1	// SPDX-License-Identifier: GPL-2.0-or-later
2	/*
3	* xen-hcd.c
4	*
5	* Xen USB Virtual Host Controller driver
6	*
7	* Copyright (C) 2009, FUJITSU LABORATORIES LTD.
8	* Author: Noboru Iwamatsu <n_iwamatsu@jp.fujitsu.com>
9	*/
10
11	#include <linux/module.h>
12	#include <linux/usb.h>
13	#include <linux/list.h>
14	#include <linux/usb/hcd.h>
15	#include <linux/io.h>
16
17	#include <xen/xen.h>
18	#include <xen/xenbus.h>
19	#include <xen/grant_table.h>
20	#include <xen/events.h>
21	#include <xen/page.h>
22
23	#include <xen/interface/io/usbif.h>
24
25	/* Private per-URB data */
26	struct urb_priv {
27	struct list_head list;
28	struct urb *urb;
29	int req_id; /* RING_REQUEST id for submitting */
30	int unlink_req_id; /* RING_REQUEST id for unlinking */
31	int status;
32	bool unlinked; /* dequeued marker */
33	};
34
35	/* virtual roothub port status */
36	struct rhport_status {
37	__u32 status;
38	bool resuming; /* in resuming */
39	bool c_connection; /* connection changed */
40	unsigned long timeout;
41	};
42
43	/* status of attached device */
44	struct vdevice_status {
45	int devnum;
46	enum usb_device_state status;
47	enum usb_device_speed speed;
48	};
49
50	/* RING request shadow */
51	struct usb_shadow {
52	struct xenusb_urb_request req;
53	struct urb *urb;
54	bool in_flight;
55	};
56
57	struct xenhcd_info {
58	/* Virtual Host Controller has 4 urb queues */
59	struct list_head pending_submit_list;
60	struct list_head pending_unlink_list;
61	struct list_head in_progress_list;
62	struct list_head giveback_waiting_list;
63
64	spinlock_t lock;
65
66	/* timer that kick pending and giveback waiting urbs */
67	struct timer_list watchdog;
68	unsigned long actions;
69
70	/* virtual root hub */
71	int rh_numports;
72	struct rhport_status ports[XENUSB_MAX_PORTNR];
73	struct vdevice_status devices[XENUSB_MAX_PORTNR];
74
75	/* Xen related staff */
76	struct xenbus_device *xbdev;
77	int urb_ring_ref;
78	int conn_ring_ref;
79	struct xenusb_urb_front_ring urb_ring;
80	struct xenusb_conn_front_ring conn_ring;
81
82	unsigned int evtchn;
83	unsigned int irq;
84	struct usb_shadow shadow[XENUSB_URB_RING_SIZE];
85	unsigned int shadow_free;
86
87	bool error;
88	};
89
90	#define XENHCD_RING_JIFFIES (HZ/200)
91	#define XENHCD_SCAN_JIFFIES 1
92
93	enum xenhcd_timer_action {
94	TIMER_RING_WATCHDOG,
95	TIMER_SCAN_PENDING_URBS,
96	};
97
98	static struct kmem_cache *xenhcd_urbp_cachep;
99
100	static inline struct xenhcd_info *xenhcd_hcd_to_info(struct usb_hcd *hcd)
101	{
102	return (struct xenhcd_info *)hcd->hcd_priv;
103	}
104
105	static inline struct usb_hcd *xenhcd_info_to_hcd(struct xenhcd_info *info)
106	{
107	return container_of((void *)info, struct usb_hcd, hcd_priv);
108	}
109
110	static void xenhcd_set_error(struct xenhcd_info *info, const char *msg)
111	{
112	info->error = true;
113
114	pr_alert("xen-hcd: protocol error: %s!\n", msg);
115	}
116
117	static inline void xenhcd_timer_action_done(struct xenhcd_info *info,
118	enum xenhcd_timer_action action)
119	{
120	clear_bit(nr: action, addr: &info->actions);
121	}
122
123	static void xenhcd_timer_action(struct xenhcd_info *info,
124	enum xenhcd_timer_action action)
125	{
126	if (timer_pending(timer: &info->watchdog) &&
127	test_bit(TIMER_SCAN_PENDING_URBS, &info->actions))
128	return;
129
130	if (!test_and_set_bit(nr: action, addr: &info->actions)) {
131	unsigned long t;
132
133	switch (action) {
134	case TIMER_RING_WATCHDOG:
135	t = XENHCD_RING_JIFFIES;
136	break;
137	default:
138	t = XENHCD_SCAN_JIFFIES;
139	break;
140	}
141	mod_timer(timer: &info->watchdog, expires: t + jiffies);
142	}
143	}
144
145	/*
146	* set virtual port connection status
147	*/
148	static void xenhcd_set_connect_state(struct xenhcd_info *info, int portnum)
149	{
150	int port;
151
152	port = portnum - 1;
153	if (info->ports[port].status & USB_PORT_STAT_POWER) {
154	switch (info->devices[port].speed) {
155	case XENUSB_SPEED_NONE:
156	info->ports[port].status &=
157	~(USB_PORT_STAT_CONNECTION |
158	USB_PORT_STAT_ENABLE |
159	USB_PORT_STAT_LOW_SPEED |
160	USB_PORT_STAT_HIGH_SPEED |
161	USB_PORT_STAT_SUSPEND);
162	break;
163	case XENUSB_SPEED_LOW:
164	info->ports[port].status |= USB_PORT_STAT_CONNECTION;
165	info->ports[port].status |= USB_PORT_STAT_LOW_SPEED;
166	break;
167	case XENUSB_SPEED_FULL:
168	info->ports[port].status |= USB_PORT_STAT_CONNECTION;
169	break;
170	case XENUSB_SPEED_HIGH:
171	info->ports[port].status |= USB_PORT_STAT_CONNECTION;
172	info->ports[port].status |= USB_PORT_STAT_HIGH_SPEED;
173	break;
174	default: /* error */
175	return;
176	}
177	info->ports[port].status |= (USB_PORT_STAT_C_CONNECTION << 16);
178	}
179	}
180
181	/*
182	* set virtual device connection status
183	*/
184	static int xenhcd_rhport_connect(struct xenhcd_info *info, __u8 portnum,
185	__u8 speed)
186	{
187	int port;
188
189	if (portnum < 1 || portnum > info->rh_numports)
190	return -EINVAL; /* invalid port number */
191
192	port = portnum - 1;
193	if (info->devices[port].speed != speed) {
194	switch (speed) {
195	case XENUSB_SPEED_NONE: /* disconnect */
196	info->devices[port].status = USB_STATE_NOTATTACHED;
197	break;
198	case XENUSB_SPEED_LOW:
199	case XENUSB_SPEED_FULL:
200	case XENUSB_SPEED_HIGH:
201	info->devices[port].status = USB_STATE_ATTACHED;
202	break;
203	default: /* error */
204	return -EINVAL;
205	}
206	info->devices[port].speed = speed;
207	info->ports[port].c_connection = true;
208
209	xenhcd_set_connect_state(info, portnum);
210	}
211
212	return 0;
213	}
214
215	/*
216	* SetPortFeature(PORT_SUSPENDED)
217	*/
218	static void xenhcd_rhport_suspend(struct xenhcd_info *info, int portnum)
219	{
220	int port;
221
222	port = portnum - 1;
223	info->ports[port].status |= USB_PORT_STAT_SUSPEND;
224	info->devices[port].status = USB_STATE_SUSPENDED;
225	}
226
227	/*
228	* ClearPortFeature(PORT_SUSPENDED)
229	*/
230	static void xenhcd_rhport_resume(struct xenhcd_info *info, int portnum)
231	{
232	int port;
233
234	port = portnum - 1;
235	if (info->ports[port].status & USB_PORT_STAT_SUSPEND) {
236	info->ports[port].resuming = true;
237	info->ports[port].timeout = jiffies + msecs_to_jiffies(m: 20);
238	}
239	}
240
241	/*
242	* SetPortFeature(PORT_POWER)
243	*/
244	static void xenhcd_rhport_power_on(struct xenhcd_info *info, int portnum)
245	{
246	int port;
247
248	port = portnum - 1;
249	if ((info->ports[port].status & USB_PORT_STAT_POWER) == 0) {
250	info->ports[port].status |= USB_PORT_STAT_POWER;
251	if (info->devices[port].status != USB_STATE_NOTATTACHED)
252	info->devices[port].status = USB_STATE_POWERED;
253	if (info->ports[port].c_connection)
254	xenhcd_set_connect_state(info, portnum);
255	}
256	}
257
258	/*
259	* ClearPortFeature(PORT_POWER)
260	* SetConfiguration(non-zero)
261	* Power_Source_Off
262	* Over-current
263	*/
264	static void xenhcd_rhport_power_off(struct xenhcd_info *info, int portnum)
265	{
266	int port;
267
268	port = portnum - 1;
269	if (info->ports[port].status & USB_PORT_STAT_POWER) {
270	info->ports[port].status = 0;
271	if (info->devices[port].status != USB_STATE_NOTATTACHED)
272	info->devices[port].status = USB_STATE_ATTACHED;
273	}
274	}
275
276	/*
277	* ClearPortFeature(PORT_ENABLE)
278	*/
279	static void xenhcd_rhport_disable(struct xenhcd_info *info, int portnum)
280	{
281	int port;
282
283	port = portnum - 1;
284	info->ports[port].status &= ~USB_PORT_STAT_ENABLE;
285	info->ports[port].status &= ~USB_PORT_STAT_SUSPEND;
286	info->ports[port].resuming = false;
287	if (info->devices[port].status != USB_STATE_NOTATTACHED)
288	info->devices[port].status = USB_STATE_POWERED;
289	}
290
291	/*
292	* SetPortFeature(PORT_RESET)
293	*/
294	static void xenhcd_rhport_reset(struct xenhcd_info *info, int portnum)
295	{
296	int port;
297
298	port = portnum - 1;
299	info->ports[port].status &= ~(USB_PORT_STAT_ENABLE |
300	USB_PORT_STAT_LOW_SPEED |
301	USB_PORT_STAT_HIGH_SPEED);
302	info->ports[port].status |= USB_PORT_STAT_RESET;
303
304	if (info->devices[port].status != USB_STATE_NOTATTACHED)
305	info->devices[port].status = USB_STATE_ATTACHED;
306
307	/* 10msec reset signaling */
308	info->ports[port].timeout = jiffies + msecs_to_jiffies(m: 10);
309	}
310
311	#ifdef CONFIG_PM
312	static int xenhcd_bus_suspend(struct usb_hcd *hcd)
313	{
314	struct xenhcd_info *info = xenhcd_hcd_to_info(hcd);
315	int ret = 0;
316	int i, ports;
317
318	ports = info->rh_numports;
319
320	spin_lock_irq(lock: &info->lock);
321	if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)) {
322	ret = -ESHUTDOWN;
323	} else {
324	/* suspend any active ports*/
325	for (i = 1; i <= ports; i++)
326	xenhcd_rhport_suspend(info, portnum: i);
327	}
328	spin_unlock_irq(lock: &info->lock);
329
330	del_timer_sync(timer: &info->watchdog);
331
332	return ret;
333	}
334
335	static int xenhcd_bus_resume(struct usb_hcd *hcd)
336	{
337	struct xenhcd_info *info = xenhcd_hcd_to_info(hcd);
338	int ret = 0;
339	int i, ports;
340
341	ports = info->rh_numports;
342
343	spin_lock_irq(lock: &info->lock);
344	if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)) {
345	ret = -ESHUTDOWN;
346	} else {
347	/* resume any suspended ports*/
348	for (i = 1; i <= ports; i++)
349	xenhcd_rhport_resume(info, portnum: i);
350	}
351	spin_unlock_irq(lock: &info->lock);
352
353	return ret;
354	}
355	#endif
356
357	static void xenhcd_hub_descriptor(struct xenhcd_info *info,
358	struct usb_hub_descriptor *desc)
359	{
360	__u16 temp;
361	int ports = info->rh_numports;
362
363	desc->bDescriptorType = 0x29;
364	desc->bPwrOn2PwrGood = 10; /* EHCI says 20ms max */
365	desc->bHubContrCurrent = 0;
366	desc->bNbrPorts = ports;
367
368	/* size of DeviceRemovable and PortPwrCtrlMask fields */
369	temp = 1 + (ports / 8);
370	desc->bDescLength = 7 + 2 * temp;
371
372	/* bitmaps for DeviceRemovable and PortPwrCtrlMask */
373	memset(&desc->u.hs.DeviceRemovable[0], 0, temp);
374	memset(&desc->u.hs.DeviceRemovable[temp], 0xff, temp);
375
376	/* per-port over current reporting and no power switching */
377	temp = 0x000a;
378	desc->wHubCharacteristics = cpu_to_le16(temp);
379	}
380
381	/* port status change mask for hub_status_data */
382	#define PORT_C_MASK ((USB_PORT_STAT_C_CONNECTION | \
383	USB_PORT_STAT_C_ENABLE | \
384	USB_PORT_STAT_C_SUSPEND | \
385	USB_PORT_STAT_C_OVERCURRENT | \
386	USB_PORT_STAT_C_RESET) << 16)
387
388	/*
389	* See USB 2.0 Spec, 11.12.4 Hub and Port Status Change Bitmap.
390	* If port status changed, writes the bitmap to buf and return
391	* that length(number of bytes).
392	* If Nothing changed, return 0.
393	*/
394	static int xenhcd_hub_status_data(struct usb_hcd *hcd, char *buf)
395	{
396	struct xenhcd_info *info = xenhcd_hcd_to_info(hcd);
397	int ports;
398	int i;
399	unsigned long flags;
400	int ret;
401	int changed = 0;
402
403	/* initialize the status to no-changes */
404	ports = info->rh_numports;
405	ret = 1 + (ports / 8);
406	memset(buf, 0, ret);
407
408	spin_lock_irqsave(&info->lock, flags);
409
410	for (i = 0; i < ports; i++) {
411	/* check status for each port */
412	if (info->ports[i].status & PORT_C_MASK) {
413	buf[(i + 1) / 8] |= 1 << (i + 1) % 8;
414	changed = 1;
415	}
416	}
417
418	if ((hcd->state == HC_STATE_SUSPENDED) && (changed == 1))
419	usb_hcd_resume_root_hub(hcd);
420
421	spin_unlock_irqrestore(lock: &info->lock, flags);
422
423	return changed ? ret : 0;
424	}
425
426	static int xenhcd_hub_control(struct usb_hcd *hcd, __u16 typeReq, __u16 wValue,
427	__u16 wIndex, char *buf, __u16 wLength)
428	{
429	struct xenhcd_info *info = xenhcd_hcd_to_info(hcd);
430	int ports = info->rh_numports;
431	unsigned long flags;
432	int ret = 0;
433	int i;
434	int changed = 0;
435
436	spin_lock_irqsave(&info->lock, flags);
437	switch (typeReq) {
438	case ClearHubFeature:
439	/* ignore this request */
440	break;
441	case ClearPortFeature:
442	if (!wIndex || wIndex > ports)
443	goto error;
444
445	switch (wValue) {
446	case USB_PORT_FEAT_SUSPEND:
447	xenhcd_rhport_resume(info, portnum: wIndex);
448	break;
449	case USB_PORT_FEAT_POWER:
450	xenhcd_rhport_power_off(info, portnum: wIndex);
451	break;
452	case USB_PORT_FEAT_ENABLE:
453	xenhcd_rhport_disable(info, portnum: wIndex);
454	break;
455	case USB_PORT_FEAT_C_CONNECTION:
456	info->ports[wIndex - 1].c_connection = false;
457	fallthrough;
458	default:
459	info->ports[wIndex - 1].status &= ~(1 << wValue);
460	break;
461	}
462	break;
463	case GetHubDescriptor:
464	xenhcd_hub_descriptor(info, desc: (struct usb_hub_descriptor *)buf);
465	break;
466	case GetHubStatus:
467	/* always local power supply good and no over-current exists. */
468	*(__le32 *)buf = cpu_to_le32(0);
469	break;
470	case GetPortStatus:
471	if (!wIndex || wIndex > ports)
472	goto error;
473
474	wIndex--;
475
476	/* resume completion */
477	if (info->ports[wIndex].resuming &&
478	time_after_eq(jiffies, info->ports[wIndex].timeout)) {
479	info->ports[wIndex].status |=
480	USB_PORT_STAT_C_SUSPEND << 16;
481	info->ports[wIndex].status &= ~USB_PORT_STAT_SUSPEND;
482	}
483
484	/* reset completion */
485	if ((info->ports[wIndex].status & USB_PORT_STAT_RESET) != 0 &&
486	time_after_eq(jiffies, info->ports[wIndex].timeout)) {
487	info->ports[wIndex].status |=
488	USB_PORT_STAT_C_RESET << 16;
489	info->ports[wIndex].status &= ~USB_PORT_STAT_RESET;
490
491	if (info->devices[wIndex].status !=
492	USB_STATE_NOTATTACHED) {
493	info->ports[wIndex].status |=
494	USB_PORT_STAT_ENABLE;
495	info->devices[wIndex].status =
496	USB_STATE_DEFAULT;
497	}
498
499	switch (info->devices[wIndex].speed) {
500	case XENUSB_SPEED_LOW:
501	info->ports[wIndex].status |=
502	USB_PORT_STAT_LOW_SPEED;
503	break;
504	case XENUSB_SPEED_HIGH:
505	info->ports[wIndex].status |=
506	USB_PORT_STAT_HIGH_SPEED;
507	break;
508	default:
509	break;
510	}
511	}
512
513	*(__le32 *)buf = cpu_to_le32(info->ports[wIndex].status);
514	break;
515	case SetPortFeature:
516	if (!wIndex || wIndex > ports)
517	goto error;
518
519	switch (wValue) {
520	case USB_PORT_FEAT_POWER:
521	xenhcd_rhport_power_on(info, portnum: wIndex);
522	break;
523	case USB_PORT_FEAT_RESET:
524	xenhcd_rhport_reset(info, portnum: wIndex);
525	break;
526	case USB_PORT_FEAT_SUSPEND:
527	xenhcd_rhport_suspend(info, portnum: wIndex);
528	break;
529	default:
530	if (info->ports[wIndex-1].status & USB_PORT_STAT_POWER)
531	info->ports[wIndex-1].status |= (1 << wValue);
532	}
533	break;
534
535	case SetHubFeature:
536	/* not supported */
537	default:
538	error:
539	ret = -EPIPE;
540	}
541	spin_unlock_irqrestore(lock: &info->lock, flags);
542
543	/* check status for each port */
544	for (i = 0; i < ports; i++) {
545	if (info->ports[i].status & PORT_C_MASK)
546	changed = 1;
547	}
548	if (changed)
549	usb_hcd_poll_rh_status(hcd);
550
551	return ret;
552	}
553
554	static void xenhcd_free_urb_priv(struct urb_priv *urbp)
555	{
556	urbp->urb->hcpriv = NULL;
557	kmem_cache_free(s: xenhcd_urbp_cachep, objp: urbp);
558	}
559
560	static inline unsigned int xenhcd_get_id_from_freelist(struct xenhcd_info *info)
561	{
562	unsigned int free;
563
564	free = info->shadow_free;
565	info->shadow_free = info->shadow[free].req.id;
566	info->shadow[free].req.id = 0x0fff; /* debug */
567	return free;
568	}
569
570	static inline void xenhcd_add_id_to_freelist(struct xenhcd_info *info,
571	unsigned int id)
572	{
573	info->shadow[id].req.id = info->shadow_free;
574	info->shadow[id].urb = NULL;
575	info->shadow_free = id;
576	}
577
578	static inline int xenhcd_count_pages(void *addr, int length)
579	{
580	unsigned long vaddr = (unsigned long)addr;
581
582	return PFN_UP(vaddr + length) - PFN_DOWN(vaddr);
583	}
584
585	static void xenhcd_gnttab_map(struct xenhcd_info *info, void *addr, int length,
586	grant_ref_t *gref_head,
587	struct xenusb_request_segment *seg,
588	int nr_pages, int flags)
589	{
590	grant_ref_t ref;
591	unsigned int offset;
592	unsigned int len = length;
593	unsigned int bytes;
594	int i;
595
596	for (i = 0; i < nr_pages; i++) {
597	offset = offset_in_page(addr);
598
599	bytes = PAGE_SIZE - offset;
600	if (bytes > len)
601	bytes = len;
602
603	ref = gnttab_claim_grant_reference(pprivate_head: gref_head);
604	gnttab_grant_foreign_access_ref(ref, domid: info->xbdev->otherend_id,
605	virt_to_gfn(addr), readonly: flags);
606	seg[i].gref = ref;
607	seg[i].offset = (__u16)offset;
608	seg[i].length = (__u16)bytes;
609
610	addr += bytes;
611	len -= bytes;
612	}
613	}
614
615	static __u32 xenhcd_pipe_urb_to_xenusb(__u32 urb_pipe, __u8 port)
616	{
617	static __u32 pipe;
618
619	pipe = usb_pipedevice(urb_pipe) << XENUSB_PIPE_DEV_SHIFT;
620	pipe |= usb_pipeendpoint(urb_pipe) << XENUSB_PIPE_EP_SHIFT;
621	if (usb_pipein(urb_pipe))
622	pipe |= XENUSB_PIPE_DIR;
623	switch (usb_pipetype(urb_pipe)) {
624	case PIPE_ISOCHRONOUS:
625	pipe |= XENUSB_PIPE_TYPE_ISOC << XENUSB_PIPE_TYPE_SHIFT;
626	break;
627	case PIPE_INTERRUPT:
628	pipe |= XENUSB_PIPE_TYPE_INT << XENUSB_PIPE_TYPE_SHIFT;
629	break;
630	case PIPE_CONTROL:
631	pipe |= XENUSB_PIPE_TYPE_CTRL << XENUSB_PIPE_TYPE_SHIFT;
632	break;
633	case PIPE_BULK:
634	pipe |= XENUSB_PIPE_TYPE_BULK << XENUSB_PIPE_TYPE_SHIFT;
635	break;
636	}
637	pipe = xenusb_setportnum_pipe(pipe, port);
638
639	return pipe;
640	}
641
642	static int xenhcd_map_urb_for_request(struct xenhcd_info *info, struct urb *urb,
643	struct xenusb_urb_request *req)
644	{
645	grant_ref_t gref_head;
646	int nr_buff_pages = 0;
647	int nr_isodesc_pages = 0;
648	int nr_grants = 0;
649
650	if (urb->transfer_buffer_length) {
651	nr_buff_pages = xenhcd_count_pages(addr: urb->transfer_buffer,
652	length: urb->transfer_buffer_length);
653
654	if (usb_pipeisoc(urb->pipe))
655	nr_isodesc_pages = xenhcd_count_pages(
656	addr: &urb->iso_frame_desc[0],
657	length: sizeof(struct usb_iso_packet_descriptor) *
658	urb->number_of_packets);
659
660	nr_grants = nr_buff_pages + nr_isodesc_pages;
661	if (nr_grants > XENUSB_MAX_SEGMENTS_PER_REQUEST) {
662	pr_err("xenhcd: error: %d grants\n", nr_grants);
663	return -E2BIG;
664	}
665
666	if (gnttab_alloc_grant_references(count: nr_grants, pprivate_head: &gref_head)) {
667	pr_err("xenhcd: gnttab_alloc_grant_references() error\n");
668	return -ENOMEM;
669	}
670
671	xenhcd_gnttab_map(info, addr: urb->transfer_buffer,
672	length: urb->transfer_buffer_length, gref_head: &gref_head,
673	seg: &req->seg[0], nr_pages: nr_buff_pages,
674	usb_pipein(urb->pipe) ? 0 : GTF_readonly);
675	}
676
677	req->pipe = xenhcd_pipe_urb_to_xenusb(urb_pipe: urb->pipe, port: urb->dev->portnum);
678	req->transfer_flags = 0;
679	if (urb->transfer_flags & URB_SHORT_NOT_OK)
680	req->transfer_flags |= XENUSB_SHORT_NOT_OK;
681	req->buffer_length = urb->transfer_buffer_length;
682	req->nr_buffer_segs = nr_buff_pages;
683
684	switch (usb_pipetype(urb->pipe)) {
685	case PIPE_ISOCHRONOUS:
686	req->u.isoc.interval = urb->interval;
687	req->u.isoc.start_frame = urb->start_frame;
688	req->u.isoc.number_of_packets = urb->number_of_packets;
689	req->u.isoc.nr_frame_desc_segs = nr_isodesc_pages;
690
691	xenhcd_gnttab_map(info, addr: &urb->iso_frame_desc[0],
692	length: sizeof(struct usb_iso_packet_descriptor) *
693	urb->number_of_packets,
694	gref_head: &gref_head, seg: &req->seg[nr_buff_pages],
695	nr_pages: nr_isodesc_pages, flags: 0);
696	break;
697	case PIPE_INTERRUPT:
698	req->u.intr.interval = urb->interval;
699	break;
700	case PIPE_CONTROL:
701	if (urb->setup_packet)
702	memcpy(req->u.ctrl, urb->setup_packet, 8);
703	break;
704	case PIPE_BULK:
705	break;
706	default:
707	break;
708	}
709
710	if (nr_grants)
711	gnttab_free_grant_references(head: gref_head);
712
713	return 0;
714	}
715
716	static void xenhcd_gnttab_done(struct xenhcd_info *info, unsigned int id)
717	{
718	struct usb_shadow *shadow = info->shadow + id;
719	int nr_segs = 0;
720	int i;
721
722	if (!shadow->in_flight) {
723	xenhcd_set_error(info, msg: "Illegal request id");
724	return;
725	}
726	shadow->in_flight = false;
727
728	nr_segs = shadow->req.nr_buffer_segs;
729
730	if (xenusb_pipeisoc(shadow->req.pipe))
731	nr_segs += shadow->req.u.isoc.nr_frame_desc_segs;
732
733	for (i = 0; i < nr_segs; i++) {
734	if (!gnttab_try_end_foreign_access(ref: shadow->req.seg[i].gref))
735	xenhcd_set_error(info, msg: "backend didn't release grant");
736	}
737
738	shadow->req.nr_buffer_segs = 0;
739	shadow->req.u.isoc.nr_frame_desc_segs = 0;
740	}
741
742	static int xenhcd_translate_status(int status)
743	{
744	switch (status) {
745	case XENUSB_STATUS_OK:
746	return 0;
747	case XENUSB_STATUS_NODEV:
748	return -ENODEV;
749	case XENUSB_STATUS_INVAL:
750	return -EINVAL;
751	case XENUSB_STATUS_STALL:
752	return -EPIPE;
753	case XENUSB_STATUS_IOERROR:
754	return -EPROTO;
755	case XENUSB_STATUS_BABBLE:
756	return -EOVERFLOW;
757	default:
758	return -ESHUTDOWN;
759	}
760	}
761
762	static void xenhcd_giveback_urb(struct xenhcd_info *info, struct urb *urb,
763	int status)
764	{
765	struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
766	int priv_status = urbp->status;
767
768	list_del_init(entry: &urbp->list);
769	xenhcd_free_urb_priv(urbp);
770
771	if (urb->status == -EINPROGRESS)
772	urb->status = xenhcd_translate_status(status);
773
774	spin_unlock(lock: &info->lock);
775	usb_hcd_giveback_urb(hcd: xenhcd_info_to_hcd(info), urb,
776	status: priv_status <= 0 ? priv_status : urb->status);
777	spin_lock(lock: &info->lock);
778	}
779
780	static int xenhcd_do_request(struct xenhcd_info *info, struct urb_priv *urbp)
781	{
782	struct xenusb_urb_request *req;
783	struct urb *urb = urbp->urb;
784	unsigned int id;
785	int notify;
786	int ret;
787
788	id = xenhcd_get_id_from_freelist(info);
789	req = &info->shadow[id].req;
790	req->id = id;
791
792	if (unlikely(urbp->unlinked)) {
793	req->u.unlink.unlink_id = urbp->req_id;
794	req->pipe = xenusb_setunlink_pipe(xenhcd_pipe_urb_to_xenusb(
795	urb->pipe, urb->dev->portnum));
796	urbp->unlink_req_id = id;
797	} else {
798	ret = xenhcd_map_urb_for_request(info, urb, req);
799	if (ret) {
800	xenhcd_add_id_to_freelist(info, id);
801	return ret;
802	}
803	urbp->req_id = id;
804	}
805
806	req = RING_GET_REQUEST(&info->urb_ring, info->urb_ring.req_prod_pvt);
807	*req = info->shadow[id].req;
808
809	info->urb_ring.req_prod_pvt++;
810	info->shadow[id].urb = urb;
811	info->shadow[id].in_flight = true;
812
813	RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&info->urb_ring, notify);
814	if (notify)
815	notify_remote_via_irq(irq: info->irq);
816
817	return 0;
818	}
819
820	static void xenhcd_kick_pending_urbs(struct xenhcd_info *info)
821	{
822	struct urb_priv *urbp;
823
824	while (!list_empty(head: &info->pending_submit_list)) {
825	if (RING_FULL(&info->urb_ring)) {
826	xenhcd_timer_action(info, action: TIMER_RING_WATCHDOG);
827	return;
828	}
829
830	urbp = list_entry(info->pending_submit_list.next,
831	struct urb_priv, list);
832	if (!xenhcd_do_request(info, urbp))
833	list_move_tail(list: &urbp->list, head: &info->in_progress_list);
834	else
835	xenhcd_giveback_urb(info, urb: urbp->urb, status: -ESHUTDOWN);
836	}
837	xenhcd_timer_action_done(info, action: TIMER_SCAN_PENDING_URBS);
838	}
839
840	/*
841	* caller must lock info->lock
842	*/
843	static void xenhcd_cancel_all_enqueued_urbs(struct xenhcd_info *info)
844	{
845	struct urb_priv *urbp, *tmp;
846	int req_id;
847
848	list_for_each_entry_safe(urbp, tmp, &info->in_progress_list, list) {
849	req_id = urbp->req_id;
850	if (!urbp->unlinked) {
851	xenhcd_gnttab_done(info, id: req_id);
852	if (info->error)
853	return;
854	if (urbp->urb->status == -EINPROGRESS)
855	/* not dequeued */
856	xenhcd_giveback_urb(info, urb: urbp->urb,
857	status: -ESHUTDOWN);
858	else /* dequeued */
859	xenhcd_giveback_urb(info, urb: urbp->urb,
860	status: urbp->urb->status);
861	}
862	info->shadow[req_id].urb = NULL;
863	}
864
865	list_for_each_entry_safe(urbp, tmp, &info->pending_submit_list, list)
866	xenhcd_giveback_urb(info, urb: urbp->urb, status: -ESHUTDOWN);
867	}
868
869	/*
870	* caller must lock info->lock
871	*/
872	static void xenhcd_giveback_unlinked_urbs(struct xenhcd_info *info)
873	{
874	struct urb_priv *urbp, *tmp;
875
876	list_for_each_entry_safe(urbp, tmp, &info->giveback_waiting_list, list)
877	xenhcd_giveback_urb(info, urb: urbp->urb, status: urbp->urb->status);
878	}
879
880	static int xenhcd_submit_urb(struct xenhcd_info *info, struct urb_priv *urbp)
881	{
882	int ret;
883
884	if (RING_FULL(&info->urb_ring)) {
885	list_add_tail(new: &urbp->list, head: &info->pending_submit_list);
886	xenhcd_timer_action(info, action: TIMER_RING_WATCHDOG);
887	return 0;
888	}
889
890	if (!list_empty(head: &info->pending_submit_list)) {
891	list_add_tail(new: &urbp->list, head: &info->pending_submit_list);
892	xenhcd_timer_action(info, action: TIMER_SCAN_PENDING_URBS);
893	return 0;
894	}
895
896	ret = xenhcd_do_request(info, urbp);
897	if (ret == 0)
898	list_add_tail(new: &urbp->list, head: &info->in_progress_list);
899
900	return ret;
901	}
902
903	static int xenhcd_unlink_urb(struct xenhcd_info *info, struct urb_priv *urbp)
904	{
905	int ret;
906
907	/* already unlinked? */
908	if (urbp->unlinked)
909	return -EBUSY;
910
911	urbp->unlinked = true;
912
913	/* the urb is still in pending_submit queue */
914	if (urbp->req_id == ~0) {
915	list_move_tail(list: &urbp->list, head: &info->giveback_waiting_list);
916	xenhcd_timer_action(info, action: TIMER_SCAN_PENDING_URBS);
917	return 0;
918	}
919
920	/* send unlink request to backend */
921	if (RING_FULL(&info->urb_ring)) {
922	list_move_tail(list: &urbp->list, head: &info->pending_unlink_list);
923	xenhcd_timer_action(info, action: TIMER_RING_WATCHDOG);
924	return 0;
925	}
926
927	if (!list_empty(head: &info->pending_unlink_list)) {
928	list_move_tail(list: &urbp->list, head: &info->pending_unlink_list);
929	xenhcd_timer_action(info, action: TIMER_SCAN_PENDING_URBS);
930	return 0;
931	}
932
933	ret = xenhcd_do_request(info, urbp);
934	if (ret == 0)
935	list_move_tail(list: &urbp->list, head: &info->in_progress_list);
936
937	return ret;
938	}
939
940	static void xenhcd_res_to_urb(struct xenhcd_info *info,
941	struct xenusb_urb_response *res, struct urb *urb)
942	{
943	if (unlikely(!urb))
944	return;
945
946	if (res->actual_length > urb->transfer_buffer_length)
947	urb->actual_length = urb->transfer_buffer_length;
948	else if (res->actual_length < 0)
949	urb->actual_length = 0;
950	else
951	urb->actual_length = res->actual_length;
952	urb->error_count = res->error_count;
953	urb->start_frame = res->start_frame;
954	xenhcd_giveback_urb(info, urb, status: res->status);
955	}
956
957	static int xenhcd_urb_request_done(struct xenhcd_info *info,
958	unsigned int *eoiflag)
959	{
960	struct xenusb_urb_response res;
961	RING_IDX i, rp;
962	__u16 id;
963	int more_to_do = 0;
964	unsigned long flags;
965
966	spin_lock_irqsave(&info->lock, flags);
967
968	rp = info->urb_ring.sring->rsp_prod;
969	if (RING_RESPONSE_PROD_OVERFLOW(&info->urb_ring, rp)) {
970	xenhcd_set_error(info, msg: "Illegal index on urb-ring");
971	goto err;
972	}
973	rmb(); /* ensure we see queued responses up to "rp" */
974
975	for (i = info->urb_ring.rsp_cons; i != rp; i++) {
976	RING_COPY_RESPONSE(&info->urb_ring, i, &res);
977	id = res.id;
978	if (id >= XENUSB_URB_RING_SIZE) {
979	xenhcd_set_error(info, msg: "Illegal data on urb-ring");
980	goto err;
981	}
982
983	if (likely(xenusb_pipesubmit(info->shadow[id].req.pipe))) {
984	xenhcd_gnttab_done(info, id);
985	if (info->error)
986	goto err;
987	xenhcd_res_to_urb(info, res: &res, urb: info->shadow[id].urb);
988	}
989
990	xenhcd_add_id_to_freelist(info, id);
991
992	*eoiflag = 0;
993	}
994	info->urb_ring.rsp_cons = i;
995
996	if (i != info->urb_ring.req_prod_pvt)
997	RING_FINAL_CHECK_FOR_RESPONSES(&info->urb_ring, more_to_do);
998	else
999	info->urb_ring.sring->rsp_event = i + 1;
1000
1001	spin_unlock_irqrestore(lock: &info->lock, flags);
1002
1003	return more_to_do;
1004
1005	err:
1006	spin_unlock_irqrestore(lock: &info->lock, flags);
1007	return 0;
1008	}
1009
1010	static int xenhcd_conn_notify(struct xenhcd_info *info, unsigned int *eoiflag)
1011	{
1012	struct xenusb_conn_response res;
1013	struct xenusb_conn_request *req;
1014	RING_IDX rc, rp;
1015	__u16 id;
1016	__u8 portnum, speed;
1017	int more_to_do = 0;
1018	int notify;
1019	int port_changed = 0;
1020	unsigned long flags;
1021
1022	spin_lock_irqsave(&info->lock, flags);
1023
1024	rc = info->conn_ring.rsp_cons;
1025	rp = info->conn_ring.sring->rsp_prod;
1026	if (RING_RESPONSE_PROD_OVERFLOW(&info->conn_ring, rp)) {
1027	xenhcd_set_error(info, msg: "Illegal index on conn-ring");
1028	spin_unlock_irqrestore(lock: &info->lock, flags);
1029	return 0;
1030	}
1031	rmb(); /* ensure we see queued responses up to "rp" */
1032
1033	while (rc != rp) {
1034	RING_COPY_RESPONSE(&info->conn_ring, rc, &res);
1035	id = res.id;
1036	portnum = res.portnum;
1037	speed = res.speed;
1038	info->conn_ring.rsp_cons = ++rc;
1039
1040	if (xenhcd_rhport_connect(info, portnum, speed)) {
1041	xenhcd_set_error(info, msg: "Illegal data on conn-ring");
1042	spin_unlock_irqrestore(lock: &info->lock, flags);
1043	return 0;
1044	}
1045
1046	if (info->ports[portnum - 1].c_connection)
1047	port_changed = 1;
1048
1049	barrier();
1050
1051	req = RING_GET_REQUEST(&info->conn_ring,
1052	info->conn_ring.req_prod_pvt);
1053	req->id = id;
1054	info->conn_ring.req_prod_pvt++;
1055
1056	*eoiflag = 0;
1057	}
1058
1059	if (rc != info->conn_ring.req_prod_pvt)
1060	RING_FINAL_CHECK_FOR_RESPONSES(&info->conn_ring, more_to_do);
1061	else
1062	info->conn_ring.sring->rsp_event = rc + 1;
1063
1064	RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&info->conn_ring, notify);
1065	if (notify)
1066	notify_remote_via_irq(irq: info->irq);
1067
1068	spin_unlock_irqrestore(lock: &info->lock, flags);
1069
1070	if (port_changed)
1071	usb_hcd_poll_rh_status(hcd: xenhcd_info_to_hcd(info));
1072
1073	return more_to_do;
1074	}
1075
1076	static irqreturn_t xenhcd_int(int irq, void *dev_id)
1077	{
1078	struct xenhcd_info *info = (struct xenhcd_info *)dev_id;
1079	unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS;
1080
1081	if (unlikely(info->error)) {
1082	xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS);
1083	return IRQ_HANDLED;
1084	}
1085
1086	while (xenhcd_urb_request_done(info, eoiflag: &eoiflag) |
1087	xenhcd_conn_notify(info, eoiflag: &eoiflag))
1088	/* Yield point for this unbounded loop. */
1089	cond_resched();
1090
1091	xen_irq_lateeoi(irq, eoi_flags: eoiflag);
1092	return IRQ_HANDLED;
1093	}
1094
1095	static void xenhcd_destroy_rings(struct xenhcd_info *info)
1096	{
1097	if (info->irq)
1098	unbind_from_irqhandler(irq: info->irq, dev_id: info);
1099	info->irq = 0;
1100
1101	xenbus_teardown_ring(vaddr: (void **)&info->urb_ring.sring, nr_pages: 1,
1102	grefs: &info->urb_ring_ref);
1103	xenbus_teardown_ring(vaddr: (void **)&info->conn_ring.sring, nr_pages: 1,
1104	grefs: &info->conn_ring_ref);
1105	}
1106
1107	static int xenhcd_setup_rings(struct xenbus_device *dev,
1108	struct xenhcd_info *info)
1109	{
1110	struct xenusb_urb_sring *urb_sring;
1111	struct xenusb_conn_sring *conn_sring;
1112	int err;
1113
1114	info->conn_ring_ref = INVALID_GRANT_REF;
1115	err = xenbus_setup_ring(dev, GFP_NOIO | __GFP_HIGH,
1116	vaddr: (void **)&urb_sring, nr_pages: 1, grefs: &info->urb_ring_ref);
1117	if (err) {
1118	xenbus_dev_fatal(dev, err, fmt: "allocating urb ring");
1119	return err;
1120	}
1121	XEN_FRONT_RING_INIT(&info->urb_ring, urb_sring, PAGE_SIZE);
1122
1123	err = xenbus_setup_ring(dev, GFP_NOIO | __GFP_HIGH,
1124	vaddr: (void **)&conn_sring, nr_pages: 1, grefs: &info->conn_ring_ref);
1125	if (err) {
1126	xenbus_dev_fatal(dev, err, fmt: "allocating conn ring");
1127	goto fail;
1128	}
1129	XEN_FRONT_RING_INIT(&info->conn_ring, conn_sring, PAGE_SIZE);
1130
1131	err = xenbus_alloc_evtchn(dev, port: &info->evtchn);
1132	if (err) {
1133	xenbus_dev_fatal(dev, err, fmt: "xenbus_alloc_evtchn");
1134	goto fail;
1135	}
1136
1137	err = bind_evtchn_to_irq_lateeoi(evtchn: info->evtchn);
1138	if (err <= 0) {
1139	xenbus_dev_fatal(dev, err, fmt: "bind_evtchn_to_irq_lateeoi");
1140	goto fail;
1141	}
1142
1143	info->irq = err;
1144
1145	err = request_threaded_irq(irq: info->irq, NULL, thread_fn: xenhcd_int,
1146	IRQF_ONESHOT, name: "xenhcd", dev: info);
1147	if (err) {
1148	xenbus_dev_fatal(dev, err, fmt: "request_threaded_irq");
1149	goto free_irq;
1150	}
1151
1152	return 0;
1153
1154	free_irq:
1155	unbind_from_irqhandler(irq: info->irq, dev_id: info);
1156	fail:
1157	xenhcd_destroy_rings(info);
1158	return err;
1159	}
1160
1161	static int xenhcd_talk_to_backend(struct xenbus_device *dev,
1162	struct xenhcd_info *info)
1163	{
1164	const char *message;
1165	struct xenbus_transaction xbt;
1166	int err;
1167
1168	err = xenhcd_setup_rings(dev, info);
1169	if (err)
1170	return err;
1171
1172	again:
1173	err = xenbus_transaction_start(t: &xbt);
1174	if (err) {
1175	xenbus_dev_fatal(dev, err, fmt: "starting transaction");
1176	goto destroy_ring;
1177	}
1178
1179	err = xenbus_printf(t: xbt, dir: dev->nodename, node: "urb-ring-ref", fmt: "%u",
1180	info->urb_ring_ref);
1181	if (err) {
1182	message = "writing urb-ring-ref";
1183	goto abort_transaction;
1184	}
1185
1186	err = xenbus_printf(t: xbt, dir: dev->nodename, node: "conn-ring-ref", fmt: "%u",
1187	info->conn_ring_ref);
1188	if (err) {
1189	message = "writing conn-ring-ref";
1190	goto abort_transaction;
1191	}
1192
1193	err = xenbus_printf(t: xbt, dir: dev->nodename, node: "event-channel", fmt: "%u",
1194	info->evtchn);
1195	if (err) {
1196	message = "writing event-channel";
1197	goto abort_transaction;
1198	}
1199
1200	err = xenbus_transaction_end(t: xbt, abort: 0);
1201	if (err) {
1202	if (err == -EAGAIN)
1203	goto again;
1204	xenbus_dev_fatal(dev, err, fmt: "completing transaction");
1205	goto destroy_ring;
1206	}
1207
1208	return 0;
1209
1210	abort_transaction:
1211	xenbus_transaction_end(t: xbt, abort: 1);
1212	xenbus_dev_fatal(dev, err, fmt: "%s", message);
1213
1214	destroy_ring:
1215	xenhcd_destroy_rings(info);
1216
1217	return err;
1218	}
1219
1220	static int xenhcd_connect(struct xenbus_device *dev)
1221	{
1222	struct xenhcd_info *info = dev_get_drvdata(dev: &dev->dev);
1223	struct xenusb_conn_request *req;
1224	int idx, err;
1225	int notify;
1226	char name[TASK_COMM_LEN];
1227	struct usb_hcd *hcd;
1228
1229	hcd = xenhcd_info_to_hcd(info);
1230	snprintf(buf: name, size: TASK_COMM_LEN, fmt: "xenhcd.%d", hcd->self.busnum);
1231
1232	err = xenhcd_talk_to_backend(dev, info);
1233	if (err)
1234	return err;
1235
1236	/* prepare ring for hotplug notification */
1237	for (idx = 0; idx < XENUSB_CONN_RING_SIZE; idx++) {
1238	req = RING_GET_REQUEST(&info->conn_ring, idx);
1239	req->id = idx;
1240	}
1241	info->conn_ring.req_prod_pvt = idx;
1242
1243	RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&info->conn_ring, notify);
1244	if (notify)
1245	notify_remote_via_irq(irq: info->irq);
1246
1247	return 0;
1248	}
1249
1250	static void xenhcd_disconnect(struct xenbus_device *dev)
1251	{
1252	struct xenhcd_info *info = dev_get_drvdata(dev: &dev->dev);
1253	struct usb_hcd *hcd = xenhcd_info_to_hcd(info);
1254
1255	usb_remove_hcd(hcd);
1256	xenbus_frontend_closed(dev);
1257	}
1258
1259	static void xenhcd_watchdog(struct timer_list *timer)
1260	{
1261	struct xenhcd_info *info = from_timer(info, timer, watchdog);
1262	unsigned long flags;
1263
1264	spin_lock_irqsave(&info->lock, flags);
1265	if (likely(HC_IS_RUNNING(xenhcd_info_to_hcd(info)->state))) {
1266	xenhcd_timer_action_done(info, action: TIMER_RING_WATCHDOG);
1267	xenhcd_giveback_unlinked_urbs(info);
1268	xenhcd_kick_pending_urbs(info);
1269	}
1270	spin_unlock_irqrestore(lock: &info->lock, flags);
1271	}
1272
1273	/*
1274	* one-time HC init
1275	*/
1276	static int xenhcd_setup(struct usb_hcd *hcd)
1277	{
1278	struct xenhcd_info *info = xenhcd_hcd_to_info(hcd);
1279
1280	spin_lock_init(&info->lock);
1281	INIT_LIST_HEAD(list: &info->pending_submit_list);
1282	INIT_LIST_HEAD(list: &info->pending_unlink_list);
1283	INIT_LIST_HEAD(list: &info->in_progress_list);
1284	INIT_LIST_HEAD(list: &info->giveback_waiting_list);
1285	timer_setup(&info->watchdog, xenhcd_watchdog, 0);
1286
1287	hcd->has_tt = (hcd->driver->flags & HCD_MASK) != HCD_USB11;
1288
1289	return 0;
1290	}
1291
1292	/*
1293	* start HC running
1294	*/
1295	static int xenhcd_run(struct usb_hcd *hcd)
1296	{
1297	hcd->uses_new_polling = 1;
1298	clear_bit(HCD_FLAG_POLL_RH, addr: &hcd->flags);
1299	hcd->state = HC_STATE_RUNNING;
1300	return 0;
1301	}
1302
1303	/*
1304	* stop running HC
1305	*/
1306	static void xenhcd_stop(struct usb_hcd *hcd)
1307	{
1308	struct xenhcd_info *info = xenhcd_hcd_to_info(hcd);
1309
1310	del_timer_sync(timer: &info->watchdog);
1311	spin_lock_irq(lock: &info->lock);
1312	/* cancel all urbs */
1313	hcd->state = HC_STATE_HALT;
1314	xenhcd_cancel_all_enqueued_urbs(info);
1315	xenhcd_giveback_unlinked_urbs(info);
1316	spin_unlock_irq(lock: &info->lock);
1317	}
1318
1319	/*
1320	* called as .urb_enqueue()
1321	* non-error returns are promise to giveback the urb later
1322	*/
1323	static int xenhcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
1324	gfp_t mem_flags)
1325	{
1326	struct xenhcd_info *info = xenhcd_hcd_to_info(hcd);
1327	struct urb_priv *urbp;
1328	unsigned long flags;
1329	int ret;
1330
1331	if (unlikely(info->error))
1332	return -ESHUTDOWN;
1333
1334	urbp = kmem_cache_zalloc(k: xenhcd_urbp_cachep, flags: mem_flags);
1335	if (!urbp)
1336	return -ENOMEM;
1337
1338	spin_lock_irqsave(&info->lock, flags);
1339
1340	urbp->urb = urb;
1341	urb->hcpriv = urbp;
1342	urbp->req_id = ~0;
1343	urbp->unlink_req_id = ~0;
1344	INIT_LIST_HEAD(list: &urbp->list);
1345	urbp->status = 1;
1346	urb->unlinked = false;
1347
1348	ret = xenhcd_submit_urb(info, urbp);
1349
1350	if (ret)
1351	xenhcd_free_urb_priv(urbp);
1352
1353	spin_unlock_irqrestore(lock: &info->lock, flags);
1354
1355	return ret;
1356	}
1357
1358	/*
1359	* called as .urb_dequeue()
1360	*/
1361	static int xenhcd_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
1362	{
1363	struct xenhcd_info *info = xenhcd_hcd_to_info(hcd);
1364	struct urb_priv *urbp;
1365	unsigned long flags;
1366	int ret = 0;
1367
1368	spin_lock_irqsave(&info->lock, flags);
1369
1370	urbp = urb->hcpriv;
1371	if (urbp) {
1372	urbp->status = status;
1373	ret = xenhcd_unlink_urb(info, urbp);
1374	}
1375
1376	spin_unlock_irqrestore(lock: &info->lock, flags);
1377
1378	return ret;
1379	}
1380
1381	/*
1382	* called from usb_get_current_frame_number(),
1383	* but, almost all drivers not use such function.
1384	*/
1385	static int xenhcd_get_frame(struct usb_hcd *hcd)
1386	{
1387	/* it means error, but probably no problem :-) */
1388	return 0;
1389	}
1390
1391	static struct hc_driver xenhcd_usb20_hc_driver = {
1392	.description = "xen-hcd",
1393	.product_desc = "Xen USB2.0 Virtual Host Controller",
1394	.hcd_priv_size = sizeof(struct xenhcd_info),
1395	.flags = HCD_USB2,
1396
1397	/* basic HC lifecycle operations */
1398	.reset = xenhcd_setup,
1399	.start = xenhcd_run,
1400	.stop = xenhcd_stop,
1401
1402	/* managing urb I/O */
1403	.urb_enqueue = xenhcd_urb_enqueue,
1404	.urb_dequeue = xenhcd_urb_dequeue,
1405	.get_frame_number = xenhcd_get_frame,
1406
1407	/* root hub operations */
1408	.hub_status_data = xenhcd_hub_status_data,
1409	.hub_control = xenhcd_hub_control,
1410	#ifdef CONFIG_PM
1411	.bus_suspend = xenhcd_bus_suspend,
1412	.bus_resume = xenhcd_bus_resume,
1413	#endif
1414	};
1415
1416	static struct hc_driver xenhcd_usb11_hc_driver = {
1417	.description = "xen-hcd",
1418	.product_desc = "Xen USB1.1 Virtual Host Controller",
1419	.hcd_priv_size = sizeof(struct xenhcd_info),
1420	.flags = HCD_USB11,
1421
1422	/* basic HC lifecycle operations */
1423	.reset = xenhcd_setup,
1424	.start = xenhcd_run,
1425	.stop = xenhcd_stop,
1426
1427	/* managing urb I/O */
1428	.urb_enqueue = xenhcd_urb_enqueue,
1429	.urb_dequeue = xenhcd_urb_dequeue,
1430	.get_frame_number = xenhcd_get_frame,
1431
1432	/* root hub operations */
1433	.hub_status_data = xenhcd_hub_status_data,
1434	.hub_control = xenhcd_hub_control,
1435	#ifdef CONFIG_PM
1436	.bus_suspend = xenhcd_bus_suspend,
1437	.bus_resume = xenhcd_bus_resume,
1438	#endif
1439	};
1440
1441	static struct usb_hcd *xenhcd_create_hcd(struct xenbus_device *dev)
1442	{
1443	int i;
1444	int err = 0;
1445	int num_ports;
1446	int usb_ver;
1447	struct usb_hcd *hcd = NULL;
1448	struct xenhcd_info *info;
1449
1450	err = xenbus_scanf(XBT_NIL, dir: dev->otherend, node: "num-ports", fmt: "%d",
1451	&num_ports);
1452	if (err != 1) {
1453	xenbus_dev_fatal(dev, err, "reading num-ports");
1454	return ERR_PTR(-EINVAL);
1455	}
1456	if (num_ports < 1 || num_ports > XENUSB_MAX_PORTNR) {
1457	xenbus_dev_fatal(dev, err, "invalid num-ports");
1458	return ERR_PTR(-EINVAL);
1459	}
1460
1461	err = xenbus_scanf(XBT_NIL, dev->otherend, "usb-ver", "%d", &usb_ver);
1462	if (err != 1) {
1463	xenbus_dev_fatal(dev, err, "reading usb-ver");
1464	return ERR_PTR(-EINVAL);
1465	}
1466	switch (usb_ver) {
1467	case XENUSB_VER_USB11:
1468	hcd = usb_create_hcd(&xenhcd_usb11_hc_driver, &dev->dev,
1469	dev_name(&dev->dev));
1470	break;
1471	case XENUSB_VER_USB20:
1472	hcd = usb_create_hcd(&xenhcd_usb20_hc_driver, &dev->dev,
1473	dev_name(&dev->dev));
1474	break;
1475	default:
1476	xenbus_dev_fatal(dev, err, "invalid usb-ver");
1477	return ERR_PTR(-EINVAL);
1478	}
1479	if (!hcd) {
1480	xenbus_dev_fatal(dev, err,
1481	"fail to allocate USB host controller");
1482	return ERR_PTR(-ENOMEM);
1483	}
1484
1485	info = xenhcd_hcd_to_info(hcd);
1486	info->xbdev = dev;
1487	info->rh_numports = num_ports;
1488
1489	for (i = 0; i < XENUSB_URB_RING_SIZE; i++) {
1490	info->shadow[i].req.id = i + 1;
1491	info->shadow[i].urb = NULL;
1492	info->shadow[i].in_flight = false;
1493	}
1494	info->shadow[XENUSB_URB_RING_SIZE - 1].req.id = 0x0fff;
1495
1496	return hcd;
1497	}
1498
1499	static void xenhcd_backend_changed(struct xenbus_device *dev,
1500	enum xenbus_state backend_state)
1501	{
1502	switch (backend_state) {
1503	case XenbusStateInitialising:
1504	case XenbusStateReconfiguring:
1505	case XenbusStateReconfigured:
1506	case XenbusStateUnknown:
1507	break;
1508
1509	case XenbusStateInitWait:
1510	case XenbusStateInitialised:
1511	case XenbusStateConnected:
1512	if (dev->state != XenbusStateInitialising)
1513	break;
1514	if (!xenhcd_connect(dev))
1515	xenbus_switch_state(dev, new_state: XenbusStateConnected);
1516	break;
1517
1518	case XenbusStateClosed:
1519	if (dev->state == XenbusStateClosed)
1520	break;
1521	fallthrough; /* Missed the backend's Closing state. */
1522	case XenbusStateClosing:
1523	xenhcd_disconnect(dev);
1524	break;
1525
1526	default:
1527	xenbus_dev_fatal(dev, err: -EINVAL, fmt: "saw state %d at frontend",
1528	backend_state);
1529	break;
1530	}
1531	}
1532
1533	static void xenhcd_remove(struct xenbus_device *dev)
1534	{
1535	struct xenhcd_info *info = dev_get_drvdata(dev: &dev->dev);
1536	struct usb_hcd *hcd = xenhcd_info_to_hcd(info);
1537
1538	xenhcd_destroy_rings(info);
1539	usb_put_hcd(hcd);
1540	}
1541
1542	static int xenhcd_probe(struct xenbus_device *dev,
1543	const struct xenbus_device_id *id)
1544	{
1545	int err;
1546	struct usb_hcd *hcd;
1547	struct xenhcd_info *info;
1548
1549	if (usb_disabled())
1550	return -ENODEV;
1551
1552	hcd = xenhcd_create_hcd(dev);
1553	if (IS_ERR(ptr: hcd)) {
1554	err = PTR_ERR(ptr: hcd);
1555	xenbus_dev_fatal(dev, err,
1556	fmt: "fail to create usb host controller");
1557	return err;
1558	}
1559
1560	info = xenhcd_hcd_to_info(hcd);
1561	dev_set_drvdata(dev: &dev->dev, data: info);
1562
1563	err = usb_add_hcd(hcd, irqnum: 0, irqflags: 0);
1564	if (err) {
1565	xenbus_dev_fatal(dev, err, fmt: "fail to add USB host controller");
1566	usb_put_hcd(hcd);
1567	dev_set_drvdata(dev: &dev->dev, NULL);
1568	}
1569
1570	return err;
1571	}
1572
1573	static const struct xenbus_device_id xenhcd_ids[] = {
1574	{ "vusb" },
1575	{ "" },
1576	};
1577
1578	static struct xenbus_driver xenhcd_driver = {
1579	.ids = xenhcd_ids,
1580	.probe = xenhcd_probe,
1581	.otherend_changed = xenhcd_backend_changed,
1582	.remove = xenhcd_remove,
1583	};
1584
1585	static int __init xenhcd_init(void)
1586	{
1587	if (!xen_domain())
1588	return -ENODEV;
1589
1590	xenhcd_urbp_cachep = kmem_cache_create(name: "xenhcd_urb_priv",
1591	size: sizeof(struct urb_priv), align: 0, flags: 0, NULL);
1592	if (!xenhcd_urbp_cachep) {
1593	pr_err("xenhcd failed to create kmem cache\n");
1594	return -ENOMEM;
1595	}
1596
1597	return xenbus_register_frontend(&xenhcd_driver);
1598	}
1599	module_init(xenhcd_init);
1600
1601	static void __exit xenhcd_exit(void)
1602	{
1603	kmem_cache_destroy(s: xenhcd_urbp_cachep);
1604	xenbus_unregister_driver(drv: &xenhcd_driver);
1605	}
1606	module_exit(xenhcd_exit);
1607
1608	MODULE_ALIAS("xen:vusb");
1609	MODULE_AUTHOR("Juergen Gross <jgross@suse.com>");
1610	MODULE_DESCRIPTION("Xen USB Virtual Host Controller driver (xen-hcd)");
1611	MODULE_LICENSE("Dual BSD/GPL");
1612