xhci-ring.c 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * USB HOST XHCI Controller stack
  4. *
  5. * Based on xHCI host controller driver in linux-kernel
  6. * by Sarah Sharp.
  7. *
  8. * Copyright (C) 2008 Intel Corp.
  9. * Author: Sarah Sharp
  10. *
  11. * Copyright (C) 2013 Samsung Electronics Co.Ltd
  12. * Authors: Vivek Gautam <gautam.vivek@samsung.com>
  13. * Vikas Sajjan <vikas.sajjan@samsung.com>
  14. */
  15. #include <common.h>
  16. #include <cpu_func.h>
  17. #include <asm/byteorder.h>
  18. #include <usb.h>
  19. #include <asm/unaligned.h>
  20. #include <linux/errno.h>
  21. #include <usb/xhci.h>
  22. /**
  23. * Is this TRB a link TRB or was the last TRB the last TRB in this event ring
  24. * segment? I.e. would the updated event TRB pointer step off the end of the
  25. * event seg ?
  26. *
  27. * @param ctrl Host controller data structure
  28. * @param ring pointer to the ring
  29. * @param seg poniter to the segment to which TRB belongs
  30. * @param trb poniter to the ring trb
  31. * @return 1 if this TRB a link TRB else 0
  32. */
  33. static int last_trb(struct xhci_ctrl *ctrl, struct xhci_ring *ring,
  34. struct xhci_segment *seg, union xhci_trb *trb)
  35. {
  36. if (ring == ctrl->event_ring)
  37. return trb == &seg->trbs[TRBS_PER_SEGMENT];
  38. else
  39. return TRB_TYPE_LINK_LE32(trb->link.control);
  40. }
  41. /**
  42. * Does this link TRB point to the first segment in a ring,
  43. * or was the previous TRB the last TRB on the last segment in the ERST?
  44. *
  45. * @param ctrl Host controller data structure
  46. * @param ring pointer to the ring
  47. * @param seg poniter to the segment to which TRB belongs
  48. * @param trb poniter to the ring trb
  49. * @return 1 if this TRB is the last TRB on the last segment else 0
  50. */
  51. static bool last_trb_on_last_seg(struct xhci_ctrl *ctrl,
  52. struct xhci_ring *ring,
  53. struct xhci_segment *seg,
  54. union xhci_trb *trb)
  55. {
  56. if (ring == ctrl->event_ring)
  57. return ((trb == &seg->trbs[TRBS_PER_SEGMENT]) &&
  58. (seg->next == ring->first_seg));
  59. else
  60. return le32_to_cpu(trb->link.control) & LINK_TOGGLE;
  61. }
  62. /**
  63. * See Cycle bit rules. SW is the consumer for the event ring only.
  64. * Don't make a ring full of link TRBs. That would be dumb and this would loop.
  65. *
  66. * If we've just enqueued a TRB that is in the middle of a TD (meaning the
  67. * chain bit is set), then set the chain bit in all the following link TRBs.
  68. * If we've enqueued the last TRB in a TD, make sure the following link TRBs
  69. * have their chain bit cleared (so that each Link TRB is a separate TD).
  70. *
  71. * Section 6.4.4.1 of the 0.95 spec says link TRBs cannot have the chain bit
  72. * set, but other sections talk about dealing with the chain bit set. This was
  73. * fixed in the 0.96 specification errata, but we have to assume that all 0.95
  74. * xHCI hardware can't handle the chain bit being cleared on a link TRB.
  75. *
  76. * @param ctrl Host controller data structure
  77. * @param ring pointer to the ring
  78. * @param more_trbs_coming flag to indicate whether more trbs
  79. * are expected or NOT.
  80. * Will you enqueue more TRBs before calling
  81. * prepare_ring()?
  82. * @return none
  83. */
  84. static void inc_enq(struct xhci_ctrl *ctrl, struct xhci_ring *ring,
  85. bool more_trbs_coming)
  86. {
  87. u32 chain;
  88. union xhci_trb *next;
  89. chain = le32_to_cpu(ring->enqueue->generic.field[3]) & TRB_CHAIN;
  90. next = ++(ring->enqueue);
  91. /*
  92. * Update the dequeue pointer further if that was a link TRB or we're at
  93. * the end of an event ring segment (which doesn't have link TRBS)
  94. */
  95. while (last_trb(ctrl, ring, ring->enq_seg, next)) {
  96. if (ring != ctrl->event_ring) {
  97. /*
  98. * If the caller doesn't plan on enqueueing more
  99. * TDs before ringing the doorbell, then we
  100. * don't want to give the link TRB to the
  101. * hardware just yet. We'll give the link TRB
  102. * back in prepare_ring() just before we enqueue
  103. * the TD at the top of the ring.
  104. */
  105. if (!chain && !more_trbs_coming)
  106. break;
  107. /*
  108. * If we're not dealing with 0.95 hardware or
  109. * isoc rings on AMD 0.96 host,
  110. * carry over the chain bit of the previous TRB
  111. * (which may mean the chain bit is cleared).
  112. */
  113. next->link.control &= cpu_to_le32(~TRB_CHAIN);
  114. next->link.control |= cpu_to_le32(chain);
  115. next->link.control ^= cpu_to_le32(TRB_CYCLE);
  116. xhci_flush_cache((uintptr_t)next,
  117. sizeof(union xhci_trb));
  118. }
  119. /* Toggle the cycle bit after the last ring segment. */
  120. if (last_trb_on_last_seg(ctrl, ring,
  121. ring->enq_seg, next))
  122. ring->cycle_state = (ring->cycle_state ? 0 : 1);
  123. ring->enq_seg = ring->enq_seg->next;
  124. ring->enqueue = ring->enq_seg->trbs;
  125. next = ring->enqueue;
  126. }
  127. }
  128. /**
  129. * See Cycle bit rules. SW is the consumer for the event ring only.
  130. * Don't make a ring full of link TRBs. That would be dumb and this would loop.
  131. *
  132. * @param ctrl Host controller data structure
  133. * @param ring Ring whose Dequeue TRB pointer needs to be incremented.
  134. * return none
  135. */
  136. static void inc_deq(struct xhci_ctrl *ctrl, struct xhci_ring *ring)
  137. {
  138. do {
  139. /*
  140. * Update the dequeue pointer further if that was a link TRB or
  141. * we're at the end of an event ring segment (which doesn't have
  142. * link TRBS)
  143. */
  144. if (last_trb(ctrl, ring, ring->deq_seg, ring->dequeue)) {
  145. if (ring == ctrl->event_ring &&
  146. last_trb_on_last_seg(ctrl, ring,
  147. ring->deq_seg, ring->dequeue)) {
  148. ring->cycle_state = (ring->cycle_state ? 0 : 1);
  149. }
  150. ring->deq_seg = ring->deq_seg->next;
  151. ring->dequeue = ring->deq_seg->trbs;
  152. } else {
  153. ring->dequeue++;
  154. }
  155. } while (last_trb(ctrl, ring, ring->deq_seg, ring->dequeue));
  156. }
  157. /**
  158. * Generic function for queueing a TRB on a ring.
  159. * The caller must have checked to make sure there's room on the ring.
  160. *
  161. * @param more_trbs_coming: Will you enqueue more TRBs before calling
  162. * prepare_ring()?
  163. * @param ctrl Host controller data structure
  164. * @param ring pointer to the ring
  165. * @param more_trbs_coming flag to indicate whether more trbs
  166. * @param trb_fields pointer to trb field array containing TRB contents
  167. * @return pointer to the enqueued trb
  168. */
  169. static struct xhci_generic_trb *queue_trb(struct xhci_ctrl *ctrl,
  170. struct xhci_ring *ring,
  171. bool more_trbs_coming,
  172. unsigned int *trb_fields)
  173. {
  174. struct xhci_generic_trb *trb;
  175. int i;
  176. trb = &ring->enqueue->generic;
  177. for (i = 0; i < 4; i++)
  178. trb->field[i] = cpu_to_le32(trb_fields[i]);
  179. xhci_flush_cache((uintptr_t)trb, sizeof(struct xhci_generic_trb));
  180. inc_enq(ctrl, ring, more_trbs_coming);
  181. return trb;
  182. }
  183. /**
  184. * Does various checks on the endpoint ring, and makes it ready
  185. * to queue num_trbs.
  186. *
  187. * @param ctrl Host controller data structure
  188. * @param ep_ring pointer to the EP Transfer Ring
  189. * @param ep_state State of the End Point
  190. * @return error code in case of invalid ep_state, 0 on success
  191. */
  192. static int prepare_ring(struct xhci_ctrl *ctrl, struct xhci_ring *ep_ring,
  193. u32 ep_state)
  194. {
  195. union xhci_trb *next = ep_ring->enqueue;
  196. /* Make sure the endpoint has been added to xHC schedule */
  197. switch (ep_state) {
  198. case EP_STATE_DISABLED:
  199. /*
  200. * USB core changed config/interfaces without notifying us,
  201. * or hardware is reporting the wrong state.
  202. */
  203. puts("WARN urb submitted to disabled ep\n");
  204. return -ENOENT;
  205. case EP_STATE_ERROR:
  206. puts("WARN waiting for error on ep to be cleared\n");
  207. return -EINVAL;
  208. case EP_STATE_HALTED:
  209. puts("WARN halted endpoint, queueing URB anyway.\n");
  210. case EP_STATE_STOPPED:
  211. case EP_STATE_RUNNING:
  212. debug("EP STATE RUNNING.\n");
  213. break;
  214. default:
  215. puts("ERROR unknown endpoint state for ep\n");
  216. return -EINVAL;
  217. }
  218. while (last_trb(ctrl, ep_ring, ep_ring->enq_seg, next)) {
  219. /*
  220. * If we're not dealing with 0.95 hardware or isoc rings
  221. * on AMD 0.96 host, clear the chain bit.
  222. */
  223. next->link.control &= cpu_to_le32(~TRB_CHAIN);
  224. next->link.control ^= cpu_to_le32(TRB_CYCLE);
  225. xhci_flush_cache((uintptr_t)next, sizeof(union xhci_trb));
  226. /* Toggle the cycle bit after the last ring segment. */
  227. if (last_trb_on_last_seg(ctrl, ep_ring,
  228. ep_ring->enq_seg, next))
  229. ep_ring->cycle_state = (ep_ring->cycle_state ? 0 : 1);
  230. ep_ring->enq_seg = ep_ring->enq_seg->next;
  231. ep_ring->enqueue = ep_ring->enq_seg->trbs;
  232. next = ep_ring->enqueue;
  233. }
  234. return 0;
  235. }
  236. /**
  237. * Generic function for queueing a command TRB on the command ring.
  238. * Check to make sure there's room on the command ring for one command TRB.
  239. *
  240. * @param ctrl Host controller data structure
  241. * @param ptr Pointer address to write in the first two fields (opt.)
  242. * @param slot_id Slot ID to encode in the flags field (opt.)
  243. * @param ep_index Endpoint index to encode in the flags field (opt.)
  244. * @param cmd Command type to enqueue
  245. * @return none
  246. */
  247. void xhci_queue_command(struct xhci_ctrl *ctrl, u8 *ptr, u32 slot_id,
  248. u32 ep_index, trb_type cmd)
  249. {
  250. u32 fields[4];
  251. u64 val_64 = (uintptr_t)ptr;
  252. BUG_ON(prepare_ring(ctrl, ctrl->cmd_ring, EP_STATE_RUNNING));
  253. fields[0] = lower_32_bits(val_64);
  254. fields[1] = upper_32_bits(val_64);
  255. fields[2] = 0;
  256. fields[3] = TRB_TYPE(cmd) | SLOT_ID_FOR_TRB(slot_id) |
  257. ctrl->cmd_ring->cycle_state;
  258. /*
  259. * Only 'reset endpoint', 'stop endpoint' and 'set TR dequeue pointer'
  260. * commands need endpoint id encoded.
  261. */
  262. if (cmd >= TRB_RESET_EP && cmd <= TRB_SET_DEQ)
  263. fields[3] |= EP_ID_FOR_TRB(ep_index);
  264. queue_trb(ctrl, ctrl->cmd_ring, false, fields);
  265. /* Ring the command ring doorbell */
  266. xhci_writel(&ctrl->dba->doorbell[0], DB_VALUE_HOST);
  267. }
  268. /**
  269. * The TD size is the number of bytes remaining in the TD (including this TRB),
  270. * right shifted by 10.
  271. * It must fit in bits 21:17, so it can't be bigger than 31.
  272. *
  273. * @param remainder remaining packets to be sent
  274. * @return remainder if remainder is less than max else max
  275. */
  276. static u32 xhci_td_remainder(unsigned int remainder)
  277. {
  278. u32 max = (1 << (21 - 17 + 1)) - 1;
  279. if ((remainder >> 10) >= max)
  280. return max << 17;
  281. else
  282. return (remainder >> 10) << 17;
  283. }
  284. /**
  285. * Finds out the remanining packets to be sent
  286. *
  287. * @param running_total total size sent so far
  288. * @param trb_buff_len length of the TRB Buffer
  289. * @param total_packet_count total packet count
  290. * @param maxpacketsize max packet size of current pipe
  291. * @param num_trbs_left number of TRBs left to be processed
  292. * @return 0 if running_total or trb_buff_len is 0, else remainder
  293. */
  294. static u32 xhci_v1_0_td_remainder(int running_total,
  295. int trb_buff_len,
  296. unsigned int total_packet_count,
  297. int maxpacketsize,
  298. unsigned int num_trbs_left)
  299. {
  300. int packets_transferred;
  301. /* One TRB with a zero-length data packet. */
  302. if (num_trbs_left == 0 || (running_total == 0 && trb_buff_len == 0))
  303. return 0;
  304. /*
  305. * All the TRB queueing functions don't count the current TRB in
  306. * running_total.
  307. */
  308. packets_transferred = (running_total + trb_buff_len) / maxpacketsize;
  309. if ((total_packet_count - packets_transferred) > 31)
  310. return 31 << 17;
  311. return (total_packet_count - packets_transferred) << 17;
  312. }
  313. /**
  314. * Ring the doorbell of the End Point
  315. *
  316. * @param udev pointer to the USB device structure
  317. * @param ep_index index of the endpoint
  318. * @param start_cycle cycle flag of the first TRB
  319. * @param start_trb pionter to the first TRB
  320. * @return none
  321. */
  322. static void giveback_first_trb(struct usb_device *udev, int ep_index,
  323. int start_cycle,
  324. struct xhci_generic_trb *start_trb)
  325. {
  326. struct xhci_ctrl *ctrl = xhci_get_ctrl(udev);
  327. /*
  328. * Pass all the TRBs to the hardware at once and make sure this write
  329. * isn't reordered.
  330. */
  331. if (start_cycle)
  332. start_trb->field[3] |= cpu_to_le32(start_cycle);
  333. else
  334. start_trb->field[3] &= cpu_to_le32(~TRB_CYCLE);
  335. xhci_flush_cache((uintptr_t)start_trb, sizeof(struct xhci_generic_trb));
  336. /* Ringing EP doorbell here */
  337. xhci_writel(&ctrl->dba->doorbell[udev->slot_id],
  338. DB_VALUE(ep_index, 0));
  339. return;
  340. }
  341. /**** POLLING mechanism for XHCI ****/
  342. /**
  343. * Finalizes a handled event TRB by advancing our dequeue pointer and giving
  344. * the TRB back to the hardware for recycling. Must call this exactly once at
  345. * the end of each event handler, and not touch the TRB again afterwards.
  346. *
  347. * @param ctrl Host controller data structure
  348. * @return none
  349. */
  350. void xhci_acknowledge_event(struct xhci_ctrl *ctrl)
  351. {
  352. /* Advance our dequeue pointer to the next event */
  353. inc_deq(ctrl, ctrl->event_ring);
  354. /* Inform the hardware */
  355. xhci_writeq(&ctrl->ir_set->erst_dequeue,
  356. (uintptr_t)ctrl->event_ring->dequeue | ERST_EHB);
  357. }
  358. /**
  359. * Checks if there is a new event to handle on the event ring.
  360. *
  361. * @param ctrl Host controller data structure
  362. * @return 0 if failure else 1 on success
  363. */
  364. static int event_ready(struct xhci_ctrl *ctrl)
  365. {
  366. union xhci_trb *event;
  367. xhci_inval_cache((uintptr_t)ctrl->event_ring->dequeue,
  368. sizeof(union xhci_trb));
  369. event = ctrl->event_ring->dequeue;
  370. /* Does the HC or OS own the TRB? */
  371. if ((le32_to_cpu(event->event_cmd.flags) & TRB_CYCLE) !=
  372. ctrl->event_ring->cycle_state)
  373. return 0;
  374. return 1;
  375. }
  376. /**
  377. * Waits for a specific type of event and returns it. Discards unexpected
  378. * events. Caller *must* call xhci_acknowledge_event() after it is finished
  379. * processing the event, and must not access the returned pointer afterwards.
  380. *
  381. * @param ctrl Host controller data structure
  382. * @param expected TRB type expected from Event TRB
  383. * @return pointer to event trb
  384. */
  385. union xhci_trb *xhci_wait_for_event(struct xhci_ctrl *ctrl, trb_type expected)
  386. {
  387. trb_type type;
  388. unsigned long ts = get_timer(0);
  389. do {
  390. union xhci_trb *event = ctrl->event_ring->dequeue;
  391. if (!event_ready(ctrl))
  392. continue;
  393. type = TRB_FIELD_TO_TYPE(le32_to_cpu(event->event_cmd.flags));
  394. if (type == expected)
  395. return event;
  396. if (type == TRB_PORT_STATUS)
  397. /* TODO: remove this once enumeration has been reworked */
  398. /*
  399. * Port status change events always have a
  400. * successful completion code
  401. */
  402. BUG_ON(GET_COMP_CODE(
  403. le32_to_cpu(event->generic.field[2])) !=
  404. COMP_SUCCESS);
  405. else
  406. printf("Unexpected XHCI event TRB, skipping... "
  407. "(%08x %08x %08x %08x)\n",
  408. le32_to_cpu(event->generic.field[0]),
  409. le32_to_cpu(event->generic.field[1]),
  410. le32_to_cpu(event->generic.field[2]),
  411. le32_to_cpu(event->generic.field[3]));
  412. xhci_acknowledge_event(ctrl);
  413. } while (get_timer(ts) < XHCI_TIMEOUT);
  414. if (expected == TRB_TRANSFER)
  415. return NULL;
  416. printf("XHCI timeout on event type %d... cannot recover.\n", expected);
  417. BUG();
  418. }
  419. /*
  420. * Stops transfer processing for an endpoint and throws away all unprocessed
  421. * TRBs by setting the xHC's dequeue pointer to our enqueue pointer. The next
  422. * xhci_bulk_tx/xhci_ctrl_tx on this enpoint will add new transfers there and
  423. * ring the doorbell, causing this endpoint to start working again.
  424. * (Careful: This will BUG() when there was no transfer in progress. Shouldn't
  425. * happen in practice for current uses and is too complicated to fix right now.)
  426. */
  427. static void abort_td(struct usb_device *udev, int ep_index)
  428. {
  429. struct xhci_ctrl *ctrl = xhci_get_ctrl(udev);
  430. struct xhci_ring *ring = ctrl->devs[udev->slot_id]->eps[ep_index].ring;
  431. union xhci_trb *event;
  432. u32 field;
  433. xhci_queue_command(ctrl, NULL, udev->slot_id, ep_index, TRB_STOP_RING);
  434. event = xhci_wait_for_event(ctrl, TRB_TRANSFER);
  435. field = le32_to_cpu(event->trans_event.flags);
  436. BUG_ON(TRB_TO_SLOT_ID(field) != udev->slot_id);
  437. BUG_ON(TRB_TO_EP_INDEX(field) != ep_index);
  438. BUG_ON(GET_COMP_CODE(le32_to_cpu(event->trans_event.transfer_len
  439. != COMP_STOP)));
  440. xhci_acknowledge_event(ctrl);
  441. event = xhci_wait_for_event(ctrl, TRB_COMPLETION);
  442. BUG_ON(TRB_TO_SLOT_ID(le32_to_cpu(event->event_cmd.flags))
  443. != udev->slot_id || GET_COMP_CODE(le32_to_cpu(
  444. event->event_cmd.status)) != COMP_SUCCESS);
  445. xhci_acknowledge_event(ctrl);
  446. xhci_queue_command(ctrl, (void *)((uintptr_t)ring->enqueue |
  447. ring->cycle_state), udev->slot_id, ep_index, TRB_SET_DEQ);
  448. event = xhci_wait_for_event(ctrl, TRB_COMPLETION);
  449. BUG_ON(TRB_TO_SLOT_ID(le32_to_cpu(event->event_cmd.flags))
  450. != udev->slot_id || GET_COMP_CODE(le32_to_cpu(
  451. event->event_cmd.status)) != COMP_SUCCESS);
  452. xhci_acknowledge_event(ctrl);
  453. }
  454. static void record_transfer_result(struct usb_device *udev,
  455. union xhci_trb *event, int length)
  456. {
  457. udev->act_len = min(length, length -
  458. (int)EVENT_TRB_LEN(le32_to_cpu(event->trans_event.transfer_len)));
  459. switch (GET_COMP_CODE(le32_to_cpu(event->trans_event.transfer_len))) {
  460. case COMP_SUCCESS:
  461. BUG_ON(udev->act_len != length);
  462. /* fallthrough */
  463. case COMP_SHORT_TX:
  464. udev->status = 0;
  465. break;
  466. case COMP_STALL:
  467. udev->status = USB_ST_STALLED;
  468. break;
  469. case COMP_DB_ERR:
  470. case COMP_TRB_ERR:
  471. udev->status = USB_ST_BUF_ERR;
  472. break;
  473. case COMP_BABBLE:
  474. udev->status = USB_ST_BABBLE_DET;
  475. break;
  476. default:
  477. udev->status = 0x80; /* USB_ST_TOO_LAZY_TO_MAKE_A_NEW_MACRO */
  478. }
  479. }
  480. /**** Bulk and Control transfer methods ****/
  481. /**
  482. * Queues up the BULK Request
  483. *
  484. * @param udev pointer to the USB device structure
  485. * @param pipe contains the DIR_IN or OUT , devnum
  486. * @param length length of the buffer
  487. * @param buffer buffer to be read/written based on the request
  488. * @return returns 0 if successful else -1 on failure
  489. */
  490. int xhci_bulk_tx(struct usb_device *udev, unsigned long pipe,
  491. int length, void *buffer)
  492. {
  493. int num_trbs = 0;
  494. struct xhci_generic_trb *start_trb;
  495. bool first_trb = false;
  496. int start_cycle;
  497. u32 field = 0;
  498. u32 length_field = 0;
  499. struct xhci_ctrl *ctrl = xhci_get_ctrl(udev);
  500. int slot_id = udev->slot_id;
  501. int ep_index;
  502. struct xhci_virt_device *virt_dev;
  503. struct xhci_ep_ctx *ep_ctx;
  504. struct xhci_ring *ring; /* EP transfer ring */
  505. union xhci_trb *event;
  506. int running_total, trb_buff_len;
  507. unsigned int total_packet_count;
  508. int maxpacketsize;
  509. u64 addr;
  510. int ret;
  511. u32 trb_fields[4];
  512. u64 val_64 = (uintptr_t)buffer;
  513. debug("dev=%p, pipe=%lx, buffer=%p, length=%d\n",
  514. udev, pipe, buffer, length);
  515. ep_index = usb_pipe_ep_index(pipe);
  516. virt_dev = ctrl->devs[slot_id];
  517. xhci_inval_cache((uintptr_t)virt_dev->out_ctx->bytes,
  518. virt_dev->out_ctx->size);
  519. ep_ctx = xhci_get_ep_ctx(ctrl, virt_dev->out_ctx, ep_index);
  520. ring = virt_dev->eps[ep_index].ring;
  521. /*
  522. * How much data is (potentially) left before the 64KB boundary?
  523. * XHCI Spec puts restriction( TABLE 49 and 6.4.1 section of XHCI Spec)
  524. * that the buffer should not span 64KB boundary. if so
  525. * we send request in more than 1 TRB by chaining them.
  526. */
  527. running_total = TRB_MAX_BUFF_SIZE -
  528. (lower_32_bits(val_64) & (TRB_MAX_BUFF_SIZE - 1));
  529. trb_buff_len = running_total;
  530. running_total &= TRB_MAX_BUFF_SIZE - 1;
  531. /*
  532. * If there's some data on this 64KB chunk, or we have to send a
  533. * zero-length transfer, we need at least one TRB
  534. */
  535. if (running_total != 0 || length == 0)
  536. num_trbs++;
  537. /* How many more 64KB chunks to transfer, how many more TRBs? */
  538. while (running_total < length) {
  539. num_trbs++;
  540. running_total += TRB_MAX_BUFF_SIZE;
  541. }
  542. /*
  543. * XXX: Calling routine prepare_ring() called in place of
  544. * prepare_trasfer() as there in 'Linux' since we are not
  545. * maintaining multiple TDs/transfer at the same time.
  546. */
  547. ret = prepare_ring(ctrl, ring,
  548. le32_to_cpu(ep_ctx->ep_info) & EP_STATE_MASK);
  549. if (ret < 0)
  550. return ret;
  551. /*
  552. * Don't give the first TRB to the hardware (by toggling the cycle bit)
  553. * until we've finished creating all the other TRBs. The ring's cycle
  554. * state may change as we enqueue the other TRBs, so save it too.
  555. */
  556. start_trb = &ring->enqueue->generic;
  557. start_cycle = ring->cycle_state;
  558. running_total = 0;
  559. maxpacketsize = usb_maxpacket(udev, pipe);
  560. total_packet_count = DIV_ROUND_UP(length, maxpacketsize);
  561. /* How much data is in the first TRB? */
  562. /*
  563. * How much data is (potentially) left before the 64KB boundary?
  564. * XHCI Spec puts restriction( TABLE 49 and 6.4.1 section of XHCI Spec)
  565. * that the buffer should not span 64KB boundary. if so
  566. * we send request in more than 1 TRB by chaining them.
  567. */
  568. addr = val_64;
  569. if (trb_buff_len > length)
  570. trb_buff_len = length;
  571. first_trb = true;
  572. /* flush the buffer before use */
  573. xhci_flush_cache((uintptr_t)buffer, length);
  574. /* Queue the first TRB, even if it's zero-length */
  575. do {
  576. u32 remainder = 0;
  577. field = 0;
  578. /* Don't change the cycle bit of the first TRB until later */
  579. if (first_trb) {
  580. first_trb = false;
  581. if (start_cycle == 0)
  582. field |= TRB_CYCLE;
  583. } else {
  584. field |= ring->cycle_state;
  585. }
  586. /*
  587. * Chain all the TRBs together; clear the chain bit in the last
  588. * TRB to indicate it's the last TRB in the chain.
  589. */
  590. if (num_trbs > 1)
  591. field |= TRB_CHAIN;
  592. else
  593. field |= TRB_IOC;
  594. /* Only set interrupt on short packet for IN endpoints */
  595. if (usb_pipein(pipe))
  596. field |= TRB_ISP;
  597. /* Set the TRB length, TD size, and interrupter fields. */
  598. if (HC_VERSION(xhci_readl(&ctrl->hccr->cr_capbase)) < 0x100)
  599. remainder = xhci_td_remainder(length - running_total);
  600. else
  601. remainder = xhci_v1_0_td_remainder(running_total,
  602. trb_buff_len,
  603. total_packet_count,
  604. maxpacketsize,
  605. num_trbs - 1);
  606. length_field = ((trb_buff_len & TRB_LEN_MASK) |
  607. remainder |
  608. ((0 & TRB_INTR_TARGET_MASK) <<
  609. TRB_INTR_TARGET_SHIFT));
  610. trb_fields[0] = lower_32_bits(addr);
  611. trb_fields[1] = upper_32_bits(addr);
  612. trb_fields[2] = length_field;
  613. trb_fields[3] = field | (TRB_NORMAL << TRB_TYPE_SHIFT);
  614. queue_trb(ctrl, ring, (num_trbs > 1), trb_fields);
  615. --num_trbs;
  616. running_total += trb_buff_len;
  617. /* Calculate length for next transfer */
  618. addr += trb_buff_len;
  619. trb_buff_len = min((length - running_total), TRB_MAX_BUFF_SIZE);
  620. } while (running_total < length);
  621. giveback_first_trb(udev, ep_index, start_cycle, start_trb);
  622. event = xhci_wait_for_event(ctrl, TRB_TRANSFER);
  623. if (!event) {
  624. debug("XHCI bulk transfer timed out, aborting...\n");
  625. abort_td(udev, ep_index);
  626. udev->status = USB_ST_NAK_REC; /* closest thing to a timeout */
  627. udev->act_len = 0;
  628. return -ETIMEDOUT;
  629. }
  630. field = le32_to_cpu(event->trans_event.flags);
  631. BUG_ON(TRB_TO_SLOT_ID(field) != slot_id);
  632. BUG_ON(TRB_TO_EP_INDEX(field) != ep_index);
  633. BUG_ON(*(void **)(uintptr_t)le64_to_cpu(event->trans_event.buffer) -
  634. buffer > (size_t)length);
  635. record_transfer_result(udev, event, length);
  636. xhci_acknowledge_event(ctrl);
  637. xhci_inval_cache((uintptr_t)buffer, length);
  638. return (udev->status != USB_ST_NOT_PROC) ? 0 : -1;
  639. }
  640. /**
  641. * Queues up the Control Transfer Request
  642. *
  643. * @param udev pointer to the USB device structure
  644. * @param pipe contains the DIR_IN or OUT , devnum
  645. * @param req request type
  646. * @param length length of the buffer
  647. * @param buffer buffer to be read/written based on the request
  648. * @return returns 0 if successful else error code on failure
  649. */
  650. int xhci_ctrl_tx(struct usb_device *udev, unsigned long pipe,
  651. struct devrequest *req, int length,
  652. void *buffer)
  653. {
  654. int ret;
  655. int start_cycle;
  656. int num_trbs;
  657. u32 field;
  658. u32 length_field;
  659. u64 buf_64 = 0;
  660. struct xhci_generic_trb *start_trb;
  661. struct xhci_ctrl *ctrl = xhci_get_ctrl(udev);
  662. int slot_id = udev->slot_id;
  663. int ep_index;
  664. u32 trb_fields[4];
  665. struct xhci_virt_device *virt_dev = ctrl->devs[slot_id];
  666. struct xhci_ring *ep_ring;
  667. union xhci_trb *event;
  668. debug("req=%u (%#x), type=%u (%#x), value=%u (%#x), index=%u\n",
  669. req->request, req->request,
  670. req->requesttype, req->requesttype,
  671. le16_to_cpu(req->value), le16_to_cpu(req->value),
  672. le16_to_cpu(req->index));
  673. ep_index = usb_pipe_ep_index(pipe);
  674. ep_ring = virt_dev->eps[ep_index].ring;
  675. /*
  676. * Check to see if the max packet size for the default control
  677. * endpoint changed during FS device enumeration
  678. */
  679. if (udev->speed == USB_SPEED_FULL) {
  680. ret = xhci_check_maxpacket(udev);
  681. if (ret < 0)
  682. return ret;
  683. }
  684. xhci_inval_cache((uintptr_t)virt_dev->out_ctx->bytes,
  685. virt_dev->out_ctx->size);
  686. struct xhci_ep_ctx *ep_ctx = NULL;
  687. ep_ctx = xhci_get_ep_ctx(ctrl, virt_dev->out_ctx, ep_index);
  688. /* 1 TRB for setup, 1 for status */
  689. num_trbs = 2;
  690. /*
  691. * Don't need to check if we need additional event data and normal TRBs,
  692. * since data in control transfers will never get bigger than 16MB
  693. * XXX: can we get a buffer that crosses 64KB boundaries?
  694. */
  695. if (length > 0)
  696. num_trbs++;
  697. /*
  698. * XXX: Calling routine prepare_ring() called in place of
  699. * prepare_trasfer() as there in 'Linux' since we are not
  700. * maintaining multiple TDs/transfer at the same time.
  701. */
  702. ret = prepare_ring(ctrl, ep_ring,
  703. le32_to_cpu(ep_ctx->ep_info) & EP_STATE_MASK);
  704. if (ret < 0)
  705. return ret;
  706. /*
  707. * Don't give the first TRB to the hardware (by toggling the cycle bit)
  708. * until we've finished creating all the other TRBs. The ring's cycle
  709. * state may change as we enqueue the other TRBs, so save it too.
  710. */
  711. start_trb = &ep_ring->enqueue->generic;
  712. start_cycle = ep_ring->cycle_state;
  713. debug("start_trb %p, start_cycle %d\n", start_trb, start_cycle);
  714. /* Queue setup TRB - see section 6.4.1.2.1 */
  715. /* FIXME better way to translate setup_packet into two u32 fields? */
  716. field = 0;
  717. field |= TRB_IDT | (TRB_SETUP << TRB_TYPE_SHIFT);
  718. if (start_cycle == 0)
  719. field |= 0x1;
  720. /* xHCI 1.0 6.4.1.2.1: Transfer Type field */
  721. if (HC_VERSION(xhci_readl(&ctrl->hccr->cr_capbase)) >= 0x100) {
  722. if (length > 0) {
  723. if (req->requesttype & USB_DIR_IN)
  724. field |= (TRB_DATA_IN << TRB_TX_TYPE_SHIFT);
  725. else
  726. field |= (TRB_DATA_OUT << TRB_TX_TYPE_SHIFT);
  727. }
  728. }
  729. debug("req->requesttype = %d, req->request = %d,"
  730. "le16_to_cpu(req->value) = %d,"
  731. "le16_to_cpu(req->index) = %d,"
  732. "le16_to_cpu(req->length) = %d\n",
  733. req->requesttype, req->request, le16_to_cpu(req->value),
  734. le16_to_cpu(req->index), le16_to_cpu(req->length));
  735. trb_fields[0] = req->requesttype | req->request << 8 |
  736. le16_to_cpu(req->value) << 16;
  737. trb_fields[1] = le16_to_cpu(req->index) |
  738. le16_to_cpu(req->length) << 16;
  739. /* TRB_LEN | (TRB_INTR_TARGET) */
  740. trb_fields[2] = (8 | ((0 & TRB_INTR_TARGET_MASK) <<
  741. TRB_INTR_TARGET_SHIFT));
  742. /* Immediate data in pointer */
  743. trb_fields[3] = field;
  744. queue_trb(ctrl, ep_ring, true, trb_fields);
  745. /* Re-initializing field to zero */
  746. field = 0;
  747. /* If there's data, queue data TRBs */
  748. /* Only set interrupt on short packet for IN endpoints */
  749. if (usb_pipein(pipe))
  750. field = TRB_ISP | (TRB_DATA << TRB_TYPE_SHIFT);
  751. else
  752. field = (TRB_DATA << TRB_TYPE_SHIFT);
  753. length_field = (length & TRB_LEN_MASK) | xhci_td_remainder(length) |
  754. ((0 & TRB_INTR_TARGET_MASK) << TRB_INTR_TARGET_SHIFT);
  755. debug("length_field = %d, length = %d,"
  756. "xhci_td_remainder(length) = %d , TRB_INTR_TARGET(0) = %d\n",
  757. length_field, (length & TRB_LEN_MASK),
  758. xhci_td_remainder(length), 0);
  759. if (length > 0) {
  760. if (req->requesttype & USB_DIR_IN)
  761. field |= TRB_DIR_IN;
  762. buf_64 = (uintptr_t)buffer;
  763. trb_fields[0] = lower_32_bits(buf_64);
  764. trb_fields[1] = upper_32_bits(buf_64);
  765. trb_fields[2] = length_field;
  766. trb_fields[3] = field | ep_ring->cycle_state;
  767. xhci_flush_cache((uintptr_t)buffer, length);
  768. queue_trb(ctrl, ep_ring, true, trb_fields);
  769. }
  770. /*
  771. * Queue status TRB -
  772. * see Table 7 and sections 4.11.2.2 and 6.4.1.2.3
  773. */
  774. /* If the device sent data, the status stage is an OUT transfer */
  775. field = 0;
  776. if (length > 0 && req->requesttype & USB_DIR_IN)
  777. field = 0;
  778. else
  779. field = TRB_DIR_IN;
  780. trb_fields[0] = 0;
  781. trb_fields[1] = 0;
  782. trb_fields[2] = ((0 & TRB_INTR_TARGET_MASK) << TRB_INTR_TARGET_SHIFT);
  783. /* Event on completion */
  784. trb_fields[3] = field | TRB_IOC |
  785. (TRB_STATUS << TRB_TYPE_SHIFT) |
  786. ep_ring->cycle_state;
  787. queue_trb(ctrl, ep_ring, false, trb_fields);
  788. giveback_first_trb(udev, ep_index, start_cycle, start_trb);
  789. event = xhci_wait_for_event(ctrl, TRB_TRANSFER);
  790. if (!event)
  791. goto abort;
  792. field = le32_to_cpu(event->trans_event.flags);
  793. BUG_ON(TRB_TO_SLOT_ID(field) != slot_id);
  794. BUG_ON(TRB_TO_EP_INDEX(field) != ep_index);
  795. record_transfer_result(udev, event, length);
  796. xhci_acknowledge_event(ctrl);
  797. /* Invalidate buffer to make it available to usb-core */
  798. if (length > 0)
  799. xhci_inval_cache((uintptr_t)buffer, length);
  800. if (GET_COMP_CODE(le32_to_cpu(event->trans_event.transfer_len))
  801. == COMP_SHORT_TX) {
  802. /* Short data stage, clear up additional status stage event */
  803. event = xhci_wait_for_event(ctrl, TRB_TRANSFER);
  804. if (!event)
  805. goto abort;
  806. BUG_ON(TRB_TO_SLOT_ID(field) != slot_id);
  807. BUG_ON(TRB_TO_EP_INDEX(field) != ep_index);
  808. xhci_acknowledge_event(ctrl);
  809. }
  810. return (udev->status != USB_ST_NOT_PROC) ? 0 : -1;
  811. abort:
  812. debug("XHCI control transfer timed out, aborting...\n");
  813. abort_td(udev, ep_index);
  814. udev->status = USB_ST_NAK_REC;
  815. udev->act_len = 0;
  816. return -ETIMEDOUT;
  817. }