v2.4.10.4 -> v2.4.10.5
[opensuse:kernel.git] / drivers / usb / usb-uhci.c
1 /* 
2  * Universal Host Controller Interface driver for USB (take II).
3  *
4  * (c) 1999-2001 Georg Acher, acher@in.tum.de (executive slave) (base guitar)
5  *               Deti Fliegl, deti@fliegl.de (executive slave) (lead voice)
6  *               Thomas Sailer, sailer@ife.ee.ethz.ch (chief consultant) (cheer leader)
7  *               Roman Weissgaerber, weissg@vienna.at (virt root hub) (studio porter)
8  * (c) 2000      Yggdrasil Computing, Inc. (port of new PCI interface support
9  *               from usb-ohci.c by Adam Richter, adam@yggdrasil.com).
10  * (C) 2000      David Brownell, david-b@pacbell.net (usb-ohci.c)
11  *          
12  * HW-initalization based on material of
13  *
14  * (C) Copyright 1999 Linus Torvalds
15  * (C) Copyright 1999 Johannes Erdfelt
16  * (C) Copyright 1999 Randy Dunlap
17  * (C) Copyright 1999 Gregory P. Smith
18  *
19  * $Id: usb-uhci.c,v 1.268 2001/08/29 14:08:43 acher Exp $
20  */
21
22 #include <linux/config.h>
23 #include <linux/module.h>
24 #include <linux/pci.h>
25 #include <linux/kernel.h>
26 #include <linux/delay.h>
27 #include <linux/ioport.h>
28 #include <linux/sched.h>
29 #include <linux/slab.h>
30 #include <linux/smp_lock.h>
31 #include <linux/errno.h>
32 #include <linux/unistd.h>
33 #include <linux/interrupt.h>    /* for in_interrupt() */
34 #include <linux/init.h>
35 #include <linux/version.h>
36 #include <linux/pm.h>
37
38 #include <asm/uaccess.h>
39 #include <asm/io.h>
40 #include <asm/irq.h>
41 #include <asm/system.h>
42
43 /* This enables more detailed sanity checks in submit_iso */
44 //#define ISO_SANITY_CHECK
45
46 /* This enables debug printks */
47 #define DEBUG
48
49 /* This enables all symbols to be exported, to ease debugging oopses */
50 //#define DEBUG_SYMBOLS
51
52 /* This enables an extra UHCI slab for memory debugging */
53 #define DEBUG_SLAB
54
55 #define VERSTR "$Revision: 1.268 $ time " __TIME__ " " __DATE__
56
57 #include <linux/usb.h>
58 #include "usb-uhci.h"
59 #include "usb-uhci-debug.h"
60
61 /*
62  * Version Information
63  */
64 #define DRIVER_VERSION "v1.268"
65 #define DRIVER_AUTHOR "Georg Acher, Deti Fliegl, Thomas Sailer, Roman Weissgaerber"
66 #define DRIVER_DESC "USB Universal Host Controller Interface driver"
67
68 #undef DEBUG
69 #undef dbg
70 #define dbg(format, arg...) do {} while (0)
71 #define DEBUG_SYMBOLS
72 #ifdef DEBUG_SYMBOLS
73         #define _static
74 #else
75         #define _static static
76 #endif
77
78 #define queue_dbg dbg //err
79 #define async_dbg dbg //err
80
81 #ifdef DEBUG_SLAB
82         static kmem_cache_t *urb_priv_kmem;
83 #endif
84
85 #define SLAB_FLAG     (in_interrupt ()? SLAB_ATOMIC : SLAB_KERNEL)
86 #define KMALLOC_FLAG  (in_interrupt ()? GFP_ATOMIC : GFP_KERNEL)
87
88 /* CONFIG_USB_UHCI_HIGH_BANDWITH turns on Full Speed Bandwidth
89  * Reclamation: feature that puts loop on descriptor loop when
90  * there's some transfer going on. With FSBR, USB performance
91  * is optimal, but PCI can be slowed down up-to 5 times, slowing down
92  * system performance (eg. framebuffer devices).
93  */
94 #define CONFIG_USB_UHCI_HIGH_BANDWIDTH 
95
96 /* *_DEPTH_FIRST puts descriptor in depth-first mode. This has
97  * somehow similar effect to FSBR (higher speed), but does not
98  * slow PCI down. OTOH USB performace is slightly slower than
99  * in FSBR case and single device could hog whole USB, starving
100  * other devices.
101  */
102 #define USE_CTRL_DEPTH_FIRST 0  // 0: Breadth first, 1: Depth first
103 #define USE_BULK_DEPTH_FIRST 0  // 0: Breadth first, 1: Depth first
104
105 /* Turning off both CONFIG_USB_UHCI_HIGH_BANDWITH and *_DEPTH_FIRST
106  * will lead to <64KB/sec performance over USB for bulk transfers targeting
107  * one device's endpoint. You probably do not want to do that.
108  */
109
110 // stop bandwidth reclamation after (roughly) 50ms
111 #define IDLE_TIMEOUT  (HZ/20)
112
113 // Suppress HC interrupt error messages for 5s
114 #define ERROR_SUPPRESSION_TIME (HZ*5)
115
116 _static int rh_submit_urb (urb_t *urb);
117 _static int rh_unlink_urb (urb_t *urb);
118 _static int delete_qh (uhci_t *s, uhci_desc_t *qh);
119 _static int process_transfer (uhci_t *s, urb_t *urb, int mode);
120 _static int process_interrupt (uhci_t *s, urb_t *urb);
121 _static int process_iso (uhci_t *s, urb_t *urb, int force);
122
123 // How much URBs with ->next are walked
124 #define MAX_NEXT_COUNT 2048
125
126 static uhci_t *devs = NULL;
127
128 /* used by userspace UHCI data structure dumper */
129 uhci_t **uhci_devices = &devs;
130
131 /*-------------------------------------------------------------------*/
132 // Cleans up collected QHs, but not more than 100 in one go
133 void clean_descs(uhci_t *s, int force)
134 {
135         struct list_head *q;
136         uhci_desc_t *qh;
137         int now=UHCI_GET_CURRENT_FRAME(s), n=0;
138
139         q=s->free_desc.prev;
140
141         while (q != &s->free_desc && (force || n<100)) {
142                 qh = list_entry (q, uhci_desc_t, horizontal);           
143                 q=qh->horizontal.prev;
144
145                 if ((qh->last_used!=now) || force)
146                         delete_qh(s,qh);
147                 n++;
148         }
149 }
150 /*-------------------------------------------------------------------*/
151 _static void uhci_switch_timer_int(uhci_t *s)
152 {
153
154         if (!list_empty(&s->urb_unlinked))
155                 set_td_ioc(s->td1ms);
156         else
157                 clr_td_ioc(s->td1ms);
158
159         if (s->timeout_urbs)
160                 set_td_ioc(s->td32ms);
161         else
162                 clr_td_ioc(s->td32ms);
163         wmb();
164 }
165 /*-------------------------------------------------------------------*/
166 #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH
167 _static void enable_desc_loop(uhci_t *s, urb_t *urb)
168 {
169         int flags;
170
171         if (urb->transfer_flags & USB_NO_FSBR)
172                 return;
173
174         spin_lock_irqsave (&s->qh_lock, flags);
175         s->chain_end->hw.qh.head&=cpu_to_le32(~UHCI_PTR_TERM);
176         mb();
177         s->loop_usage++;
178         ((urb_priv_t*)urb->hcpriv)->use_loop=1;
179         spin_unlock_irqrestore (&s->qh_lock, flags);
180 }
181 /*-------------------------------------------------------------------*/
182 _static void disable_desc_loop(uhci_t *s, urb_t *urb)
183 {
184         int flags;
185
186         if (urb->transfer_flags & USB_NO_FSBR)
187                 return;
188
189         spin_lock_irqsave (&s->qh_lock, flags);
190         if (((urb_priv_t*)urb->hcpriv)->use_loop) {
191                 s->loop_usage--;
192
193                 if (!s->loop_usage) {
194                         s->chain_end->hw.qh.head|=cpu_to_le32(UHCI_PTR_TERM);
195                         mb();
196                 }
197                 ((urb_priv_t*)urb->hcpriv)->use_loop=0;
198         }
199         spin_unlock_irqrestore (&s->qh_lock, flags);
200 }
201 #endif
202 /*-------------------------------------------------------------------*/
203 _static void queue_urb_unlocked (uhci_t *s, urb_t *urb)
204 {
205         struct list_head *p=&urb->urb_list;
206 #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH
207         {
208                 int type;
209                 type=usb_pipetype (urb->pipe);
210
211                 if ((type == PIPE_BULK) || (type == PIPE_CONTROL))
212                         enable_desc_loop(s, urb);
213         }
214 #endif
215         urb->status = -EINPROGRESS;
216         ((urb_priv_t*)urb->hcpriv)->started=jiffies;
217         list_add (p, &s->urb_list);
218         if (urb->timeout)
219                 s->timeout_urbs++;
220         uhci_switch_timer_int(s);
221 }
222 /*-------------------------------------------------------------------*/
223 _static void queue_urb (uhci_t *s, urb_t *urb)
224 {
225         unsigned long flags=0;
226
227         spin_lock_irqsave (&s->urb_list_lock, flags);
228         queue_urb_unlocked(s,urb);
229         spin_unlock_irqrestore (&s->urb_list_lock, flags);
230 }
231 /*-------------------------------------------------------------------*/
232 _static void dequeue_urb (uhci_t *s, urb_t *urb)
233 {
234 #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH
235         int type;
236
237         type=usb_pipetype (urb->pipe);
238
239         if ((type == PIPE_BULK) || (type == PIPE_CONTROL))
240                 disable_desc_loop(s, urb);
241 #endif
242
243         list_del (&urb->urb_list);
244         if (urb->timeout && s->timeout_urbs)
245                 s->timeout_urbs--;
246
247 }
248 /*-------------------------------------------------------------------*/
249 _static int alloc_td (uhci_t *s, uhci_desc_t ** new, int flags)
250 {
251         dma_addr_t dma_handle;
252
253         *new = pci_pool_alloc(s->desc_pool, GFP_DMA | GFP_ATOMIC, &dma_handle);
254         if (!*new)
255                 return -ENOMEM;
256         memset (*new, 0, sizeof (uhci_desc_t));
257         (*new)->dma_addr = dma_handle;
258         set_td_link((*new), UHCI_PTR_TERM | (flags & UHCI_PTR_BITS));   // last by default
259         (*new)->type = TD_TYPE;
260         mb();
261         INIT_LIST_HEAD (&(*new)->vertical);
262         INIT_LIST_HEAD (&(*new)->horizontal);
263         
264         return 0;
265 }
266 /*-------------------------------------------------------------------*/
267 // append a qh to td.link physically, the SW linkage is not affected
268 _static void append_qh(uhci_t *s, uhci_desc_t *td, uhci_desc_t* qh, int  flags)
269 {
270         unsigned long xxx;
271         
272         spin_lock_irqsave (&s->td_lock, xxx);
273
274         set_td_link(td, qh->dma_addr | (flags & UHCI_PTR_DEPTH) | UHCI_PTR_QH);
275        
276         mb();
277         spin_unlock_irqrestore (&s->td_lock, xxx);
278 }
279 /*-------------------------------------------------------------------*/
280 /* insert td at last position in td-list of qh (vertical) */
281 _static int insert_td (uhci_t *s, uhci_desc_t *qh, uhci_desc_t* new, int flags)
282 {
283         uhci_desc_t *prev;
284         unsigned long xxx;
285         
286         spin_lock_irqsave (&s->td_lock, xxx);
287
288         list_add_tail (&new->vertical, &qh->vertical);
289
290         prev = list_entry (new->vertical.prev, uhci_desc_t, vertical);
291
292         if (qh == prev ) {
293                 // virgin qh without any tds
294                 set_qh_element(qh, new->dma_addr | UHCI_PTR_TERM);
295         }
296         else {
297                 // already tds inserted, implicitely remove TERM bit of prev
298                 set_td_link(prev, new->dma_addr | (flags & UHCI_PTR_DEPTH));
299         }
300         mb();
301         spin_unlock_irqrestore (&s->td_lock, xxx);
302         
303         return 0;
304 }
305 /*-------------------------------------------------------------------*/
306 /* insert new_td after td (horizontal) */
307 _static int insert_td_horizontal (uhci_t *s, uhci_desc_t *td, uhci_desc_t* new)
308 {
309         uhci_desc_t *next;
310         unsigned long flags;
311         
312         spin_lock_irqsave (&s->td_lock, flags);
313
314         next = list_entry (td->horizontal.next, uhci_desc_t, horizontal);
315         list_add (&new->horizontal, &td->horizontal);
316         new->hw.td.link = td->hw.td.link;
317         set_td_link(td, new->dma_addr);
318         mb();
319         spin_unlock_irqrestore (&s->td_lock, flags);    
320         
321         return 0;
322 }
323 /*-------------------------------------------------------------------*/
324 _static int unlink_td (uhci_t *s, uhci_desc_t *element, int phys_unlink)
325 {
326         uhci_desc_t *next, *prev;
327         int dir = 0;
328         unsigned long flags;
329         
330         spin_lock_irqsave (&s->td_lock, flags);
331         
332         next = list_entry (element->vertical.next, uhci_desc_t, vertical);
333         
334         if (next == element) {
335                 dir = 1;
336                 prev = list_entry (element->horizontal.prev, uhci_desc_t, horizontal);
337         }
338         else 
339                 prev = list_entry (element->vertical.prev, uhci_desc_t, vertical);
340         
341         if (phys_unlink) {
342                 // really remove HW linking
343                 if (prev->type == TD_TYPE)
344                         prev->hw.td.link = element->hw.td.link;
345                 else
346                         prev->hw.qh.element = element->hw.td.link;
347         }
348
349         mb ();
350
351         if (dir == 0)
352                 list_del (&element->vertical);
353         else
354                 list_del (&element->horizontal);
355         
356         spin_unlock_irqrestore (&s->td_lock, flags);    
357         
358         return 0;
359 }
360
361 /*-------------------------------------------------------------------*/
362 _static int delete_desc (uhci_t *s, uhci_desc_t *element)
363 {
364         pci_pool_free(s->desc_pool, element, element->dma_addr);
365         return 0;
366 }
367 /*-------------------------------------------------------------------*/
368 // Allocates qh element
369 _static int alloc_qh (uhci_t *s, uhci_desc_t ** new)
370 {
371         dma_addr_t dma_handle;
372
373         *new = pci_pool_alloc(s->desc_pool, GFP_DMA | GFP_ATOMIC, &dma_handle);
374         if (!*new)
375                 return -ENOMEM;
376         memset (*new, 0, sizeof (uhci_desc_t));
377         (*new)->dma_addr = dma_handle;
378         set_qh_head(*new, UHCI_PTR_TERM);
379         set_qh_element(*new, UHCI_PTR_TERM);
380         (*new)->type = QH_TYPE;
381         
382         mb();
383         INIT_LIST_HEAD (&(*new)->horizontal);
384         INIT_LIST_HEAD (&(*new)->vertical);
385         
386         dbg("Allocated qh @ %p", *new);
387         
388         return 0;
389 }
390 /*-------------------------------------------------------------------*/
391 // inserts new qh before/after the qh at pos
392 // flags: 0: insert before pos, 1: insert after pos (for low speed transfers)
393 _static int insert_qh (uhci_t *s, uhci_desc_t *pos, uhci_desc_t *new, int order)
394 {
395         uhci_desc_t *old;
396         unsigned long flags;
397
398         spin_lock_irqsave (&s->qh_lock, flags);
399
400         if (!order) {
401                 // (OLD) (POS) -> (OLD) (NEW) (POS)
402                 old = list_entry (pos->horizontal.prev, uhci_desc_t, horizontal);
403                 list_add_tail (&new->horizontal, &pos->horizontal);
404                 set_qh_head(new, MAKE_QH_ADDR (pos)) ;
405                 if (!(old->hw.qh.head & cpu_to_le32(UHCI_PTR_TERM)))
406                         set_qh_head(old, MAKE_QH_ADDR (new)) ;
407         }
408         else {
409                 // (POS) (OLD) -> (POS) (NEW) (OLD)
410                 old = list_entry (pos->horizontal.next, uhci_desc_t, horizontal);
411                 list_add (&new->horizontal, &pos->horizontal);
412                 set_qh_head(new, MAKE_QH_ADDR (old));
413                 set_qh_head(pos, MAKE_QH_ADDR (new)) ;
414         }
415
416         mb ();
417         
418         spin_unlock_irqrestore (&s->qh_lock, flags);
419
420         return 0;
421 }
422
423 /*-------------------------------------------------------------------*/
424 _static int unlink_qh (uhci_t *s, uhci_desc_t *element)
425 {
426         uhci_desc_t  *prev;
427         unsigned long flags;
428
429         spin_lock_irqsave (&s->qh_lock, flags);
430         
431         prev = list_entry (element->horizontal.prev, uhci_desc_t, horizontal);
432         prev->hw.qh.head = element->hw.qh.head;
433
434         dbg("unlink qh %p, pqh %p, nxqh %p, to %08x", element, prev, 
435             list_entry (element->horizontal.next, uhci_desc_t, horizontal),le32_to_cpu(element->hw.qh.head) &~15);
436         
437         list_del(&element->horizontal);
438
439         mb ();
440         spin_unlock_irqrestore (&s->qh_lock, flags);
441         
442         return 0;
443 }
444 /*-------------------------------------------------------------------*/
445 _static int delete_qh (uhci_t *s, uhci_desc_t *qh)
446 {
447         uhci_desc_t *td;
448         struct list_head *p;
449         
450         list_del (&qh->horizontal);
451
452         while ((p = qh->vertical.next) != &qh->vertical) {
453                 td = list_entry (p, uhci_desc_t, vertical);
454                 dbg("unlink td @ %p",td);
455                 unlink_td (s, td, 0); // no physical unlink
456                 delete_desc (s, td);
457         }
458
459         delete_desc (s, qh);
460         
461         return 0;
462 }
463 /*-------------------------------------------------------------------*/
464 _static void clean_td_chain (uhci_t *s, uhci_desc_t *td)
465 {
466         struct list_head *p;
467         uhci_desc_t *td1;
468
469         if (!td)
470                 return;
471         
472         while ((p = td->horizontal.next) != &td->horizontal) {
473                 td1 = list_entry (p, uhci_desc_t, horizontal);
474                 delete_desc (s, td1);
475         }
476         
477         delete_desc (s, td);
478 }
479
480 /*-------------------------------------------------------------------*/
481 _static void fill_td (uhci_desc_t *td, int status, int info, __u32 buffer)
482 {
483         td->hw.td.status = cpu_to_le32(status);
484         td->hw.td.info = cpu_to_le32(info);
485         td->hw.td.buffer = cpu_to_le32(buffer);
486 }
487 /*-------------------------------------------------------------------*/
488 // Removes ALL qhs in chain (paranoia!)
489 _static void cleanup_skel (uhci_t *s)
490 {
491         unsigned int n;
492         uhci_desc_t *td;
493
494         dbg("cleanup_skel");
495
496         clean_descs(s,1);
497
498         
499         if (s->td32ms) {
500         
501                 unlink_td(s,s->td32ms,1);
502                 delete_desc(s, s->td32ms);
503         }
504
505         for (n = 0; n < 8; n++) {
506                 td = s->int_chain[n];
507                 clean_td_chain (s, td);
508         }
509
510         if (s->iso_td) {
511                 for (n = 0; n < 1024; n++) {
512                         td = s->iso_td[n];
513                         clean_td_chain (s, td);
514                 }
515                 kfree (s->iso_td);
516         }
517
518         if (s->framelist)
519                 pci_free_consistent(s->uhci_pci, PAGE_SIZE,
520                                     s->framelist, s->framelist_dma);
521
522         if (s->control_chain) {
523                 // completed init_skel?
524                 struct list_head *p;
525                 uhci_desc_t *qh, *qh1;
526
527                 qh = s->control_chain;
528                 while ((p = qh->horizontal.next) != &qh->horizontal) {
529                         qh1 = list_entry (p, uhci_desc_t, horizontal);
530                         delete_qh (s, qh1);
531                 }
532
533                 delete_qh (s, qh);
534         }
535         else {
536                 if (s->ls_control_chain)
537                         delete_desc (s, s->ls_control_chain);
538                 if (s->control_chain)
539                         delete_desc (s, s->control_chain);
540                 if (s->bulk_chain)
541                         delete_desc (s, s->bulk_chain);
542                 if (s->chain_end)
543                         delete_desc (s, s->chain_end);
544         }
545
546         if (s->desc_pool) {
547                 pci_pool_destroy(s->desc_pool);
548                 s->desc_pool = NULL;
549         }
550
551         dbg("cleanup_skel finished");   
552 }
553 /*-------------------------------------------------------------------*/
554 // allocates framelist and qh-skeletons
555 // only HW-links provide continous linking, SW-links stay in their domain (ISO/INT)
556 _static int init_skel (uhci_t *s)
557 {
558         int n, ret;
559         uhci_desc_t *qh, *td;
560         
561         dbg("init_skel");
562         
563         s->framelist = pci_alloc_consistent(s->uhci_pci, PAGE_SIZE,
564                                             &s->framelist_dma);
565
566         if (!s->framelist)
567                 return -ENOMEM;
568
569         memset (s->framelist, 0, 4096);
570
571         dbg("creating descriptor pci_pool");
572
573         s->desc_pool = pci_pool_create("uhci_desc", s->uhci_pci,
574                                        sizeof(uhci_desc_t), 16, 0,
575                                        GFP_DMA | GFP_ATOMIC);   
576         if (!s->desc_pool)
577                 goto init_skel_cleanup;
578
579         dbg("allocating iso desc pointer list");
580         s->iso_td = (uhci_desc_t **) kmalloc (1024 * sizeof (uhci_desc_t*), GFP_KERNEL);
581         
582         if (!s->iso_td)
583                 goto init_skel_cleanup;
584
585         s->ls_control_chain = NULL;
586         s->control_chain = NULL;
587         s->bulk_chain = NULL;
588         s->chain_end = NULL;
589
590         dbg("allocating iso descs");
591         for (n = 0; n < 1024; n++) {
592                 // allocate skeleton iso/irq-tds
593                 if (alloc_td (s, &td, 0))
594                         goto init_skel_cleanup;
595
596                 s->iso_td[n] = td;
597                 s->framelist[n] = cpu_to_le32((__u32) td->dma_addr);
598         }
599
600         dbg("allocating qh: chain_end");
601         if (alloc_qh (s, &qh))  
602                 goto init_skel_cleanup;
603                                 
604         s->chain_end = qh;
605
606         if (alloc_td (s, &td, 0))
607                 goto init_skel_cleanup;
608         
609         fill_td (td, 0 * TD_CTRL_IOC, 0, 0); // generate 1ms interrupt (enabled on demand)
610         insert_td (s, qh, td, 0);
611         qh->hw.qh.element &= cpu_to_le32(~UHCI_PTR_TERM); // remove TERM bit
612         s->td1ms=td;
613
614         dbg("allocating qh: bulk_chain");
615         if (alloc_qh (s, &qh))
616                 goto init_skel_cleanup;
617         
618         insert_qh (s, s->chain_end, qh, 0);
619         s->bulk_chain = qh;
620
621         dbg("allocating qh: control_chain");
622         ret = alloc_qh (s, &qh);
623         if (ret)
624                 goto init_skel_cleanup;
625         
626         insert_qh (s, s->bulk_chain, qh, 0);
627         s->control_chain = qh;
628
629 #ifdef  CONFIG_USB_UHCI_HIGH_BANDWIDTH
630         // disabled reclamation loop
631         set_qh_head(s->chain_end, s->control_chain->dma_addr | UHCI_PTR_QH | UHCI_PTR_TERM);
632 #endif
633
634         dbg("allocating qh: ls_control_chain");
635         if (alloc_qh (s, &qh))
636                 goto init_skel_cleanup;
637         
638         insert_qh (s, s->control_chain, qh, 0);
639         s->ls_control_chain = qh;
640
641         for (n = 0; n < 8; n++)
642                 s->int_chain[n] = 0;
643
644         dbg("allocating skeleton INT-TDs");
645         
646         for (n = 0; n < 8; n++) {
647                 uhci_desc_t *td;
648
649                 if (alloc_td (s, &td, 0))
650                         goto init_skel_cleanup;
651
652                 s->int_chain[n] = td;
653                 if (n == 0) {
654                         set_td_link(s->int_chain[0], s->ls_control_chain->dma_addr | UHCI_PTR_QH);
655                 }
656                 else {
657                         set_td_link(s->int_chain[n], s->int_chain[0]->dma_addr);
658                 }
659         }
660
661         dbg("Linking skeleton INT-TDs");
662         
663         for (n = 0; n < 1024; n++) {
664                 // link all iso-tds to the interrupt chains
665                 int m, o;
666                 dbg("framelist[%i]=%x",n,le32_to_cpu(s->framelist[n]));
667                 if ((n&127)==127) 
668                         ((uhci_desc_t*) s->iso_td[n])->hw.td.link = cpu_to_le32(s->int_chain[0]->dma_addr);
669                 else 
670                         for (o = 1, m = 2; m <= 128; o++, m += m)
671                                 if ((n & (m - 1)) == ((m - 1) / 2))
672                                         set_td_link(((uhci_desc_t*) s->iso_td[n]), s->int_chain[o]->dma_addr);
673         }
674
675         if (alloc_td (s, &td, 0))
676                 goto init_skel_cleanup;
677         
678         fill_td (td, 0 * TD_CTRL_IOC, 0, 0); // generate 32ms interrupt (activated later)
679         s->td32ms=td;
680
681         insert_td_horizontal (s, s->int_chain[5], td);
682
683         mb();
684         //uhci_show_queue(s->control_chain);   
685         dbg("init_skel exit");
686         return 0;
687
688       init_skel_cleanup:
689         cleanup_skel (s);
690         return -ENOMEM;
691 }
692
693 /*-------------------------------------------------------------------*/
694 //                         LOW LEVEL STUFF
695 //          assembles QHs und TDs for control, bulk and iso
696 /*-------------------------------------------------------------------*/
697 _static int uhci_submit_control_urb (urb_t *urb)
698 {
699         uhci_desc_t *qh, *td;
700         uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
701         urb_priv_t *urb_priv = urb->hcpriv;
702         unsigned long destination, status;
703         int maxsze = usb_maxpacket (urb->dev, urb->pipe, usb_pipeout (urb->pipe));
704         unsigned long len;
705         char *data;
706         int depth_first=USE_CTRL_DEPTH_FIRST;  // UHCI descriptor chasing method
707
708         dbg("uhci_submit_control start");
709         if (alloc_qh (s, &qh))          // alloc qh for this request
710                 return -ENOMEM;
711
712         if (alloc_td (s, &td, UHCI_PTR_DEPTH * depth_first))            // get td for setup stage
713         {
714                 delete_qh (s, qh);
715                 return -ENOMEM;
716         }
717
718         /* The "pipe" thing contains the destination in bits 8--18 */
719         destination = (urb->pipe & PIPE_DEVEP_MASK) | USB_PID_SETUP;
720
721         /* 3 errors */
722         status = (urb->pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE |
723                 (urb->transfer_flags & USB_DISABLE_SPD ? 0 : TD_CTRL_SPD) | (3 << 27);
724
725         /*  Build the TD for the control request, try forever, 8 bytes of data */
726         fill_td (td, status, destination | (7 << 21), urb_priv->setup_packet_dma);
727
728         insert_td (s, qh, td, 0);       // queue 'setup stage'-td in qh
729 #if 0
730         {
731                 char *sp=urb->setup_packet;
732                 dbg("SETUP to pipe %x: %x %x %x %x %x %x %x %x", urb->pipe,
733                     sp[0],sp[1],sp[2],sp[3],sp[4],sp[5],sp[6],sp[7]);
734         }
735         //uhci_show_td(td);
736 #endif
737
738         len = urb->transfer_buffer_length;
739         data = urb->transfer_buffer;
740
741         /* If direction is "send", change the frame from SETUP (0x2D)
742            to OUT (0xE1). Else change it from SETUP to IN (0x69). */
743
744         destination = (urb->pipe & PIPE_DEVEP_MASK) | (usb_pipeout (urb->pipe)?USB_PID_OUT:USB_PID_IN);
745
746         while (len > 0) {
747                 int pktsze = len;
748
749                 if (alloc_td (s, &td, UHCI_PTR_DEPTH * depth_first))
750                         goto fail_unmap_enomem;
751
752                 if (pktsze > maxsze)
753                         pktsze = maxsze;
754
755                 destination ^= 1 << TD_TOKEN_TOGGLE;    // toggle DATA0/1
756
757                 // Status, pktsze bytes of data
758                 fill_td (td, status, destination | ((pktsze - 1) << 21),
759                          urb_priv->transfer_buffer_dma + (data - (char *)urb->transfer_buffer));
760
761                 insert_td (s, qh, td, UHCI_PTR_DEPTH * depth_first);    // queue 'data stage'-td in qh
762
763                 data += pktsze;
764                 len -= pktsze;
765         }
766
767         /* Build the final TD for control status */
768         /* It's only IN if the pipe is out AND we aren't expecting data */
769
770         destination &= ~UHCI_PID;
771
772         if (usb_pipeout (urb->pipe) || (urb->transfer_buffer_length == 0))
773                 destination |= USB_PID_IN;
774         else
775                 destination |= USB_PID_OUT;
776
777         destination |= 1 << TD_TOKEN_TOGGLE;    /* End in Data1 */
778
779         if (alloc_td (s, &td, UHCI_PTR_DEPTH))
780                 goto fail_unmap_enomem;
781
782         status &=~TD_CTRL_SPD;
783
784         /* no limit on errors on final packet , 0 bytes of data */
785         fill_td (td, status | TD_CTRL_IOC, destination | (UHCI_NULL_DATA_SIZE << 21),
786                  0);
787
788         insert_td (s, qh, td, UHCI_PTR_DEPTH * depth_first);    // queue status td
789
790         list_add (&qh->desc_list, &urb_priv->desc_list);
791
792         queue_urb (s, urb);     // queue before inserting in desc chain
793
794         qh->hw.qh.element &= cpu_to_le32(~UHCI_PTR_TERM);
795
796         //uhci_show_queue(qh);
797         /* Start it up... put low speed first */
798         if (urb->pipe & TD_CTRL_LS)
799                 insert_qh (s, s->control_chain, qh, 0);
800         else
801                 insert_qh (s, s->bulk_chain, qh, 0);
802
803         dbg("uhci_submit_control end");
804         return 0;
805
806 fail_unmap_enomem:
807         delete_qh(s, qh);
808         return -ENOMEM;
809 }
810 /*-------------------------------------------------------------------*/
811 // For queued bulk transfers, two additional QH helpers are allocated (nqh, bqh)
812 // Due to the linking with other bulk urbs, it has to be locked with urb_list_lock!
813
814 _static int uhci_submit_bulk_urb (urb_t *urb, urb_t *bulk_urb)
815 {
816         uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
817         urb_priv_t *urb_priv = urb->hcpriv, *upriv, *bpriv=NULL;
818         uhci_desc_t *qh, *td, *nqh=NULL, *bqh=NULL, *first_td=NULL;
819         unsigned long destination, status;
820         char *data;
821         unsigned int pipe = urb->pipe;
822         int maxsze = usb_maxpacket (urb->dev, pipe, usb_pipeout (pipe));
823         int info, len, last;
824         int depth_first=USE_BULK_DEPTH_FIRST;  // UHCI descriptor chasing method
825
826         if (usb_endpoint_halted (urb->dev, usb_pipeendpoint (pipe), usb_pipeout (pipe)))
827                 return -EPIPE;
828
829         queue_dbg("uhci_submit_bulk_urb: urb %p, old %p, pipe %08x, len %i",
830                   urb,bulk_urb,urb->pipe,urb->transfer_buffer_length);
831
832         upriv = (urb_priv_t*)urb->hcpriv;
833
834         if (!bulk_urb) {
835                 if (alloc_qh (s, &qh))          // get qh for this request
836                         return -ENOMEM;
837
838                 if (urb->transfer_flags & USB_QUEUE_BULK) {
839                         if (alloc_qh(s, &nqh)) // placeholder for clean unlink
840                         {
841                                 delete_desc (s, qh);
842                                 return -ENOMEM;
843                         }
844                         upriv->next_qh = nqh;
845                         queue_dbg("new next qh %p",nqh);
846                 }
847         }
848         else { 
849                 bpriv = (urb_priv_t*)bulk_urb->hcpriv;
850                 qh = bpriv->bottom_qh;  // re-use bottom qh and next qh
851                 nqh = bpriv->next_qh;
852                 upriv->next_qh=nqh;     
853                 upriv->prev_queued_urb=bulk_urb;
854         }
855
856         if (urb->transfer_flags & USB_QUEUE_BULK) {
857                 if (alloc_qh (s, &bqh))  // "bottom" QH
858                 {
859                         if (!bulk_urb) { 
860                                 delete_desc(s, qh);
861                                 delete_desc(s, nqh);
862                         }
863                         return -ENOMEM;
864                 }
865                 set_qh_element(bqh, UHCI_PTR_TERM);
866                 set_qh_head(bqh, nqh->dma_addr | UHCI_PTR_QH); // element
867                 upriv->bottom_qh = bqh;
868         }
869         queue_dbg("uhci_submit_bulk: qh %p bqh %p nqh %p",qh, bqh, nqh);
870
871         /* The "pipe" thing contains the destination in bits 8--18. */
872         destination = (pipe & PIPE_DEVEP_MASK) | usb_packetid (pipe);
873
874         /* 3 errors */
875         status = (pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE |
876                 ((urb->transfer_flags & USB_DISABLE_SPD) ? 0 : TD_CTRL_SPD) | (3 << 27);
877
878         /* Build the TDs for the bulk request */
879         len = urb->transfer_buffer_length;
880         data = urb->transfer_buffer;
881         
882         do {                                    // TBD: Really allow zero-length packets?
883                 int pktsze = len;
884
885                 if (alloc_td (s, &td, UHCI_PTR_DEPTH * depth_first))
886                 {
887                         delete_qh (s, qh);
888                         return -ENOMEM;
889                 }
890
891                 if (pktsze > maxsze)
892                         pktsze = maxsze;
893
894                 // pktsze bytes of data 
895                 info = destination | (((pktsze - 1)&UHCI_NULL_DATA_SIZE) << 21) |
896                         (usb_gettoggle (urb->dev, usb_pipeendpoint (pipe), usb_pipeout (pipe)) << TD_TOKEN_TOGGLE);
897
898                 fill_td (td, status, info,
899                          urb_priv->transfer_buffer_dma + (data - (char *)urb->transfer_buffer));
900
901                 data += pktsze;
902                 len -= pktsze;
903                 // Use USB_ZERO_PACKET to finish bulk OUTs always with a zero length packet
904                 last = (len == 0 && (usb_pipein(pipe) || pktsze < maxsze || !(urb->transfer_flags & USB_ZERO_PACKET)));
905
906                 if (last)
907                         set_td_ioc(td); // last one generates INT
908
909                 insert_td (s, qh, td, UHCI_PTR_DEPTH * depth_first);
910                 if (!first_td)
911                         first_td=td;
912                 usb_dotoggle (urb->dev, usb_pipeendpoint (pipe), usb_pipeout (pipe));
913
914         } while (!last);
915
916         if (bulk_urb && bpriv)   // everything went OK, link with old bulk URB
917                 bpriv->next_queued_urb=urb;
918
919         list_add (&qh->desc_list, &urb_priv->desc_list);
920
921         if (urb->transfer_flags & USB_QUEUE_BULK)
922                 append_qh(s, td, bqh, UHCI_PTR_DEPTH * depth_first);
923
924         queue_urb_unlocked (s, urb);
925         
926         if (urb->transfer_flags & USB_QUEUE_BULK)
927                 set_qh_element(qh, first_td->dma_addr);
928         else
929                 qh->hw.qh.element &= cpu_to_le32(~UHCI_PTR_TERM);    // arm QH
930
931         if (!bulk_urb) {                                        // new bulk queue       
932                 if (urb->transfer_flags & USB_QUEUE_BULK) {
933                         spin_lock (&s->td_lock);                // both QHs in one go
934                         insert_qh (s, s->chain_end, qh, 0);     // Main QH
935                         insert_qh (s, s->chain_end, nqh, 0);    // Helper QH
936                         spin_unlock (&s->td_lock);
937                 }
938                 else
939                         insert_qh (s, s->chain_end, qh, 0);
940         }
941         
942         //uhci_show_queue(s->bulk_chain);
943         //dbg("uhci_submit_bulk_urb: exit\n");
944         return 0;
945 }
946 /*-------------------------------------------------------------------*/
947 _static void uhci_clean_iso_step1(uhci_t *s, urb_priv_t *urb_priv)
948 {
949         struct list_head *p;
950         uhci_desc_t *td;
951
952         for (p = urb_priv->desc_list.next; p != &urb_priv->desc_list; p = p->next) {
953                                 td = list_entry (p, uhci_desc_t, desc_list);
954                                 unlink_td (s, td, 1);
955         }
956 }
957 /*-------------------------------------------------------------------*/
958 _static void uhci_clean_iso_step2(uhci_t *s, urb_priv_t *urb_priv)
959 {
960         struct list_head *p;
961         uhci_desc_t *td;
962
963         while ((p = urb_priv->desc_list.next) != &urb_priv->desc_list) {
964                                 td = list_entry (p, uhci_desc_t, desc_list);
965                                 list_del (p);
966                                 delete_desc (s, td);
967         }
968 }
969 /*-------------------------------------------------------------------*/
970 /* mode: CLEAN_TRANSFER_NO_DELETION: unlink but no deletion mark (step 1 of async_unlink)
971          CLEAN_TRANSFER_REGULAR: regular (unlink/delete-mark)
972          CLEAN_TRANSFER_DELETION_MARK: deletion mark for QH (step 2 of async_unlink)
973  looks a bit complicated because of all the bulk queueing goodies
974 */
975
976 _static void uhci_clean_transfer (uhci_t *s, urb_t *urb, uhci_desc_t *qh, int mode)
977 {
978         uhci_desc_t *bqh, *nqh, *prevqh, *prevtd;
979         int now;
980         urb_priv_t *priv=(urb_priv_t*)urb->hcpriv;
981
982         now=UHCI_GET_CURRENT_FRAME(s);
983
984         bqh=priv->bottom_qh;    
985         
986         if (!priv->next_queued_urb)  { // no more appended bulk queues
987
988                 queue_dbg("uhci_clean_transfer: No more bulks for urb %p, qh %p, bqh %p, nqh %p", urb, qh, bqh, priv->next_qh); 
989         
990                 if (priv->prev_queued_urb && mode != CLEAN_TRANSFER_DELETION_MARK) {  // qh not top of the queue
991                                 unsigned long flags; 
992                                 urb_priv_t* ppriv=(urb_priv_t*)priv->prev_queued_urb->hcpriv;
993
994                                 spin_lock_irqsave (&s->qh_lock, flags);
995                                 prevqh = list_entry (ppriv->desc_list.next, uhci_desc_t, desc_list);
996                                 prevtd = list_entry (prevqh->vertical.prev, uhci_desc_t, vertical);
997                                 set_td_link(prevtd, priv->bottom_qh->dma_addr | UHCI_PTR_QH); // skip current qh
998                                 mb();
999                                 queue_dbg("uhci_clean_transfer: relink pqh %p, ptd %p",prevqh, prevtd);
1000                                 spin_unlock_irqrestore (&s->qh_lock, flags);
1001
1002                                 ppriv->bottom_qh = priv->bottom_qh;
1003                                 ppriv->next_queued_urb = NULL;
1004                         }
1005                 else {   // queue is dead, qh is top of the queue
1006                         
1007                         if (mode != CLEAN_TRANSFER_DELETION_MARK)                               
1008                                 unlink_qh(s, qh); // remove qh from horizontal chain
1009
1010                         if (bqh) {  // remove remainings of bulk queue
1011                                 nqh=priv->next_qh;
1012
1013                                 if (mode != CLEAN_TRANSFER_DELETION_MARK) 
1014                                         unlink_qh(s, nqh);  // remove nqh from horizontal chain
1015                                 
1016                                 if (mode != CLEAN_TRANSFER_NO_DELETION) {  // add helper QHs to free desc list
1017                                         nqh->last_used = bqh->last_used = now;
1018                                         list_add_tail (&nqh->horizontal, &s->free_desc);
1019                                         list_add_tail (&bqh->horizontal, &s->free_desc);
1020                                 }                       
1021                         }
1022                 }
1023         }
1024         else { // there are queued urbs following
1025         
1026           queue_dbg("uhci_clean_transfer: urb %p, prevurb %p, nexturb %p, qh %p, bqh %p, nqh %p",
1027                        urb, priv->prev_queued_urb,  priv->next_queued_urb, qh, bqh, priv->next_qh);     
1028         
1029                 if (mode != CLEAN_TRANSFER_DELETION_MARK) {     // no work for cleanup at unlink-completion
1030                         urb_t *nurb;
1031                         unsigned long flags;
1032
1033                         nurb = priv->next_queued_urb;
1034                         spin_lock_irqsave (&s->qh_lock, flags);         
1035
1036                         if (!priv->prev_queued_urb) { // top QH
1037                                 
1038                                 prevqh = list_entry (qh->horizontal.prev, uhci_desc_t, horizontal);
1039                                 set_qh_head(prevqh, bqh->dma_addr | UHCI_PTR_QH);
1040                                 list_del (&qh->horizontal);  // remove this qh form horizontal chain
1041                                 list_add (&bqh->horizontal, &prevqh->horizontal); // insert next bqh in horizontal chain
1042                         }
1043                         else {          // intermediate QH
1044                                 urb_priv_t* ppriv=(urb_priv_t*)priv->prev_queued_urb->hcpriv;
1045                                 urb_priv_t* npriv=(urb_priv_t*)nurb->hcpriv;
1046                                 uhci_desc_t * bnqh;
1047                                 
1048                                 bnqh = list_entry (npriv->desc_list.next, uhci_desc_t, desc_list);
1049                                 ppriv->bottom_qh = bnqh;
1050                                 ppriv->next_queued_urb = nurb;                          
1051                                 prevqh = list_entry (ppriv->desc_list.next, uhci_desc_t, desc_list);
1052                                 set_qh_head(prevqh, bqh->dma_addr | UHCI_PTR_QH);
1053                         }
1054
1055                         mb();
1056                         ((urb_priv_t*)nurb->hcpriv)->prev_queued_urb=priv->prev_queued_urb;
1057                         spin_unlock_irqrestore (&s->qh_lock, flags);
1058                 }               
1059         }
1060
1061         if (mode != CLEAN_TRANSFER_NO_DELETION) {
1062                 qh->last_used = now;    
1063                 list_add_tail (&qh->horizontal, &s->free_desc); // mark qh for later deletion/kfree
1064         }
1065 }
1066 /*-------------------------------------------------------------------*/
1067 // Release bandwidth for Interrupt or Isoc. transfers 
1068 _static void uhci_release_bandwidth(urb_t *urb)
1069 {       
1070         if (urb->bandwidth) {
1071                 switch (usb_pipetype(urb->pipe)) {
1072                 case PIPE_INTERRUPT:
1073                         usb_release_bandwidth (urb->dev, urb, 0);
1074                         break;
1075                 case PIPE_ISOCHRONOUS:
1076                         usb_release_bandwidth (urb->dev, urb, 1);
1077                         break;
1078                 default:
1079                         break;
1080                 }
1081         }       
1082 }
1083
1084 _static void uhci_urb_dma_sync(uhci_t *s, urb_t *urb, urb_priv_t *urb_priv)
1085 {
1086         if (urb_priv->setup_packet_dma)
1087                 pci_dma_sync_single(s->uhci_pci, urb_priv->setup_packet_dma,
1088                                     sizeof(devrequest), PCI_DMA_TODEVICE);
1089
1090         if (urb_priv->transfer_buffer_dma)
1091                 pci_dma_sync_single(s->uhci_pci, urb_priv->transfer_buffer_dma,
1092                                     urb->transfer_buffer_length,
1093                                     usb_pipein(urb->pipe) ?
1094                                     PCI_DMA_FROMDEVICE :
1095                                     PCI_DMA_TODEVICE);
1096 }
1097
1098 _static void uhci_urb_dma_unmap(uhci_t *s, urb_t *urb, urb_priv_t *urb_priv)
1099 {
1100         if (urb_priv->setup_packet_dma) {
1101                 pci_unmap_single(s->uhci_pci, urb_priv->setup_packet_dma,
1102                                  sizeof(devrequest), PCI_DMA_TODEVICE);
1103                 urb_priv->setup_packet_dma = 0;
1104         }
1105         if (urb_priv->transfer_buffer_dma) {
1106                 pci_unmap_single(s->uhci_pci, urb_priv->transfer_buffer_dma,
1107                                  urb->transfer_buffer_length,
1108                                  usb_pipein(urb->pipe) ?
1109                                  PCI_DMA_FROMDEVICE :
1110                                  PCI_DMA_TODEVICE);
1111                 urb_priv->transfer_buffer_dma = 0;
1112         }
1113 }
1114 /*-------------------------------------------------------------------*/
1115 /* needs urb_list_lock!
1116    mode: UNLINK_ASYNC_STORE_URB: unlink and move URB into unlinked list
1117          UNLINK_ASYNC_DONT_STORE: unlink, don't move URB into unlinked list
1118 */
1119 _static int uhci_unlink_urb_async (uhci_t *s,urb_t *urb, int mode)
1120 {
1121         uhci_desc_t *qh;
1122         urb_priv_t *urb_priv;
1123         
1124         async_dbg("unlink_urb_async called %p",urb);
1125
1126         if ((urb->status == -EINPROGRESS) ||
1127             ((usb_pipetype (urb->pipe) ==  PIPE_INTERRUPT) && ((urb_priv_t*)urb->hcpriv)->flags))
1128         {
1129                 ((urb_priv_t*)urb->hcpriv)->started = ~0;  // mark
1130                 dequeue_urb (s, urb);
1131
1132                 if (mode==UNLINK_ASYNC_STORE_URB)
1133                         list_add_tail (&urb->urb_list, &s->urb_unlinked); // store urb
1134
1135                 uhci_switch_timer_int(s);
1136                 s->unlink_urb_done = 1;
1137                 uhci_release_bandwidth(urb);
1138
1139                 urb->status = -ECONNABORTED;    // mark urb as "waiting to be killed"   
1140                 urb_priv = (urb_priv_t*)urb->hcpriv;
1141
1142                 switch (usb_pipetype (urb->pipe)) {
1143                 case PIPE_INTERRUPT:
1144                         usb_dotoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe));
1145
1146                 case PIPE_ISOCHRONOUS:
1147                         uhci_clean_iso_step1 (s, urb_priv);
1148                         break;
1149
1150                 case PIPE_BULK:
1151                 case PIPE_CONTROL:
1152                         qh = list_entry (urb_priv->desc_list.next, uhci_desc_t, desc_list);
1153                         uhci_clean_transfer (s, urb, qh, CLEAN_TRANSFER_NO_DELETION);
1154                         break;
1155                 }
1156                 ((urb_priv_t*)urb->hcpriv)->started = UHCI_GET_CURRENT_FRAME(s);
1157                 return -EINPROGRESS;  // completion will follow
1158         }               
1159
1160         return 0;    // URB already dead
1161 }
1162 /*-------------------------------------------------------------------*/
1163 // kills an urb by unlinking descriptors and waiting for at least one frame
1164 _static int uhci_unlink_urb_sync (uhci_t *s, urb_t *urb)
1165 {
1166         uhci_desc_t *qh;
1167         urb_priv_t *urb_priv;
1168         unsigned long flags=0;
1169         struct usb_device *usb_dev;
1170
1171         spin_lock_irqsave (&s->urb_list_lock, flags);
1172
1173         if (urb->status == -EINPROGRESS) {
1174
1175                 // move descriptors out the the running chains, dequeue urb
1176                 uhci_unlink_urb_async(s, urb, UNLINK_ASYNC_DONT_STORE);
1177
1178                 urb_priv = urb->hcpriv;
1179                 urb->status = -ENOENT;  // prevent from double deletion after unlock            
1180                 spin_unlock_irqrestore (&s->urb_list_lock, flags);
1181                 
1182                 // cleanup the rest
1183                 switch (usb_pipetype (urb->pipe)) {
1184
1185                 case PIPE_ISOCHRONOUS:
1186                         uhci_wait_ms(1);
1187                         uhci_clean_iso_step2(s, urb_priv);
1188                         break;
1189
1190                 case PIPE_BULK:
1191                 case PIPE_CONTROL:
1192                         qh = list_entry (urb_priv->desc_list.next, uhci_desc_t, desc_list);
1193                         uhci_clean_transfer(s, urb, qh, CLEAN_TRANSFER_DELETION_MARK);
1194                         uhci_wait_ms(1);
1195                 }
1196                 urb->status = -ENOENT;  // mark urb as killed           
1197                                         
1198                 uhci_urb_dma_unmap(s, urb, urb->hcpriv);
1199
1200 #ifdef DEBUG_SLAB
1201                 kmem_cache_free (urb_priv_kmem, urb->hcpriv);
1202 #else
1203                 kfree (urb->hcpriv);
1204 #endif
1205                 usb_dev = urb->dev;
1206                 if (urb->complete) {
1207                         dbg("unlink_urb: calling completion");
1208                         urb->dev = NULL;
1209                         urb->complete ((struct urb *) urb);
1210                 }
1211                 usb_dec_dev_use (usb_dev);
1212         }
1213         else
1214                 spin_unlock_irqrestore (&s->urb_list_lock, flags);
1215
1216         return 0;
1217 }
1218 /*-------------------------------------------------------------------*/
1219 // async unlink_urb completion/cleanup work
1220 // has to be protected by urb_list_lock!
1221 // features: if set in transfer_flags, the resulting status of the killed
1222 // transaction is not overwritten
1223
1224 _static void uhci_cleanup_unlink(uhci_t *s, int force)
1225 {
1226         struct list_head *q;
1227         urb_t *urb;
1228         struct usb_device *dev;
1229         int now, type;
1230         urb_priv_t *urb_priv;
1231
1232         q=s->urb_unlinked.next;
1233         now=UHCI_GET_CURRENT_FRAME(s);
1234
1235         while (q != &s->urb_unlinked) {
1236
1237                 urb = list_entry (q, urb_t, urb_list);
1238
1239                 urb_priv = (urb_priv_t*)urb->hcpriv;
1240                 q = urb->urb_list.next;
1241                 
1242                 if (!urb_priv) // avoid crash when URB is corrupted
1243                         break;
1244                         
1245                 if (force || ((urb_priv->started != ~0) && (urb_priv->started != now))) {
1246                         async_dbg("async cleanup %p",urb);
1247                         type=usb_pipetype (urb->pipe);
1248
1249                         switch (type) { // process descriptors
1250                         case PIPE_CONTROL:
1251                                 process_transfer (s, urb, CLEAN_TRANSFER_DELETION_MARK);  // don't unlink (already done)
1252                                 break;
1253                         case PIPE_BULK:
1254                                 if (!s->avoid_bulk.counter)
1255                                         process_transfer (s, urb, CLEAN_TRANSFER_DELETION_MARK); // don't unlink (already done)
1256                                 else
1257                                         continue;
1258                                 break;
1259                         case PIPE_ISOCHRONOUS:
1260                                 process_iso (s, urb, PROCESS_ISO_FORCE); // force, don't unlink
1261                                 break;
1262                         case PIPE_INTERRUPT:
1263                                 process_interrupt (s, urb);
1264                                 break;
1265                         }
1266
1267                         if (!(urb->transfer_flags & USB_TIMEOUT_KILLED))
1268                                 urb->status = -ECONNRESET; // mark as asynchronously killed
1269
1270                         dev = urb->dev; // completion may destroy all...
1271                         urb_priv = urb->hcpriv;
1272                         list_del (&urb->urb_list);
1273                         
1274                         uhci_urb_dma_sync(s, urb, urb_priv);
1275                         if (urb->complete) {
1276                                 spin_unlock(&s->urb_list_lock);
1277                                 urb->dev = NULL;
1278                                 urb->complete ((struct urb *) urb);
1279                                 spin_lock(&s->urb_list_lock);
1280                         }
1281
1282                         if (!(urb->transfer_flags & USB_TIMEOUT_KILLED))
1283                                 urb->status = -ENOENT;  // now the urb is really dead
1284
1285                         switch (type) {
1286                         case PIPE_ISOCHRONOUS:
1287                         case PIPE_INTERRUPT:
1288                                 uhci_clean_iso_step2(s, urb_priv);
1289                                 break;
1290                         }
1291         
1292                         uhci_urb_dma_unmap(s, urb, urb_priv);
1293
1294                         usb_dec_dev_use (dev);
1295 #ifdef DEBUG_SLAB
1296                         kmem_cache_free (urb_priv_kmem, urb_priv);
1297 #else
1298                         kfree (urb_priv);
1299 #endif
1300
1301                 }
1302         }
1303 }
1304  
1305 /*-------------------------------------------------------------------*/
1306 _static int uhci_unlink_urb (urb_t *urb)
1307 {
1308         uhci_t *s;
1309         unsigned long flags=0;
1310         dbg("uhci_unlink_urb called for %p",urb);
1311         if (!urb || !urb->dev)          // you never know...
1312                 return -EINVAL;
1313         
1314         s = (uhci_t*) urb->dev->bus->hcpriv;
1315
1316         if (usb_pipedevice (urb->pipe) == s->rh.devnum)
1317                 return rh_unlink_urb (urb);
1318
1319         if (!urb->hcpriv)
1320                 return -EINVAL;
1321
1322         if (urb->transfer_flags & USB_ASYNC_UNLINK) {
1323                 int ret;
1324                 spin_lock_irqsave (&s->urb_list_lock, flags);
1325                 
1326                 uhci_release_bandwidth(urb);
1327                 ret = uhci_unlink_urb_async(s, urb, UNLINK_ASYNC_STORE_URB);
1328
1329                 spin_unlock_irqrestore (&s->urb_list_lock, flags);      
1330                 return ret;
1331         }
1332         else
1333                 return uhci_unlink_urb_sync(s, urb);
1334 }
1335 /*-------------------------------------------------------------------*/
1336 // In case of ASAP iso transfer, search the URB-list for already queued URBs
1337 // for this EP and calculate the earliest start frame for the new
1338 // URB (easy seamless URB continuation!)
1339 _static int find_iso_limits (urb_t *urb, unsigned int *start, unsigned int *end)
1340 {
1341         urb_t *u, *last_urb = NULL;
1342         uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
1343         struct list_head *p;
1344         int ret=-1;
1345         unsigned long flags;
1346         
1347         spin_lock_irqsave (&s->urb_list_lock, flags);
1348         p=s->urb_list.prev;
1349
1350         for (; p != &s->urb_list; p = p->prev) {
1351                 u = list_entry (p, urb_t, urb_list);
1352                 // look for pending URBs with identical pipe handle
1353                 // works only because iso doesn't toggle the data bit!
1354                 if ((urb->pipe == u->pipe) && (urb->dev == u->dev) && (u->status == -EINPROGRESS)) {
1355                         if (!last_urb)
1356                                 *start = u->start_frame;
1357                         last_urb = u;
1358                 }
1359         }
1360         
1361         if (last_urb) {
1362                 *end = (last_urb->start_frame + last_urb->number_of_packets) & 1023;
1363                 ret=0;
1364         }
1365         
1366         spin_unlock_irqrestore(&s->urb_list_lock, flags);
1367         
1368         return ret;
1369 }
1370 /*-------------------------------------------------------------------*/
1371 // adjust start_frame according to scheduling constraints (ASAP etc)
1372
1373 _static int iso_find_start (urb_t *urb)
1374 {
1375         uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
1376         unsigned int now;
1377         unsigned int start_limit = 0, stop_limit = 0, queued_size;
1378         int limits;
1379
1380         now = UHCI_GET_CURRENT_FRAME (s) & 1023;
1381
1382         if ((unsigned) urb->number_of_packets > 900)
1383                 return -EFBIG;
1384         
1385         limits = find_iso_limits (urb, &start_limit, &stop_limit);
1386         queued_size = (stop_limit - start_limit) & 1023;
1387
1388         if (urb->transfer_flags & USB_ISO_ASAP) {
1389                 // first iso
1390                 if (limits) {
1391                         // 10ms setup should be enough //FIXME!
1392                         urb->start_frame = (now + 10) & 1023;
1393                 }
1394                 else {
1395                         urb->start_frame = stop_limit;          //seamless linkage
1396
1397                         if (((now - urb->start_frame) & 1023) <= (unsigned) urb->number_of_packets) {
1398                                 info("iso_find_start: gap in seamless isochronous scheduling");
1399                                 dbg("iso_find_start: now %u start_frame %u number_of_packets %u pipe 0x%08x",
1400                                         now, urb->start_frame, urb->number_of_packets, urb->pipe);
1401                                 urb->start_frame = (now + 5) & 1023;    // 5ms setup should be enough //FIXME!
1402                         }
1403                 }
1404         }
1405         else {
1406                 urb->start_frame &= 1023;
1407                 if (((now - urb->start_frame) & 1023) < (unsigned) urb->number_of_packets) {
1408                         dbg("iso_find_start: now between start_frame and end");
1409                         return -EAGAIN;
1410                 }
1411         }
1412
1413         /* check if either start_frame or start_frame+number_of_packets-1 lies between start_limit and stop_limit */
1414         if (limits)
1415                 return 0;
1416
1417         if (((urb->start_frame - start_limit) & 1023) < queued_size ||
1418             ((urb->start_frame + urb->number_of_packets - 1 - start_limit) & 1023) < queued_size) {
1419                 dbg("iso_find_start: start_frame %u number_of_packets %u start_limit %u stop_limit %u",
1420                         urb->start_frame, urb->number_of_packets, start_limit, stop_limit);
1421                 return -EAGAIN;
1422         }
1423
1424         return 0;
1425 }
1426 /*-------------------------------------------------------------------*/
1427 // submits USB interrupt (ie. polling ;-) 
1428 // ASAP-flag set implicitely
1429 // if period==0, the transfer is only done once
1430
1431 _static int uhci_submit_int_urb (urb_t *urb)
1432 {
1433         uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
1434         urb_priv_t *urb_priv = urb->hcpriv;
1435         int nint, n;
1436         uhci_desc_t *td;
1437         int status, destination;
1438         int info;
1439         unsigned int pipe = urb->pipe;
1440
1441         if (urb->interval < 0 || urb->interval >= 256)
1442                 return -EINVAL;
1443
1444         if (urb->interval == 0)
1445                 nint = 0;
1446         else {
1447                 for (nint = 0, n = 1; nint <= 8; nint++, n += n)        // round interval down to 2^n
1448                  {
1449                         if (urb->interval < n) {
1450                                 urb->interval = n / 2;
1451                                 break;
1452                         }
1453                 }
1454                 nint--;
1455         }
1456
1457         dbg("Rounded interval to %i, chain  %i", urb->interval, nint);
1458
1459         urb->start_frame = UHCI_GET_CURRENT_FRAME (s) & 1023;   // remember start frame, just in case...
1460
1461         urb->number_of_packets = 1;
1462
1463         // INT allows only one packet
1464         if (urb->transfer_buffer_length > usb_maxpacket (urb->dev, pipe, usb_pipeout (pipe)))
1465                 return -EINVAL;
1466
1467         if (alloc_td (s, &td, UHCI_PTR_DEPTH))
1468                 return -ENOMEM;
1469
1470         status = (pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE | TD_CTRL_IOC |
1471                 (urb->transfer_flags & USB_DISABLE_SPD ? 0 : TD_CTRL_SPD) | (3 << 27);
1472
1473         destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid (urb->pipe) |
1474                 (((urb->transfer_buffer_length - 1) & 0x7ff) << 21);
1475
1476
1477         info = destination | (usb_gettoggle (urb->dev, usb_pipeendpoint (pipe), usb_pipeout (pipe)) << TD_TOKEN_TOGGLE);
1478
1479         fill_td (td, status, info, urb_priv->transfer_buffer_dma);
1480         list_add_tail (&td->desc_list, &urb_priv->desc_list);
1481
1482         queue_urb (s, urb);
1483
1484         insert_td_horizontal (s, s->int_chain[nint], td);       // store in INT-TDs
1485
1486         usb_dotoggle (urb->dev, usb_pipeendpoint (pipe), usb_pipeout (pipe));
1487
1488         return 0;
1489 }
1490 /*-------------------------------------------------------------------*/
1491 _static int uhci_submit_iso_urb (urb_t *urb)
1492 {
1493         uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
1494         urb_priv_t *urb_priv = urb->hcpriv;
1495 #ifdef ISO_SANITY_CHECK
1496         int pipe=urb->pipe;
1497         int maxsze = usb_maxpacket (urb->dev, pipe, usb_pipeout (pipe));
1498 #endif
1499         int n, ret, last=0;
1500         uhci_desc_t *td, **tdm;
1501         int status, destination;
1502         unsigned long flags;
1503
1504         __save_flags(flags);
1505         __cli();                      // Disable IRQs to schedule all ISO-TDs in time
1506         ret = iso_find_start (urb);     // adjusts urb->start_frame for later use
1507         
1508         if (ret)
1509                 goto err;
1510
1511         tdm = (uhci_desc_t **) kmalloc (urb->number_of_packets * sizeof (uhci_desc_t*), KMALLOC_FLAG);
1512
1513         if (!tdm) {
1514                 ret = -ENOMEM;
1515                 goto err;
1516         }
1517
1518         memset(tdm, 0, urb->number_of_packets * sizeof (uhci_desc_t*));
1519
1520         // First try to get all TDs. Cause: Removing already inserted TDs can only be done 
1521         // racefree in three steps: unlink TDs, wait one frame, delete TDs. 
1522         // So, this solutions seems simpler...
1523
1524         for (n = 0; n < urb->number_of_packets; n++) {
1525                 dbg("n:%d urb->iso_frame_desc[n].length:%d", n, urb->iso_frame_desc[n].length);
1526                 if (!urb->iso_frame_desc[n].length)
1527                         continue;  // allows ISO striping by setting length to zero in iso_descriptor
1528
1529
1530 #ifdef ISO_SANITY_CHECK
1531                 if(urb->iso_frame_desc[n].length > maxsze) {
1532
1533                         err("submit_iso: urb->iso_frame_desc[%d].length(%d)>%d",n , urb->iso_frame_desc[n].length, maxsze);
1534                         ret=-EINVAL;            
1535                 }
1536                 else
1537 #endif
1538                 if (alloc_td (s, &td, UHCI_PTR_DEPTH)) {
1539                         int i;  // Cleanup allocated TDs
1540
1541                         for (i = 0; i < n; n++)
1542                                 if (tdm[i])
1543                                          delete_desc(s, tdm[i]);
1544                         kfree (tdm);
1545                         goto err;
1546                 }
1547                 last=n;
1548                 tdm[n] = td;
1549         }
1550
1551         status = TD_CTRL_ACTIVE | TD_CTRL_IOS;
1552
1553         destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid (urb->pipe);
1554
1555         // Queue all allocated TDs
1556         for (n = 0; n < urb->number_of_packets; n++) {
1557                 td = tdm[n];
1558                 if (!td)
1559                         continue;
1560                         
1561                 if (n  == last) {
1562                         status |= TD_CTRL_IOC;
1563                         queue_urb (s, urb);
1564                 }
1565
1566                 fill_td (td, status, destination | (((urb->iso_frame_desc[n].length - 1) & 0x7ff) << 21),
1567                          urb_priv->transfer_buffer_dma + urb->iso_frame_desc[n].offset);
1568                 list_add_tail (&td->desc_list, &urb_priv->desc_list);
1569         
1570                 insert_td_horizontal (s, s->iso_td[(urb->start_frame + n) & 1023], td); // store in iso-tds
1571         }
1572
1573         kfree (tdm);
1574         dbg("ISO-INT# %i, start %i, now %i", urb->number_of_packets, urb->start_frame, UHCI_GET_CURRENT_FRAME (s) & 1023);
1575         ret = 0;
1576
1577       err:
1578         __restore_flags(flags);
1579         return ret;
1580 }
1581 /*-------------------------------------------------------------------*/
1582 // returns: 0 (no transfer queued), urb* (this urb already queued)
1583  
1584 _static urb_t* search_dev_ep (uhci_t *s, urb_t *urb)
1585 {
1586         struct list_head *p;
1587         urb_t *tmp;
1588         unsigned int mask = usb_pipecontrol(urb->pipe) ? (~USB_DIR_IN) : (~0);
1589
1590         dbg("search_dev_ep:");
1591
1592         p=s->urb_list.next;
1593
1594         for (; p != &s->urb_list; p = p->next) {
1595                 tmp = list_entry (p, urb_t, urb_list);
1596                 dbg("urb: %p", tmp);
1597                 // we can accept this urb if it is not queued at this time 
1598                 // or if non-iso transfer requests should be scheduled for the same device and pipe
1599                 if ((!usb_pipeisoc(urb->pipe) && (tmp->dev == urb->dev) && !((tmp->pipe ^ urb->pipe) & mask)) ||
1600                     (urb == tmp)) {
1601                         return tmp;     // found another urb already queued for processing
1602                 }
1603         }
1604
1605         return 0;
1606 }
1607 /*-------------------------------------------------------------------*/
1608 _static int uhci_submit_urb (urb_t *urb)
1609 {
1610         uhci_t *s;
1611         urb_priv_t *urb_priv;
1612         int ret = 0, type;
1613         unsigned long flags;
1614         urb_t *queued_urb=NULL;
1615         int bustime;
1616                 
1617         if (!urb->dev || !urb->dev->bus)
1618                 return -ENODEV;
1619
1620         s = (uhci_t*) urb->dev->bus->hcpriv;
1621         //dbg("submit_urb: %p type %d",urb,usb_pipetype(urb->pipe));
1622         
1623         if (!s->running)
1624                 return -ENODEV;
1625         
1626         type = usb_pipetype (urb->pipe);
1627
1628         if (usb_pipedevice (urb->pipe) == s->rh.devnum)
1629                 return rh_submit_urb (urb);     /* virtual root hub */
1630
1631         // Sanity checks
1632         if (usb_maxpacket (urb->dev, urb->pipe, usb_pipeout (urb->pipe)) <= 0) {                
1633                 err("uhci_submit_urb: pipesize for pipe %x is zero", urb->pipe);
1634                 return -EMSGSIZE;
1635         }
1636
1637         if (urb->transfer_buffer_length < 0 && type != PIPE_ISOCHRONOUS) {
1638                 err("uhci_submit_urb: Negative transfer length for urb %p", urb);
1639                 return -EINVAL;
1640         }
1641
1642         usb_inc_dev_use (urb->dev);
1643
1644         spin_lock_irqsave (&s->urb_list_lock, flags);
1645
1646         queued_urb = search_dev_ep (s, urb); // returns already queued urb for that pipe
1647
1648         if (queued_urb) {
1649
1650                 queue_dbg("found bulk urb %p\n", queued_urb);
1651
1652                 if (( type != PIPE_BULK) ||
1653                     ((type == PIPE_BULK) &&
1654                      (!(urb->transfer_flags & USB_QUEUE_BULK) || !(queued_urb->transfer_flags & USB_QUEUE_BULK)))) {
1655                         spin_unlock_irqrestore (&s->urb_list_lock, flags);
1656                         usb_dec_dev_use (urb->dev);
1657                         err("ENXIO %08x, flags %x, urb %p, burb %p",urb->pipe,urb->transfer_flags,urb,queued_urb);
1658                         return -ENXIO;  // urb already queued
1659                 }
1660         }
1661
1662 #ifdef DEBUG_SLAB
1663         urb_priv = kmem_cache_alloc(urb_priv_kmem, SLAB_FLAG);
1664 #else
1665         urb_priv = kmalloc (sizeof (urb_priv_t), KMALLOC_FLAG);
1666 #endif
1667         if (!urb_priv) {
1668                 usb_dec_dev_use (urb->dev);
1669                 spin_unlock_irqrestore (&s->urb_list_lock, flags);
1670                 return -ENOMEM;
1671         }
1672
1673         memset(urb_priv, 0, sizeof(urb_priv_t));
1674         urb->hcpriv = urb_priv;
1675         INIT_LIST_HEAD (&urb_priv->desc_list);
1676
1677         dbg("submit_urb: scheduling %p", urb);
1678         
1679         if (type == PIPE_CONTROL)
1680                 urb_priv->setup_packet_dma = pci_map_single(s->uhci_pci, urb->setup_packet,
1681                                                             sizeof(devrequest), PCI_DMA_TODEVICE);
1682
1683         if (urb->transfer_buffer_length)
1684                 urb_priv->transfer_buffer_dma = pci_map_single(s->uhci_pci,
1685                                                                urb->transfer_buffer,
1686                                                                urb->transfer_buffer_length,
1687                                                                usb_pipein(urb->pipe) ?
1688                                                                PCI_DMA_FROMDEVICE :
1689                                                                PCI_DMA_TODEVICE);
1690
1691         if (type == PIPE_BULK) {
1692         
1693                 if (queued_urb) {
1694                         while (((urb_priv_t*)queued_urb->hcpriv)->next_queued_urb)  // find last queued bulk
1695                                 queued_urb=((urb_priv_t*)queued_urb->hcpriv)->next_queued_urb;
1696                         
1697                         ((urb_priv_t*)queued_urb->hcpriv)->next_queued_urb=urb;
1698                 }
1699                 atomic_inc (&s->avoid_bulk);
1700                 ret = uhci_submit_bulk_urb (urb, queued_urb);
1701                 atomic_dec (&s->avoid_bulk);
1702                 spin_unlock_irqrestore (&s->urb_list_lock, flags);
1703         }
1704         else {
1705                 spin_unlock_irqrestore (&s->urb_list_lock, flags);
1706                 switch (type) {
1707                 case PIPE_ISOCHRONOUS:                  
1708                         if (urb->bandwidth == 0) {      /* not yet checked/allocated */
1709                                 if (urb->number_of_packets <= 0) {
1710                                         ret = -EINVAL;
1711                                         break;
1712                                 }
1713
1714                                 bustime = usb_check_bandwidth (urb->dev, urb);
1715                                 if (bustime < 0) 
1716                                         ret = bustime;
1717                                 else {
1718                                         ret = uhci_submit_iso_urb(urb);
1719                                         if (ret == 0)
1720                                                 usb_claim_bandwidth (urb->dev, urb, bustime, 1);
1721                                 }
1722                         } else {        /* bandwidth is already set */
1723                                 ret = uhci_submit_iso_urb(urb);
1724                         }
1725                         break;
1726                 case PIPE_INTERRUPT:
1727                         if (urb->bandwidth == 0) {      /* not yet checked/allocated */
1728                                 bustime = usb_check_bandwidth (urb->dev, urb);
1729                                 if (bustime < 0)
1730                                         ret = bustime;
1731                                 else {
1732                                         ret = uhci_submit_int_urb(urb);
1733                                         if (ret == 0)
1734                                                 usb_claim_bandwidth (urb->dev, urb, bustime, 0);
1735                                 }
1736                         } else {        /* bandwidth is already set */
1737                                 ret = uhci_submit_int_urb(urb);
1738                         }
1739                         break;
1740                 case PIPE_CONTROL:
1741                         ret = uhci_submit_control_urb (urb);
1742                         break;
1743                 default:
1744                         ret = -EINVAL;
1745                 }
1746         }
1747
1748         dbg("submit_urb: scheduled with ret: %d", ret);
1749         
1750         if (ret != 0) {
1751                 uhci_urb_dma_unmap(s, urb, urb_priv);
1752                 usb_dec_dev_use (urb->dev);
1753 #ifdef DEBUG_SLAB
1754                 kmem_cache_free(urb_priv_kmem, urb_priv);
1755 #else
1756                 kfree (urb_priv);
1757 #endif
1758                 return ret;
1759         }
1760
1761         return 0;
1762 }
1763
1764 // Checks for URB timeout and removes bandwidth reclamation if URB idles too long
1765 _static void uhci_check_timeouts(uhci_t *s)
1766 {
1767         struct list_head *p,*p2;
1768         urb_t *urb;
1769         int type;       
1770
1771         p = s->urb_list.prev;   
1772
1773         while (p != &s->urb_list) {
1774                 urb_priv_t *hcpriv;
1775
1776                 p2 = p;
1777                 p = p->prev;
1778                 urb = list_entry (p2, urb_t, urb_list);
1779                 type = usb_pipetype (urb->pipe);
1780
1781                 hcpriv = (urb_priv_t*)urb->hcpriv;
1782                                 
1783                 if ( urb->timeout && 
1784                         ((hcpriv->started + urb->timeout) < jiffies)) {
1785                         urb->transfer_flags |= USB_TIMEOUT_KILLED | USB_ASYNC_UNLINK;
1786                         async_dbg("uhci_check_timeout: timeout for %p",urb);
1787                         uhci_unlink_urb_async(s, urb, UNLINK_ASYNC_STORE_URB);
1788                 }
1789 #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH
1790                 else if (((type == PIPE_BULK) || (type == PIPE_CONTROL)) &&  
1791                      (hcpriv->use_loop) &&
1792                      ((hcpriv->started + IDLE_TIMEOUT) < jiffies))
1793                         disable_desc_loop(s, urb);
1794 #endif
1795
1796         }
1797         s->timeout_check=jiffies;
1798 }
1799
1800 /*-------------------------------------------------------------------
1801  Virtual Root Hub
1802  -------------------------------------------------------------------*/
1803
1804 _static __u8 root_hub_dev_des[] =
1805 {
1806         0x12,                   /*  __u8  bLength; */
1807         0x01,                   /*  __u8  bDescriptorType; Device */
1808         0x00,                   /*  __u16 bcdUSB; v1.0 */
1809         0x01,
1810         0x09,                   /*  __u8  bDeviceClass; HUB_CLASSCODE */
1811         0x00,                   /*  __u8  bDeviceSubClass; */
1812         0x00,                   /*  __u8  bDeviceProtocol; */
1813         0x08,                   /*  __u8  bMaxPacketSize0; 8 Bytes */
1814         0x00,                   /*  __u16 idVendor; */
1815         0x00,
1816         0x00,                   /*  __u16 idProduct; */
1817         0x00,
1818         0x00,                   /*  __u16 bcdDevice; */
1819         0x00,
1820         0x00,                   /*  __u8  iManufacturer; */
1821         0x02,                   /*  __u8  iProduct; */
1822         0x01,                   /*  __u8  iSerialNumber; */
1823         0x01                    /*  __u8  bNumConfigurations; */
1824 };
1825
1826
1827 /* Configuration descriptor */
1828 _static __u8 root_hub_config_des[] =
1829 {
1830         0x09,                   /*  __u8  bLength; */
1831         0x02,                   /*  __u8  bDescriptorType; Configuration */
1832         0x19,                   /*  __u16 wTotalLength; */
1833         0x00,
1834         0x01,                   /*  __u8  bNumInterfaces; */
1835         0x01,                   /*  __u8  bConfigurationValue; */
1836         0x00,                   /*  __u8  iConfiguration; */
1837         0x40,                   /*  __u8  bmAttributes; 
1838                                    Bit 7: Bus-powered, 6: Self-powered, 5 Remote-wakwup, 4..0: resvd */
1839         0x00,                   /*  __u8  MaxPower; */
1840
1841      /* interface */
1842         0x09,                   /*  __u8  if_bLength; */
1843         0x04,                   /*  __u8  if_bDescriptorType; Interface */
1844         0x00,                   /*  __u8  if_bInterfaceNumber; */
1845         0x00,                   /*  __u8  if_bAlternateSetting; */
1846         0x01,                   /*  __u8  if_bNumEndpoints; */
1847         0x09,                   /*  __u8  if_bInterfaceClass; HUB_CLASSCODE */
1848         0x00,                   /*  __u8  if_bInterfaceSubClass; */
1849         0x00,                   /*  __u8  if_bInterfaceProtocol; */
1850         0x00,                   /*  __u8  if_iInterface; */
1851
1852      /* endpoint */
1853         0x07,                   /*  __u8  ep_bLength; */
1854         0x05,                   /*  __u8  ep_bDescriptorType; Endpoint */
1855         0x81,                   /*  __u8  ep_bEndpointAddress; IN Endpoint 1 */
1856         0x03,                   /*  __u8  ep_bmAttributes; Interrupt */
1857         0x08,                   /*  __u16 ep_wMaxPacketSize; 8 Bytes */
1858         0x00,
1859         0xff                    /*  __u8  ep_bInterval; 255 ms */
1860 };
1861
1862
1863 _static __u8 root_hub_hub_des[] =
1864 {
1865         0x09,                   /*  __u8  bLength; */
1866         0x29,                   /*  __u8  bDescriptorType; Hub-descriptor */
1867         0x02,                   /*  __u8  bNbrPorts; */
1868         0x00,                   /* __u16  wHubCharacteristics; */
1869         0x00,
1870         0x01,                   /*  __u8  bPwrOn2pwrGood; 2ms */
1871         0x00,                   /*  __u8  bHubContrCurrent; 0 mA */
1872         0x00,                   /*  __u8  DeviceRemovable; *** 7 Ports max *** */
1873         0xff                    /*  __u8  PortPwrCtrlMask; *** 7 ports max *** */
1874 };
1875
1876 /*-------------------------------------------------------------------------*/
1877 /* prepare Interrupt pipe transaction data; HUB INTERRUPT ENDPOINT */
1878 _static int rh_send_irq (urb_t *urb)
1879 {
1880         int len = 1;
1881         int i;
1882         uhci_t *uhci = urb->dev->bus->hcpriv;
1883         unsigned int io_addr = uhci->io_addr;
1884         __u16 data = 0;
1885
1886         for (i = 0; i < uhci->rh.numports; i++) {
1887                 data |= ((inw (io_addr + USBPORTSC1 + i * 2) & 0xa) > 0 ? (1 << (i + 1)) : 0);
1888                 len = (i + 1) / 8 + 1;
1889         }
1890
1891         *(__u16 *) urb->transfer_buffer = cpu_to_le16 (data);
1892         urb->actual_length = len;
1893         urb->status = 0;
1894         
1895         if ((data > 0) && (uhci->rh.send != 0)) {
1896                 dbg("Root-Hub INT complete: port1: %x port2: %x data: %x",
1897                      inw (io_addr + USBPORTSC1), inw (io_addr + USBPORTSC2), data);
1898                 urb->complete (urb);
1899         }
1900         return 0;
1901 }
1902
1903 /*-------------------------------------------------------------------------*/
1904 /* Virtual Root Hub INTs are polled by this timer every "intervall" ms */
1905 _static int rh_init_int_timer (urb_t *urb);
1906
1907 _static void rh_int_timer_do (unsigned long ptr)
1908 {
1909         int len;
1910         urb_t *urb = (urb_t*) ptr;
1911         uhci_t *uhci = urb->dev->bus->hcpriv;
1912
1913         if (uhci->rh.send) {
1914                 len = rh_send_irq (urb);
1915                 if (len > 0) {
1916                         urb->actual_length = len;
1917                         if (urb->complete)
1918                                 urb->complete (urb);
1919                 }
1920         }
1921         rh_init_int_timer (urb);
1922 }
1923
1924 /*-------------------------------------------------------------------------*/
1925 /* Root Hub INTs are polled by this timer, polling interval 20ms */
1926
1927 _static int rh_init_int_timer (urb_t *urb)
1928 {
1929         uhci_t *uhci = urb->dev->bus->hcpriv;
1930
1931         uhci->rh.interval = urb->interval;
1932         init_timer (&uhci->rh.rh_int_timer);
1933         uhci->rh.rh_int_timer.function = rh_int_timer_do;
1934         uhci->rh.rh_int_timer.data = (unsigned long) urb;
1935         uhci->rh.rh_int_timer.expires = jiffies + (HZ * 20) / 1000;
1936         add_timer (&uhci->rh.rh_int_timer);
1937
1938         return 0;
1939 }
1940
1941 /*-------------------------------------------------------------------------*/
1942 #define OK(x)                   len = (x); break
1943
1944 #define CLR_RH_PORTSTAT(x) \
1945                 status = inw(io_addr+USBPORTSC1+2*(wIndex-1)); \
1946                 status = (status & 0xfff5) & ~(x); \
1947                 outw(status, io_addr+USBPORTSC1+2*(wIndex-1))
1948
1949 #define SET_RH_PORTSTAT(x) \
1950                 status = inw(io_addr+USBPORTSC1+2*(wIndex-1)); \
1951                 status = (status & 0xfff5) | (x); \
1952                 outw(status, io_addr+USBPORTSC1+2*(wIndex-1))
1953
1954
1955 /*-------------------------------------------------------------------------*/
1956 /****
1957  ** Root Hub Control Pipe
1958  *************************/
1959
1960
1961 _static int rh_submit_urb (urb_t *urb)
1962 {
1963         struct usb_device *usb_dev = urb->dev;
1964         uhci_t *uhci = usb_dev->bus->hcpriv;
1965         unsigned int pipe = urb->pipe;
1966         devrequest *cmd = (devrequest *) urb->setup_packet;
1967         void *data = urb->transfer_buffer;
1968         int leni = urb->transfer_buffer_length;
1969         int len = 0;
1970         int status = 0;
1971         int stat = 0;
1972         int i;
1973         unsigned int io_addr = uhci->io_addr;
1974         __u16 cstatus;
1975
1976         __u16 bmRType_bReq;
1977         __u16 wValue;
1978         __u16 wIndex;
1979         __u16 wLength;
1980
1981         if (usb_pipetype (pipe) == PIPE_INTERRUPT) {
1982                 dbg("Root-Hub submit IRQ: every %d ms", urb->interval);
1983                 uhci->rh.urb = urb;
1984                 uhci->rh.send = 1;
1985                 uhci->rh.interval = urb->interval;
1986                 rh_init_int_timer (urb);
1987
1988                 return 0;
1989         }
1990
1991
1992         bmRType_bReq = cmd->requesttype | cmd->request << 8;
1993         wValue = le16_to_cpu (cmd->value);
1994         wIndex = le16_to_cpu (cmd->index);
1995         wLength = le16_to_cpu (cmd->length);
1996
1997         for (i = 0; i < 8; i++)
1998                 uhci->rh.c_p_r[i] = 0;
1999
2000         dbg("Root-Hub: adr: %2x cmd(%1x): %04x %04x %04x %04x",
2001              uhci->rh.devnum, 8, bmRType_bReq, wValue, wIndex, wLength);
2002
2003         switch (bmRType_bReq) {
2004                 /* Request Destination:
2005                    without flags: Device, 
2006                    RH_INTERFACE: interface, 
2007                    RH_ENDPOINT: endpoint,
2008                    RH_CLASS means HUB here, 
2009                    RH_OTHER | RH_CLASS  almost ever means HUB_PORT here 
2010                  */
2011
2012         case RH_GET_STATUS:
2013                 *(__u16 *) data = cpu_to_le16 (1);
2014                 OK (2);
2015         case RH_GET_STATUS | RH_INTERFACE:
2016                 *(__u16 *) data = cpu_to_le16 (0);
2017                 OK (2);
2018         case RH_GET_STATUS | RH_ENDPOINT:
2019                 *(__u16 *) data = cpu_to_le16 (0);
2020                 OK (2);
2021         case RH_GET_STATUS | RH_CLASS:
2022                 *(__u32 *) data = cpu_to_le32 (0);
2023                 OK (4);         /* hub power ** */
2024         case RH_GET_STATUS | RH_OTHER | RH_CLASS:
2025                 status = inw (io_addr + USBPORTSC1 + 2 * (wIndex - 1));
2026                 cstatus = ((status & USBPORTSC_CSC) >> (1 - 0)) |
2027                         ((status & USBPORTSC_PEC) >> (3 - 1)) |
2028                         (uhci->rh.c_p_r[wIndex - 1] << (0 + 4));
2029                 status = (status & USBPORTSC_CCS) |
2030                         ((status & USBPORTSC_PE) >> (2 - 1)) |
2031                         ((status & USBPORTSC_SUSP) >> (12 - 2)) |
2032                         ((status & USBPORTSC_PR) >> (9 - 4)) |
2033                         (1 << 8) |      /* power on ** */
2034                         ((status & USBPORTSC_LSDA) << (-8 + 9));
2035
2036                 *(__u16 *) data = cpu_to_le16 (status);
2037                 *(__u16 *) (data + 2) = cpu_to_le16 (cstatus);
2038                 OK (4);
2039
2040         case RH_CLEAR_FEATURE | RH_ENDPOINT:
2041                 switch (wValue) {
2042                 case (RH_ENDPOINT_STALL):
2043                         OK (0);
2044                 }
2045                 break;
2046
2047         case RH_CLEAR_FEATURE | RH_CLASS:
2048                 switch (wValue) {
2049                 case (RH_C_HUB_OVER_CURRENT):
2050                         OK (0); /* hub power over current ** */
2051                 }
2052                 break;
2053
2054         case RH_CLEAR_FEATURE | RH_OTHER | RH_CLASS:
2055                 switch (wValue) {
2056                 case (RH_PORT_ENABLE):
2057                         CLR_RH_PORTSTAT (USBPORTSC_PE);
2058                         OK (0);
2059                 case (RH_PORT_SUSPEND):
2060                         CLR_RH_PORTSTAT (USBPORTSC_SUSP);
2061                         OK (0);
2062                 case (RH_PORT_POWER):
2063                         OK (0); /* port power ** */
2064                 case (RH_C_PORT_CONNECTION):
2065                         SET_RH_PORTSTAT (USBPORTSC_CSC);
2066                         OK (0);
2067                 case (RH_C_PORT_ENABLE):
2068                         SET_RH_PORTSTAT (USBPORTSC_PEC);
2069                         OK (0);
2070                 case (RH_C_PORT_SUSPEND):
2071 /*** WR_RH_PORTSTAT(RH_PS_PSSC); */
2072                         OK (0);
2073                 case (RH_C_PORT_OVER_CURRENT):
2074                         OK (0); /* port power over current ** */
2075                 case (RH_C_PORT_RESET):
2076                         uhci->rh.c_p_r[wIndex - 1] = 0;
2077                         OK (0);
2078                 }
2079                 break;
2080
2081         case RH_SET_FEATURE | RH_OTHER | RH_CLASS:
2082                 switch (wValue) {
2083                 case (RH_PORT_SUSPEND):
2084                         SET_RH_PORTSTAT (USBPORTSC_SUSP);
2085                         OK (0);
2086                 case (RH_PORT_RESET):
2087                         SET_RH_PORTSTAT (USBPORTSC_PR);
2088                         uhci_wait_ms (10);
2089                         uhci->rh.c_p_r[wIndex - 1] = 1;
2090                         CLR_RH_PORTSTAT (USBPORTSC_PR);
2091                         udelay (10);
2092                         SET_RH_PORTSTAT (USBPORTSC_PE);
2093                         uhci_wait_ms (10);
2094                         SET_RH_PORTSTAT (0xa);
2095                         OK (0);
2096                 case (RH_PORT_POWER):
2097                         OK (0); /* port power ** */
2098                 case (RH_PORT_ENABLE):
2099                         SET_RH_PORTSTAT (USBPORTSC_PE);
2100                         OK (0);
2101                 }
2102                 break;
2103
2104         case RH_SET_ADDRESS:
2105                 uhci->rh.devnum = wValue;
2106                 OK (0);
2107
2108         case RH_GET_DESCRIPTOR:
2109                 switch ((wValue & 0xff00) >> 8) {
2110                 case (0x01):    /* device descriptor */
2111                         len = min_t(unsigned int, leni,
2112                                   min_t(unsigned int,
2113                                       sizeof (root_hub_dev_des), wLength));
2114                         memcpy (data, root_hub_dev_des, len);
2115                         OK (len);
2116                 case (0x02):    /* configuration descriptor */
2117                         len = min_t(unsigned int, leni,
2118                                   min_t(unsigned int,
2119                                       sizeof (root_hub_config_des), wLength));
2120                         memcpy (data, root_hub_config_des, len);
2121                         OK (len);
2122                 case (0x03):    /* string descriptors */
2123                         len = usb_root_hub_string (wValue & 0xff,
2124                                 uhci->io_addr, "UHCI",
2125                                 data, wLength);
2126                         if (len > 0) {
2127                                 OK(min_t(int, leni, len));
2128                         } else 
2129                                 stat = -EPIPE;
2130                 }
2131                 break;
2132
2133         case RH_GET_DESCRIPTOR | RH_CLASS:
2134                 root_hub_hub_des[2] = uhci->rh.numports;
2135                 len = min_t(unsigned int, leni,
2136                           min_t(unsigned int, sizeof (root_hub_hub_des), wLength));
2137                 memcpy (data, root_hub_hub_des, len);
2138                 OK (len);
2139
2140         case RH_GET_CONFIGURATION:
2141                 *(__u8 *) data = 0x01;
2142                 OK (1);
2143
2144         case RH_SET_CONFIGURATION:
2145                 OK (0);
2146         default:
2147                 stat = -EPIPE;
2148         }
2149
2150         dbg("Root-Hub stat port1: %x port2: %x",
2151              inw (io_addr + USBPORTSC1), inw (io_addr + USBPORTSC2));
2152
2153         urb->actual_length = len;
2154         urb->status = stat;
2155         urb->dev=NULL;
2156         if (urb->complete)
2157                 urb->complete (urb);
2158         return 0;
2159 }
2160 /*-------------------------------------------------------------------------*/
2161
2162 _static int rh_unlink_urb (urb_t *urb)
2163 {
2164         uhci_t *uhci = urb->dev->bus->hcpriv;
2165
2166         if (uhci->rh.urb==urb) {
2167                 dbg("Root-Hub unlink IRQ");
2168                 uhci->rh.send = 0;
2169                 del_timer (&uhci->rh.rh_int_timer);
2170         }
2171         return 0;
2172 }
2173 /*-------------------------------------------------------------------*/
2174
2175 /*
2176  * Map status to standard result codes
2177  *
2178  * <status> is (td->status & 0xFE0000) [a.k.a. uhci_status_bits(td->status)
2179  * <dir_out> is True for output TDs and False for input TDs.
2180  */
2181 _static int uhci_map_status (int status, int dir_out)
2182 {
2183         if (!status)
2184                 return 0;
2185         if (status & TD_CTRL_BITSTUFF)  /* Bitstuff error */
2186                 return -EPROTO;
2187         if (status & TD_CTRL_CRCTIMEO) {        /* CRC/Timeout */
2188                 if (dir_out)
2189                         return -ETIMEDOUT;
2190                 else
2191                         return -EILSEQ;
2192         }
2193         if (status & TD_CTRL_NAK)       /* NAK */
2194                 return -ETIMEDOUT;
2195         if (status & TD_CTRL_BABBLE)    /* Babble */
2196                 return -EPIPE;
2197         if (status & TD_CTRL_DBUFERR)   /* Buffer error */
2198                 return -ENOSR;
2199         if (status & TD_CTRL_STALLED)   /* Stalled */
2200                 return -EPIPE;
2201         if (status & TD_CTRL_ACTIVE)    /* Active */
2202                 return 0;
2203
2204         return -EPROTO;
2205 }
2206
2207 /*
2208  * Only the USB core should call uhci_alloc_dev and uhci_free_dev
2209  */
2210 _static int uhci_alloc_dev (struct usb_device *usb_dev)
2211 {
2212         return 0;
2213 }
2214
2215 _static void uhci_unlink_urbs(uhci_t *s, struct usb_device *usb_dev, int remove_all)
2216 {
2217         unsigned long flags;
2218         struct list_head *p;
2219         struct list_head *p2;
2220         urb_t *urb;
2221
2222         spin_lock_irqsave (&s->urb_list_lock, flags);
2223         p = s->urb_list.prev;   
2224         while (p != &s->urb_list) {
2225                 p2 = p;
2226                 p = p->prev ;
2227                 urb = list_entry (p2, urb_t, urb_list);
2228                 dbg("urb: %p, dev %p, %p", urb, usb_dev,urb->dev);
2229                 
2230                 //urb->transfer_flags |=USB_ASYNC_UNLINK; 
2231                         
2232                 if (remove_all || (usb_dev == urb->dev)) {
2233                         spin_unlock_irqrestore (&s->urb_list_lock, flags);
2234                         warn("forced removing of queued URB %p due to disconnect",urb);
2235                         uhci_unlink_urb(urb);
2236                         urb->dev = NULL; // avoid further processing of this URB
2237                         spin_lock_irqsave (&s->urb_list_lock, flags);
2238                         p = s->urb_list.prev;   
2239                 }
2240         }
2241         spin_unlock_irqrestore (&s->urb_list_lock, flags);
2242 }
2243
2244 _static int uhci_free_dev (struct usb_device *usb_dev)
2245 {
2246         uhci_t *s;
2247         
2248
2249         if(!usb_dev || !usb_dev->bus || !usb_dev->bus->hcpriv)
2250                 return -EINVAL;
2251         
2252         s=(uhci_t*) usb_dev->bus->hcpriv;       
2253         uhci_unlink_urbs(s, usb_dev, 0);
2254
2255         return 0;
2256 }
2257
2258 /*
2259  * uhci_get_current_frame_number()
2260  *
2261  * returns the current frame number for a USB bus/controller.
2262  */
2263 _static int uhci_get_current_frame_number (struct usb_device *usb_dev)
2264 {
2265         return UHCI_GET_CURRENT_FRAME ((uhci_t*) usb_dev->bus->hcpriv);
2266 }
2267
2268 struct usb_operations uhci_device_operations =
2269 {
2270         uhci_alloc_dev,
2271         uhci_free_dev,
2272         uhci_get_current_frame_number,
2273         uhci_submit_urb,
2274         uhci_unlink_urb
2275 };
2276
2277 _static void correct_data_toggles(urb_t *urb)
2278 {
2279         usb_settoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe), 
2280                        !usb_gettoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe)));
2281
2282         while(urb) {
2283                 urb_priv_t *priv=urb->hcpriv;           
2284                 uhci_desc_t *qh = list_entry (priv->desc_list.next, uhci_desc_t, desc_list);
2285                 struct list_head *p = qh->vertical.next;
2286                 uhci_desc_t *td;
2287                 dbg("URB to correct %p\n", urb);
2288         
2289                 for (; p != &qh->vertical; p = p->next) {
2290                         td = list_entry (p, uhci_desc_t, vertical);
2291                         td->hw.td.info^=cpu_to_le32(1<<TD_TOKEN_TOGGLE);
2292                 }
2293                 urb=priv->next_queued_urb;
2294         }
2295 }
2296
2297 /* 
2298  * For IN-control transfers, process_transfer gets a bit more complicated,
2299  * since there are devices that return less data (eg. strings) than they
2300  * have announced. This leads to a queue abort due to the short packet,
2301  * the status stage is not executed. If this happens, the status stage
2302  * is manually re-executed.
2303  * mode: PROCESS_TRANSFER_REGULAR: regular (unlink QH)
2304  *       PROCESS_TRANSFER_DONT_UNLINK: QHs already unlinked (for async unlink_urb)
2305  */
2306
2307 _static int process_transfer (uhci_t *s, urb_t *urb, int mode)
2308 {
2309         int ret = 0;
2310         urb_priv_t *urb_priv = urb->hcpriv;
2311         struct list_head *qhl = urb_priv->desc_list.next;
2312         uhci_desc_t *qh = list_entry (qhl, uhci_desc_t, desc_list);
2313         struct list_head *p = qh->vertical.next;
2314         uhci_desc_t *desc= list_entry (urb_priv->desc_list.prev, uhci_desc_t, desc_list);
2315         uhci_desc_t *last_desc = list_entry (desc->vertical.prev, uhci_desc_t, vertical);
2316         int data_toggle = usb_gettoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe));      // save initial data_toggle
2317         int maxlength;  // extracted and remapped info from TD
2318         int actual_length;
2319         int status = 0;
2320
2321         //dbg("process_transfer: urb %p, urb_priv %p, qh %p last_desc %p\n",urb,urb_priv, qh, last_desc);
2322
2323         /* if the status phase has been retriggered and the
2324            queue is empty or the last status-TD is inactive, the retriggered
2325            status stage is completed
2326          */
2327
2328         if (urb_priv->flags && 
2329             ((qh->hw.qh.element == cpu_to_le32(UHCI_PTR_TERM)) || !is_td_active(desc)))
2330                 goto transfer_finished;
2331
2332         urb->actual_length=0;
2333
2334         for (; p != &qh->vertical; p = p->next) {
2335                 desc = list_entry (p, uhci_desc_t, vertical);
2336
2337                 if (is_td_active(desc)) {       // do not process active TDs
2338                         if (mode == CLEAN_TRANSFER_DELETION_MARK) // if called from async_unlink
2339                                 uhci_clean_transfer(s, urb, qh, CLEAN_TRANSFER_DELETION_MARK);
2340                         return ret;
2341                 }
2342         
2343                 actual_length = uhci_actual_length(le32_to_cpu(desc->hw.td.status));            // extract transfer parameters from TD
2344                 maxlength = (((le32_to_cpu(desc->hw.td.info) >> 21) & 0x7ff) + 1) & 0x7ff;
2345                 status = uhci_map_status (uhci_status_bits (le32_to_cpu(desc->hw.td.status)), usb_pipeout (urb->pipe));
2346
2347                 if (status == -EPIPE) {                 // see if EP is stalled
2348                         // set up stalled condition
2349                         usb_endpoint_halt (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe));
2350                 }
2351
2352                 if (status && (status != -EPIPE)) {     // if any error occurred stop processing of further TDs
2353                         // only set ret if status returned an error
2354   is_error:
2355                         ret = status;
2356                         urb->error_count++;
2357                         break;
2358                 }
2359                 else if ((le32_to_cpu(desc->hw.td.info) & 0xff) != USB_PID_SETUP)
2360                         urb->actual_length += actual_length;
2361
2362                 // got less data than requested
2363                 if ( (actual_length < maxlength)) {
2364                         if (urb->transfer_flags & USB_DISABLE_SPD) {
2365                                 status = -EREMOTEIO;    // treat as real error
2366                                 dbg("process_transfer: SPD!!");
2367                                 break;  // exit after this TD because SP was detected
2368                         }
2369
2370                         // short read during control-IN: re-start status stage
2371                         if ((usb_pipetype (urb->pipe) == PIPE_CONTROL)) {
2372                                 if (uhci_packetid(le32_to_cpu(last_desc->hw.td.info)) == USB_PID_OUT) {
2373                         
2374                                         set_qh_element(qh, last_desc->dma_addr);  // re-trigger status stage
2375                                         dbg("short packet during control transfer, retrigger status stage @ %p",last_desc);
2376                                         urb_priv->flags = 1; // mark as short control packet
2377                                         return 0;
2378                                 }
2379                         }
2380                         // all other cases: short read is OK
2381                         data_toggle = uhci_toggle (le32_to_cpu(desc->hw.td.info));
2382                         break;
2383                 }
2384                 else if (status)
2385                         goto is_error;
2386
2387                 data_toggle = uhci_toggle (le32_to_cpu(desc->hw.td.info));
2388                 queue_dbg("process_transfer: len:%d status:%x mapped:%x toggle:%d", actual_length, le32_to_cpu(desc->hw.td.status),status, data_toggle);      
2389
2390         }
2391
2392         if (usb_pipetype (urb->pipe) == PIPE_BULK ) {  /* toggle correction for short bulk transfers (nonqueued/queued) */
2393
2394                 urb_priv_t *priv=(urb_priv_t*)urb->hcpriv;
2395                 urb_t *next_queued_urb=priv->next_queued_urb;
2396
2397                 if (next_queued_urb) {
2398                         urb_priv_t *next_priv=(urb_priv_t*)next_queued_urb->hcpriv;
2399                         uhci_desc_t *qh = list_entry (next_priv->desc_list.next, uhci_desc_t, desc_list);
2400                         uhci_desc_t *first_td=list_entry (qh->vertical.next, uhci_desc_t, vertical);
2401
2402                         if (data_toggle == uhci_toggle (le32_to_cpu(first_td->hw.td.info))) {
2403                                 err("process_transfer: fixed toggle");
2404                                 correct_data_toggles(next_queued_urb);
2405                         }                                               
2406                 }
2407                 else
2408                         usb_settoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe), !data_toggle);          
2409         }
2410
2411  transfer_finished:
2412         
2413         uhci_clean_transfer(s, urb, qh, mode);
2414
2415         urb->status = status;
2416
2417 #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH   
2418         disable_desc_loop(s,urb);
2419 #endif  
2420
2421         queue_dbg("process_transfer: (end) urb %p, wanted len %d, len %d status %x err %d",
2422                 urb,urb->transfer_buffer_length,urb->actual_length, urb->status, urb->error_count);
2423         return ret;
2424 }
2425
2426 _static int process_interrupt (uhci_t *s, urb_t *urb)
2427 {
2428         int i, ret = -EINPROGRESS;
2429         urb_priv_t *urb_priv = urb->hcpriv;
2430         struct list_head *p = urb_priv->desc_list.next;
2431         uhci_desc_t *desc = list_entry (urb_priv->desc_list.prev, uhci_desc_t, desc_list);
2432
2433         int actual_length;
2434         int status = 0;
2435
2436         //dbg("urb contains interrupt request");
2437
2438         for (i = 0; p != &urb_priv->desc_list; p = p->next, i++)        // Maybe we allow more than one TD later ;-)
2439         {
2440                 desc = list_entry (p, uhci_desc_t, desc_list);
2441
2442                 if (is_td_active(desc)) {
2443                         // do not process active TDs
2444                         //dbg("TD ACT Status @%p %08x",desc,le32_to_cpu(desc->hw.td.status));
2445                         break;
2446                 }
2447
2448                 if (!desc->hw.td.status & cpu_to_le32(TD_CTRL_IOC)) {
2449                         // do not process one-shot TDs, no recycling
2450                         break;
2451                 }
2452                 // extract transfer parameters from TD
2453
2454                 actual_length = uhci_actual_length(le32_to_cpu(desc->hw.td.status));
2455                 status = uhci_map_status (uhci_status_bits (le32_to_cpu(desc->hw.td.status)), usb_pipeout (urb->pipe));
2456
2457                 // see if EP is stalled
2458                 if (status == -EPIPE) {
2459                         // set up stalled condition
2460                         usb_endpoint_halt (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe));
2461                 }
2462
2463                 // if any error occurred: ignore this td, and continue
2464                 if (status != 0) {
2465                         //uhci_show_td (desc);
2466                         urb->error_count++;
2467                         goto recycle;
2468                 }
2469                 else
2470                         urb->actual_length = actual_length;
2471
2472         recycle:
2473                 uhci_urb_dma_sync(s, urb, urb->hcpriv);
2474                 if (urb->complete) {
2475                         //dbg("process_interrupt: calling completion, status %i",status);
2476                         urb->status = status;
2477                         ((urb_priv_t*)urb->hcpriv)->flags=1; // if unlink_urb is called during completion
2478
2479                         spin_unlock(&s->urb_list_lock);
2480                         
2481                         urb->complete ((struct urb *) urb);
2482                         
2483                         spin_lock(&s->urb_list_lock);
2484
2485                         ((urb_priv_t*)urb->hcpriv)->flags=0;                                    
2486                 }
2487                 
2488                 if ((urb->status != -ECONNABORTED) && (urb->status != ECONNRESET) &&
2489                             (urb->status != -ENOENT)) {
2490
2491                         urb->status = -EINPROGRESS;
2492
2493                         // Recycle INT-TD if interval!=0, else mark TD as one-shot
2494                         if (urb->interval) {
2495                                 
2496                                 desc->hw.td.info &= cpu_to_le32(~(1 << TD_TOKEN_TOGGLE));
2497                                 if (status==0) {
2498                                         ((urb_priv_t*)urb->hcpriv)->started=jiffies;
2499                                         desc->hw.td.info |= cpu_to_le32((usb_gettoggle (urb->dev, usb_pipeendpoint (urb->pipe),
2500                                                                             usb_pipeout (urb->pipe)) << TD_TOKEN_TOGGLE));
2501                                         usb_dotoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe));
2502                                 } else {
2503                                         desc->hw.td.info |= cpu_to_le32((!usb_gettoggle (urb->dev, usb_pipeendpoint (urb->pipe),
2504                                                                              usb_pipeout (urb->pipe)) << TD_TOKEN_TOGGLE));
2505                                 }
2506                                 desc->hw.td.status= cpu_to_le32((urb->pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE | TD_CTRL_IOC |
2507                                         (urb->transfer_flags & USB_DISABLE_SPD ? 0 : TD_CTRL_SPD) | (3 << 27));
2508                                 mb();
2509                         }
2510                         else {
2511                                 uhci_unlink_urb_async(s, urb, UNLINK_ASYNC_STORE_URB);
2512                                 clr_td_ioc(desc); // inactivate TD
2513                         }
2514                 }
2515         }
2516
2517         return ret;
2518 }
2519
2520 // mode: PROCESS_ISO_REGULAR: processing only for done TDs, unlink TDs
2521 // mode: PROCESS_ISO_FORCE: force processing, don't unlink TDs (already unlinked)
2522
2523 _static int process_iso (uhci_t *s, urb_t *urb, int mode)
2524 {
2525         int i;
2526         int ret = 0;
2527         urb_priv_t *urb_priv = urb->hcpriv;
2528         struct list_head *p = urb_priv->desc_list.next, *p_tmp;
2529         uhci_desc_t *desc = list_entry (urb_priv->desc_list.prev, uhci_desc_t, desc_list);
2530
2531         dbg("urb contains iso request");
2532         if (is_td_active(desc) && mode==PROCESS_ISO_REGULAR)
2533                 return -EXDEV;  // last TD not finished
2534
2535         urb->error_count = 0;
2536         urb->actual_length = 0;
2537         urb->status = 0;
2538         dbg("process iso urb %p, %li, %i, %i, %i %08x",urb,jiffies,UHCI_GET_CURRENT_FRAME(s),
2539             urb->number_of_packets,mode,le32_to_cpu(desc->hw.td.status));
2540
2541         for (i = 0; p != &urb_priv->desc_list;  i++) {
2542                 desc = list_entry (p, uhci_desc_t, desc_list);
2543                 
2544                 //uhci_show_td(desc);
2545                 if (is_td_active(desc)) {
2546                         // means we have completed the last TD, but not the TDs before
2547                         desc->hw.td.status &= cpu_to_le32(~TD_CTRL_ACTIVE);
2548                         dbg("TD still active (%x)- grrr. paranoia!", le32_to_cpu(desc->hw.td.status));
2549                         ret = -EXDEV;
2550                         urb->iso_frame_desc[i].status = ret;
2551                         unlink_td (s, desc, 1);
2552                         // FIXME: immediate deletion may be dangerous
2553                         goto err;
2554                 }
2555
2556                 if (mode == PROCESS_ISO_REGULAR)
2557                         unlink_td (s, desc, 1);
2558
2559                 if (urb->number_of_packets <= i) {
2560                         dbg("urb->number_of_packets (%d)<=(%d)", urb->number_of_packets, i);
2561                         ret = -EINVAL;
2562                         goto err;
2563                 }
2564
2565                 urb->iso_frame_desc[i].actual_length = uhci_actual_length(le32_to_cpu(desc->hw.td.status));
2566                 urb->iso_frame_desc[i].status = uhci_map_status (uhci_status_bits (le32_to_cpu(desc->hw.td.status)), usb_pipeout (urb->pipe));
2567                 urb->actual_length += urb->iso_frame_desc[i].actual_length;
2568
2569               err:
2570
2571                 if (urb->iso_frame_desc[i].status != 0) {
2572                         urb->error_count++;
2573                         urb->status = urb->iso_frame_desc[i].status;
2574                 }
2575                 dbg("process_iso: %i: len:%d %08x status:%x",
2576                      i, urb->iso_frame_desc[i].actual_length, le32_to_cpu(desc->hw.td.status),urb->iso_frame_desc[i].status);
2577
2578                 p_tmp = p;
2579                 p = p->next;
2580                 list_del (p_tmp);
2581                 delete_desc (s, desc);
2582         }
2583         
2584         dbg("process_iso: exit %i (%d), actual_len %i", i, ret,urb->actual_length);
2585         return ret;
2586 }
2587
2588
2589 _static int process_urb (uhci_t *s, struct list_head *p)
2590 {
2591         int ret = 0;
2592         urb_t *urb;
2593
2594         urb=list_entry (p, urb_t, urb_list);
2595         //dbg("process_urb: found queued urb: %p", urb);
2596
2597         switch (usb_pipetype (urb->pipe)) {
2598         case PIPE_CONTROL:
2599                 ret = process_transfer (s, urb, CLEAN_TRANSFER_REGULAR);
2600                 break;
2601         case PIPE_BULK:
2602                 if (!s->avoid_bulk.counter)
2603                         ret = process_transfer (s, urb, CLEAN_TRANSFER_REGULAR);
2604                 else
2605                         return 0;
2606                 break;
2607         case PIPE_ISOCHRONOUS:
2608                 ret = process_iso (s, urb, PROCESS_ISO_REGULAR);
2609                 break;
2610         case PIPE_INTERRUPT:
2611                 ret = process_interrupt (s, urb);
2612                 break;
2613         }
2614
2615         if (urb->status != -EINPROGRESS) {
2616                 urb_priv_t *urb_priv;
2617                 struct usb_device *usb_dev;
2618                 
2619                 usb_dev=urb->dev;
2620
2621                 /* Release bandwidth for Interrupt or Iso transfers */
2622                 if (urb->bandwidth) {
2623                         if (usb_pipetype(urb->pipe)==PIPE_ISOCHRONOUS)
2624                                 usb_release_bandwidth (urb->dev, urb, 1);
2625                         else if (usb_pipetype(urb->pipe)==PIPE_INTERRUPT && urb->interval)
2626                                 usb_release_bandwidth (urb->dev, urb, 0);
2627                 }
2628
2629                 dbg("dequeued urb: %p", urb);
2630                 dequeue_urb (s, urb);
2631
2632                 urb_priv = urb->hcpriv;
2633
2634                 uhci_urb_dma_unmap(s, urb, urb_priv);
2635
2636 #ifdef DEBUG_SLAB
2637                 kmem_cache_free(urb_priv_kmem, urb_priv);
2638 #else
2639                 kfree (urb_priv);
2640 #endif
2641
2642                 if ((usb_pipetype (urb->pipe) != PIPE_INTERRUPT)) {  // process_interrupt does completion on its own            
2643                         urb_t *next_urb = urb->next;
2644                         int is_ring = 0;
2645                         int contains_killed = 0;
2646                         int loop_count=0;
2647                         
2648                         if (next_urb) {
2649                                 // Find out if the URBs are linked to a ring
2650                                 while  (next_urb != NULL && next_urb != urb && loop_count < MAX_NEXT_COUNT) {
2651                                         if (next_urb->status == -ENOENT) {// killed URBs break ring structure & resubmission
2652                                                 contains_killed = 1;
2653                                                 break;
2654                                         }       
2655                                         next_urb = next_urb->next;
2656                                         loop_count++;
2657                                 }
2658                                 
2659                                 if (loop_count == MAX_NEXT_COUNT)
2660                                         err("process_urb: Too much linked URBs in ring detection!");
2661
2662                                 if (next_urb == urb)
2663                                         is_ring=1;
2664                         }                       
2665
2666                         // Submit idle/non-killed URBs linked with urb->next
2667                         // Stop before the current URB                          
2668                         
2669                         next_urb = urb->next;   
2670                         if (next_urb && !contains_killed) {