drivers/xen/usbfront/usbfront.c

   1 /*
   2  * Xen Virtual USB Frontend Driver
   3  *
   4  * This file contains the first version of the Xen virtual USB hub
   5  * that I've managed not to delete by mistake (3rd time lucky!).
   6  *
   7  * Based on Linux's uhci.c, original copyright notices are displayed
   8  * below.  Portions also (c) 2004 Intel Research Cambridge
   9  * and (c) 2004, 2005 Mark Williamson
  10  *
  11  * Contact <mark.williamson@cl.cam.ac.uk> or
  12  * <xen-devel@lists.sourceforge.net> regarding this code.
  13  *
  14  * Still to be (maybe) implemented:
  15  * - migration / backend restart support?
  16  * - support for building / using as a module
  17  */
  18
  19 /*
  20  * Universal Host Controller Interface driver for USB.
  21  *
  22  * Maintainer: Johannes Erdfelt <johannes@erdfelt.com>
  23  *
  24  * (C) Copyright 1999 Linus Torvalds
  25  * (C) Copyright 1999-2002 Johannes Erdfelt, johannes@erdfelt.com
  26  * (C) Copyright 1999 Randy Dunlap
  27  * (C) Copyright 1999 Georg Acher, acher@in.tum.de
  28  * (C) Copyright 1999 Deti Fliegl, deti@fliegl.de
  29  * (C) Copyright 1999 Thomas Sailer, sailer@ife.ee.ethz.ch
  30  * (C) Copyright 1999 Roman Weissgaerber, weissg@vienna.at
  31  * (C) Copyright 2000 Yggdrasil Computing, Inc. (port of new PCI interface
  32  *               support from usb-ohci.c by Adam Richter, adam@yggdrasil.com).
  33  * (C) Copyright 1999 Gregory P. Smith (from usb-ohci.c)
  34  *
  35  * Intel documents this fairly well, and as far as I know there
  36  * are no royalties or anything like that, but even so there are
  37  * people who decided that they want to do the same thing in a
  38  * completely different way.
  39  *
  40  * WARNING! The USB documentation is downright evil. Most of it
  41  * is just crap, written by a committee. You're better off ignoring
  42  * most of it, the important stuff is:
  43  *  - the low-level protocol (fairly simple but lots of small details)
  44  *  - working around the horridness of the rest
  45  */
  46
  47 #include <linux/config.h>
  48 #include <linux/module.h>
  49 #include <linux/kernel.h>
  50 #include <linux/init.h>
  51 #include <linux/sched.h>
  52 #include <linux/delay.h>
  53 #include <linux/slab.h>
  54 #include <linux/smp_lock.h>
  55 #include <linux/errno.h>
  56 #include <linux/interrupt.h>
  57 #include <linux/spinlock.h>
  58 #ifdef CONFIG_USB_DEBUG
  59 #define DEBUG
  60 #else
  61 #undef DEBUG
  62 #endif
  63 #include <linux/usb.h>
  64
  65 #include <asm/irq.h>
  66 #include <asm/system.h>
  67
  68 #include "xhci.h"
  69
  70 #include "../../../../../drivers/usb/hcd.h"
  71
  72 #include <asm-xen/xen-public/io/usbif.h>
  73 #include <asm/ctrl_if.h>
  74 #include <asm/xen-public/io/domain_controller.h>
  75
  76 /*
  77  * Version Information
  78  */
  79 #define DRIVER_VERSION "v1.0"
  80 #define DRIVER_AUTHOR "Linus 'Frodo Rabbit' Torvalds, Johannes Erdfelt, " \
  81                       "Randy Dunlap, Georg Acher, Deti Fliegl, " \
  82                       "Thomas Sailer, Roman Weissgaerber, Mark Williamson"
  83 #define DRIVER_DESC "Xen Virtual USB Host Controller Interface"
  84
  85 /*
  86  * debug = 0, no debugging messages
  87  * debug = 1, dump failed URB's except for stalls
  88  * debug = 2, dump all failed URB's (including stalls)
  89  */
  90 #ifdef DEBUG
  91 static int debug = 1;
  92 #else
  93 static int debug = 0;
  94 #endif
  95 MODULE_PARM(debug, "i");
  96 MODULE_PARM_DESC(debug, "Debug level");
  97 static char *errbuf;
  98 #define ERRBUF_LEN    (PAGE_SIZE * 8)
  99
 100 static int rh_submit_urb(struct urb *urb);
 101 static int rh_unlink_urb(struct urb *urb);
 102 static int xhci_unlink_urb(struct urb *urb);
 103 static void xhci_call_completion(struct urb *urb);
 104 static void xhci_drain_ring(void);
 105 static void xhci_transfer_result(struct xhci *xhci, struct urb *urb);
 106 static void xhci_finish_completion(void);
 107
 108 #define MAX_URB_LOOP    2048            /* Maximum number of linked URB's */
 109
 110 static kmem_cache_t *xhci_up_cachep;    /* urb_priv cache */
 111 static struct xhci *xhci;               /* XHCI structure for the interface */
 112
 113 /******************************************************************************
 114  * DEBUGGING
 115  */
 116
 117 #ifdef DEBUG
 118
 119 static void dump_urb(struct urb *urb)
 120 {
 121     printk(KERN_DEBUG "dumping urb @ %p\n"
 122            "  hcpriv = %p\n"
 123            "  next = %p\n"
 124            "  dev = %p\n"
 125            "  pipe = 0x%lx\n"
 126            "  status = %d\n"
 127            "  transfer_flags = 0x%lx\n"
 128            "  transfer_buffer = %p\n"
 129            "  transfer_buffer_length = %d\n"
 130            "  actual_length = %d\n"
 131            "  bandwidth = %d\n"
 132            "  setup_packet = %p\n",
 133            urb, urb->hcpriv, urb->next, urb->dev, urb->pipe, urb->status,
 134            urb->transfer_flags, urb->transfer_buffer,
 135            urb->transfer_buffer_length, urb->actual_length, urb->bandwidth,
 136            urb->setup_packet);
 137     if ( urb->setup_packet != NULL )
 138         printk(KERN_DEBUG
 139                "setup = { 0x%x, 0x%x, 0x%x, 0x%x, 0x%x, 0x%x, 0x%x, 0x%x }\n",
 140                urb->setup_packet[0], urb->setup_packet[1],
 141                urb->setup_packet[2], urb->setup_packet[3],
 142                urb->setup_packet[4], urb->setup_packet[5],
 143                urb->setup_packet[6], urb->setup_packet[7]);
 144     printk(KERN_DEBUG "complete = %p\n"
 145            "interval = %d\n", urb->complete, urb->interval);
 146
 147 }
 148
 149 static void xhci_show_resp(usbif_response_t *r)
 150 {
 151         printk(KERN_DEBUG "dumping response @ %p\n"
 152                "  id=0x%lx\n"
 153                "  op=0x%x\n"
 154                "  data=0x%x\n"
 155                "  status=0x%x\n"
 156                "  length=0x%lx\n",
 157                r->id, r->operation, r->data, r->status, r->length);
 158 }
 159
 160 #define DPRINK(...) printk(KERN_DEBUG __VA_ARGS__)
 161
 162 #else /* DEBUG */
 163
 164 #define dump_urb(blah) ((void)0)
 165 #define xhci_show_resp(blah) ((void)0)
 166 #define DPRINTK(blah,...) ((void)0)
 167
 168 #endif /* DEBUG */
 169
 170 /******************************************************************************
 171  * RING REQUEST HANDLING
 172  */
 173
 174 #define RING_PLUGGED(_hc) ( RING_FULL(&_hc->usb_ring) || _hc->recovery )
 175
 176 /**
 177  * xhci_construct_isoc - add isochronous information to a request
 178  */
 179 static int xhci_construct_isoc(usbif_request_t *req, struct urb *urb)
 180 {
 181         usbif_iso_t *schedule;
 182         int i;
 183         struct urb_priv *urb_priv = urb->hcpriv;
 184
 185         req->num_iso = urb->number_of_packets;
 186         schedule = (usbif_iso_t *)__get_free_page(GFP_KERNEL);
 187
 188         if ( schedule == NULL )
 189             return -ENOMEM;
 190
 191         for ( i = 0; i < req->num_iso; i++ )
 192         {
 193                 schedule[i].buffer_offset = urb->iso_frame_desc[i].offset;
 194                 schedule[i].length = urb->iso_frame_desc[i].length;
 195         }
 196
 197         urb_priv->schedule = schedule;
 198         req->iso_schedule = virt_to_machine(schedule);
 199
 200         return 0;
 201 }
 202
 203 /**
 204  * xhci_queue_req - construct and queue request for an URB
 205  */
 206 static int xhci_queue_req(struct urb *urb)
 207 {
 208         unsigned long flags;
 209         usbif_request_t *req;
 210         usbif_front_ring_t *usb_ring = &xhci->usb_ring;
 211
 212 #if DEBUG
 213         printk(KERN_DEBUG
 214                "usbif = %p, req_prod = %d (@ 0x%lx), resp_prod = %d, resp_cons = %d\n",
 215                usbif, usbif->req_prod, virt_to_machine(&usbif->req_prod),
 216                usbif->resp_prod, xhci->usb_resp_cons);
 217 #endif
 218
 219         spin_lock_irqsave(&xhci->ring_lock, flags);
 220
 221         if ( RING_PLUGGED(xhci) )
 222         {
 223                 printk(KERN_WARNING
 224                        "xhci_queue_req(): USB ring plugged, not queuing request\n");
 225                 spin_unlock_irqrestore(&xhci->ring_lock, flags);
 226                 return -ENOBUFS;
 227         }
 228
 229         /* Stick something in the shared communications ring. */
 230         req = RING_GET_REQUEST(usb_ring, usb_ring->req_prod_pvt);
 231
 232         req->operation       = USBIF_OP_IO;
 233         req->port            = 0; /* We don't care what the port is. */
 234         req->id              = (unsigned long) urb->hcpriv;
 235         req->transfer_buffer = virt_to_machine(urb->transfer_buffer);
 236         req->devnum          = usb_pipedevice(urb->pipe);
 237         req->direction       = usb_pipein(urb->pipe);
 238         req->speed           = usb_pipeslow(urb->pipe);
 239         req->pipe_type       = usb_pipetype(urb->pipe);
 240         req->length          = urb->transfer_buffer_length;
 241         req->transfer_flags  = urb->transfer_flags;
 242         req->endpoint        = usb_pipeendpoint(urb->pipe);
 243         req->speed           = usb_pipeslow(urb->pipe);
 244         req->timeout         = urb->timeout * (1000 / HZ);
 245
 246         if ( usb_pipetype(urb->pipe) == 0 ) /* ISO */
 247         {
 248             int ret = xhci_construct_isoc(req, urb);
 249             if ( ret != 0 )
 250                 return ret;
 251         }
 252
 253         if(urb->setup_packet != NULL)
 254                 memcpy(req->setup, urb->setup_packet, 8);
 255         else
 256                 memset(req->setup, 0, 8);
 257
 258         usb_ring->req_prod_pvt++;
 259         RING_PUSH_REQUESTS(usb_ring);
 260
 261         spin_unlock_irqrestore(&xhci->ring_lock, flags);
 262
 263         notify_via_evtchn(xhci->evtchn);
 264
 265         DPRINTK("Queued request for an URB.\n");
 266         dump_urb(urb);
 267
 268         return -EINPROGRESS;
 269 }
 270
 271 /**
 272  * xhci_queue_probe - queue a probe request for a particular port
 273  */
 274 static inline usbif_request_t *xhci_queue_probe(usbif_vdev_t port)
 275 {
 276         usbif_request_t *req;
 277         usbif_front_ring_t *usb_ring = &xhci->usb_ring;
 278
 279 #if DEBUG
 280         printk(KERN_DEBUG
 281                "queuing probe: req_prod = %d (@ 0x%lx), resp_prod = %d, "
 282                "resp_cons = %d\n", usbif->req_prod,
 283                virt_to_machine(&usbif->req_prod),
 284                usbif->resp_prod, xhci->usb_resp_cons);
 285 #endif
 286
 287         /* This is always called from the timer interrupt. */
 288         spin_lock(&xhci->ring_lock);
 289
 290         if ( RING_PLUGGED(xhci) )
 291         {
 292                 printk(KERN_WARNING
 293                        "xhci_queue_probe(): ring full, not queuing request\n");
 294                 spin_unlock(&xhci->ring_lock);
 295                 return NULL;
 296         }
 297
 298         /* Stick something in the shared communications ring. */
 299         req = RING_GET_REQUEST(usb_ring, usb_ring->req_prod_pvt);
 300
 301         memset(req, 0, sizeof(*req));
 302
 303         req->operation       = USBIF_OP_PROBE;
 304         req->port            = port;
 305
 306         usb_ring->req_prod_pvt++;
 307         RING_PUSH_REQUESTS(usb_ring);
 308
 309         spin_unlock(&xhci->ring_lock);
 310
 311         notify_via_evtchn(xhci->evtchn);
 312
 313         return req;
 314 }
 315
 316 /**
 317  * xhci_port_reset - queue a reset request for a particular port
 318  */
 319 static int xhci_port_reset(usbif_vdev_t port)
 320 {
 321         usbif_request_t *req;
 322         usbif_front_ring_t *usb_ring = &xhci->usb_ring;
 323
 324         /* Only ever happens from process context (hub thread). */
 325         spin_lock_irq(&xhci->ring_lock);
 326
 327         if ( RING_PLUGGED(xhci) )
 328         {
 329                 printk(KERN_WARNING
 330                        "xhci_port_reset(): ring plugged, not queuing request\n");
 331                 spin_unlock_irq(&xhci->ring_lock);
 332                 return -ENOBUFS;
 333         }
 334
 335         /* We only reset one port at a time, so we only need one variable per
 336          * hub. */
 337         xhci->awaiting_reset = 1;
 338
 339         /* Stick something in the shared communications ring. */
 340         req = RING_GET_REQUEST(usb_ring, usb_ring->req_prod_pvt);
 341
 342         memset(req, 0, sizeof(*req));
 343
 344         req->operation       = USBIF_OP_RESET;
 345         req->port            = port;
 346
 347         usb_ring->req_prod_pvt++;
 348         RING_PUSH_REQUESTS(usb_ring);
 349
 350         spin_unlock_irq(&xhci->ring_lock);
 351
 352         notify_via_evtchn(xhci->evtchn);
 353
 354         while ( xhci->awaiting_reset > 0 )
 355         {
 356                 mdelay(1);
 357                 xhci_drain_ring();
 358         }
 359
 360         xhci->rh.ports[port].pe = 1;
 361         xhci->rh.ports[port].pe_chg = 1;
 362
 363         return xhci->awaiting_reset;
 364 }
 365
 366
 367 /******************************************************************************
 368  * RING RESPONSE HANDLING
 369  */
 370
 371 static void receive_usb_reset(usbif_response_t *resp)
 372 {
 373     xhci->awaiting_reset = resp->status;
 374     rmb();
 375
 376 }
 377
 378 static void receive_usb_probe(usbif_response_t *resp)
 379 {
 380     spin_lock(&xhci->rh.port_state_lock);
 381
 382     if ( resp->status >= 0 )
 383     {
 384         if ( resp->status == 1 )
 385         {
 386             /* If theres a device there and there wasn't one before there must
 387              * have been a connection status change. */
 388             if( xhci->rh.ports[resp->data].cs == 0 )
 389             {
 390                 xhci->rh.ports[resp->data].cs = 1;
 391                 xhci->rh.ports[resp->data].cs_chg = 1;
 392             }
 393         }
 394         else if ( resp->status == 0 )
 395         {
 396             if(xhci->rh.ports[resp->data].cs == 1 )
 397             {
 398                 xhci->rh.ports[resp->data].cs  = 0;
 399                 xhci->rh.ports[resp->data].cs_chg = 1;
 400                 xhci->rh.ports[resp->data].pe = 0;
 401                 /* According to USB Spec v2.0, 11.24.2.7.2.2, we don't need
 402                  * to set pe_chg since an error has not occurred. */
 403             }
 404         }
 405         else
 406             printk(KERN_WARNING "receive_usb_probe(): unexpected status %d "
 407                    "for port %d\n", resp->status, resp->data);
 408     }
 409     else if ( resp->status < 0)
 410         printk(KERN_WARNING "receive_usb_probe(): got error status %d\n",
 411                resp->status);
 412
 413     spin_unlock(&xhci->rh.port_state_lock);
 414 }
 415
 416 static void receive_usb_io(usbif_response_t *resp)
 417 {
 418         struct urb_priv *urbp = (struct urb_priv *)resp->id;
 419         struct urb *urb = urbp->urb;
 420
 421         urb->actual_length = resp->length;
 422         urbp->in_progress = 0;
 423
 424         if( usb_pipetype(urb->pipe) == 0 ) /* ISO */
 425         {
 426                 int i;
 427
 428                 /* Copy ISO schedule results back in. */
 429                 for ( i = 0; i < urb->number_of_packets; i++ )
 430                 {
 431                         urb->iso_frame_desc[i].status
 432                                 = urbp->schedule[i].status;
 433                         urb->iso_frame_desc[i].actual_length
 434                                 = urbp->schedule[i].length;
 435                 }
 436                 free_page((unsigned long)urbp->schedule);
 437         }
 438
 439         /* Only set status if it's not been changed since submission.  It might
 440          * have been changed if the URB has been unlinked asynchronously, for
 441          * instance. */
 442         if ( urb->status == -EINPROGRESS )
 443                 urbp->status = urb->status = resp->status;
 444 }
 445
 446 /**
 447  * xhci_drain_ring - drain responses from the ring, calling handlers
 448  *
 449  * This may be called from interrupt context when an event is received from the
 450  * backend domain, or sometimes in process context whilst waiting for a port
 451  * reset or URB completion.
 452  */
 453 static void xhci_drain_ring(void)
 454 {
 455         struct list_head *tmp, *head;
 456         usbif_front_ring_t *usb_ring = &xhci->usb_ring;
 457         usbif_response_t *resp;
 458         RING_IDX i, rp;
 459
 460         /* Walk the ring here to get responses, updating URBs to show what
 461          * completed. */
 462
 463         rp = usb_ring->sring->rsp_prod;
 464         rmb(); /* Ensure we see queued requests up to 'rp'. */
 465
 466         /* Take items off the comms ring, taking care not to overflow. */
 467         for ( i = usb_ring->rsp_cons; i != rp; i++ )
 468         {
 469             resp = RING_GET_RESPONSE(usb_ring, i);
 470
 471             /* May need to deal with batching and with putting a ceiling on
 472                the number dispatched for performance and anti-dos reasons */
 473
 474             xhci_show_resp(resp);
 475
 476             switch ( resp->operation )
 477             {
 478             case USBIF_OP_PROBE:
 479                 receive_usb_probe(resp);
 480                 break;
 481
 482             case USBIF_OP_IO:
 483                 receive_usb_io(resp);
 484                 break;
 485
 486             case USBIF_OP_RESET:
 487                 receive_usb_reset(resp);
 488                 break;
 489
 490             default:
 491                 printk(KERN_WARNING
 492                        "error: unknown USB io operation response [%d]\n",
 493                        resp->operation);
 494                 break;
 495             }
 496         }
 497
 498         usb_ring->rsp_cons = i;
 499
 500         /* Walk the list of pending URB's to see which ones completed and do
 501          * callbacks, etc. */
 502         spin_lock(&xhci->urb_list_lock);
 503         head = &xhci->urb_list;
 504         tmp = head->next;
 505         while (tmp != head) {
 506                 struct urb *urb = list_entry(tmp, struct urb, urb_list);
 507
 508                 tmp = tmp->next;
 509
 510                 /* Checks the status and does all of the magic necessary */
 511                 xhci_transfer_result(xhci, urb);
 512         }
 513         spin_unlock(&xhci->urb_list_lock);
 514
 515         xhci_finish_completion();
 516 }
 517
 518
 519 static void xhci_interrupt(int irq, void *__xhci, struct pt_regs *regs)
 520 {
 521         xhci_drain_ring();
 522 }
 523
 524 /******************************************************************************
 525  * HOST CONTROLLER FUNCTIONALITY
 526  */
 527
 528 /**
 529  * no-op implementation of private device alloc / free routines
 530  */
 531 static int xhci_do_nothing_dev(struct usb_device *dev)
 532 {
 533         return 0;
 534 }
 535
 536 static inline void xhci_add_complete(struct urb *urb)
 537 {
 538         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
 539         unsigned long flags;
 540
 541         spin_lock_irqsave(&xhci->complete_list_lock, flags);
 542         list_add_tail(&urbp->complete_list, &xhci->complete_list);
 543         spin_unlock_irqrestore(&xhci->complete_list_lock, flags);
 544 }
 545
 546 /* When this returns, the owner of the URB may free its
 547  * storage.
 548  *
 549  * We spin and wait for the URB to complete before returning.
 550  *
 551  * Call with urb->lock acquired.
 552  */
 553 static void xhci_delete_urb(struct urb *urb)
 554 {
 555         struct urb_priv *urbp;
 556
 557         urbp = urb->hcpriv;
 558
 559         /* If there's no urb_priv structure for this URB then it can't have
 560          * been submitted at all. */
 561         if ( urbp == NULL )
 562                 return;
 563
 564         /* For now we just spin until the URB completes.  It shouldn't take too
 565          * long and we don't expect to have to do this very often. */
 566         while ( urb->status == -EINPROGRESS )
 567         {
 568             xhci_drain_ring();
 569             mdelay(1);
 570         }
 571
 572         /* Now we know that further transfers to the buffer won't
 573          * occur, so we can safely return. */
 574 }
 575
 576 static struct urb_priv *xhci_alloc_urb_priv(struct urb *urb)
 577 {
 578         struct urb_priv *urbp;
 579
 580         urbp = kmem_cache_alloc(xhci_up_cachep, SLAB_ATOMIC);
 581         if (!urbp) {
 582                 err("xhci_alloc_urb_priv: couldn't allocate memory for urb_priv\n");
 583                 return NULL;
 584         }
 585
 586         memset((void *)urbp, 0, sizeof(*urbp));
 587
 588         urbp->inserttime = jiffies;
 589         urbp->urb = urb;
 590         urbp->dev = urb->dev;
 591
 592         INIT_LIST_HEAD(&urbp->complete_list);
 593
 594         urb->hcpriv = urbp;
 595
 596         return urbp;
 597 }
 598
 599 /*
 600  * MUST be called with urb->lock acquired
 601  */
 602 /* When is this called?  Do we need to stop the transfer (as we
 603  * currently do)? */
 604 static void xhci_destroy_urb_priv(struct urb *urb)
 605 {
 606     struct urb_priv *urbp;
 607
 608     urbp = (struct urb_priv *)urb->hcpriv;
 609     if (!urbp)
 610         return;
 611
 612     if (!list_empty(&urb->urb_list))
 613         warn("xhci_destroy_urb_priv: urb %p still on xhci->urb_list", urb);
 614
 615     if (!list_empty(&urbp->complete_list))
 616         warn("xhci_destroy_urb_priv: urb %p still on xhci->complete_list", urb);
 617
 618     kmem_cache_free(xhci_up_cachep, urb->hcpriv);
 619
 620     urb->hcpriv = NULL;
 621 }
 622
 623 /**
 624  * Try to find URBs in progress on the same pipe to the same device.
 625  *
 626  * MUST be called with xhci->urb_list_lock acquired
 627  */
 628 static struct urb *xhci_find_urb_ep(struct xhci *xhci, struct urb *urb)
 629 {
 630         struct list_head *tmp, *head;
 631
 632         /* We don't match Isoc transfers since they are special */
 633         if (usb_pipeisoc(urb->pipe))
 634                 return NULL;
 635
 636         head = &xhci->urb_list;
 637         tmp = head->next;
 638         while (tmp != head) {
 639                 struct urb *u = list_entry(tmp, struct urb, urb_list);
 640
 641                 tmp = tmp->next;
 642
 643                 if (u->dev == urb->dev && u->pipe == urb->pipe &&
 644                     u->status == -EINPROGRESS)
 645                         return u;
 646         }
 647
 648         return NULL;
 649 }
 650
 651 static int xhci_submit_urb(struct urb *urb)
 652 {
 653         int ret = -EINVAL;
 654         unsigned long flags;
 655         struct urb *eurb;
 656         int bustime;
 657
 658         DPRINTK("URB submitted to XHCI driver.\n");
 659         dump_urb(urb);
 660
 661         if (!urb)
 662                 return -EINVAL;
 663
 664         if (!urb->dev || !urb->dev->bus || !urb->dev->bus->hcpriv) {
 665                 warn("xhci_submit_urb: urb %p belongs to disconnected device or bus?", urb);
 666                 return -ENODEV;
 667         }
 668
 669         if ( urb->dev->devpath == NULL )
 670                 BUG();
 671
 672         usb_inc_dev_use(urb->dev);
 673
 674         spin_lock_irqsave(&xhci->urb_list_lock, flags);
 675         spin_lock(&urb->lock);
 676
 677         if (urb->status == -EINPROGRESS || urb->status == -ECONNRESET ||
 678             urb->status == -ECONNABORTED) {
 679                 dbg("xhci_submit_urb: urb not available to submit (status = %d)", urb->status);
 680                 /* Since we can have problems on the out path */
 681                 spin_unlock(&urb->lock);
 682                 spin_unlock_irqrestore(&xhci->urb_list_lock, flags);
 683                 usb_dec_dev_use(urb->dev);
 684
 685                 return ret;
 686         }
 687
 688         INIT_LIST_HEAD(&urb->urb_list);
 689         if (!xhci_alloc_urb_priv(urb)) {
 690                 ret = -ENOMEM;
 691
 692                 goto out;
 693         }
 694
 695         ( (struct urb_priv *)urb->hcpriv )->in_progress = 1;
 696
 697         eurb = xhci_find_urb_ep(xhci, urb);
 698         if (eurb && !(urb->transfer_flags & USB_QUEUE_BULK)) {
 699                 ret = -ENXIO;
 700
 701                 goto out;
 702         }
 703
 704         /* Short circuit the virtual root hub */
 705         if (urb->dev == xhci->rh.dev) {
 706                 ret = rh_submit_urb(urb);
 707
 708                 goto out;
 709         }
 710
 711         switch (usb_pipetype(urb->pipe)) {
 712         case PIPE_CONTROL:
 713         case PIPE_BULK:
 714                 ret = xhci_queue_req(urb);
 715                 break;
 716
 717         case PIPE_INTERRUPT:
 718                 if (urb->bandwidth == 0) {      /* not yet checked/allocated */
 719                         bustime = usb_check_bandwidth(urb->dev, urb);
 720                         if (bustime < 0)
 721                                 ret = bustime;
 722                         else {
 723                                 ret = xhci_queue_req(urb);
 724                                 if (ret == -EINPROGRESS)
 725                                         usb_claim_bandwidth(urb->dev, urb,
 726                                                             bustime, 0);
 727                         }
 728                 } else          /* bandwidth is already set */
 729                         ret = xhci_queue_req(urb);
 730                 break;
 731
 732         case PIPE_ISOCHRONOUS:
 733                 if (urb->bandwidth == 0) {      /* not yet checked/allocated */
 734                         if (urb->number_of_packets <= 0) {
 735                                 ret = -EINVAL;
 736                                 break;
 737                         }
 738                         bustime = usb_check_bandwidth(urb->dev, urb);
 739                         if (bustime < 0) {
 740                                 ret = bustime;
 741                                 break;
 742                         }
 743
 744                         ret = xhci_queue_req(urb);
 745                         if (ret == -EINPROGRESS)
 746                                 usb_claim_bandwidth(urb->dev, urb, bustime, 1);
 747                 } else          /* bandwidth is already set */
 748                         ret = xhci_queue_req(urb);
 749                 break;
 750         }
 751 out:
 752         urb->status = ret;
 753
 754         if (ret == -EINPROGRESS) {
 755                 /* We use _tail to make find_urb_ep more efficient */
 756                 list_add_tail(&urb->urb_list, &xhci->urb_list);
 757
 758                 spin_unlock(&urb->lock);
 759                 spin_unlock_irqrestore(&xhci->urb_list_lock, flags);
 760
 761                 return 0;
 762         }
 763
 764         xhci_delete_urb(urb);
 765
 766         spin_unlock(&urb->lock);
 767         spin_unlock_irqrestore(&xhci->urb_list_lock, flags);
 768
 769         /* Only call completion if it was successful */
 770         if (!ret)
 771                 xhci_call_completion(urb);
 772
 773         return ret;
 774 }
 775
 776 /*
 777  * Return the result of a transfer
 778  *
 779  * MUST be called with urb_list_lock acquired
 780  */
 781 static void xhci_transfer_result(struct xhci *xhci, struct urb *urb)
 782 {
 783         int ret = 0;
 784         unsigned long flags;
 785         struct urb_priv *urbp;
 786
 787         /* The root hub is special */
 788         if (urb->dev == xhci->rh.dev)
 789                 return;
 790
 791         spin_lock_irqsave(&urb->lock, flags);
 792
 793         urbp = (struct urb_priv *)urb->hcpriv;
 794
 795         if ( ( (struct urb_priv *)urb->hcpriv )->in_progress )
 796                 ret = -EINPROGRESS;
 797
 798         if (urb->actual_length < urb->transfer_buffer_length) {
 799                 if (urb->transfer_flags & USB_DISABLE_SPD) {
 800                         ret = -EREMOTEIO;
 801                 }
 802         }
 803
 804         if (urb->status == -EPIPE)
 805         {
 806                 ret = urb->status;
 807                 /* endpoint has stalled - mark it halted */
 808                 usb_endpoint_halt(urb->dev, usb_pipeendpoint(urb->pipe),
 809                                   usb_pipeout(urb->pipe));
 810         }
 811
 812         if ((debug == 1 && ret != 0 && ret != -EPIPE) ||
 813             (ret != 0 && debug > 1)) {
 814                 /* Some debugging code */
 815                 dbg("xhci_result_interrupt/bulk() failed with status %x",
 816                         status);
 817         }
 818
 819         if (ret == -EINPROGRESS)
 820                 goto out;
 821
 822         switch (usb_pipetype(urb->pipe)) {
 823         case PIPE_CONTROL:
 824         case PIPE_BULK:
 825         case PIPE_ISOCHRONOUS:
 826                 /* Release bandwidth for Interrupt or Isoc. transfers */
 827                 /* Spinlock needed ? */
 828                 if (urb->bandwidth)
 829                         usb_release_bandwidth(urb->dev, urb, 1);
 830                 xhci_delete_urb(urb);
 831                 break;
 832         case PIPE_INTERRUPT:
 833                 /* Interrupts are an exception */
 834                 if (urb->interval)
 835                         goto out_complete;
 836
 837                 /* Release bandwidth for Interrupt or Isoc. transfers */
 838                 /* Spinlock needed ? */
 839                 if (urb->bandwidth)
 840                         usb_release_bandwidth(urb->dev, urb, 0);
 841                 xhci_delete_urb(urb);
 842                 break;
 843         default:
 844                 info("xhci_transfer_result: unknown pipe type %d for urb %p\n",
 845                      usb_pipetype(urb->pipe), urb);
 846         }
 847
 848         /* Remove it from xhci->urb_list */
 849         list_del_init(&urb->urb_list);
 850
 851 out_complete:
 852         xhci_add_complete(urb);
 853
 854 out:
 855         spin_unlock_irqrestore(&urb->lock, flags);
 856 }
 857
 858 static int xhci_unlink_urb(struct urb *urb)
 859 {
 860         unsigned long flags;
 861         struct urb_priv *urbp = urb->hcpriv;
 862
 863         if (!urb)
 864                 return -EINVAL;
 865
 866         if (!urb->dev || !urb->dev->bus || !urb->dev->bus->hcpriv)
 867                 return -ENODEV;
 868
 869         spin_lock_irqsave(&xhci->urb_list_lock, flags);
 870         spin_lock(&urb->lock);
 871
 872         /* Release bandwidth for Interrupt or Isoc. transfers */
 873         /* Spinlock needed ? */
 874         if (urb->bandwidth) {
 875                 switch (usb_pipetype(urb->pipe)) {
 876                 case PIPE_INTERRUPT:
 877                         usb_release_bandwidth(urb->dev, urb, 0);
 878                         break;
 879                 case PIPE_ISOCHRONOUS:
 880                         usb_release_bandwidth(urb->dev, urb, 1);
 881                         break;
 882                 default:
 883                         break;
 884                 }
 885         }
 886
 887         if (urb->status != -EINPROGRESS) {
 888                 spin_unlock(&urb->lock);
 889                 spin_unlock_irqrestore(&xhci->urb_list_lock, flags);
 890                 return 0;
 891         }
 892
 893         list_del_init(&urb->urb_list);
 894
 895         /* Short circuit the virtual root hub */
 896         if (urb->dev == xhci->rh.dev) {
 897                 rh_unlink_urb(urb);
 898
 899                 spin_unlock(&urb->lock);
 900                 spin_unlock_irqrestore(&xhci->urb_list_lock, flags);
 901
 902                 xhci_call_completion(urb);
 903         } else {
 904                 if (urb->transfer_flags & USB_ASYNC_UNLINK) {
 905                         /* We currently don't currently attempt to cancel URBs
 906                          * that have been queued in the ring.  We handle async
 907                          * unlinked URBs when they complete. */
 908                         urbp->status = urb->status = -ECONNABORTED;
 909                         spin_unlock(&urb->lock);
 910                         spin_unlock_irqrestore(&xhci->urb_list_lock, flags);
 911                 } else {
 912                         urb->status = -ENOENT;
 913
 914                         spin_unlock(&urb->lock);
 915                         spin_unlock_irqrestore(&xhci->urb_list_lock, flags);
 916
 917                         if (in_interrupt()) {   /* wait at least 1 frame */
 918                                 static int errorcount = 10;
 919
 920                                 if (errorcount--)
 921                                         dbg("xhci_unlink_urb called from interrupt for urb %p", urb);
 922                                 udelay(1000);
 923                         } else
 924                                 schedule_timeout(1+1*HZ/1000);
 925
 926                         xhci_delete_urb(urb);
 927
 928                         xhci_call_completion(urb);
 929                 }
 930         }
 931
 932         return 0;
 933 }
 934
 935 static void xhci_call_completion(struct urb *urb)
 936 {
 937         struct urb_priv *urbp;
 938         struct usb_device *dev = urb->dev;
 939         int is_ring = 0, killed, resubmit_interrupt, status;
 940         struct urb *nurb;
 941         unsigned long flags;
 942
 943         spin_lock_irqsave(&urb->lock, flags);
 944
 945         urbp = (struct urb_priv *)urb->hcpriv;
 946         if (!urbp || !urb->dev) {
 947                 spin_unlock_irqrestore(&urb->lock, flags);
 948                 return;
 949         }
 950
 951         killed = (urb->status == -ENOENT || urb->status == -ECONNABORTED ||
 952                         urb->status == -ECONNRESET);
 953         resubmit_interrupt = (usb_pipetype(urb->pipe) == PIPE_INTERRUPT &&
 954                         urb->interval);
 955
 956         nurb = urb->next;
 957         if (nurb && !killed) {
 958                 int count = 0;
 959
 960                 while (nurb && nurb != urb && count < MAX_URB_LOOP) {
 961                         if (nurb->status == -ENOENT ||
 962                             nurb->status == -ECONNABORTED ||
 963                             nurb->status == -ECONNRESET) {
 964                                 killed = 1;
 965                                 break;
 966                         }
 967
 968                         nurb = nurb->next;
 969                         count++;
 970                 }
 971
 972                 if (count == MAX_URB_LOOP)
 973                         err("xhci_call_completion: too many linked URB's, loop? (first loop)");
 974
 975                 /* Check to see if chain is a ring */
 976                 is_ring = (nurb == urb);
 977         }
 978
 979         status = urbp->status;
 980         if (!resubmit_interrupt || killed)
 981                 /* We don't need urb_priv anymore */
 982                 xhci_destroy_urb_priv(urb);
 983
 984         if (!killed)
 985                 urb->status = status;
 986
 987         spin_unlock_irqrestore(&urb->lock, flags);
 988
 989         if (urb->complete)
 990                 urb->complete(urb);
 991
 992         if (resubmit_interrupt)
 993                 /* Recheck the status. The completion handler may have */
 994                 /*  unlinked the resubmitting interrupt URB */
 995                 killed = (urb->status == -ENOENT ||
 996                           urb->status == -ECONNABORTED ||
 997                           urb->status == -ECONNRESET);
 998
 999         if (resubmit_interrupt && !killed) {
1000                 if ( urb->dev != xhci->rh.dev )
1001                         xhci_queue_req(urb); /* XXX What if this fails? */
1002                 /* Don't need to resubmit URBs for the virtual root dev. */
1003         } else {
1004                 if (is_ring && !killed) {
1005                         urb->dev = dev;
1006                         xhci_submit_urb(urb);
1007                 } else {
1008                         /* We decrement the usage count after we're done */
1009                         /*  with everything */
1010                         usb_dec_dev_use(dev);
1011                 }
1012         }
1013 }
1014
1015 static void xhci_finish_completion(void)
1016 {
1017         struct list_head *tmp, *head;
1018         unsigned long flags;
1019
1020         spin_lock_irqsave(&xhci->complete_list_lock, flags);
1021         head = &xhci->complete_list;
1022         tmp = head->next;
1023         while (tmp != head) {
1024                 struct urb_priv *urbp = list_entry(tmp, struct urb_priv,
1025                                                    complete_list);
1026                 struct urb *urb = urbp->urb;
1027
1028                 list_del_init(&urbp->complete_list);
1029                 spin_unlock_irqrestore(&xhci->complete_list_lock, flags);
1030
1031                 xhci_call_completion(urb);
1032
1033                 spin_lock_irqsave(&xhci->complete_list_lock, flags);
1034                 head = &xhci->complete_list;
1035                 tmp = head->next;
1036         }
1037         spin_unlock_irqrestore(&xhci->complete_list_lock, flags);
1038 }
1039
1040 static struct usb_operations xhci_device_operations = {
1041         .allocate = xhci_do_nothing_dev,
1042         .deallocate = xhci_do_nothing_dev,
1043         /* It doesn't look like any drivers actually care what the frame number
1044          * is at the moment!  If necessary, we could approximate the current
1045          * frame nubmer by passing it from the backend in response messages. */
1046         .get_frame_number = NULL,
1047         .submit_urb = xhci_submit_urb,
1048         .unlink_urb = xhci_unlink_urb
1049 };
1050
1051 /******************************************************************************
1052  * VIRTUAL ROOT HUB EMULATION
1053  */
1054
1055 static __u8 root_hub_dev_des[] =
1056 {
1057         0x12,                   /*  __u8  bLength; */
1058         0x01,                   /*  __u8  bDescriptorType; Device */
1059         0x00,                   /*  __u16 bcdUSB; v1.0 */
1060         0x01,
1061         0x09,                   /*  __u8  bDeviceClass; HUB_CLASSCODE */
1062         0x00,                   /*  __u8  bDeviceSubClass; */
1063         0x00,                   /*  __u8  bDeviceProtocol; */
1064         0x08,                   /*  __u8  bMaxPacketSize0; 8 Bytes */
1065         0x00,                   /*  __u16 idVendor; */
1066         0x00,
1067         0x00,                   /*  __u16 idProduct; */
1068         0x00,
1069         0x00,                   /*  __u16 bcdDevice; */
1070         0x00,
1071         0x00,                   /*  __u8  iManufacturer; */
1072         0x02,                   /*  __u8  iProduct; */
1073         0x01,                   /*  __u8  iSerialNumber; */
1074         0x01                    /*  __u8  bNumConfigurations; */
1075 };
1076
1077
1078 /* Configuration descriptor */
1079 static __u8 root_hub_config_des[] =
1080 {
1081         0x09,                   /*  __u8  bLength; */
1082         0x02,                   /*  __u8  bDescriptorType; Configuration */
1083         0x19,                   /*  __u16 wTotalLength; */
1084         0x00,
1085         0x01,                   /*  __u8  bNumInterfaces; */
1086         0x01,                   /*  __u8  bConfigurationValue; */
1087         0x00,                   /*  __u8  iConfiguration; */
1088         0x40,                   /*  __u8  bmAttributes;
1089                                         Bit 7: Bus-powered, 6: Self-powered,
1090                                         Bit 5 Remote-wakeup, 4..0: resvd */
1091         0x00,                   /*  __u8  MaxPower; */
1092
1093         /* interface */
1094         0x09,                   /*  __u8  if_bLength; */
1095         0x04,                   /*  __u8  if_bDescriptorType; Interface */
1096         0x00,                   /*  __u8  if_bInterfaceNumber; */
1097         0x00,                   /*  __u8  if_bAlternateSetting; */
1098         0x01,                   /*  __u8  if_bNumEndpoints; */
1099         0x09,                   /*  __u8  if_bInterfaceClass; HUB_CLASSCODE */
1100         0x00,                   /*  __u8  if_bInterfaceSubClass; */
1101         0x00,                   /*  __u8  if_bInterfaceProtocol; */
1102         0x00,                   /*  __u8  if_iInterface; */
1103
1104         /* endpoint */
1105         0x07,                   /*  __u8  ep_bLength; */
1106         0x05,                   /*  __u8  ep_bDescriptorType; Endpoint */
1107         0x81,                   /*  __u8  ep_bEndpointAddress; IN Endpoint 1 */
1108         0x03,                   /*  __u8  ep_bmAttributes; Interrupt */
1109         0x08,                   /*  __u16 ep_wMaxPacketSize; 8 Bytes */
1110         0x00,
1111         0xff                    /*  __u8  ep_bInterval; 255 ms */
1112 };
1113
1114 static __u8 root_hub_hub_des[] =
1115 {
1116         0x09,                   /*  __u8  bLength; */
1117         0x29,                   /*  __u8  bDescriptorType; Hub-descriptor */
1118         0x02,                   /*  __u8  bNbrPorts; */
1119         0x00,                   /* __u16  wHubCharacteristics; */
1120         0x00,
1121         0x01,                   /*  __u8  bPwrOn2pwrGood; 2ms */
1122         0x00,                   /*  __u8  bHubContrCurrent; 0 mA */
1123         0x00,                   /*  __u8  DeviceRemovable; *** 7 Ports max *** */
1124         0xff                    /*  __u8  PortPwrCtrlMask; *** 7 ports max *** */
1125 };
1126
1127 /* prepare Interrupt pipe transaction data; HUB INTERRUPT ENDPOINT */
1128 static int rh_send_irq(struct urb *urb)
1129 {
1130         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1131         xhci_port_t *ports = xhci->rh.ports;
1132         unsigned long flags;
1133         int i, len = 1;
1134         __u16 data = 0;
1135
1136         spin_lock_irqsave(&urb->lock, flags);
1137         for (i = 0; i < xhci->rh.numports; i++) {
1138                 /* Set a bit if anything at all has changed on the port, as per
1139                  * USB spec 11.12 */
1140                 data |= (ports[i].cs_chg || ports[i].pe_chg )
1141                         ? (1 << (i + 1))
1142                         : 0;
1143
1144                 len = (i + 1) / 8 + 1;
1145         }
1146
1147         *(__u16 *) urb->transfer_buffer = cpu_to_le16(data);
1148         urb->actual_length = len;
1149         urbp->status = 0;
1150
1151         spin_unlock_irqrestore(&urb->lock, flags);
1152
1153         if ((data > 0) && (xhci->rh.send != 0)) {
1154                 dbg("root-hub INT complete: data: %x", data);
1155                 xhci_call_completion(urb);
1156         }
1157
1158         return 0;
1159 }
1160
1161 /* Virtual Root Hub INTs are polled by this timer every "interval" ms */
1162 static int rh_init_int_timer(struct urb *urb);
1163
1164 static void rh_int_timer_do(unsigned long ptr)
1165 {
1166         struct urb *urb = (struct urb *)ptr;
1167         struct list_head list, *tmp, *head;
1168         unsigned long flags;
1169         int i;
1170
1171         for ( i = 0; i < xhci->rh.numports; i++)
1172                 xhci_queue_probe(i);
1173
1174         if (xhci->rh.send)
1175                 rh_send_irq(urb);
1176
1177         INIT_LIST_HEAD(&list);
1178
1179         spin_lock_irqsave(&xhci->urb_list_lock, flags);
1180         head = &xhci->urb_list;
1181         tmp = head->next;
1182         while (tmp != head) {
1183                 struct urb *u = list_entry(tmp, struct urb, urb_list);
1184                 struct urb_priv *up = (struct urb_priv *)u->hcpriv;
1185
1186                 tmp = tmp->next;
1187
1188                 spin_lock(&u->lock);
1189
1190                 /* Check if the URB timed out */
1191                 if (u->timeout && time_after_eq(jiffies,
1192                                                 up->inserttime + u->timeout)) {
1193                         list_del(&u->urb_list);
1194                         list_add_tail(&u->urb_list, &list);
1195                 }
1196
1197                 spin_unlock(&u->lock);
1198         }
1199         spin_unlock_irqrestore(&xhci->urb_list_lock, flags);
1200
1201         head = &list;
1202         tmp = head->next;
1203         while (tmp != head) {
1204                 struct urb *u = list_entry(tmp, struct urb, urb_list);
1205
1206                 tmp = tmp->next;
1207
1208                 u->transfer_flags |= USB_ASYNC_UNLINK | USB_TIMEOUT_KILLED;
1209                 xhci_unlink_urb(u);
1210         }
1211
1212         rh_init_int_timer(urb);
1213 }
1214
1215 /* Root Hub INTs are polled by this timer */
1216 static int rh_init_int_timer(struct urb *urb)
1217 {
1218         xhci->rh.interval = urb->interval;
1219         init_timer(&xhci->rh.rh_int_timer);
1220         xhci->rh.rh_int_timer.function = rh_int_timer_do;
1221         xhci->rh.rh_int_timer.data = (unsigned long)urb;
1222         xhci->rh.rh_int_timer.expires = jiffies
1223                 + (HZ * (urb->interval < 30 ? 30 : urb->interval)) / 1000;
1224         add_timer(&xhci->rh.rh_int_timer);
1225
1226         return 0;
1227 }
1228
1229 #define OK(x)                   len = (x); break
1230
1231 /* Root Hub Control Pipe */
1232 static int rh_submit_urb(struct urb *urb)
1233 {
1234         unsigned int pipe = urb->pipe;
1235         struct usb_ctrlrequest *cmd =
1236                 (struct usb_ctrlrequest *)urb->setup_packet;
1237         void *data = urb->transfer_buffer;
1238         int leni = urb->transfer_buffer_length;
1239         int len = 0;
1240         xhci_port_t *status;
1241         int stat = 0;
1242         int i;
1243         int retstatus;
1244         unsigned long flags;
1245
1246         __u16 cstatus;
1247         __u16 bmRType_bReq;
1248         __u16 wValue;
1249         __u16 wIndex;
1250         __u16 wLength;
1251
1252         if (usb_pipetype(pipe) == PIPE_INTERRUPT) {
1253                 xhci->rh.urb = urb;
1254                 xhci->rh.send = 1;
1255                 xhci->rh.interval = urb->interval;
1256                 rh_init_int_timer(urb);
1257
1258                 return -EINPROGRESS;
1259         }
1260
1261         bmRType_bReq = cmd->bRequestType | cmd->bRequest << 8;
1262         wValue = le16_to_cpu(cmd->wValue);
1263         wIndex = le16_to_cpu(cmd->wIndex);
1264         wLength = le16_to_cpu(cmd->wLength);
1265
1266         for (i = 0; i < 8; i++)
1267                 xhci->rh.c_p_r[i] = 0;
1268
1269         status = &xhci->rh.ports[wIndex - 1];
1270
1271         spin_lock_irqsave(&xhci->rh.port_state_lock, flags);
1272
1273         switch (bmRType_bReq) {
1274                 /* Request Destination:
1275                    without flags: Device,
1276                    RH_INTERFACE: interface,
1277                    RH_ENDPOINT: endpoint,
1278                    RH_CLASS means HUB here,
1279                    RH_OTHER | RH_CLASS  almost ever means HUB_PORT here
1280                 */
1281
1282         case RH_GET_STATUS:
1283                 *(__u16 *)data = cpu_to_le16(1);
1284                 OK(2);
1285         case RH_GET_STATUS | RH_INTERFACE:
1286                 *(__u16 *)data = cpu_to_le16(0);
1287                 OK(2);
1288         case RH_GET_STATUS | RH_ENDPOINT:
1289                 *(__u16 *)data = cpu_to_le16(0);
1290                 OK(2);
1291         case RH_GET_STATUS | RH_CLASS:
1292                 *(__u32 *)data = cpu_to_le32(0);
1293                 OK(4);          /* hub power */
1294         case RH_GET_STATUS | RH_OTHER | RH_CLASS:
1295                 cstatus = (status->cs_chg) |
1296                         (status->pe_chg << 1) |
1297                         (xhci->rh.c_p_r[wIndex - 1] << 4);
1298                 retstatus = (status->cs) |
1299                         (status->pe << 1) |
1300                         (status->susp << 2) |
1301                         (1 << 8) |      /* power on */
1302                         (status->lsda << 9);
1303                 *(__u16 *)data = cpu_to_le16(retstatus);
1304                 *(__u16 *)(data + 2) = cpu_to_le16(cstatus);
1305                 OK(4);
1306         case RH_CLEAR_FEATURE | RH_ENDPOINT:
1307                 switch (wValue) {
1308                 case RH_ENDPOINT_STALL:
1309                         OK(0);
1310                 }
1311                 break;
1312         case RH_CLEAR_FEATURE | RH_CLASS:
1313                 switch (wValue) {
1314                 case RH_C_HUB_OVER_CURRENT:
1315                         OK(0);  /* hub power over current */
1316                 }
1317                 break;
1318         case RH_CLEAR_FEATURE | RH_OTHER | RH_CLASS:
1319                 switch (wValue) {
1320                 case RH_PORT_ENABLE:
1321                         status->pe     = 0;
1322                         OK(0);
1323                 case RH_PORT_SUSPEND:
1324                         status->susp   = 0;
1325                         OK(0);
1326                 case RH_PORT_POWER:
1327                         OK(0);  /* port power */
1328                 case RH_C_PORT_CONNECTION:
1329                         status->cs_chg = 0;
1330                         OK(0);
1331                 case RH_C_PORT_ENABLE:
1332                         status->pe_chg = 0;
1333                         OK(0);
1334                 case RH_C_PORT_SUSPEND:
1335                         /*** WR_RH_PORTSTAT(RH_PS_PSSC); */
1336                         OK(0);
1337                 case RH_C_PORT_OVER_CURRENT:
1338                         OK(0);  /* port power over current */
1339                 case RH_C_PORT_RESET:
1340                         xhci->rh.c_p_r[wIndex - 1] = 0;
1341                         OK(0);
1342                 }
1343                 break;
1344         case RH_SET_FEATURE | RH_OTHER | RH_CLASS:
1345                 switch (wValue) {
1346                 case RH_PORT_SUSPEND:
1347                         status->susp = 1;
1348                         OK(0);
1349                 case RH_PORT_RESET:
1350                 {
1351                         int ret;
1352                         xhci->rh.c_p_r[wIndex - 1] = 1;
1353                         status->pr = 0;
1354                         status->pe = 1;
1355                         ret = xhci_port_reset(wIndex - 1);
1356                         /* XXX MAW: should probably cancel queued transfers during reset... *\/ */
1357                         if ( ret == 0 ) { OK(0); }
1358                         else { return ret; }
1359                 }
1360                 break;
1361                 case RH_PORT_POWER:
1362                         OK(0); /* port power ** */
1363                 case RH_PORT_ENABLE:
1364                         status->pe = 1;
1365                         OK(0);
1366                 }
1367                 break;
1368         case RH_SET_ADDRESS:
1369                 xhci->rh.devnum = wValue;
1370                 OK(0);
1371         case RH_GET_DESCRIPTOR:
1372                 switch ((wValue & 0xff00) >> 8) {
1373                 case 0x01:      /* device descriptor */
1374                         len = min_t(unsigned int, leni,
1375                                   min_t(unsigned int,
1376                                       sizeof(root_hub_dev_des), wLength));
1377                         memcpy(data, root_hub_dev_des, len);
1378                         OK(len);
1379                 case 0x02:      /* configuration descriptor */
1380                         len = min_t(unsigned int, leni,
1381                                   min_t(unsigned int,
1382                                       sizeof(root_hub_config_des), wLength));
1383                         memcpy (data, root_hub_config_des, len);
1384                         OK(len);
1385                 case 0x03:      /* string descriptors */
1386                         len = usb_root_hub_string (wValue & 0xff,
1387                                 0, "XHCI-alt",
1388                                 data, wLength);
1389                         if (len > 0) {
1390                                 OK(min_t(int, leni, len));
1391                         } else
1392                                 stat = -EPIPE;
1393                 }
1394                 break;
1395         case RH_GET_DESCRIPTOR | RH_CLASS:
1396                 root_hub_hub_des[2] = xhci->rh.numports;
1397                 len = min_t(unsigned int, leni,
1398                           min_t(unsigned int, sizeof(root_hub_hub_des), wLength));
1399                 memcpy(data, root_hub_hub_des, len);
1400                 OK(len);
1401         case RH_GET_CONFIGURATION:
1402                 *(__u8 *)data = 0x01;
1403                 OK(1);
1404         case RH_SET_CONFIGURATION:
1405                 OK(0);
1406         case RH_GET_INTERFACE | RH_INTERFACE:
1407                 *(__u8 *)data = 0x00;
1408                 OK(1);
1409         case RH_SET_INTERFACE | RH_INTERFACE:
1410                 OK(0);
1411         default:
1412                 stat = -EPIPE;
1413         }
1414
1415         spin_unlock_irqrestore(&xhci->rh.port_state_lock, flags);
1416
1417         urb->actual_length = len;
1418
1419         return stat;
1420 }
1421
1422 /*
1423  * MUST be called with urb->lock acquired
1424  */
1425 static int rh_unlink_urb(struct urb *urb)
1426 {
1427         if (xhci->rh.urb == urb) {
1428                 urb->status = -ENOENT;
1429                 xhci->rh.send = 0;
1430                 xhci->rh.urb = NULL;
1431                 del_timer(&xhci->rh.rh_int_timer);
1432         }
1433         return 0;
1434 }
1435
1436 /******************************************************************************
1437  * CONTROL PLANE FUNCTIONALITY
1438  */
1439
1440 /**
1441  * alloc_xhci - initialise a new virtual root hub for a new USB device channel
1442  */
1443 static int alloc_xhci(void)
1444 {
1445         int retval;
1446         struct usb_bus *bus;
1447
1448         retval = -EBUSY;
1449
1450         xhci = kmalloc(sizeof(*xhci), GFP_KERNEL);
1451         if (!xhci) {
1452                 err("couldn't allocate xhci structure");
1453                 retval = -ENOMEM;
1454                 goto err_alloc_xhci;
1455         }
1456
1457         xhci->state = USBIF_STATE_CLOSED;
1458
1459         spin_lock_init(&xhci->urb_list_lock);
1460         INIT_LIST_HEAD(&xhci->urb_list);
1461
1462         spin_lock_init(&xhci->complete_list_lock);
1463         INIT_LIST_HEAD(&xhci->complete_list);
1464
1465         spin_lock_init(&xhci->frame_list_lock);
1466
1467         bus = usb_alloc_bus(&xhci_device_operations);
1468
1469         if (!bus) {
1470                 err("unable to allocate bus");
1471                 goto err_alloc_bus;
1472         }
1473
1474         xhci->bus = bus;
1475         bus->bus_name = "XHCI";
1476         bus->hcpriv = xhci;
1477
1478         usb_register_bus(xhci->bus);
1479
1480         /* Initialize the root hub */
1481
1482         xhci->rh.numports = 0;
1483
1484         xhci->bus->root_hub = xhci->rh.dev = usb_alloc_dev(NULL, xhci->bus);
1485         if (!xhci->rh.dev) {
1486                 err("unable to allocate root hub");
1487                 goto err_alloc_root_hub;
1488         }
1489
1490         xhci->state = 0;
1491
1492         return 0;
1493
1494 /*
1495  * error exits:
1496  */
1497 err_alloc_root_hub:
1498         usb_deregister_bus(xhci->bus);
1499         usb_free_bus(xhci->bus);
1500         xhci->bus = NULL;
1501
1502 err_alloc_bus:
1503         kfree(xhci);
1504
1505 err_alloc_xhci:
1506         return retval;
1507 }
1508
1509 /**
1510  * usbif_status_change - deal with an incoming USB_INTERFACE_STATUS_ message
1511  */
1512 static void usbif_status_change(usbif_fe_interface_status_changed_t *status)
1513 {
1514     ctrl_msg_t                   cmsg;
1515     usbif_fe_interface_connect_t up;
1516     long rc;
1517     usbif_sring_t *sring;
1518
1519     switch ( status->status )
1520     {
1521     case USBIF_INTERFACE_STATUS_DESTROYED:
1522         printk(KERN_WARNING "Unexpected usbif-DESTROYED message in state %d\n",
1523                xhci->state);
1524         break;
1525
1526     case USBIF_INTERFACE_STATUS_DISCONNECTED:
1527         if ( xhci->state != USBIF_STATE_CLOSED )
1528         {
1529             printk(KERN_WARNING "Unexpected usbif-DISCONNECTED message"
1530                    " in state %d\n", xhci->state);
1531             break;
1532             /* Not bothering to do recovery here for now.  Keep things
1533              * simple. */
1534
1535             spin_lock_irq(&xhci->ring_lock);
1536
1537             /* Clean up resources. */
1538             free_page((unsigned long)xhci->usb_ring.sring);
1539             free_irq(xhci->irq, xhci);
1540             unbind_evtchn_from_irq(xhci->evtchn);
1541
1542             /* Plug the ring. */
1543             xhci->recovery = 1;
1544             wmb();
1545
1546             spin_unlock_irq(&xhci->ring_lock);
1547         }
1548
1549         /* Move from CLOSED to DISCONNECTED state. */
1550         sring = (usbif_sring_t *)__get_free_page(GFP_KERNEL);
1551         SHARED_RING_INIT(sring);
1552         FRONT_RING_INIT(&xhci->usb_ring, sring, PAGE_SIZE);
1553         xhci->state  = USBIF_STATE_DISCONNECTED;
1554
1555         /* Construct an interface-CONNECT message for the domain controller. */
1556         cmsg.type      = CMSG_USBIF_FE;
1557         cmsg.subtype   = CMSG_USBIF_FE_INTERFACE_CONNECT;
1558         cmsg.length    = sizeof(usbif_fe_interface_connect_t);
1559         up.shmem_frame = virt_to_machine(sring) >> PAGE_SHIFT;
1560         memcpy(cmsg.msg, &up, sizeof(up));
1561
1562         /* Tell the controller to bring up the interface. */
1563         ctrl_if_send_message_block(&cmsg, NULL, 0, TASK_UNINTERRUPTIBLE);
1564         break;
1565
1566     case USBIF_INTERFACE_STATUS_CONNECTED:
1567         if ( xhci->state == USBIF_STATE_CLOSED )
1568         {
1569             printk(KERN_WARNING "Unexpected usbif-CONNECTED message"
1570                    " in state %d\n", xhci->state);
1571             break;
1572         }
1573
1574         xhci->evtchn = status->evtchn;
1575         xhci->irq = bind_evtchn_to_irq(xhci->evtchn);
1576         xhci->bandwidth = status->bandwidth;
1577         xhci->rh.numports = status->num_ports;
1578
1579         xhci->rh.ports = kmalloc (sizeof(xhci_port_t) * xhci->rh.numports, GFP_KERNEL);
1580
1581         if ( xhci->rh.ports == NULL )
1582             goto alloc_ports_nomem;
1583
1584         memset(xhci->rh.ports, 0, sizeof(xhci_port_t) * xhci->rh.numports);
1585
1586         usb_connect(xhci->rh.dev);
1587
1588         if (usb_new_device(xhci->rh.dev) != 0) {
1589                 err("unable to start root hub");
1590         }
1591
1592         /* Allocate the appropriate USB bandwidth here...  Need to
1593          * somehow know what the total available is thought to be so we
1594          * can calculate the reservation correctly. */
1595         usb_claim_bandwidth(xhci->rh.dev, xhci->rh.urb,
1596                             1000 - xhci->bandwidth, 0);
1597
1598         if ( (rc = request_irq(xhci->irq, xhci_interrupt,
1599                                SA_SAMPLE_RANDOM, "usbif", xhci)) )
1600                 printk(KERN_ALERT"usbfront request_irq failed (%ld)\n",rc);
1601
1602         DPRINTK(KERN_INFO __FILE__
1603                 ": USB XHCI: SHM at %p (0x%lx), EVTCHN %d IRQ %d\n",
1604                 xhci->usb_ring.sring, virt_to_machine(xhci->usbif),
1605                 xhci->evtchn, xhci->irq);
1606
1607         xhci->state = USBIF_STATE_CONNECTED;
1608
1609         break;
1610
1611     default:
1612         printk(KERN_WARNING "Status change to unknown value %d\n",
1613                status->status);
1614         break;
1615     }
1616
1617     return;
1618
1619  alloc_ports_nomem:
1620     printk(KERN_WARNING "Failed to allocate port memory, XHCI failed to connect.\n");
1621     return;
1622 }
1623
1624 /**
1625  * usbif_ctrlif_rx - demux control messages by subtype
1626  */
1627 static void usbif_ctrlif_rx(ctrl_msg_t *msg, unsigned long id)
1628 {
1629     switch ( msg->subtype )
1630     {
1631     case CMSG_USBIF_FE_INTERFACE_STATUS_CHANGED:
1632         usbif_status_change((usbif_fe_interface_status_changed_t *)
1633                             &msg->msg[0]);
1634         break;
1635
1636         /* New interface...? */
1637     default:
1638         msg->length = 0;
1639         break;
1640     }
1641
1642     ctrl_if_send_response(msg);
1643 }
1644
1645 static void send_driver_up(void)
1646 {
1647         control_msg_t cmsg;
1648         usbif_fe_interface_status_changed_t st;
1649
1650         /* Send a driver-UP notification to the domain controller. */
1651         cmsg.type      = CMSG_USBIF_FE;
1652         cmsg.subtype   = CMSG_USBIF_FE_DRIVER_STATUS_CHANGED;
1653         cmsg.length    = sizeof(usbif_fe_driver_status_changed_t);
1654         st.status      = USBIF_DRIVER_STATUS_UP;
1655         memcpy(cmsg.msg, &st, sizeof(st));
1656         ctrl_if_send_message_block(&cmsg, NULL, 0, TASK_UNINTERRUPTIBLE);
1657 }
1658
1659 void usbif_resume(void)
1660 {
1661         int i;
1662
1663         /* Fake disconnection on all virtual USB ports (suspending / migrating
1664          * will destroy hard state associated will the USB devices anyhow). */
1665         /* No need to lock here. */
1666         for ( i = 0; i < xhci->rh.numports; i++ )
1667         {
1668                 xhci->rh.ports[i].cs = 0;
1669                 xhci->rh.ports[i].cs_chg = 1;
1670                 xhci->rh.ports[i].pe = 0;
1671         }
1672
1673         send_driver_up();
1674 }
1675
1676 static int __init xhci_hcd_init(void)
1677 {
1678         int retval = -ENOMEM, i;
1679
1680         if ( (xen_start_info.flags & SIF_INITDOMAIN)
1681              || (xen_start_info.flags & SIF_USB_BE_DOMAIN) )
1682                 return 0;
1683
1684         info(DRIVER_DESC " " DRIVER_VERSION);
1685
1686         if (debug) {
1687                 errbuf = kmalloc(ERRBUF_LEN, GFP_KERNEL);
1688                 if (!errbuf)
1689                         goto errbuf_failed;
1690         }
1691
1692         xhci_up_cachep = kmem_cache_create("xhci_urb_priv",
1693                 sizeof(struct urb_priv), 0, 0, NULL, NULL);
1694         if (!xhci_up_cachep)
1695                 goto up_failed;
1696
1697         /* Let the domain controller know we're here.  For now we wait until
1698          * connection, as for the block and net drivers.  This is only strictly
1699          * necessary if we're going to boot off a USB device. */
1700         printk(KERN_INFO "Initialising Xen virtual USB hub\n");
1701
1702         (void)ctrl_if_register_receiver(CMSG_USBIF_FE, usbif_ctrlif_rx,
1703                                         CALLBACK_IN_BLOCKING_CONTEXT);
1704
1705         alloc_xhci();
1706
1707         send_driver_up();
1708
1709         /*
1710          * We should read 'nr_interfaces' from response message and wait
1711          * for notifications before proceeding. For now we assume that we
1712          * will be notified of exactly one interface.
1713          */
1714         for ( i=0; (xhci->state != USBIF_STATE_CONNECTED) && (i < 10*HZ); i++ )
1715         {
1716             set_current_state(TASK_INTERRUPTIBLE);
1717             schedule_timeout(1);
1718         }
1719
1720         if (xhci->state != USBIF_STATE_CONNECTED)
1721             printk(KERN_WARNING "Timeout connecting USB frontend driver!\n");
1722
1723         return 0;
1724
1725 up_failed:
1726         if (errbuf)
1727                 kfree(errbuf);
1728
1729 errbuf_failed:
1730         return retval;
1731 }
1732
1733 module_init(xhci_hcd_init);
1734
1735 MODULE_AUTHOR(DRIVER_AUTHOR);
1736 MODULE_DESCRIPTION(DRIVER_DESC);
1737 MODULE_LICENSE("GPL");
1738