USB uhci bug fix.
[opensuse:kernel.git] / drivers / usb / uhci.c
1 /*
2  * Universal Host Controller Interface driver for USB.
3  *
4  * Maintainer: Johannes Erdfelt <johannes@erdfelt.com>
5  *
6  * (C) Copyright 1999 Linus Torvalds
7  * (C) Copyright 1999-2002 Johannes Erdfelt, johannes@erdfelt.com
8  * (C) Copyright 1999 Randy Dunlap
9  * (C) Copyright 1999 Georg Acher, acher@in.tum.de
10  * (C) Copyright 1999 Deti Fliegl, deti@fliegl.de
11  * (C) Copyright 1999 Thomas Sailer, sailer@ife.ee.ethz.ch
12  * (C) Copyright 1999 Roman Weissgaerber, weissg@vienna.at
13  * (C) Copyright 2000 Yggdrasil Computing, Inc. (port of new PCI interface
14  *               support from usb-ohci.c by Adam Richter, adam@yggdrasil.com).
15  * (C) Copyright 1999 Gregory P. Smith (from usb-ohci.c)
16  *
17  * Intel documents this fairly well, and as far as I know there
18  * are no royalties or anything like that, but even so there are
19  * people who decided that they want to do the same thing in a
20  * completely different way.
21  *
22  * WARNING! The USB documentation is downright evil. Most of it
23  * is just crap, written by a committee. You're better off ignoring
24  * most of it, the important stuff is:
25  *  - the low-level protocol (fairly simple but lots of small details)
26  *  - working around the horridness of the rest
27  */
28
29 #include <linux/config.h>
30 #include <linux/module.h>
31 #include <linux/pci.h>
32 #include <linux/kernel.h>
33 #include <linux/init.h>
34 #include <linux/delay.h>
35 #include <linux/ioport.h>
36 #include <linux/sched.h>
37 #include <linux/slab.h>
38 #include <linux/smp_lock.h>
39 #include <linux/errno.h>
40 #include <linux/unistd.h>
41 #include <linux/interrupt.h>
42 #include <linux/spinlock.h>
43 #include <linux/proc_fs.h>
44 #ifdef CONFIG_USB_DEBUG
45 #define DEBUG
46 #else
47 #undef DEBUG
48 #endif
49 #include <linux/usb.h>
50
51 #include <asm/uaccess.h>
52 #include <asm/io.h>
53 #include <asm/irq.h>
54 #include <asm/system.h>
55
56 #include "hcd.h"
57 #include "uhci.h"
58
59 #include <linux/pm.h>
60
61 /*
62  * Version Information
63  */
64 #define DRIVER_VERSION "v1.1"
65 #define DRIVER_AUTHOR "Linus 'Frodo Rabbit' Torvalds, Johannes Erdfelt, Randy Dunlap, Georg Acher, Deti Fliegl, Thomas Sailer, Roman Weissgaerber"
66 #define DRIVER_DESC "USB Universal Host Controller Interface driver"
67
68 /*
69  * debug = 0, no debugging messages
70  * debug = 1, dump failed URB's except for stalls
71  * debug = 2, dump all failed URB's (including stalls)
72  *            show all queues in /proc/uhci/hc*
73  * debug = 3, show all TD's in URB's when dumping
74  */
75 #ifdef DEBUG
76 static int debug = 1;
77 #else
78 static int debug = 0;
79 #endif
80 MODULE_PARM(debug, "i");
81 MODULE_PARM_DESC(debug, "Debug level");
82 static char *errbuf;
83 #define ERRBUF_LEN    (PAGE_SIZE * 8)
84
85 #include "uhci-debug.h"
86
87 static kmem_cache_t *uhci_up_cachep;    /* urb_priv */
88
89 static int rh_submit_urb(struct urb *urb);
90 static int rh_unlink_urb(struct urb *urb);
91 static int uhci_get_current_frame_number(struct usb_device *dev);
92 static int uhci_unlink_urb(struct urb *urb);
93 static void uhci_unlink_generic(struct uhci *uhci, struct urb *urb);
94 static void uhci_call_completion(struct urb *urb);
95
96 static int  ports_active(struct uhci *uhci);
97 static void suspend_hc(struct uhci *uhci);
98 static void wakeup_hc(struct uhci *uhci);
99
100 /* If a transfer is still active after this much time, turn off FSBR */
101 #define IDLE_TIMEOUT    (HZ / 20)       /* 50 ms */
102 #define FSBR_DELAY      (HZ / 20)       /* 50 ms */
103
104 #define MAX_URB_LOOP    2048            /* Maximum number of linked URB's */
105
106 /*
107  * Only the USB core should call uhci_alloc_dev and uhci_free_dev
108  */
109 static int uhci_alloc_dev(struct usb_device *dev)
110 {
111         return 0;
112 }
113
114 static int uhci_free_dev(struct usb_device *dev)
115 {
116         return 0;
117 }
118
119 static inline void uhci_set_next_interrupt(struct uhci *uhci)
120 {
121         unsigned long flags;
122
123         spin_lock_irqsave(&uhci->frame_list_lock, flags);
124         set_bit(TD_CTRL_IOC_BIT, &uhci->skel_term_td->status);
125         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
126 }
127
128 static inline void uhci_clear_next_interrupt(struct uhci *uhci)
129 {
130         unsigned long flags;
131
132         spin_lock_irqsave(&uhci->frame_list_lock, flags);
133         clear_bit(TD_CTRL_IOC_BIT, &uhci->skel_term_td->status);
134         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
135 }
136
137 static inline void uhci_add_complete(struct urb *urb)
138 {
139         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
140         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
141         unsigned long flags;
142
143         spin_lock_irqsave(&uhci->complete_list_lock, flags);
144         list_add(&urbp->complete_list, &uhci->complete_list);
145         spin_unlock_irqrestore(&uhci->complete_list_lock, flags);
146 }
147
148 static struct uhci_td *uhci_alloc_td(struct uhci *uhci, struct usb_device *dev)
149 {
150         dma_addr_t dma_handle;
151         struct uhci_td *td;
152
153         td = pci_pool_alloc(uhci->td_pool, GFP_DMA | GFP_ATOMIC, &dma_handle);
154         if (!td)
155                 return NULL;
156
157         td->dma_handle = dma_handle;
158
159         td->link = UHCI_PTR_TERM;
160         td->buffer = 0;
161
162         td->frame = -1;
163         td->dev = dev;
164
165         INIT_LIST_HEAD(&td->list);
166         INIT_LIST_HEAD(&td->fl_list);
167
168         usb_inc_dev_use(dev);
169
170         return td;
171 }
172
173 static void inline uhci_fill_td(struct uhci_td *td, __u32 status,
174                 __u32 info, __u32 buffer)
175 {
176         td->status = status;
177         td->info = info;
178         td->buffer = buffer;
179 }
180
181 static void uhci_insert_td(struct uhci *uhci, struct uhci_td *skeltd, struct uhci_td *td)
182 {
183         unsigned long flags;
184         struct uhci_td *ltd;
185
186         spin_lock_irqsave(&uhci->frame_list_lock, flags);
187
188         ltd = list_entry(skeltd->fl_list.prev, struct uhci_td, fl_list);
189
190         td->link = ltd->link;
191         mb();
192         ltd->link = td->dma_handle;
193
194         list_add_tail(&td->fl_list, &skeltd->fl_list);
195
196         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
197 }
198
199 /*
200  * We insert Isochronous transfers directly into the frame list at the
201  * beginning
202  * The layout looks as follows:
203  * frame list pointer -> iso td's (if any) ->
204  * periodic interrupt td (if frame 0) -> irq td's -> control qh -> bulk qh
205  */
206 static void uhci_insert_td_frame_list(struct uhci *uhci, struct uhci_td *td, unsigned framenum)
207 {
208         unsigned long flags;
209
210         framenum %= UHCI_NUMFRAMES;
211
212         spin_lock_irqsave(&uhci->frame_list_lock, flags);
213
214         td->frame = framenum;
215
216         /* Is there a TD already mapped there? */
217         if (uhci->fl->frame_cpu[framenum]) {
218                 struct uhci_td *ftd, *ltd;
219
220                 ftd = uhci->fl->frame_cpu[framenum];
221                 ltd = list_entry(ftd->fl_list.prev, struct uhci_td, fl_list);
222
223                 list_add_tail(&td->fl_list, &ftd->fl_list);
224
225                 td->link = ltd->link;
226                 mb();
227                 ltd->link = td->dma_handle;
228         } else {
229                 td->link = uhci->fl->frame[framenum];
230                 mb();
231                 uhci->fl->frame[framenum] = td->dma_handle;
232                 uhci->fl->frame_cpu[framenum] = td;
233         }
234
235         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
236 }
237
238 static void uhci_remove_td(struct uhci *uhci, struct uhci_td *td)
239 {
240         unsigned long flags;
241
242         /* If it's not inserted, don't remove it */
243         spin_lock_irqsave(&uhci->frame_list_lock, flags);
244         if (td->frame == -1 && list_empty(&td->fl_list))
245                 goto out;
246
247         if (td->frame != -1 && uhci->fl->frame_cpu[td->frame] == td) {
248                 if (list_empty(&td->fl_list)) {
249                         uhci->fl->frame[td->frame] = td->link;
250                         uhci->fl->frame_cpu[td->frame] = NULL;
251                 } else {
252                         struct uhci_td *ntd;
253
254                         ntd = list_entry(td->fl_list.next, struct uhci_td, fl_list);
255                         uhci->fl->frame[td->frame] = ntd->dma_handle;
256                         uhci->fl->frame_cpu[td->frame] = ntd;
257                 }
258         } else {
259                 struct uhci_td *ptd;
260
261                 ptd = list_entry(td->fl_list.prev, struct uhci_td, fl_list);
262                 ptd->link = td->link;
263         }
264
265         mb();
266         td->link = UHCI_PTR_TERM;
267
268         list_del_init(&td->fl_list);
269         td->frame = -1;
270
271 out:
272         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
273 }
274
275 /*
276  * Inserts a td into qh list at the top.
277  */
278 static void uhci_insert_tds_in_qh(struct uhci_qh *qh, struct urb *urb, int breadth)
279 {
280         struct list_head *tmp, *head;
281         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
282         struct uhci_td *td, *ptd;
283
284         if (list_empty(&urbp->td_list))
285                 return;
286
287         head = &urbp->td_list;
288         tmp = head->next;
289
290         /* Ordering isn't important here yet since the QH hasn't been */
291         /*  inserted into the schedule yet */
292         td = list_entry(tmp, struct uhci_td, list);
293
294         /* Add the first TD to the QH element pointer */
295         qh->element = td->dma_handle | (breadth ? 0 : UHCI_PTR_DEPTH);
296
297         ptd = td;
298
299         /* Then link the rest of the TD's */
300         tmp = tmp->next;
301         while (tmp != head) {
302                 td = list_entry(tmp, struct uhci_td, list);
303
304                 tmp = tmp->next;
305
306                 ptd->link = td->dma_handle | (breadth ? 0 : UHCI_PTR_DEPTH);
307
308                 ptd = td;
309         }
310
311         ptd->link = UHCI_PTR_TERM;
312 }
313
314 static void uhci_free_td(struct uhci *uhci, struct uhci_td *td)
315 {
316         if (!list_empty(&td->list) || !list_empty(&td->fl_list))
317                 dbg("td is still in URB list!");
318
319         if (td->dev)
320                 usb_dec_dev_use(td->dev);
321
322         pci_pool_free(uhci->td_pool, td, td->dma_handle);
323 }
324
325 static struct uhci_qh *uhci_alloc_qh(struct uhci *uhci, struct usb_device *dev)
326 {
327         dma_addr_t dma_handle;
328         struct uhci_qh *qh;
329
330         qh = pci_pool_alloc(uhci->qh_pool, GFP_DMA | GFP_ATOMIC, &dma_handle);
331         if (!qh)
332                 return NULL;
333
334         qh->dma_handle = dma_handle;
335
336         qh->element = UHCI_PTR_TERM;
337         qh->link = UHCI_PTR_TERM;
338
339         qh->dev = dev;
340         qh->urbp = NULL;
341
342         INIT_LIST_HEAD(&qh->list);
343         INIT_LIST_HEAD(&qh->remove_list);
344
345         usb_inc_dev_use(dev);
346
347         return qh;
348 }
349
350 static void uhci_free_qh(struct uhci *uhci, struct uhci_qh *qh)
351 {
352         if (!list_empty(&qh->list))
353                 dbg("qh list not empty!");
354         if (!list_empty(&qh->remove_list))
355                 dbg("qh still in remove_list!");
356
357         if (qh->dev)
358                 usb_dec_dev_use(qh->dev);
359
360         pci_pool_free(uhci->qh_pool, qh, qh->dma_handle);
361 }
362
363 /*
364  * MUST be called with uhci->frame_list_lock acquired
365  */
366 static void _uhci_insert_qh(struct uhci *uhci, struct uhci_qh *skelqh, struct urb *urb)
367 {
368         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
369         struct list_head *head, *tmp;
370         struct uhci_qh *lqh;
371
372         /* Grab the last QH */
373         lqh = list_entry(skelqh->list.prev, struct uhci_qh, list);
374
375         if (lqh->urbp) {
376                 head = &lqh->urbp->queue_list;
377                 tmp = head->next;
378                 while (head != tmp) {
379                         struct urb_priv *turbp =
380                                 list_entry(tmp, struct urb_priv, queue_list);
381
382                         tmp = tmp->next;
383
384                         turbp->qh->link = urbp->qh->dma_handle | UHCI_PTR_QH;
385                 }
386         }
387
388         head = &urbp->queue_list;
389         tmp = head->next;
390         while (head != tmp) {
391                 struct urb_priv *turbp =
392                         list_entry(tmp, struct urb_priv, queue_list);
393
394                 tmp = tmp->next;
395
396                 turbp->qh->link = lqh->link;
397         }
398
399         urbp->qh->link = lqh->link;
400         mb();                           /* Ordering is important */
401         lqh->link = urbp->qh->dma_handle | UHCI_PTR_QH;
402
403         list_add_tail(&urbp->qh->list, &skelqh->list);
404 }
405
406 static void uhci_insert_qh(struct uhci *uhci, struct uhci_qh *skelqh, struct urb *urb)
407 {
408         unsigned long flags;
409
410         spin_lock_irqsave(&uhci->frame_list_lock, flags);
411         _uhci_insert_qh(uhci, skelqh, urb);
412         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
413 }
414
415 static void uhci_remove_qh(struct uhci *uhci, struct uhci_qh *qh)
416 {
417         unsigned long flags;
418         struct uhci_qh *pqh;
419
420         if (!qh)
421                 return;
422
423         qh->urbp = NULL;
424
425         /* Only go through the hoops if it's actually linked in */
426         spin_lock_irqsave(&uhci->frame_list_lock, flags);
427         if (!list_empty(&qh->list)) {
428                 pqh = list_entry(qh->list.prev, struct uhci_qh, list);
429
430                 if (pqh->urbp) {
431                         struct list_head *head, *tmp;
432
433                         head = &pqh->urbp->queue_list;
434                         tmp = head->next;
435                         while (head != tmp) {
436                                 struct urb_priv *turbp =
437                                         list_entry(tmp, struct urb_priv, queue_list);
438
439                                 tmp = tmp->next;
440
441                                 turbp->qh->link = qh->link;
442                         }
443                 }
444
445                 pqh->link = qh->link;
446                 mb();
447                 qh->element = qh->link = UHCI_PTR_TERM;
448
449                 list_del_init(&qh->list);
450         }
451         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
452
453         spin_lock_irqsave(&uhci->qh_remove_list_lock, flags);
454
455         /* Check to see if the remove list is empty. Set the IOC bit */
456         /* to force an interrupt so we can remove the QH */
457         if (list_empty(&uhci->qh_remove_list))
458                 uhci_set_next_interrupt(uhci);
459
460         list_add(&qh->remove_list, &uhci->qh_remove_list);
461
462         spin_unlock_irqrestore(&uhci->qh_remove_list_lock, flags);
463 }
464
465 static int uhci_fixup_toggle(struct urb *urb, unsigned int toggle)
466 {
467         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
468         struct list_head *head, *tmp;
469
470         head = &urbp->td_list;
471         tmp = head->next;
472         while (head != tmp) {
473                 struct uhci_td *td = list_entry(tmp, struct uhci_td, list);
474
475                 tmp = tmp->next;
476
477                 if (toggle)
478                         set_bit(TD_TOKEN_TOGGLE, &td->info);
479                 else
480                         clear_bit(TD_TOKEN_TOGGLE, &td->info);
481
482                 toggle ^= 1;
483         }
484
485         return toggle;
486 }
487
488 /* This function will append one URB's QH to another URB's QH. This is for */
489 /*  USB_QUEUE_BULK support for bulk transfers and soon implicitily for */
490 /*  control transfers */
491 static void uhci_append_queued_urb(struct uhci *uhci, struct urb *eurb, struct urb *urb)
492 {
493         struct urb_priv *eurbp, *urbp, *furbp, *lurbp;
494         struct list_head *tmp;
495         struct uhci_td *lltd;
496         unsigned long flags;
497
498         eurbp = eurb->hcpriv;
499         urbp = urb->hcpriv;
500
501         spin_lock_irqsave(&uhci->frame_list_lock, flags);
502
503         /* Find the first URB in the queue */
504         if (eurbp->queued) {
505                 struct list_head *head = &eurbp->queue_list;
506
507                 tmp = head->next;
508                 while (tmp != head) {
509                         struct urb_priv *turbp =
510                                 list_entry(tmp, struct urb_priv, queue_list);
511
512                         if (!turbp->queued)
513                                 break;
514
515                         tmp = tmp->next;
516                 }
517         } else
518                 tmp = &eurbp->queue_list;
519
520         furbp = list_entry(tmp, struct urb_priv, queue_list);
521         lurbp = list_entry(furbp->queue_list.prev, struct urb_priv, queue_list);
522
523         lltd = list_entry(lurbp->td_list.prev, struct uhci_td, list);
524
525         usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe), usb_pipeout(urb->pipe),
526                 uhci_fixup_toggle(urb, uhci_toggle(lltd->info) ^ 1));
527
528         /* All qh's in the queue need to link to the next queue */
529         urbp->qh->link = eurbp->qh->link;
530
531         mb();                   /* Make sure we flush everything */
532         /* Only support bulk right now, so no depth */
533         lltd->link = urbp->qh->dma_handle | UHCI_PTR_QH;
534
535         list_add_tail(&urbp->queue_list, &furbp->queue_list);
536
537         urbp->queued = 1;
538
539         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
540 }
541
542 static void uhci_delete_queued_urb(struct uhci *uhci, struct urb *urb)
543 {
544         struct urb_priv *urbp, *nurbp;
545         struct list_head *head, *tmp;
546         struct urb_priv *purbp;
547         struct uhci_td *pltd;
548         unsigned int toggle;
549         unsigned long flags;
550
551         urbp = urb->hcpriv;
552
553         spin_lock_irqsave(&uhci->frame_list_lock, flags);
554
555         if (list_empty(&urbp->queue_list))
556                 goto out;
557
558         nurbp = list_entry(urbp->queue_list.next, struct urb_priv, queue_list);
559
560         /* Fix up the toggle for the next URB's */
561         if (!urbp->queued)
562                 /* We set the toggle when we unlink */
563                 toggle = usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe), usb_pipeout(urb->pipe));
564         else {
565                 /* If we're in the middle of the queue, grab the toggle */
566                 /*  from the TD previous to us */
567                 purbp = list_entry(urbp->queue_list.prev, struct urb_priv,
568                                 queue_list);
569
570                 pltd = list_entry(purbp->td_list.prev, struct uhci_td, list);
571
572                 toggle = uhci_toggle(pltd->info) ^ 1;
573         }
574
575         head = &urbp->queue_list;
576         tmp = head->next;
577         while (head != tmp) {
578                 struct urb_priv *turbp;
579
580                 turbp = list_entry(tmp, struct urb_priv, queue_list);
581
582                 tmp = tmp->next;
583
584                 if (!turbp->queued)
585                         break;
586
587                 toggle = uhci_fixup_toggle(turbp->urb, toggle);
588         }
589
590         usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
591                 usb_pipeout(urb->pipe), toggle);
592
593         if (!urbp->queued) {
594                 nurbp->queued = 0;
595
596                 _uhci_insert_qh(uhci, uhci->skel_bulk_qh, nurbp->urb);
597         } else {
598                 /* We're somewhere in the middle (or end). A bit trickier */
599                 /*  than the head scenario */
600                 purbp = list_entry(urbp->queue_list.prev, struct urb_priv,
601                                 queue_list);
602
603                 pltd = list_entry(purbp->td_list.prev, struct uhci_td, list);
604                 if (nurbp->queued)
605                         pltd->link = nurbp->qh->dma_handle | UHCI_PTR_QH;
606                 else
607                         /* The next URB happens to be the beginning, so */
608                         /*  we're the last, end the chain */
609                         pltd->link = UHCI_PTR_TERM;
610         }
611
612         list_del_init(&urbp->queue_list);
613
614 out:
615         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
616 }
617
618 static struct urb_priv *uhci_alloc_urb_priv(struct uhci *uhci, struct urb *urb)
619 {
620         struct urb_priv *urbp;
621
622         urbp = kmem_cache_alloc(uhci_up_cachep, SLAB_ATOMIC);
623         if (!urbp) {
624                 err("uhci_alloc_urb_priv: couldn't allocate memory for urb_priv\n");
625                 return NULL;
626         }
627
628         memset((void *)urbp, 0, sizeof(*urbp));
629
630         urbp->inserttime = jiffies;
631         urbp->fsbrtime = jiffies;
632         urbp->urb = urb;
633         urbp->dev = urb->dev;
634         
635         INIT_LIST_HEAD(&urbp->td_list);
636         INIT_LIST_HEAD(&urbp->queue_list);
637         INIT_LIST_HEAD(&urbp->complete_list);
638
639         urb->hcpriv = urbp;
640
641         if (urb->dev != uhci->rh.dev) {
642                 if (urb->transfer_buffer_length) {
643                         urbp->transfer_buffer_dma_handle = pci_map_single(uhci->dev,
644                                 urb->transfer_buffer, urb->transfer_buffer_length,
645                                 usb_pipein(urb->pipe) ? PCI_DMA_FROMDEVICE :
646                                 PCI_DMA_TODEVICE);
647                         if (!urbp->transfer_buffer_dma_handle)
648                                 return NULL;
649                 }
650
651                 if (usb_pipetype(urb->pipe) == PIPE_CONTROL && urb->setup_packet) {
652                         urbp->setup_packet_dma_handle = pci_map_single(uhci->dev,
653                                 urb->setup_packet, sizeof(struct usb_ctrlrequest),
654                                 PCI_DMA_TODEVICE);
655                         if (!urbp->setup_packet_dma_handle)
656                                 return NULL;
657                 }
658         }
659
660         return urbp;
661 }
662
663 /*
664  * MUST be called with urb->lock acquired
665  */
666 static void uhci_add_td_to_urb(struct urb *urb, struct uhci_td *td)
667 {
668         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
669
670         td->urb = urb;
671
672         list_add_tail(&td->list, &urbp->td_list);
673 }
674
675 /*
676  * MUST be called with urb->lock acquired
677  */
678 static void uhci_remove_td_from_urb(struct uhci_td *td)
679 {
680         if (list_empty(&td->list))
681                 return;
682
683         list_del_init(&td->list);
684
685         td->urb = NULL;
686 }
687
688 /*
689  * MUST be called with urb->lock acquired
690  */
691 static void uhci_destroy_urb_priv(struct urb *urb)
692 {
693         struct list_head *head, *tmp;
694         struct urb_priv *urbp;
695         struct uhci *uhci;
696
697         urbp = (struct urb_priv *)urb->hcpriv;
698         if (!urbp)
699                 return;
700
701         if (!urbp->dev || !urbp->dev->bus || !urbp->dev->bus->hcpriv) {
702                 warn("uhci_destroy_urb_priv: urb %p belongs to disconnected device or bus?", urb);
703                 return;
704         }
705
706         if (!list_empty(&urb->urb_list))
707                 warn("uhci_destroy_urb_priv: urb %p still on uhci->urb_list or uhci->remove_list", urb);
708
709         if (!list_empty(&urbp->complete_list))
710                 warn("uhci_destroy_urb_priv: urb %p still on uhci->complete_list", urb);
711
712         uhci = urbp->dev->bus->hcpriv;
713
714         head = &urbp->td_list;
715         tmp = head->next;
716         while (tmp != head) {
717                 struct uhci_td *td = list_entry(tmp, struct uhci_td, list);
718
719                 tmp = tmp->next;
720
721                 uhci_remove_td_from_urb(td);
722                 uhci_remove_td(uhci, td);
723                 uhci_free_td(uhci, td);
724         }
725
726         if (urbp->setup_packet_dma_handle) {
727                 pci_unmap_single(uhci->dev, urbp->setup_packet_dma_handle,
728                         sizeof(struct usb_ctrlrequest), PCI_DMA_TODEVICE);
729                 urbp->setup_packet_dma_handle = 0;
730         }
731
732         if (urbp->transfer_buffer_dma_handle) {
733                 pci_unmap_single(uhci->dev, urbp->transfer_buffer_dma_handle,
734                         urb->transfer_buffer_length, usb_pipein(urb->pipe) ?
735                         PCI_DMA_FROMDEVICE : PCI_DMA_TODEVICE);
736                 urbp->transfer_buffer_dma_handle = 0;
737         }
738
739         urb->hcpriv = NULL;
740         kmem_cache_free(uhci_up_cachep, urbp);
741 }
742
743 static void uhci_inc_fsbr(struct uhci *uhci, struct urb *urb)
744 {
745         unsigned long flags;
746         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
747
748         spin_lock_irqsave(&uhci->frame_list_lock, flags);
749
750         if ((!(urb->transfer_flags & USB_NO_FSBR)) && !urbp->fsbr) {
751                 urbp->fsbr = 1;
752                 if (!uhci->fsbr++)
753                         uhci->skel_term_qh->link = uhci->skel_hs_control_qh->dma_handle | UHCI_PTR_QH;
754         }
755
756         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
757 }
758
759 static void uhci_dec_fsbr(struct uhci *uhci, struct urb *urb)
760 {
761         unsigned long flags;
762         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
763
764         spin_lock_irqsave(&uhci->frame_list_lock, flags);
765
766         if ((!(urb->transfer_flags & USB_NO_FSBR)) && urbp->fsbr) {
767                 urbp->fsbr = 0;
768                 if (!--uhci->fsbr)
769                         uhci->fsbrtimeout = jiffies + FSBR_DELAY;
770         }
771
772         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
773 }
774
775 /*
776  * Map status to standard result codes
777  *
778  * <status> is (td->status & 0xFE0000) [a.k.a. uhci_status_bits(td->status)]
779  * <dir_out> is True for output TDs and False for input TDs.
780  */
781 static int uhci_map_status(int status, int dir_out)
782 {
783         if (!status)
784                 return 0;
785         if (status & TD_CTRL_BITSTUFF)                  /* Bitstuff error */
786                 return -EPROTO;
787         if (status & TD_CTRL_CRCTIMEO) {                /* CRC/Timeout */
788                 if (dir_out)
789                         return -ETIMEDOUT;
790                 else
791                         return -EILSEQ;
792         }
793         if (status & TD_CTRL_NAK)                       /* NAK */
794                 return -ETIMEDOUT;
795         if (status & TD_CTRL_BABBLE)                    /* Babble */
796                 return -EOVERFLOW;
797         if (status & TD_CTRL_DBUFERR)                   /* Buffer error */
798                 return -ENOSR;
799         if (status & TD_CTRL_STALLED)                   /* Stalled */
800                 return -EPIPE;
801         if (status & TD_CTRL_ACTIVE)                    /* Active */
802                 return 0;
803
804         return -EINVAL;
805 }
806
807 /*
808  * Control transfers
809  */
810 static int uhci_submit_control(struct urb *urb)
811 {
812         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
813         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
814         struct uhci_td *td;
815         struct uhci_qh *qh;
816         unsigned long destination, status;
817         int maxsze = usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe));
818         int len = urb->transfer_buffer_length;
819         dma_addr_t data = urbp->transfer_buffer_dma_handle;
820
821         /* The "pipe" thing contains the destination in bits 8--18 */
822         destination = (urb->pipe & PIPE_DEVEP_MASK) | USB_PID_SETUP;
823
824         /* 3 errors */
825         status = TD_CTRL_ACTIVE | (3 << 27);
826         if (urb->dev->speed == USB_SPEED_LOW)
827                 status |= TD_CTRL_LS;
828
829         /*
830          * Build the TD for the control request
831          */
832         td = uhci_alloc_td(uhci, urb->dev);
833         if (!td)
834                 return -ENOMEM;
835
836         uhci_add_td_to_urb(urb, td);
837         uhci_fill_td(td, status, destination | (7 << 21),
838                 urbp->setup_packet_dma_handle);
839
840         /*
841          * If direction is "send", change the frame from SETUP (0x2D)
842          * to OUT (0xE1). Else change it from SETUP to IN (0x69).
843          */
844         destination ^= (USB_PID_SETUP ^ usb_packetid(urb->pipe));
845
846         if (!(urb->transfer_flags & USB_DISABLE_SPD))
847                 status |= TD_CTRL_SPD;
848
849         /*
850          * Build the DATA TD's
851          */
852         while (len > 0) {
853                 int pktsze = len;
854
855                 if (pktsze > maxsze)
856                         pktsze = maxsze;
857
858                 td = uhci_alloc_td(uhci, urb->dev);
859                 if (!td)
860                         return -ENOMEM;
861
862                 /* Alternate Data0/1 (start with Data1) */
863                 destination ^= 1 << TD_TOKEN_TOGGLE;
864         
865                 uhci_add_td_to_urb(urb, td);
866                 uhci_fill_td(td, status, destination | ((pktsze - 1) << 21),
867                         data);
868
869                 data += pktsze;
870                 len -= pktsze;
871         }
872
873         /*
874          * Build the final TD for control status 
875          */
876         td = uhci_alloc_td(uhci, urb->dev);
877         if (!td)
878                 return -ENOMEM;
879
880         /*
881          * It's IN if the pipe is an output pipe or we're not expecting
882          * data back.
883          */
884         destination &= ~TD_TOKEN_PID_MASK;
885         if (usb_pipeout(urb->pipe) || !urb->transfer_buffer_length)
886                 destination |= USB_PID_IN;
887         else
888                 destination |= USB_PID_OUT;
889
890         destination |= 1 << TD_TOKEN_TOGGLE;            /* End in Data1 */
891
892         status &= ~TD_CTRL_SPD;
893
894         uhci_add_td_to_urb(urb, td);
895         uhci_fill_td(td, status | TD_CTRL_IOC,
896                 destination | (UHCI_NULL_DATA_SIZE << 21), 0);
897
898         qh = uhci_alloc_qh(uhci, urb->dev);
899         if (!qh)
900                 return -ENOMEM;
901
902         urbp->qh = qh;
903         qh->urbp = urbp;
904
905         /* Low speed or small transfers gets a different queue and treatment */
906         if (urb->dev->speed == USB_SPEED_LOW) {
907                 uhci_insert_tds_in_qh(qh, urb, 0);
908                 uhci_insert_qh(uhci, uhci->skel_ls_control_qh, urb);
909         } else {
910                 uhci_insert_tds_in_qh(qh, urb, 1);
911                 uhci_insert_qh(uhci, uhci->skel_hs_control_qh, urb);
912                 uhci_inc_fsbr(uhci, urb);
913         }
914
915         return -EINPROGRESS;
916 }
917
918 static int usb_control_retrigger_status(struct urb *urb);
919
920 static int uhci_result_control(struct urb *urb)
921 {
922         struct list_head *tmp, *head;
923         struct urb_priv *urbp = urb->hcpriv;
924         struct uhci_td *td;
925         unsigned int status;
926         int ret = 0;
927
928         if (list_empty(&urbp->td_list))
929                 return -EINVAL;
930
931         head = &urbp->td_list;
932
933         if (urbp->short_control_packet) {
934                 tmp = head->prev;
935                 goto status_phase;
936         }
937
938         tmp = head->next;
939         td = list_entry(tmp, struct uhci_td, list);
940
941         /* The first TD is the SETUP phase, check the status, but skip */
942         /*  the count */
943         status = uhci_status_bits(td->status);
944         if (status & TD_CTRL_ACTIVE)
945                 return -EINPROGRESS;
946
947         if (status)
948                 goto td_error;
949
950         urb->actual_length = 0;
951
952         /* The rest of the TD's (but the last) are data */
953         tmp = tmp->next;
954         while (tmp != head && tmp->next != head) {
955                 td = list_entry(tmp, struct uhci_td, list);
956
957                 tmp = tmp->next;
958
959                 if (urbp->fsbr_timeout && (td->status & TD_CTRL_IOC) &&
960                     !(td->status & TD_CTRL_ACTIVE)) {
961                         uhci_inc_fsbr(urb->dev->bus->hcpriv, urb);
962                         urbp->fsbr_timeout = 0;
963                         urbp->fsbrtime = jiffies;
964                         clear_bit(TD_CTRL_IOC_BIT, &td->status);
965                 }
966
967                 status = uhci_status_bits(td->status);
968                 if (status & TD_CTRL_ACTIVE)
969                         return -EINPROGRESS;
970
971                 urb->actual_length += uhci_actual_length(td->status);
972
973                 if (status)
974                         goto td_error;
975
976                 /* Check to see if we received a short packet */
977                 if (uhci_actual_length(td->status) < uhci_expected_length(td->info)) {
978                         if (urb->transfer_flags & USB_DISABLE_SPD) {
979                                 ret = -EREMOTEIO;
980                                 goto err;
981                         }
982
983                         if (uhci_packetid(td->info) == USB_PID_IN)
984                                 return usb_control_retrigger_status(urb);
985                         else
986                                 return 0;
987                 }
988         }
989
990 status_phase:
991         td = list_entry(tmp, struct uhci_td, list);
992
993         /* Control status phase */
994         status = uhci_status_bits(td->status);
995
996 #ifdef I_HAVE_BUGGY_APC_BACKUPS
997         /* APC BackUPS Pro kludge */
998         /* It tries to send all of the descriptor instead of the amount */
999         /*  we requested */
1000         if (td->status & TD_CTRL_IOC && /* IOC is masked out by uhci_status_bits */
1001             status & TD_CTRL_ACTIVE &&
1002             status & TD_CTRL_NAK)
1003                 return 0;
1004 #endif
1005
1006         if (status & TD_CTRL_ACTIVE)
1007                 return -EINPROGRESS;
1008
1009         if (status)
1010                 goto td_error;
1011
1012         return 0;
1013
1014 td_error:
1015         ret = uhci_map_status(status, uhci_packetout(td->info));
1016         if (ret == -EPIPE)
1017                 /* endpoint has stalled - mark it halted */
1018                 usb_endpoint_halt(urb->dev, uhci_endpoint(td->info),
1019                                 uhci_packetout(td->info));
1020
1021 err:
1022         if ((debug == 1 && ret != -EPIPE) || debug > 1) {
1023                 /* Some debugging code */
1024                 dbg("uhci_result_control() failed with status %x", status);
1025
1026                 if (errbuf) {
1027                         /* Print the chain for debugging purposes */
1028                         uhci_show_qh(urbp->qh, errbuf, ERRBUF_LEN, 0);
1029
1030                         lprintk(errbuf);
1031                 }
1032         }
1033
1034         return ret;
1035 }
1036
1037 static int usb_control_retrigger_status(struct urb *urb)
1038 {
1039         struct list_head *tmp, *head;
1040         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1041         struct uhci *uhci = urb->dev->bus->hcpriv;
1042
1043         urbp->short_control_packet = 1;
1044
1045         /* Create a new QH to avoid pointer overwriting problems */
1046         uhci_remove_qh(uhci, urbp->qh);
1047
1048         /* Delete all of the TD's except for the status TD at the end */
1049         head = &urbp->td_list;
1050         tmp = head->next;
1051         while (tmp != head && tmp->next != head) {
1052                 struct uhci_td *td = list_entry(tmp, struct uhci_td, list);
1053
1054                 tmp = tmp->next;
1055
1056                 uhci_remove_td_from_urb(td);
1057                 uhci_remove_td(uhci, td);
1058                 uhci_free_td(uhci, td);
1059         }
1060
1061         urbp->qh = uhci_alloc_qh(uhci, urb->dev);
1062         if (!urbp->qh) {
1063                 err("unable to allocate new QH for control retrigger");
1064                 return -ENOMEM;
1065         }
1066
1067         urbp->qh->urbp = urbp;
1068
1069         /* One TD, who cares about Breadth first? */
1070         uhci_insert_tds_in_qh(urbp->qh, urb, 0);
1071
1072         /* Low speed or small transfers gets a different queue and treatment */
1073         if (urb->dev->speed == USB_SPEED_LOW)
1074                 uhci_insert_qh(uhci, uhci->skel_ls_control_qh, urb);
1075         else
1076                 uhci_insert_qh(uhci, uhci->skel_hs_control_qh, urb);
1077
1078         return -EINPROGRESS;
1079 }
1080
1081 /*
1082  * Interrupt transfers
1083  */
1084 static int uhci_submit_interrupt(struct urb *urb)
1085 {
1086         struct uhci_td *td;
1087         unsigned long destination, status;
1088         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
1089         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1090
1091         if (urb->transfer_buffer_length > usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe)))
1092                 return -EINVAL;
1093
1094         /* The "pipe" thing contains the destination in bits 8--18 */
1095         destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
1096
1097         status = TD_CTRL_ACTIVE | TD_CTRL_IOC;
1098         if (urb->dev->speed == USB_SPEED_LOW)
1099                 status |= TD_CTRL_LS;
1100
1101         td = uhci_alloc_td(uhci, urb->dev);
1102         if (!td)
1103                 return -ENOMEM;
1104
1105         destination |= (usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe), usb_pipeout(urb->pipe)) << TD_TOKEN_TOGGLE);
1106         destination |= ((urb->transfer_buffer_length - 1) << 21);
1107
1108         usb_dotoggle(urb->dev, usb_pipeendpoint(urb->pipe), usb_pipeout(urb->pipe));
1109
1110         uhci_add_td_to_urb(urb, td);
1111         uhci_fill_td(td, status, destination, urbp->transfer_buffer_dma_handle);
1112
1113         uhci_insert_td(uhci, uhci->skeltd[__interval_to_skel(urb->interval)], td);
1114
1115         return -EINPROGRESS;
1116 }
1117
1118 static int uhci_result_interrupt(struct urb *urb)
1119 {
1120         struct list_head *tmp, *head;
1121         struct urb_priv *urbp = urb->hcpriv;
1122         struct uhci_td *td;
1123         unsigned int status;
1124         int ret = 0;
1125
1126         urb->actual_length = 0;
1127
1128         head = &urbp->td_list;
1129         tmp = head->next;
1130         while (tmp != head) {
1131                 td = list_entry(tmp, struct uhci_td, list);
1132
1133                 tmp = tmp->next;
1134
1135                 if (urbp->fsbr_timeout && (td->status & TD_CTRL_IOC) &&
1136                     !(td->status & TD_CTRL_ACTIVE)) {
1137                         uhci_inc_fsbr(urb->dev->bus->hcpriv, urb);
1138                         urbp->fsbr_timeout = 0;
1139                         urbp->fsbrtime = jiffies;
1140                         clear_bit(TD_CTRL_IOC_BIT, &td->status);
1141                 }
1142
1143                 status = uhci_status_bits(td->status);
1144                 if (status & TD_CTRL_ACTIVE)
1145                         return -EINPROGRESS;
1146
1147                 urb->actual_length += uhci_actual_length(td->status);
1148
1149                 if (status)
1150                         goto td_error;
1151
1152                 if (uhci_actual_length(td->status) < uhci_expected_length(td->info)) {
1153                         if (urb->transfer_flags & USB_DISABLE_SPD) {
1154                                 ret = -EREMOTEIO;
1155                                 goto err;
1156                         } else
1157                                 return 0;
1158                 }
1159         }
1160
1161         return 0;
1162
1163 td_error:
1164         ret = uhci_map_status(status, uhci_packetout(td->info));
1165         if (ret == -EPIPE)
1166                 /* endpoint has stalled - mark it halted */
1167                 usb_endpoint_halt(urb->dev, uhci_endpoint(td->info),
1168                                 uhci_packetout(td->info));
1169
1170 err:
1171         if ((debug == 1 && ret != -EPIPE) || debug > 1) {
1172                 /* Some debugging code */
1173                 dbg("uhci_result_interrupt/bulk() failed with status %x",
1174                         status);
1175
1176                 if (errbuf) {
1177                         /* Print the chain for debugging purposes */
1178                         if (urbp->qh)
1179                                 uhci_show_qh(urbp->qh, errbuf, ERRBUF_LEN, 0);
1180                         else
1181                                 uhci_show_td(td, errbuf, ERRBUF_LEN, 0);
1182
1183                         lprintk(errbuf);
1184                 }
1185         }
1186
1187         return ret;
1188 }
1189
1190 static void uhci_reset_interrupt(struct urb *urb)
1191 {
1192         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
1193         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1194         struct uhci_td *td;
1195         unsigned long flags;
1196
1197         spin_lock_irqsave(&urb->lock, flags);
1198
1199         /* Root hub is special */
1200         if (urb->dev == uhci->rh.dev)
1201                 goto out;
1202
1203         td = list_entry(urbp->td_list.next, struct uhci_td, list);
1204
1205         td->status = (td->status & 0x2F000000) | TD_CTRL_ACTIVE | TD_CTRL_IOC;
1206         td->info &= ~(1 << TD_TOKEN_TOGGLE);
1207         td->info |= (usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe), usb_pipeout(urb->pipe)) << TD_TOKEN_TOGGLE);
1208         usb_dotoggle(urb->dev, usb_pipeendpoint(urb->pipe), usb_pipeout(urb->pipe));
1209
1210 out:
1211         urb->status = -EINPROGRESS;
1212
1213         spin_unlock_irqrestore(&urb->lock, flags);
1214 }
1215
1216 /*
1217  * Bulk transfers
1218  */
1219 static int uhci_submit_bulk(struct urb *urb, struct urb *eurb)
1220 {
1221         struct uhci_td *td;
1222         struct uhci_qh *qh;
1223         unsigned long destination, status;
1224         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
1225         int maxsze = usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe));
1226         int len = urb->transfer_buffer_length;
1227         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1228         dma_addr_t data = urbp->transfer_buffer_dma_handle;
1229
1230         if (len < 0)
1231                 return -EINVAL;
1232
1233         /* Can't have low speed bulk transfers */
1234         if (urb->dev->speed == USB_SPEED_LOW)
1235                 return -EINVAL;
1236
1237         /* The "pipe" thing contains the destination in bits 8--18 */
1238         destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
1239
1240         /* 3 errors */
1241         status = TD_CTRL_ACTIVE | (3 << TD_CTRL_C_ERR_SHIFT);
1242
1243         if (!(urb->transfer_flags & USB_DISABLE_SPD))
1244                 status |= TD_CTRL_SPD;
1245
1246         /*
1247          * Build the DATA TD's
1248          */
1249         do {    /* Allow zero length packets */
1250                 int pktsze = len;
1251
1252                 if (pktsze > maxsze)
1253                         pktsze = maxsze;
1254
1255                 td = uhci_alloc_td(uhci, urb->dev);
1256                 if (!td)
1257                         return -ENOMEM;
1258
1259                 uhci_add_td_to_urb(urb, td);
1260                 uhci_fill_td(td, status, destination |
1261                         (((pktsze - 1) & UHCI_NULL_DATA_SIZE) << 21) |
1262                         (usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe),
1263                          usb_pipeout(urb->pipe)) << TD_TOKEN_TOGGLE),
1264                         data);
1265
1266                 data += pktsze;
1267                 len -= maxsze;
1268
1269                 usb_dotoggle(urb->dev, usb_pipeendpoint(urb->pipe),
1270                         usb_pipeout(urb->pipe));
1271         } while (len > 0);
1272
1273         /*
1274          * USB_ZERO_PACKET means adding a 0-length packet, if
1275          * direction is OUT and the transfer_length was an
1276          * exact multiple of maxsze, hence
1277          * (len = transfer_length - N * maxsze) == 0
1278          * however, if transfer_length == 0, the zero packet
1279          * was already prepared above.
1280          */
1281         if (usb_pipeout(urb->pipe) && (urb->transfer_flags & USB_ZERO_PACKET) &&
1282            !len && urb->transfer_buffer_length) {
1283                 td = uhci_alloc_td(uhci, urb->dev);
1284                 if (!td)
1285                         return -ENOMEM;
1286
1287                 uhci_add_td_to_urb(urb, td);
1288                 uhci_fill_td(td, status, destination |
1289                         (UHCI_NULL_DATA_SIZE << 21) |
1290                         (usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe),
1291                          usb_pipeout(urb->pipe)) << TD_TOKEN_TOGGLE),
1292                         data);
1293
1294                 usb_dotoggle(urb->dev, usb_pipeendpoint(urb->pipe),
1295                         usb_pipeout(urb->pipe));
1296         }
1297
1298         /* Set the flag on the last packet */
1299         td->status |= TD_CTRL_IOC;
1300
1301         qh = uhci_alloc_qh(uhci, urb->dev);
1302         if (!qh)
1303                 return -ENOMEM;
1304
1305         urbp->qh = qh;
1306         qh->urbp = urbp;
1307
1308         /* Always assume breadth first */
1309         uhci_insert_tds_in_qh(qh, urb, 1);
1310
1311         if (urb->transfer_flags & USB_QUEUE_BULK && eurb)
1312                 uhci_append_queued_urb(uhci, eurb, urb);
1313         else
1314                 uhci_insert_qh(uhci, uhci->skel_bulk_qh, urb);
1315
1316         uhci_inc_fsbr(uhci, urb);
1317
1318         return -EINPROGRESS;
1319 }
1320
1321 /* We can use the result interrupt since they're identical */
1322 #define uhci_result_bulk uhci_result_interrupt
1323
1324 /*
1325  * Isochronous transfers
1326  */
1327 static int isochronous_find_limits(struct urb *urb, unsigned int *start, unsigned int *end)
1328 {
1329         struct urb *last_urb = NULL;
1330         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
1331         struct list_head *tmp, *head;
1332         int ret = 0;
1333
1334         head = &uhci->urb_list;
1335         tmp = head->next;
1336         while (tmp != head) {
1337                 struct urb *u = list_entry(tmp, struct urb, urb_list);
1338
1339                 tmp = tmp->next;
1340
1341                 /* look for pending URB's with identical pipe handle */
1342                 if ((urb->pipe == u->pipe) && (urb->dev == u->dev) &&
1343                     (u->status == -EINPROGRESS) && (u != urb)) {
1344                         if (!last_urb)
1345                                 *start = u->start_frame;
1346                         last_urb = u;
1347                 }
1348         }
1349
1350         if (last_urb) {
1351                 *end = (last_urb->start_frame + last_urb->number_of_packets) & 1023;
1352                 ret = 0;
1353         } else
1354                 ret = -1;       /* no previous urb found */
1355
1356         return ret;
1357 }
1358
1359 static int isochronous_find_start(struct urb *urb)
1360 {
1361         int limits;
1362         unsigned int start = 0, end = 0;
1363
1364         if (urb->number_of_packets > 900)       /* 900? Why? */
1365                 return -EFBIG;
1366
1367         limits = isochronous_find_limits(urb, &start, &end);
1368
1369         if (urb->transfer_flags & USB_ISO_ASAP) {
1370                 if (limits) {
1371                         int curframe;
1372
1373                         curframe = uhci_get_current_frame_number(urb->dev) % UHCI_NUMFRAMES;
1374                         urb->start_frame = (curframe + 10) % UHCI_NUMFRAMES;
1375                 } else
1376                         urb->start_frame = end;
1377         } else {
1378                 urb->start_frame %= UHCI_NUMFRAMES;
1379                 /* FIXME: Sanity check */
1380         }
1381
1382         return 0;
1383 }
1384
1385 /*
1386  * Isochronous transfers
1387  */
1388 static int uhci_submit_isochronous(struct urb *urb)
1389 {
1390         struct uhci_td *td;
1391         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
1392         int i, ret, framenum;
1393         int status, destination;
1394         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1395
1396         status = TD_CTRL_ACTIVE | TD_CTRL_IOS;
1397         destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
1398
1399         ret = isochronous_find_start(urb);
1400         if (ret)
1401                 return ret;
1402
1403         framenum = urb->start_frame;
1404         for (i = 0; i < urb->number_of_packets; i++, framenum++) {
1405                 if (!urb->iso_frame_desc[i].length)
1406                         continue;
1407
1408                 td = uhci_alloc_td(uhci, urb->dev);
1409                 if (!td)
1410                         return -ENOMEM;
1411
1412                 uhci_add_td_to_urb(urb, td);
1413                 uhci_fill_td(td, status, destination | ((urb->iso_frame_desc[i].length - 1) << 21),
1414                         urbp->transfer_buffer_dma_handle + urb->iso_frame_desc[i].offset);
1415
1416                 if (i + 1 >= urb->number_of_packets)
1417                         td->status |= TD_CTRL_IOC;
1418
1419                 uhci_insert_td_frame_list(uhci, td, framenum);
1420         }
1421
1422         return -EINPROGRESS;
1423 }
1424
1425 static int uhci_result_isochronous(struct urb *urb)
1426 {
1427         struct list_head *tmp, *head;
1428         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1429         int status;
1430         int i, ret = 0;
1431
1432         urb->actual_length = 0;
1433
1434         i = 0;
1435         head = &urbp->td_list;
1436         tmp = head->next;
1437         while (tmp != head) {
1438                 struct uhci_td *td = list_entry(tmp, struct uhci_td, list);
1439                 int actlength;
1440
1441                 tmp = tmp->next;
1442
1443                 if (td->status & TD_CTRL_ACTIVE)
1444                         return -EINPROGRESS;
1445
1446                 actlength = uhci_actual_length(td->status);
1447                 urb->iso_frame_desc[i].actual_length = actlength;
1448                 urb->actual_length += actlength;
1449
1450                 status = uhci_map_status(uhci_status_bits(td->status), usb_pipeout(urb->pipe));
1451                 urb->iso_frame_desc[i].status = status;
1452                 if (status) {
1453                         urb->error_count++;
1454                         ret = status;
1455                 }
1456
1457                 i++;
1458         }
1459
1460         return ret;
1461 }
1462
1463 /*
1464  * MUST be called with uhci->urb_list_lock acquired
1465  */
1466 static struct urb *uhci_find_urb_ep(struct uhci *uhci, struct urb *urb)
1467 {
1468         struct list_head *tmp, *head;
1469
1470         /* We don't match Isoc transfers since they are special */
1471         if (usb_pipeisoc(urb->pipe))
1472                 return NULL;
1473
1474         head = &uhci->urb_list;
1475         tmp = head->next;
1476         while (tmp != head) {
1477                 struct urb *u = list_entry(tmp, struct urb, urb_list);
1478
1479                 tmp = tmp->next;
1480
1481                 if (u->dev == urb->dev && u->pipe == urb->pipe &&
1482                     u->status == -EINPROGRESS)
1483                         return u;
1484         }
1485
1486         return NULL;
1487 }
1488
1489 static int uhci_submit_urb(struct urb *urb, int mem_flags)
1490 {
1491         int ret = -EINVAL;
1492         struct uhci *uhci;
1493         unsigned long flags;
1494         struct urb *eurb;
1495         int bustime;
1496
1497         if (!urb)
1498                 return -EINVAL;
1499
1500         if (!urb->dev || !urb->dev->bus || !urb->dev->bus->hcpriv) {
1501                 warn("uhci_submit_urb: urb %p belongs to disconnected device or bus?", urb);
1502                 return -ENODEV;
1503         }
1504
1505         /* increment the reference count of the urb, as we now also control it */
1506         urb = usb_get_urb(urb);
1507
1508         uhci = (struct uhci *)urb->dev->bus->hcpriv;
1509
1510         INIT_LIST_HEAD(&urb->urb_list);
1511         usb_inc_dev_use(urb->dev);
1512
1513         spin_lock_irqsave(&uhci->urb_list_lock, flags);
1514         spin_lock(&urb->lock);
1515
1516         if (urb->status == -EINPROGRESS || urb->status == -ECONNRESET ||
1517             urb->status == -ECONNABORTED) {
1518                 dbg("uhci_submit_urb: urb not available to submit (status = %d)", urb->status);
1519                 /* Since we can have problems on the out path */
1520                 spin_unlock(&urb->lock);
1521                 spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
1522                 usb_dec_dev_use(urb->dev);
1523                 usb_put_urb(urb);
1524
1525                 return ret;
1526         }
1527
1528         if (!uhci_alloc_urb_priv(uhci, urb)) {
1529                 ret = -ENOMEM;
1530
1531                 goto out;
1532         }
1533
1534         eurb = uhci_find_urb_ep(uhci, urb);
1535         if (eurb && !(urb->transfer_flags & USB_QUEUE_BULK)) {
1536                 ret = -ENXIO;
1537
1538                 goto out;
1539         }
1540
1541         /* Short circuit the virtual root hub */
1542         if (urb->dev == uhci->rh.dev) {
1543                 ret = rh_submit_urb(urb);
1544
1545                 goto out;
1546         }
1547
1548         switch (usb_pipetype(urb->pipe)) {
1549         case PIPE_CONTROL:
1550                 ret = uhci_submit_control(urb);
1551                 break;
1552         case PIPE_INTERRUPT:
1553                 if (urb->bandwidth == 0) {      /* not yet checked/allocated */
1554                         bustime = usb_check_bandwidth(urb->dev, urb);
1555                         if (bustime < 0)
1556                                 ret = bustime;
1557                         else {
1558                                 ret = uhci_submit_interrupt(urb);
1559                                 if (ret == -EINPROGRESS)
1560                                         usb_claim_bandwidth(urb->dev, urb, bustime, 0);
1561                         }
1562                 } else          /* bandwidth is already set */
1563                         ret = uhci_submit_interrupt(urb);
1564                 break;
1565         case PIPE_BULK:
1566                 ret = uhci_submit_bulk(urb, eurb);
1567                 break;
1568         case PIPE_ISOCHRONOUS:
1569                 if (urb->bandwidth == 0) {      /* not yet checked/allocated */
1570                         if (urb->number_of_packets <= 0) {
1571                                 ret = -EINVAL;
1572                                 break;
1573                         }
1574                         bustime = usb_check_bandwidth(urb->dev, urb);
1575                         if (bustime < 0) {
1576                                 ret = bustime;
1577                                 break;
1578                         }
1579
1580                         ret = uhci_submit_isochronous(urb);
1581                         if (ret == -EINPROGRESS)
1582                                 usb_claim_bandwidth(urb->dev, urb, bustime, 1);
1583                 } else          /* bandwidth is already set */
1584                         ret = uhci_submit_isochronous(urb);
1585                 break;
1586         }
1587
1588 out:
1589         urb->status = ret;
1590
1591         if (ret == -EINPROGRESS) {
1592                 /* We use _tail to make find_urb_ep more efficient */
1593                 list_add_tail(&urb->urb_list, &uhci->urb_list);
1594
1595                 spin_unlock(&urb->lock);
1596                 spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
1597
1598                 return 0;
1599         }
1600
1601         uhci_unlink_generic(uhci, urb);
1602
1603         spin_unlock(&urb->lock);
1604         spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
1605
1606         /* Only call completion if it was successful */
1607         if (!ret)
1608                 uhci_call_completion(urb);
1609
1610         return ret;
1611 }
1612
1613 /*
1614  * Return the result of a transfer
1615  *
1616  * MUST be called with urb_list_lock acquired
1617  */
1618 static void uhci_transfer_result(struct uhci *uhci, struct urb *urb)
1619 {
1620         int ret = -EINVAL;
1621         unsigned long flags;
1622         struct urb_priv *urbp;
1623
1624         /* The root hub is special */
1625         if (urb->dev == uhci->rh.dev)
1626                 return;
1627
1628         spin_lock_irqsave(&urb->lock, flags);
1629
1630         urbp = (struct urb_priv *)urb->hcpriv;
1631
1632         if (urb->status != -EINPROGRESS) {
1633                 info("uhci_transfer_result: called for URB %p not in flight?", urb);
1634                 spin_unlock_irqrestore(&urb->lock, flags);
1635                 return;
1636         }
1637
1638         switch (usb_pipetype(urb->pipe)) {
1639         case PIPE_CONTROL:
1640                 ret = uhci_result_control(urb);
1641                 break;
1642         case PIPE_INTERRUPT:
1643                 ret = uhci_result_interrupt(urb);
1644                 break;
1645         case PIPE_BULK:
1646                 ret = uhci_result_bulk(urb);
1647                 break;
1648         case PIPE_ISOCHRONOUS:
1649                 ret = uhci_result_isochronous(urb);
1650                 break;
1651         }
1652
1653         urbp->status = ret;
1654
1655         if (ret == -EINPROGRESS) {
1656                 spin_unlock_irqrestore(&urb->lock, flags);
1657                 return;
1658         }
1659
1660         switch (usb_pipetype(urb->pipe)) {
1661         case PIPE_CONTROL:
1662         case PIPE_BULK:
1663         case PIPE_ISOCHRONOUS:
1664                 /* Release bandwidth for Interrupt or Isoc. transfers */
1665                 /* Spinlock needed ? */
1666                 if (urb->bandwidth)
1667                         usb_release_bandwidth(urb->dev, urb, 1);
1668                 uhci_unlink_generic(uhci, urb);
1669                 break;
1670         case PIPE_INTERRUPT:
1671                 /* Interrupts are an exception */
1672                 if (urb->interval) {
1673                         uhci_add_complete(urb);
1674                         spin_unlock_irqrestore(&urb->lock, flags);
1675                         return;         /* <-- note return */
1676                 }
1677
1678                 /* Release bandwidth for Interrupt or Isoc. transfers */
1679                 /* Spinlock needed ? */
1680                 if (urb->bandwidth)
1681                         usb_release_bandwidth(urb->dev, urb, 0);
1682                 uhci_unlink_generic(uhci, urb);
1683                 break;
1684         default:
1685                 info("uhci_transfer_result: unknown pipe type %d for urb %p\n",
1686                         usb_pipetype(urb->pipe), urb);
1687         }
1688
1689         /* Remove it from uhci->urb_list */
1690         list_del_init(&urb->urb_list);
1691
1692         uhci_add_complete(urb);
1693
1694         spin_unlock_irqrestore(&urb->lock, flags);
1695 }
1696
1697 /*
1698  * MUST be called with urb->lock acquired
1699  */
1700 static void uhci_unlink_generic(struct uhci *uhci, struct urb *urb)
1701 {
1702         struct list_head *head, *tmp;
1703         struct urb_priv *urbp = urb->hcpriv;
1704         int prevactive = 1;
1705
1706         /* We can get called when urbp allocation fails, so check */
1707         if (!urbp)
1708                 return;
1709
1710         uhci_dec_fsbr(uhci, urb);       /* Safe since it checks */
1711
1712         /*
1713          * Now we need to find out what the last successful toggle was
1714          * so we can update the local data toggle for the next transfer
1715          *
1716          * There's 3 way's the last successful completed TD is found:
1717          *
1718          * 1) The TD is NOT active and the actual length < expected length
1719          * 2) The TD is NOT active and it's the last TD in the chain
1720          * 3) The TD is active and the previous TD is NOT active
1721          *
1722          * Control and Isochronous ignore the toggle, so this is safe
1723          * for all types
1724          */
1725         head = &urbp->td_list;
1726         tmp = head->next;
1727         while (tmp != head) {
1728                 struct uhci_td *td = list_entry(tmp, struct uhci_td, list);
1729
1730                 tmp = tmp->next;
1731
1732                 if (!(td->status & TD_CTRL_ACTIVE) &&
1733                     (uhci_actual_length(td->status) < uhci_expected_length(td->info) ||
1734                     tmp == head))
1735                         usb_settoggle(urb->dev, uhci_endpoint(td->info),
1736                                 uhci_packetout(td->info),
1737                                 uhci_toggle(td->info) ^ 1);
1738                 else if ((td->status & TD_CTRL_ACTIVE) && !prevactive)
1739                         usb_settoggle(urb->dev, uhci_endpoint(td->info),
1740                                 uhci_packetout(td->info),
1741                                 uhci_toggle(td->info));
1742
1743                 prevactive = td->status & TD_CTRL_ACTIVE;
1744         }
1745
1746         uhci_delete_queued_urb(uhci, urb);
1747
1748         /* The interrupt loop will reclaim the QH's */
1749         uhci_remove_qh(uhci, urbp->qh);
1750         urbp->qh = NULL;
1751 }
1752
1753 static int uhci_unlink_urb(struct urb *urb)
1754 {
1755         struct uhci *uhci;
1756         unsigned long flags;
1757         struct urb_priv *urbp = urb->hcpriv;
1758
1759         if (!urb)
1760                 return -EINVAL;
1761
1762         if (!urb->dev || !urb->dev->bus || !urb->dev->bus->hcpriv)
1763                 return -ENODEV;
1764
1765         uhci = (struct uhci *)urb->dev->bus->hcpriv;
1766
1767         spin_lock_irqsave(&uhci->urb_list_lock, flags);
1768         spin_lock(&urb->lock);
1769
1770         /* Release bandwidth for Interrupt or Isoc. transfers */
1771         /* Spinlock needed ? */
1772         if (urb->bandwidth) {
1773                 switch (usb_pipetype(urb->pipe)) {
1774                 case PIPE_INTERRUPT:
1775                         usb_release_bandwidth(urb->dev, urb, 0);
1776                         break;
1777                 case PIPE_ISOCHRONOUS:
1778                         usb_release_bandwidth(urb->dev, urb, 1);
1779                         break;
1780                 default:
1781                         break;
1782                 }
1783         }
1784
1785         if (urb->status != -EINPROGRESS) {
1786                 spin_unlock(&urb->lock);
1787                 spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
1788                 return 0;
1789         }
1790
1791         list_del_init(&urb->urb_list);
1792
1793         uhci_unlink_generic(uhci, urb);
1794
1795         /* Short circuit the virtual root hub */
1796         if (urb->dev == uhci->rh.dev) {
1797                 rh_unlink_urb(urb);
1798
1799                 spin_unlock(&urb->lock);
1800                 spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
1801
1802                 uhci_call_completion(urb);
1803         } else {
1804                 if (urb->transfer_flags & USB_ASYNC_UNLINK) {
1805                         urbp->status = urb->status = -ECONNABORTED;
1806
1807                         spin_lock(&uhci->urb_remove_list_lock);
1808
1809                         /* If we're the first, set the next interrupt bit */
1810                         if (list_empty(&uhci->urb_remove_list))
1811                                 uhci_set_next_interrupt(uhci);
1812                         
1813                         list_add(&urb->urb_list, &uhci->urb_remove_list);
1814
1815                         spin_unlock(&uhci->urb_remove_list_lock);
1816
1817                         spin_unlock(&urb->lock);
1818                         spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
1819
1820                 } else {
1821                         urb->status = -ENOENT;
1822
1823                         if (in_interrupt()) {   /* wait at least 1 frame */
1824                                 static int errorcount = 10;
1825
1826                                 if (errorcount--)
1827                                         dbg("uhci_unlink_urb called from interrupt for urb %p", urb);
1828                                 udelay(1000);
1829                         } else
1830                                 schedule_timeout(1+1*HZ/1000); 
1831
1832                         spin_unlock(&urb->lock);
1833                         spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
1834
1835                         uhci_call_completion(urb);
1836                 }
1837         }
1838
1839         return 0;
1840 }
1841
1842 static int uhci_fsbr_timeout(struct uhci *uhci, struct urb *urb)
1843 {
1844         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1845         struct list_head *head, *tmp;
1846
1847         uhci_dec_fsbr(uhci, urb);
1848
1849         /* There is a race with updating IOC in here, but it's not worth */
1850         /*  trying to fix since this is merely an optimization. The only */
1851         /*  time we'd lose is if the status of the packet got updated */
1852         /*  and we'd be turning on FSBR next frame anyway, so it's a wash */
1853         urbp->fsbr_timeout = 1;
1854
1855         head = &urbp->td_list;
1856         tmp = head->next;
1857         while (tmp != head) {
1858                 struct uhci_td *td = list_entry(tmp, struct uhci_td, list);
1859
1860                 tmp = tmp->next;
1861
1862                 if (td->status & TD_CTRL_ACTIVE) {
1863                         set_bit(TD_CTRL_IOC_BIT, &td->status);
1864                         break;
1865                 }
1866         }
1867
1868         return 0;
1869 }
1870
1871 /*
1872  * uhci_get_current_frame_number()
1873  *
1874  * returns the current frame number for a USB bus/controller.
1875  */
1876 static int uhci_get_current_frame_number(struct usb_device *dev)
1877 {
1878         struct uhci *uhci = (struct uhci *)dev->bus->hcpriv;
1879
1880         return inw(uhci->io_addr + USBFRNUM);
1881 }
1882
1883 struct usb_operations uhci_device_operations = {
1884         allocate:               uhci_alloc_dev,
1885         deallocate:             uhci_free_dev,
1886         get_frame_number:       uhci_get_current_frame_number,
1887         submit_urb:             uhci_submit_urb,
1888         unlink_urb:             uhci_unlink_urb,
1889 };
1890
1891 /* Virtual Root Hub */
1892
1893 static __u8 root_hub_dev_des[] =
1894 {
1895         0x12,                   /*  __u8  bLength; */
1896         0x01,                   /*  __u8  bDescriptorType; Device */
1897         0x00,                   /*  __u16 bcdUSB; v1.0 */
1898         0x01,
1899         0x09,                   /*  __u8  bDeviceClass; HUB_CLASSCODE */
1900         0x00,                   /*  __u8  bDeviceSubClass; */
1901         0x00,                   /*  __u8  bDeviceProtocol; */
1902         0x08,                   /*  __u8  bMaxPacketSize0; 8 Bytes */
1903         0x00,                   /*  __u16 idVendor; */
1904         0x00,
1905         0x00,                   /*  __u16 idProduct; */
1906         0x00,
1907         0x00,                   /*  __u16 bcdDevice; */
1908         0x00,
1909         0x00,                   /*  __u8  iManufacturer; */
1910         0x02,                   /*  __u8  iProduct; */
1911         0x01,                   /*  __u8  iSerialNumber; */
1912         0x01                    /*  __u8  bNumConfigurations; */
1913 };
1914
1915
1916 /* Configuration descriptor */
1917 static __u8 root_hub_config_des[] =
1918 {
1919         0x09,                   /*  __u8  bLength; */
1920         0x02,                   /*  __u8  bDescriptorType; Configuration */
1921         0x19,                   /*  __u16 wTotalLength; */
1922         0x00,
1923         0x01,                   /*  __u8  bNumInterfaces; */
1924         0x01,                   /*  __u8  bConfigurationValue; */
1925         0x00,                   /*  __u8  iConfiguration; */
1926         0x40,                   /*  __u8  bmAttributes;
1927                                         Bit 7: Bus-powered, 6: Self-powered,
1928                                         Bit 5 Remote-wakeup, 4..0: resvd */
1929         0x00,                   /*  __u8  MaxPower; */
1930
1931         /* interface */
1932         0x09,                   /*  __u8  if_bLength; */
1933         0x04,                   /*  __u8  if_bDescriptorType; Interface */
1934         0x00,                   /*  __u8  if_bInterfaceNumber; */
1935         0x00,                   /*  __u8  if_bAlternateSetting; */
1936         0x01,                   /*  __u8  if_bNumEndpoints; */
1937         0x09,                   /*  __u8  if_bInterfaceClass; HUB_CLASSCODE */
1938         0x00,                   /*  __u8  if_bInterfaceSubClass; */
1939         0x00,                   /*  __u8  if_bInterfaceProtocol; */
1940         0x00,                   /*  __u8  if_iInterface; */
1941
1942         /* endpoint */
1943         0x07,                   /*  __u8  ep_bLength; */
1944         0x05,                   /*  __u8  ep_bDescriptorType; Endpoint */
1945         0x81,                   /*  __u8  ep_bEndpointAddress; IN Endpoint 1 */
1946         0x03,                   /*  __u8  ep_bmAttributes; Interrupt */
1947         0x08,                   /*  __u16 ep_wMaxPacketSize; 8 Bytes */
1948         0x00,
1949         0xff                    /*  __u8  ep_bInterval; 255 ms */
1950 };
1951
1952 static __u8 root_hub_hub_des[] =
1953 {
1954         0x09,                   /*  __u8  bLength; */
1955         0x29,                   /*  __u8  bDescriptorType; Hub-descriptor */
1956         0x02,                   /*  __u8  bNbrPorts; */
1957         0x00,                   /* __u16  wHubCharacteristics; */
1958         0x00,
1959         0x01,                   /*  __u8  bPwrOn2pwrGood; 2ms */
1960         0x00,                   /*  __u8  bHubContrCurrent; 0 mA */
1961         0x00,                   /*  __u8  DeviceRemovable; *** 7 Ports max *** */
1962         0xff                    /*  __u8  PortPwrCtrlMask; *** 7 ports max *** */
1963 };
1964
1965 /* prepare Interrupt pipe transaction data; HUB INTERRUPT ENDPOINT */
1966 static int rh_send_irq(struct urb *urb)
1967 {
1968         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
1969         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1970         unsigned int io_addr = uhci->io_addr;
1971         unsigned long flags;
1972         int i, len = 1;
1973         __u16 data = 0;
1974
1975         spin_lock_irqsave(&urb->lock, flags);
1976         for (i = 0; i < uhci->rh.numports; i++) {
1977                 data |= ((inw(io_addr + USBPORTSC1 + i * 2) & 0xa) > 0 ? (1 << (i + 1)) : 0);
1978                 len = (i + 1) / 8 + 1;
1979         }
1980
1981         *(__u16 *) urb->transfer_buffer = cpu_to_le16(data);
1982         urb->actual_length = len;
1983         urbp->status = 0;
1984
1985         spin_unlock_irqrestore(&urb->lock, flags);
1986
1987         if ((data > 0) && (uhci->rh.send != 0)) {
1988                 dbg("root-hub INT complete: port1: %x port2: %x data: %x",
1989                         inw(io_addr + USBPORTSC1), inw(io_addr + USBPORTSC2), data);
1990                 uhci_call_completion(urb);
1991         }
1992
1993         return 0;
1994 }
1995
1996 /* Virtual Root Hub INTs are polled by this timer every "interval" ms */
1997 static int rh_init_int_timer(struct urb *urb);
1998
1999 static void rh_int_timer_do(unsigned long ptr)
2000 {
2001         struct urb *urb = (struct urb *)ptr;
2002         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
2003         struct list_head list, *tmp, *head;
2004         unsigned long flags;
2005
2006         if (uhci->rh.send)
2007                 rh_send_irq(urb);
2008
2009         INIT_LIST_HEAD(&list);
2010
2011         spin_lock_irqsave(&uhci->urb_list_lock, flags);
2012         head = &uhci->urb_list;
2013         tmp = head->next;
2014         while (tmp != head) {
2015                 struct urb *u = list_entry(tmp, struct urb, urb_list);
2016                 struct urb_priv *urbp = (struct urb_priv *)u->hcpriv;
2017
2018                 tmp = tmp->next;
2019
2020                 spin_lock(&urb->lock);
2021
2022                 /* Check if the FSBR timed out */
2023                 if (urbp->fsbr && !urbp->fsbr_timeout && time_after_eq(jiffies, urbp->fsbrtime + IDLE_TIMEOUT))
2024                         uhci_fsbr_timeout(uhci, u);
2025
2026                 /* Check if the URB timed out */
2027                 if (u->timeout && time_after_eq(jiffies, urbp->inserttime + u->timeout)) {
2028                         list_del(&u->urb_list);
2029                         list_add_tail(&u->urb_list, &list);
2030                 }
2031
2032                 spin_unlock(&urb->lock);
2033         }
2034         spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
2035
2036         head = &list;
2037         tmp = head->next;
2038         while (tmp != head) {
2039                 struct urb *u = list_entry(tmp, struct urb, urb_list);
2040
2041                 tmp = tmp->next;
2042
2043                 u->transfer_flags |= USB_ASYNC_UNLINK | USB_TIMEOUT_KILLED;
2044                 uhci_unlink_urb(u);
2045         }
2046
2047         /* Really disable FSBR */
2048         if (!uhci->fsbr && uhci->fsbrtimeout && time_after_eq(jiffies, uhci->fsbrtimeout)) {
2049                 uhci->fsbrtimeout = 0;
2050                 uhci->skel_term_qh->link = UHCI_PTR_TERM;
2051         }
2052
2053         /* enter global suspend if nothing connected */
2054         if (!uhci->is_suspended && !ports_active(uhci))
2055                 suspend_hc(uhci);
2056
2057         rh_init_int_timer(urb);
2058 }
2059
2060 /* Root Hub INTs are polled by this timer */
2061 static int rh_init_int_timer(struct urb *urb)
2062 {
2063         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
2064
2065         uhci->rh.interval = urb->interval;
2066         init_timer(&uhci->rh.rh_int_timer);
2067         uhci->rh.rh_int_timer.function = rh_int_timer_do;
2068         uhci->rh.rh_int_timer.data = (unsigned long)urb;
2069         uhci->rh.rh_int_timer.expires = jiffies + (HZ * (urb->interval < 30 ? 30 : urb->interval)) / 1000;
2070         add_timer(&uhci->rh.rh_int_timer);
2071
2072         return 0;
2073 }
2074
2075 #define OK(x)                   len = (x); break
2076
2077 #define CLR_RH_PORTSTAT(x) \
2078         status = inw(io_addr + USBPORTSC1 + 2 * (wIndex-1)); \
2079         status = (status & 0xfff5) & ~(x); \
2080         outw(status, io_addr + USBPORTSC1 + 2 * (wIndex-1))
2081
2082 #define SET_RH_PORTSTAT(x) \
2083         status = inw(io_addr + USBPORTSC1 + 2 * (wIndex-1)); \
2084         status = (status & 0xfff5) | (x); \
2085         outw(status, io_addr + USBPORTSC1 + 2 * (wIndex-1))
2086
2087
2088 /* Root Hub Control Pipe */
2089 static int rh_submit_urb(struct urb *urb)
2090 {
2091         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
2092         unsigned int pipe = urb->pipe;
2093         struct usb_ctrlrequest *cmd = (struct usb_ctrlrequest *)urb->setup_packet;
2094         void *data = urb->transfer_buffer;
2095         int leni = urb->transfer_buffer_length;
2096         int len = 0;
2097         int status = 0;
2098         int stat = 0;
2099         int i;
2100         unsigned int io_addr = uhci->io_addr;
2101         __u16 cstatus;
2102         __u16 bmRType_bReq;
2103         __u16 wValue;
2104         __u16 wIndex;
2105         __u16 wLength;
2106
2107         if (usb_pipetype(pipe) == PIPE_INTERRUPT) {
2108                 uhci->rh.urb = urb;
2109                 uhci->rh.send = 1;
2110                 uhci->rh.interval = urb->interval;
2111                 rh_init_int_timer(urb);
2112
2113                 return -EINPROGRESS;
2114         }
2115
2116         bmRType_bReq = cmd->bRequestType | cmd->bRequest << 8;
2117         wValue = le16_to_cpu(cmd->wValue);
2118         wIndex = le16_to_cpu(cmd->wIndex);
2119         wLength = le16_to_cpu(cmd->wLength);
2120
2121         for (i = 0; i < 8; i++)
2122                 uhci->rh.c_p_r[i] = 0;
2123
2124         switch (bmRType_bReq) {
2125                 /* Request Destination:
2126                    without flags: Device,
2127                    RH_INTERFACE: interface,
2128                    RH_ENDPOINT: endpoint,
2129                    RH_CLASS means HUB here,
2130                    RH_OTHER | RH_CLASS  almost ever means HUB_PORT here
2131                 */
2132
2133         case RH_GET_STATUS:
2134                 *(__u16 *)data = cpu_to_le16(1);
2135                 OK(2);
2136         case RH_GET_STATUS | RH_INTERFACE:
2137                 *(__u16 *)data = cpu_to_le16(0);
2138                 OK(2);
2139         case RH_GET_STATUS | RH_ENDPOINT:
2140                 *(__u16 *)data = cpu_to_le16(0);
2141                 OK(2);
2142         case RH_GET_STATUS | RH_CLASS:
2143                 *(__u32 *)data = cpu_to_le32(0);
2144                 OK(4);          /* hub power */
2145         case RH_GET_STATUS | RH_OTHER | RH_CLASS:
2146                 status = inw(io_addr + USBPORTSC1 + 2 * (wIndex - 1));
2147                 cstatus = ((status & USBPORTSC_CSC) >> (1 - 0)) |
2148                         ((status & USBPORTSC_PEC) >> (3 - 1)) |
2149                         (uhci->rh.c_p_r[wIndex - 1] << (0 + 4));
2150                         status = (status & USBPORTSC_CCS) |
2151                         ((status & USBPORTSC_PE) >> (2 - 1)) |
2152                         ((status & USBPORTSC_SUSP) >> (12 - 2)) |
2153                         ((status & USBPORTSC_PR) >> (9 - 4)) |
2154                         (1 << 8) |      /* power on */
2155                         ((status & USBPORTSC_LSDA) << (-8 + 9));
2156
2157                 *(__u16 *)data = cpu_to_le16(status);
2158                 *(__u16 *)(data + 2) = cpu_to_le16(cstatus);
2159                 OK(4);
2160         case RH_CLEAR_FEATURE | RH_ENDPOINT:
2161                 switch (wValue) {
2162                 case RH_ENDPOINT_STALL:
2163                         OK(0);
2164                 }
2165                 break;
2166         case RH_CLEAR_FEATURE | RH_CLASS:
2167                 switch (wValue) {
2168                 case RH_C_HUB_OVER_CURRENT:
2169                         OK(0);  /* hub power over current */
2170                 }
2171                 break;
2172         case RH_CLEAR_FEATURE | RH_OTHER | RH_CLASS:
2173                 switch (wValue) {
2174                 case RH_PORT_ENABLE:
2175                         CLR_RH_PORTSTAT(USBPORTSC_PE);
2176                         OK(0);
2177                 case RH_PORT_SUSPEND:
2178                         CLR_RH_PORTSTAT(USBPORTSC_SUSP);
2179                         OK(0);
2180                 case RH_PORT_POWER:
2181                         OK(0);  /* port power */
2182                 case RH_C_PORT_CONNECTION:
2183                         SET_RH_PORTSTAT(USBPORTSC_CSC);
2184                         OK(0);
2185                 case RH_C_PORT_ENABLE:
2186                         SET_RH_PORTSTAT(USBPORTSC_PEC);
2187                         OK(0);
2188                 case RH_C_PORT_SUSPEND:
2189                         /*** WR_RH_PORTSTAT(RH_PS_PSSC); */
2190                         OK(0);
2191                 case RH_C_PORT_OVER_CURRENT:
2192                         OK(0);  /* port power over current */
2193                 case RH_C_PORT_RESET:
2194                         uhci->rh.c_p_r[wIndex - 1] = 0;
2195                         OK(0);
2196                 }
2197                 break;
2198         case RH_SET_FEATURE | RH_OTHER | RH_CLASS:
2199                 switch (wValue) {
2200                 case RH_PORT_SUSPEND:
2201                         SET_RH_PORTSTAT(USBPORTSC_SUSP);
2202                         OK(0);
2203                 case RH_PORT_RESET:
2204                         SET_RH_PORTSTAT(USBPORTSC_PR);
2205                         wait_ms(50);    /* USB v1.1 7.1.7.3 */
2206                         uhci->rh.c_p_r[wIndex - 1] = 1;
2207                         CLR_RH_PORTSTAT(USBPORTSC_PR);
2208                         udelay(10);
2209                         SET_RH_PORTSTAT(USBPORTSC_PE);
2210                         wait_ms(10);
2211                         SET_RH_PORTSTAT(0xa);
2212                         OK(0);
2213                 case RH_PORT_POWER:
2214                         OK(0); /* port power ** */
2215                 case RH_PORT_ENABLE:
2216                         SET_RH_PORTSTAT(USBPORTSC_PE);
2217                         OK(0);
2218                 }
2219                 break;
2220         case RH_SET_ADDRESS:
2221                 uhci->rh.devnum = wValue;
2222                 OK(0);
2223         case RH_GET_DESCRIPTOR:
2224                 switch ((wValue & 0xff00) >> 8) {
2225                 case 0x01:      /* device descriptor */
2226                         len = min_t(unsigned int, leni,
2227                                   min_t(unsigned int,
2228                                       sizeof(root_hub_dev_des), wLength));
2229                         memcpy(data, root_hub_dev_des, len);
2230                         OK(len);
2231                 case 0x02:      /* configuration descriptor */
2232                         len = min_t(unsigned int, leni,
2233                                   min_t(unsigned int,
2234                                       sizeof(root_hub_config_des), wLength));
2235                         memcpy (data, root_hub_config_des, len);
2236                         OK(len);
2237                 case 0x03:      /* string descriptors */
2238                         len = usb_root_hub_string (wValue & 0xff,
2239                                 uhci->io_addr, "UHCI-alt",
2240                                 data, wLength);
2241                         if (len > 0) {
2242                                 OK(min_t(int, leni, len));
2243                         } else 
2244                                 stat = -EPIPE;
2245                 }
2246                 break;
2247         case RH_GET_DESCRIPTOR | RH_CLASS:
2248                 root_hub_hub_des[2] = uhci->rh.numports;
2249                 len = min_t(unsigned int, leni,
2250                           min_t(unsigned int, sizeof(root_hub_hub_des), wLength));
2251                 memcpy(data, root_hub_hub_des, len);
2252                 OK(len);
2253         case RH_GET_CONFIGURATION:
2254                 *(__u8 *)data = 0x01;
2255                 OK(1);
2256         case RH_SET_CONFIGURATION:
2257                 OK(0);
2258         case RH_GET_INTERFACE | RH_INTERFACE:
2259                 *(__u8 *)data = 0x00;
2260                 OK(1);
2261         case RH_SET_INTERFACE | RH_INTERFACE:
2262                 OK(0);
2263         default:
2264                 stat = -EPIPE;
2265         }
2266
2267         urb->actual_length = len;
2268
2269         return stat;
2270 }
2271
2272 /*
2273  * MUST be called with urb->lock acquired
2274  */
2275 static int rh_unlink_urb(struct urb *urb)
2276 {
2277         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
2278
2279         if (uhci->rh.urb == urb) {
2280                 urb->status = -ENOENT;
2281                 uhci->rh.send = 0;
2282                 uhci->rh.urb = NULL;
2283                 del_timer(&uhci->rh.rh_int_timer);
2284         }
2285         return 0;
2286 }
2287
2288 static void uhci_free_pending_qhs(struct uhci *uhci)
2289 {
2290         struct list_head *tmp, *head;
2291         unsigned long flags;
2292
2293         spin_lock_irqsave(&uhci->qh_remove_list_lock, flags);
2294         head = &uhci->qh_remove_list;
2295         tmp = head->next;
2296         while (tmp != head) {
2297                 struct uhci_qh *qh = list_entry(tmp, struct uhci_qh, remove_list);
2298
2299                 tmp = tmp->next;
2300
2301                 list_del_init(&qh->remove_list);
2302
2303                 uhci_free_qh(uhci, qh);
2304         }
2305         spin_unlock_irqrestore(&uhci->qh_remove_list_lock, flags);
2306 }
2307
2308 static void uhci_call_completion(struct urb *urb)
2309 {
2310         struct urb_priv *urbp;
2311         struct usb_device *dev = urb->dev;
2312         struct uhci *uhci = (struct uhci *)dev->bus->hcpriv;
2313         int is_ring = 0, killed, resubmit_interrupt, status;
2314         struct urb *nurb;
2315         unsigned long flags;
2316
2317         spin_lock_irqsave(&urb->lock, flags);
2318
2319         urbp = (struct urb_priv *)urb->hcpriv;
2320         if (!urbp || !urb->dev) {
2321                 spin_unlock_irqrestore(&urb->lock, flags);
2322                 return;
2323         }
2324
2325         killed = (urb->status == -ENOENT || urb->status == -ECONNABORTED ||
2326                         urb->status == -ECONNRESET);
2327         resubmit_interrupt = (usb_pipetype(urb->pipe) == PIPE_INTERRUPT &&
2328                         urb->interval);
2329
2330         nurb = urb->next;
2331         if (nurb && !killed) {
2332                 int count = 0;
2333
2334                 while (nurb && nurb != urb && count < MAX_URB_LOOP) {
2335                         if (nurb->status == -ENOENT ||
2336                             nurb->status == -ECONNABORTED ||
2337                             nurb->status == -ECONNRESET) {
2338                                 killed = 1;
2339                                 break;
2340                         }
2341
2342                         nurb = nurb->next;
2343                         count++;
2344                 }
2345
2346                 if (count == MAX_URB_LOOP)
2347                         err("uhci_call_completion: too many linked URB's, loop? (first loop)");
2348
2349                 /* Check to see if chain is a ring */
2350                 is_ring = (nurb == urb);
2351         }
2352
2353         if (urbp->transfer_buffer_dma_handle)
2354                 pci_dma_sync_single(uhci->dev, urbp->transfer_buffer_dma_handle,
2355                         urb->transfer_buffer_length, usb_pipein(urb->pipe) ?
2356                         PCI_DMA_FROMDEVICE : PCI_DMA_TODEVICE);
2357
2358         if (urbp->setup_packet_dma_handle)
2359                 pci_dma_sync_single(uhci->dev, urbp->setup_packet_dma_handle,
2360                         sizeof(struct usb_ctrlrequest), PCI_DMA_TODEVICE);
2361
2362         status = urbp->status;
2363         if (!resubmit_interrupt || killed)
2364                 /* We don't need urb_priv anymore */
2365                 uhci_destroy_urb_priv(urb);
2366
2367         if (!killed)
2368                 urb->status = status;
2369
2370         urb->dev = NULL;
2371         spin_unlock_irqrestore(&urb->lock, flags);
2372
2373         if (urb->complete) {
2374                 urb->complete(urb);
2375
2376                 /* Recheck the status. The completion handler may have */
2377                 /*  unlinked the resubmitting interrupt URB */
2378                 killed = (urb->status == -ENOENT ||
2379                           urb->status == -ECONNABORTED ||
2380                           urb->status == -ECONNRESET);
2381         }
2382
2383         if (resubmit_interrupt && !killed) {
2384                 urb->dev = dev;
2385                 uhci_reset_interrupt(urb);
2386         } else {
2387                 if (is_ring && !killed) {
2388                         urb->dev = dev;
2389                         uhci_submit_urb(urb, GFP_ATOMIC);
2390                 } else {
2391                         /* We decrement the usage count after we're done */
2392                         /*  with everything */
2393                         usb_dec_dev_use(dev);
2394                         usb_put_urb(urb);
2395                 }
2396         }
2397 }
2398
2399 static void uhci_finish_completion(struct uhci *uhci)
2400 {
2401         struct list_head *tmp, *head;
2402         unsigned long flags;
2403
2404         spin_lock_irqsave(&uhci->complete_list_lock, flags);
2405         head = &uhci->complete_list;
2406         tmp = head->next;
2407         while (tmp != head) {
2408                 struct urb_priv *urbp = list_entry(tmp, struct urb_priv, complete_list);
2409                 struct urb *urb = urbp->urb;
2410
2411                 list_del_init(&urbp->complete_list);
2412                 spin_unlock_irqrestore(&uhci->complete_list_lock, flags);
2413
2414                 uhci_call_completion(urb);
2415
2416                 spin_lock_irqsave(&uhci->complete_list_lock, flags);
2417                 head = &uhci->complete_list;
2418                 tmp = head->next;
2419         }
2420         spin_unlock_irqrestore(&uhci->complete_list_lock, flags);
2421 }
2422
2423 static void uhci_remove_pending_qhs(struct uhci *uhci)
2424 {
2425         struct list_head *tmp, *head;
2426         unsigned long flags;
2427
2428         spin_lock_irqsave(&uhci->urb_remove_list_lock, flags);
2429         head = &uhci->urb_remove_list;
2430         tmp = head->next;
2431         while (tmp != head) {
2432                 struct urb *urb = list_entry(tmp, struct urb, urb_list);
2433                 struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
2434
2435                 tmp = tmp->next;
2436
2437                 list_del_init(&urb->urb_list);
2438
2439                 urbp->status = urb->status = -ECONNRESET;
2440
2441                 uhci_add_complete(urb);
2442         }
2443         spin_unlock_irqrestore(&uhci->urb_remove_list_lock, flags);
2444 }
2445
2446 static void uhci_interrupt(int irq, void *__uhci, struct pt_regs *regs)
2447 {
2448         struct uhci *uhci = __uhci;
2449         unsigned int io_addr = uhci->io_addr;
2450         unsigned short status;
2451         struct list_head *tmp, *head;
2452
2453         /*
2454          * Read the interrupt status, and write it back to clear the
2455          * interrupt cause
2456          */
2457         status = inw(io_addr + USBSTS);
2458         if (!status)    /* shared interrupt, not mine */
2459                 return;
2460         outw(status, io_addr + USBSTS);         /* Clear it */
2461
2462         if (status & ~(USBSTS_USBINT | USBSTS_ERROR | USBSTS_RD)) {
2463                 if (status & USBSTS_HSE)
2464                         err("%x: host system error, PCI problems?", io_addr);
2465                 if (status & USBSTS_HCPE)
2466                         err("%x: host controller process error. something bad happened", io_addr);
2467                 if ((status & USBSTS_HCH) && !uhci->is_suspended) {
2468                         err("%x: host controller halted. very bad", io_addr);
2469                         /* FIXME: Reset the controller, fix the offending TD */
2470                 }
2471         }
2472
2473         if (status & USBSTS_RD)
2474                 wakeup_hc(uhci);
2475
2476         uhci_free_pending_qhs(uhci);
2477
2478         uhci_remove_pending_qhs(uhci);
2479
2480         uhci_clear_next_interrupt(uhci);
2481
2482         /* Walk the list of pending URB's to see which ones completed */
2483         spin_lock(&uhci->urb_list_lock);
2484         head = &uhci->urb_list;
2485         tmp = head->next;
2486         while (tmp != head) {
2487                 struct urb *urb = list_entry(tmp, struct urb, urb_list);
2488
2489                 tmp = tmp->next;
2490
2491                 /* Checks the status and does all of the magic necessary */
2492                 uhci_transfer_result(uhci, urb);
2493         }
2494         spin_unlock(&uhci->urb_list_lock);
2495
2496         uhci_finish_completion(uhci);
2497 }
2498
2499 static void reset_hc(struct uhci *uhci)
2500 {
2501         unsigned int io_addr = uhci->io_addr;
2502
2503         /* Global reset for 50ms */
2504         outw(USBCMD_GRESET, io_addr + USBCMD);
2505         wait_ms(50);
2506         outw(0, io_addr + USBCMD);
2507         wait_ms(10);
2508 }
2509
2510 static void suspend_hc(struct uhci *uhci)
2511 {
2512         unsigned int io_addr = uhci->io_addr;
2513
2514         dbg("%x: suspend_hc", io_addr);
2515
2516         outw(USBCMD_EGSM, io_addr + USBCMD);
2517
2518         uhci->is_suspended = 1;
2519 }
2520
2521 static void wakeup_hc(struct uhci *uhci)
2522 {
2523         unsigned int io_addr = uhci->io_addr;
2524         unsigned int status;
2525
2526         dbg("%x: wakeup_hc", io_addr);
2527
2528         outw(0, io_addr + USBCMD);
2529         
2530         /* wait for EOP to be sent */
2531         status = inw(io_addr + USBCMD);
2532         while (status & USBCMD_FGR)
2533                 status = inw(io_addr + USBCMD);
2534
2535         uhci->is_suspended = 0;
2536
2537         /* Run and mark it configured with a 64-byte max packet */
2538         outw(USBCMD_RS | USBCMD_CF | USBCMD_MAXP, io_addr + USBCMD);
2539 }
2540
2541 static int ports_active(struct uhci *uhci)
2542 {
2543         unsigned int io_addr = uhci->io_addr;
2544         int connection = 0;
2545         int i;
2546
2547         for (i = 0; i < uhci->rh.numports; i++)
2548                 connection |= (inw(io_addr + USBPORTSC1 + i * 2) & 0x1);
2549
2550         return connection;
2551 }
2552
2553 static void start_hc(struct uhci *uhci)
2554 {
2555         unsigned int io_addr = uhci->io_addr;
2556         int timeout = 1000;
2557
2558         /*
2559          * Reset the HC - this will force us to get a
2560          * new notification of any already connected
2561          * ports due to the virtual disconnect that it
2562          * implies.
2563          */
2564         outw(USBCMD_HCRESET, io_addr + USBCMD);
2565         while (inw(io_addr + USBCMD) & USBCMD_HCRESET) {
2566                 if (!--timeout) {
2567                         printk(KERN_ERR "uhci: USBCMD_HCRESET timed out!\n");
2568                         break;
2569                 }
2570         }
2571
2572         /* Turn on all interrupts */
2573         outw(USBINTR_TIMEOUT | USBINTR_RESUME | USBINTR_IOC | USBINTR_SP,
2574                 io_addr + USBINTR);
2575
2576         /* Start at frame 0 */
2577         outw(0, io_addr + USBFRNUM);
2578         outl(uhci->fl->dma_handle, io_addr + USBFLBASEADD);
2579
2580         /* Run and mark it configured with a 64-byte max packet */
2581         outw(USBCMD_RS | USBCMD_CF | USBCMD_MAXP, io_addr + USBCMD);
2582 }
2583
2584 #ifdef CONFIG_PROC_FS
2585 static int uhci_num = 0;
2586 #endif
2587
2588 static void free_uhci(struct uhci *uhci)
2589 {
2590         kfree(uhci);
2591 }
2592
2593 /*
2594  * De-allocate all resources..
2595  */
2596 static void release_uhci(struct uhci *uhci)
2597 {
2598         int i;
2599 #ifdef CONFIG_PROC_FS
2600         char buf[8];
2601 #endif
2602
2603         if (uhci->irq >= 0) {
2604                 free_irq(uhci->irq, uhci);
2605                 uhci->irq = -1;
2606         }
2607
2608         for (i = 0; i < UHCI_NUM_SKELQH; i++)
2609                 if (uhci->skelqh[i]) {
2610                         uhci_free_qh(uhci, uhci->skelqh[i]);
2611                         uhci->skelqh[i] = NULL;
2612                 }
2613
2614         for (i = 0; i < UHCI_NUM_SKELTD; i++)
2615                 if (uhci->skeltd[i]) {
2616                         uhci_free_td(uhci, uhci->skeltd[i]);
2617                         uhci->skeltd[i] = NULL;
2618                 }
2619
2620         if (uhci->qh_pool) {
2621                 pci_pool_destroy(uhci->qh_pool);
2622                 uhci->qh_pool = NULL;
2623         }
2624
2625         if (uhci->td_pool) {
2626                 pci_pool_destroy(uhci->td_pool);
2627                 uhci->td_pool = NULL;
2628         }
2629
2630         if (uhci->fl) {
2631                 pci_free_consistent(uhci->dev, sizeof(*uhci->fl), uhci->fl, uhci->fl->dma_handle);
2632                 uhci->fl = NULL;
2633         }
2634
2635         if (uhci->bus) {
2636                 usb_free_bus(uhci->bus);
2637                 uhci->bus = NULL;
2638         }
2639
2640 #ifdef CONFIG_PROC_FS
2641         if (uhci->proc_entry) {
2642                 sprintf(buf, "hc%d", uhci->num);
2643
2644                 remove_proc_entry(buf, uhci_proc_root);
2645                 uhci->proc_entry = NULL;
2646         }
2647 #endif
2648
2649         free_uhci(uhci);
2650 }
2651
2652 /*
2653  * Allocate a frame list, and then setup the skeleton
2654  *
2655  * The hardware doesn't really know any difference
2656  * in the queues, but the order does matter for the
2657  * protocols higher up. The order is:
2658  *
2659  *  - any isochronous events handled before any
2660  *    of the queues. We don't do that here, because
2661  *    we'll create the actual TD entries on demand.
2662  *  - The first queue is the interrupt queue.
2663  *  - The second queue is the control queue, split into low and high speed
2664  *  - The third queue is bulk queue.
2665  *  - The fourth queue is the bandwidth reclamation queue, which loops back
2666  *    to the high speed control queue.
2667  */
2668 static int alloc_uhci(struct pci_dev *dev, unsigned int io_addr, unsigned int io_size)
2669 {
2670         struct uhci *uhci;
2671         int retval;
2672         char buf[8], *bufp = buf;
2673         int i, port;
2674         struct usb_bus *bus;
2675         dma_addr_t dma_handle;
2676 #ifdef CONFIG_PROC_FS
2677         struct proc_dir_entry *ent;
2678 #endif
2679
2680         retval = -ENODEV;
2681         if (pci_enable_device(dev) < 0) {
2682                 err("couldn't enable PCI device");
2683                 goto err_enable_device;
2684         }
2685
2686         if (!dev->irq) {
2687                 err("found UHCI device with no IRQ assigned. check BIOS settings!");
2688                 goto err_invalid_irq;
2689         }
2690
2691         if (!pci_dma_supported(dev, 0xFFFFFFFF)) {
2692                 err("PCI subsystem doesn't support 32 bit addressing?");
2693                 goto err_pci_dma_supported;
2694         }
2695
2696         retval = -EBUSY;
2697         if (!request_region(io_addr, io_size, "usb-uhci")) {
2698                 err("couldn't allocate I/O range %x - %x", io_addr,
2699                         io_addr + io_size - 1);
2700                 goto err_request_region;
2701         }
2702
2703         pci_set_master(dev);
2704
2705 #ifndef __sparc__
2706         sprintf(buf, "%d", dev->irq);
2707 #else
2708         bufp = __irq_itoa(dev->irq);
2709 #endif
2710         printk(KERN_INFO __FILE__ ": USB UHCI at I/O 0x%x, IRQ %s\n",
2711                 io_addr, bufp);
2712
2713         if (pci_set_dma_mask(dev, 0xFFFFFFFF)) {
2714                 err("couldn't set PCI dma mask");
2715                 retval = -ENODEV;
2716                 goto err_pci_set_dma_mask;
2717         }
2718
2719         uhci = kmalloc(sizeof(*uhci), GFP_KERNEL);
2720         if (!uhci) {
2721                 err("couldn't allocate uhci structure");
2722                 retval = -ENOMEM;
2723                 goto err_alloc_uhci;
2724         }
2725
2726         uhci->dev = dev;
2727         uhci->io_addr = io_addr;
2728         uhci->io_size = io_size;
2729         pci_set_drvdata(dev, uhci);
2730
2731 #ifdef CONFIG_PROC_FS
2732         uhci->num = uhci_num++;
2733
2734         sprintf(buf, "hc%d", uhci->num);
2735
2736         ent = create_proc_entry(buf, S_IFREG|S_IRUGO|S_IWUSR, uhci_proc_root);
2737         if (!ent) {
2738                 err("couldn't create uhci proc entry");
2739                 retval = -ENOMEM;
2740                 goto err_create_proc_entry;
2741         }
2742
2743         ent->data = uhci;
2744         ent->proc_fops = &uhci_proc_operations;
2745         ent->size = 0;
2746         uhci->proc_entry = ent;
2747 #endif
2748
2749         /* Reset here so we don't get any interrupts from an old setup */
2750         /*  or broken setup */
2751         reset_hc(uhci);
2752
2753         spin_lock_init(&uhci->qh_remove_list_lock);
2754         INIT_LIST_HEAD(&uhci->qh_remove_list);
2755
2756         spin_lock_init(&uhci->urb_remove_list_lock);
2757         INIT_LIST_HEAD(&uhci->urb_remove_list);
2758
2759         spin_lock_init(&uhci->urb_list_lock);
2760         INIT_LIST_HEAD(&uhci->urb_list);
2761
2762         spin_lock_init(&uhci->complete_list_lock);
2763         INIT_LIST_HEAD(&uhci->complete_list);
2764
2765         spin_lock_init(&uhci->frame_list_lock);
2766
2767         /* We need exactly one page (per UHCI specs), how convenient */
2768         /* We assume that one page is atleast 4k (1024 frames * 4 bytes) */
2769 #if PAGE_SIZE < (4 * 1024)
2770 #error PAGE_SIZE is not atleast 4k
2771 #endif
2772         uhci->fl = pci_alloc_consistent(uhci->dev, sizeof(*uhci->fl), &dma_handle);
2773         if (!uhci->fl) {
2774                 err("unable to allocate consistent memory for frame list");
2775                 goto err_alloc_fl;
2776         }
2777
2778         memset((void *)uhci->fl, 0, sizeof(*uhci->fl));
2779
2780         uhci->fl->dma_handle = dma_handle;
2781
2782         uhci->td_pool = pci_pool_create("uhci_td", uhci->dev,
2783                 sizeof(struct uhci_td), 16, 0, GFP_DMA | GFP_ATOMIC);
2784         if (!uhci->td_pool) {
2785                 err("unable to create td pci_pool");
2786                 goto err_create_td_pool;
2787         }
2788
2789         uhci->qh_pool = pci_pool_create("uhci_qh", uhci->dev,
2790                 sizeof(struct uhci_qh), 16, 0, GFP_DMA | GFP_ATOMIC);
2791         if (!uhci->qh_pool) {
2792                 err("unable to create qh pci_pool");
2793                 goto err_create_qh_pool;
2794         }
2795
2796         bus = usb_alloc_bus(&uhci_device_operations);
2797         if (!bus) {
2798                 err("unable to allocate bus");
2799                 goto err_alloc_bus;
2800         }
2801
2802         uhci->bus = bus;
2803         bus->hcpriv = uhci;
2804
2805         usb_register_bus(uhci->bus);
2806
2807         /* Initialize the root hub */
2808
2809         /* UHCI specs says devices must have 2 ports, but goes on to say */
2810         /*  they may have more but give no way to determine how many they */
2811         /*  have. However, according to the UHCI spec, Bit 7 is always set */
2812         /*  to 1. So we try to use this to our advantage */
2813         for (port = 0; port < (uhci->io_size - 0x10) / 2; port++) {
2814                 unsigned int portstatus;
2815
2816                 portstatus = inw(uhci->io_addr + 0x10 + (port * 2));
2817                 if (!(portstatus & 0x0080))
2818                         break;
2819         }
2820         if (debug)
2821                 info("detected %d ports", port);
2822
2823         /* This is experimental so anything less than 2 or greater than 8 is */
2824         /*  something weird and we'll ignore it */
2825         if (port < 2 || port > 8) {
2826                 info("port count misdetected? forcing to 2 ports");
2827                 port = 2;
2828         }
2829
2830         uhci->rh.numports = port;
2831
2832         uhci->bus->root_hub = uhci->rh.dev = usb_alloc_dev(NULL, uhci->bus);
2833         if (!uhci->rh.dev) {
2834                 err("unable to allocate root hub");
2835                 goto err_alloc_root_hub;
2836         }
2837
2838         uhci->skeltd[0] = uhci_alloc_td(uhci, uhci->rh.dev);
2839         if (!uhci->skeltd[0]) {
2840                 err("unable to allocate TD 0");
2841                 goto err_alloc_skeltd;
2842         }
2843
2844         /*
2845          * 9 Interrupt queues; link int2 to int1, int4 to int2, etc
2846          * then link int1 to control and control to bulk
2847          */
2848         for (i = 1; i < 9; i++) {
2849                 struct uhci_td *td;
2850
2851        &nb