]>
git.ipfire.org Git - people/ms/u-boot.git/blob - drivers/usb/host/xhci-ring.c
2 * USB HOST XHCI Controller stack
4 * Based on xHCI host controller driver in linux-kernel
7 * Copyright (C) 2008 Intel Corp.
10 * Copyright (C) 2013 Samsung Electronics Co.Ltd
11 * Authors: Vivek Gautam <gautam.vivek@samsung.com>
12 * Vikas Sajjan <vikas.sajjan@samsung.com>
14 * SPDX-License-Identifier: GPL-2.0+
18 #include <asm/byteorder.h>
20 #include <asm/unaligned.h>
21 #include <asm-generic/errno.h>
26 * Is this TRB a link TRB or was the last TRB the last TRB in this event ring
27 * segment? I.e. would the updated event TRB pointer step off the end of the
30 * @param ctrl Host controller data structure
31 * @param ring pointer to the ring
32 * @param seg poniter to the segment to which TRB belongs
33 * @param trb poniter to the ring trb
34 * @return 1 if this TRB a link TRB else 0
36 static int last_trb(struct xhci_ctrl
*ctrl
, struct xhci_ring
*ring
,
37 struct xhci_segment
*seg
, union xhci_trb
*trb
)
39 if (ring
== ctrl
->event_ring
)
40 return trb
== &seg
->trbs
[TRBS_PER_SEGMENT
];
42 return TRB_TYPE_LINK_LE32(trb
->link
.control
);
46 * Does this link TRB point to the first segment in a ring,
47 * or was the previous TRB the last TRB on the last segment in the ERST?
49 * @param ctrl Host controller data structure
50 * @param ring pointer to the ring
51 * @param seg poniter to the segment to which TRB belongs
52 * @param trb poniter to the ring trb
53 * @return 1 if this TRB is the last TRB on the last segment else 0
55 static bool last_trb_on_last_seg(struct xhci_ctrl
*ctrl
,
56 struct xhci_ring
*ring
,
57 struct xhci_segment
*seg
,
60 if (ring
== ctrl
->event_ring
)
61 return ((trb
== &seg
->trbs
[TRBS_PER_SEGMENT
]) &&
62 (seg
->next
== ring
->first_seg
));
64 return le32_to_cpu(trb
->link
.control
) & LINK_TOGGLE
;
68 * See Cycle bit rules. SW is the consumer for the event ring only.
69 * Don't make a ring full of link TRBs. That would be dumb and this would loop.
71 * If we've just enqueued a TRB that is in the middle of a TD (meaning the
72 * chain bit is set), then set the chain bit in all the following link TRBs.
73 * If we've enqueued the last TRB in a TD, make sure the following link TRBs
74 * have their chain bit cleared (so that each Link TRB is a separate TD).
76 * Section 6.4.4.1 of the 0.95 spec says link TRBs cannot have the chain bit
77 * set, but other sections talk about dealing with the chain bit set. This was
78 * fixed in the 0.96 specification errata, but we have to assume that all 0.95
79 * xHCI hardware can't handle the chain bit being cleared on a link TRB.
81 * @param ctrl Host controller data structure
82 * @param ring pointer to the ring
83 * @param more_trbs_coming flag to indicate whether more trbs
84 * are expected or NOT.
85 * Will you enqueue more TRBs before calling
89 static void inc_enq(struct xhci_ctrl
*ctrl
, struct xhci_ring
*ring
,
90 bool more_trbs_coming
)
95 chain
= le32_to_cpu(ring
->enqueue
->generic
.field
[3]) & TRB_CHAIN
;
96 next
= ++(ring
->enqueue
);
99 * Update the dequeue pointer further if that was a link TRB or we're at
100 * the end of an event ring segment (which doesn't have link TRBS)
102 while (last_trb(ctrl
, ring
, ring
->enq_seg
, next
)) {
103 if (ring
!= ctrl
->event_ring
) {
105 * If the caller doesn't plan on enqueueing more
106 * TDs before ringing the doorbell, then we
107 * don't want to give the link TRB to the
108 * hardware just yet. We'll give the link TRB
109 * back in prepare_ring() just before we enqueue
110 * the TD at the top of the ring.
112 if (!chain
&& !more_trbs_coming
)
116 * If we're not dealing with 0.95 hardware or
117 * isoc rings on AMD 0.96 host,
118 * carry over the chain bit of the previous TRB
119 * (which may mean the chain bit is cleared).
121 next
->link
.control
&= cpu_to_le32(~TRB_CHAIN
);
122 next
->link
.control
|= cpu_to_le32(chain
);
124 next
->link
.control
^= cpu_to_le32(TRB_CYCLE
);
125 xhci_flush_cache((uint32_t)next
,
126 sizeof(union xhci_trb
));
128 /* Toggle the cycle bit after the last ring segment. */
129 if (last_trb_on_last_seg(ctrl
, ring
,
130 ring
->enq_seg
, next
))
131 ring
->cycle_state
= (ring
->cycle_state
? 0 : 1);
133 ring
->enq_seg
= ring
->enq_seg
->next
;
134 ring
->enqueue
= ring
->enq_seg
->trbs
;
135 next
= ring
->enqueue
;
140 * See Cycle bit rules. SW is the consumer for the event ring only.
141 * Don't make a ring full of link TRBs. That would be dumb and this would loop.
143 * @param ctrl Host controller data structure
144 * @param ring Ring whose Dequeue TRB pointer needs to be incremented.
147 static void inc_deq(struct xhci_ctrl
*ctrl
, struct xhci_ring
*ring
)
151 * Update the dequeue pointer further if that was a link TRB or
152 * we're at the end of an event ring segment (which doesn't have
155 if (last_trb(ctrl
, ring
, ring
->deq_seg
, ring
->dequeue
)) {
156 if (ring
== ctrl
->event_ring
&&
157 last_trb_on_last_seg(ctrl
, ring
,
158 ring
->deq_seg
, ring
->dequeue
)) {
159 ring
->cycle_state
= (ring
->cycle_state
? 0 : 1);
161 ring
->deq_seg
= ring
->deq_seg
->next
;
162 ring
->dequeue
= ring
->deq_seg
->trbs
;
166 } while (last_trb(ctrl
, ring
, ring
->deq_seg
, ring
->dequeue
));
170 * Generic function for queueing a TRB on a ring.
171 * The caller must have checked to make sure there's room on the ring.
173 * @param more_trbs_coming: Will you enqueue more TRBs before calling
175 * @param ctrl Host controller data structure
176 * @param ring pointer to the ring
177 * @param more_trbs_coming flag to indicate whether more trbs
178 * @param trb_fields pointer to trb field array containing TRB contents
179 * @return pointer to the enqueued trb
181 static struct xhci_generic_trb
*queue_trb(struct xhci_ctrl
*ctrl
,
182 struct xhci_ring
*ring
,
183 bool more_trbs_coming
,
184 unsigned int *trb_fields
)
186 struct xhci_generic_trb
*trb
;
189 trb
= &ring
->enqueue
->generic
;
191 for (i
= 0; i
< 4; i
++)
192 trb
->field
[i
] = cpu_to_le32(trb_fields
[i
]);
194 xhci_flush_cache((uint32_t)trb
, sizeof(struct xhci_generic_trb
));
196 inc_enq(ctrl
, ring
, more_trbs_coming
);
202 * Does various checks on the endpoint ring, and makes it ready
205 * @param ctrl Host controller data structure
206 * @param ep_ring pointer to the EP Transfer Ring
207 * @param ep_state State of the End Point
208 * @return error code in case of invalid ep_state, 0 on success
210 static int prepare_ring(struct xhci_ctrl
*ctrl
, struct xhci_ring
*ep_ring
,
213 union xhci_trb
*next
= ep_ring
->enqueue
;
215 /* Make sure the endpoint has been added to xHC schedule */
217 case EP_STATE_DISABLED
:
219 * USB core changed config/interfaces without notifying us,
220 * or hardware is reporting the wrong state.
222 puts("WARN urb submitted to disabled ep\n");
225 puts("WARN waiting for error on ep to be cleared\n");
227 case EP_STATE_HALTED
:
228 puts("WARN halted endpoint, queueing URB anyway.\n");
229 case EP_STATE_STOPPED
:
230 case EP_STATE_RUNNING
:
231 debug("EP STATE RUNNING.\n");
234 puts("ERROR unknown endpoint state for ep\n");
238 while (last_trb(ctrl
, ep_ring
, ep_ring
->enq_seg
, next
)) {
240 * If we're not dealing with 0.95 hardware or isoc rings
241 * on AMD 0.96 host, clear the chain bit.
243 next
->link
.control
&= cpu_to_le32(~TRB_CHAIN
);
245 next
->link
.control
^= cpu_to_le32(TRB_CYCLE
);
247 xhci_flush_cache((uint32_t)next
, sizeof(union xhci_trb
));
249 /* Toggle the cycle bit after the last ring segment. */
250 if (last_trb_on_last_seg(ctrl
, ep_ring
,
251 ep_ring
->enq_seg
, next
))
252 ep_ring
->cycle_state
= (ep_ring
->cycle_state
? 0 : 1);
253 ep_ring
->enq_seg
= ep_ring
->enq_seg
->next
;
254 ep_ring
->enqueue
= ep_ring
->enq_seg
->trbs
;
255 next
= ep_ring
->enqueue
;
262 * Generic function for queueing a command TRB on the command ring.
263 * Check to make sure there's room on the command ring for one command TRB.
265 * @param ctrl Host controller data structure
266 * @param ptr Pointer address to write in the first two fields (opt.)
267 * @param slot_id Slot ID to encode in the flags field (opt.)
268 * @param ep_index Endpoint index to encode in the flags field (opt.)
269 * @param cmd Command type to enqueue
272 void xhci_queue_command(struct xhci_ctrl
*ctrl
, u8
*ptr
, u32 slot_id
,
273 u32 ep_index
, trb_type cmd
)
276 u64 val_64
= (uintptr_t)ptr
;
278 BUG_ON(prepare_ring(ctrl
, ctrl
->cmd_ring
, EP_STATE_RUNNING
));
280 fields
[0] = lower_32_bits(val_64
);
281 fields
[1] = upper_32_bits(val_64
);
283 fields
[3] = TRB_TYPE(cmd
) | EP_ID_FOR_TRB(ep_index
) |
284 SLOT_ID_FOR_TRB(slot_id
) | ctrl
->cmd_ring
->cycle_state
;
286 queue_trb(ctrl
, ctrl
->cmd_ring
, false, fields
);
288 /* Ring the command ring doorbell */
289 xhci_writel(&ctrl
->dba
->doorbell
[0], DB_VALUE_HOST
);
293 * The TD size is the number of bytes remaining in the TD (including this TRB),
294 * right shifted by 10.
295 * It must fit in bits 21:17, so it can't be bigger than 31.
297 * @param remainder remaining packets to be sent
298 * @return remainder if remainder is less than max else max
300 static u32
xhci_td_remainder(unsigned int remainder
)
302 u32 max
= (1 << (21 - 17 + 1)) - 1;
304 if ((remainder
>> 10) >= max
)
307 return (remainder
>> 10) << 17;
311 * Finds out the remanining packets to be sent
313 * @param running_total total size sent so far
314 * @param trb_buff_len length of the TRB Buffer
315 * @param total_packet_count total packet count
316 * @param maxpacketsize max packet size of current pipe
317 * @param num_trbs_left number of TRBs left to be processed
318 * @return 0 if running_total or trb_buff_len is 0, else remainder
320 static u32
xhci_v1_0_td_remainder(int running_total
,
322 unsigned int total_packet_count
,
324 unsigned int num_trbs_left
)
326 int packets_transferred
;
328 /* One TRB with a zero-length data packet. */
329 if (num_trbs_left
== 0 || (running_total
== 0 && trb_buff_len
== 0))
333 * All the TRB queueing functions don't count the current TRB in
336 packets_transferred
= (running_total
+ trb_buff_len
) / maxpacketsize
;
338 if ((total_packet_count
- packets_transferred
) > 31)
340 return (total_packet_count
- packets_transferred
) << 17;
344 * Ring the doorbell of the End Point
346 * @param udev pointer to the USB device structure
347 * @param ep_index index of the endpoint
348 * @param start_cycle cycle flag of the first TRB
349 * @param start_trb pionter to the first TRB
352 static void giveback_first_trb(struct usb_device
*udev
, int ep_index
,
354 struct xhci_generic_trb
*start_trb
)
356 struct xhci_ctrl
*ctrl
= udev
->controller
;
359 * Pass all the TRBs to the hardware at once and make sure this write
363 start_trb
->field
[3] |= cpu_to_le32(start_cycle
);
365 start_trb
->field
[3] &= cpu_to_le32(~TRB_CYCLE
);
367 xhci_flush_cache((uint32_t)start_trb
, sizeof(struct xhci_generic_trb
));
369 /* Ringing EP doorbell here */
370 xhci_writel(&ctrl
->dba
->doorbell
[udev
->slot_id
],
371 DB_VALUE(ep_index
, 0));
376 /**** POLLING mechanism for XHCI ****/
379 * Finalizes a handled event TRB by advancing our dequeue pointer and giving
380 * the TRB back to the hardware for recycling. Must call this exactly once at
381 * the end of each event handler, and not touch the TRB again afterwards.
383 * @param ctrl Host controller data structure
386 void xhci_acknowledge_event(struct xhci_ctrl
*ctrl
)
388 /* Advance our dequeue pointer to the next event */
389 inc_deq(ctrl
, ctrl
->event_ring
);
391 /* Inform the hardware */
392 xhci_writeq(&ctrl
->ir_set
->erst_dequeue
,
393 (uintptr_t)ctrl
->event_ring
->dequeue
| ERST_EHB
);
397 * Checks if there is a new event to handle on the event ring.
399 * @param ctrl Host controller data structure
400 * @return 0 if failure else 1 on success
402 static int event_ready(struct xhci_ctrl
*ctrl
)
404 union xhci_trb
*event
;
406 xhci_inval_cache((uint32_t)ctrl
->event_ring
->dequeue
,
407 sizeof(union xhci_trb
));
409 event
= ctrl
->event_ring
->dequeue
;
411 /* Does the HC or OS own the TRB? */
412 if ((le32_to_cpu(event
->event_cmd
.flags
) & TRB_CYCLE
) !=
413 ctrl
->event_ring
->cycle_state
)
420 * Waits for a specific type of event and returns it. Discards unexpected
421 * events. Caller *must* call xhci_acknowledge_event() after it is finished
422 * processing the event, and must not access the returned pointer afterwards.
424 * @param ctrl Host controller data structure
425 * @param expected TRB type expected from Event TRB
426 * @return pointer to event trb
428 union xhci_trb
*xhci_wait_for_event(struct xhci_ctrl
*ctrl
, trb_type expected
)
431 unsigned long ts
= get_timer(0);
434 union xhci_trb
*event
= ctrl
->event_ring
->dequeue
;
436 if (!event_ready(ctrl
))
439 type
= TRB_FIELD_TO_TYPE(le32_to_cpu(event
->event_cmd
.flags
));
440 if (type
== expected
)
443 if (type
== TRB_PORT_STATUS
)
444 /* TODO: remove this once enumeration has been reworked */
446 * Port status change events always have a
447 * successful completion code
449 BUG_ON(GET_COMP_CODE(
450 le32_to_cpu(event
->generic
.field
[2])) !=
453 printf("Unexpected XHCI event TRB, skipping... "
454 "(%08x %08x %08x %08x)\n",
455 le32_to_cpu(event
->generic
.field
[0]),
456 le32_to_cpu(event
->generic
.field
[1]),
457 le32_to_cpu(event
->generic
.field
[2]),
458 le32_to_cpu(event
->generic
.field
[3]));
460 xhci_acknowledge_event(ctrl
);
461 } while (get_timer(ts
) < XHCI_TIMEOUT
);
463 if (expected
== TRB_TRANSFER
)
466 printf("XHCI timeout on event type %d... cannot recover.\n", expected
);
471 * Stops transfer processing for an endpoint and throws away all unprocessed
472 * TRBs by setting the xHC's dequeue pointer to our enqueue pointer. The next
473 * xhci_bulk_tx/xhci_ctrl_tx on this enpoint will add new transfers there and
474 * ring the doorbell, causing this endpoint to start working again.
475 * (Careful: This will BUG() when there was no transfer in progress. Shouldn't
476 * happen in practice for current uses and is too complicated to fix right now.)
478 static void abort_td(struct usb_device
*udev
, int ep_index
)
480 struct xhci_ctrl
*ctrl
= udev
->controller
;
481 struct xhci_ring
*ring
= ctrl
->devs
[udev
->slot_id
]->eps
[ep_index
].ring
;
482 union xhci_trb
*event
;
485 xhci_queue_command(ctrl
, NULL
, udev
->slot_id
, ep_index
, TRB_STOP_RING
);
487 event
= xhci_wait_for_event(ctrl
, TRB_TRANSFER
);
488 field
= le32_to_cpu(event
->trans_event
.flags
);
489 BUG_ON(TRB_TO_SLOT_ID(field
) != udev
->slot_id
);
490 BUG_ON(TRB_TO_EP_INDEX(field
) != ep_index
);
491 BUG_ON(GET_COMP_CODE(le32_to_cpu(event
->trans_event
.transfer_len
493 xhci_acknowledge_event(ctrl
);
495 event
= xhci_wait_for_event(ctrl
, TRB_COMPLETION
);
496 BUG_ON(TRB_TO_SLOT_ID(le32_to_cpu(event
->event_cmd
.flags
))
497 != udev
->slot_id
|| GET_COMP_CODE(le32_to_cpu(
498 event
->event_cmd
.status
)) != COMP_SUCCESS
);
499 xhci_acknowledge_event(ctrl
);
501 xhci_queue_command(ctrl
, (void *)((uintptr_t)ring
->enqueue
|
502 ring
->cycle_state
), udev
->slot_id
, ep_index
, TRB_SET_DEQ
);
503 event
= xhci_wait_for_event(ctrl
, TRB_COMPLETION
);
504 BUG_ON(TRB_TO_SLOT_ID(le32_to_cpu(event
->event_cmd
.flags
))
505 != udev
->slot_id
|| GET_COMP_CODE(le32_to_cpu(
506 event
->event_cmd
.status
)) != COMP_SUCCESS
);
507 xhci_acknowledge_event(ctrl
);
510 static void record_transfer_result(struct usb_device
*udev
,
511 union xhci_trb
*event
, int length
)
513 udev
->act_len
= min(length
, length
-
514 EVENT_TRB_LEN(le32_to_cpu(event
->trans_event
.transfer_len
)));
516 switch (GET_COMP_CODE(le32_to_cpu(event
->trans_event
.transfer_len
))) {
518 BUG_ON(udev
->act_len
!= length
);
524 udev
->status
= USB_ST_STALLED
;
528 udev
->status
= USB_ST_BUF_ERR
;
531 udev
->status
= USB_ST_BABBLE_DET
;
534 udev
->status
= 0x80; /* USB_ST_TOO_LAZY_TO_MAKE_A_NEW_MACRO */
538 /**** Bulk and Control transfer methods ****/
540 * Queues up the BULK Request
542 * @param udev pointer to the USB device structure
543 * @param pipe contains the DIR_IN or OUT , devnum
544 * @param length length of the buffer
545 * @param buffer buffer to be read/written based on the request
546 * @return returns 0 if successful else -1 on failure
548 int xhci_bulk_tx(struct usb_device
*udev
, unsigned long pipe
,
549 int length
, void *buffer
)
552 struct xhci_generic_trb
*start_trb
;
556 u32 length_field
= 0;
557 struct xhci_ctrl
*ctrl
= udev
->controller
;
558 int slot_id
= udev
->slot_id
;
560 struct xhci_virt_device
*virt_dev
;
561 struct xhci_ep_ctx
*ep_ctx
;
562 struct xhci_ring
*ring
; /* EP transfer ring */
563 union xhci_trb
*event
;
565 int running_total
, trb_buff_len
;
566 unsigned int total_packet_count
;
571 u64 val_64
= (uintptr_t)buffer
;
573 debug("dev=%p, pipe=%lx, buffer=%p, length=%d\n",
574 udev
, pipe
, buffer
, length
);
576 ep_index
= usb_pipe_ep_index(pipe
);
577 virt_dev
= ctrl
->devs
[slot_id
];
579 xhci_inval_cache((uint32_t)virt_dev
->out_ctx
->bytes
,
580 virt_dev
->out_ctx
->size
);
582 ep_ctx
= xhci_get_ep_ctx(ctrl
, virt_dev
->out_ctx
, ep_index
);
584 ring
= virt_dev
->eps
[ep_index
].ring
;
586 * How much data is (potentially) left before the 64KB boundary?
587 * XHCI Spec puts restriction( TABLE 49 and 6.4.1 section of XHCI Spec)
588 * that the buffer should not span 64KB boundary. if so
589 * we send request in more than 1 TRB by chaining them.
591 running_total
= TRB_MAX_BUFF_SIZE
-
592 (lower_32_bits(val_64
) & (TRB_MAX_BUFF_SIZE
- 1));
593 trb_buff_len
= running_total
;
594 running_total
&= TRB_MAX_BUFF_SIZE
- 1;
597 * If there's some data on this 64KB chunk, or we have to send a
598 * zero-length transfer, we need at least one TRB
600 if (running_total
!= 0 || length
== 0)
603 /* How many more 64KB chunks to transfer, how many more TRBs? */
604 while (running_total
< length
) {
606 running_total
+= TRB_MAX_BUFF_SIZE
;
610 * XXX: Calling routine prepare_ring() called in place of
611 * prepare_trasfer() as there in 'Linux' since we are not
612 * maintaining multiple TDs/transfer at the same time.
614 ret
= prepare_ring(ctrl
, ring
,
615 le32_to_cpu(ep_ctx
->ep_info
) & EP_STATE_MASK
);
620 * Don't give the first TRB to the hardware (by toggling the cycle bit)
621 * until we've finished creating all the other TRBs. The ring's cycle
622 * state may change as we enqueue the other TRBs, so save it too.
624 start_trb
= &ring
->enqueue
->generic
;
625 start_cycle
= ring
->cycle_state
;
628 maxpacketsize
= usb_maxpacket(udev
, pipe
);
630 total_packet_count
= DIV_ROUND_UP(length
, maxpacketsize
);
632 /* How much data is in the first TRB? */
634 * How much data is (potentially) left before the 64KB boundary?
635 * XHCI Spec puts restriction( TABLE 49 and 6.4.1 section of XHCI Spec)
636 * that the buffer should not span 64KB boundary. if so
637 * we send request in more than 1 TRB by chaining them.
641 if (trb_buff_len
> length
)
642 trb_buff_len
= length
;
646 /* flush the buffer before use */
647 xhci_flush_cache((uint32_t)buffer
, length
);
649 /* Queue the first TRB, even if it's zero-length */
653 /* Don't change the cycle bit of the first TRB until later */
656 if (start_cycle
== 0)
659 field
|= ring
->cycle_state
;
663 * Chain all the TRBs together; clear the chain bit in the last
664 * TRB to indicate it's the last TRB in the chain.
671 /* Only set interrupt on short packet for IN endpoints */
672 if (usb_pipein(pipe
))
675 /* Set the TRB length, TD size, and interrupter fields. */
676 if (HC_VERSION(xhci_readl(&ctrl
->hccr
->cr_capbase
)) < 0x100)
677 remainder
= xhci_td_remainder(length
- running_total
);
679 remainder
= xhci_v1_0_td_remainder(running_total
,
685 length_field
= ((trb_buff_len
& TRB_LEN_MASK
) |
687 ((0 & TRB_INTR_TARGET_MASK
) <<
688 TRB_INTR_TARGET_SHIFT
));
690 trb_fields
[0] = lower_32_bits(addr
);
691 trb_fields
[1] = upper_32_bits(addr
);
692 trb_fields
[2] = length_field
;
693 trb_fields
[3] = field
| (TRB_NORMAL
<< TRB_TYPE_SHIFT
);
695 queue_trb(ctrl
, ring
, (num_trbs
> 1), trb_fields
);
699 running_total
+= trb_buff_len
;
701 /* Calculate length for next transfer */
702 addr
+= trb_buff_len
;
703 trb_buff_len
= min((length
- running_total
), TRB_MAX_BUFF_SIZE
);
704 } while (running_total
< length
);
706 giveback_first_trb(udev
, ep_index
, start_cycle
, start_trb
);
708 event
= xhci_wait_for_event(ctrl
, TRB_TRANSFER
);
710 debug("XHCI bulk transfer timed out, aborting...\n");
711 abort_td(udev
, ep_index
);
712 udev
->status
= USB_ST_NAK_REC
; /* closest thing to a timeout */
716 field
= le32_to_cpu(event
->trans_event
.flags
);
718 BUG_ON(TRB_TO_SLOT_ID(field
) != slot_id
);
719 BUG_ON(TRB_TO_EP_INDEX(field
) != ep_index
);
720 BUG_ON(*(void **)(uintptr_t)le64_to_cpu(event
->trans_event
.buffer
) -
721 buffer
> (size_t)length
);
723 record_transfer_result(udev
, event
, length
);
724 xhci_acknowledge_event(ctrl
);
725 xhci_inval_cache((uint32_t)buffer
, length
);
727 return (udev
->status
!= USB_ST_NOT_PROC
) ? 0 : -1;
731 * Queues up the Control Transfer Request
733 * @param udev pointer to the USB device structure
734 * @param pipe contains the DIR_IN or OUT , devnum
735 * @param req request type
736 * @param length length of the buffer
737 * @param buffer buffer to be read/written based on the request
738 * @return returns 0 if successful else error code on failure
740 int xhci_ctrl_tx(struct usb_device
*udev
, unsigned long pipe
,
741 struct devrequest
*req
, int length
,
750 struct xhci_generic_trb
*start_trb
;
751 struct xhci_ctrl
*ctrl
= udev
->controller
;
752 int slot_id
= udev
->slot_id
;
755 struct xhci_virt_device
*virt_dev
= ctrl
->devs
[slot_id
];
756 struct xhci_ring
*ep_ring
;
757 union xhci_trb
*event
;
759 debug("req=%u (%#x), type=%u (%#x), value=%u (%#x), index=%u\n",
760 req
->request
, req
->request
,
761 req
->requesttype
, req
->requesttype
,
762 le16_to_cpu(req
->value
), le16_to_cpu(req
->value
),
763 le16_to_cpu(req
->index
));
765 ep_index
= usb_pipe_ep_index(pipe
);
767 ep_ring
= virt_dev
->eps
[ep_index
].ring
;
770 * Check to see if the max packet size for the default control
771 * endpoint changed during FS device enumeration
773 if (udev
->speed
== USB_SPEED_FULL
) {
774 ret
= xhci_check_maxpacket(udev
);
779 xhci_inval_cache((uint32_t)virt_dev
->out_ctx
->bytes
,
780 virt_dev
->out_ctx
->size
);
782 struct xhci_ep_ctx
*ep_ctx
= NULL
;
783 ep_ctx
= xhci_get_ep_ctx(ctrl
, virt_dev
->out_ctx
, ep_index
);
785 /* 1 TRB for setup, 1 for status */
788 * Don't need to check if we need additional event data and normal TRBs,
789 * since data in control transfers will never get bigger than 16MB
790 * XXX: can we get a buffer that crosses 64KB boundaries?
796 * XXX: Calling routine prepare_ring() called in place of
797 * prepare_trasfer() as there in 'Linux' since we are not
798 * maintaining multiple TDs/transfer at the same time.
800 ret
= prepare_ring(ctrl
, ep_ring
,
801 le32_to_cpu(ep_ctx
->ep_info
) & EP_STATE_MASK
);
807 * Don't give the first TRB to the hardware (by toggling the cycle bit)
808 * until we've finished creating all the other TRBs. The ring's cycle
809 * state may change as we enqueue the other TRBs, so save it too.
811 start_trb
= &ep_ring
->enqueue
->generic
;
812 start_cycle
= ep_ring
->cycle_state
;
814 debug("start_trb %p, start_cycle %d\n", start_trb
, start_cycle
);
816 /* Queue setup TRB - see section 6.4.1.2.1 */
817 /* FIXME better way to translate setup_packet into two u32 fields? */
819 field
|= TRB_IDT
| (TRB_SETUP
<< TRB_TYPE_SHIFT
);
820 if (start_cycle
== 0)
823 /* xHCI 1.0 6.4.1.2.1: Transfer Type field */
824 if (HC_VERSION(xhci_readl(&ctrl
->hccr
->cr_capbase
)) == 0x100) {
826 if (req
->requesttype
& USB_DIR_IN
)
827 field
|= (TRB_DATA_IN
<< TRB_TX_TYPE_SHIFT
);
829 field
|= (TRB_DATA_OUT
<< TRB_TX_TYPE_SHIFT
);
833 debug("req->requesttype = %d, req->request = %d,"
834 "le16_to_cpu(req->value) = %d,"
835 "le16_to_cpu(req->index) = %d,"
836 "le16_to_cpu(req->length) = %d\n",
837 req
->requesttype
, req
->request
, le16_to_cpu(req
->value
),
838 le16_to_cpu(req
->index
), le16_to_cpu(req
->length
));
840 trb_fields
[0] = req
->requesttype
| req
->request
<< 8 |
841 le16_to_cpu(req
->value
) << 16;
842 trb_fields
[1] = le16_to_cpu(req
->index
) |
843 le16_to_cpu(req
->length
) << 16;
844 /* TRB_LEN | (TRB_INTR_TARGET) */
845 trb_fields
[2] = (8 | ((0 & TRB_INTR_TARGET_MASK
) <<
846 TRB_INTR_TARGET_SHIFT
));
847 /* Immediate data in pointer */
848 trb_fields
[3] = field
;
849 queue_trb(ctrl
, ep_ring
, true, trb_fields
);
851 /* Re-initializing field to zero */
853 /* If there's data, queue data TRBs */
854 /* Only set interrupt on short packet for IN endpoints */
855 if (usb_pipein(pipe
))
856 field
= TRB_ISP
| (TRB_DATA
<< TRB_TYPE_SHIFT
);
858 field
= (TRB_DATA
<< TRB_TYPE_SHIFT
);
860 length_field
= (length
& TRB_LEN_MASK
) | xhci_td_remainder(length
) |
861 ((0 & TRB_INTR_TARGET_MASK
) << TRB_INTR_TARGET_SHIFT
);
862 debug("length_field = %d, length = %d,"
863 "xhci_td_remainder(length) = %d , TRB_INTR_TARGET(0) = %d\n",
864 length_field
, (length
& TRB_LEN_MASK
),
865 xhci_td_remainder(length
), 0);
868 if (req
->requesttype
& USB_DIR_IN
)
870 buf_64
= (uintptr_t)buffer
;
872 trb_fields
[0] = lower_32_bits(buf_64
);
873 trb_fields
[1] = upper_32_bits(buf_64
);
874 trb_fields
[2] = length_field
;
875 trb_fields
[3] = field
| ep_ring
->cycle_state
;
877 xhci_flush_cache((uint32_t)buffer
, length
);
878 queue_trb(ctrl
, ep_ring
, true, trb_fields
);
883 * see Table 7 and sections 4.11.2.2 and 6.4.1.2.3
886 /* If the device sent data, the status stage is an OUT transfer */
888 if (length
> 0 && req
->requesttype
& USB_DIR_IN
)
895 trb_fields
[2] = ((0 & TRB_INTR_TARGET_MASK
) << TRB_INTR_TARGET_SHIFT
);
896 /* Event on completion */
897 trb_fields
[3] = field
| TRB_IOC
|
898 (TRB_STATUS
<< TRB_TYPE_SHIFT
) |
899 ep_ring
->cycle_state
;
901 queue_trb(ctrl
, ep_ring
, false, trb_fields
);
903 giveback_first_trb(udev
, ep_index
, start_cycle
, start_trb
);
905 event
= xhci_wait_for_event(ctrl
, TRB_TRANSFER
);
908 field
= le32_to_cpu(event
->trans_event
.flags
);
910 BUG_ON(TRB_TO_SLOT_ID(field
) != slot_id
);
911 BUG_ON(TRB_TO_EP_INDEX(field
) != ep_index
);
913 record_transfer_result(udev
, event
, length
);
914 xhci_acknowledge_event(ctrl
);
916 /* Invalidate buffer to make it available to usb-core */
918 xhci_inval_cache((uint32_t)buffer
, length
);
920 if (GET_COMP_CODE(le32_to_cpu(event
->trans_event
.transfer_len
))
922 /* Short data stage, clear up additional status stage event */
923 event
= xhci_wait_for_event(ctrl
, TRB_TRANSFER
);
926 BUG_ON(TRB_TO_SLOT_ID(field
) != slot_id
);
927 BUG_ON(TRB_TO_EP_INDEX(field
) != ep_index
);
928 xhci_acknowledge_event(ctrl
);
931 return (udev
->status
!= USB_ST_NOT_PROC
) ? 0 : -1;
934 debug("XHCI control transfer timed out, aborting...\n");
935 abort_td(udev
, ep_index
);
936 udev
->status
= USB_ST_NAK_REC
;