &&
1553 					ep_type != INT_IN_EP)
1554 				continue;
1555 
1556 			/* Added or changed endpoint */
1557 			bw_info->ep_interval = CTX_TO_EP_INTERVAL(
1558 					le32_to_cpu(ep_ctx->ep_info));
1559 			/* Number of packets and mult are zero-based in the
1560 			 * input context, but we want one-based for the
1561 			 * interval table.
1562 			 */
1563 			bw_info->mult = CTX_TO_EP_MULT(
1564 					le32_to_cpu(ep_ctx->ep_info)) + 1;
1565 			bw_info->num_packets = CTX_TO_MAX_BURST(
1566 					le32_to_cpu(ep_ctx->ep_info2)) + 1;
1567 			bw_info->max_packet_size = MAX_PACKET_DECODED(
1568 					le32_to_cpu(ep_ctx->ep_info2));
1569 			bw_info->type = ep_type;
1570 			bw_info->max_esit_payload = CTX_TO_MAX_ESIT_PAYLOAD(
1571 					le32_to_cpu(ep_ctx->tx_info));
1572 		}
1573 	}
1574 }
1575 
1576 /* Copy output xhci_ep_ctx to the input xhci_ep_ctx copy.
1577  * Useful when you want to change one particular aspect of the endpoint and then
1578  * issue a configure endpoint command.
1579  */
1580 void xhci_endpoint_copy(struct xhci_hcd *xhci,
1581 		struct xhci_container_ctx *in_ctx,
1582 		struct xhci_container_ctx *out_ctx,
1583 		unsigned int ep_index)
1584 {
1585 	struct xhci_ep_ctx *out_ep_ctx;
1586 	struct xhci_ep_ctx *in_ep_ctx;
1587 
1588 	out_ep_ctx = xhci_get_ep_ctx(xhci, out_ctx, ep_index);
1589 	in_ep_ctx = xhci_get_ep_ctx(xhci, in_ctx, ep_index);
1590 
1591 	in_ep_ctx->ep_info = out_ep_ctx->ep_info;
1592 	in_ep_ctx->ep_info2 = out_ep_ctx->ep_info2;
1593 	in_ep_ctx->deq = out_ep_ctx->deq;
1594 	in_ep_ctx->tx_info = out_ep_ctx->tx_info;
1595 	if (xhci->quirks & XHCI_MTK_HOST) {
1596 		in_ep_ctx->reserved[0] = out_ep_ctx->reserved[0];
1597 		in_ep_ctx->reserved[1] = out_ep_ctx->reserved[1];
1598 	}
1599 }
1600 
1601 /* Copy output xhci_slot_ctx to the input xhci_slot_ctx.
1602  * Useful when you want to change one particular aspect of the endpoint and then
1603  * issue a configure endpoint command.  Only the context entries field matters,
1604  * but we'll copy the whole thing anyway.
1605  */
1606 void xhci_slot_copy(struct xhci_hcd *xhci,
1607 		struct xhci_container_ctx *in_ctx,
1608 		struct xhci_container_ctx *out_ctx)
1609 {
1610 	struct xhci_slot_ctx *in_slot_ctx;
1611 	struct xhci_slot_ctx *out_slot_ctx;
1612 
1613 	in_slot_ctx = xhci_get_slot_ctx(xhci, in_ctx);
1614 	out_slot_ctx = xhci_get_slot_ctx(xhci, out_ctx);
1615 
1616 	in_slot_ctx->dev_info = out_slot_ctx->dev_info;
1617 	in_slot_ctx->dev_info2 = out_slot_ctx->dev_info2;
1618 	in_slot_ctx->tt_info = out_slot_ctx->tt_info;
1619 	in_slot_ctx->dev_state = out_slot_ctx->dev_state;
1620 }
1621 
1622 /* Set up the scratchpad buffer array and scratchpad buffers, if needed. */
1623 static int scratchpad_alloc(struct xhci_hcd *xhci, gfp_t flags)
1624 {
1625 	int i;
1626 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
1627 	int num_sp = HCS_MAX_SCRATCHPAD(xhci->hcs_params2);
1628 
1629 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
1630 			"Allocating %d scratchpad buffers", num_sp);
1631 
1632 	if (!num_sp)
1633 		return 0;
1634 
1635 	xhci->scratchpad = kzalloc_node(sizeof(*xhci->scratchpad), flags,
1636 				dev_to_node(dev));
1637 	if (!xhci->scratchpad)
1638 		goto fail_sp;
1639 
1640 	xhci->scratchpad->sp_array = dma_alloc_coherent(dev,
1641 				     size_mul(sizeof(u64), num_sp),
1642 				     &xhci->scratchpad->sp_dma, flags);
1643 	if (!xhci->scratchpad->sp_array)
1644 		goto fail_sp2;
1645 
1646 	xhci->scratchpad->sp_buffers = kcalloc_node(num_sp, sizeof(void *),
1647 					flags, dev_to_node(dev));
1648 	if (!xhci->scratchpad->sp_buffers)
1649 		goto fail_sp3;
1650 
1651 	xhci->dcbaa->dev_context_ptrs[0] = cpu_to_le64(xhci->scratchpad->sp_dma);
1652 	for (i = 0; i < num_sp; i++) {
1653 		dma_addr_t dma;
1654 		void *buf = dma_alloc_coherent(dev, xhci->page_size, &dma,
1655 					       flags);
1656 		if (!buf)
1657 			goto fail_sp4;
1658 
1659 		xhci->scratchpad->sp_array[i] = dma;
1660 		xhci->scratchpad->sp_buffers[i] = buf;
1661 	}
1662 
1663 	return 0;
1664 
1665  fail_sp4:
1666 	while (i--)
1667 		dma_free_coherent(dev, xhci->page_size,
1668 				    xhci->scratchpad->sp_buffers[i],
1669 				    xhci->scratchpad->sp_array[i]);
1670 
1671 	kfree(xhci->scratchpad->sp_buffers);
1672 
1673  fail_sp3:
1674 	dma_free_coherent(dev, num_sp * sizeof(u64),
1675 			    xhci->scratchpad->sp_array,
1676 			    xhci->scratchpad->sp_dma);
1677 
1678  fail_sp2:
1679 	kfree(xhci->scratchpad);
1680 	xhci->scratchpad = NULL;
1681 
1682  fail_sp:
1683 	return -ENOMEM;
1684 }
1685 
1686 static void scratchpad_free(struct xhci_hcd *xhci)
1687 {
1688 	int num_sp;
1689 	int i;
1690 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
1691 
1692 	if (!xhci->scratchpad)
1693 		return;
1694 
1695 	num_sp = HCS_MAX_SCRATCHPAD(xhci->hcs_params2);
1696 
1697 	for (i = 0; i < num_sp; i++) {
1698 		dma_free_coherent(dev, xhci->page_size,
1699 				    xhci->scratchpad->sp_buffers[i],
1700 				    xhci->scratchpad->sp_array[i]);
1701 	}
1702 	kfree(xhci->scratchpad->sp_buffers);
1703 	dma_free_coherent(dev, num_sp * sizeof(u64),
1704 			    xhci->scratchpad->sp_array,
1705 			    xhci->scratchpad->sp_dma);
1706 	kfree(xhci->scratchpad);
1707 	xhci->scratchpad = NULL;
1708 }
1709 
1710 struct xhci_command *xhci_alloc_command(struct xhci_hcd *xhci,
1711 		bool allocate_completion, gfp_t mem_flags)
1712 {
1713 	struct xhci_command *command;
1714 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
1715 
1716 	command = kzalloc_node(sizeof(*command), mem_flags, dev_to_node(dev));
1717 	if (!command)
1718 		return NULL;
1719 
1720 	if (allocate_completion) {
1721 		command->completion =
1722 			kzalloc_node(sizeof(struct completion), mem_flags,
1723 				dev_to_node(dev));
1724 		if (!command->completion) {
1725 			kfree(command);
1726 			return NULL;
1727 		}
1728 		init_completion(command->completion);
1729 	}
1730 
1731 	command->status = 0;
1732 	/* set default timeout to 5000 ms */
1733 	command->timeout_ms = XHCI_CMD_DEFAULT_TIMEOUT;
1734 	INIT_LIST_HEAD(&command->cmd_list);
1735 	return command;
1736 }
1737 
1738 struct xhci_command *xhci_alloc_command_with_ctx(struct xhci_hcd *xhci,
1739 		bool allocate_completion, gfp_t mem_flags)
1740 {
1741 	struct xhci_command *command;
1742 
1743 	command = xhci_alloc_command(xhci, allocate_completion, mem_flags);
1744 	if (!command)
1745 		return NULL;
1746 
1747 	command->in_ctx = xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_INPUT,
1748 						   mem_flags);
1749 	if (!command->in_ctx) {
1750 		kfree(command->completion);
1751 		kfree(command);
1752 		return NULL;
1753 	}
1754 	return command;
1755 }
1756 
1757 void xhci_urb_free_priv(struct urb_priv *urb_priv)
1758 {
1759 	kfree(urb_priv);
1760 }
1761 
1762 void xhci_free_command(struct xhci_hcd *xhci,
1763 		struct xhci_command *command)
1764 {
1765 	xhci_free_container_ctx(xhci,
1766 			command->in_ctx);
1767 	kfree(command->completion);
1768 	kfree(command);
1769 }
1770 
1771 int xhci_alloc_erst(struct xhci_hcd *xhci,
1772 		    struct xhci_ring *evt_ring,
1773 		    struct xhci_erst *erst,
1774 		    gfp_t flags)
1775 {
1776 	size_t size;
1777 	unsigned int val;
1778 	struct xhci_segment *seg;
1779 	struct xhci_erst_entry *entry;
1780 
1781 	size = size_mul(sizeof(struct xhci_erst_entry), evt_ring->num_segs);
1782 	erst->entries = dma_alloc_coherent(xhci_to_hcd(xhci)->self.sysdev,
1783 					   size, &erst->erst_dma_addr, flags);
1784 	if (!erst->entries)
1785 		return -ENOMEM;
1786 
1787 	erst->num_entries = evt_ring->num_segs;
1788 
1789 	seg = evt_ring->first_seg;
1790 	for (val = 0; val < evt_ring->num_segs; val++) {
1791 		entry = &erst->entries[val];
1792 		entry->seg_addr = cpu_to_le64(seg->dma);
1793 		entry->seg_size = cpu_to_le32(TRBS_PER_SEGMENT);
1794 		entry->rsvd = 0;
1795 		seg = seg->next;
1796 	}
1797 
1798 	return 0;
1799 }
1800 
1801 static void
1802 xhci_free_interrupter(struct xhci_hcd *xhci, struct xhci_interrupter *ir)
1803 {
1804 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
1805 	size_t erst_size;
1806 	u64 tmp64;
1807 	u32 tmp;
1808 
1809 	if (!ir)
1810 		return;
1811 
1812 	erst_size = sizeof(struct xhci_erst_entry) * ir->erst.num_entries;
1813 	if (ir->erst.entries)
1814 		dma_free_coherent(dev, erst_size,
1815 				  ir->erst.entries,
1816 				  ir->erst.erst_dma_addr);
1817 	ir->erst.entries = NULL;
1818 
1819 	/*
1820 	 * Clean out interrupter registers except ERSTBA. Clearing either the
1821 	 * low or high 32 bits of ERSTBA immediately causes the controller to
1822 	 * dereference the partially cleared 64 bit address, causing IOMMU error.
1823 	 */
1824 	if (ir->ir_set) {
1825 		tmp = readl(&ir->ir_set->erst_size);
1826 		tmp &= ERST_SIZE_MASK;
1827 		writel(tmp, &ir->ir_set->erst_size);
1828 
1829 		tmp64 = xhci_read_64(xhci, &ir->ir_set->erst_dequeue);
1830 		tmp64 &= (u64) ERST_PTR_MASK;
1831 		xhci_write_64(xhci, tmp64, &ir->ir_set->erst_dequeue);
1832 	}
1833 
1834 	/* free interrrupter event ring */
1835 	if (ir->event_ring)
1836 		xhci_ring_free(xhci, ir->event_ring);
1837 	ir->event_ring = NULL;
1838 
1839 	kfree(ir);
1840 }
1841 
1842 void xhci_mem_cleanup(struct xhci_hcd *xhci)
1843 {
1844 	struct device	*dev = xhci_to_hcd(xhci)->self.sysdev;
1845 	int i, j, num_ports;
1846 
1847 	cancel_delayed_work_sync(&xhci->cmd_timer);
1848 
1849 	xhci_free_interrupter(xhci, xhci->interrupter);
1850 	xhci->interrupter = NULL;
1851 	xhci_dbg_trace(xhci, trace_xhci_dbg_init, "Freed primary event ring");
1852 
1853 	if (xhci->cmd_ring)
1854 		xhci_ring_free(xhci, xhci->cmd_ring);
1855 	xhci->cmd_ring = NULL;
1856 	xhci_dbg_trace(xhci, trace_xhci_dbg_init, "Freed command ring");
1857 	xhci_cleanup_command_queue(xhci);
1858 
1859 	num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
1860 	for (i = 0; i < num_ports && xhci->rh_bw; i++) {
1861 		struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;
1862 		for (j = 0; j < XHCI_MAX_INTERVAL; j++) {
1863 			struct list_head *ep = &bwt->interval_bw[j].endpoints;
1864 			while (!list_empty(ep))
1865 				list_del_init(ep->next);
1866 		}
1867 	}
1868 
1869 	for (i = HCS_MAX_SLOTS(xhci->hcs_params1); i > 0; i--)
1870 		xhci_free_virt_devices_depth_first(xhci, i);
1871 
1872 	dma_pool_destroy(xhci->segment_pool);
1873 	xhci->segment_pool = NULL;
1874 	xhci_dbg_trace(xhci, trace_xhci_dbg_init, "Freed segment pool");
1875 
1876 	dma_pool_destroy(xhci->device_pool);
1877 	xhci->device_pool = NULL;
1878 	xhci_dbg_trace(xhci, trace_xhci_dbg_init, "Freed device context pool");
1879 
1880 	dma_pool_destroy(xhci->small_streams_pool);
1881 	xhci->small_streams_pool = NULL;
1882 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
1883 			"Freed small stream array pool");
1884 
1885 	dma_pool_destroy(xhci->medium_streams_pool);
1886 	xhci->medium_streams_pool = NULL;
1887 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
1888 			"Freed medium stream array pool");
1889 
1890 	if (xhci->dcbaa)
1891 		dma_free_coherent(dev, sizeof(*xhci->dcbaa),
1892 				xhci->dcbaa, xhci->dcbaa->dma);
1893 	xhci->dcbaa = NULL;
1894 
1895 	scratchpad_free(xhci);
1896 
1897 	if (!xhci->rh_bw)
1898 		goto no_bw;
1899 
1900 	for (i = 0; i < num_ports; i++) {
1901 		struct xhci_tt_bw_info *tt, *n;
1902 		list_for_each_entry_safe(tt, n, &xhci->rh_bw[i].tts, tt_list) {
1903 			list_del(&tt->tt_list);
1904 			kfree(tt);
1905 		}
1906 	}
1907 
1908 no_bw:
1909 	xhci->cmd_ring_reserved_trbs = 0;
1910 	xhci->usb2_rhub.num_ports = 0;
1911 	xhci->usb3_rhub.num_ports = 0;
1912 	xhci->num_active_eps = 0;
1913 	kfree(xhci->usb2_rhub.ports);
1914 	kfree(xhci->usb3_rhub.ports);
1915 	kfree(xhci->hw_ports);
1916 	kfree(xhci->rh_bw);
1917 	kfree(xhci->ext_caps);
1918 	for (i = 0; i < xhci->num_port_caps; i++)
1919 		kfree(xhci->port_caps[i].psi);
1920 	kfree(xhci->port_caps);
1921 	xhci->num_port_caps = 0;
1922 
1923 	xhci->usb2_rhub.ports = NULL;
1924 	xhci->usb3_rhub.ports = NULL;
1925 	xhci->hw_ports = NULL;
1926 	xhci->rh_bw = NULL;
1927 	xhci->ext_caps = NULL;
1928 	xhci->port_caps = NULL;
1929 
1930 	xhci->page_size = 0;
1931 	xhci->page_shift = 0;
1932 	xhci->usb2_rhub.bus_state.bus_suspended = 0;
1933 	xhci->usb3_rhub.bus_state.bus_suspended = 0;
1934 }
1935 
1936 static void xhci_set_hc_event_deq(struct xhci_hcd *xhci, struct xhci_interrupter *ir)
1937 {
1938 	u64 temp;
1939 	dma_addr_t deq;
1940 
1941 	deq = xhci_trb_virt_to_dma(ir->event_ring->deq_seg,
1942 			ir->event_ring->dequeue);
1943 	if (!deq)
1944 		xhci_warn(xhci, "WARN something wrong with SW event ring dequeue ptr.\n");
1945 	/* Update HC event ring dequeue pointer */
1946 	temp = xhci_read_64(xhci, &ir->ir_set->erst_dequeue);
1947 	temp &= ERST_PTR_MASK;
1948 	/* Don't clear the EHB bit (which is RW1C) because
1949 	 * there might be more events to service.
1950 	 */
1951 	temp &= ~ERST_EHB;
1952 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
1953 		       "// Write event ring dequeue pointer, preserving EHB bit");
1954 	xhci_write_64(xhci, ((u64) deq & (u64) ~ERST_PTR_MASK) | temp,
1955 			&ir->ir_set->erst_dequeue);
1956 }
1957 
1958 static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,
1959 		__le32 __iomem *addr, int max_caps)
1960 {
1961 	u32 temp, port_offset, port_count;
1962 	int i;
1963 	u8 major_revision, minor_revision, tmp_minor_revision;
1964 	struct xhci_hub *rhub;
1965 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
1966 	struct xhci_port_cap *port_cap;
1967 
1968 	temp = readl(addr);
1969 	major_revision = XHCI_EXT_PORT_MAJOR(temp);
1970 	minor_revision = XHCI_EXT_PORT_MINOR(temp);
1971 
1972 	if (major_revision == 0x03) {
1973 		rhub = &xhci->usb3_rhub;
1974 		/*
1975 		 * Some hosts incorrectly use sub-minor version for minor
1976 		 * version (i.e. 0x02 instead of 0x20 for bcdUSB 0x320 and 0x01
1977 		 * for bcdUSB 0x310). Since there is no USB release with sub
1978 		 * minor version 0x301 to 0x309, we can assume that they are
1979 		 * incorrect and fix it here.
1980 		 */
1981 		if (minor_revision > 0x00 && minor_revision < 0x10)
1982 			minor_revision <<= 4;
1983 		/*
1984 		 * Some zhaoxin's xHCI controller that follow usb3.1 spec
1985 		 * but only support Gen1.
1986 		 */
1987 		if (xhci->quirks & XHCI_ZHAOXIN_HOST) {
1988 			tmp_minor_revision = minor_revision;
1989 			minor_revision = 0;
1990 		}
1991 
1992 	} else if (major_revision <= 0x02) {
1993 		rhub = &xhci->usb2_rhub;
1994 	} else {
1995 		xhci_warn(xhci, "Ignoring unknown port speed, Ext Cap %p, revision = 0x%x\n",
1996 				addr, major_revision);
1997 		/* Ignoring port protocol we can't understand. FIXME */
1998 		return;
1999 	}
2000 
2001 	/* Port offset and count in the third dword, see section 7.2 */
2002 	temp = readl(addr + 2);
2003 	port_offset = XHCI_EXT_PORT_OFF(temp);
2004 	port_count = XHCI_EXT_PORT_COUNT(temp);
2005 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
2006 		       "Ext Cap %p, port offset = %u, count = %u, revision = 0x%x",
2007 		       addr, port_offset, port_count, major_revision);
2008 	/* Port count includes the current port offset */
2009 	if (port_offset == 0 || (port_offset + port_count - 1) > num_ports)
2010 		/* WTF? "Valid values are ‘1’ to MaxPorts" */
2011 		return;
2012 
2013 	port_cap = &xhci->port_caps[xhci->num_port_caps++];
2014 	if (xhci->num_port_caps > max_caps)
2015 		return;
2016 
2017 	port_cap->psi_count = XHCI_EXT_PORT_PSIC(temp);
2018 
2019 	if (port_cap->psi_count) {
2020 		port_cap->psi = kcalloc_node(port_cap->psi_count,
2021 					     sizeof(*port_cap->psi),
2022 					     GFP_KERNEL, dev_to_node(dev));
2023 		if (!port_cap->psi)
2024 			port_cap->psi_count = 0;
2025 
2026 		port_cap->psi_uid_count++;
2027 		for (i = 0; i < port_cap->psi_count; i++) {
2028 			port_cap->psi[i] = readl(addr + 4 + i);
2029 
2030 			/* count unique ID values, two consecutive entries can
2031 			 * have the same ID if link is assymetric
2032 			 */
2033 			if (i && (XHCI_EXT_PORT_PSIV(port_cap->psi[i]) !=
2034 				  XHCI_EXT_PORT_PSIV(port_cap->psi[i - 1])))
2035 				port_cap->psi_uid_count++;
2036 
2037 			if (xhci->quirks & XHCI_ZHAOXIN_HOST &&
2038 			    major_revision == 0x03 &&
2039 			    XHCI_EXT_PORT_PSIV(port_cap->psi[i]) >= 5)
2040 				minor_revision = tmp_minor_revision;
2041 
2042 			xhci_dbg(xhci, "PSIV:%d PSIE:%d PLT:%d PFD:%d LP:%d PSIM:%d\n",
2043 				  XHCI_EXT_PORT_PSIV(port_cap->psi[i]),
2044 				  XHCI_EXT_PORT_PSIE(port_cap->psi[i]),
2045 				  XHCI_EXT_PORT_PLT(port_cap->psi[i]),
2046 				  XHCI_EXT_PORT_PFD(port_cap->psi[i]),
2047 				  XHCI_EXT_PORT_LP(port_cap->psi[i]),
2048 				  XHCI_EXT_PORT_PSIM(port_cap->psi[i]));
2049 		}
2050 	}
2051 
2052 	rhub->maj_rev = major_revision;
2053 
2054 	if (rhub->min_rev < minor_revision)
2055 		rhub->min_rev = minor_revision;
2056 
2057 	port_cap->maj_rev = major_revision;
2058 	port_cap->min_rev = minor_revision;
2059 
2060 	/* cache usb2 port capabilities */
2061 	if (major_revision < 0x03 && xhci->num_ext_caps < max_caps)
2062 		xhci->ext_caps[xhci->num_ext_caps++] = temp;
2063 
2064 	if ((xhci->hci_version >= 0x100) && (major_revision != 0x03) &&
2065 		 (temp & XHCI_HLC)) {
2066 		xhci_dbg_trace(xhci, trace_xhci_dbg_init,
2067 			       "xHCI 1.0: support USB2 hardware lpm");
2068 		xhci->hw_lpm_support = 1;
2069 	}
2070 
2071 	port_offset--;
2072 	for (i = port_offset; i < (port_offset + port_count); i++) {
2073 		struct xhci_port *hw_port = &xhci->hw_ports[i];
2074 		/* Duplicate entry.  Ignore the port if the revisions differ. */
2075 		if (hw_port->rhub) {
2076 			xhci_warn(xhci, "Duplicate port entry, Ext Cap %p, port %u\n", addr, i);
2077 			xhci_warn(xhci, "Port was marked as USB %u, duplicated as USB %u\n",
2078 					hw_port->rhub->maj_rev, major_revision);
2079 			/* Only adjust the roothub port counts if we haven't
2080 			 * found a similar duplicate.
2081 			 */
2082 			if (hw_port->rhub != rhub &&
2083 				 hw_port->hcd_portnum != DUPLICATE_ENTRY) {
2084 				hw_port->rhub->num_ports--;
2085 				hw_port->hcd_portnum = DUPLICATE_ENTRY;
2086 			}
2087 			continue;
2088 		}
2089 		hw_port->rhub = rhub;
2090 		hw_port->port_cap = port_cap;
2091 		rhub->num_ports++;
2092 	}
2093 	/* FIXME: Should we disable ports not in the Extended Capabilities? */
2094 }
2095 
2096 static void xhci_create_rhub_port_array(struct xhci_hcd *xhci,
2097 					struct xhci_hub *rhub, gfp_t flags)
2098 {
2099 	int port_index = 0;
2100 	int i;
2101 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
2102 
2103 	if (!rhub->num_ports)
2104 		return;
2105 	rhub->ports = kcalloc_node(rhub->num_ports, sizeof(*rhub->ports),
2106 			flags, dev_to_node(dev));
2107 	if (!rhub->ports)
2108 		return;
2109 
2110 	for (i = 0; i < HCS_MAX_PORTS(xhci->hcs_params1); i++) {
2111 		if (xhci->hw_ports[i].rhub != rhub ||
2112 		    xhci->hw_ports[i].hcd_portnum == DUPLICATE_ENTRY)
2113 			continue;
2114 		xhci->hw_ports[i].hcd_portnum = port_index;
2115 		rhub->ports[port_index] = &xhci->hw_ports[i];
2116 		port_index++;
2117 		if (port_index == rhub->num_ports)
2118 			break;
2119 	}
2120 }
2121 
2122 /*
2123  * Scan the Extended Capabilities for the "Supported Protocol Capabilities" that
2124  * specify what speeds each port is supposed to be.  We can't count on the port
2125  * speed bits in the PORTSC register being correct until a device is connected,
2126  * but we need to set up the two fake roothubs with the correct number of USB
2127  * 3.0 and USB 2.0 ports at host controller initialization time.
2128  */
2129 static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
2130 {
2131 	void __iomem *base;
2132 	u32 offset;
2133 	unsigned int num_ports;
2134 	int i, j;
2135 	int cap_count = 0;
2136 	u32 cap_start;
2137 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
2138 
2139 	num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
2140 	xhci->hw_ports = kcalloc_node(num_ports, sizeof(*xhci->hw_ports),
2141 				flags, dev_to_node(dev));
2142 	if (!xhci->hw_ports)
2143 		return -ENOMEM;
2144 
2145 	for (i = 0; i < num_ports; i++) {
2146 		xhci->hw_ports[i].addr = &xhci->op_regs->port_status_base +
2147 			NUM_PORT_REGS * i;
2148 		xhci->hw_ports[i].hw_portnum = i;
2149 
2150 		init_completion(&xhci->hw_ports[i].rexit_done);
2151 		init_completion(&xhci->hw_ports[i].u3exit_done);
2152 	}
2153 
2154 	xhci->rh_bw = kcalloc_node(num_ports, sizeof(*xhci->rh_bw), flags,
2155 				   dev_to_node(dev));
2156 	if (!xhci->rh_bw)
2157 		return -ENOMEM;
2158 	for (i = 0; i < num_ports; i++) {
2159 		struct xhci_interval_bw_table *bw_table;
2160 
2161 		INIT_LIST_HEAD(&xhci->rh_bw[i].tts);
2162 		bw_table = &xhci->rh_bw[i].bw_table;
2163 		for (j = 0; j < XHCI_MAX_INTERVAL; j++)
2164 			INIT_LIST_HEAD(&bw_table->interval_bw[j].endpoints);
2165 	}
2166 	base = &xhci->cap_regs->hc_capbase;
2167 
2168 	cap_start = xhci_find_next_ext_cap(base, 0, XHCI_EXT_CAPS_PROTOCOL);
2169 	if (!cap_start) {
2170 		xhci_err(xhci, "No Extended Capability registers, unable to set up roothub\n");
2171 		return -ENODEV;
2172 	}
2173 
2174 	offset = cap_start;
2175 	/* count extended protocol capability entries for later caching */
2176 	while (offset) {
2177 		cap_count++;
2178 		offset = xhci_find_next_ext_cap(base, offset,
2179 						      XHCI_EXT_CAPS_PROTOCOL);
2180 	}
2181 
2182 	xhci->ext_caps = kcalloc_node(cap_count, sizeof(*xhci->ext_caps),
2183 				flags, dev_to_node(dev));
2184 	if (!xhci->ext_caps)
2185 		return -ENOMEM;
2186 
2187 	xhci->port_caps = kcalloc_node(cap_count, sizeof(*xhci->port_caps),
2188 				flags, dev_to_node(dev));
2189 	if (!xhci->port_caps)
2190 		return -ENOMEM;
2191 
2192 	offset = cap_start;
2193 
2194 	while (offset) {
2195 		xhci_add_in_port(xhci, num_ports, base + offset, cap_count);
2196 		if (xhci->usb2_rhub.num_ports + xhci->usb3_rhub.num_ports ==
2197 		    num_ports)
2198 			break;
2199 		offset = xhci_find_next_ext_cap(base, offset,
2200 						XHCI_EXT_CAPS_PROTOCOL);
2201 	}
2202 	if (xhci->usb2_rhub.num_ports == 0 && xhci->usb3_rhub.num_ports == 0) {
2203 		xhci_warn(xhci, "No ports on the roothubs?\n");
2204 		return -ENODEV;
2205 	}
2206 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
2207 		       "Found %u USB 2.0 ports and %u USB 3.0 ports.",
2208 		       xhci->usb2_rhub.num_ports, xhci->usb3_rhub.num_ports);
2209 
2210 	/* Place limits on the number of roothub ports so that the hub
2211 	 * descriptors aren't longer than the USB core will allocate.
2212 	 */
2213 	if (xhci->usb3_rhub.num_ports > USB_SS_MAXPORTS) {
2214 		xhci_dbg_trace(xhci, trace_xhci_dbg_init,
2215 				"Limiting USB 3.0 roothub ports to %u.",
2216 				USB_SS_MAXPORTS);
2217 		xhci->usb3_rhub.num_ports = USB_SS_MAXPORTS;
2218 	}
2219 	if (xhci->usb2_rhub.num_ports > USB_MAXCHILDREN) {
2220 		xhci_dbg_trace(xhci, trace_xhci_dbg_init,
2221 				"Limiting USB 2.0 roothub ports to %u.",
2222 				USB_MAXCHILDREN);
2223 		xhci->usb2_rhub.num_ports = USB_MAXCHILDREN;
2224 	}
2225 
2226 	if (!xhci->usb2_rhub.num_ports)
2227 		xhci_info(xhci, "USB2 root hub has no ports\n");
2228 
2229 	if (!xhci->usb3_rhub.num_ports)
2230 		xhci_info(xhci, "USB3 root hub has no ports\n");
2231 
2232 	xhci_create_rhub_port_array(xhci, &xhci->usb2_rhub, flags);
2233 	xhci_create_rhub_port_array(xhci, &xhci->usb3_rhub, flags);
2234 
2235 	return 0;
2236 }
2237 
2238 static struct xhci_interrupter *
2239 xhci_alloc_interrupter(struct xhci_hcd *xhci, gfp_t flags)
2240 {
2241 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
2242 	struct xhci_interrupter *ir;
2243 	int ret;
2244 
2245 	ir = kzalloc_node(sizeof(*ir), flags, dev_to_node(dev));
2246 	if (!ir)
2247 		return NULL;
2248 
2249 	ir->event_ring = xhci_ring_alloc(xhci, ERST_NUM_SEGS, 1, TYPE_EVENT,
2250 					0, flags);
2251 	if (!ir->event_ring) {
2252 		xhci_warn(xhci, "Failed to allocate interrupter event ring\n");
2253 		kfree(ir);
2254 		return NULL;
2255 	}
2256 
2257 	ret = xhci_alloc_erst(xhci, ir->event_ring, &ir->erst, flags);
2258 	if (ret) {
2259 		xhci_warn(xhci, "Failed to allocate interrupter erst\n");
2260 		xhci_ring_free(xhci, ir->event_ring);
2261 		kfree(ir);
2262 		return NULL;
2263 	}
2264 
2265 	return ir;
2266 }
2267 
2268 static int
2269 xhci_add_interrupter(struct xhci_hcd *xhci, struct xhci_interrupter *ir,
2270 		     unsigned int intr_num)
2271 {
2272 	u64 erst_base;
2273 	u32 erst_size;
2274 
2275 	if (intr_num > xhci->max_interrupters) {
2276 		xhci_warn(xhci, "Can't add interrupter %d, max interrupters %d\n",
2277 			  intr_num, xhci->max_interrupters);
2278 		return -EINVAL;
2279 	}
2280 
2281 	ir->ir_set = &xhci->run_regs->ir_set[intr_num];
2282 
2283 	/* set ERST count with the number of entries in the segment table */
2284 	erst_size = readl(&ir->ir_set->erst_size);
2285 	erst_size &= ERST_SIZE_MASK;
2286 	erst_size |= ERST_NUM_SEGS;
2287 	writel(erst_size, &ir->ir_set->erst_size);
2288 
2289 	erst_base = xhci_read_64(xhci, &ir->ir_set->erst_base);
2290 	erst_base &= ERST_BASE_RSVDP;
2291 	erst_base |= ir->erst.erst_dma_addr & ~ERST_BASE_RSVDP;
2292 	xhci_write_64(xhci, erst_base, &ir->ir_set->erst_base);
2293 
2294 	/* Set the event ring dequeue address of this interrupter */
2295 	xhci_set_hc_event_deq(xhci, ir);
2296 
2297 	return 0;
2298 }
2299 
2300 int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
2301 {
2302 	dma_addr_t	dma;
2303 	struct device	*dev = xhci_to_hcd(xhci)->self.sysdev;
2304 	unsigned int	val, val2;
2305 	u64		val_64;
2306 	u32		page_size, temp;
2307 	int		i;
2308 
2309 	INIT_LIST_HEAD(&xhci->cmd_list);
2310 
2311 	/* init command timeout work */
2312 	INIT_DELAYED_WORK(&xhci->cmd_timer, xhci_handle_command_timeout);
2313 	init_completion(&xhci->cmd_ring_stop_completion);
2314 
2315 	page_size = readl(&xhci->op_regs->page_size);
2316 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
2317 			"Supported page size register = 0x%x", page_size);
2318 	i = ffs(page_size);
2319 	if (i < 16)
2320 		xhci_dbg_trace(xhci, trace_xhci_dbg_init,
2321 			"Supported page size of %iK", (1 << (i+12)) / 1024);
2322 	else
2323 		xhci_warn(xhci, "WARN: no supported page size\n");
2324 	/* Use 4K pages, since that's common and the minimum the HC supports */
2325 	xhci->page_shift = 12;
2326 	xhci->page_size = 1 << xhci->page_shift;
2327 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
2328 			"HCD page size set to %iK", xhci->page_size / 1024);
2329 
2330 	/*
2331 	 * Program the Number of Device Slots Enabled field in the CONFIG
2332 	 * register with the max value of slots the HC can handle.
2333 	 */
2334 	val = HCS_MAX_SLOTS(readl(&xhci->cap_regs->hcs_params1));
2335 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
2336 			"// xHC can handle at most %d device slots.", val);
2337 	val2 = readl(&xhci->op_regs->config_reg);
2338 	val |= (val2 & ~HCS_SLOTS_MASK);
2339 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
2340 			"// Setting Max device slots reg = 0x%x.", val);
2341 	writel(val, &xhci->op_regs->config_reg);
2342 
2343 	/*
2344 	 * xHCI section 5.4.6 - Device Context array must be
2345 	 * "physically contiguous and 64-byte (cache line) aligned".
2346 	 */
2347 	xhci->dcbaa = dma_alloc_coherent(dev, sizeof(*xhci->dcbaa), &dma,
2348 			flags);
2349 	if (!xhci->dcbaa)
2350 		goto fail;
2351 	xhci->dcbaa->dma = dma;
2352 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
2353 			"// Device context base array address = 0x%pad (DMA), %p (virt)",
2354 			&xhci->dcbaa->dma, xhci->dcbaa);
2355 	xhci_write_64(xhci, dma, &xhci->op_regs->dcbaa_ptr);
2356 
2357 	/*
2358 	 * Initialize the ring segment pool.  The ring must be a contiguous
2359 	 * structure comprised of TRBs.  The TRBs must be 16 byte aligned,
2360 	 * however, the command ring segment needs 64-byte aligned segments
2361 	 * and our use of dma addresses in the trb_address_map radix tree needs
2362 	 * TRB_SEGMENT_SIZE alignment, so we pick the greater alignment need.
2363 	 */
2364 	if (xhci->quirks & XHCI_ZHAOXIN_TRB_FETCH)
2365 		xhci->segment_pool = dma_pool_create("xHCI ring segments", dev,
2366 				TRB_SEGMENT_SIZE * 2, TRB_SEGMENT_SIZE * 2, xhci->page_size * 2);
2367 	else
2368 		xhci->segment_pool = dma_pool_create("xHCI ring segments", dev,
2369 				TRB_SEGMENT_SIZE, TRB_SEGMENT_SIZE, xhci->page_size);
2370 
2371 	/* See Table 46 and Note on Figure 55 */
2372 	xhci->device_pool = dma_pool_create("xHCI input/output contexts", dev,
2373 			2112, 64, xhci->page_size);
2374 	if (!xhci->segment_pool || !xhci->device_pool)
2375 		goto fail;
2376 
2377 	/* Linear stream context arrays don't have any boundary restrictions,
2378 	 * and only need to be 16-byte aligned.
2379 	 */
2380 	xhci->small_streams_pool =
2381 		dma_pool_create("xHCI 256 byte stream ctx arrays",
2382 			dev, SMALL_STREAM_ARRAY_SIZE, 16, 0);
2383 	xhci->medium_streams_pool =
2384 		dma_pool_create("xHCI 1KB stream ctx arrays",
2385 			dev, MEDIUM_STREAM_ARRAY_SIZE, 16, 0);
2386 	/* Any stream context array bigger than MEDIUM_STREAM_ARRAY_SIZE
2387 	 * will be allocated with dma_alloc_coherent()
2388 	 */
2389 
2390 	if (!xhci->small_streams_pool || !xhci->medium_streams_pool)
2391 		goto fail;
2392 
2393 	/* Set up the command ring to have one segments for now. */
2394 	xhci->cmd_ring = xhci_ring_alloc(xhci, 1, 1, TYPE_COMMAND, 0, flags);
2395 	if (!xhci->cmd_ring)
2396 		goto fail;
2397 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
2398 			"Allocated command ring at %p", xhci->cmd_ring);
2399 	xhci_dbg_trace(xhci, trace_xhci_dbg_init, "First segment DMA is 0x%pad",
2400 			&xhci->cmd_ring->first_seg->dma);
2401 
2402 	/* Set the address in the Command Ring Control register */
2403 	val_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
2404 	val_64 = (val_64 & (u64) CMD_RING_RSVD_BITS) |
2405 		(xhci->cmd_ring->first_seg->dma & (u64) ~CMD_RING_RSVD_BITS) |
2406 		xhci->cmd_ring->cycle_state;
2407 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
2408 			"// Setting command ring address to 0x%016llx", val_64);
2409 	xhci_write_64(xhci, val_64, &xhci->op_regs->cmd_ring);
2410 
2411 	/* Reserve one command ring TRB for disabling LPM.
2412 	 * Since the USB core grabs the shared usb_bus bandwidth mutex before
2413 	 * disabling LPM, we only need to reserve one TRB for all devices.
2414 	 */
2415 	xhci->cmd_ring_reserved_trbs++;
2416 
2417 	val = readl(&xhci->cap_regs->db_off);
2418 	val &= DBOFF_MASK;
2419 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
2420 		       "// Doorbell array is located at offset 0x%x from cap regs base addr",
2421 		       val);
2422 	xhci->dba = (void __iomem *) xhci->cap_regs + val;
2423 
2424 	/* Allocate and set up primary interrupter 0 with an event ring. */
2425 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
2426 		       "Allocating primary event ring");
2427 	xhci->interrupter = xhci_alloc_interrupter(xhci, flags);
2428 	if (!xhci->interrupter)
2429 		goto fail;
2430 
2431 	if (xhci_add_interrupter(xhci, xhci->interrupter, 0))
2432 		goto fail;
2433 
2434 	xhci->isoc_bei_interval = AVOID_BEI_INTERVAL_MAX;
2435 
2436 	/*
2437 	 * XXX: Might need to set the Interrupter Moderation Register to
2438 	 * something other than the default (~1ms minimum between interrupts).
2439 	 * See section 5.5.1.2.
2440 	 */
2441 	for (i = 0; i < MAX_HC_SLOTS; i++)
2442 		xhci->devs[i] = NULL;
2443 
2444 	if (scratchpad_alloc(xhci, flags))
2445 		goto fail;
2446 	if (xhci_setup_port_arrays(xhci, flags))
2447 		goto fail;
2448 
2449 	/* Enable USB 3.0 device notifications for function remote wake, which
2450 	 * is necessary for allowing USB 3.0 devices to do remote wakeup from
2451 	 * U3 (device suspend).
2452 	 */
2453 	temp = readl(&xhci->op_regs->dev_notification);
2454 	temp &= ~DEV_NOTE_MASK;
2455 	temp |= DEV_NOTE_FWAKE;
2456 	writel(temp, &xhci->op_regs->dev_notification);
2457 
2458 	return 0;
2459 
2460 fail:
2461 	xhci_halt(xhci);
2462 	xhci_reset(xhci, XHCI_RESET_SHORT_USEC);
2463 	xhci_mem_cleanup(xhci);
2464 	return -ENOMEM;
2465 }
2466