xref: /openbmc/linux/drivers/usb/musb/musb_host.c (revision b6dcefde)
1 /*
2  * MUSB OTG driver host support
3  *
4  * Copyright 2005 Mentor Graphics Corporation
5  * Copyright (C) 2005-2006 by Texas Instruments
6  * Copyright (C) 2006-2007 Nokia Corporation
7  * Copyright (C) 2008-2009 MontaVista Software, Inc. <source@mvista.com>
8  *
9  * This program is free software; you can redistribute it and/or
10  * modify it under the terms of the GNU General Public License
11  * version 2 as published by the Free Software Foundation.
12  *
13  * This program is distributed in the hope that it will be useful, but
14  * WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16  * General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, write to the Free Software
20  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
21  * 02110-1301 USA
22  *
23  * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
24  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
25  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
26  * NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
27  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
28  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
29  * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
30  * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
32  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  *
34  */
35 
36 #include <linux/module.h>
37 #include <linux/kernel.h>
38 #include <linux/delay.h>
39 #include <linux/sched.h>
40 #include <linux/slab.h>
41 #include <linux/errno.h>
42 #include <linux/init.h>
43 #include <linux/list.h>
44 
45 #include "musb_core.h"
46 #include "musb_host.h"
47 
48 
49 /* MUSB HOST status 22-mar-2006
50  *
51  * - There's still lots of partial code duplication for fault paths, so
52  *   they aren't handled as consistently as they need to be.
53  *
54  * - PIO mostly behaved when last tested.
55  *     + including ep0, with all usbtest cases 9, 10
56  *     + usbtest 14 (ep0out) doesn't seem to run at all
57  *     + double buffered OUT/TX endpoints saw stalls(!) with certain usbtest
58  *       configurations, but otherwise double buffering passes basic tests.
59  *     + for 2.6.N, for N > ~10, needs API changes for hcd framework.
60  *
61  * - DMA (CPPI) ... partially behaves, not currently recommended
62  *     + about 1/15 the speed of typical EHCI implementations (PCI)
63  *     + RX, all too often reqpkt seems to misbehave after tx
64  *     + TX, no known issues (other than evident silicon issue)
65  *
66  * - DMA (Mentor/OMAP) ...has at least toggle update problems
67  *
68  * - [23-feb-2009] minimal traffic scheduling to avoid bulk RX packet
69  *   starvation ... nothing yet for TX, interrupt, or bulk.
70  *
71  * - Not tested with HNP, but some SRP paths seem to behave.
72  *
73  * NOTE 24-August-2006:
74  *
75  * - Bulk traffic finally uses both sides of hardware ep1, freeing up an
76  *   extra endpoint for periodic use enabling hub + keybd + mouse.  That
77  *   mostly works, except that with "usbnet" it's easy to trigger cases
78  *   with "ping" where RX loses.  (a) ping to davinci, even "ping -f",
79  *   fine; but (b) ping _from_ davinci, even "ping -c 1", ICMP RX loses
80  *   although ARP RX wins.  (That test was done with a full speed link.)
81  */
82 
83 
84 /*
85  * NOTE on endpoint usage:
86  *
87  * CONTROL transfers all go through ep0.  BULK ones go through dedicated IN
88  * and OUT endpoints ... hardware is dedicated for those "async" queue(s).
89  * (Yes, bulk _could_ use more of the endpoints than that, and would even
90  * benefit from it.)
91  *
92  * INTERUPPT and ISOCHRONOUS transfers are scheduled to the other endpoints.
93  * So far that scheduling is both dumb and optimistic:  the endpoint will be
94  * "claimed" until its software queue is no longer refilled.  No multiplexing
95  * of transfers between endpoints, or anything clever.
96  */
97 
98 
99 static void musb_ep_program(struct musb *musb, u8 epnum,
100 			struct urb *urb, int is_out,
101 			u8 *buf, u32 offset, u32 len);
102 
103 /*
104  * Clear TX fifo. Needed to avoid BABBLE errors.
105  */
106 static void musb_h_tx_flush_fifo(struct musb_hw_ep *ep)
107 {
108 	void __iomem	*epio = ep->regs;
109 	u16		csr;
110 	u16		lastcsr = 0;
111 	int		retries = 1000;
112 
113 	csr = musb_readw(epio, MUSB_TXCSR);
114 	while (csr & MUSB_TXCSR_FIFONOTEMPTY) {
115 		if (csr != lastcsr)
116 			DBG(3, "Host TX FIFONOTEMPTY csr: %02x\n", csr);
117 		lastcsr = csr;
118 		csr |= MUSB_TXCSR_FLUSHFIFO;
119 		musb_writew(epio, MUSB_TXCSR, csr);
120 		csr = musb_readw(epio, MUSB_TXCSR);
121 		if (WARN(retries-- < 1,
122 				"Could not flush host TX%d fifo: csr: %04x\n",
123 				ep->epnum, csr))
124 			return;
125 		mdelay(1);
126 	}
127 }
128 
129 static void musb_h_ep0_flush_fifo(struct musb_hw_ep *ep)
130 {
131 	void __iomem	*epio = ep->regs;
132 	u16		csr;
133 	int		retries = 5;
134 
135 	/* scrub any data left in the fifo */
136 	do {
137 		csr = musb_readw(epio, MUSB_TXCSR);
138 		if (!(csr & (MUSB_CSR0_TXPKTRDY | MUSB_CSR0_RXPKTRDY)))
139 			break;
140 		musb_writew(epio, MUSB_TXCSR, MUSB_CSR0_FLUSHFIFO);
141 		csr = musb_readw(epio, MUSB_TXCSR);
142 		udelay(10);
143 	} while (--retries);
144 
145 	WARN(!retries, "Could not flush host TX%d fifo: csr: %04x\n",
146 			ep->epnum, csr);
147 
148 	/* and reset for the next transfer */
149 	musb_writew(epio, MUSB_TXCSR, 0);
150 }
151 
152 /*
153  * Start transmit. Caller is responsible for locking shared resources.
154  * musb must be locked.
155  */
156 static inline void musb_h_tx_start(struct musb_hw_ep *ep)
157 {
158 	u16	txcsr;
159 
160 	/* NOTE: no locks here; caller should lock and select EP */
161 	if (ep->epnum) {
162 		txcsr = musb_readw(ep->regs, MUSB_TXCSR);
163 		txcsr |= MUSB_TXCSR_TXPKTRDY | MUSB_TXCSR_H_WZC_BITS;
164 		musb_writew(ep->regs, MUSB_TXCSR, txcsr);
165 	} else {
166 		txcsr = MUSB_CSR0_H_SETUPPKT | MUSB_CSR0_TXPKTRDY;
167 		musb_writew(ep->regs, MUSB_CSR0, txcsr);
168 	}
169 
170 }
171 
172 static inline void musb_h_tx_dma_start(struct musb_hw_ep *ep)
173 {
174 	u16	txcsr;
175 
176 	/* NOTE: no locks here; caller should lock and select EP */
177 	txcsr = musb_readw(ep->regs, MUSB_TXCSR);
178 	txcsr |= MUSB_TXCSR_DMAENAB | MUSB_TXCSR_H_WZC_BITS;
179 	if (is_cppi_enabled())
180 		txcsr |= MUSB_TXCSR_DMAMODE;
181 	musb_writew(ep->regs, MUSB_TXCSR, txcsr);
182 }
183 
184 static void musb_ep_set_qh(struct musb_hw_ep *ep, int is_in, struct musb_qh *qh)
185 {
186 	if (is_in != 0 || ep->is_shared_fifo)
187 		ep->in_qh  = qh;
188 	if (is_in == 0 || ep->is_shared_fifo)
189 		ep->out_qh = qh;
190 }
191 
192 static struct musb_qh *musb_ep_get_qh(struct musb_hw_ep *ep, int is_in)
193 {
194 	return is_in ? ep->in_qh : ep->out_qh;
195 }
196 
197 /*
198  * Start the URB at the front of an endpoint's queue
199  * end must be claimed from the caller.
200  *
201  * Context: controller locked, irqs blocked
202  */
203 static void
204 musb_start_urb(struct musb *musb, int is_in, struct musb_qh *qh)
205 {
206 	u16			frame;
207 	u32			len;
208 	void __iomem		*mbase =  musb->mregs;
209 	struct urb		*urb = next_urb(qh);
210 	void			*buf = urb->transfer_buffer;
211 	u32			offset = 0;
212 	struct musb_hw_ep	*hw_ep = qh->hw_ep;
213 	unsigned		pipe = urb->pipe;
214 	u8			address = usb_pipedevice(pipe);
215 	int			epnum = hw_ep->epnum;
216 
217 	/* initialize software qh state */
218 	qh->offset = 0;
219 	qh->segsize = 0;
220 
221 	/* gather right source of data */
222 	switch (qh->type) {
223 	case USB_ENDPOINT_XFER_CONTROL:
224 		/* control transfers always start with SETUP */
225 		is_in = 0;
226 		musb->ep0_stage = MUSB_EP0_START;
227 		buf = urb->setup_packet;
228 		len = 8;
229 		break;
230 	case USB_ENDPOINT_XFER_ISOC:
231 		qh->iso_idx = 0;
232 		qh->frame = 0;
233 		offset = urb->iso_frame_desc[0].offset;
234 		len = urb->iso_frame_desc[0].length;
235 		break;
236 	default:		/* bulk, interrupt */
237 		/* actual_length may be nonzero on retry paths */
238 		buf = urb->transfer_buffer + urb->actual_length;
239 		len = urb->transfer_buffer_length - urb->actual_length;
240 	}
241 
242 	DBG(4, "qh %p urb %p dev%d ep%d%s%s, hw_ep %d, %p/%d\n",
243 			qh, urb, address, qh->epnum,
244 			is_in ? "in" : "out",
245 			({char *s; switch (qh->type) {
246 			case USB_ENDPOINT_XFER_CONTROL:	s = ""; break;
247 			case USB_ENDPOINT_XFER_BULK:	s = "-bulk"; break;
248 			case USB_ENDPOINT_XFER_ISOC:	s = "-iso"; break;
249 			default:			s = "-intr"; break;
250 			}; s; }),
251 			epnum, buf + offset, len);
252 
253 	/* Configure endpoint */
254 	musb_ep_set_qh(hw_ep, is_in, qh);
255 	musb_ep_program(musb, epnum, urb, !is_in, buf, offset, len);
256 
257 	/* transmit may have more work: start it when it is time */
258 	if (is_in)
259 		return;
260 
261 	/* determine if the time is right for a periodic transfer */
262 	switch (qh->type) {
263 	case USB_ENDPOINT_XFER_ISOC:
264 	case USB_ENDPOINT_XFER_INT:
265 		DBG(3, "check whether there's still time for periodic Tx\n");
266 		frame = musb_readw(mbase, MUSB_FRAME);
267 		/* FIXME this doesn't implement that scheduling policy ...
268 		 * or handle framecounter wrapping
269 		 */
270 		if ((urb->transfer_flags & URB_ISO_ASAP)
271 				|| (frame >= urb->start_frame)) {
272 			/* REVISIT the SOF irq handler shouldn't duplicate
273 			 * this code; and we don't init urb->start_frame...
274 			 */
275 			qh->frame = 0;
276 			goto start;
277 		} else {
278 			qh->frame = urb->start_frame;
279 			/* enable SOF interrupt so we can count down */
280 			DBG(1, "SOF for %d\n", epnum);
281 #if 1 /* ifndef	CONFIG_ARCH_DAVINCI */
282 			musb_writeb(mbase, MUSB_INTRUSBE, 0xff);
283 #endif
284 		}
285 		break;
286 	default:
287 start:
288 		DBG(4, "Start TX%d %s\n", epnum,
289 			hw_ep->tx_channel ? "dma" : "pio");
290 
291 		if (!hw_ep->tx_channel)
292 			musb_h_tx_start(hw_ep);
293 		else if (is_cppi_enabled() || tusb_dma_omap())
294 			musb_h_tx_dma_start(hw_ep);
295 	}
296 }
297 
298 /* Context: caller owns controller lock, IRQs are blocked */
299 static void musb_giveback(struct musb *musb, struct urb *urb, int status)
300 __releases(musb->lock)
301 __acquires(musb->lock)
302 {
303 	DBG(({ int level; switch (status) {
304 				case 0:
305 					level = 4;
306 					break;
307 				/* common/boring faults */
308 				case -EREMOTEIO:
309 				case -ESHUTDOWN:
310 				case -ECONNRESET:
311 				case -EPIPE:
312 					level = 3;
313 					break;
314 				default:
315 					level = 2;
316 					break;
317 				}; level; }),
318 			"complete %p %pF (%d), dev%d ep%d%s, %d/%d\n",
319 			urb, urb->complete, status,
320 			usb_pipedevice(urb->pipe),
321 			usb_pipeendpoint(urb->pipe),
322 			usb_pipein(urb->pipe) ? "in" : "out",
323 			urb->actual_length, urb->transfer_buffer_length
324 			);
325 
326 	usb_hcd_unlink_urb_from_ep(musb_to_hcd(musb), urb);
327 	spin_unlock(&musb->lock);
328 	usb_hcd_giveback_urb(musb_to_hcd(musb), urb, status);
329 	spin_lock(&musb->lock);
330 }
331 
332 /* For bulk/interrupt endpoints only */
333 static inline void musb_save_toggle(struct musb_qh *qh, int is_in,
334 				    struct urb *urb)
335 {
336 	void __iomem		*epio = qh->hw_ep->regs;
337 	u16			csr;
338 
339 	/*
340 	 * FIXME: the current Mentor DMA code seems to have
341 	 * problems getting toggle correct.
342 	 */
343 
344 	if (is_in)
345 		csr = musb_readw(epio, MUSB_RXCSR) & MUSB_RXCSR_H_DATATOGGLE;
346 	else
347 		csr = musb_readw(epio, MUSB_TXCSR) & MUSB_TXCSR_H_DATATOGGLE;
348 
349 	usb_settoggle(urb->dev, qh->epnum, !is_in, csr ? 1 : 0);
350 }
351 
352 /*
353  * Advance this hardware endpoint's queue, completing the specified URB and
354  * advancing to either the next URB queued to that qh, or else invalidating
355  * that qh and advancing to the next qh scheduled after the current one.
356  *
357  * Context: caller owns controller lock, IRQs are blocked
358  */
359 static void musb_advance_schedule(struct musb *musb, struct urb *urb,
360 				  struct musb_hw_ep *hw_ep, int is_in)
361 {
362 	struct musb_qh		*qh = musb_ep_get_qh(hw_ep, is_in);
363 	struct musb_hw_ep	*ep = qh->hw_ep;
364 	int			ready = qh->is_ready;
365 	int			status;
366 
367 	status = (urb->status == -EINPROGRESS) ? 0 : urb->status;
368 
369 	/* save toggle eagerly, for paranoia */
370 	switch (qh->type) {
371 	case USB_ENDPOINT_XFER_BULK:
372 	case USB_ENDPOINT_XFER_INT:
373 		musb_save_toggle(qh, is_in, urb);
374 		break;
375 	case USB_ENDPOINT_XFER_ISOC:
376 		if (status == 0 && urb->error_count)
377 			status = -EXDEV;
378 		break;
379 	}
380 
381 	qh->is_ready = 0;
382 	musb_giveback(musb, urb, status);
383 	qh->is_ready = ready;
384 
385 	/* reclaim resources (and bandwidth) ASAP; deschedule it, and
386 	 * invalidate qh as soon as list_empty(&hep->urb_list)
387 	 */
388 	if (list_empty(&qh->hep->urb_list)) {
389 		struct list_head	*head;
390 
391 		if (is_in)
392 			ep->rx_reinit = 1;
393 		else
394 			ep->tx_reinit = 1;
395 
396 		/* Clobber old pointers to this qh */
397 		musb_ep_set_qh(ep, is_in, NULL);
398 		qh->hep->hcpriv = NULL;
399 
400 		switch (qh->type) {
401 
402 		case USB_ENDPOINT_XFER_CONTROL:
403 		case USB_ENDPOINT_XFER_BULK:
404 			/* fifo policy for these lists, except that NAKing
405 			 * should rotate a qh to the end (for fairness).
406 			 */
407 			if (qh->mux == 1) {
408 				head = qh->ring.prev;
409 				list_del(&qh->ring);
410 				kfree(qh);
411 				qh = first_qh(head);
412 				break;
413 			}
414 
415 		case USB_ENDPOINT_XFER_ISOC:
416 		case USB_ENDPOINT_XFER_INT:
417 			/* this is where periodic bandwidth should be
418 			 * de-allocated if it's tracked and allocated;
419 			 * and where we'd update the schedule tree...
420 			 */
421 			kfree(qh);
422 			qh = NULL;
423 			break;
424 		}
425 	}
426 
427 	if (qh != NULL && qh->is_ready) {
428 		DBG(4, "... next ep%d %cX urb %p\n",
429 		    hw_ep->epnum, is_in ? 'R' : 'T', next_urb(qh));
430 		musb_start_urb(musb, is_in, qh);
431 	}
432 }
433 
434 static u16 musb_h_flush_rxfifo(struct musb_hw_ep *hw_ep, u16 csr)
435 {
436 	/* we don't want fifo to fill itself again;
437 	 * ignore dma (various models),
438 	 * leave toggle alone (may not have been saved yet)
439 	 */
440 	csr |= MUSB_RXCSR_FLUSHFIFO | MUSB_RXCSR_RXPKTRDY;
441 	csr &= ~(MUSB_RXCSR_H_REQPKT
442 		| MUSB_RXCSR_H_AUTOREQ
443 		| MUSB_RXCSR_AUTOCLEAR);
444 
445 	/* write 2x to allow double buffering */
446 	musb_writew(hw_ep->regs, MUSB_RXCSR, csr);
447 	musb_writew(hw_ep->regs, MUSB_RXCSR, csr);
448 
449 	/* flush writebuffer */
450 	return musb_readw(hw_ep->regs, MUSB_RXCSR);
451 }
452 
453 /*
454  * PIO RX for a packet (or part of it).
455  */
456 static bool
457 musb_host_packet_rx(struct musb *musb, struct urb *urb, u8 epnum, u8 iso_err)
458 {
459 	u16			rx_count;
460 	u8			*buf;
461 	u16			csr;
462 	bool			done = false;
463 	u32			length;
464 	int			do_flush = 0;
465 	struct musb_hw_ep	*hw_ep = musb->endpoints + epnum;
466 	void __iomem		*epio = hw_ep->regs;
467 	struct musb_qh		*qh = hw_ep->in_qh;
468 	int			pipe = urb->pipe;
469 	void			*buffer = urb->transfer_buffer;
470 
471 	/* musb_ep_select(mbase, epnum); */
472 	rx_count = musb_readw(epio, MUSB_RXCOUNT);
473 	DBG(3, "RX%d count %d, buffer %p len %d/%d\n", epnum, rx_count,
474 			urb->transfer_buffer, qh->offset,
475 			urb->transfer_buffer_length);
476 
477 	/* unload FIFO */
478 	if (usb_pipeisoc(pipe)) {
479 		int					status = 0;
480 		struct usb_iso_packet_descriptor	*d;
481 
482 		if (iso_err) {
483 			status = -EILSEQ;
484 			urb->error_count++;
485 		}
486 
487 		d = urb->iso_frame_desc + qh->iso_idx;
488 		buf = buffer + d->offset;
489 		length = d->length;
490 		if (rx_count > length) {
491 			if (status == 0) {
492 				status = -EOVERFLOW;
493 				urb->error_count++;
494 			}
495 			DBG(2, "** OVERFLOW %d into %d\n", rx_count, length);
496 			do_flush = 1;
497 		} else
498 			length = rx_count;
499 		urb->actual_length += length;
500 		d->actual_length = length;
501 
502 		d->status = status;
503 
504 		/* see if we are done */
505 		done = (++qh->iso_idx >= urb->number_of_packets);
506 	} else {
507 		/* non-isoch */
508 		buf = buffer + qh->offset;
509 		length = urb->transfer_buffer_length - qh->offset;
510 		if (rx_count > length) {
511 			if (urb->status == -EINPROGRESS)
512 				urb->status = -EOVERFLOW;
513 			DBG(2, "** OVERFLOW %d into %d\n", rx_count, length);
514 			do_flush = 1;
515 		} else
516 			length = rx_count;
517 		urb->actual_length += length;
518 		qh->offset += length;
519 
520 		/* see if we are done */
521 		done = (urb->actual_length == urb->transfer_buffer_length)
522 			|| (rx_count < qh->maxpacket)
523 			|| (urb->status != -EINPROGRESS);
524 		if (done
525 				&& (urb->status == -EINPROGRESS)
526 				&& (urb->transfer_flags & URB_SHORT_NOT_OK)
527 				&& (urb->actual_length
528 					< urb->transfer_buffer_length))
529 			urb->status = -EREMOTEIO;
530 	}
531 
532 	musb_read_fifo(hw_ep, length, buf);
533 
534 	csr = musb_readw(epio, MUSB_RXCSR);
535 	csr |= MUSB_RXCSR_H_WZC_BITS;
536 	if (unlikely(do_flush))
537 		musb_h_flush_rxfifo(hw_ep, csr);
538 	else {
539 		/* REVISIT this assumes AUTOCLEAR is never set */
540 		csr &= ~(MUSB_RXCSR_RXPKTRDY | MUSB_RXCSR_H_REQPKT);
541 		if (!done)
542 			csr |= MUSB_RXCSR_H_REQPKT;
543 		musb_writew(epio, MUSB_RXCSR, csr);
544 	}
545 
546 	return done;
547 }
548 
549 /* we don't always need to reinit a given side of an endpoint...
550  * when we do, use tx/rx reinit routine and then construct a new CSR
551  * to address data toggle, NYET, and DMA or PIO.
552  *
553  * it's possible that driver bugs (especially for DMA) or aborting a
554  * transfer might have left the endpoint busier than it should be.
555  * the busy/not-empty tests are basically paranoia.
556  */
557 static void
558 musb_rx_reinit(struct musb *musb, struct musb_qh *qh, struct musb_hw_ep *ep)
559 {
560 	u16	csr;
561 
562 	/* NOTE:  we know the "rx" fifo reinit never triggers for ep0.
563 	 * That always uses tx_reinit since ep0 repurposes TX register
564 	 * offsets; the initial SETUP packet is also a kind of OUT.
565 	 */
566 
567 	/* if programmed for Tx, put it in RX mode */
568 	if (ep->is_shared_fifo) {
569 		csr = musb_readw(ep->regs, MUSB_TXCSR);
570 		if (csr & MUSB_TXCSR_MODE) {
571 			musb_h_tx_flush_fifo(ep);
572 			csr = musb_readw(ep->regs, MUSB_TXCSR);
573 			musb_writew(ep->regs, MUSB_TXCSR,
574 				    csr | MUSB_TXCSR_FRCDATATOG);
575 		}
576 
577 		/*
578 		 * Clear the MODE bit (and everything else) to enable Rx.
579 		 * NOTE: we mustn't clear the DMAMODE bit before DMAENAB.
580 		 */
581 		if (csr & MUSB_TXCSR_DMAMODE)
582 			musb_writew(ep->regs, MUSB_TXCSR, MUSB_TXCSR_DMAMODE);
583 		musb_writew(ep->regs, MUSB_TXCSR, 0);
584 
585 	/* scrub all previous state, clearing toggle */
586 	} else {
587 		csr = musb_readw(ep->regs, MUSB_RXCSR);
588 		if (csr & MUSB_RXCSR_RXPKTRDY)
589 			WARNING("rx%d, packet/%d ready?\n", ep->epnum,
590 				musb_readw(ep->regs, MUSB_RXCOUNT));
591 
592 		musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG);
593 	}
594 
595 	/* target addr and (for multipoint) hub addr/port */
596 	if (musb->is_multipoint) {
597 		musb_write_rxfunaddr(ep->target_regs, qh->addr_reg);
598 		musb_write_rxhubaddr(ep->target_regs, qh->h_addr_reg);
599 		musb_write_rxhubport(ep->target_regs, qh->h_port_reg);
600 
601 	} else
602 		musb_writeb(musb->mregs, MUSB_FADDR, qh->addr_reg);
603 
604 	/* protocol/endpoint, interval/NAKlimit, i/o size */
605 	musb_writeb(ep->regs, MUSB_RXTYPE, qh->type_reg);
606 	musb_writeb(ep->regs, MUSB_RXINTERVAL, qh->intv_reg);
607 	/* NOTE: bulk combining rewrites high bits of maxpacket */
608 	musb_writew(ep->regs, MUSB_RXMAXP,
609 			qh->maxpacket | ((qh->hb_mult - 1) << 11));
610 
611 	ep->rx_reinit = 0;
612 }
613 
614 static bool musb_tx_dma_program(struct dma_controller *dma,
615 		struct musb_hw_ep *hw_ep, struct musb_qh *qh,
616 		struct urb *urb, u32 offset, u32 length)
617 {
618 	struct dma_channel	*channel = hw_ep->tx_channel;
619 	void __iomem		*epio = hw_ep->regs;
620 	u16			pkt_size = qh->maxpacket;
621 	u16			csr;
622 	u8			mode;
623 
624 #ifdef	CONFIG_USB_INVENTRA_DMA
625 	if (length > channel->max_len)
626 		length = channel->max_len;
627 
628 	csr = musb_readw(epio, MUSB_TXCSR);
629 	if (length > pkt_size) {
630 		mode = 1;
631 		csr |= MUSB_TXCSR_DMAMODE | MUSB_TXCSR_DMAENAB;
632 		/* autoset shouldn't be set in high bandwidth */
633 		if (qh->hb_mult == 1)
634 			csr |= MUSB_TXCSR_AUTOSET;
635 	} else {
636 		mode = 0;
637 		csr &= ~(MUSB_TXCSR_AUTOSET | MUSB_TXCSR_DMAMODE);
638 		csr |= MUSB_TXCSR_DMAENAB; /* against programmer's guide */
639 	}
640 	channel->desired_mode = mode;
641 	musb_writew(epio, MUSB_TXCSR, csr);
642 #else
643 	if (!is_cppi_enabled() && !tusb_dma_omap())
644 		return false;
645 
646 	channel->actual_len = 0;
647 
648 	/*
649 	 * TX uses "RNDIS" mode automatically but needs help
650 	 * to identify the zero-length-final-packet case.
651 	 */
652 	mode = (urb->transfer_flags & URB_ZERO_PACKET) ? 1 : 0;
653 #endif
654 
655 	qh->segsize = length;
656 
657 	if (!dma->channel_program(channel, pkt_size, mode,
658 			urb->transfer_dma + offset, length)) {
659 		dma->channel_release(channel);
660 		hw_ep->tx_channel = NULL;
661 
662 		csr = musb_readw(epio, MUSB_TXCSR);
663 		csr &= ~(MUSB_TXCSR_AUTOSET | MUSB_TXCSR_DMAENAB);
664 		musb_writew(epio, MUSB_TXCSR, csr | MUSB_TXCSR_H_WZC_BITS);
665 		return false;
666 	}
667 	return true;
668 }
669 
670 /*
671  * Program an HDRC endpoint as per the given URB
672  * Context: irqs blocked, controller lock held
673  */
674 static void musb_ep_program(struct musb *musb, u8 epnum,
675 			struct urb *urb, int is_out,
676 			u8 *buf, u32 offset, u32 len)
677 {
678 	struct dma_controller	*dma_controller;
679 	struct dma_channel	*dma_channel;
680 	u8			dma_ok;
681 	void __iomem		*mbase = musb->mregs;
682 	struct musb_hw_ep	*hw_ep = musb->endpoints + epnum;
683 	void __iomem		*epio = hw_ep->regs;
684 	struct musb_qh		*qh = musb_ep_get_qh(hw_ep, !is_out);
685 	u16			packet_sz = qh->maxpacket;
686 
687 	DBG(3, "%s hw%d urb %p spd%d dev%d ep%d%s "
688 				"h_addr%02x h_port%02x bytes %d\n",
689 			is_out ? "-->" : "<--",
690 			epnum, urb, urb->dev->speed,
691 			qh->addr_reg, qh->epnum, is_out ? "out" : "in",
692 			qh->h_addr_reg, qh->h_port_reg,
693 			len);
694 
695 	musb_ep_select(mbase, epnum);
696 
697 	/* candidate for DMA? */
698 	dma_controller = musb->dma_controller;
699 	if (is_dma_capable() && epnum && dma_controller) {
700 		dma_channel = is_out ? hw_ep->tx_channel : hw_ep->rx_channel;
701 		if (!dma_channel) {
702 			dma_channel = dma_controller->channel_alloc(
703 					dma_controller, hw_ep, is_out);
704 			if (is_out)
705 				hw_ep->tx_channel = dma_channel;
706 			else
707 				hw_ep->rx_channel = dma_channel;
708 		}
709 	} else
710 		dma_channel = NULL;
711 
712 	/* make sure we clear DMAEnab, autoSet bits from previous run */
713 
714 	/* OUT/transmit/EP0 or IN/receive? */
715 	if (is_out) {
716 		u16	csr;
717 		u16	int_txe;
718 		u16	load_count;
719 
720 		csr = musb_readw(epio, MUSB_TXCSR);
721 
722 		/* disable interrupt in case we flush */
723 		int_txe = musb_readw(mbase, MUSB_INTRTXE);
724 		musb_writew(mbase, MUSB_INTRTXE, int_txe & ~(1 << epnum));
725 
726 		/* general endpoint setup */
727 		if (epnum) {
728 			/* flush all old state, set default */
729 			musb_h_tx_flush_fifo(hw_ep);
730 
731 			/*
732 			 * We must not clear the DMAMODE bit before or in
733 			 * the same cycle with the DMAENAB bit, so we clear
734 			 * the latter first...
735 			 */
736 			csr &= ~(MUSB_TXCSR_H_NAKTIMEOUT
737 					| MUSB_TXCSR_AUTOSET
738 					| MUSB_TXCSR_DMAENAB
739 					| MUSB_TXCSR_FRCDATATOG
740 					| MUSB_TXCSR_H_RXSTALL
741 					| MUSB_TXCSR_H_ERROR
742 					| MUSB_TXCSR_TXPKTRDY
743 					);
744 			csr |= MUSB_TXCSR_MODE;
745 
746 			if (usb_gettoggle(urb->dev, qh->epnum, 1))
747 				csr |= MUSB_TXCSR_H_WR_DATATOGGLE
748 					| MUSB_TXCSR_H_DATATOGGLE;
749 			else
750 				csr |= MUSB_TXCSR_CLRDATATOG;
751 
752 			musb_writew(epio, MUSB_TXCSR, csr);
753 			/* REVISIT may need to clear FLUSHFIFO ... */
754 			csr &= ~MUSB_TXCSR_DMAMODE;
755 			musb_writew(epio, MUSB_TXCSR, csr);
756 			csr = musb_readw(epio, MUSB_TXCSR);
757 		} else {
758 			/* endpoint 0: just flush */
759 			musb_h_ep0_flush_fifo(hw_ep);
760 		}
761 
762 		/* target addr and (for multipoint) hub addr/port */
763 		if (musb->is_multipoint) {
764 			musb_write_txfunaddr(mbase, epnum, qh->addr_reg);
765 			musb_write_txhubaddr(mbase, epnum, qh->h_addr_reg);
766 			musb_write_txhubport(mbase, epnum, qh->h_port_reg);
767 /* FIXME if !epnum, do the same for RX ... */
768 		} else
769 			musb_writeb(mbase, MUSB_FADDR, qh->addr_reg);
770 
771 		/* protocol/endpoint/interval/NAKlimit */
772 		if (epnum) {
773 			musb_writeb(epio, MUSB_TXTYPE, qh->type_reg);
774 			if (can_bulk_split(musb, qh->type))
775 				musb_writew(epio, MUSB_TXMAXP,
776 					packet_sz
777 					| ((hw_ep->max_packet_sz_tx /
778 						packet_sz) - 1) << 11);
779 			else
780 				musb_writew(epio, MUSB_TXMAXP,
781 					packet_sz);
782 			musb_writeb(epio, MUSB_TXINTERVAL, qh->intv_reg);
783 		} else {
784 			musb_writeb(epio, MUSB_NAKLIMIT0, qh->intv_reg);
785 			if (musb->is_multipoint)
786 				musb_writeb(epio, MUSB_TYPE0,
787 						qh->type_reg);
788 		}
789 
790 		if (can_bulk_split(musb, qh->type))
791 			load_count = min((u32) hw_ep->max_packet_sz_tx,
792 						len);
793 		else
794 			load_count = min((u32) packet_sz, len);
795 
796 		if (dma_channel && musb_tx_dma_program(dma_controller,
797 					hw_ep, qh, urb, offset, len))
798 			load_count = 0;
799 
800 		if (load_count) {
801 			/* PIO to load FIFO */
802 			qh->segsize = load_count;
803 			musb_write_fifo(hw_ep, load_count, buf);
804 		}
805 
806 		/* re-enable interrupt */
807 		musb_writew(mbase, MUSB_INTRTXE, int_txe);
808 
809 	/* IN/receive */
810 	} else {
811 		u16	csr;
812 
813 		if (hw_ep->rx_reinit) {
814 			musb_rx_reinit(musb, qh, hw_ep);
815 
816 			/* init new state: toggle and NYET, maybe DMA later */
817 			if (usb_gettoggle(urb->dev, qh->epnum, 0))
818 				csr = MUSB_RXCSR_H_WR_DATATOGGLE
819 					| MUSB_RXCSR_H_DATATOGGLE;
820 			else
821 				csr = 0;
822 			if (qh->type == USB_ENDPOINT_XFER_INT)
823 				csr |= MUSB_RXCSR_DISNYET;
824 
825 		} else {
826 			csr = musb_readw(hw_ep->regs, MUSB_RXCSR);
827 
828 			if (csr & (MUSB_RXCSR_RXPKTRDY
829 					| MUSB_RXCSR_DMAENAB
830 					| MUSB_RXCSR_H_REQPKT))
831 				ERR("broken !rx_reinit, ep%d csr %04x\n",
832 						hw_ep->epnum, csr);
833 
834 			/* scrub any stale state, leaving toggle alone */
835 			csr &= MUSB_RXCSR_DISNYET;
836 		}
837 
838 		/* kick things off */
839 
840 		if ((is_cppi_enabled() || tusb_dma_omap()) && dma_channel) {
841 			/* candidate for DMA */
842 			if (dma_channel) {
843 				dma_channel->actual_len = 0L;
844 				qh->segsize = len;
845 
846 				/* AUTOREQ is in a DMA register */
847 				musb_writew(hw_ep->regs, MUSB_RXCSR, csr);
848 				csr = musb_readw(hw_ep->regs,
849 						MUSB_RXCSR);
850 
851 				/* unless caller treats short rx transfers as
852 				 * errors, we dare not queue multiple transfers.
853 				 */
854 				dma_ok = dma_controller->channel_program(
855 						dma_channel, packet_sz,
856 						!(urb->transfer_flags
857 							& URB_SHORT_NOT_OK),
858 						urb->transfer_dma + offset,
859 						qh->segsize);
860 				if (!dma_ok) {
861 					dma_controller->channel_release(
862 							dma_channel);
863 					hw_ep->rx_channel = NULL;
864 					dma_channel = NULL;
865 				} else
866 					csr |= MUSB_RXCSR_DMAENAB;
867 			}
868 		}
869 
870 		csr |= MUSB_RXCSR_H_REQPKT;
871 		DBG(7, "RXCSR%d := %04x\n", epnum, csr);
872 		musb_writew(hw_ep->regs, MUSB_RXCSR, csr);
873 		csr = musb_readw(hw_ep->regs, MUSB_RXCSR);
874 	}
875 }
876 
877 
878 /*
879  * Service the default endpoint (ep0) as host.
880  * Return true until it's time to start the status stage.
881  */
882 static bool musb_h_ep0_continue(struct musb *musb, u16 len, struct urb *urb)
883 {
884 	bool			 more = false;
885 	u8			*fifo_dest = NULL;
886 	u16			fifo_count = 0;
887 	struct musb_hw_ep	*hw_ep = musb->control_ep;
888 	struct musb_qh		*qh = hw_ep->in_qh;
889 	struct usb_ctrlrequest	*request;
890 
891 	switch (musb->ep0_stage) {
892 	case MUSB_EP0_IN:
893 		fifo_dest = urb->transfer_buffer + urb->actual_length;
894 		fifo_count = min_t(size_t, len, urb->transfer_buffer_length -
895 				   urb->actual_length);
896 		if (fifo_count < len)
897 			urb->status = -EOVERFLOW;
898 
899 		musb_read_fifo(hw_ep, fifo_count, fifo_dest);
900 
901 		urb->actual_length += fifo_count;
902 		if (len < qh->maxpacket) {
903 			/* always terminate on short read; it's
904 			 * rarely reported as an error.
905 			 */
906 		} else if (urb->actual_length <
907 				urb->transfer_buffer_length)
908 			more = true;
909 		break;
910 	case MUSB_EP0_START:
911 		request = (struct usb_ctrlrequest *) urb->setup_packet;
912 
913 		if (!request->wLength) {
914 			DBG(4, "start no-DATA\n");
915 			break;
916 		} else if (request->bRequestType & USB_DIR_IN) {
917 			DBG(4, "start IN-DATA\n");
918 			musb->ep0_stage = MUSB_EP0_IN;
919 			more = true;
920 			break;
921 		} else {
922 			DBG(4, "start OUT-DATA\n");
923 			musb->ep0_stage = MUSB_EP0_OUT;
924 			more = true;
925 		}
926 		/* FALLTHROUGH */
927 	case MUSB_EP0_OUT:
928 		fifo_count = min_t(size_t, qh->maxpacket,
929 				   urb->transfer_buffer_length -
930 				   urb->actual_length);
931 		if (fifo_count) {
932 			fifo_dest = (u8 *) (urb->transfer_buffer
933 					+ urb->actual_length);
934 			DBG(3, "Sending %d byte%s to ep0 fifo %p\n",
935 					fifo_count,
936 					(fifo_count == 1) ? "" : "s",
937 					fifo_dest);
938 			musb_write_fifo(hw_ep, fifo_count, fifo_dest);
939 
940 			urb->actual_length += fifo_count;
941 			more = true;
942 		}
943 		break;
944 	default:
945 		ERR("bogus ep0 stage %d\n", musb->ep0_stage);
946 		break;
947 	}
948 
949 	return more;
950 }
951 
952 /*
953  * Handle default endpoint interrupt as host. Only called in IRQ time
954  * from musb_interrupt().
955  *
956  * called with controller irqlocked
957  */
958 irqreturn_t musb_h_ep0_irq(struct musb *musb)
959 {
960 	struct urb		*urb;
961 	u16			csr, len;
962 	int			status = 0;
963 	void __iomem		*mbase = musb->mregs;
964 	struct musb_hw_ep	*hw_ep = musb->control_ep;
965 	void __iomem		*epio = hw_ep->regs;
966 	struct musb_qh		*qh = hw_ep->in_qh;
967 	bool			complete = false;
968 	irqreturn_t		retval = IRQ_NONE;
969 
970 	/* ep0 only has one queue, "in" */
971 	urb = next_urb(qh);
972 
973 	musb_ep_select(mbase, 0);
974 	csr = musb_readw(epio, MUSB_CSR0);
975 	len = (csr & MUSB_CSR0_RXPKTRDY)
976 			? musb_readb(epio, MUSB_COUNT0)
977 			: 0;
978 
979 	DBG(4, "<== csr0 %04x, qh %p, count %d, urb %p, stage %d\n",
980 		csr, qh, len, urb, musb->ep0_stage);
981 
982 	/* if we just did status stage, we are done */
983 	if (MUSB_EP0_STATUS == musb->ep0_stage) {
984 		retval = IRQ_HANDLED;
985 		complete = true;
986 	}
987 
988 	/* prepare status */
989 	if (csr & MUSB_CSR0_H_RXSTALL) {
990 		DBG(6, "STALLING ENDPOINT\n");
991 		status = -EPIPE;
992 
993 	} else if (csr & MUSB_CSR0_H_ERROR) {
994 		DBG(2, "no response, csr0 %04x\n", csr);
995 		status = -EPROTO;
996 
997 	} else if (csr & MUSB_CSR0_H_NAKTIMEOUT) {
998 		DBG(2, "control NAK timeout\n");
999 
1000 		/* NOTE:  this code path would be a good place to PAUSE a
1001 		 * control transfer, if another one is queued, so that
1002 		 * ep0 is more likely to stay busy.  That's already done
1003 		 * for bulk RX transfers.
1004 		 *
1005 		 * if (qh->ring.next != &musb->control), then
1006 		 * we have a candidate... NAKing is *NOT* an error
1007 		 */
1008 		musb_writew(epio, MUSB_CSR0, 0);
1009 		retval = IRQ_HANDLED;
1010 	}
1011 
1012 	if (status) {
1013 		DBG(6, "aborting\n");
1014 		retval = IRQ_HANDLED;
1015 		if (urb)
1016 			urb->status = status;
1017 		complete = true;
1018 
1019 		/* use the proper sequence to abort the transfer */
1020 		if (csr & MUSB_CSR0_H_REQPKT) {
1021 			csr &= ~MUSB_CSR0_H_REQPKT;
1022 			musb_writew(epio, MUSB_CSR0, csr);
1023 			csr &= ~MUSB_CSR0_H_NAKTIMEOUT;
1024 			musb_writew(epio, MUSB_CSR0, csr);
1025 		} else {
1026 			musb_h_ep0_flush_fifo(hw_ep);
1027 		}
1028 
1029 		musb_writeb(epio, MUSB_NAKLIMIT0, 0);
1030 
1031 		/* clear it */
1032 		musb_writew(epio, MUSB_CSR0, 0);
1033 	}
1034 
1035 	if (unlikely(!urb)) {
1036 		/* stop endpoint since we have no place for its data, this
1037 		 * SHOULD NEVER HAPPEN! */
1038 		ERR("no URB for end 0\n");
1039 
1040 		musb_h_ep0_flush_fifo(hw_ep);
1041 		goto done;
1042 	}
1043 
1044 	if (!complete) {
1045 		/* call common logic and prepare response */
1046 		if (musb_h_ep0_continue(musb, len, urb)) {
1047 			/* more packets required */
1048 			csr = (MUSB_EP0_IN == musb->ep0_stage)
1049 				?  MUSB_CSR0_H_REQPKT : MUSB_CSR0_TXPKTRDY;
1050 		} else {
1051 			/* data transfer complete; perform status phase */
1052 			if (usb_pipeout(urb->pipe)
1053 					|| !urb->transfer_buffer_length)
1054 				csr = MUSB_CSR0_H_STATUSPKT
1055 					| MUSB_CSR0_H_REQPKT;
1056 			else
1057 				csr = MUSB_CSR0_H_STATUSPKT
1058 					| MUSB_CSR0_TXPKTRDY;
1059 
1060 			/* flag status stage */
1061 			musb->ep0_stage = MUSB_EP0_STATUS;
1062 
1063 			DBG(5, "ep0 STATUS, csr %04x\n", csr);
1064 
1065 		}
1066 		musb_writew(epio, MUSB_CSR0, csr);
1067 		retval = IRQ_HANDLED;
1068 	} else
1069 		musb->ep0_stage = MUSB_EP0_IDLE;
1070 
1071 	/* call completion handler if done */
1072 	if (complete)
1073 		musb_advance_schedule(musb, urb, hw_ep, 1);
1074 done:
1075 	return retval;
1076 }
1077 
1078 
1079 #ifdef CONFIG_USB_INVENTRA_DMA
1080 
1081 /* Host side TX (OUT) using Mentor DMA works as follows:
1082 	submit_urb ->
1083 		- if queue was empty, Program Endpoint
1084 		- ... which starts DMA to fifo in mode 1 or 0
1085 
1086 	DMA Isr (transfer complete) -> TxAvail()
1087 		- Stop DMA (~DmaEnab)	(<--- Alert ... currently happens
1088 					only in musb_cleanup_urb)
1089 		- TxPktRdy has to be set in mode 0 or for
1090 			short packets in mode 1.
1091 */
1092 
1093 #endif
1094 
1095 /* Service a Tx-Available or dma completion irq for the endpoint */
1096 void musb_host_tx(struct musb *musb, u8 epnum)
1097 {
1098 	int			pipe;
1099 	bool			done = false;
1100 	u16			tx_csr;
1101 	size_t			length = 0;
1102 	size_t			offset = 0;
1103 	struct musb_hw_ep	*hw_ep = musb->endpoints + epnum;
1104 	void __iomem		*epio = hw_ep->regs;
1105 	struct musb_qh		*qh = hw_ep->out_qh;
1106 	struct urb		*urb = next_urb(qh);
1107 	u32			status = 0;
1108 	void __iomem		*mbase = musb->mregs;
1109 	struct dma_channel	*dma;
1110 
1111 	musb_ep_select(mbase, epnum);
1112 	tx_csr = musb_readw(epio, MUSB_TXCSR);
1113 
1114 	/* with CPPI, DMA sometimes triggers "extra" irqs */
1115 	if (!urb) {
1116 		DBG(4, "extra TX%d ready, csr %04x\n", epnum, tx_csr);
1117 		return;
1118 	}
1119 
1120 	pipe = urb->pipe;
1121 	dma = is_dma_capable() ? hw_ep->tx_channel : NULL;
1122 	DBG(4, "OUT/TX%d end, csr %04x%s\n", epnum, tx_csr,
1123 			dma ? ", dma" : "");
1124 
1125 	/* check for errors */
1126 	if (tx_csr & MUSB_TXCSR_H_RXSTALL) {
1127 		/* dma was disabled, fifo flushed */
1128 		DBG(3, "TX end %d stall\n", epnum);
1129 
1130 		/* stall; record URB status */
1131 		status = -EPIPE;
1132 
1133 	} else if (tx_csr & MUSB_TXCSR_H_ERROR) {
1134 		/* (NON-ISO) dma was disabled, fifo flushed */
1135 		DBG(3, "TX 3strikes on ep=%d\n", epnum);
1136 
1137 		status = -ETIMEDOUT;
1138 
1139 	} else if (tx_csr & MUSB_TXCSR_H_NAKTIMEOUT) {
1140 		DBG(6, "TX end=%d device not responding\n", epnum);
1141 
1142 		/* NOTE:  this code path would be a good place to PAUSE a
1143 		 * transfer, if there's some other (nonperiodic) tx urb
1144 		 * that could use this fifo.  (dma complicates it...)
1145 		 * That's already done for bulk RX transfers.
1146 		 *
1147 		 * if (bulk && qh->ring.next != &musb->out_bulk), then
1148 		 * we have a candidate... NAKing is *NOT* an error
1149 		 */
1150 		musb_ep_select(mbase, epnum);
1151 		musb_writew(epio, MUSB_TXCSR,
1152 				MUSB_TXCSR_H_WZC_BITS
1153 				| MUSB_TXCSR_TXPKTRDY);
1154 		return;
1155 	}
1156 
1157 	if (status) {
1158 		if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
1159 			dma->status = MUSB_DMA_STATUS_CORE_ABORT;
1160 			(void) musb->dma_controller->channel_abort(dma);
1161 		}
1162 
1163 		/* do the proper sequence to abort the transfer in the
1164 		 * usb core; the dma engine should already be stopped.
1165 		 */
1166 		musb_h_tx_flush_fifo(hw_ep);
1167 		tx_csr &= ~(MUSB_TXCSR_AUTOSET
1168 				| MUSB_TXCSR_DMAENAB
1169 				| MUSB_TXCSR_H_ERROR
1170 				| MUSB_TXCSR_H_RXSTALL
1171 				| MUSB_TXCSR_H_NAKTIMEOUT
1172 				);
1173 
1174 		musb_ep_select(mbase, epnum);
1175 		musb_writew(epio, MUSB_TXCSR, tx_csr);
1176 		/* REVISIT may need to clear FLUSHFIFO ... */
1177 		musb_writew(epio, MUSB_TXCSR, tx_csr);
1178 		musb_writeb(epio, MUSB_TXINTERVAL, 0);
1179 
1180 		done = true;
1181 	}
1182 
1183 	/* second cppi case */
1184 	if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
1185 		DBG(4, "extra TX%d ready, csr %04x\n", epnum, tx_csr);
1186 		return;
1187 	}
1188 
1189 	if (is_dma_capable() && dma && !status) {
1190 		/*
1191 		 * DMA has completed.  But if we're using DMA mode 1 (multi
1192 		 * packet DMA), we need a terminal TXPKTRDY interrupt before
1193 		 * we can consider this transfer completed, lest we trash
1194 		 * its last packet when writing the next URB's data.  So we
1195 		 * switch back to mode 0 to get that interrupt; we'll come
1196 		 * back here once it happens.
1197 		 */
1198 		if (tx_csr & MUSB_TXCSR_DMAMODE) {
1199 			/*
1200 			 * We shouldn't clear DMAMODE with DMAENAB set; so
1201 			 * clear them in a safe order.  That should be OK
1202 			 * once TXPKTRDY has been set (and I've never seen
1203 			 * it being 0 at this moment -- DMA interrupt latency
1204 			 * is significant) but if it hasn't been then we have
1205 			 * no choice but to stop being polite and ignore the
1206 			 * programmer's guide... :-)
1207 			 *
1208 			 * Note that we must write TXCSR with TXPKTRDY cleared
1209 			 * in order not to re-trigger the packet send (this bit
1210 			 * can't be cleared by CPU), and there's another caveat:
1211 			 * TXPKTRDY may be set shortly and then cleared in the
1212 			 * double-buffered FIFO mode, so we do an extra TXCSR
1213 			 * read for debouncing...
1214 			 */
1215 			tx_csr &= musb_readw(epio, MUSB_TXCSR);
1216 			if (tx_csr & MUSB_TXCSR_TXPKTRDY) {
1217 				tx_csr &= ~(MUSB_TXCSR_DMAENAB |
1218 					    MUSB_TXCSR_TXPKTRDY);
1219 				musb_writew(epio, MUSB_TXCSR,
1220 					    tx_csr | MUSB_TXCSR_H_WZC_BITS);
1221 			}
1222 			tx_csr &= ~(MUSB_TXCSR_DMAMODE |
1223 				    MUSB_TXCSR_TXPKTRDY);
1224 			musb_writew(epio, MUSB_TXCSR,
1225 				    tx_csr | MUSB_TXCSR_H_WZC_BITS);
1226 
1227 			/*
1228 			 * There is no guarantee that we'll get an interrupt
1229 			 * after clearing DMAMODE as we might have done this
1230 			 * too late (after TXPKTRDY was cleared by controller).
1231 			 * Re-read TXCSR as we have spoiled its previous value.
1232 			 */
1233 			tx_csr = musb_readw(epio, MUSB_TXCSR);
1234 		}
1235 
1236 		/*
1237 		 * We may get here from a DMA completion or TXPKTRDY interrupt.
1238 		 * In any case, we must check the FIFO status here and bail out
1239 		 * only if the FIFO still has data -- that should prevent the
1240 		 * "missed" TXPKTRDY interrupts and deal with double-buffered
1241 		 * FIFO mode too...
1242 		 */
1243 		if (tx_csr & (MUSB_TXCSR_FIFONOTEMPTY | MUSB_TXCSR_TXPKTRDY)) {
1244 			DBG(2, "DMA complete but packet still in FIFO, "
1245 			    "CSR %04x\n", tx_csr);
1246 			return;
1247 		}
1248 	}
1249 
1250 	if (!status || dma || usb_pipeisoc(pipe)) {
1251 		if (dma)
1252 			length = dma->actual_len;
1253 		else
1254 			length = qh->segsize;
1255 		qh->offset += length;
1256 
1257 		if (usb_pipeisoc(pipe)) {
1258 			struct usb_iso_packet_descriptor	*d;
1259 
1260 			d = urb->iso_frame_desc + qh->iso_idx;
1261 			d->actual_length = length;
1262 			d->status = status;
1263 			if (++qh->iso_idx >= urb->number_of_packets) {
1264 				done = true;
1265 			} else {
1266 				d++;
1267 				offset = d->offset;
1268 				length = d->length;
1269 			}
1270 		} else if (dma) {
1271 			done = true;
1272 		} else {
1273 			/* see if we need to send more data, or ZLP */
1274 			if (qh->segsize < qh->maxpacket)
1275 				done = true;
1276 			else if (qh->offset == urb->transfer_buffer_length
1277 					&& !(urb->transfer_flags
1278 						& URB_ZERO_PACKET))
1279 				done = true;
1280 			if (!done) {
1281 				offset = qh->offset;
1282 				length = urb->transfer_buffer_length - offset;
1283 			}
1284 		}
1285 	}
1286 
1287 	/* urb->status != -EINPROGRESS means request has been faulted,
1288 	 * so we must abort this transfer after cleanup
1289 	 */
1290 	if (urb->status != -EINPROGRESS) {
1291 		done = true;
1292 		if (status == 0)
1293 			status = urb->status;
1294 	}
1295 
1296 	if (done) {
1297 		/* set status */
1298 		urb->status = status;
1299 		urb->actual_length = qh->offset;
1300 		musb_advance_schedule(musb, urb, hw_ep, USB_DIR_OUT);
1301 		return;
1302 	} else	if (usb_pipeisoc(pipe) && dma) {
1303 		if (musb_tx_dma_program(musb->dma_controller, hw_ep, qh, urb,
1304 				offset, length)) {
1305 			if (is_cppi_enabled() || tusb_dma_omap())
1306 				musb_h_tx_dma_start(hw_ep);
1307 			return;
1308 		}
1309 	} else	if (tx_csr & MUSB_TXCSR_DMAENAB) {
1310 		DBG(1, "not complete, but DMA enabled?\n");
1311 		return;
1312 	}
1313 
1314 	/*
1315 	 * PIO: start next packet in this URB.
1316 	 *
1317 	 * REVISIT: some docs say that when hw_ep->tx_double_buffered,
1318 	 * (and presumably, FIFO is not half-full) we should write *two*
1319 	 * packets before updating TXCSR; other docs disagree...
1320 	 */
1321 	if (length > qh->maxpacket)
1322 		length = qh->maxpacket;
1323 	musb_write_fifo(hw_ep, length, urb->transfer_buffer + offset);
1324 	qh->segsize = length;
1325 
1326 	musb_ep_select(mbase, epnum);
1327 	musb_writew(epio, MUSB_TXCSR,
1328 			MUSB_TXCSR_H_WZC_BITS | MUSB_TXCSR_TXPKTRDY);
1329 }
1330 
1331 
1332 #ifdef CONFIG_USB_INVENTRA_DMA
1333 
1334 /* Host side RX (IN) using Mentor DMA works as follows:
1335 	submit_urb ->
1336 		- if queue was empty, ProgramEndpoint
1337 		- first IN token is sent out (by setting ReqPkt)
1338 	LinuxIsr -> RxReady()
1339 	/\	=> first packet is received
1340 	|	- Set in mode 0 (DmaEnab, ~ReqPkt)
1341 	|		-> DMA Isr (transfer complete) -> RxReady()
1342 	|		    - Ack receive (~RxPktRdy), turn off DMA (~DmaEnab)
1343 	|		    - if urb not complete, send next IN token (ReqPkt)
1344 	|			   |		else complete urb.
1345 	|			   |
1346 	---------------------------
1347  *
1348  * Nuances of mode 1:
1349  *	For short packets, no ack (+RxPktRdy) is sent automatically
1350  *	(even if AutoClear is ON)
1351  *	For full packets, ack (~RxPktRdy) and next IN token (+ReqPkt) is sent
1352  *	automatically => major problem, as collecting the next packet becomes
1353  *	difficult. Hence mode 1 is not used.
1354  *
1355  * REVISIT
1356  *	All we care about at this driver level is that
1357  *       (a) all URBs terminate with REQPKT cleared and fifo(s) empty;
1358  *       (b) termination conditions are: short RX, or buffer full;
1359  *       (c) fault modes include
1360  *           - iff URB_SHORT_NOT_OK, short RX status is -EREMOTEIO.
1361  *             (and that endpoint's dma queue stops immediately)
1362  *           - overflow (full, PLUS more bytes in the terminal packet)
1363  *
1364  *	So for example, usb-storage sets URB_SHORT_NOT_OK, and would
1365  *	thus be a great candidate for using mode 1 ... for all but the
1366  *	last packet of one URB's transfer.
1367  */
1368 
1369 #endif
1370 
1371 /* Schedule next QH from musb->in_bulk and move the current qh to
1372  * the end; avoids starvation for other endpoints.
1373  */
1374 static void musb_bulk_rx_nak_timeout(struct musb *musb, struct musb_hw_ep *ep)
1375 {
1376 	struct dma_channel	*dma;
1377 	struct urb		*urb;
1378 	void __iomem		*mbase = musb->mregs;
1379 	void __iomem		*epio = ep->regs;
1380 	struct musb_qh		*cur_qh, *next_qh;
1381 	u16			rx_csr;
1382 
1383 	musb_ep_select(mbase, ep->epnum);
1384 	dma = is_dma_capable() ? ep->rx_channel : NULL;
1385 
1386 	/* clear nak timeout bit */
1387 	rx_csr = musb_readw(epio, MUSB_RXCSR);
1388 	rx_csr |= MUSB_RXCSR_H_WZC_BITS;
1389 	rx_csr &= ~MUSB_RXCSR_DATAERROR;
1390 	musb_writew(epio, MUSB_RXCSR, rx_csr);
1391 
1392 	cur_qh = first_qh(&musb->in_bulk);
1393 	if (cur_qh) {
1394 		urb = next_urb(cur_qh);
1395 		if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
1396 			dma->status = MUSB_DMA_STATUS_CORE_ABORT;
1397 			musb->dma_controller->channel_abort(dma);
1398 			urb->actual_length += dma->actual_len;
1399 			dma->actual_len = 0L;
1400 		}
1401 		musb_save_toggle(cur_qh, 1, urb);
1402 
1403 		/* move cur_qh to end of queue */
1404 		list_move_tail(&cur_qh->ring, &musb->in_bulk);
1405 
1406 		/* get the next qh from musb->in_bulk */
1407 		next_qh = first_qh(&musb->in_bulk);
1408 
1409 		/* set rx_reinit and schedule the next qh */
1410 		ep->rx_reinit = 1;
1411 		musb_start_urb(musb, 1, next_qh);
1412 	}
1413 }
1414 
1415 /*
1416  * Service an RX interrupt for the given IN endpoint; docs cover bulk, iso,
1417  * and high-bandwidth IN transfer cases.
1418  */
1419 void musb_host_rx(struct musb *musb, u8 epnum)
1420 {
1421 	struct urb		*urb;
1422 	struct musb_hw_ep	*hw_ep = musb->endpoints + epnum;
1423 	void __iomem		*epio = hw_ep->regs;
1424 	struct musb_qh		*qh = hw_ep->in_qh;
1425 	size_t			xfer_len;
1426 	void __iomem		*mbase = musb->mregs;
1427 	int			pipe;
1428 	u16			rx_csr, val;
1429 	bool			iso_err = false;
1430 	bool			done = false;
1431 	u32			status;
1432 	struct dma_channel	*dma;
1433 
1434 	musb_ep_select(mbase, epnum);
1435 
1436 	urb = next_urb(qh);
1437 	dma = is_dma_capable() ? hw_ep->rx_channel : NULL;
1438 	status = 0;
1439 	xfer_len = 0;
1440 
1441 	rx_csr = musb_readw(epio, MUSB_RXCSR);
1442 	val = rx_csr;
1443 
1444 	if (unlikely(!urb)) {
1445 		/* REVISIT -- THIS SHOULD NEVER HAPPEN ... but, at least
1446 		 * usbtest #11 (unlinks) triggers it regularly, sometimes
1447 		 * with fifo full.  (Only with DMA??)
1448 		 */
1449 		DBG(3, "BOGUS RX%d ready, csr %04x, count %d\n", epnum, val,
1450 			musb_readw(epio, MUSB_RXCOUNT));
1451 		musb_h_flush_rxfifo(hw_ep, MUSB_RXCSR_CLRDATATOG);
1452 		return;
1453 	}
1454 
1455 	pipe = urb->pipe;
1456 
1457 	DBG(5, "<== hw %d rxcsr %04x, urb actual %d (+dma %zu)\n",
1458 		epnum, rx_csr, urb->actual_length,
1459 		dma ? dma->actual_len : 0);
1460 
1461 	/* check for errors, concurrent stall & unlink is not really
1462 	 * handled yet! */
1463 	if (rx_csr & MUSB_RXCSR_H_RXSTALL) {
1464 		DBG(3, "RX end %d STALL\n", epnum);
1465 
1466 		/* stall; record URB status */
1467 		status = -EPIPE;
1468 
1469 	} else if (rx_csr & MUSB_RXCSR_H_ERROR) {
1470 		DBG(3, "end %d RX proto error\n", epnum);
1471 
1472 		status = -EPROTO;
1473 		musb_writeb(epio, MUSB_RXINTERVAL, 0);
1474 
1475 	} else if (rx_csr & MUSB_RXCSR_DATAERROR) {
1476 
1477 		if (USB_ENDPOINT_XFER_ISOC != qh->type) {
1478 			DBG(6, "RX end %d NAK timeout\n", epnum);
1479 
1480 			/* NOTE: NAKing is *NOT* an error, so we want to
1481 			 * continue.  Except ... if there's a request for
1482 			 * another QH, use that instead of starving it.
1483 			 *
1484 			 * Devices like Ethernet and serial adapters keep
1485 			 * reads posted at all times, which will starve
1486 			 * other devices without this logic.
1487 			 */
1488 			if (usb_pipebulk(urb->pipe)
1489 					&& qh->mux == 1
1490 					&& !list_is_singular(&musb->in_bulk)) {
1491 				musb_bulk_rx_nak_timeout(musb, hw_ep);
1492 				return;
1493 			}
1494 			musb_ep_select(mbase, epnum);
1495 			rx_csr |= MUSB_RXCSR_H_WZC_BITS;
1496 			rx_csr &= ~MUSB_RXCSR_DATAERROR;
1497 			musb_writew(epio, MUSB_RXCSR, rx_csr);
1498 
1499 			goto finish;
1500 		} else {
1501 			DBG(4, "RX end %d ISO data error\n", epnum);
1502 			/* packet error reported later */
1503 			iso_err = true;
1504 		}
1505 	} else if (rx_csr & MUSB_RXCSR_INCOMPRX) {
1506 		DBG(3, "end %d high bandwidth incomplete ISO packet RX\n",
1507 				epnum);
1508 		status = -EPROTO;
1509 	}
1510 
1511 	/* faults abort the transfer */
1512 	if (status) {
1513 		/* clean up dma and collect transfer count */
1514 		if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
1515 			dma->status = MUSB_DMA_STATUS_CORE_ABORT;
1516 			(void) musb->dma_controller->channel_abort(dma);
1517 			xfer_len = dma->actual_len;
1518 		}
1519 		musb_h_flush_rxfifo(hw_ep, MUSB_RXCSR_CLRDATATOG);
1520 		musb_writeb(epio, MUSB_RXINTERVAL, 0);
1521 		done = true;
1522 		goto finish;
1523 	}
1524 
1525 	if (unlikely(dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY)) {
1526 		/* SHOULD NEVER HAPPEN ... but at least DaVinci has done it */
1527 		ERR("RX%d dma busy, csr %04x\n", epnum, rx_csr);
1528 		goto finish;
1529 	}
1530 
1531 	/* thorough shutdown for now ... given more precise fault handling
1532 	 * and better queueing support, we might keep a DMA pipeline going
1533 	 * while processing this irq for earlier completions.
1534 	 */
1535 
1536 	/* FIXME this is _way_ too much in-line logic for Mentor DMA */
1537 
1538 #ifndef CONFIG_USB_INVENTRA_DMA
1539 	if (rx_csr & MUSB_RXCSR_H_REQPKT)  {
1540 		/* REVISIT this happened for a while on some short reads...
1541 		 * the cleanup still needs investigation... looks bad...
1542 		 * and also duplicates dma cleanup code above ... plus,
1543 		 * shouldn't this be the "half full" double buffer case?
1544 		 */
1545 		if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
1546 			dma->status = MUSB_DMA_STATUS_CORE_ABORT;
1547 			(void) musb->dma_controller->channel_abort(dma);
1548 			xfer_len = dma->actual_len;
1549 			done = true;
1550 		}
1551 
1552 		DBG(2, "RXCSR%d %04x, reqpkt, len %zu%s\n", epnum, rx_csr,
1553 				xfer_len, dma ? ", dma" : "");
1554 		rx_csr &= ~MUSB_RXCSR_H_REQPKT;
1555 
1556 		musb_ep_select(mbase, epnum);
1557 		musb_writew(epio, MUSB_RXCSR,
1558 				MUSB_RXCSR_H_WZC_BITS | rx_csr);
1559 	}
1560 #endif
1561 	if (dma && (rx_csr & MUSB_RXCSR_DMAENAB)) {
1562 		xfer_len = dma->actual_len;
1563 
1564 		val &= ~(MUSB_RXCSR_DMAENAB
1565 			| MUSB_RXCSR_H_AUTOREQ
1566 			| MUSB_RXCSR_AUTOCLEAR
1567 			| MUSB_RXCSR_RXPKTRDY);
1568 		musb_writew(hw_ep->regs, MUSB_RXCSR, val);
1569 
1570 #ifdef CONFIG_USB_INVENTRA_DMA
1571 		if (usb_pipeisoc(pipe)) {
1572 			struct usb_iso_packet_descriptor *d;
1573 
1574 			d = urb->iso_frame_desc + qh->iso_idx;
1575 			d->actual_length = xfer_len;
1576 
1577 			/* even if there was an error, we did the dma
1578 			 * for iso_frame_desc->length
1579 			 */
1580 			if (d->status != EILSEQ && d->status != -EOVERFLOW)
1581 				d->status = 0;
1582 
1583 			if (++qh->iso_idx >= urb->number_of_packets)
1584 				done = true;
1585 			else
1586 				done = false;
1587 
1588 		} else  {
1589 		/* done if urb buffer is full or short packet is recd */
1590 		done = (urb->actual_length + xfer_len >=
1591 				urb->transfer_buffer_length
1592 			|| dma->actual_len < qh->maxpacket);
1593 		}
1594 
1595 		/* send IN token for next packet, without AUTOREQ */
1596 		if (!done) {
1597 			val |= MUSB_RXCSR_H_REQPKT;
1598 			musb_writew(epio, MUSB_RXCSR,
1599 				MUSB_RXCSR_H_WZC_BITS | val);
1600 		}
1601 
1602 		DBG(4, "ep %d dma %s, rxcsr %04x, rxcount %d\n", epnum,
1603 			done ? "off" : "reset",
1604 			musb_readw(epio, MUSB_RXCSR),
1605 			musb_readw(epio, MUSB_RXCOUNT));
1606 #else
1607 		done = true;
1608 #endif
1609 	} else if (urb->status == -EINPROGRESS) {
1610 		/* if no errors, be sure a packet is ready for unloading */
1611 		if (unlikely(!(rx_csr & MUSB_RXCSR_RXPKTRDY))) {
1612 			status = -EPROTO;
1613 			ERR("Rx interrupt with no errors or packet!\n");
1614 
1615 			/* FIXME this is another "SHOULD NEVER HAPPEN" */
1616 
1617 /* SCRUB (RX) */
1618 			/* do the proper sequence to abort the transfer */
1619 			musb_ep_select(mbase, epnum);
1620 			val &= ~MUSB_RXCSR_H_REQPKT;
1621 			musb_writew(epio, MUSB_RXCSR, val);
1622 			goto finish;
1623 		}
1624 
1625 		/* we are expecting IN packets */
1626 #ifdef CONFIG_USB_INVENTRA_DMA
1627 		if (dma) {
1628 			struct dma_controller	*c;
1629 			u16			rx_count;
1630 			int			ret, length;
1631 			dma_addr_t		buf;
1632 
1633 			rx_count = musb_readw(epio, MUSB_RXCOUNT);
1634 
1635 			DBG(2, "RX%d count %d, buffer 0x%x len %d/%d\n",
1636 					epnum, rx_count,
1637 					urb->transfer_dma
1638 						+ urb->actual_length,
1639 					qh->offset,
1640 					urb->transfer_buffer_length);
1641 
1642 			c = musb->dma_controller;
1643 
1644 			if (usb_pipeisoc(pipe)) {
1645 				int d_status = 0;
1646 				struct usb_iso_packet_descriptor *d;
1647 
1648 				d = urb->iso_frame_desc + qh->iso_idx;
1649 
1650 				if (iso_err) {
1651 					d_status = -EILSEQ;
1652 					urb->error_count++;
1653 				}
1654 				if (rx_count > d->length) {
1655 					if (d_status == 0) {
1656 						d_status = -EOVERFLOW;
1657 						urb->error_count++;
1658 					}
1659 					DBG(2, "** OVERFLOW %d into %d\n",\
1660 					    rx_count, d->length);
1661 
1662 					length = d->length;
1663 				} else
1664 					length = rx_count;
1665 				d->status = d_status;
1666 				buf = urb->transfer_dma + d->offset;
1667 			} else {
1668 				length = rx_count;
1669 				buf = urb->transfer_dma +
1670 						urb->actual_length;
1671 			}
1672 
1673 			dma->desired_mode = 0;
1674 #ifdef USE_MODE1
1675 			/* because of the issue below, mode 1 will
1676 			 * only rarely behave with correct semantics.
1677 			 */
1678 			if ((urb->transfer_flags &
1679 						URB_SHORT_NOT_OK)
1680 				&& (urb->transfer_buffer_length -
1681 						urb->actual_length)
1682 					> qh->maxpacket)
1683 				dma->desired_mode = 1;
1684 			if (rx_count < hw_ep->max_packet_sz_rx) {
1685 				length = rx_count;
1686 				dma->bDesiredMode = 0;
1687 			} else {
1688 				length = urb->transfer_buffer_length;
1689 			}
1690 #endif
1691 
1692 /* Disadvantage of using mode 1:
1693  *	It's basically usable only for mass storage class; essentially all
1694  *	other protocols also terminate transfers on short packets.
1695  *
1696  * Details:
1697  *	An extra IN token is sent at the end of the transfer (due to AUTOREQ)
1698  *	If you try to use mode 1 for (transfer_buffer_length - 512), and try
1699  *	to use the extra IN token to grab the last packet using mode 0, then
1700  *	the problem is that you cannot be sure when the device will send the
1701  *	last packet and RxPktRdy set. Sometimes the packet is recd too soon
1702  *	such that it gets lost when RxCSR is re-set at the end of the mode 1
1703  *	transfer, while sometimes it is recd just a little late so that if you
1704  *	try to configure for mode 0 soon after the mode 1 transfer is
1705  *	completed, you will find rxcount 0. Okay, so you might think why not
1706  *	wait for an interrupt when the pkt is recd. Well, you won't get any!
1707  */
1708 
1709 			val = musb_readw(epio, MUSB_RXCSR);
1710 			val &= ~MUSB_RXCSR_H_REQPKT;
1711 
1712 			if (dma->desired_mode == 0)
1713 				val &= ~MUSB_RXCSR_H_AUTOREQ;
1714 			else
1715 				val |= MUSB_RXCSR_H_AUTOREQ;
1716 			val |= MUSB_RXCSR_DMAENAB;
1717 
1718 			/* autoclear shouldn't be set in high bandwidth */
1719 			if (qh->hb_mult == 1)
1720 				val |= MUSB_RXCSR_AUTOCLEAR;
1721 
1722 			musb_writew(epio, MUSB_RXCSR,
1723 				MUSB_RXCSR_H_WZC_BITS | val);
1724 
1725 			/* REVISIT if when actual_length != 0,
1726 			 * transfer_buffer_length needs to be
1727 			 * adjusted first...
1728 			 */
1729 			ret = c->channel_program(
1730 				dma, qh->maxpacket,
1731 				dma->desired_mode, buf, length);
1732 
1733 			if (!ret) {
1734 				c->channel_release(dma);
1735 				hw_ep->rx_channel = NULL;
1736 				dma = NULL;
1737 				/* REVISIT reset CSR */
1738 			}
1739 		}
1740 #endif	/* Mentor DMA */
1741 
1742 		if (!dma) {
1743 			done = musb_host_packet_rx(musb, urb,
1744 					epnum, iso_err);
1745 			DBG(6, "read %spacket\n", done ? "last " : "");
1746 		}
1747 	}
1748 
1749 finish:
1750 	urb->actual_length += xfer_len;
1751 	qh->offset += xfer_len;
1752 	if (done) {
1753 		if (urb->status == -EINPROGRESS)
1754 			urb->status = status;
1755 		musb_advance_schedule(musb, urb, hw_ep, USB_DIR_IN);
1756 	}
1757 }
1758 
1759 /* schedule nodes correspond to peripheral endpoints, like an OHCI QH.
1760  * the software schedule associates multiple such nodes with a given
1761  * host side hardware endpoint + direction; scheduling may activate
1762  * that hardware endpoint.
1763  */
1764 static int musb_schedule(
1765 	struct musb		*musb,
1766 	struct musb_qh		*qh,
1767 	int			is_in)
1768 {
1769 	int			idle;
1770 	int			best_diff;
1771 	int			best_end, epnum;
1772 	struct musb_hw_ep	*hw_ep = NULL;
1773 	struct list_head	*head = NULL;
1774 
1775 	/* use fixed hardware for control and bulk */
1776 	if (qh->type == USB_ENDPOINT_XFER_CONTROL) {
1777 		head = &musb->control;
1778 		hw_ep = musb->control_ep;
1779 		goto success;
1780 	}
1781 
1782 	/* else, periodic transfers get muxed to other endpoints */
1783 
1784 	/*
1785 	 * We know this qh hasn't been scheduled, so all we need to do
1786 	 * is choose which hardware endpoint to put it on ...
1787 	 *
1788 	 * REVISIT what we really want here is a regular schedule tree
1789 	 * like e.g. OHCI uses.
1790 	 */
1791 	best_diff = 4096;
1792 	best_end = -1;
1793 
1794 	for (epnum = 1, hw_ep = musb->endpoints + 1;
1795 			epnum < musb->nr_endpoints;
1796 			epnum++, hw_ep++) {
1797 		int	diff;
1798 
1799 		if (musb_ep_get_qh(hw_ep, is_in) != NULL)
1800 			continue;
1801 
1802 		if (hw_ep == musb->bulk_ep)
1803 			continue;
1804 
1805 		if (is_in)
1806 			diff = hw_ep->max_packet_sz_rx;
1807 		else
1808 			diff = hw_ep->max_packet_sz_tx;
1809 		diff -= (qh->maxpacket * qh->hb_mult);
1810 
1811 		if (diff >= 0 && best_diff > diff) {
1812 			best_diff = diff;
1813 			best_end = epnum;
1814 		}
1815 	}
1816 	/* use bulk reserved ep1 if no other ep is free */
1817 	if (best_end < 0 && qh->type == USB_ENDPOINT_XFER_BULK) {
1818 		hw_ep = musb->bulk_ep;
1819 		if (is_in)
1820 			head = &musb->in_bulk;
1821 		else
1822 			head = &musb->out_bulk;
1823 
1824 		/* Enable bulk RX NAK timeout scheme when bulk requests are
1825 		 * multiplexed.  This scheme doen't work in high speed to full
1826 		 * speed scenario as NAK interrupts are not coming from a
1827 		 * full speed device connected to a high speed device.
1828 		 * NAK timeout interval is 8 (128 uframe or 16ms) for HS and
1829 		 * 4 (8 frame or 8ms) for FS device.
1830 		 */
1831 		if (is_in && qh->dev)
1832 			qh->intv_reg =
1833 				(USB_SPEED_HIGH == qh->dev->speed) ? 8 : 4;
1834 		goto success;
1835 	} else if (best_end < 0) {
1836 		return -ENOSPC;
1837 	}
1838 
1839 	idle = 1;
1840 	qh->mux = 0;
1841 	hw_ep = musb->endpoints + best_end;
1842 	DBG(4, "qh %p periodic slot %d\n", qh, best_end);
1843 success:
1844 	if (head) {
1845 		idle = list_empty(head);
1846 		list_add_tail(&qh->ring, head);
1847 		qh->mux = 1;
1848 	}
1849 	qh->hw_ep = hw_ep;
1850 	qh->hep->hcpriv = qh;
1851 	if (idle)
1852 		musb_start_urb(musb, is_in, qh);
1853 	return 0;
1854 }
1855 
1856 static int musb_urb_enqueue(
1857 	struct usb_hcd			*hcd,
1858 	struct urb			*urb,
1859 	gfp_t				mem_flags)
1860 {
1861 	unsigned long			flags;
1862 	struct musb			*musb = hcd_to_musb(hcd);
1863 	struct usb_host_endpoint	*hep = urb->ep;
1864 	struct musb_qh			*qh;
1865 	struct usb_endpoint_descriptor	*epd = &hep->desc;
1866 	int				ret;
1867 	unsigned			type_reg;
1868 	unsigned			interval;
1869 
1870 	/* host role must be active */
1871 	if (!is_host_active(musb) || !musb->is_active)
1872 		return -ENODEV;
1873 
1874 	spin_lock_irqsave(&musb->lock, flags);
1875 	ret = usb_hcd_link_urb_to_ep(hcd, urb);
1876 	qh = ret ? NULL : hep->hcpriv;
1877 	if (qh)
1878 		urb->hcpriv = qh;
1879 	spin_unlock_irqrestore(&musb->lock, flags);
1880 
1881 	/* DMA mapping was already done, if needed, and this urb is on
1882 	 * hep->urb_list now ... so we're done, unless hep wasn't yet
1883 	 * scheduled onto a live qh.
1884 	 *
1885 	 * REVISIT best to keep hep->hcpriv valid until the endpoint gets
1886 	 * disabled, testing for empty qh->ring and avoiding qh setup costs
1887 	 * except for the first urb queued after a config change.
1888 	 */
1889 	if (qh || ret)
1890 		return ret;
1891 
1892 	/* Allocate and initialize qh, minimizing the work done each time
1893 	 * hw_ep gets reprogrammed, or with irqs blocked.  Then schedule it.
1894 	 *
1895 	 * REVISIT consider a dedicated qh kmem_cache, so it's harder
1896 	 * for bugs in other kernel code to break this driver...
1897 	 */
1898 	qh = kzalloc(sizeof *qh, mem_flags);
1899 	if (!qh) {
1900 		spin_lock_irqsave(&musb->lock, flags);
1901 		usb_hcd_unlink_urb_from_ep(hcd, urb);
1902 		spin_unlock_irqrestore(&musb->lock, flags);
1903 		return -ENOMEM;
1904 	}
1905 
1906 	qh->hep = hep;
1907 	qh->dev = urb->dev;
1908 	INIT_LIST_HEAD(&qh->ring);
1909 	qh->is_ready = 1;
1910 
1911 	qh->maxpacket = le16_to_cpu(epd->wMaxPacketSize);
1912 	qh->type = usb_endpoint_type(epd);
1913 
1914 	/* Bits 11 & 12 of wMaxPacketSize encode high bandwidth multiplier.
1915 	 * Some musb cores don't support high bandwidth ISO transfers; and
1916 	 * we don't (yet!) support high bandwidth interrupt transfers.
1917 	 */
1918 	qh->hb_mult = 1 + ((qh->maxpacket >> 11) & 0x03);
1919 	if (qh->hb_mult > 1) {
1920 		int ok = (qh->type == USB_ENDPOINT_XFER_ISOC);
1921 
1922 		if (ok)
1923 			ok = (usb_pipein(urb->pipe) && musb->hb_iso_rx)
1924 				|| (usb_pipeout(urb->pipe) && musb->hb_iso_tx);
1925 		if (!ok) {
1926 			ret = -EMSGSIZE;
1927 			goto done;
1928 		}
1929 		qh->maxpacket &= 0x7ff;
1930 	}
1931 
1932 	qh->epnum = usb_endpoint_num(epd);
1933 
1934 	/* NOTE: urb->dev->devnum is wrong during SET_ADDRESS */
1935 	qh->addr_reg = (u8) usb_pipedevice(urb->pipe);
1936 
1937 	/* precompute rxtype/txtype/type0 register */
1938 	type_reg = (qh->type << 4) | qh->epnum;
1939 	switch (urb->dev->speed) {
1940 	case USB_SPEED_LOW:
1941 		type_reg |= 0xc0;
1942 		break;
1943 	case USB_SPEED_FULL:
1944 		type_reg |= 0x80;
1945 		break;
1946 	default:
1947 		type_reg |= 0x40;
1948 	}
1949 	qh->type_reg = type_reg;
1950 
1951 	/* Precompute RXINTERVAL/TXINTERVAL register */
1952 	switch (qh->type) {
1953 	case USB_ENDPOINT_XFER_INT:
1954 		/*
1955 		 * Full/low speeds use the  linear encoding,
1956 		 * high speed uses the logarithmic encoding.
1957 		 */
1958 		if (urb->dev->speed <= USB_SPEED_FULL) {
1959 			interval = max_t(u8, epd->bInterval, 1);
1960 			break;
1961 		}
1962 		/* FALLTHROUGH */
1963 	case USB_ENDPOINT_XFER_ISOC:
1964 		/* ISO always uses logarithmic encoding */
1965 		interval = min_t(u8, epd->bInterval, 16);
1966 		break;
1967 	default:
1968 		/* REVISIT we actually want to use NAK limits, hinting to the
1969 		 * transfer scheduling logic to try some other qh, e.g. try
1970 		 * for 2 msec first:
1971 		 *
1972 		 * interval = (USB_SPEED_HIGH == urb->dev->speed) ? 16 : 2;
1973 		 *
1974 		 * The downside of disabling this is that transfer scheduling
1975 		 * gets VERY unfair for nonperiodic transfers; a misbehaving
1976 		 * peripheral could make that hurt.  That's perfectly normal
1977 		 * for reads from network or serial adapters ... so we have
1978 		 * partial NAKlimit support for bulk RX.
1979 		 *
1980 		 * The upside of disabling it is simpler transfer scheduling.
1981 		 */
1982 		interval = 0;
1983 	}
1984 	qh->intv_reg = interval;
1985 
1986 	/* precompute addressing for external hub/tt ports */
1987 	if (musb->is_multipoint) {
1988 		struct usb_device	*parent = urb->dev->parent;
1989 
1990 		if (parent != hcd->self.root_hub) {
1991 			qh->h_addr_reg = (u8) parent->devnum;
1992 
1993 			/* set up tt info if needed */
1994 			if (urb->dev->tt) {
1995 				qh->h_port_reg = (u8) urb->dev->ttport;
1996 				if (urb->dev->tt->hub)
1997 					qh->h_addr_reg =
1998 						(u8) urb->dev->tt->hub->devnum;
1999 				if (urb->dev->tt->multi)
2000 					qh->h_addr_reg |= 0x80;
2001 			}
2002 		}
2003 	}
2004 
2005 	/* invariant: hep->hcpriv is null OR the qh that's already scheduled.
2006 	 * until we get real dma queues (with an entry for each urb/buffer),
2007 	 * we only have work to do in the former case.
2008 	 */
2009 	spin_lock_irqsave(&musb->lock, flags);
2010 	if (hep->hcpriv) {
2011 		/* some concurrent activity submitted another urb to hep...
2012 		 * odd, rare, error prone, but legal.
2013 		 */
2014 		kfree(qh);
2015 		ret = 0;
2016 	} else
2017 		ret = musb_schedule(musb, qh,
2018 				epd->bEndpointAddress & USB_ENDPOINT_DIR_MASK);
2019 
2020 	if (ret == 0) {
2021 		urb->hcpriv = qh;
2022 		/* FIXME set urb->start_frame for iso/intr, it's tested in
2023 		 * musb_start_urb(), but otherwise only konicawc cares ...
2024 		 */
2025 	}
2026 	spin_unlock_irqrestore(&musb->lock, flags);
2027 
2028 done:
2029 	if (ret != 0) {
2030 		spin_lock_irqsave(&musb->lock, flags);
2031 		usb_hcd_unlink_urb_from_ep(hcd, urb);
2032 		spin_unlock_irqrestore(&musb->lock, flags);
2033 		kfree(qh);
2034 	}
2035 	return ret;
2036 }
2037 
2038 
2039 /*
2040  * abort a transfer that's at the head of a hardware queue.
2041  * called with controller locked, irqs blocked
2042  * that hardware queue advances to the next transfer, unless prevented
2043  */
2044 static int musb_cleanup_urb(struct urb *urb, struct musb_qh *qh)
2045 {
2046 	struct musb_hw_ep	*ep = qh->hw_ep;
2047 	void __iomem		*epio = ep->regs;
2048 	unsigned		hw_end = ep->epnum;
2049 	void __iomem		*regs = ep->musb->mregs;
2050 	int			is_in = usb_pipein(urb->pipe);
2051 	int			status = 0;
2052 	u16			csr;
2053 
2054 	musb_ep_select(regs, hw_end);
2055 
2056 	if (is_dma_capable()) {
2057 		struct dma_channel	*dma;
2058 
2059 		dma = is_in ? ep->rx_channel : ep->tx_channel;
2060 		if (dma) {
2061 			status = ep->musb->dma_controller->channel_abort(dma);
2062 			DBG(status ? 1 : 3,
2063 				"abort %cX%d DMA for urb %p --> %d\n",
2064 				is_in ? 'R' : 'T', ep->epnum,
2065 				urb, status);
2066 			urb->actual_length += dma->actual_len;
2067 		}
2068 	}
2069 
2070 	/* turn off DMA requests, discard state, stop polling ... */
2071 	if (is_in) {
2072 		/* giveback saves bulk toggle */
2073 		csr = musb_h_flush_rxfifo(ep, 0);
2074 
2075 		/* REVISIT we still get an irq; should likely clear the
2076 		 * endpoint's irq status here to avoid bogus irqs.
2077 		 * clearing that status is platform-specific...
2078 		 */
2079 	} else if (ep->epnum) {
2080 		musb_h_tx_flush_fifo(ep);
2081 		csr = musb_readw(epio, MUSB_TXCSR);
2082 		csr &= ~(MUSB_TXCSR_AUTOSET
2083 			| MUSB_TXCSR_DMAENAB
2084 			| MUSB_TXCSR_H_RXSTALL
2085 			| MUSB_TXCSR_H_NAKTIMEOUT
2086 			| MUSB_TXCSR_H_ERROR
2087 			| MUSB_TXCSR_TXPKTRDY);
2088 		musb_writew(epio, MUSB_TXCSR, csr);
2089 		/* REVISIT may need to clear FLUSHFIFO ... */
2090 		musb_writew(epio, MUSB_TXCSR, csr);
2091 		/* flush cpu writebuffer */
2092 		csr = musb_readw(epio, MUSB_TXCSR);
2093 	} else  {
2094 		musb_h_ep0_flush_fifo(ep);
2095 	}
2096 	if (status == 0)
2097 		musb_advance_schedule(ep->musb, urb, ep, is_in);
2098 	return status;
2099 }
2100 
2101 static int musb_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
2102 {
2103 	struct musb		*musb = hcd_to_musb(hcd);
2104 	struct musb_qh		*qh;
2105 	unsigned long		flags;
2106 	int			is_in  = usb_pipein(urb->pipe);
2107 	int			ret;
2108 
2109 	DBG(4, "urb=%p, dev%d ep%d%s\n", urb,
2110 			usb_pipedevice(urb->pipe),
2111 			usb_pipeendpoint(urb->pipe),
2112 			is_in ? "in" : "out");
2113 
2114 	spin_lock_irqsave(&musb->lock, flags);
2115 	ret = usb_hcd_check_unlink_urb(hcd, urb, status);
2116 	if (ret)
2117 		goto done;
2118 
2119 	qh = urb->hcpriv;
2120 	if (!qh)
2121 		goto done;
2122 
2123 	/*
2124 	 * Any URB not actively programmed into endpoint hardware can be
2125 	 * immediately given back; that's any URB not at the head of an
2126 	 * endpoint queue, unless someday we get real DMA queues.  And even
2127 	 * if it's at the head, it might not be known to the hardware...
2128 	 *
2129 	 * Otherwise abort current transfer, pending DMA, etc.; urb->status
2130 	 * has already been updated.  This is a synchronous abort; it'd be
2131 	 * OK to hold off until after some IRQ, though.
2132 	 *
2133 	 * NOTE: qh is invalid unless !list_empty(&hep->urb_list)
2134 	 */
2135 	if (!qh->is_ready
2136 			|| urb->urb_list.prev != &qh->hep->urb_list
2137 			|| musb_ep_get_qh(qh->hw_ep, is_in) != qh) {
2138 		int	ready = qh->is_ready;
2139 
2140 		qh->is_ready = 0;
2141 		musb_giveback(musb, urb, 0);
2142 		qh->is_ready = ready;
2143 
2144 		/* If nothing else (usually musb_giveback) is using it
2145 		 * and its URB list has emptied, recycle this qh.
2146 		 */
2147 		if (ready && list_empty(&qh->hep->urb_list)) {
2148 			qh->hep->hcpriv = NULL;
2149 			list_del(&qh->ring);
2150 			kfree(qh);
2151 		}
2152 	} else
2153 		ret = musb_cleanup_urb(urb, qh);
2154 done:
2155 	spin_unlock_irqrestore(&musb->lock, flags);
2156 	return ret;
2157 }
2158 
2159 /* disable an endpoint */
2160 static void
2161 musb_h_disable(struct usb_hcd *hcd, struct usb_host_endpoint *hep)
2162 {
2163 	u8			is_in = hep->desc.bEndpointAddress & USB_DIR_IN;
2164 	unsigned long		flags;
2165 	struct musb		*musb = hcd_to_musb(hcd);
2166 	struct musb_qh		*qh;
2167 	struct urb		*urb;
2168 
2169 	spin_lock_irqsave(&musb->lock, flags);
2170 
2171 	qh = hep->hcpriv;
2172 	if (qh == NULL)
2173 		goto exit;
2174 
2175 	/* NOTE: qh is invalid unless !list_empty(&hep->urb_list) */
2176 
2177 	/* Kick the first URB off the hardware, if needed */
2178 	qh->is_ready = 0;
2179 	if (musb_ep_get_qh(qh->hw_ep, is_in) == qh) {
2180 		urb = next_urb(qh);
2181 
2182 		/* make software (then hardware) stop ASAP */
2183 		if (!urb->unlinked)
2184 			urb->status = -ESHUTDOWN;
2185 
2186 		/* cleanup */
2187 		musb_cleanup_urb(urb, qh);
2188 
2189 		/* Then nuke all the others ... and advance the
2190 		 * queue on hw_ep (e.g. bulk ring) when we're done.
2191 		 */
2192 		while (!list_empty(&hep->urb_list)) {
2193 			urb = next_urb(qh);
2194 			urb->status = -ESHUTDOWN;
2195 			musb_advance_schedule(musb, urb, qh->hw_ep, is_in);
2196 		}
2197 	} else {
2198 		/* Just empty the queue; the hardware is busy with
2199 		 * other transfers, and since !qh->is_ready nothing
2200 		 * will activate any of these as it advances.
2201 		 */
2202 		while (!list_empty(&hep->urb_list))
2203 			musb_giveback(musb, next_urb(qh), -ESHUTDOWN);
2204 
2205 		hep->hcpriv = NULL;
2206 		list_del(&qh->ring);
2207 		kfree(qh);
2208 	}
2209 exit:
2210 	spin_unlock_irqrestore(&musb->lock, flags);
2211 }
2212 
2213 static int musb_h_get_frame_number(struct usb_hcd *hcd)
2214 {
2215 	struct musb	*musb = hcd_to_musb(hcd);
2216 
2217 	return musb_readw(musb->mregs, MUSB_FRAME);
2218 }
2219 
2220 static int musb_h_start(struct usb_hcd *hcd)
2221 {
2222 	struct musb	*musb = hcd_to_musb(hcd);
2223 
2224 	/* NOTE: musb_start() is called when the hub driver turns
2225 	 * on port power, or when (OTG) peripheral starts.
2226 	 */
2227 	hcd->state = HC_STATE_RUNNING;
2228 	musb->port1_status = 0;
2229 	return 0;
2230 }
2231 
2232 static void musb_h_stop(struct usb_hcd *hcd)
2233 {
2234 	musb_stop(hcd_to_musb(hcd));
2235 	hcd->state = HC_STATE_HALT;
2236 }
2237 
2238 static int musb_bus_suspend(struct usb_hcd *hcd)
2239 {
2240 	struct musb	*musb = hcd_to_musb(hcd);
2241 	u8		devctl;
2242 
2243 	if (!is_host_active(musb))
2244 		return 0;
2245 
2246 	switch (musb->xceiv->state) {
2247 	case OTG_STATE_A_SUSPEND:
2248 		return 0;
2249 	case OTG_STATE_A_WAIT_VRISE:
2250 		/* ID could be grounded even if there's no device
2251 		 * on the other end of the cable.  NOTE that the
2252 		 * A_WAIT_VRISE timers are messy with MUSB...
2253 		 */
2254 		devctl = musb_readb(musb->mregs, MUSB_DEVCTL);
2255 		if ((devctl & MUSB_DEVCTL_VBUS) == MUSB_DEVCTL_VBUS)
2256 			musb->xceiv->state = OTG_STATE_A_WAIT_BCON;
2257 		break;
2258 	default:
2259 		break;
2260 	}
2261 
2262 	if (musb->is_active) {
2263 		WARNING("trying to suspend as %s while active\n",
2264 				otg_state_string(musb));
2265 		return -EBUSY;
2266 	} else
2267 		return 0;
2268 }
2269 
2270 static int musb_bus_resume(struct usb_hcd *hcd)
2271 {
2272 	/* resuming child port does the work */
2273 	return 0;
2274 }
2275 
2276 const struct hc_driver musb_hc_driver = {
2277 	.description		= "musb-hcd",
2278 	.product_desc		= "MUSB HDRC host driver",
2279 	.hcd_priv_size		= sizeof(struct musb),
2280 	.flags			= HCD_USB2 | HCD_MEMORY,
2281 
2282 	/* not using irq handler or reset hooks from usbcore, since
2283 	 * those must be shared with peripheral code for OTG configs
2284 	 */
2285 
2286 	.start			= musb_h_start,
2287 	.stop			= musb_h_stop,
2288 
2289 	.get_frame_number	= musb_h_get_frame_number,
2290 
2291 	.urb_enqueue		= musb_urb_enqueue,
2292 	.urb_dequeue		= musb_urb_dequeue,
2293 	.endpoint_disable	= musb_h_disable,
2294 
2295 	.hub_status_data	= musb_hub_status_data,
2296 	.hub_control		= musb_hub_control,
2297 	.bus_suspend		= musb_bus_suspend,
2298 	.bus_resume		= musb_bus_resume,
2299 	/* .start_port_reset	= NULL, */
2300 	/* .hub_irq_enable	= NULL, */
2301 };
2302