1 // SPDX-License-Identifier: GPL-2.0+
3 * USB HOST XHCI Controller stack
5 * Based on xHCI host controller driver in linux-kernel
8 * Copyright (C) 2008 Intel Corp.
11 * Copyright (C) 2013 Samsung Electronics Co.Ltd
12 * Authors: Vivek Gautam <gautam.vivek@samsung.com>
13 * Vikas Sajjan <vikas.sajjan@samsung.com>
19 #include <asm/byteorder.h>
21 #include <asm/unaligned.h>
22 #include <linux/bug.h>
23 #include <linux/errno.h>
28 * Is this TRB a link TRB or was the last TRB the last TRB in this event ring
29 * segment? I.e. would the updated event TRB pointer step off the end of the
32 * @param ctrl Host controller data structure
33 * @param ring pointer to the ring
34 * @param seg poniter to the segment to which TRB belongs
35 * @param trb poniter to the ring trb
36 * @return 1 if this TRB a link TRB else 0
38 static int last_trb(struct xhci_ctrl *ctrl, struct xhci_ring *ring,
39 struct xhci_segment *seg, union xhci_trb *trb)
41 if (ring == ctrl->event_ring)
42 return trb == &seg->trbs[TRBS_PER_SEGMENT];
44 return TRB_TYPE_LINK_LE32(trb->link.control);
48 * Does this link TRB point to the first segment in a ring,
49 * or was the previous TRB the last TRB on the last segment in the ERST?
51 * @param ctrl Host controller data structure
52 * @param ring pointer to the ring
53 * @param seg poniter to the segment to which TRB belongs
54 * @param trb poniter to the ring trb
55 * @return 1 if this TRB is the last TRB on the last segment else 0
57 static bool last_trb_on_last_seg(struct xhci_ctrl *ctrl,
58 struct xhci_ring *ring,
59 struct xhci_segment *seg,
62 if (ring == ctrl->event_ring)
63 return ((trb == &seg->trbs[TRBS_PER_SEGMENT]) &&
64 (seg->next == ring->first_seg));
66 return le32_to_cpu(trb->link.control) & LINK_TOGGLE;
70 * See Cycle bit rules. SW is the consumer for the event ring only.
71 * Don't make a ring full of link TRBs. That would be dumb and this would loop.
73 * If we've just enqueued a TRB that is in the middle of a TD (meaning the
74 * chain bit is set), then set the chain bit in all the following link TRBs.
75 * If we've enqueued the last TRB in a TD, make sure the following link TRBs
76 * have their chain bit cleared (so that each Link TRB is a separate TD).
78 * Section 6.4.4.1 of the 0.95 spec says link TRBs cannot have the chain bit
79 * set, but other sections talk about dealing with the chain bit set. This was
80 * fixed in the 0.96 specification errata, but we have to assume that all 0.95
81 * xHCI hardware can't handle the chain bit being cleared on a link TRB.
83 * @param ctrl Host controller data structure
84 * @param ring pointer to the ring
85 * @param more_trbs_coming flag to indicate whether more trbs
86 * are expected or NOT.
87 * Will you enqueue more TRBs before calling
91 static void inc_enq(struct xhci_ctrl *ctrl, struct xhci_ring *ring,
92 bool more_trbs_coming)
97 chain = le32_to_cpu(ring->enqueue->generic.field[3]) & TRB_CHAIN;
98 next = ++(ring->enqueue);
101 * Update the dequeue pointer further if that was a link TRB or we're at
102 * the end of an event ring segment (which doesn't have link TRBS)
104 while (last_trb(ctrl, ring, ring->enq_seg, next)) {
105 if (ring != ctrl->event_ring) {
107 * If the caller doesn't plan on enqueueing more
108 * TDs before ringing the doorbell, then we
109 * don't want to give the link TRB to the
110 * hardware just yet. We'll give the link TRB
111 * back in prepare_ring() just before we enqueue
112 * the TD at the top of the ring.
114 if (!chain && !more_trbs_coming)
118 * If we're not dealing with 0.95 hardware or
119 * isoc rings on AMD 0.96 host,
120 * carry over the chain bit of the previous TRB
121 * (which may mean the chain bit is cleared).
123 next->link.control &= cpu_to_le32(~TRB_CHAIN);
124 next->link.control |= cpu_to_le32(chain);
126 next->link.control ^= cpu_to_le32(TRB_CYCLE);
127 xhci_flush_cache((uintptr_t)next,
128 sizeof(union xhci_trb));
130 /* Toggle the cycle bit after the last ring segment. */
131 if (last_trb_on_last_seg(ctrl, ring,
132 ring->enq_seg, next))
133 ring->cycle_state = (ring->cycle_state ? 0 : 1);
135 ring->enq_seg = ring->enq_seg->next;
136 ring->enqueue = ring->enq_seg->trbs;
137 next = ring->enqueue;
142 * See Cycle bit rules. SW is the consumer for the event ring only.
143 * Don't make a ring full of link TRBs. That would be dumb and this would loop.
145 * @param ctrl Host controller data structure
146 * @param ring Ring whose Dequeue TRB pointer needs to be incremented.
149 static void inc_deq(struct xhci_ctrl *ctrl, struct xhci_ring *ring)
153 * Update the dequeue pointer further if that was a link TRB or
154 * we're at the end of an event ring segment (which doesn't have
157 if (last_trb(ctrl, ring, ring->deq_seg, ring->dequeue)) {
158 if (ring == ctrl->event_ring &&
159 last_trb_on_last_seg(ctrl, ring,
160 ring->deq_seg, ring->dequeue)) {
161 ring->cycle_state = (ring->cycle_state ? 0 : 1);
163 ring->deq_seg = ring->deq_seg->next;
164 ring->dequeue = ring->deq_seg->trbs;
168 } while (last_trb(ctrl, ring, ring->deq_seg, ring->dequeue));
172 * Generic function for queueing a TRB on a ring.
173 * The caller must have checked to make sure there's room on the ring.
175 * @param more_trbs_coming: Will you enqueue more TRBs before calling
177 * @param ctrl Host controller data structure
178 * @param ring pointer to the ring
179 * @param more_trbs_coming flag to indicate whether more trbs
180 * @param trb_fields pointer to trb field array containing TRB contents
181 * @return pointer to the enqueued trb
183 static struct xhci_generic_trb *queue_trb(struct xhci_ctrl *ctrl,
184 struct xhci_ring *ring,
185 bool more_trbs_coming,
186 unsigned int *trb_fields)
188 struct xhci_generic_trb *trb;
191 trb = &ring->enqueue->generic;
193 for (i = 0; i < 4; i++)
194 trb->field[i] = cpu_to_le32(trb_fields[i]);
196 xhci_flush_cache((uintptr_t)trb, sizeof(struct xhci_generic_trb));
198 inc_enq(ctrl, ring, more_trbs_coming);
204 * Does various checks on the endpoint ring, and makes it ready
207 * @param ctrl Host controller data structure
208 * @param ep_ring pointer to the EP Transfer Ring
209 * @param ep_state State of the End Point
210 * @return error code in case of invalid ep_state, 0 on success
212 static int prepare_ring(struct xhci_ctrl *ctrl, struct xhci_ring *ep_ring,
215 union xhci_trb *next = ep_ring->enqueue;
217 /* Make sure the endpoint has been added to xHC schedule */
219 case EP_STATE_DISABLED:
221 * USB core changed config/interfaces without notifying us,
222 * or hardware is reporting the wrong state.
224 puts("WARN urb submitted to disabled ep\n");
227 puts("WARN waiting for error on ep to be cleared\n");
229 case EP_STATE_HALTED:
230 puts("WARN halted endpoint, queueing URB anyway.\n");
231 case EP_STATE_STOPPED:
232 case EP_STATE_RUNNING:
233 debug("EP STATE RUNNING.\n");
236 puts("ERROR unknown endpoint state for ep\n");
240 while (last_trb(ctrl, ep_ring, ep_ring->enq_seg, next)) {
242 * If we're not dealing with 0.95 hardware or isoc rings
243 * on AMD 0.96 host, clear the chain bit.
245 next->link.control &= cpu_to_le32(~TRB_CHAIN);
247 next->link.control ^= cpu_to_le32(TRB_CYCLE);
249 xhci_flush_cache((uintptr_t)next, sizeof(union xhci_trb));
251 /* Toggle the cycle bit after the last ring segment. */
252 if (last_trb_on_last_seg(ctrl, ep_ring,
253 ep_ring->enq_seg, next))
254 ep_ring->cycle_state = (ep_ring->cycle_state ? 0 : 1);
255 ep_ring->enq_seg = ep_ring->enq_seg->next;
256 ep_ring->enqueue = ep_ring->enq_seg->trbs;
257 next = ep_ring->enqueue;
264 * Generic function for queueing a command TRB on the command ring.
265 * Check to make sure there's room on the command ring for one command TRB.
267 * @param ctrl Host controller data structure
268 * @param ptr Pointer address to write in the first two fields (opt.)
269 * @param slot_id Slot ID to encode in the flags field (opt.)
270 * @param ep_index Endpoint index to encode in the flags field (opt.)
271 * @param cmd Command type to enqueue
274 void xhci_queue_command(struct xhci_ctrl *ctrl, u8 *ptr, u32 slot_id,
275 u32 ep_index, trb_type cmd)
278 u64 val_64 = virt_to_phys(ptr);
280 BUG_ON(prepare_ring(ctrl, ctrl->cmd_ring, EP_STATE_RUNNING));
282 fields[0] = lower_32_bits(val_64);
283 fields[1] = upper_32_bits(val_64);
285 fields[3] = TRB_TYPE(cmd) | SLOT_ID_FOR_TRB(slot_id) |
286 ctrl->cmd_ring->cycle_state;
289 * Only 'reset endpoint', 'stop endpoint' and 'set TR dequeue pointer'
290 * commands need endpoint id encoded.
292 if (cmd >= TRB_RESET_EP && cmd <= TRB_SET_DEQ)
293 fields[3] |= EP_ID_FOR_TRB(ep_index);
295 queue_trb(ctrl, ctrl->cmd_ring, false, fields);
297 /* Ring the command ring doorbell */
298 xhci_writel(&ctrl->dba->doorbell[0], DB_VALUE_HOST);
302 * For xHCI 1.0 host controllers, TD size is the number of max packet sized
303 * packets remaining in the TD (*not* including this TRB).
305 * Total TD packet count = total_packet_count =
306 * DIV_ROUND_UP(TD size in bytes / wMaxPacketSize)
308 * Packets transferred up to and including this TRB = packets_transferred =
309 * rounddown(total bytes transferred including this TRB / wMaxPacketSize)
311 * TD size = total_packet_count - packets_transferred
313 * For xHCI 0.96 and older, TD size field should be the remaining bytes
314 * including this TRB, right shifted by 10
316 * For all hosts it must fit in bits 21:17, so it can't be bigger than 31.
317 * This is taken care of in the TRB_TD_SIZE() macro
319 * The last TRB in a TD must have the TD size set to zero.
321 * @param ctrl host controller data structure
322 * @param transferred total size sent so far
323 * @param trb_buff_len length of the TRB Buffer
324 * @param td_total_len total packet count
325 * @param maxp max packet size of current pipe
326 * @param more_trbs_coming indicate last trb in TD
329 static u32 xhci_td_remainder(struct xhci_ctrl *ctrl, int transferred,
330 int trb_buff_len, unsigned int td_total_len,
331 int maxp, bool more_trbs_coming)
333 u32 total_packet_count;
335 /* MTK xHCI 0.96 contains some features from 1.0 */
336 if (ctrl->hci_version < 0x100 && !(ctrl->quirks & XHCI_MTK_HOST))
337 return ((td_total_len - transferred) >> 10);
339 /* One TRB with a zero-length data packet. */
340 if (!more_trbs_coming || (transferred == 0 && trb_buff_len == 0) ||
341 trb_buff_len == td_total_len)
344 /* for MTK xHCI 0.96, TD size include this TRB, but not in 1.x */
345 if ((ctrl->quirks & XHCI_MTK_HOST) && (ctrl->hci_version < 0x100))
348 total_packet_count = DIV_ROUND_UP(td_total_len, maxp);
350 /* Queueing functions don't count the current TRB into transferred */
351 return (total_packet_count - ((transferred + trb_buff_len) / maxp));
355 * Ring the doorbell of the End Point
357 * @param udev pointer to the USB device structure
358 * @param ep_index index of the endpoint
359 * @param start_cycle cycle flag of the first TRB
360 * @param start_trb pionter to the first TRB
363 static void giveback_first_trb(struct usb_device *udev, int ep_index,
365 struct xhci_generic_trb *start_trb)
367 struct xhci_ctrl *ctrl = xhci_get_ctrl(udev);
370 * Pass all the TRBs to the hardware at once and make sure this write
374 start_trb->field[3] |= cpu_to_le32(start_cycle);
376 start_trb->field[3] &= cpu_to_le32(~TRB_CYCLE);
378 xhci_flush_cache((uintptr_t)start_trb, sizeof(struct xhci_generic_trb));
380 /* Ringing EP doorbell here */
381 xhci_writel(&ctrl->dba->doorbell[udev->slot_id],
382 DB_VALUE(ep_index, 0));
387 /**** POLLING mechanism for XHCI ****/
390 * Finalizes a handled event TRB by advancing our dequeue pointer and giving
391 * the TRB back to the hardware for recycling. Must call this exactly once at
392 * the end of each event handler, and not touch the TRB again afterwards.
394 * @param ctrl Host controller data structure
397 void xhci_acknowledge_event(struct xhci_ctrl *ctrl)
399 /* Advance our dequeue pointer to the next event */
400 inc_deq(ctrl, ctrl->event_ring);
402 /* Inform the hardware */
403 xhci_writeq(&ctrl->ir_set->erst_dequeue,
404 virt_to_phys(ctrl->event_ring->dequeue) | ERST_EHB);
408 * Checks if there is a new event to handle on the event ring.
410 * @param ctrl Host controller data structure
411 * @return 0 if failure else 1 on success
413 static int event_ready(struct xhci_ctrl *ctrl)
415 union xhci_trb *event;
417 xhci_inval_cache((uintptr_t)ctrl->event_ring->dequeue,
418 sizeof(union xhci_trb));
420 event = ctrl->event_ring->dequeue;
422 /* Does the HC or OS own the TRB? */
423 if ((le32_to_cpu(event->event_cmd.flags) & TRB_CYCLE) !=
424 ctrl->event_ring->cycle_state)
431 * Waits for a specific type of event and returns it. Discards unexpected
432 * events. Caller *must* call xhci_acknowledge_event() after it is finished
433 * processing the event, and must not access the returned pointer afterwards.
435 * @param ctrl Host controller data structure
436 * @param expected TRB type expected from Event TRB
437 * @return pointer to event trb
439 union xhci_trb *xhci_wait_for_event(struct xhci_ctrl *ctrl, trb_type expected)
442 unsigned long ts = get_timer(0);
445 union xhci_trb *event = ctrl->event_ring->dequeue;
447 if (!event_ready(ctrl))
450 type = TRB_FIELD_TO_TYPE(le32_to_cpu(event->event_cmd.flags));
451 if (type == expected)
454 if (type == TRB_PORT_STATUS)
455 /* TODO: remove this once enumeration has been reworked */
457 * Port status change events always have a
458 * successful completion code
460 BUG_ON(GET_COMP_CODE(
461 le32_to_cpu(event->generic.field[2])) !=
464 printf("Unexpected XHCI event TRB, skipping... "
465 "(%08x %08x %08x %08x)\n",
466 le32_to_cpu(event->generic.field[0]),
467 le32_to_cpu(event->generic.field[1]),
468 le32_to_cpu(event->generic.field[2]),
469 le32_to_cpu(event->generic.field[3]));
471 xhci_acknowledge_event(ctrl);
472 } while (get_timer(ts) < XHCI_TIMEOUT);
474 if (expected == TRB_TRANSFER)
477 printf("XHCI timeout on event type %d... cannot recover.\n", expected);
482 * Stops transfer processing for an endpoint and throws away all unprocessed
483 * TRBs by setting the xHC's dequeue pointer to our enqueue pointer. The next
484 * xhci_bulk_tx/xhci_ctrl_tx on this enpoint will add new transfers there and
485 * ring the doorbell, causing this endpoint to start working again.
486 * (Careful: This will BUG() when there was no transfer in progress. Shouldn't
487 * happen in practice for current uses and is too complicated to fix right now.)
489 static void abort_td(struct usb_device *udev, int ep_index)
491 struct xhci_ctrl *ctrl = xhci_get_ctrl(udev);
492 struct xhci_ring *ring = ctrl->devs[udev->slot_id]->eps[ep_index].ring;
493 union xhci_trb *event;
496 xhci_queue_command(ctrl, NULL, udev->slot_id, ep_index, TRB_STOP_RING);
498 event = xhci_wait_for_event(ctrl, TRB_TRANSFER);
499 field = le32_to_cpu(event->trans_event.flags);
500 BUG_ON(TRB_TO_SLOT_ID(field) != udev->slot_id);
501 BUG_ON(TRB_TO_EP_INDEX(field) != ep_index);
502 BUG_ON(GET_COMP_CODE(le32_to_cpu(event->trans_event.transfer_len
504 xhci_acknowledge_event(ctrl);
506 event = xhci_wait_for_event(ctrl, TRB_COMPLETION);
507 BUG_ON(TRB_TO_SLOT_ID(le32_to_cpu(event->event_cmd.flags))
508 != udev->slot_id || GET_COMP_CODE(le32_to_cpu(
509 event->event_cmd.status)) != COMP_SUCCESS);
510 xhci_acknowledge_event(ctrl);
512 xhci_queue_command(ctrl, (void *)((uintptr_t)ring->enqueue |
513 ring->cycle_state), udev->slot_id, ep_index, TRB_SET_DEQ);
514 event = xhci_wait_for_event(ctrl, TRB_COMPLETION);
515 BUG_ON(TRB_TO_SLOT_ID(le32_to_cpu(event->event_cmd.flags))
516 != udev->slot_id || GET_COMP_CODE(le32_to_cpu(
517 event->event_cmd.status)) != COMP_SUCCESS);
518 xhci_acknowledge_event(ctrl);
521 static void record_transfer_result(struct usb_device *udev,
522 union xhci_trb *event, int length)
524 udev->act_len = min(length, length -
525 (int)EVENT_TRB_LEN(le32_to_cpu(event->trans_event.transfer_len)));
527 switch (GET_COMP_CODE(le32_to_cpu(event->trans_event.transfer_len))) {
529 BUG_ON(udev->act_len != length);
535 udev->status = USB_ST_STALLED;
539 udev->status = USB_ST_BUF_ERR;
542 udev->status = USB_ST_BABBLE_DET;
545 udev->status = 0x80; /* USB_ST_TOO_LAZY_TO_MAKE_A_NEW_MACRO */
549 /**** Bulk and Control transfer methods ****/
551 * Queues up the BULK Request
553 * @param udev pointer to the USB device structure
554 * @param pipe contains the DIR_IN or OUT , devnum
555 * @param length length of the buffer
556 * @param buffer buffer to be read/written based on the request
557 * @return returns 0 if successful else -1 on failure
559 int xhci_bulk_tx(struct usb_device *udev, unsigned long pipe,
560 int length, void *buffer)
563 struct xhci_generic_trb *start_trb;
564 bool first_trb = false;
567 u32 length_field = 0;
568 struct xhci_ctrl *ctrl = xhci_get_ctrl(udev);
569 int slot_id = udev->slot_id;
571 struct xhci_virt_device *virt_dev;
572 struct xhci_ep_ctx *ep_ctx;
573 struct xhci_ring *ring; /* EP transfer ring */
574 union xhci_trb *event;
576 int running_total, trb_buff_len;
577 bool more_trbs_coming = true;
582 u64 val_64 = virt_to_phys(buffer);
584 debug("dev=%p, pipe=%lx, buffer=%p, length=%d\n",
585 udev, pipe, buffer, length);
587 ep_index = usb_pipe_ep_index(pipe);
588 virt_dev = ctrl->devs[slot_id];
590 xhci_inval_cache((uintptr_t)virt_dev->out_ctx->bytes,
591 virt_dev->out_ctx->size);
593 ep_ctx = xhci_get_ep_ctx(ctrl, virt_dev->out_ctx, ep_index);
595 ring = virt_dev->eps[ep_index].ring;
597 * How much data is (potentially) left before the 64KB boundary?
598 * XHCI Spec puts restriction( TABLE 49 and 6.4.1 section of XHCI Spec)
599 * that the buffer should not span 64KB boundary. if so
600 * we send request in more than 1 TRB by chaining them.
602 running_total = TRB_MAX_BUFF_SIZE -
603 (lower_32_bits(val_64) & (TRB_MAX_BUFF_SIZE - 1));
604 trb_buff_len = running_total;
605 running_total &= TRB_MAX_BUFF_SIZE - 1;
608 * If there's some data on this 64KB chunk, or we have to send a
609 * zero-length transfer, we need at least one TRB
611 if (running_total != 0 || length == 0)
614 /* How many more 64KB chunks to transfer, how many more TRBs? */
615 while (running_total < length) {
617 running_total += TRB_MAX_BUFF_SIZE;
621 * XXX: Calling routine prepare_ring() called in place of
622 * prepare_trasfer() as there in 'Linux' since we are not
623 * maintaining multiple TDs/transfer at the same time.
625 ret = prepare_ring(ctrl, ring,
626 le32_to_cpu(ep_ctx->ep_info) & EP_STATE_MASK);
631 * Don't give the first TRB to the hardware (by toggling the cycle bit)
632 * until we've finished creating all the other TRBs. The ring's cycle
633 * state may change as we enqueue the other TRBs, so save it too.
635 start_trb = &ring->enqueue->generic;
636 start_cycle = ring->cycle_state;
639 maxpacketsize = usb_maxpacket(udev, pipe);
641 /* How much data is in the first TRB? */
643 * How much data is (potentially) left before the 64KB boundary?
644 * XHCI Spec puts restriction( TABLE 49 and 6.4.1 section of XHCI Spec)
645 * that the buffer should not span 64KB boundary. if so
646 * we send request in more than 1 TRB by chaining them.
650 if (trb_buff_len > length)
651 trb_buff_len = length;
655 /* flush the buffer before use */
656 xhci_flush_cache((uintptr_t)buffer, length);
658 /* Queue the first TRB, even if it's zero-length */
662 /* Don't change the cycle bit of the first TRB until later */
665 if (start_cycle == 0)
668 field |= ring->cycle_state;
672 * Chain all the TRBs together; clear the chain bit in the last
673 * TRB to indicate it's the last TRB in the chain.
679 more_trbs_coming = false;
682 /* Only set interrupt on short packet for IN endpoints */
683 if (usb_pipein(pipe))
686 /* Set the TRB length, TD size, and interrupter fields. */
687 remainder = xhci_td_remainder(ctrl, running_total, trb_buff_len,
688 length, maxpacketsize,
691 length_field = ((trb_buff_len & TRB_LEN_MASK) |
692 TRB_TD_SIZE(remainder) |
693 ((0 & TRB_INTR_TARGET_MASK) <<
694 TRB_INTR_TARGET_SHIFT));
696 trb_fields[0] = lower_32_bits(addr);
697 trb_fields[1] = upper_32_bits(addr);
698 trb_fields[2] = length_field;
699 trb_fields[3] = field | (TRB_NORMAL << TRB_TYPE_SHIFT);
701 queue_trb(ctrl, ring, (num_trbs > 1), trb_fields);
705 running_total += trb_buff_len;
707 /* Calculate length for next transfer */
708 addr += trb_buff_len;
709 trb_buff_len = min((length - running_total), TRB_MAX_BUFF_SIZE);
710 } while (running_total < length);
712 giveback_first_trb(udev, ep_index, start_cycle, start_trb);
714 event = xhci_wait_for_event(ctrl, TRB_TRANSFER);
716 debug("XHCI bulk transfer timed out, aborting...\n");
717 abort_td(udev, ep_index);
718 udev->status = USB_ST_NAK_REC; /* closest thing to a timeout */
722 field = le32_to_cpu(event->trans_event.flags);
724 BUG_ON(TRB_TO_SLOT_ID(field) != slot_id);
725 BUG_ON(TRB_TO_EP_INDEX(field) != ep_index);
726 BUG_ON(*(void **)(uintptr_t)le64_to_cpu(event->trans_event.buffer) -
727 buffer > (size_t)length);
729 record_transfer_result(udev, event, length);
730 xhci_acknowledge_event(ctrl);
731 xhci_inval_cache((uintptr_t)buffer, length);
733 return (udev->status != USB_ST_NOT_PROC) ? 0 : -1;
737 * Queues up the Control Transfer Request
739 * @param udev pointer to the USB device structure
740 * @param pipe contains the DIR_IN or OUT , devnum
741 * @param req request type
742 * @param length length of the buffer
743 * @param buffer buffer to be read/written based on the request
744 * @return returns 0 if successful else error code on failure
746 int xhci_ctrl_tx(struct usb_device *udev, unsigned long pipe,
747 struct devrequest *req, int length,
756 struct xhci_generic_trb *start_trb;
757 struct xhci_ctrl *ctrl = xhci_get_ctrl(udev);
758 int slot_id = udev->slot_id;
761 struct xhci_virt_device *virt_dev = ctrl->devs[slot_id];
762 struct xhci_ring *ep_ring;
763 union xhci_trb *event;
766 debug("req=%u (%#x), type=%u (%#x), value=%u (%#x), index=%u\n",
767 req->request, req->request,
768 req->requesttype, req->requesttype,
769 le16_to_cpu(req->value), le16_to_cpu(req->value),
770 le16_to_cpu(req->index));
772 ep_index = usb_pipe_ep_index(pipe);
774 ep_ring = virt_dev->eps[ep_index].ring;
777 * Check to see if the max packet size for the default control
778 * endpoint changed during FS device enumeration
780 if (udev->speed == USB_SPEED_FULL) {
781 ret = xhci_check_maxpacket(udev);
786 xhci_inval_cache((uintptr_t)virt_dev->out_ctx->bytes,
787 virt_dev->out_ctx->size);
789 struct xhci_ep_ctx *ep_ctx = NULL;
790 ep_ctx = xhci_get_ep_ctx(ctrl, virt_dev->out_ctx, ep_index);
792 /* 1 TRB for setup, 1 for status */
795 * Don't need to check if we need additional event data and normal TRBs,
796 * since data in control transfers will never get bigger than 16MB
797 * XXX: can we get a buffer that crosses 64KB boundaries?
803 * XXX: Calling routine prepare_ring() called in place of
804 * prepare_trasfer() as there in 'Linux' since we are not
805 * maintaining multiple TDs/transfer at the same time.
807 ret = prepare_ring(ctrl, ep_ring,
808 le32_to_cpu(ep_ctx->ep_info) & EP_STATE_MASK);
814 * Don't give the first TRB to the hardware (by toggling the cycle bit)
815 * until we've finished creating all the other TRBs. The ring's cycle
816 * state may change as we enqueue the other TRBs, so save it too.
818 start_trb = &ep_ring->enqueue->generic;
819 start_cycle = ep_ring->cycle_state;
821 debug("start_trb %p, start_cycle %d\n", start_trb, start_cycle);
823 /* Queue setup TRB - see section 6.4.1.2.1 */
824 /* FIXME better way to translate setup_packet into two u32 fields? */
826 field |= TRB_IDT | (TRB_SETUP << TRB_TYPE_SHIFT);
827 if (start_cycle == 0)
830 /* xHCI 1.0 6.4.1.2.1: Transfer Type field */
831 if (ctrl->hci_version >= 0x100 || ctrl->quirks & XHCI_MTK_HOST) {
833 if (req->requesttype & USB_DIR_IN)
834 field |= (TRB_DATA_IN << TRB_TX_TYPE_SHIFT);
836 field |= (TRB_DATA_OUT << TRB_TX_TYPE_SHIFT);
840 debug("req->requesttype = %d, req->request = %d,"
841 "le16_to_cpu(req->value) = %d,"
842 "le16_to_cpu(req->index) = %d,"
843 "le16_to_cpu(req->length) = %d\n",
844 req->requesttype, req->request, le16_to_cpu(req->value),
845 le16_to_cpu(req->index), le16_to_cpu(req->length));
847 trb_fields[0] = req->requesttype | req->request << 8 |
848 le16_to_cpu(req->value) << 16;
849 trb_fields[1] = le16_to_cpu(req->index) |
850 le16_to_cpu(req->length) << 16;
851 /* TRB_LEN | (TRB_INTR_TARGET) */
852 trb_fields[2] = (8 | ((0 & TRB_INTR_TARGET_MASK) <<
853 TRB_INTR_TARGET_SHIFT));
854 /* Immediate data in pointer */
855 trb_fields[3] = field;
856 queue_trb(ctrl, ep_ring, true, trb_fields);
858 /* Re-initializing field to zero */
860 /* If there's data, queue data TRBs */
861 /* Only set interrupt on short packet for IN endpoints */
862 if (usb_pipein(pipe))
863 field = TRB_ISP | (TRB_DATA << TRB_TYPE_SHIFT);
865 field = (TRB_DATA << TRB_TYPE_SHIFT);
867 remainder = xhci_td_remainder(ctrl, 0, length, length,
868 usb_maxpacket(udev, pipe), true);
869 length_field = (length & TRB_LEN_MASK) | TRB_TD_SIZE(remainder) |
870 ((0 & TRB_INTR_TARGET_MASK) << TRB_INTR_TARGET_SHIFT);
871 debug("length_field = %d, length = %d,"
872 "xhci_td_remainder(length) = %d , TRB_INTR_TARGET(0) = %d\n",
873 length_field, (length & TRB_LEN_MASK),
874 TRB_TD_SIZE(remainder), 0);
877 if (req->requesttype & USB_DIR_IN)
879 buf_64 = virt_to_phys(buffer);
881 trb_fields[0] = lower_32_bits(buf_64);
882 trb_fields[1] = upper_32_bits(buf_64);
883 trb_fields[2] = length_field;
884 trb_fields[3] = field | ep_ring->cycle_state;
886 xhci_flush_cache((uintptr_t)buffer, length);
887 queue_trb(ctrl, ep_ring, true, trb_fields);
892 * see Table 7 and sections 4.11.2.2 and 6.4.1.2.3
895 /* If the device sent data, the status stage is an OUT transfer */
897 if (length > 0 && req->requesttype & USB_DIR_IN)
904 trb_fields[2] = ((0 & TRB_INTR_TARGET_MASK) << TRB_INTR_TARGET_SHIFT);
905 /* Event on completion */
906 trb_fields[3] = field | TRB_IOC |
907 (TRB_STATUS << TRB_TYPE_SHIFT) |
908 ep_ring->cycle_state;
910 queue_trb(ctrl, ep_ring, false, trb_fields);
912 giveback_first_trb(udev, ep_index, start_cycle, start_trb);
914 event = xhci_wait_for_event(ctrl, TRB_TRANSFER);
917 field = le32_to_cpu(event->trans_event.flags);
919 BUG_ON(TRB_TO_SLOT_ID(field) != slot_id);
920 BUG_ON(TRB_TO_EP_INDEX(field) != ep_index);
922 record_transfer_result(udev, event, length);
923 xhci_acknowledge_event(ctrl);
925 /* Invalidate buffer to make it available to usb-core */
927 xhci_inval_cache((uintptr_t)buffer, length);
929 if (GET_COMP_CODE(le32_to_cpu(event->trans_event.transfer_len))
931 /* Short data stage, clear up additional status stage event */
932 event = xhci_wait_for_event(ctrl, TRB_TRANSFER);
935 BUG_ON(TRB_TO_SLOT_ID(field) != slot_id);
936 BUG_ON(TRB_TO_EP_INDEX(field) != ep_index);
937 xhci_acknowledge_event(ctrl);
940 return (udev->status != USB_ST_NOT_PROC) ? 0 : -1;
943 debug("XHCI control transfer timed out, aborting...\n");
944 abort_td(udev, ep_index);
945 udev->status = USB_ST_NAK_REC;