v2.4.10.4 -> v2.4.10.5
[opensuse:kernel.git] / drivers / usb / uhci.c
1 /*
2  * Universal Host Controller Interface driver for USB.
3  *
4  * Maintainer: Johannes Erdfelt <johannes@erdfelt.com>
5  *
6  * (C) Copyright 1999 Linus Torvalds
7  * (C) Copyright 1999-2001 Johannes Erdfelt, johannes@erdfelt.com
8  * (C) Copyright 1999 Randy Dunlap
9  * (C) Copyright 1999 Georg Acher, acher@in.tum.de
10  * (C) Copyright 1999 Deti Fliegl, deti@fliegl.de
11  * (C) Copyright 1999 Thomas Sailer, sailer@ife.ee.ethz.ch
12  * (C) Copyright 1999 Roman Weissgaerber, weissg@vienna.at
13  * (C) Copyright 2000 Yggdrasil Computing, Inc. (port of new PCI interface
14  *               support from usb-ohci.c by Adam Richter, adam@yggdrasil.com).
15  * (C) Copyright 1999 Gregory P. Smith (from usb-ohci.c)
16  *
17  * Intel documents this fairly well, and as far as I know there
18  * are no royalties or anything like that, but even so there are
19  * people who decided that they want to do the same thing in a
20  * completely different way.
21  *
22  * WARNING! The USB documentation is downright evil. Most of it
23  * is just crap, written by a committee. You're better off ignoring
24  * most of it, the important stuff is:
25  *  - the low-level protocol (fairly simple but lots of small details)
26  *  - working around the horridness of the rest
27  */
28
29 #include <linux/config.h>
30 #include <linux/module.h>
31 #include <linux/pci.h>
32 #include <linux/kernel.h>
33 #include <linux/init.h>
34 #include <linux/delay.h>
35 #include <linux/ioport.h>
36 #include <linux/sched.h>
37 #include <linux/slab.h>
38 #include <linux/smp_lock.h>
39 #include <linux/errno.h>
40 #include <linux/unistd.h>
41 #include <linux/interrupt.h>
42 #include <linux/spinlock.h>
43 #include <linux/proc_fs.h>
44 #ifdef CONFIG_USB_DEBUG
45 #define DEBUG
46 #else
47 #undef DEBUG
48 #endif
49 #include <linux/usb.h>
50
51 #include <asm/uaccess.h>
52 #include <asm/io.h>
53 #include <asm/irq.h>
54 #include <asm/system.h>
55
56 #include "uhci.h"
57
58 #include <linux/pm.h>
59
60
61 /*
62  * Version Information
63  */
64 #define DRIVER_VERSION "v1.1"
65 #define DRIVER_AUTHOR "Linus 'Frodo Rabbit' Torvalds, Johannes Erdfelt, Randy Dunlap, Georg Acher, Deti Fliegl, Thomas Sailer, Roman Weissgaerber"
66 #define DRIVER_DESC "USB Universal Host Controller Interface driver"
67
68
69 /*
70  * debug = 0, no debugging messages
71  * debug = 1, dump failed URB's except for stalls
72  * debug = 2, dump all failed URB's (including stalls)
73  *            show all queues in /proc/uhci/hc*
74  * debug = 3, show all TD's in URB's when dumping
75  */
76 #ifdef DEBUG
77 static int debug = 1;
78 #else
79 static int debug = 0;
80 #endif
81 MODULE_PARM(debug, "i");
82 MODULE_PARM_DESC(debug, "Debug level");
83 static char *errbuf;
84 #define ERRBUF_LEN    (PAGE_SIZE * 8)
85
86 #include "uhci-debug.h"
87
88 static kmem_cache_t *uhci_up_cachep;    /* urb_priv */
89
90 static int rh_submit_urb(struct urb *urb);
91 static int rh_unlink_urb(struct urb *urb);
92 static int uhci_get_current_frame_number(struct usb_device *dev);
93 static int uhci_unlink_urb(struct urb *urb);
94 static void uhci_unlink_generic(struct uhci *uhci, struct urb *urb);
95 static void uhci_call_completion(struct urb *urb);
96
97 static int  ports_active(struct uhci *uhci);
98 static void suspend_hc(struct uhci *uhci);
99 static void wakeup_hc(struct uhci *uhci);
100
101 /* If a transfer is still active after this much time, turn off FSBR */
102 #define IDLE_TIMEOUT    (HZ / 20)       /* 50 ms */
103
104 #define MAX_URB_LOOP    2048            /* Maximum number of linked URB's */
105
106 /*
107  * Only the USB core should call uhci_alloc_dev and uhci_free_dev
108  */
109 static int uhci_alloc_dev(struct usb_device *dev)
110 {
111         return 0;
112 }
113
114 static int uhci_free_dev(struct usb_device *dev)
115 {
116         struct uhci *uhci = (struct uhci *)dev->bus->hcpriv;
117         struct list_head list, *tmp, *head;
118         unsigned long flags;
119
120         /* Walk through the entire URB list and forcefully remove any */
121         /*  URBs that are still active for that device */
122
123         /* Two stage unlink so we don't deadlock on urb_list_lock */
124         INIT_LIST_HEAD(&list);
125
126         spin_lock_irqsave(&uhci->urb_list_lock, flags);
127         head = &uhci->urb_list;
128         tmp = head->next;
129         while (tmp != head) {
130                 struct urb *urb = list_entry(tmp, struct urb, urb_list);
131
132                 tmp = tmp->next;
133
134                 if (urb->dev == dev) {
135                         list_del(&urb->urb_list);
136                         list_add(&urb->urb_list, &list);
137                 }
138         }
139         spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
140
141         head = &list;
142         tmp = head->next;
143         while (tmp != head) {
144                 struct urb *urb = list_entry(tmp, struct urb, urb_list);
145                 tmp = tmp->next;
146
147                 /* Make sure we block waiting on these to die */
148                 urb->transfer_flags &= ~USB_ASYNC_UNLINK;
149
150                 /* uhci_unlink_urb will unlink from the temp list */
151                 uhci_unlink_urb(urb);
152         }
153
154         return 0;
155 }
156
157 static inline void uhci_set_next_interrupt(struct uhci *uhci)
158 {
159         unsigned long flags;
160
161         spin_lock_irqsave(&uhci->frame_list_lock, flags);
162         uhci->skel_term_td->status |= TD_CTRL_IOC;
163         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
164 }
165
166 static inline void uhci_clear_next_interrupt(struct uhci *uhci)
167 {
168         unsigned long flags;
169
170         spin_lock_irqsave(&uhci->frame_list_lock, flags);
171         uhci->skel_term_td->status &= ~TD_CTRL_IOC;
172         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
173 }
174
175 static inline void uhci_add_complete(struct urb *urb)
176 {
177         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
178         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
179         unsigned long flags;
180
181         spin_lock_irqsave(&uhci->complete_list_lock, flags);
182         list_add(&urbp->complete_list, &uhci->complete_list);
183         spin_unlock_irqrestore(&uhci->complete_list_lock, flags);
184 }
185
186 static struct uhci_td *uhci_alloc_td(struct uhci *uhci, struct usb_device *dev)
187 {
188         dma_addr_t dma_handle;
189         struct uhci_td *td;
190
191         td = pci_pool_alloc(uhci->td_pool, GFP_DMA | GFP_ATOMIC, &dma_handle);
192         if (!td)
193                 return NULL;
194
195         td->dma_handle = dma_handle;
196
197         td->link = UHCI_PTR_TERM;
198         td->buffer = 0;
199
200         td->frame = -1;
201         td->dev = dev;
202
203         INIT_LIST_HEAD(&td->list);
204         INIT_LIST_HEAD(&td->fl_list);
205
206         usb_inc_dev_use(dev);
207
208         return td;
209 }
210
211 static void inline uhci_fill_td(struct uhci_td *td, __u32 status,
212                 __u32 info, __u32 buffer)
213 {
214         td->status = status;
215         td->info = info;
216         td->buffer = buffer;
217 }
218
219 static void uhci_insert_td(struct uhci *uhci, struct uhci_td *skeltd, struct uhci_td *td)
220 {
221         unsigned long flags;
222         struct uhci_td *ltd;
223
224         spin_lock_irqsave(&uhci->frame_list_lock, flags);
225
226         ltd = list_entry(skeltd->fl_list.prev, struct uhci_td, fl_list);
227
228         td->link = ltd->link;
229         mb();
230         ltd->link = td->dma_handle;
231
232         list_add_tail(&td->fl_list, &skeltd->fl_list);
233
234         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
235 }
236
237 /*
238  * We insert Isochronous transfers directly into the frame list at the
239  * beginning
240  * The layout looks as follows:
241  * frame list pointer -> iso td's (if any) ->
242  * periodic interrupt td (if frame 0) -> irq td's -> control qh -> bulk qh
243  */
244 static void uhci_insert_td_frame_list(struct uhci *uhci, struct uhci_td *td, unsigned framenum)
245 {
246         unsigned long flags;
247
248         framenum %= UHCI_NUMFRAMES;
249
250         spin_lock_irqsave(&uhci->frame_list_lock, flags);
251
252         td->frame = framenum;
253
254         /* Is there a TD already mapped there? */
255         if (uhci->fl->frame_cpu[framenum]) {
256                 struct uhci_td *ftd, *ltd;
257
258                 ftd = uhci->fl->frame_cpu[framenum];
259                 ltd = list_entry(ftd->fl_list.prev, struct uhci_td, fl_list);
260
261                 list_add_tail(&td->fl_list, &ftd->fl_list);
262
263                 td->link = ltd->link;
264                 mb();
265                 ltd->link = td->dma_handle;
266         } else {
267                 td->link = uhci->fl->frame[framenum];
268                 mb();
269                 uhci->fl->frame[framenum] = td->dma_handle;
270                 uhci->fl->frame_cpu[framenum] = td;
271         }
272
273         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
274 }
275
276 static void uhci_remove_td(struct uhci *uhci, struct uhci_td *td)
277 {
278         unsigned long flags;
279
280         /* If it's not inserted, don't remove it */
281         if (td->frame == -1 && list_empty(&td->fl_list))
282                 return;
283
284         spin_lock_irqsave(&uhci->frame_list_lock, flags);
285         if (td->frame != -1 && uhci->fl->frame_cpu[td->frame] == td) {
286                 if (list_empty(&td->fl_list)) {
287                         uhci->fl->frame[td->frame] = td->link;
288                         uhci->fl->frame_cpu[td->frame] = NULL;
289                 } else {
290                         struct uhci_td *ntd;
291
292                         ntd = list_entry(td->fl_list.next, struct uhci_td, fl_list);
293                         uhci->fl->frame[td->frame] = ntd->dma_handle;
294                         uhci->fl->frame_cpu[td->frame] = ntd;
295                 }
296         } else {
297                 struct uhci_td *ptd;
298
299                 ptd = list_entry(td->fl_list.prev, struct uhci_td, fl_list);
300                 ptd->link = td->link;
301         }
302
303         mb();
304         td->link = UHCI_PTR_TERM;
305
306         list_del_init(&td->fl_list);
307         td->frame = -1;
308
309         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
310 }
311
312 /*
313  * Inserts a td into qh list at the top.
314  */
315 static void uhci_insert_tds_in_qh(struct uhci_qh *qh, struct urb *urb, int breadth)
316 {
317         struct list_head *tmp, *head;
318         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
319         struct uhci_td *td, *ptd;
320
321         if (list_empty(&urbp->td_list))
322                 return;
323
324         head = &urbp->td_list;
325         tmp = head->next;
326
327         /* Ordering isn't important here yet since the QH hasn't been */
328         /*  inserted into the schedule yet */
329         td = list_entry(tmp, struct uhci_td, list);
330
331         /* Add the first TD to the QH element pointer */
332         qh->element = td->dma_handle | (breadth ? 0 : UHCI_PTR_DEPTH);
333
334         ptd = td;
335
336         /* Then link the rest of the TD's */
337         tmp = tmp->next;
338         while (tmp != head) {
339                 td = list_entry(tmp, struct uhci_td, list);
340
341                 tmp = tmp->next;
342
343                 ptd->link = td->dma_handle | (breadth ? 0 : UHCI_PTR_DEPTH);
344
345                 ptd = td;
346         }
347
348         ptd->link = UHCI_PTR_TERM;
349 }
350
351 static void uhci_free_td(struct uhci *uhci, struct uhci_td *td)
352 {
353         if (!list_empty(&td->list) || !list_empty(&td->fl_list))
354                 dbg("td is still in URB list!");
355
356         if (td->dev)
357                 usb_dec_dev_use(td->dev);
358
359         pci_pool_free(uhci->td_pool, td, td->dma_handle);
360 }
361
362 static struct uhci_qh *uhci_alloc_qh(struct uhci *uhci, struct usb_device *dev)
363 {
364         dma_addr_t dma_handle;
365         struct uhci_qh *qh;
366
367         qh = pci_pool_alloc(uhci->qh_pool, GFP_DMA | GFP_ATOMIC, &dma_handle);
368         if (!qh)
369                 return NULL;
370
371         qh->dma_handle = dma_handle;
372
373         qh->element = UHCI_PTR_TERM;
374         qh->link = UHCI_PTR_TERM;
375
376         qh->dev = dev;
377
378         INIT_LIST_HEAD(&qh->list);
379         INIT_LIST_HEAD(&qh->remove_list);
380
381         usb_inc_dev_use(dev);
382
383         return qh;
384 }
385
386 static void uhci_free_qh(struct uhci *uhci, struct uhci_qh *qh)
387 {
388         if (!list_empty(&qh->list))
389                 dbg("qh list not empty!");
390         if (!list_empty(&qh->remove_list))
391                 dbg("qh still in remove_list!");
392
393         if (qh->dev)
394                 usb_dec_dev_use(qh->dev);
395
396         pci_pool_free(uhci->qh_pool, qh, qh->dma_handle);
397 }
398
399 static void uhci_insert_qh(struct uhci *uhci, struct uhci_qh *skelqh, struct uhci_qh *qh)
400 {
401         struct uhci_qh *lqh;
402         unsigned long flags;
403
404         spin_lock_irqsave(&uhci->frame_list_lock, flags);
405
406         /* Grab the last QH */
407         lqh = list_entry(skelqh->list.prev, struct uhci_qh, list);
408
409         qh->link = lqh->link;
410         mb();                           /* Ordering is important */
411         lqh->link = qh->dma_handle | UHCI_PTR_QH;
412
413         list_add_tail(&qh->list, &skelqh->list);
414
415         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
416 }
417
418 static void uhci_remove_qh(struct uhci *uhci, struct uhci_qh *qh)
419 {
420         unsigned long flags;
421         struct uhci_qh *prevqh;
422
423         /* Only go through the hoops if it's actually linked in */
424         if (list_empty(&qh->list)) {
425                 goto list;
426         }
427
428         qh->urbp = NULL;
429
430         spin_lock_irqsave(&uhci->frame_list_lock, flags);
431
432         prevqh = list_entry(qh->list.prev, struct uhci_qh, list);
433
434         prevqh->link = qh->link;
435         mb();
436         qh->element = qh->link = UHCI_PTR_TERM;
437
438         list_del_init(&qh->list);
439
440         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
441
442 list:
443         spin_lock_irqsave(&uhci->qh_remove_list_lock, flags);
444
445         /* Check to see if the remove list is empty. Set the IOC bit */
446         /* to force an interrupt so we can remove the QH */
447         if (list_empty(&uhci->qh_remove_list))
448                 uhci_set_next_interrupt(uhci);
449
450         list_add(&qh->remove_list, &uhci->qh_remove_list);
451
452         spin_unlock_irqrestore(&uhci->qh_remove_list_lock, flags);
453 }
454
455 static int uhci_fixup_toggle(struct urb *urb, unsigned int toggle)
456 {
457         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
458         struct list_head *head, *tmp;
459
460         head = &urbp->td_list;
461         tmp = head->next;
462         while (head != tmp) {
463                 struct uhci_td *td = list_entry(tmp, struct uhci_td, list);
464
465                 tmp = tmp->next;
466
467                 td->info &= ~(1 << TD_TOKEN_TOGGLE);
468                 if (toggle)
469                         td->info |= (1 << TD_TOKEN_TOGGLE);
470
471                 toggle ^= 1;
472         }
473
474         return toggle;
475 }
476
477 /* This function will append one URB's QH to another URB's QH. This is for */
478 /*  USB_QUEUE_BULK support for bulk transfers and soon implicitily for */
479 /*  control transfers */
480 static void uhci_append_queued_urb(struct uhci *uhci, struct urb *eurb, struct urb *urb)
481 {
482         struct urb_priv *eurbp, *urbp, *furbp, *lurbp;
483         struct list_head *tmp;
484         struct uhci_td *ftd, *lltd;
485         unsigned long flags;
486
487         eurbp = eurb->hcpriv;
488         urbp = urb->hcpriv;
489
490         spin_lock_irqsave(&uhci->frame_list_lock, flags);
491
492         /* Find the first URB in the queue */
493         if (eurbp->queued) {
494                 struct list_head *head = &eurbp->queue_list;
495
496                 tmp = head->next;
497                 while (tmp != head) {
498                         struct urb_priv *turbp =
499                                 list_entry(tmp, struct urb_priv, queue_list);
500
501                         if (!turbp->queued)
502                                 break;
503
504                         tmp = tmp->next;
505                 }
506         } else
507                 tmp = &eurbp->queue_list;
508
509         furbp = list_entry(tmp, struct urb_priv, queue_list);
510         lurbp = list_entry(furbp->queue_list.prev, struct urb_priv, queue_list);
511
512         lltd = list_entry(lurbp->td_list.prev, struct uhci_td, list);
513         ftd = list_entry(urbp->td_list.next, struct uhci_td, list);
514
515         uhci_fixup_toggle(urb, uhci_toggle(lltd->info) ^ 1);
516
517         mb();                   /* Make sure we flush everything */
518         /* Only support bulk right now, so no depth */
519         lltd->link = ftd->dma_handle;
520
521         list_add_tail(&urbp->queue_list, &furbp->queue_list);
522
523         urbp->queued = 1;
524
525         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
526 }
527
528 static void uhci_delete_queued_urb(struct uhci *uhci, struct urb *urb)
529 {
530         struct urb_priv *urbp, *nurbp;
531         struct list_head *head, *tmp;
532         struct urb_priv *purbp;
533         struct uhci_td *pltd;
534         unsigned int toggle;
535         unsigned long flags;
536
537         urbp = urb->hcpriv;
538
539         spin_lock_irqsave(&uhci->frame_list_lock, flags);
540
541         if (list_empty(&urbp->queue_list))
542                 goto out;
543
544         nurbp = list_entry(urbp->queue_list.next, struct urb_priv, queue_list);
545
546         /* Fix up the toggle for the next URB's */
547         if (!urbp->queued)
548                 toggle = usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe), usb_pipeout(urb->pipe));
549         else {
550                 /* If we're in the middle of the queue, grab the toggle */
551                 /*  from the TD previous to us */
552                 purbp = list_entry(urbp->queue_list.prev, struct urb_priv,
553                                 queue_list);
554
555                 pltd = list_entry(purbp->td_list.prev, struct uhci_td, list);
556
557                 toggle = uhci_toggle(pltd->info) ^ 1;
558         }
559
560         head = &urbp->queue_list;
561         tmp = head->next;
562         while (head != tmp) {
563                 struct urb_priv *turbp;
564
565                 turbp = list_entry(tmp, struct urb_priv, queue_list);
566
567                 tmp = tmp->next;
568
569                 if (!turbp->queued)
570                         break;
571
572                 toggle = uhci_fixup_toggle(turbp->urb, toggle);
573         }
574
575         usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
576                 usb_pipeout(urb->pipe), toggle);
577
578         if (!urbp->queued) {
579                 int status;
580
581                 /*  The HC may continue using the current QH if it finished */
582                 /* all of the TD's in this URB and may have started on the */
583                 /* next URB's TD's already, so we'll take over ownership */
584                 /* of this QH and use it instead. Don't forget to delete */
585                 /* the old QH first */
586                 uhci_free_qh(uhci, nurbp->qh);
587
588                 nurbp->qh = urbp->qh;
589                 nurbp->qh->urbp = nurbp;
590                 urbp->qh = NULL;
591
592                 /* If the last TD from the first (this) urb didn't */
593                 /*  complete, reset qh->element to the first TD in the */
594                 /*  next urb */
595                 pltd = list_entry(urbp->td_list.prev, struct uhci_td, list);
596                 status = uhci_status_bits(pltd->status);
597                 if ((status & TD_CTRL_ACTIVE) || uhci_actual_length(pltd->status) < uhci_expected_length(pltd->info)) {
598                         struct uhci_td *ftd = list_entry(nurbp->td_list.next, struct uhci_td, list);
599                         nurbp->qh->element = ftd->dma_handle;
600                 }
601
602                 nurbp->queued = 0;
603         } else {
604                 /* We're somewhere in the middle (or end). A bit trickier */
605                 /*  than the head scenario */
606                 purbp = list_entry(urbp->queue_list.prev, struct urb_priv,
607                                 queue_list);
608
609                 pltd = list_entry(purbp->td_list.prev, struct uhci_td, list);
610                 if (nurbp->queued) {
611                         struct uhci_td *nftd;
612
613                         /* Close the gap between the two */
614                         nftd = list_entry(nurbp->td_list.next, struct uhci_td,
615                                         list);
616                         pltd->link = nftd->dma_handle;
617                 } else
618                         /* The next URB happens to be the beggining, so */
619                         /*  we're the last, end the chain */
620                         pltd->link = UHCI_PTR_TERM;
621         }
622
623         list_del_init(&urbp->queue_list);
624
625 out:
626         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
627 }
628
629 static struct urb_priv *uhci_alloc_urb_priv(struct uhci *uhci, struct urb *urb)
630 {
631         struct urb_priv *urbp;
632
633         urbp = kmem_cache_alloc(uhci_up_cachep, in_interrupt() ? SLAB_ATOMIC : SLAB_KERNEL);
634         if (!urbp) {
635                 err("uhci_alloc_urb_priv: couldn't allocate memory for urb_priv\n");
636                 return NULL;
637         }
638
639         memset((void *)urbp, 0, sizeof(*urbp));
640
641         urbp->inserttime = jiffies;
642         urbp->urb = urb;
643         urbp->dev = urb->dev;
644         
645         INIT_LIST_HEAD(&urbp->td_list);
646         INIT_LIST_HEAD(&urbp->queue_list);
647         INIT_LIST_HEAD(&urbp->complete_list);
648
649         urb->hcpriv = urbp;
650
651         if (urb->dev != uhci->rh.dev) {
652                 if (urb->transfer_buffer_length) {
653                         urbp->transfer_buffer_dma_handle = pci_map_single(uhci->dev,
654                                 urb->transfer_buffer, urb->transfer_buffer_length,
655                                 usb_pipein(urb->pipe) ? PCI_DMA_FROMDEVICE :
656                                 PCI_DMA_TODEVICE);
657                         if (!urbp->transfer_buffer_dma_handle)
658                                 return NULL;
659                 }
660
661                 if (usb_pipetype(urb->pipe) == PIPE_CONTROL && urb->setup_packet) {
662                         urbp->setup_packet_dma_handle = pci_map_single(uhci->dev,
663                                 urb->setup_packet, sizeof(devrequest),
664                                 PCI_DMA_TODEVICE);
665                         if (!urbp->setup_packet_dma_handle)
666                                 return NULL;
667                 }
668         }
669
670         return urbp;
671 }
672
673 static void uhci_add_td_to_urb(struct urb *urb, struct uhci_td *td)
674 {
675         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
676
677         td->urb = urb;
678
679         list_add_tail(&td->list, &urbp->td_list);
680 }
681
682 static void uhci_remove_td_from_urb(struct uhci_td *td)
683 {
684         if (list_empty(&td->list))
685                 return;
686
687         list_del_init(&td->list);
688
689         td->urb = NULL;
690 }
691
692 static void uhci_destroy_urb_priv(struct urb *urb)
693 {
694         struct list_head *head, *tmp;
695         struct urb_priv *urbp;
696         struct uhci *uhci;
697         unsigned long flags;
698
699         spin_lock_irqsave(&urb->lock, flags);
700
701         urbp = (struct urb_priv *)urb->hcpriv;
702         if (!urbp)
703                 goto out;
704
705         if (!urbp->dev || !urbp->dev->bus || !urbp->dev->bus->hcpriv) {
706                 warn("uhci_destroy_urb_priv: urb %p belongs to disconnected device or bus?", urb);
707                 goto out;
708         }
709
710         if (!list_empty(&urb->urb_list))
711                 warn("uhci_destroy_urb_priv: urb %p still on uhci->urb_list or uhci->remove_list", urb);
712
713         if (!list_empty(&urbp->complete_list))
714                 warn("uhci_destroy_urb_priv: urb %p still on uhci->complete_list", urb);
715
716         uhci = urbp->dev->bus->hcpriv;
717
718         head = &urbp->td_list;
719         tmp = head->next;
720         while (tmp != head) {
721                 struct uhci_td *td = list_entry(tmp, struct uhci_td, list);
722
723                 tmp = tmp->next;
724
725                 uhci_remove_td_from_urb(td);
726                 uhci_remove_td(uhci, td);
727                 uhci_free_td(uhci, td);
728         }
729
730         if (urbp->setup_packet_dma_handle)
731                 pci_unmap_single(uhci->dev, urbp->setup_packet_dma_handle,
732                         sizeof(devrequest), PCI_DMA_TODEVICE);
733
734         if (urbp->transfer_buffer_dma_handle)
735                 pci_unmap_single(uhci->dev, urbp->transfer_buffer_dma_handle,
736                         urb->transfer_buffer_length, usb_pipein(urb->pipe) ?
737                         PCI_DMA_FROMDEVICE : PCI_DMA_TODEVICE);
738
739         urb->hcpriv = NULL;
740         kmem_cache_free(uhci_up_cachep, urbp);
741
742 out:
743         spin_unlock_irqrestore(&urb->lock, flags);
744 }
745
746 static void uhci_inc_fsbr(struct uhci *uhci, struct urb *urb)
747 {
748         unsigned long flags;
749         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
750
751         spin_lock_irqsave(&uhci->frame_list_lock, flags);
752
753         if ((!(urb->transfer_flags & USB_NO_FSBR)) && !urbp->fsbr) {
754                 urbp->fsbr = 1;
755                 if (!uhci->fsbr++)
756                         uhci->skel_term_qh->link = uhci->skel_hs_control_qh->dma_handle | UHCI_PTR_QH;
757         }
758
759         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
760 }
761
762 static void uhci_dec_fsbr(struct uhci *uhci, struct urb *urb)
763 {
764         unsigned long flags;
765         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
766
767         spin_lock_irqsave(&uhci->frame_list_lock, flags);
768
769         if ((!(urb->transfer_flags & USB_NO_FSBR)) && urbp->fsbr) {
770                 urbp->fsbr = 0;
771                 if (!--uhci->fsbr)
772                         uhci->skel_term_qh->link = UHCI_PTR_TERM;
773         }
774
775         spin_unlock_irqrestore(&uhci->frame_list_lock, flags);
776 }
777
778 /*
779  * Map status to standard result codes
780  *
781  * <status> is (td->status & 0xFE0000) [a.k.a. uhci_status_bits(td->status)]
782  * <dir_out> is True for output TDs and False for input TDs.
783  */
784 static int uhci_map_status(int status, int dir_out)
785 {
786         if (!status)
787                 return 0;
788         if (status & TD_CTRL_BITSTUFF)                  /* Bitstuff error */
789                 return -EPROTO;
790         if (status & TD_CTRL_CRCTIMEO) {                /* CRC/Timeout */
791                 if (dir_out)
792                         return -ETIMEDOUT;
793                 else
794                         return -EILSEQ;
795         }
796         if (status & TD_CTRL_NAK)                       /* NAK */
797                 return -ETIMEDOUT;
798         if (status & TD_CTRL_BABBLE)                    /* Babble */
799                 return -EPIPE;
800         if (status & TD_CTRL_DBUFERR)                   /* Buffer error */
801                 return -ENOSR;
802         if (status & TD_CTRL_STALLED)                   /* Stalled */
803                 return -EPIPE;
804         if (status & TD_CTRL_ACTIVE)                    /* Active */
805                 return 0;
806
807         return -EINVAL;
808 }
809
810 /*
811  * Control transfers
812  */
813 static int uhci_submit_control(struct urb *urb)
814 {
815         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
816         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
817         struct uhci_td *td;
818         struct uhci_qh *qh;
819         unsigned long destination, status;
820         int maxsze = usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe));
821         int len = urb->transfer_buffer_length;
822         dma_addr_t data = urbp->transfer_buffer_dma_handle;
823
824         /* The "pipe" thing contains the destination in bits 8--18 */
825         destination = (urb->pipe & PIPE_DEVEP_MASK) | USB_PID_SETUP;
826
827         /* 3 errors */
828         status = (urb->pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE | (3 << 27);
829
830         /*
831          * Build the TD for the control request
832          */
833         td = uhci_alloc_td(uhci, urb->dev);
834         if (!td)
835                 return -ENOMEM;
836
837         uhci_add_td_to_urb(urb, td);
838         uhci_fill_td(td, status, destination | (7 << 21),
839                 urbp->setup_packet_dma_handle);
840
841         /*
842          * If direction is "send", change the frame from SETUP (0x2D)
843          * to OUT (0xE1). Else change it from SETUP to IN (0x69).
844          */
845         destination ^= (USB_PID_SETUP ^ usb_packetid(urb->pipe));
846
847         if (!(urb->transfer_flags & USB_DISABLE_SPD))
848                 status |= TD_CTRL_SPD;
849
850         /*
851          * Build the DATA TD's
852          */
853         while (len > 0) {
854                 int pktsze = len;
855
856                 if (pktsze > maxsze)
857                         pktsze = maxsze;
858
859                 td = uhci_alloc_td(uhci, urb->dev);
860                 if (!td)
861                         return -ENOMEM;
862
863                 /* Alternate Data0/1 (start with Data1) */
864                 destination ^= 1 << TD_TOKEN_TOGGLE;
865         
866                 uhci_add_td_to_urb(urb, td);
867                 uhci_fill_td(td, status, destination | ((pktsze - 1) << 21),
868                         data);
869
870                 data += pktsze;
871                 len -= pktsze;
872         }
873
874         /*
875          * Build the final TD for control status 
876          */
877         td = uhci_alloc_td(uhci, urb->dev);
878         if (!td)
879                 return -ENOMEM;
880
881         /*
882          * It's IN if the pipe is an output pipe or we're not expecting
883          * data back.
884          */
885         destination &= ~TD_PID;
886         if (usb_pipeout(urb->pipe) || !urb->transfer_buffer_length)
887                 destination |= USB_PID_IN;
888         else
889                 destination |= USB_PID_OUT;
890
891         destination |= 1 << TD_TOKEN_TOGGLE;            /* End in Data1 */
892
893         status &= ~TD_CTRL_SPD;
894
895         uhci_add_td_to_urb(urb, td);
896         uhci_fill_td(td, status | TD_CTRL_IOC,
897                 destination | (UHCI_NULL_DATA_SIZE << 21), 0);
898
899         qh = uhci_alloc_qh(uhci, urb->dev);
900         if (!qh)
901                 return -ENOMEM;
902
903         /* Low speed or small transfers gets a different queue and treatment */
904         if (urb->pipe & TD_CTRL_LS) {
905                 uhci_insert_tds_in_qh(qh, urb, 0);
906                 uhci_insert_qh(uhci, uhci->skel_ls_control_qh, qh);
907         } else {
908                 uhci_insert_tds_in_qh(qh, urb, 1);
909                 uhci_insert_qh(uhci, uhci->skel_hs_control_qh, qh);
910                 uhci_inc_fsbr(uhci, urb);
911         }
912
913         urbp->qh = qh;
914         qh->urbp = urbp;
915
916         return -EINPROGRESS;
917 }
918
919 static int usb_control_retrigger_status(struct urb *urb);
920
921 static int uhci_result_control(struct urb *urb)
922 {
923         struct list_head *tmp, *head;
924         struct urb_priv *urbp = urb->hcpriv;
925         struct uhci_td *td;
926         unsigned int status;
927         int ret = 0;
928
929         if (list_empty(&urbp->td_list))
930                 return -EINVAL;
931
932         head = &urbp->td_list;
933
934         if (urbp->short_control_packet) {
935                 tmp = head->prev;
936                 goto status_phase;
937         }
938
939         tmp = head->next;
940         td = list_entry(tmp, struct uhci_td, list);
941
942         /* The first TD is the SETUP phase, check the status, but skip */
943         /*  the count */
944         status = uhci_status_bits(td->status);
945         if (status & TD_CTRL_ACTIVE)
946                 return -EINPROGRESS;
947
948         if (status)
949                 goto td_error;
950
951         urb->actual_length = 0;
952
953         /* The rest of the TD's (but the last) are data */
954         tmp = tmp->next;
955         while (tmp != head && tmp->next != head) {
956                 td = list_entry(tmp, struct uhci_td, list);
957
958                 tmp = tmp->next;
959
960                 if (urbp->fsbr_timeout && (td->status & TD_CTRL_IOC) &&
961                     !(td->status & TD_CTRL_ACTIVE)) {
962                         uhci_inc_fsbr(urb->dev->bus->hcpriv, urb);
963                         urbp->fsbr_timeout = 0;
964                         td->status &= ~TD_CTRL_IOC;
965                 }
966
967                 status = uhci_status_bits(td->status);
968                 if (status & TD_CTRL_ACTIVE)
969                         return -EINPROGRESS;
970
971                 urb->actual_length += uhci_actual_length(td->status);
972
973                 if (status)
974                         goto td_error;
975
976                 /* Check to see if we received a short packet */
977                 if (uhci_actual_length(td->status) < uhci_expected_length(td->info)) {
978                         if (urb->transfer_flags & USB_DISABLE_SPD) {
979                                 ret = -EREMOTEIO;
980                                 goto err;
981                         }
982
983                         if (uhci_packetid(td->info) == USB_PID_IN)
984                                 return usb_control_retrigger_status(urb);
985                         else
986                                 return 0;
987                 }
988         }
989
990 status_phase:
991         td = list_entry(tmp, struct uhci_td, list);
992
993         /* Control status phase */
994         status = uhci_status_bits(td->status);
995
996 #ifdef I_HAVE_BUGGY_APC_BACKUPS
997         /* APC BackUPS Pro kludge */
998         /* It tries to send all of the descriptor instead of the amount */
999         /*  we requested */
1000         if (td->status & TD_CTRL_IOC && /* IOC is masked out by uhci_status_bits */
1001             status & TD_CTRL_ACTIVE &&
1002             status & TD_CTRL_NAK)
1003                 return 0;
1004 #endif
1005
1006         if (status & TD_CTRL_ACTIVE)
1007                 return -EINPROGRESS;
1008
1009         if (status)
1010                 goto td_error;
1011
1012         return 0;
1013
1014 td_error:
1015         ret = uhci_map_status(status, uhci_packetout(td->info));
1016         if (ret == -EPIPE)
1017                 /* endpoint has stalled - mark it halted */
1018                 usb_endpoint_halt(urb->dev, uhci_endpoint(td->info),
1019                                 uhci_packetout(td->info));
1020
1021 err:
1022         if ((debug == 1 && ret != -EPIPE) || debug > 1) {
1023                 /* Some debugging code */
1024                 dbg("uhci_result_control() failed with status %x", status);
1025
1026                 if (errbuf) {
1027                         /* Print the chain for debugging purposes */
1028                         uhci_show_qh(urbp->qh, errbuf, ERRBUF_LEN, 0);
1029
1030                         lprintk(errbuf);
1031                 }
1032         }
1033
1034         return ret;
1035 }
1036
1037 static int usb_control_retrigger_status(struct urb *urb)
1038 {
1039         struct list_head *tmp, *head;
1040         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1041         struct uhci *uhci = urb->dev->bus->hcpriv;
1042
1043         urbp->short_control_packet = 1;
1044
1045         /* Create a new QH to avoid pointer overwriting problems */
1046         uhci_remove_qh(uhci, urbp->qh);
1047
1048         /* Delete all of the TD's except for the status TD at the end */
1049         head = &urbp->td_list;
1050         tmp = head->next;
1051         while (tmp != head && tmp->next != head) {
1052                 struct uhci_td *td = list_entry(tmp, struct uhci_td, list);
1053
1054                 tmp = tmp->next;
1055
1056                 uhci_remove_td_from_urb(td);
1057                 uhci_remove_td(uhci, td);
1058                 uhci_free_td(uhci, td);
1059         }
1060
1061         urbp->qh = uhci_alloc_qh(uhci, urb->dev);
1062         if (!urbp->qh) {
1063                 err("unable to allocate new QH for control retrigger");
1064                 return -ENOMEM;
1065         }
1066
1067         urbp->qh->urbp = urbp;
1068
1069         /* One TD, who cares about Breadth first? */
1070         uhci_insert_tds_in_qh(urbp->qh, urb, 0);
1071
1072         /* Low speed or small transfers gets a different queue and treatment */
1073         if (urb->pipe & TD_CTRL_LS)
1074                 uhci_insert_qh(uhci, uhci->skel_ls_control_qh, urbp->qh);
1075         else
1076                 uhci_insert_qh(uhci, uhci->skel_hs_control_qh, urbp->qh);
1077
1078         return -EINPROGRESS;
1079 }
1080
1081 /*
1082  * Interrupt transfers
1083  */
1084 static int uhci_submit_interrupt(struct urb *urb)
1085 {
1086         struct uhci_td *td;
1087         unsigned long destination, status;
1088         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
1089         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1090
1091         if (urb->transfer_buffer_length > usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe)))
1092                 return -EINVAL;
1093
1094         /* The "pipe" thing contains the destination in bits 8--18 */
1095         destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
1096
1097         status = (urb->pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE | TD_CTRL_IOC;
1098
1099         td = uhci_alloc_td(uhci, urb->dev);
1100         if (!td)
1101                 return -ENOMEM;
1102
1103         destination |= (usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe), usb_pipeout(urb->pipe)) << TD_TOKEN_TOGGLE);
1104         destination |= ((urb->transfer_buffer_length - 1) << 21);
1105
1106         usb_dotoggle(urb->dev, usb_pipeendpoint(urb->pipe), usb_pipeout(urb->pipe));
1107
1108         uhci_add_td_to_urb(urb, td);
1109         uhci_fill_td(td, status, destination, urbp->transfer_buffer_dma_handle);
1110
1111         uhci_insert_td(uhci, uhci->skeltd[__interval_to_skel(urb->interval)], td);
1112
1113         return -EINPROGRESS;
1114 }
1115
1116 static int uhci_result_interrupt(struct urb *urb)
1117 {
1118         struct list_head *tmp, *head;
1119         struct urb_priv *urbp = urb->hcpriv;
1120         struct uhci_td *td;
1121         unsigned int status;
1122         int ret = 0;
1123
1124         urb->actual_length = 0;
1125
1126         head = &urbp->td_list;
1127         tmp = head->next;
1128         while (tmp != head) {
1129                 td = list_entry(tmp, struct uhci_td, list);
1130
1131                 tmp = tmp->next;
1132
1133                 if (urbp->fsbr_timeout && (td->status & TD_CTRL_IOC) &&
1134                     !(td->status & TD_CTRL_ACTIVE)) {
1135                         uhci_inc_fsbr(urb->dev->bus->hcpriv, urb);
1136                         urbp->fsbr_timeout = 0;
1137                         td->status &= ~TD_CTRL_IOC;
1138                 }
1139
1140                 status = uhci_status_bits(td->status);
1141                 if (status & TD_CTRL_ACTIVE)
1142                         return -EINPROGRESS;
1143
1144                 urb->actual_length += uhci_actual_length(td->status);
1145
1146                 if (status)
1147                         goto td_error;
1148
1149                 if (uhci_actual_length(td->status) < uhci_expected_length(td->info)) {
1150                         usb_settoggle(urb->dev, uhci_endpoint(td->info),
1151                                 uhci_packetout(td->info),
1152                                 uhci_toggle(td->info) ^ 1);
1153
1154                         if (urb->transfer_flags & USB_DISABLE_SPD) {
1155                                 ret = -EREMOTEIO;
1156                                 goto err;
1157                         } else
1158                                 return 0;
1159                 }
1160         }
1161
1162         return 0;
1163
1164 td_error:
1165         ret = uhci_map_status(status, uhci_packetout(td->info));
1166         if (ret == -EPIPE)
1167                 /* endpoint has stalled - mark it halted */
1168                 usb_endpoint_halt(urb->dev, uhci_endpoint(td->info),
1169                                 uhci_packetout(td->info));
1170
1171 err:
1172         if ((debug == 1 && ret != -EPIPE) || debug > 1) {
1173                 /* Some debugging code */
1174                 dbg("uhci_result_interrupt/bulk() failed with status %x",
1175                         status);
1176
1177                 if (errbuf) {
1178                         /* Print the chain for debugging purposes */
1179                         if (urbp->qh)
1180                                 uhci_show_qh(urbp->qh, errbuf, ERRBUF_LEN, 0);
1181                         else
1182                                 uhci_show_td(td, errbuf, ERRBUF_LEN, 0);
1183
1184                         lprintk(errbuf);
1185                 }
1186         }
1187
1188         return ret;
1189 }
1190
1191 static void uhci_reset_interrupt(struct urb *urb)
1192 {
1193         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
1194         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1195         struct uhci_td *td;
1196         unsigned long flags;
1197
1198         spin_lock_irqsave(&urb->lock, flags);
1199
1200         /* Root hub is special */
1201         if (urb->dev == uhci->rh.dev)
1202                 goto out;
1203
1204         td = list_entry(urbp->td_list.next, struct uhci_td, list);
1205
1206         td->status = (td->status & 0x2F000000) | TD_CTRL_ACTIVE | TD_CTRL_IOC;
1207         td->info &= ~(1 << TD_TOKEN_TOGGLE);
1208         td->info |= (usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe), usb_pipeout(urb->pipe)) << TD_TOKEN_TOGGLE);
1209         usb_dotoggle(urb->dev, usb_pipeendpoint(urb->pipe), usb_pipeout(urb->pipe));
1210
1211 out:
1212         urb->status = -EINPROGRESS;
1213
1214         spin_unlock_irqrestore(&urb->lock, flags);
1215 }
1216
1217 /*
1218  * Bulk transfers
1219  */
1220 static int uhci_submit_bulk(struct urb *urb, struct urb *eurb)
1221 {
1222         struct uhci_td *td;
1223         struct uhci_qh *qh;
1224         unsigned long destination, status;
1225         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
1226         int maxsze = usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe));
1227         int len = urb->transfer_buffer_length;
1228         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1229         dma_addr_t data = urbp->transfer_buffer_dma_handle;
1230
1231         if (len < 0)
1232                 return -EINVAL;
1233
1234         /* Can't have low speed bulk transfers */
1235         if (urb->pipe & TD_CTRL_LS)
1236                 return -EINVAL;
1237
1238         /* The "pipe" thing contains the destination in bits 8--18 */
1239         destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
1240
1241         /* 3 errors */
1242         status = TD_CTRL_ACTIVE | (3 << TD_CTRL_C_ERR_SHIFT);
1243
1244         if (!(urb->transfer_flags & USB_DISABLE_SPD))
1245                 status |= TD_CTRL_SPD;
1246
1247         /*
1248          * Build the DATA TD's
1249          */
1250         do {    /* Allow zero length packets */
1251                 int pktsze = len;
1252
1253                 if (pktsze > maxsze)
1254                         pktsze = maxsze;
1255
1256                 td = uhci_alloc_td(uhci, urb->dev);
1257                 if (!td)
1258                         return -ENOMEM;
1259
1260                 uhci_add_td_to_urb(urb, td);
1261                 uhci_fill_td(td, status, destination |
1262                         (((pktsze - 1) & UHCI_NULL_DATA_SIZE) << 21) |
1263                         (usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe),
1264                          usb_pipeout(urb->pipe)) << TD_TOKEN_TOGGLE),
1265                         data);
1266
1267                 data += pktsze;
1268                 len -= pktsze;
1269
1270                 usb_dotoggle(urb->dev, usb_pipeendpoint(urb->pipe),
1271                         usb_pipeout(urb->pipe));
1272         } while (len > 0);
1273
1274         if (usb_pipeout(urb->pipe) && (urb->transfer_flags & USB_ZERO_PACKET) &&
1275            urb->transfer_buffer_length) {
1276                 td = uhci_alloc_td(uhci, urb->dev);
1277                 if (!td)
1278                         return -ENOMEM;
1279
1280                 uhci_add_td_to_urb(urb, td);
1281                 uhci_fill_td(td, status, destination | UHCI_NULL_DATA_SIZE |
1282                         (usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe),
1283                          usb_pipeout(urb->pipe)) << TD_TOKEN_TOGGLE),
1284                         data);
1285
1286                 usb_dotoggle(urb->dev, usb_pipeendpoint(urb->pipe),
1287                         usb_pipeout(urb->pipe));
1288         }
1289
1290         /* Set the flag on the last packet */
1291         td->status |= TD_CTRL_IOC;
1292
1293         qh = uhci_alloc_qh(uhci, urb->dev);
1294         if (!qh)
1295                 return -ENOMEM;
1296
1297         urbp->qh = qh;
1298         qh->urbp = urbp;
1299
1300         /* Always assume breadth first */
1301         uhci_insert_tds_in_qh(qh, urb, 1);
1302
1303         if (urb->transfer_flags & USB_QUEUE_BULK && eurb)
1304                 uhci_append_queued_urb(uhci, eurb, urb);
1305         else
1306                 uhci_insert_qh(uhci, uhci->skel_bulk_qh, qh);
1307
1308         uhci_inc_fsbr(uhci, urb);
1309
1310         return -EINPROGRESS;
1311 }
1312
1313 /* We can use the result interrupt since they're identical */
1314 #define uhci_result_bulk uhci_result_interrupt
1315
1316 /*
1317  * Isochronous transfers
1318  */
1319 static int isochronous_find_limits(struct urb *urb, unsigned int *start, unsigned int *end)
1320 {
1321         struct urb *last_urb = NULL;
1322         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
1323         struct list_head *tmp, *head;
1324         int ret = 0;
1325         unsigned long flags;
1326
1327         spin_lock_irqsave(&uhci->urb_list_lock, flags);
1328         head = &uhci->urb_list;
1329         tmp = head->next;
1330         while (tmp != head) {
1331                 struct urb *u = list_entry(tmp, struct urb, urb_list);
1332
1333                 tmp = tmp->next;
1334
1335                 /* look for pending URB's with identical pipe handle */
1336                 if ((urb->pipe == u->pipe) && (urb->dev == u->dev) &&
1337                     (u->status == -EINPROGRESS) && (u != urb)) {
1338                         if (!last_urb)
1339                                 *start = u->start_frame;
1340                         last_urb = u;
1341                 }
1342         }
1343
1344         if (last_urb) {
1345                 *end = (last_urb->start_frame + last_urb->number_of_packets) & 1023;
1346                 ret = 0;
1347         } else
1348                 ret = -1;       /* no previous urb found */
1349
1350         spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
1351
1352         return ret;
1353 }
1354
1355 static int isochronous_find_start(struct urb *urb)
1356 {
1357         int limits;
1358         unsigned int start = 0, end = 0;
1359
1360         if (urb->number_of_packets > 900)       /* 900? Why? */
1361                 return -EFBIG;
1362
1363         limits = isochronous_find_limits(urb, &start, &end);
1364
1365         if (urb->transfer_flags & USB_ISO_ASAP) {
1366                 if (limits) {
1367                         int curframe;
1368
1369                         curframe = uhci_get_current_frame_number(urb->dev) % UHCI_NUMFRAMES;
1370                         urb->start_frame = (curframe + 10) % UHCI_NUMFRAMES;
1371                 } else
1372                         urb->start_frame = end;
1373         } else {
1374                 urb->start_frame %= UHCI_NUMFRAMES;
1375                 /* FIXME: Sanity check */
1376         }
1377
1378         return 0;
1379 }
1380
1381 /*
1382  * Isochronous transfers
1383  */
1384 static int uhci_submit_isochronous(struct urb *urb)
1385 {
1386         struct uhci_td *td;
1387         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
1388         int i, ret, framenum;
1389         int status, destination;
1390         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1391
1392         status = TD_CTRL_ACTIVE | TD_CTRL_IOS;
1393         destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
1394
1395         ret = isochronous_find_start(urb);
1396         if (ret)
1397                 return ret;
1398
1399         framenum = urb->start_frame;
1400         for (i = 0; i < urb->number_of_packets; i++, framenum++) {
1401                 if (!urb->iso_frame_desc[i].length)
1402                         continue;
1403
1404                 td = uhci_alloc_td(uhci, urb->dev);
1405                 if (!td)
1406                         return -ENOMEM;
1407
1408                 uhci_add_td_to_urb(urb, td);
1409                 uhci_fill_td(td, status, destination | ((urb->iso_frame_desc[i].length - 1) << 21),
1410                         urbp->transfer_buffer_dma_handle + urb->iso_frame_desc[i].offset);
1411
1412                 if (i + 1 >= urb->number_of_packets)
1413                         td->status |= TD_CTRL_IOC;
1414
1415                 uhci_insert_td_frame_list(uhci, td, framenum);
1416         }
1417
1418         return -EINPROGRESS;
1419 }
1420
1421 static int uhci_result_isochronous(struct urb *urb)
1422 {
1423         struct list_head *tmp, *head;
1424         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1425         int status;
1426         int i, ret = 0;
1427
1428         urb->actual_length = 0;
1429
1430         i = 0;
1431         head = &urbp->td_list;
1432         tmp = head->next;
1433         while (tmp != head) {
1434                 struct uhci_td *td = list_entry(tmp, struct uhci_td, list);
1435                 int actlength;
1436
1437                 tmp = tmp->next;
1438
1439                 if (td->status & TD_CTRL_ACTIVE)
1440                         return -EINPROGRESS;
1441
1442                 actlength = uhci_actual_length(td->status);
1443                 urb->iso_frame_desc[i].actual_length = actlength;
1444                 urb->actual_length += actlength;
1445
1446                 status = uhci_map_status(uhci_status_bits(td->status), usb_pipeout(urb->pipe));
1447                 urb->iso_frame_desc[i].status = status;
1448                 if (status) {
1449                         urb->error_count++;
1450                         ret = status;
1451                 }
1452
1453                 i++;
1454         }
1455
1456         return ret;
1457 }
1458
1459 static struct urb *uhci_find_urb_ep(struct uhci *uhci, struct urb *urb)
1460 {
1461         struct list_head *tmp, *head;
1462         unsigned long flags;
1463         struct urb *u = NULL;
1464
1465         /* We don't match Isoc transfers since they are special */
1466         if (usb_pipeisoc(urb->pipe))
1467                 return NULL;
1468
1469         spin_lock_irqsave(&uhci->urb_list_lock, flags);
1470         head = &uhci->urb_list;
1471         tmp = head->next;
1472         while (tmp != head) {
1473                 u = list_entry(tmp, struct urb, urb_list);
1474
1475                 tmp = tmp->next;
1476
1477                 if (u->dev == urb->dev && u->pipe == urb->pipe &&
1478                     u->status == -EINPROGRESS)
1479                         goto out;
1480         }
1481         u = NULL;
1482
1483 out:
1484         spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
1485
1486         return u;
1487 }
1488
1489 static int uhci_submit_urb(struct urb *urb)
1490 {
1491         int ret = -EINVAL;
1492         struct uhci *uhci;
1493         unsigned long flags;
1494         struct urb *eurb;
1495         int bustime;
1496
1497         if (!urb)
1498                 return -EINVAL;
1499
1500         if (!urb->dev || !urb->dev->bus || !urb->dev->bus->hcpriv) {
1501                 warn("uhci_submit_urb: urb %p belongs to disconnected device or bus?", urb);
1502                 return -ENODEV;
1503         }
1504
1505         uhci = (struct uhci *)urb->dev->bus->hcpriv;
1506
1507         INIT_LIST_HEAD(&urb->urb_list);
1508         usb_inc_dev_use(urb->dev);
1509
1510         spin_lock_irqsave(&urb->lock, flags);
1511
1512         if (urb->status == -EINPROGRESS || urb->status == -ECONNRESET ||
1513             urb->status == -ECONNABORTED) {
1514                 dbg("uhci_submit_urb: urb not available to submit (status = %d)", urb->status);
1515                 /* Since we can have problems on the out path */
1516                 spin_unlock_irqrestore(&urb->lock, flags);
1517                 usb_dec_dev_use(urb->dev);
1518
1519                 return ret;
1520         }
1521
1522         if (!uhci_alloc_urb_priv(uhci, urb)) {
1523                 ret = -ENOMEM;
1524
1525                 goto out;
1526         }
1527
1528         eurb = uhci_find_urb_ep(uhci, urb);
1529         if (eurb && !(urb->transfer_flags & USB_QUEUE_BULK)) {
1530                 ret = -ENXIO;
1531
1532                 goto out;
1533         }
1534
1535         /* Short circuit the virtual root hub */
1536         if (urb->dev == uhci->rh.dev) {
1537                 ret = rh_submit_urb(urb);
1538
1539                 goto out;
1540         }
1541
1542         switch (usb_pipetype(urb->pipe)) {
1543         case PIPE_CONTROL:
1544                 ret = uhci_submit_control(urb);
1545                 break;
1546         case PIPE_INTERRUPT:
1547                 if (urb->bandwidth == 0) {      /* not yet checked/allocated */
1548                         bustime = usb_check_bandwidth(urb->dev, urb);
1549                         if (bustime < 0)
1550                                 ret = bustime;
1551                         else {
1552                                 ret = uhci_submit_interrupt(urb);
1553                                 if (ret == -EINPROGRESS)
1554                                         usb_claim_bandwidth(urb->dev, urb, bustime, 0);
1555                         }
1556                 } else          /* bandwidth is already set */
1557                         ret = uhci_submit_interrupt(urb);
1558                 break;
1559         case PIPE_BULK:
1560                 ret = uhci_submit_bulk(urb, eurb);
1561                 break;
1562         case PIPE_ISOCHRONOUS:
1563                 if (urb->bandwidth == 0) {      /* not yet checked/allocated */
1564                         if (urb->number_of_packets <= 0) {
1565                                 ret = -EINVAL;
1566                                 break;
1567                         }
1568                         bustime = usb_check_bandwidth(urb->dev, urb);
1569                         if (bustime < 0) {
1570                                 ret = bustime;
1571                                 break;
1572                         }
1573
1574                         ret = uhci_submit_isochronous(urb);
1575                         if (ret == -EINPROGRESS)
1576                                 usb_claim_bandwidth(urb->dev, urb, bustime, 1);
1577                 } else          /* bandwidth is already set */
1578                         ret = uhci_submit_isochronous(urb);
1579                 break;
1580         }
1581
1582 out:
1583         urb->status = ret;
1584
1585         spin_unlock_irqrestore(&urb->lock, flags);
1586
1587         if (ret == -EINPROGRESS) {
1588                 spin_lock_irqsave(&uhci->urb_list_lock, flags);
1589                 /* We use _tail to make find_urb_ep more efficient */
1590                 list_add_tail(&urb->urb_list, &uhci->urb_list);
1591                 spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
1592
1593                 return 0;
1594         }
1595
1596         uhci_unlink_generic(uhci, urb);
1597         uhci_destroy_urb_priv(urb);
1598
1599         usb_dec_dev_use(urb->dev);
1600
1601         return ret;
1602 }
1603
1604 /*
1605  * Return the result of a transfer
1606  *
1607  * Must be called with urb_list_lock acquired
1608  */
1609 static void uhci_transfer_result(struct uhci *uhci, struct urb *urb)
1610 {
1611         int ret = -EINVAL;
1612         unsigned long flags;
1613         struct urb_priv *urbp;
1614
1615         /* The root hub is special */
1616         if (urb->dev == uhci->rh.dev)
1617                 return;
1618
1619         spin_lock_irqsave(&urb->lock, flags);
1620
1621         urbp = (struct urb_priv *)urb->hcpriv;
1622
1623         if (urb->status != -EINPROGRESS) {
1624                 info("uhci_transfer_result: called for URB %p not in flight?", urb);
1625                 spin_unlock_irqrestore(&urb->lock, flags);
1626                 return;
1627         }
1628
1629         switch (usb_pipetype(urb->pipe)) {
1630         case PIPE_CONTROL:
1631                 ret = uhci_result_control(urb);
1632                 break;
1633         case PIPE_INTERRUPT:
1634                 ret = uhci_result_interrupt(urb);
1635                 break;
1636         case PIPE_BULK:
1637                 ret = uhci_result_bulk(urb);
1638                 break;
1639         case PIPE_ISOCHRONOUS:
1640                 ret = uhci_result_isochronous(urb);
1641                 break;
1642         }
1643
1644         urbp->status = ret;
1645
1646         spin_unlock_irqrestore(&urb->lock, flags);
1647
1648         if (ret == -EINPROGRESS)
1649                 return;
1650
1651         switch (usb_pipetype(urb->pipe)) {
1652         case PIPE_CONTROL:
1653         case PIPE_BULK:
1654         case PIPE_ISOCHRONOUS:
1655                 /* Release bandwidth for Interrupt or Isoc. transfers */
1656                 /* Spinlock needed ? */
1657                 if (urb->bandwidth)
1658                         usb_release_bandwidth(urb->dev, urb, 1);
1659                 uhci_unlink_generic(uhci, urb);
1660                 break;
1661         case PIPE_INTERRUPT:
1662                 /* Interrupts are an exception */
1663                 if (urb->interval) {
1664                         uhci_add_complete(urb);
1665                         return;         /* <-- note return */
1666                 }
1667
1668                 /* Release bandwidth for Interrupt or Isoc. transfers */
1669                 /* Spinlock needed ? */
1670                 if (urb->bandwidth)
1671                         usb_release_bandwidth(urb->dev, urb, 0);
1672                 uhci_unlink_generic(uhci, urb);
1673                 break;
1674         default:
1675                 info("uhci_transfer_result: unknown pipe type %d for urb %p\n",
1676                         usb_pipetype(urb->pipe), urb);
1677         }
1678
1679         list_del_init(&urb->urb_list);
1680
1681         uhci_add_complete(urb);
1682 }
1683
1684 static void uhci_unlink_generic(struct uhci *uhci, struct urb *urb)
1685 {
1686         struct urb_priv *urbp = urb->hcpriv;
1687
1688         /* We can get called when urbp allocation fails, so check */
1689         if (!urbp)
1690                 return;
1691
1692         uhci_dec_fsbr(uhci, urb);       /* Safe since it checks */
1693
1694         uhci_delete_queued_urb(uhci, urb);
1695
1696         if (urbp->qh)
1697                 /* The interrupt loop will reclaim the QH's */
1698                 uhci_remove_qh(uhci, urbp->qh);
1699 }
1700
1701 /* FIXME: If we forcefully unlink an urb, we should reset the toggle for */
1702 /*  that pipe to match what actually completed */
1703 static int uhci_unlink_urb(struct urb *urb)
1704 {
1705         struct uhci *uhci;
1706         unsigned long flags;
1707         struct urb_priv *urbp = urb->hcpriv;
1708
1709         if (!urb)
1710                 return -EINVAL;
1711
1712         if (!urb->dev || !urb->dev->bus || !urb->dev->bus->hcpriv)
1713                 return -ENODEV;
1714
1715         uhci = (struct uhci *)urb->dev->bus->hcpriv;
1716
1717         /* Release bandwidth for Interrupt or Isoc. transfers */
1718         /* Spinlock needed ? */
1719         if (urb->bandwidth) {
1720                 switch (usb_pipetype(urb->pipe)) {
1721                 case PIPE_INTERRUPT:
1722                         usb_release_bandwidth(urb->dev, urb, 0);
1723                         break;
1724                 case PIPE_ISOCHRONOUS:
1725                         usb_release_bandwidth(urb->dev, urb, 1);
1726                         break;
1727                 default:
1728                         break;
1729                 }
1730         }
1731
1732         if (urb->status != -EINPROGRESS)
1733                 return 0;
1734
1735         spin_lock_irqsave(&uhci->urb_list_lock, flags);
1736         list_del_init(&urb->urb_list);
1737         spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
1738
1739         uhci_unlink_generic(uhci, urb);
1740
1741         /* Short circuit the virtual root hub */
1742         if (urb->dev == uhci->rh.dev) {
1743                 rh_unlink_urb(urb);
1744                 uhci_call_completion(urb);
1745         } else {
1746                 if (urb->transfer_flags & USB_ASYNC_UNLINK) {
1747                         /* urb_list is available now since we called */
1748                         /*  uhci_unlink_generic already */
1749
1750                         urbp->status = urb->status = -ECONNABORTED;
1751
1752                         spin_lock_irqsave(&uhci->urb_remove_list_lock, flags);
1753
1754                         /* Check to see if the remove list is empty */
1755                         if (list_empty(&uhci->urb_remove_list))
1756                                 uhci_set_next_interrupt(uhci);
1757                         
1758                         list_add(&urb->urb_list, &uhci->urb_remove_list);
1759
1760                         spin_unlock_irqrestore(&uhci->urb_remove_list_lock, flags);
1761                 } else {
1762                         urb->status = -ENOENT;
1763
1764                         if (in_interrupt()) {   /* wait at least 1 frame */
1765                                 static int errorcount = 10;
1766
1767                                 if (errorcount--)
1768                                         dbg("uhci_unlink_urb called from interrupt for urb %p", urb);
1769                                 udelay(1000);
1770                         } else
1771                                 schedule_timeout(1+1*HZ/1000); 
1772
1773                         uhci_call_completion(urb);
1774                 }
1775         }
1776
1777         return 0;
1778 }
1779
1780 static int uhci_fsbr_timeout(struct uhci *uhci, struct urb *urb)
1781 {
1782         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1783         struct list_head *head, *tmp;
1784
1785         uhci_dec_fsbr(uhci, urb);
1786
1787         /* There is a race with updating IOC in here, but it's not worth */
1788         /*  trying to fix since this is merely an optimization. The only */
1789         /*  time we'd lose is if the status of the packet got updated */
1790         /*  and we'd be turning on FSBR next frame anyway, so it's a wash */
1791         urbp->fsbr_timeout = 1;
1792
1793         head = &urbp->td_list;
1794         tmp = head->next;
1795         while (tmp != head) {
1796                 struct uhci_td *td = list_entry(tmp, struct uhci_td, list);
1797
1798                 tmp = tmp->next;
1799
1800                 if (td->status & TD_CTRL_ACTIVE) {
1801                         td->status |= TD_CTRL_IOC;
1802                         break;
1803                 }
1804         }
1805
1806         return 0;
1807 }
1808
1809 /*
1810  * uhci_get_current_frame_number()
1811  *
1812  * returns the current frame number for a USB bus/controller.
1813  */
1814 static int uhci_get_current_frame_number(struct usb_device *dev)
1815 {
1816         struct uhci *uhci = (struct uhci *)dev->bus->hcpriv;
1817
1818         return inw(uhci->io_addr + USBFRNUM);
1819 }
1820
1821 struct usb_operations uhci_device_operations = {
1822         uhci_alloc_dev,
1823         uhci_free_dev,
1824         uhci_get_current_frame_number,
1825         uhci_submit_urb,
1826         uhci_unlink_urb
1827 };
1828
1829 /* Virtual Root Hub */
1830
1831 static __u8 root_hub_dev_des[] =
1832 {
1833         0x12,                   /*  __u8  bLength; */
1834         0x01,                   /*  __u8  bDescriptorType; Device */
1835         0x00,                   /*  __u16 bcdUSB; v1.0 */
1836         0x01,
1837         0x09,                   /*  __u8  bDeviceClass; HUB_CLASSCODE */
1838         0x00,                   /*  __u8  bDeviceSubClass; */
1839         0x00,                   /*  __u8  bDeviceProtocol; */
1840         0x08,                   /*  __u8  bMaxPacketSize0; 8 Bytes */
1841         0x00,                   /*  __u16 idVendor; */
1842         0x00,
1843         0x00,                   /*  __u16 idProduct; */
1844         0x00,
1845         0x00,                   /*  __u16 bcdDevice; */
1846         0x00,
1847         0x00,                   /*  __u8  iManufacturer; */
1848         0x02,                   /*  __u8  iProduct; */
1849         0x01,                   /*  __u8  iSerialNumber; */
1850         0x01                    /*  __u8  bNumConfigurations; */
1851 };
1852
1853
1854 /* Configuration descriptor */
1855 static __u8 root_hub_config_des[] =
1856 {
1857         0x09,                   /*  __u8  bLength; */
1858         0x02,                   /*  __u8  bDescriptorType; Configuration */
1859         0x19,                   /*  __u16 wTotalLength; */
1860         0x00,
1861         0x01,                   /*  __u8  bNumInterfaces; */
1862         0x01,                   /*  __u8  bConfigurationValue; */
1863         0x00,                   /*  __u8  iConfiguration; */
1864         0x40,                   /*  __u8  bmAttributes;
1865                                         Bit 7: Bus-powered, 6: Self-powered,
1866                                         Bit 5 Remote-wakeup, 4..0: resvd */
1867         0x00,                   /*  __u8  MaxPower; */
1868
1869         /* interface */
1870         0x09,                   /*  __u8  if_bLength; */
1871         0x04,                   /*  __u8  if_bDescriptorType; Interface */
1872         0x00,                   /*  __u8  if_bInterfaceNumber; */
1873         0x00,                   /*  __u8  if_bAlternateSetting; */
1874         0x01,                   /*  __u8  if_bNumEndpoints; */
1875         0x09,                   /*  __u8  if_bInterfaceClass; HUB_CLASSCODE */
1876         0x00,                   /*  __u8  if_bInterfaceSubClass; */
1877         0x00,                   /*  __u8  if_bInterfaceProtocol; */
1878         0x00,                   /*  __u8  if_iInterface; */
1879
1880         /* endpoint */
1881         0x07,                   /*  __u8  ep_bLength; */
1882         0x05,                   /*  __u8  ep_bDescriptorType; Endpoint */
1883         0x81,                   /*  __u8  ep_bEndpointAddress; IN Endpoint 1 */
1884         0x03,                   /*  __u8  ep_bmAttributes; Interrupt */
1885         0x08,                   /*  __u16 ep_wMaxPacketSize; 8 Bytes */
1886         0x00,
1887         0xff                    /*  __u8  ep_bInterval; 255 ms */
1888 };
1889
1890 static __u8 root_hub_hub_des[] =
1891 {
1892         0x09,                   /*  __u8  bLength; */
1893         0x29,                   /*  __u8  bDescriptorType; Hub-descriptor */
1894         0x02,                   /*  __u8  bNbrPorts; */
1895         0x00,                   /* __u16  wHubCharacteristics; */
1896         0x00,
1897         0x01,                   /*  __u8  bPwrOn2pwrGood; 2ms */
1898         0x00,                   /*  __u8  bHubContrCurrent; 0 mA */
1899         0x00,                   /*  __u8  DeviceRemovable; *** 7 Ports max *** */
1900         0xff                    /*  __u8  PortPwrCtrlMask; *** 7 ports max *** */
1901 };
1902
1903 /* prepare Interrupt pipe transaction data; HUB INTERRUPT ENDPOINT */
1904 static int rh_send_irq(struct urb *urb)
1905 {
1906         int i, len = 1;
1907         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
1908         unsigned int io_addr = uhci->io_addr;
1909         __u16 data = 0;
1910         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1911
1912         for (i = 0; i < uhci->rh.numports; i++) {
1913                 data |= ((inw(io_addr + USBPORTSC1 + i * 2) & 0xa) > 0 ? (1 << (i + 1)) : 0);
1914                 len = (i + 1) / 8 + 1;
1915         }
1916
1917         *(__u16 *) urb->transfer_buffer = cpu_to_le16(data);
1918         urb->actual_length = len;
1919         urbp->status = 0;
1920
1921         if ((data > 0) && (uhci->rh.send != 0)) {
1922                 dbg("root-hub INT complete: port1: %x port2: %x data: %x",
1923                         inw(io_addr + USBPORTSC1), inw(io_addr + USBPORTSC2), data);
1924                 uhci_call_completion(urb);
1925         }
1926
1927         return 0;
1928 }
1929
1930 /* Virtual Root Hub INTs are polled by this timer every "interval" ms */
1931 static int rh_init_int_timer(struct urb *urb);
1932
1933 static void rh_int_timer_do(unsigned long ptr)
1934 {
1935         struct urb *urb = (struct urb *)ptr;
1936         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
1937         struct list_head list, *tmp, *head;
1938         unsigned long flags;
1939
1940         if (uhci->rh.send)
1941                 rh_send_irq(urb);
1942
1943         INIT_LIST_HEAD(&list);
1944
1945         spin_lock_irqsave(&uhci->urb_list_lock, flags);
1946         head = &uhci->urb_list;
1947
1948         tmp = head->next;
1949         while (tmp != head) {
1950                 struct urb *u = list_entry(tmp, struct urb, urb_list);
1951                 struct urb_priv *urbp = (struct urb_priv *)u->hcpriv;
1952
1953                 tmp = tmp->next;
1954
1955                 /* Check if the FSBR timed out */
1956                 if (urbp->fsbr && time_after_eq(jiffies, urbp->inserttime + IDLE_TIMEOUT))
1957                         uhci_fsbr_timeout(uhci, u);
1958
1959                 /* Check if the URB timed out */
1960                 if (u->timeout && time_after_eq(jiffies, u->timeout)) {
1961                         list_del(&u->urb_list);
1962                         list_add_tail(&u->urb_list, &list);
1963                 }
1964         }
1965         spin_unlock_irqrestore(&uhci->urb_list_lock, flags);
1966
1967         head = &list;
1968         tmp = head->next;
1969         while (tmp != head) {
1970                 struct urb *u = list_entry(tmp, struct urb, urb_list);
1971
1972                 tmp = tmp->next;
1973
1974                 u->transfer_flags |= USB_ASYNC_UNLINK | USB_TIMEOUT_KILLED;
1975                 uhci_unlink_urb(u);
1976         }
1977
1978         /* enter global suspend if nothing connected */
1979         if (!uhci->is_suspended && !ports_active(uhci))
1980                 suspend_hc(uhci);
1981
1982         rh_init_int_timer(urb);
1983 }
1984
1985 /* Root Hub INTs are polled by this timer */
1986 static int rh_init_int_timer(struct urb *urb)
1987 {
1988         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
1989
1990         uhci->rh.interval = urb->interval;
1991         init_timer(&uhci->rh.rh_int_timer);
1992         uhci->rh.rh_int_timer.function = rh_int_timer_do;
1993         uhci->rh.rh_int_timer.data = (unsigned long)urb;
1994         uhci->rh.rh_int_timer.expires = jiffies + (HZ * (urb->interval < 30 ? 30 : urb->interval)) / 1000;
1995         add_timer(&uhci->rh.rh_int_timer);
1996
1997         return 0;
1998 }
1999
2000 #define OK(x)                   len = (x); break
2001
2002 #define CLR_RH_PORTSTAT(x) \
2003         status = inw(io_addr + USBPORTSC1 + 2 * (wIndex-1)); \
2004         status = (status & 0xfff5) & ~(x); \
2005         outw(status, io_addr + USBPORTSC1 + 2 * (wIndex-1))
2006
2007 #define SET_RH_PORTSTAT(x) \
2008         status = inw(io_addr + USBPORTSC1 + 2 * (wIndex-1)); \
2009         status = (status & 0xfff5) | (x); \
2010         outw(status, io_addr + USBPORTSC1 + 2 * (wIndex-1))
2011
2012
2013 /* Root Hub Control Pipe */
2014 static int rh_submit_urb(struct urb *urb)
2015 {
2016         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
2017         unsigned int pipe = urb->pipe;
2018         devrequest *cmd = (devrequest *)urb->setup_packet;
2019         void *data = urb->transfer_buffer;
2020         int leni = urb->transfer_buffer_length;
2021         int len = 0;
2022         int status = 0;
2023         int stat = 0;
2024         int i;
2025         unsigned int io_addr = uhci->io_addr;
2026         __u16 cstatus;
2027         __u16 bmRType_bReq;
2028         __u16 wValue;
2029         __u16 wIndex;
2030         __u16 wLength;
2031
2032         if (usb_pipetype(pipe) == PIPE_INTERRUPT) {
2033                 uhci->rh.urb = urb;
2034                 uhci->rh.send = 1;
2035                 uhci->rh.interval = urb->interval;
2036                 rh_init_int_timer(urb);
2037
2038                 return -EINPROGRESS;
2039         }
2040
2041         bmRType_bReq = cmd->requesttype | cmd->request << 8;
2042         wValue = le16_to_cpu(cmd->value);
2043         wIndex = le16_to_cpu(cmd->index);
2044         wLength = le16_to_cpu(cmd->length);
2045
2046         for (i = 0; i < 8; i++)
2047                 uhci->rh.c_p_r[i] = 0;
2048
2049         switch (bmRType_bReq) {
2050                 /* Request Destination:
2051                    without flags: Device,
2052                    RH_INTERFACE: interface,
2053                    RH_ENDPOINT: endpoint,
2054                    RH_CLASS means HUB here,
2055                    RH_OTHER | RH_CLASS  almost ever means HUB_PORT here
2056                 */
2057
2058         case RH_GET_STATUS:
2059                 *(__u16 *)data = cpu_to_le16(1);
2060                 OK(2);
2061         case RH_GET_STATUS | RH_INTERFACE:
2062                 *(__u16 *)data = cpu_to_le16(0);
2063                 OK(2);
2064         case RH_GET_STATUS | RH_ENDPOINT:
2065                 *(__u16 *)data = cpu_to_le16(0);
2066                 OK(2);
2067         case RH_GET_STATUS | RH_CLASS:
2068                 *(__u32 *)data = cpu_to_le32(0);
2069                 OK(4);          /* hub power */
2070         case RH_GET_STATUS | RH_OTHER | RH_CLASS:
2071                 status = inw(io_addr + USBPORTSC1 + 2 * (wIndex - 1));
2072                 cstatus = ((status & USBPORTSC_CSC) >> (1 - 0)) |
2073                         ((status & USBPORTSC_PEC) >> (3 - 1)) |
2074                         (uhci->rh.c_p_r[wIndex - 1] << (0 + 4));
2075                         status = (status & USBPORTSC_CCS) |
2076                         ((status & USBPORTSC_PE) >> (2 - 1)) |
2077                         ((status & USBPORTSC_SUSP) >> (12 - 2)) |
2078                         ((status & USBPORTSC_PR) >> (9 - 4)) |
2079                         (1 << 8) |      /* power on */
2080                         ((status & USBPORTSC_LSDA) << (-8 + 9));
2081
2082                 *(__u16 *)data = cpu_to_le16(status);
2083                 *(__u16 *)(data + 2) = cpu_to_le16(cstatus);
2084                 OK(4);
2085         case RH_CLEAR_FEATURE | RH_ENDPOINT:
2086                 switch (wValue) {
2087                 case RH_ENDPOINT_STALL:
2088                         OK(0);
2089                 }
2090                 break;
2091         case RH_CLEAR_FEATURE | RH_CLASS:
2092                 switch (wValue) {
2093                 case RH_C_HUB_OVER_CURRENT:
2094                         OK(0);  /* hub power over current */
2095                 }
2096                 break;
2097         case RH_CLEAR_FEATURE | RH_OTHER | RH_CLASS:
2098                 switch (wValue) {
2099                 case RH_PORT_ENABLE:
2100                         CLR_RH_PORTSTAT(USBPORTSC_PE);
2101                         OK(0);
2102                 case RH_PORT_SUSPEND:
2103                         CLR_RH_PORTSTAT(USBPORTSC_SUSP);
2104                         OK(0);
2105                 case RH_PORT_POWER:
2106                         OK(0);  /* port power */
2107                 case RH_C_PORT_CONNECTION:
2108                         SET_RH_PORTSTAT(USBPORTSC_CSC);
2109                         OK(0);
2110                 case RH_C_PORT_ENABLE:
2111                         SET_RH_PORTSTAT(USBPORTSC_PEC);
2112                         OK(0);
2113                 case RH_C_PORT_SUSPEND:
2114                         /*** WR_RH_PORTSTAT(RH_PS_PSSC); */
2115                         OK(0);
2116                 case RH_C_PORT_OVER_CURRENT:
2117                         OK(0);  /* port power over current */
2118                 case RH_C_PORT_RESET:
2119                         uhci->rh.c_p_r[wIndex - 1] = 0;
2120                         OK(0);
2121                 }
2122                 break;
2123         case RH_SET_FEATURE | RH_OTHER | RH_CLASS:
2124                 switch (wValue) {
2125                 case RH_PORT_SUSPEND:
2126                         SET_RH_PORTSTAT(USBPORTSC_SUSP);
2127                         OK(0);
2128                 case RH_PORT_RESET:
2129                         SET_RH_PORTSTAT(USBPORTSC_PR);
2130                         wait_ms(50);    /* USB v1.1 7.1.7.3 */
2131                         uhci->rh.c_p_r[wIndex - 1] = 1;
2132                         CLR_RH_PORTSTAT(USBPORTSC_PR);
2133                         udelay(10);
2134                         SET_RH_PORTSTAT(USBPORTSC_PE);
2135                         wait_ms(10);
2136                         SET_RH_PORTSTAT(0xa);
2137                         OK(0);
2138                 case RH_PORT_POWER:
2139                         OK(0); /* port power ** */
2140                 case RH_PORT_ENABLE:
2141                         SET_RH_PORTSTAT(USBPORTSC_PE);
2142                         OK(0);
2143                 }
2144                 break;
2145         case RH_SET_ADDRESS:
2146                 uhci->rh.devnum = wValue;
2147                 OK(0);
2148         case RH_GET_DESCRIPTOR:
2149                 switch ((wValue & 0xff00) >> 8) {
2150                 case 0x01:      /* device descriptor */
2151                         len = min_t(unsigned int, leni,
2152                                   min_t(unsigned int,
2153                                       sizeof(root_hub_dev_des), wLength));
2154                         memcpy(data, root_hub_dev_des, len);
2155                         OK(len);
2156                 case 0x02:      /* configuration descriptor */
2157                         len = min_t(unsigned int, leni,
2158                                   min_t(unsigned int,
2159                                       sizeof(root_hub_config_des), wLength));
2160                         memcpy (data, root_hub_config_des, len);
2161                         OK(len);
2162                 case 0x03:      /* string descriptors */
2163                         len = usb_root_hub_string (wValue & 0xff,
2164                                 uhci->io_addr, "UHCI-alt",
2165                                 data, wLength);
2166                         if (len > 0) {
2167                                 OK(min_t(int, leni, len));
2168                         } else 
2169                                 stat = -EPIPE;
2170                 }
2171                 break;
2172         case RH_GET_DESCRIPTOR | RH_CLASS:
2173                 root_hub_hub_des[2] = uhci->rh.numports;
2174                 len = min_t(unsigned int, leni,
2175                           min_t(unsigned int, sizeof(root_hub_hub_des), wLength));
2176                 memcpy(data, root_hub_hub_des, len);
2177                 OK(len);
2178         case RH_GET_CONFIGURATION:
2179                 *(__u8 *)data = 0x01;
2180                 OK(1);
2181         case RH_SET_CONFIGURATION:
2182                 OK(0);
2183         case RH_GET_INTERFACE | RH_INTERFACE:
2184                 *(__u8 *)data = 0x00;
2185                 OK(1);
2186         case RH_SET_INTERFACE | RH_INTERFACE:
2187                 OK(0);
2188         default:
2189                 stat = -EPIPE;
2190         }
2191
2192         urb->actual_length = len;
2193
2194         return stat;
2195 }
2196
2197 static int rh_unlink_urb(struct urb *urb)
2198 {
2199         struct uhci *uhci = (struct uhci *)urb->dev->bus->hcpriv;
2200
2201         if (uhci->rh.urb == urb) {
2202                 urb->status = -ENOENT;
2203                 uhci->rh.send = 0;
2204                 uhci->rh.urb = NULL;
2205                 del_timer(&uhci->rh.rh_int_timer);
2206         }
2207         return 0;
2208 }
2209
2210 static void uhci_free_pending_qhs(struct uhci *uhci)
2211 {
2212         struct list_head *tmp, *head;
2213         unsigned long flags;
2214
2215         spin_lock_irqsave(&uhci->qh_remove_list_lock, flags);
2216         head = &uhci->qh_remove_list;
2217         tmp = head->next;
2218         while (tmp != head) {
2219                 struct uhci_qh *qh = list_entry(tmp, struct uhci_qh, remove_list);
2220
2221                 tmp = tmp->next;
2222
2223                 list_del_init(&qh->remove_list);
2224
2225                 uhci_free_qh(uhci, qh);
2226         }
2227         spin_unlock_irqrestore(&uhci->qh_remove_list_lock, flags);
2228 }
2229
2230 static void uhci_call_completion(struct urb *urb)
2231 {
2232         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
2233         struct usb_device *dev = urb->dev;
2234         struct uhci *uhci = (struct uhci *)dev->bus->hcpriv;
2235         int is_ring = 0, killed, resubmit_interrupt, status;
2236         struct urb *nurb;
2237
2238         killed = (urb->status == -ENOENT || urb->status == -ECONNABORTED ||
2239                         urb->status == -ECONNRESET);
2240         resubmit_interrupt = (usb_pipetype(urb->pipe) == PIPE_INTERRUPT &&
2241                         urb->interval && !killed);
2242
2243         nurb = urb->next;
2244         if (nurb && !killed) {
2245                 int count = 0;
2246
2247                 while (nurb && nurb != urb && count < MAX_URB_LOOP) {
2248                         if (nurb->status == -ENOENT ||
2249                             nurb->status == -ECONNABORTED ||
2250                             nurb->status == -ECONNRESET) {
2251                                 killed = 1;
2252                                 break;
2253                         }
2254
2255                         nurb = nurb->next;
2256                         count++;
2257                 }
2258
2259                 if (count == MAX_URB_LOOP)
2260                         err("uhci_call_completion: too many linked URB's, loop? (first loop)");
2261
2262                 /* Check to see if chain is a ring */
2263                 is_ring = (nurb == urb);
2264         }
2265
2266         status = urbp->status;
2267         if (!resubmit_interrupt)
2268                 /* We don't need urb_priv anymore */
2269                 uhci_destroy_urb_priv(urb);
2270
2271         if (!killed)
2272                 urb->status = status;
2273
2274         if (urbp->transfer_buffer_dma_handle)
2275                 pci_dma_sync_single(uhci->dev, urbp->transfer_buffer_dma_handle,
2276                         urb->transfer_buffer_length, usb_pipein(urb->pipe) ?
2277                         PCI_DMA_FROMDEVICE : PCI_DMA_TODEVICE);
2278
2279         if (urbp->setup_packet_dma_handle)
2280                 pci_dma_sync_single(uhci->dev, urbp->setup_packet_dma_handle,
2281                         sizeof(devrequest), PCI_DMA_TODEVICE);
2282
2283         urb->dev = NULL;
2284         if (urb->complete)
2285                 urb->complete(urb);
2286
2287         if (resubmit_interrupt) {
2288                 urb->dev = dev;
2289                 uhci_reset_interrupt(urb);
2290         } else {
2291                 if (is_ring && !killed) {
2292                         urb->dev = dev;
2293                         uhci_submit_urb(urb);
2294                 } else {
2295                         /* We decrement the usage count after we're done */
2296                         /*  with everything */
2297                         usb_dec_dev_use(dev);
2298                 }
2299         }
2300 }
2301
2302 static void uhci_finish_completion(struct uhci *uhci)
2303 {
2304         struct list_head *tmp, *head;
2305         unsigned long flags;
2306
2307         spin_lock_irqsave(&uhci->complete_list_lock, flags);
2308         head = &uhci->complete_list;
2309         tmp = head->next;
2310         while (tmp != head) {
2311                 struct urb_priv *urbp = list_entry(tmp, struct urb_priv, complete_list);
2312                 struct urb *urb = urbp->urb;
2313
2314                 tmp = tmp->next;
2315
2316                 list_del_init(&urbp->complete_list);
2317
2318                 uhci_call_completion(urb);
2319         }
2320         spin_unlock_irqrestore(&uhci->complete_list_lock, flags);
2321 }
2322
2323 static void uhci_remove_pending_qhs(struct uhci *uhci)
2324 {
2325         struct list_head *tmp, *head;
2326         unsigned long flags;
2327
2328         spin_lock_irqsave(&uhci->urb_remove_list_lock, flags);
2329         head = &uhci->urb_remove_list;
2330         tmp = head->next;
2331         while (tmp != head) {
2332                 struct urb *urb = list_entry(tmp, struct urb, urb_list);
2333                 struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
2334
2335                 tmp = tmp->next;
2336
2337                 list_del_init(&urb->urb_list);
2338
2339                 urbp->status = urb->status = -ECONNRESET;
2340                 uhci_call_completion(urb);
2341         }
2342         spin_unlock_irqrestore(&uhci->urb_remove_list_lock, flags);
2343 }
2344
2345 static void uhci_interrupt(int irq, void *__uhci, struct pt_regs *regs)
2346 {
2347         struct uhci *uhci = __uhci;
2348         unsigned int io_addr = uhci->io_addr;
2349         unsigned short status;
2350         struct list_head *tmp, *head;
2351
2352         /*
2353          * Read the interrupt status, and write it back to clear the
2354          * interrupt cause
2355          */
2356         status = inw(io_addr + USBSTS);
2357         if (!status)    /* shared interrupt, not mine */
2358                 return;
2359         outw(status, io_addr + USBSTS);         /* Clear it */
2360
2361         if (status & ~(USBSTS_USBINT | USBSTS_ERROR | USBSTS_RD)) {
2362                 if (status & USBSTS_HSE)
2363                         err("%x: host system error, PCI problems?", io_addr);
2364                 if (status & USBSTS_HCPE)
2365                         err("%x: host controller process error. something bad happened", io_addr);
2366                 if ((status & USBSTS_HCH) && !uhci->is_suspended) {
2367                         err("%x: host controller halted. very bad", io_addr);
2368                         /* FIXME: Reset the controller, fix the offending TD */
2369                 }
2370         }
2371
2372         if (status & USBSTS_RD)
2373                 wakeup_hc(uhci);
2374
2375         uhci_free_pending_qhs(uhci);
2376
2377         uhci_remove_pending_qhs(uhci);
2378
2379         uhci_clear_next_interrupt(uhci);
2380
2381         /* Walk the list of pending URB's to see which ones completed */
2382         spin_lock(&uhci->urb_list_lock);
2383         head = &uhci->urb_list;
2384         tmp = head->next;
2385         while (tmp != head) {
2386                 struct urb *urb = list_entry(tmp, struct urb, urb_list);
2387
2388                 tmp = tmp->next;
2389
2390                 /* Checks the status and does all of the magic necessary */
2391                 uhci_transfer_result(uhci, urb);
2392         }
2393         spin_unlock(&uhci->urb_list_lock);
2394
2395         uhci_finish_completion(uhci);
2396 }
2397
2398 static void reset_hc(struct uhci *uhci)
2399 {
2400         unsigned int io_addr = uhci->io_addr;
2401
2402         /* Global reset for 50ms */
2403         outw(USBCMD_GRESET, io_addr + USBCMD);
2404         wait_ms(50);
2405         outw(0, io_addr + USBCMD);
2406         wait_ms(10);
2407 }
2408
2409 static void suspend_hc(struct uhci *uhci)
2410 {
2411         unsigned int io_addr = uhci->io_addr;
2412
2413         dbg("suspend_hc");
2414
2415         outw(USBCMD_EGSM, io_addr + USBCMD);
2416
2417         uhci->is_suspended = 1;
2418 }
2419
2420 static void wakeup_hc(struct uhci *uhci)
2421 {
2422         unsigned int io_addr = uhci->io_addr;
2423         unsigned int status;
2424
2425         dbg("wakeup_hc");
2426
2427         outw(0, io_addr + USBCMD);
2428         
2429         /* wait for EOP to be sent */
2430         status = inw(io_addr + USBCMD);
2431         while (status & USBCMD_FGR)
2432                 status = inw(io_addr + USBCMD);
2433
2434         uhci->is_suspended = 0;
2435
2436         /* Run and mark it configured with a 64-byte max packet */
2437         outw(USBCMD_RS | USBCMD_CF | USBCMD_MAXP, io_addr + USBCMD);
2438 }
2439
2440 static int ports_active(struct uhci *uhci)
2441 {
2442         unsigned int io_addr = uhci->io_addr;
2443         int connection = 0;
2444         int i;
2445
2446         for (i = 0; i < uhci->rh.numports; i++)
2447                 connection |= (inw(io_addr + USBPORTSC1 + i * 2) & 0x1);
2448
2449         return connection;
2450 }
2451
2452 static void start_hc(struct uhci *uhci)
2453 {
2454         unsigned int io_addr = uhci->io_addr;
2455         int timeout = 1000;
2456
2457         /*
2458          * Reset the HC - this will force us to get a
2459          * new notification of any already connected
2460          * ports due to the virtual disconnect that it
2461          * implies.
2462          */
2463         outw(USBCMD_HCRESET, io_addr + USBCMD);
2464         while (inw(io_addr + USBCMD) & USBCMD_HCRESET) {
2465                 if (!--timeout) {
2466                         printk(KERN_ERR "uhci: USBCMD_HCRESET timed out!\n");
2467                         break;
2468                 }
2469         }
2470
2471         /* Turn on all interrupts */
2472         outw(USBINTR_TIMEOUT | USBINTR_RESUME | USBINTR_IOC | USBINTR_SP,
2473                 io_addr + USBINTR);
2474
2475         /* Start at frame 0 */
2476         outw(0, io_addr + USBFRNUM);
2477         outl(uhci->fl->dma_handle, io_addr + USBFLBASEADD);
2478
2479         /* Run and mark it configured with a 64-byte max packet */
2480         outw(USBCMD_RS | USBCMD_CF | USBCMD_MAXP, io_addr + USBCMD);
2481 }
2482
2483 #ifdef CONFIG_PROC_FS
2484 static int uhci_num = 0;
2485 #endif
2486
2487 static void free_uhci(struct uhci *uhci)
2488 {
2489         kfree(uhci);
2490 }
2491
2492 /*
2493  * De-allocate all resources..
2494  */
2495 static void release_uhci(struct uhci *uhci)
2496 {
2497         int i;
2498 #ifdef CONFIG_PROC_FS
2499         char buf[8];
2500 #endif
2501
2502         if (uhci->irq >= 0) {
2503                 free_irq(uhci->irq, uhci);
2504                 uhci->irq = -1;
2505         }
2506
2507         for (i = 0; i < UHCI_NUM_SKELQH; i++)
2508                 if (uhci->skelqh[i]) {
2509                         uhci_free_qh(uhci, uhci->skelqh[i]);
2510                         uhci->skelqh[i] = NULL;
2511                 }
2512
2513         for (i = 0; i < UHCI_NUM_SKELTD; i++)
2514                 if (uhci->skeltd[i]) {
2515                         uhci_free_td(uhci, uhci->skeltd[i]);
2516                         uhci->skeltd[i] = NULL;
2517                 }
2518
2519         if (uhci->qh_pool) {
2520                 pci_pool_destroy(uhci->qh_pool);
2521                 uhci->qh_pool = NULL;
2522         }
2523
2524         if (uhci->td_pool) {
2525                 pci_pool_destroy(uhci->td_pool);
2526                 uhci->td_pool = NULL;
2527         }
2528
2529         if (uhci->fl) {
2530                 pci_free_consistent(uhci->dev, sizeof(*uhci->fl), uhci->fl, uhci->fl->dma_handle);
2531                 uhci->fl = NULL;
2532         }
2533
2534         if (uhci->bus) {
2535                 usb_free_bus(uhci->bus);
2536                 uhci->bus = NULL;
2537         }
2538
2539 #ifdef CONFIG_PROC_FS
2540         if (uhci->proc_entry) {
2541                 sprintf(buf, "hc%d", uhci->num);
2542
2543                 remove_proc_entry(buf, uhci_proc_root);
2544                 uhci->proc_entry = NULL;
2545         }
2546 #endif
2547
2548         free_uhci(uhci);
2549 }
2550
2551 /*
2552  * Allocate a frame list, and then setup the skeleton
2553  *
2554  * The hardware doesn't really know any difference
2555  * in the queues, but the order does matter for the
2556  * protocols higher up. The order is:
2557  *
2558  *  - any isochronous events handled before any
2559  *    of the queues. We don't do that here, because
2560  *    we'll create the actual TD entries on demand.
2561  *  - The first queue is the interrupt queue.
2562  *  - The second queue is the control queue, split into low and high speed
2563  *  - The third queue is bulk queue.
2564  *  - The fourth queue is the bandwidth reclamation queue, which loops back
2565  *    to the high speed control queue.
2566  */
2567 static int alloc_uhci(struct pci_dev *dev, int irq, unsigned int io_addr, unsigned int io_size)
2568 {
2569         struct uhci *uhci;
2570         int retval = -EBUSY;
2571         char buf[8], *bufp = buf;
2572         int i, port;
2573         struct usb_bus *bus;
2574         dma_addr_t dma_handle;
2575 #ifdef CONFIG_PROC_FS
2576         struct proc_dir_entry *ent;
2577 #endif
2578
2579         if (!request_region(io_addr, io_size, "usb-uhci")) {
2580                 err("couldn't allocate I/O range %x - %x", io_addr,
2581                         io_addr + io_size - 1);
2582                 goto err_request_region;
2583         }
2584
2585         if (!dev->irq) {
2586                 err("found UHCI device with no IRQ assigned. check BIOS settings!");
2587                 retval = -EINVAL;
2588                 goto err_invalid_irq;
2589         }
2590
2591         if (!pci_dma_supported(dev, 0xFFFFFFFF)) {
2592                 err("PCI subsystem doesn't support 32 bit addressing?");
2593                 retval = -ENODEV;
2594                 goto err_pci_dma_supported;
2595         }
2596
2597         if (pci_enable_device(dev) < 0) {
2598                 err("couldn't enable PCI device");
2599                 goto err_enable_device;
2600         }
2601
2602         pci_set_master(dev);
2603
2604 #ifndef __sparc__
2605         sprintf(buf, "%d", irq);
2606 #else
2607         bufp = __irq_itoa(irq);
2608 #endif
2609         printk(KERN_INFO __FILE__ ": USB UHCI at I/O 0x%x, IRQ %s\n",
2610                 io_addr, bufp);
2611
2612         if (pci_set_dma_mask(dev, 0xFFFFFFFF)) {
2613                 err("couldn't set PCI dma mask");
2614                 retval = -ENODEV;
2615                 goto err_pci_set_dma_mask;
2616         }
2617
2618         uhci = kmalloc(sizeof(*uhci), GFP_KERNEL);
2619         if (!uhci) {
2620                 err("couldn't allocate uhci structure");
2621                 retval = -ENOMEM;
2622                 goto err_alloc_uhci;
2623         }
2624
2625         uhci->dev = dev;
2626         uhci->io_addr = io_addr;
2627         uhci->io_size = io_size;
2628         dev->driver_data = uhci;
2629
2630 #ifdef CONFIG_PROC_FS
2631         uhci->num = uhci_num++;
2632
2633         sprintf(buf, "hc%d", uhci->num);
2634
2635         ent = create_proc_entry(buf, S_IFREG|S_IRUGO|S_IWUSR, uhci_proc_root);
2636         if (!ent) {
2637                 err("couldn't create uhci proc entry");
2638                 retval = -ENOMEM;
2639                 goto err_create_proc_entry;
2640         }
2641
2642         ent->data = uhci;
2643         ent->proc_fops = &uhci_proc_operations;
2644         ent->size = 0;
2645         uhci->proc_entry = ent;
2646 #endif
2647
2648         /* Reset here so we don't get any interrupts from an old setup */
2649         /*  or broken setup */
2650         reset_hc(uhci);
2651
2652         spin_lock_init(&uhci->qh_remove_list_lock);
2653         INIT_LIST_HEAD(&uhci->qh_remove_list);
2654
2655         spin_lock_init(&uhci->urb_remove_list_lock);
2656         INIT_LIST_HEAD(&uhci->urb_remove_list);
2657
2658         spin_lock_init(&uhci->urb_list_lock);
2659         INIT_LIST_HEAD(&uhci->urb_list);
2660
2661         spin_lock_init(&uhci->complete_list_lock);
2662         INIT_LIST_HEAD(&uhci->complete_list);
2663
2664         spin_lock_init(&uhci->frame_list_lock);
2665
2666         /* We need exactly one page (per UHCI specs), how convenient */
2667         /* We assume that one page is atleast 4k (1024 frames * 4 bytes) */
2668 #if PAGE_SIZE < (4 * 1024)
2669 #error PAGE_SIZE is not atleast 4k
2670 #endif
2671         uhci->fl = pci_alloc_consistent(uhci->dev, sizeof(*uhci->fl), &dma_handle);
2672         if (!uhci->fl) {
2673                 err("unable to allocate consistent memory for frame list");
2674                 goto err_alloc_fl;
2675         }
2676
2677         memset((void *)uhci->fl, 0, sizeof(*uhci->fl));
2678
2679         uhci->fl->dma_handle = dma_handle;
2680
2681         uhci->td_pool = pci_pool_create("uhci_td", uhci->dev,
2682                 sizeof(struct uhci_td), 16, 0, GFP_DMA | GFP_ATOMIC);
2683         if (!uhci->td_pool) {
2684                 err("unable to create td pci_pool");
2685                 goto err_create_td_pool;
2686         }
2687
2688         uhci->qh_pool = pci_pool_create("uhci_qh", uhci->dev,
2689                 sizeof(struct uhci_qh), 16, 0, GFP_DMA | GFP_ATOMIC);
2690         if (!uhci->qh_pool) {
2691                 err("unable to create qh pci_pool");
2692                 goto err_create_qh_pool;
2693         }
2694
2695         bus = usb_alloc_bus(&uhci_device_operations);
2696         if (!bus) {
2697                 err("unable to allocate bus");
2698                 goto err_alloc_bus;
2699         }
2700
2701         uhci->bus = bus;
2702         bus->hcpriv = uhci;
2703
2704         usb_register_bus(uhci->bus);
2705
2706         /* Initialize the root hub */
2707
2708         /* UHCI specs says devices must have 2 ports, but goes on to say */
2709         /*  they may have more but give no way to determine how many they */
2710         /*  have. However, according to the UHCI spec, Bit 7 is always set */
2711         /*  to 1. So we try to use this to our advantage */
2712         for (port = 0; port < (uhci->io_size - 0x10) / 2; port++) {
2713                 unsigned int portstatus;
2714
2715                 portstatus = inw(uhci->io_addr + 0x10 + (port * 2));
2716                 if (!(portstatus & 0x0080))
2717                         break;
2718         }
2719         if (debug)
2720                 info("detected %d ports", port);
2721
2722         /* This is experimental so anything less than 2 or greater than 8 is */
2723         /*  something weird and we'll ignore it */
2724         if (port < 2 || port > 8) {
2725                 info("port count misdetected? forcing to 2 ports");
2726                 port = 2;
2727         }
2728
2729         uhci->rh.numports = port;
2730
2731         uhci->bus->root_hub = uhci->rh.dev = usb_alloc_dev(NULL, uhci->bus);
2732         if (!uhci->rh.dev) {
2733                 err("unable to allocate root hub");
2734                 goto err_alloc_root_hub;
2735         }
2736
2737         uhci->skeltd[0] = uhci_alloc_td(uhci, uhci->rh.dev);
2738         if (!uhci->skeltd[0]) {
2739                 err("unable to allocate TD 0");
2740                 goto err_alloc_skeltd;
2741         }
2742
2743         /*
2744          * 9 Interrupt queues; link int2 to int1, int4 to int2, etc
2745          * then link int1 to control and control to bulk
2746          */
2747         for (i = 1; i < 9; i++) {
2748                 struct uhci_td *td;
2749
2750                 td = uhci->skeltd[i] = uhci_alloc_td(uhci, uhci->rh.dev);
2751                 if (!td) {
2752                         err("unable to allocate TD %d", i);
2753                         goto err_alloc_skeltd;
2754                 }
2755
2756                 uhci_fill_td(td, 0, (UHCI_NULL_DATA_SIZE << 21) | (0x7f << 8) | USB_PID_IN, 0);
2757                 td->link = uhci->skeltd[i - 1]->dma_handle;
2758         }
2759
2760         uhci->skel_term_td = uhci_alloc_td(uhci, uhci->rh.dev);
2761         if (!uhci->skel_term_td) {
2762                 err("unable to allocate skel TD term");
2763                 goto err_alloc_skeltd;
2764         }
2765
2766         for (i = 0; i < UHCI_NUM_SKELQH; i++) {
2767                 uhci->skelqh[i] = uhci_alloc_qh(uhci, uhci->rh.dev);
2768                 if (!uhci->skelqh[i]) {
2769                         err("unable to allocate QH %d", i);
2770                         goto err_alloc_skelqh;
2771                 }
2772         }
2773
2774         uhci_fill_td(uhci->skel_int1_td, 0, (UHCI_NULL_DATA_SIZE << 21) | (0x7f << 8) | USB_PID_IN, 0);
2775         uhci->skel_int1_td->link = uhci->skel_ls_control_qh->dma_handle | UHCI_PTR_QH;
2776
2777         uhci->skel_ls_control_qh->link = uhci->skel_hs_control_qh->dma_handle | UHCI_PTR_QH;
2778         uhci->skel_ls_control_qh->element = UHCI_PTR_TERM;
2779
2780         uhci->skel_hs_control_qh->link = uhci->skel_bulk_qh->dma_handle | UHCI_PTR_QH;
2781         uhci->skel_hs_control_qh->element = UHCI_PTR_TERM;
2782
2783         uhci->skel_bulk_qh->link = uhci->skel_term_qh->dma_handle | UHCI_PTR_QH;
2784         uhci->skel_bulk_qh->element = UHCI_PTR_TERM;
2785
2786         /* This dummy TD is to work around a bug in Intel PIIX controllers */
2787         uhci_fill_td(uhci->skel_term_td, 0, (UHCI_NULL_DATA_SIZE << 21) | (0x7f << 8) | USB_PID_IN, 0);
2788         uhci->skel_term_td->link = uhci->skel_term_td->dma_handle;
2789
2790         uhci->skel_term_qh->link = UHCI_PTR_TERM;
2791         uhci->skel_term_qh->element = uhci->skel_term_td->dma_handle;
2792
2793         /*
2794          * Fill the frame list: make all entries point to
2795          * the proper interrupt queue.
2796          *
2797          * This is probably silly, but it's a simple way to
2798          * scatter the interrupt queues in a way that gives
2799          * us a reasonable dynamic range for irq latencies.
2800          */
2801         for (i = 0; i < UHCI_NUMFRAMES; i++) {
2802                 int irq = 0;
2803
2804                 if (i & 1) {
2805                         irq++;
2806                         if (i & 2) {
2807                                 irq++;
2808                                 if (i & 4) { 
2809                                         irq++;
2810                                         if (i & 8) { 
2811                                                 irq++;
2812                                                 if (i & 16) {
2813                                                         irq++;
2814                                                         if (i & 32) {
2815                                                                 irq++;
2816                                                                 if (i & 64)
2817                                                                         irq++;
2818                                                         }
2819                                                 }
2820                                         }
2821                                 }
2822                         }
2823                 }
2824
2825                 /* Only place we don't use the frame list routines */
2826                 uhci->fl->frame[i] =  uhci->skeltd[irq]->dma_handle;
2827         }
2828
2829      &nbs