drivers/usb/host/usb-uhci.c

   1 /*
   2  * Universal Host Controller Interface driver for USB (take II).
   3  *
   4  * (c) 1999-2001 Georg Acher, acher@in.tum.de (executive slave) (base guitar)
   5  *               Deti Fliegl, deti@fliegl.de (executive slave) (lead voice)
   6  *               Thomas Sailer, sailer@ife.ee.ethz.ch (chief consultant) (cheer leader)
   7  *               Roman Weissgaerber, weissg@vienna.at (virt root hub) (studio porter)
   8  * (c) 2000      Yggdrasil Computing, Inc. (port of new PCI interface support
   9  *               from usb-ohci.c by Adam Richter, adam@yggdrasil.com).
  10  * (C) 2000      David Brownell, david-b@pacbell.net (usb-ohci.c)
  11  *
  12  * HW-initalization based on material of
  13  *
  14  * (C) Copyright 1999 Linus Torvalds
  15  * (C) Copyright 1999 Johannes Erdfelt
  16  * (C) Copyright 1999 Randy Dunlap
  17  * (C) Copyright 1999 Gregory P. Smith
  18  *
  19  * $Id: usb-uhci.c,v 1.275 2002/01/19 20:57:33 acher Exp $
  20  */
  21
  22 #include <linux/config.h>
  23 #include <linux/module.h>
  24 #include <linux/pci.h>
  25 #include <linux/kernel.h>
  26 #include <linux/delay.h>
  27 #include <linux/ioport.h>
  28 #include <linux/sched.h>
  29 #include <linux/slab.h>
  30 #include <linux/smp_lock.h>
  31 #include <linux/errno.h>
  32 #include <linux/unistd.h>
  33 #include <linux/interrupt.h>    /* for in_interrupt() */
  34 #include <linux/init.h>
  35 #include <linux/version.h>
  36 #include <linux/pm.h>
  37 #include <linux/timer.h>
  38
  39 #include <asm/uaccess.h>
  40 #include <asm/io.h>
  41 #include <asm/irq.h>
  42 #include <asm/system.h>
  43
  44 /* This enables more detailed sanity checks in submit_iso */
  45 //#define ISO_SANITY_CHECK
  46
  47 /* This enables debug printks */
  48 #define DEBUG
  49
  50 /* This enables all symbols to be exported, to ease debugging oopses */
  51 //#define DEBUG_SYMBOLS
  52
  53 /* This enables an extra UHCI slab for memory debugging */
  54 #define DEBUG_SLAB
  55
  56 #define VERSTR "$Revision: 1.275 $ time " __TIME__ " " __DATE__
  57
  58 #include <linux/usb.h>
  59 #include "usb-uhci.h"
  60 #include "usb-uhci-debug.h"
  61
  62 #include "../hcd.h"
  63
  64 /*
  65  * Version Information
  66  */
  67 #define DRIVER_VERSION "v1.275"
  68 #define DRIVER_AUTHOR "Georg Acher, Deti Fliegl, Thomas Sailer, Roman Weissgaerber"
  69 #define DRIVER_DESC "USB Universal Host Controller Interface driver"
  70
  71 #undef DEBUG
  72 #undef dbg
  73 #define dbg(format, arg...) do {} while (0)
  74 #define DEBUG_SYMBOLS
  75 #ifdef DEBUG_SYMBOLS
  76         #define _static
  77         #ifndef EXPORT_SYMTAB
  78                 #define EXPORT_SYMTAB
  79         #endif
  80 #else
  81         #define _static static
  82 #endif
  83
  84 #define queue_dbg dbg //err
  85 #define async_dbg dbg //err
  86
  87 #ifdef DEBUG_SLAB
  88         static kmem_cache_t *urb_priv_kmem;
  89 #endif
  90
  91 #define SLAB_FLAG     (in_interrupt () || current->state != TASK_RUNNING ? SLAB_ATOMIC : SLAB_NOIO)
  92 #define KMALLOC_FLAG  (in_interrupt () || current->state != TASK_RUNNING ? GFP_ATOMIC : GFP_NOIO)
  93
  94 /* CONFIG_USB_UHCI_HIGH_BANDWITH turns on Full Speed Bandwidth
  95  * Reclamation: feature that puts loop on descriptor loop when
  96  * there's some transfer going on. With FSBR, USB performance
  97  * is optimal, but PCI can be slowed down up-to 5 times, slowing down
  98  * system performance (eg. framebuffer devices).
  99  */
 100 #define CONFIG_USB_UHCI_HIGH_BANDWIDTH
 101
 102 /* *_DEPTH_FIRST puts descriptor in depth-first mode. This has
 103  * somehow similar effect to FSBR (higher speed), but does not
 104  * slow PCI down. OTOH USB performace is slightly slower than
 105  * in FSBR case and single device could hog whole USB, starving
 106  * other devices.
 107  */
 108 #define USE_CTRL_DEPTH_FIRST 0  // 0: Breadth first, 1: Depth first
 109 #define USE_BULK_DEPTH_FIRST 0  // 0: Breadth first, 1: Depth first
 110
 111 /* Turning off both CONFIG_USB_UHCI_HIGH_BANDWITH and *_DEPTH_FIRST
 112  * will lead to <64KB/sec performance over USB for bulk transfers targeting
 113  * one device's endpoint. You probably do not want to do that.
 114  */
 115
 116 // stop bandwidth reclamation after (roughly) 50ms
 117 #define IDLE_TIMEOUT  (HZ/20)
 118
 119 // Suppress HC interrupt error messages for 5s
 120 #define ERROR_SUPPRESSION_TIME (HZ*5)
 121
 122 _static int rh_submit_urb (struct urb *urb);
 123 _static int rh_unlink_urb (struct urb *urb);
 124 _static int delete_qh (uhci_t *s, uhci_desc_t *qh);
 125 _static int process_transfer (uhci_t *s, struct urb *urb, int mode);
 126 _static int process_interrupt (uhci_t *s, struct urb *urb);
 127 _static int process_iso (uhci_t *s, struct urb *urb, int force);
 128
 129 // How much URBs with ->next are walked
 130 #define MAX_NEXT_COUNT 2048
 131
 132 static uhci_t *devs = NULL;
 133
 134 /* used by userspace UHCI data structure dumper */
 135 uhci_t **uhci_devices = &devs;
 136
 137 /*-------------------------------------------------------------------*/
 138 // Cleans up collected QHs, but not more than 100 in one go
 139 void clean_descs(uhci_t *s, int force)
 140 {
 141         struct list_head *q;
 142         uhci_desc_t *qh;
 143         int now=UHCI_GET_CURRENT_FRAME(s), n=0;
 144
 145         q=s->free_desc.prev;
 146
 147         while (q != &s->free_desc && (force || n<100)) {
 148                 qh = list_entry (q, uhci_desc_t, horizontal);
 149                 q=qh->horizontal.prev;
 150
 151                 if ((qh->last_used!=now) || force)
 152                         delete_qh(s,qh);
 153                 n++;
 154         }
 155 }
 156 /*-------------------------------------------------------------------*/
 157 _static void uhci_switch_timer_int(uhci_t *s)
 158 {
 159
 160         if (!list_empty(&s->urb_unlinked))
 161                 set_td_ioc(s->td1ms);
 162         else
 163                 clr_td_ioc(s->td1ms);
 164
 165         if (s->timeout_urbs)
 166                 set_td_ioc(s->td32ms);
 167         else
 168                 clr_td_ioc(s->td32ms);
 169         wmb();
 170 }
 171 /*-------------------------------------------------------------------*/
 172 #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH
 173 _static void enable_desc_loop(uhci_t *s, struct urb *urb)
 174 {
 175         unsigned long flags;
 176
 177         if (urb->transfer_flags & USB_NO_FSBR)
 178                 return;
 179
 180         spin_lock_irqsave (&s->qh_lock, flags);
 181         s->chain_end->hw.qh.head&=cpu_to_le32(~UHCI_PTR_TERM);
 182         mb();
 183         s->loop_usage++;
 184         ((urb_priv_t*)urb->hcpriv)->use_loop=1;
 185         spin_unlock_irqrestore (&s->qh_lock, flags);
 186 }
 187 /*-------------------------------------------------------------------*/
 188 _static void disable_desc_loop(uhci_t *s, struct urb *urb)
 189 {
 190         unsigned long flags;
 191
 192         if (urb->transfer_flags & USB_NO_FSBR)
 193                 return;
 194
 195         spin_lock_irqsave (&s->qh_lock, flags);
 196         if (((urb_priv_t*)urb->hcpriv)->use_loop) {
 197                 s->loop_usage--;
 198
 199                 if (!s->loop_usage) {
 200                         s->chain_end->hw.qh.head|=cpu_to_le32(UHCI_PTR_TERM);
 201                         mb();
 202                 }
 203                 ((urb_priv_t*)urb->hcpriv)->use_loop=0;
 204         }
 205         spin_unlock_irqrestore (&s->qh_lock, flags);
 206 }
 207 #endif
 208 /*-------------------------------------------------------------------*/
 209 _static void queue_urb_unlocked (uhci_t *s, struct urb *urb)
 210 {
 211         struct list_head *p=&urb->urb_list;
 212 #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH
 213         {
 214                 int type;
 215                 type=usb_pipetype (urb->pipe);
 216
 217                 if ((type == PIPE_BULK) || (type == PIPE_CONTROL))
 218                         enable_desc_loop(s, urb);
 219         }
 220 #endif
 221         urb->status = -EINPROGRESS;
 222         ((urb_priv_t*)urb->hcpriv)->started=jiffies;
 223         list_add (p, &s->urb_list);
 224         if (urb->timeout)
 225                 s->timeout_urbs++;
 226         uhci_switch_timer_int(s);
 227 }
 228 /*-------------------------------------------------------------------*/
 229 _static void queue_urb (uhci_t *s, struct urb *urb)
 230 {
 231         unsigned long flags=0;
 232
 233         spin_lock_irqsave (&s->urb_list_lock, flags);
 234         queue_urb_unlocked(s,urb);
 235         spin_unlock_irqrestore (&s->urb_list_lock, flags);
 236 }
 237 /*-------------------------------------------------------------------*/
 238 _static void dequeue_urb (uhci_t *s, struct urb *urb)
 239 {
 240 #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH
 241         int type;
 242
 243         type=usb_pipetype (urb->pipe);
 244
 245         if ((type == PIPE_BULK) || (type == PIPE_CONTROL))
 246                 disable_desc_loop(s, urb);
 247 #endif
 248
 249         list_del (&urb->urb_list);
 250         if (urb->timeout && s->timeout_urbs)
 251                 s->timeout_urbs--;
 252
 253 }
 254 /*-------------------------------------------------------------------*/
 255 _static int alloc_td (uhci_t *s, uhci_desc_t ** new, int flags)
 256 {
 257         dma_addr_t dma_handle;
 258
 259         *new = pci_pool_alloc(s->desc_pool, GFP_DMA | GFP_ATOMIC, &dma_handle);
 260         if (!*new)
 261                 return -ENOMEM;
 262         memset (*new, 0, sizeof (uhci_desc_t));
 263         (*new)->dma_addr = dma_handle;
 264         set_td_link((*new), UHCI_PTR_TERM | (flags & UHCI_PTR_BITS));   // last by default
 265         (*new)->type = TD_TYPE;
 266         mb();
 267         INIT_LIST_HEAD (&(*new)->vertical);
 268         INIT_LIST_HEAD (&(*new)->horizontal);
 269
 270         return 0;
 271 }
 272 /*-------------------------------------------------------------------*/
 273 // append a qh to td.link physically, the SW linkage is not affected
 274 _static void append_qh(uhci_t *s, uhci_desc_t *td, uhci_desc_t* qh, int  flags)
 275 {
 276         unsigned long xxx;
 277
 278         spin_lock_irqsave (&s->td_lock, xxx);
 279
 280         set_td_link(td, qh->dma_addr | (flags & UHCI_PTR_DEPTH) | UHCI_PTR_QH);
 281
 282         mb();
 283         spin_unlock_irqrestore (&s->td_lock, xxx);
 284 }
 285 /*-------------------------------------------------------------------*/
 286 /* insert td at last position in td-list of qh (vertical) */
 287 _static int insert_td (uhci_t *s, uhci_desc_t *qh, uhci_desc_t* new, int flags)
 288 {
 289         uhci_desc_t *prev;
 290         unsigned long xxx;
 291
 292         spin_lock_irqsave (&s->td_lock, xxx);
 293
 294         list_add_tail (&new->vertical, &qh->vertical);
 295
 296         prev = list_entry (new->vertical.prev, uhci_desc_t, vertical);
 297
 298         if (qh == prev ) {
 299                 // virgin qh without any tds
 300                 set_qh_element(qh, new->dma_addr | UHCI_PTR_TERM);
 301         }
 302         else {
 303                 // already tds inserted, implicitely remove TERM bit of prev
 304                 set_td_link(prev, new->dma_addr | (flags & UHCI_PTR_DEPTH));
 305         }
 306         mb();
 307         spin_unlock_irqrestore (&s->td_lock, xxx);
 308
 309         return 0;
 310 }
 311 /*-------------------------------------------------------------------*/
 312 /* insert new_td after td (horizontal) */
 313 _static int insert_td_horizontal (uhci_t *s, uhci_desc_t *td, uhci_desc_t* new)
 314 {
 315         uhci_desc_t *next;
 316         unsigned long flags;
 317
 318         spin_lock_irqsave (&s->td_lock, flags);
 319
 320         next = list_entry (td->horizontal.next, uhci_desc_t, horizontal);
 321         list_add (&new->horizontal, &td->horizontal);
 322         new->hw.td.link = td->hw.td.link;
 323         set_td_link(td, new->dma_addr);
 324         mb();
 325         spin_unlock_irqrestore (&s->td_lock, flags);
 326
 327         return 0;
 328 }
 329 /*-------------------------------------------------------------------*/
 330 _static int unlink_td (uhci_t *s, uhci_desc_t *element, int phys_unlink)
 331 {
 332         uhci_desc_t *next, *prev;
 333         int dir = 0;
 334         unsigned long flags;
 335
 336         spin_lock_irqsave (&s->td_lock, flags);
 337
 338         next = list_entry (element->vertical.next, uhci_desc_t, vertical);
 339
 340         if (next == element) {
 341                 dir = 1;
 342                 prev = list_entry (element->horizontal.prev, uhci_desc_t, horizontal);
 343         }
 344         else
 345                 prev = list_entry (element->vertical.prev, uhci_desc_t, vertical);
 346
 347         if (phys_unlink) {
 348                 // really remove HW linking
 349                 if (prev->type == TD_TYPE)
 350                         prev->hw.td.link = element->hw.td.link;
 351                 else
 352                         prev->hw.qh.element = element->hw.td.link;
 353         }
 354
 355         mb ();
 356
 357         if (dir == 0)
 358                 list_del (&element->vertical);
 359         else
 360                 list_del (&element->horizontal);
 361
 362         spin_unlock_irqrestore (&s->td_lock, flags);
 363
 364         return 0;
 365 }
 366
 367 /*-------------------------------------------------------------------*/
 368 _static int delete_desc (uhci_t *s, uhci_desc_t *element)
 369 {
 370         pci_pool_free(s->desc_pool, element, element->dma_addr);
 371         return 0;
 372 }
 373 /*-------------------------------------------------------------------*/
 374 // Allocates qh element
 375 _static int alloc_qh (uhci_t *s, uhci_desc_t ** new)
 376 {
 377         dma_addr_t dma_handle;
 378
 379         *new = pci_pool_alloc(s->desc_pool, GFP_DMA | GFP_ATOMIC, &dma_handle);
 380         if (!*new)
 381                 return -ENOMEM;
 382         memset (*new, 0, sizeof (uhci_desc_t));
 383         (*new)->dma_addr = dma_handle;
 384         set_qh_head(*new, UHCI_PTR_TERM);
 385         set_qh_element(*new, UHCI_PTR_TERM);
 386         (*new)->type = QH_TYPE;
 387
 388         mb();
 389         INIT_LIST_HEAD (&(*new)->horizontal);
 390         INIT_LIST_HEAD (&(*new)->vertical);
 391
 392         dbg("Allocated qh @ %p", *new);
 393
 394         return 0;
 395 }
 396 /*-------------------------------------------------------------------*/
 397 // inserts new qh before/after the qh at pos
 398 // flags: 0: insert before pos, 1: insert after pos (for low speed transfers)
 399 _static int insert_qh (uhci_t *s, uhci_desc_t *pos, uhci_desc_t *new, int order)
 400 {
 401         uhci_desc_t *old;
 402         unsigned long flags;
 403
 404         spin_lock_irqsave (&s->qh_lock, flags);
 405
 406         if (!order) {
 407                 // (OLD) (POS) -> (OLD) (NEW) (POS)
 408                 old = list_entry (pos->horizontal.prev, uhci_desc_t, horizontal);
 409                 list_add_tail (&new->horizontal, &pos->horizontal);
 410                 set_qh_head(new, MAKE_QH_ADDR (pos)) ;
 411                 if (!(old->hw.qh.head & cpu_to_le32(UHCI_PTR_TERM)))
 412                         set_qh_head(old, MAKE_QH_ADDR (new)) ;
 413         }
 414         else {
 415                 // (POS) (OLD) -> (POS) (NEW) (OLD)
 416                 old = list_entry (pos->horizontal.next, uhci_desc_t, horizontal);
 417                 list_add (&new->horizontal, &pos->horizontal);
 418                 set_qh_head(new, MAKE_QH_ADDR (old));
 419                 set_qh_head(pos, MAKE_QH_ADDR (new)) ;
 420         }
 421
 422         mb ();
 423
 424         spin_unlock_irqrestore (&s->qh_lock, flags);
 425
 426         return 0;
 427 }
 428
 429 /*-------------------------------------------------------------------*/
 430 _static int unlink_qh (uhci_t *s, uhci_desc_t *element)
 431 {
 432         uhci_desc_t  *prev;
 433         unsigned long flags;
 434
 435         spin_lock_irqsave (&s->qh_lock, flags);
 436
 437         prev = list_entry (element->horizontal.prev, uhci_desc_t, horizontal);
 438         prev->hw.qh.head = element->hw.qh.head;
 439
 440         dbg("unlink qh %p, pqh %p, nxqh %p, to %08x", element, prev,
 441             list_entry (element->horizontal.next, uhci_desc_t, horizontal),le32_to_cpu(element->hw.qh.head) &~15);
 442
 443         list_del(&element->horizontal);
 444
 445         mb ();
 446         spin_unlock_irqrestore (&s->qh_lock, flags);
 447
 448         return 0;
 449 }
 450 /*-------------------------------------------------------------------*/
 451 _static int delete_qh (uhci_t *s, uhci_desc_t *qh)
 452 {
 453         uhci_desc_t *td;
 454         struct list_head *p;
 455
 456         list_del (&qh->horizontal);
 457
 458         while ((p = qh->vertical.next) != &qh->vertical) {
 459                 td = list_entry (p, uhci_desc_t, vertical);
 460                 dbg("unlink td @ %p",td);
 461                 unlink_td (s, td, 0); // no physical unlink
 462                 delete_desc (s, td);
 463         }
 464
 465         delete_desc (s, qh);
 466
 467         return 0;
 468 }
 469 /*-------------------------------------------------------------------*/
 470 _static void clean_td_chain (uhci_t *s, uhci_desc_t *td)
 471 {
 472         struct list_head *p;
 473         uhci_desc_t *td1;
 474
 475         if (!td)
 476                 return;
 477
 478         while ((p = td->horizontal.next) != &td->horizontal) {
 479                 td1 = list_entry (p, uhci_desc_t, horizontal);
 480                 delete_desc (s, td1);
 481         }
 482
 483         delete_desc (s, td);
 484 }
 485
 486 /*-------------------------------------------------------------------*/
 487 _static void fill_td (uhci_desc_t *td, int status, int info, __u32 buffer)
 488 {
 489         td->hw.td.status = cpu_to_le32(status);
 490         td->hw.td.info = cpu_to_le32(info);
 491         td->hw.td.buffer = cpu_to_le32(buffer);
 492 }
 493 /*-------------------------------------------------------------------*/
 494 // Removes ALL qhs in chain (paranoia!)
 495 _static void cleanup_skel (uhci_t *s)
 496 {
 497         unsigned int n;
 498         uhci_desc_t *td;
 499
 500         dbg("cleanup_skel");
 501
 502         clean_descs(s,1);
 503
 504
 505         if (s->td32ms) {
 506
 507                 unlink_td(s,s->td32ms,1);
 508                 delete_desc(s, s->td32ms);
 509         }
 510
 511         for (n = 0; n < 8; n++) {
 512                 td = s->int_chain[n];
 513                 clean_td_chain (s, td);
 514         }
 515
 516         if (s->iso_td) {
 517                 for (n = 0; n < 1024; n++) {
 518                         td = s->iso_td[n];
 519                         clean_td_chain (s, td);
 520                 }
 521                 kfree (s->iso_td);
 522         }
 523
 524         if (s->framelist)
 525                 pci_free_consistent(s->uhci_pci, PAGE_SIZE,
 526                                     s->framelist, s->framelist_dma);
 527
 528         if (s->control_chain) {
 529                 // completed init_skel?
 530                 struct list_head *p;
 531                 uhci_desc_t *qh, *qh1;
 532
 533                 qh = s->control_chain;
 534                 while ((p = qh->horizontal.next) != &qh->horizontal) {
 535                         qh1 = list_entry (p, uhci_desc_t, horizontal);
 536                         delete_qh (s, qh1);
 537                 }
 538
 539                 delete_qh (s, qh);
 540         }
 541         else {
 542                 if (s->ls_control_chain)
 543                         delete_desc (s, s->ls_control_chain);
 544                 if (s->control_chain)
 545                         delete_desc (s, s->control_chain);
 546                 if (s->bulk_chain)
 547                         delete_desc (s, s->bulk_chain);
 548                 if (s->chain_end)
 549                         delete_desc (s, s->chain_end);
 550         }
 551
 552         if (s->desc_pool) {
 553                 pci_pool_destroy(s->desc_pool);
 554                 s->desc_pool = NULL;
 555         }
 556
 557         dbg("cleanup_skel finished");
 558 }
 559 /*-------------------------------------------------------------------*/
 560 // allocates framelist and qh-skeletons
 561 // only HW-links provide continous linking, SW-links stay in their domain (ISO/INT)
 562 _static int init_skel (uhci_t *s)
 563 {
 564         int n, ret;
 565         uhci_desc_t *qh, *td;
 566
 567         dbg("init_skel");
 568
 569         s->framelist = pci_alloc_consistent(s->uhci_pci, PAGE_SIZE,
 570                                             &s->framelist_dma);
 571
 572         if (!s->framelist)
 573                 return -ENOMEM;
 574
 575         memset (s->framelist, 0, 4096);
 576
 577         dbg("creating descriptor pci_pool");
 578
 579         s->desc_pool = pci_pool_create("uhci_desc", s->uhci_pci,
 580                                        sizeof(uhci_desc_t), 16, 0,
 581                                        GFP_DMA | GFP_ATOMIC);
 582         if (!s->desc_pool)
 583                 goto init_skel_cleanup;
 584
 585         dbg("allocating iso desc pointer list");
 586         s->iso_td = (uhci_desc_t **) kmalloc (1024 * sizeof (uhci_desc_t*), GFP_KERNEL);
 587
 588         if (!s->iso_td)
 589                 goto init_skel_cleanup;
 590
 591         s->ls_control_chain = NULL;
 592         s->control_chain = NULL;
 593         s->bulk_chain = NULL;
 594         s->chain_end = NULL;
 595
 596         dbg("allocating iso descs");
 597         for (n = 0; n < 1024; n++) {
 598                 // allocate skeleton iso/irq-tds
 599                 if (alloc_td (s, &td, 0))
 600                         goto init_skel_cleanup;
 601
 602                 s->iso_td[n] = td;
 603                 s->framelist[n] = cpu_to_le32((__u32) td->dma_addr);
 604         }
 605
 606         dbg("allocating qh: chain_end");
 607         if (alloc_qh (s, &qh))
 608                 goto init_skel_cleanup;
 609
 610         s->chain_end = qh;
 611
 612         if (alloc_td (s, &td, 0))
 613                 goto init_skel_cleanup;
 614
 615         fill_td (td, 0 * TD_CTRL_IOC, 0, 0); // generate 1ms interrupt (enabled on demand)
 616         insert_td (s, qh, td, 0);
 617         qh->hw.qh.element &= cpu_to_le32(~UHCI_PTR_TERM); // remove TERM bit
 618         s->td1ms=td;
 619
 620         dbg("allocating qh: bulk_chain");
 621         if (alloc_qh (s, &qh))
 622                 goto init_skel_cleanup;
 623
 624         insert_qh (s, s->chain_end, qh, 0);
 625         s->bulk_chain = qh;
 626
 627         dbg("allocating qh: control_chain");
 628         ret = alloc_qh (s, &qh);
 629         if (ret)
 630                 goto init_skel_cleanup;
 631
 632         insert_qh (s, s->bulk_chain, qh, 0);
 633         s->control_chain = qh;
 634
 635 #ifdef  CONFIG_USB_UHCI_HIGH_BANDWIDTH
 636         // disabled reclamation loop
 637         set_qh_head(s->chain_end, s->control_chain->dma_addr | UHCI_PTR_QH | UHCI_PTR_TERM);
 638 #endif
 639
 640         dbg("allocating qh: ls_control_chain");
 641         if (alloc_qh (s, &qh))
 642                 goto init_skel_cleanup;
 643
 644         insert_qh (s, s->control_chain, qh, 0);
 645         s->ls_control_chain = qh;
 646
 647         for (n = 0; n < 8; n++)
 648                 s->int_chain[n] = 0;
 649
 650         dbg("allocating skeleton INT-TDs");
 651
 652         for (n = 0; n < 8; n++) {
 653                 uhci_desc_t *td;
 654
 655                 if (alloc_td (s, &td, 0))
 656                         goto init_skel_cleanup;
 657
 658                 s->int_chain[n] = td;
 659                 if (n == 0) {
 660                         set_td_link(s->int_chain[0], s->ls_control_chain->dma_addr | UHCI_PTR_QH);
 661                 }
 662                 else {
 663                         set_td_link(s->int_chain[n], s->int_chain[0]->dma_addr);
 664                 }
 665         }
 666
 667         dbg("Linking skeleton INT-TDs");
 668
 669         for (n = 0; n < 1024; n++) {
 670                 // link all iso-tds to the interrupt chains
 671                 int m, o;
 672                 dbg("framelist[%i]=%x",n,le32_to_cpu(s->framelist[n]));
 673                 if ((n&127)==127)
 674                         ((uhci_desc_t*) s->iso_td[n])->hw.td.link = cpu_to_le32(s->int_chain[0]->dma_addr);
 675                 else
 676                         for (o = 1, m = 2; m <= 128; o++, m += m)
 677                                 if ((n & (m - 1)) == ((m - 1) / 2))
 678                                         set_td_link(((uhci_desc_t*) s->iso_td[n]), s->int_chain[o]->dma_addr);
 679         }
 680
 681         if (alloc_td (s, &td, 0))
 682                 goto init_skel_cleanup;
 683
 684         fill_td (td, 0 * TD_CTRL_IOC, 0, 0); // generate 32ms interrupt (activated later)
 685         s->td32ms=td;
 686
 687         insert_td_horizontal (s, s->int_chain[5], td);
 688
 689         mb();
 690         //uhci_show_queue(s->control_chain);
 691         dbg("init_skel exit");
 692         return 0;
 693
 694       init_skel_cleanup:
 695         cleanup_skel (s);
 696         return -ENOMEM;
 697 }
 698
 699 /*-------------------------------------------------------------------*/
 700 //                         LOW LEVEL STUFF
 701 //          assembles QHs und TDs for control, bulk and iso
 702 /*-------------------------------------------------------------------*/
 703 _static int uhci_submit_control_urb (struct urb *urb)
 704 {
 705         uhci_desc_t *qh, *td;
 706         uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
 707         urb_priv_t *urb_priv = urb->hcpriv;
 708         unsigned long destination, status;
 709         int maxsze = usb_maxpacket (urb->dev, urb->pipe, usb_pipeout (urb->pipe));
 710         unsigned long len;
 711         char *data;
 712         int depth_first=USE_CTRL_DEPTH_FIRST;  // UHCI descriptor chasing method
 713
 714         dbg("uhci_submit_control start");
 715         if (alloc_qh (s, &qh))          // alloc qh for this request
 716                 return -ENOMEM;
 717
 718         if (alloc_td (s, &td, UHCI_PTR_DEPTH * depth_first))            // get td for setup stage
 719         {
 720                 delete_qh (s, qh);
 721                 return -ENOMEM;
 722         }
 723
 724         /* The "pipe" thing contains the destination in bits 8--18 */
 725         destination = (urb->pipe & PIPE_DEVEP_MASK) | USB_PID_SETUP;
 726
 727         /* 3 errors */
 728         status = (urb->pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE |
 729                 (urb->transfer_flags & USB_DISABLE_SPD ? 0 : TD_CTRL_SPD) | (3 << 27);
 730
 731         /*  Build the TD for the control request, try forever, 8 bytes of data */
 732         fill_td (td, status, destination | (7 << 21), urb_priv->setup_packet_dma);
 733
 734         insert_td (s, qh, td, 0);       // queue 'setup stage'-td in qh
 735 #if 0
 736         {
 737                 char *sp=urb->setup_packet;
 738                 dbg("SETUP to pipe %x: %x %x %x %x %x %x %x %x", urb->pipe,
 739                     sp[0],sp[1],sp[2],sp[3],sp[4],sp[5],sp[6],sp[7]);
 740         }
 741         //uhci_show_td(td);
 742 #endif
 743
 744         len = urb->transfer_buffer_length;
 745         data = urb->transfer_buffer;
 746
 747         /* If direction is "send", change the frame from SETUP (0x2D)
 748            to OUT (0xE1). Else change it from SETUP to IN (0x69). */
 749
 750         destination = (urb->pipe & PIPE_DEVEP_MASK) | (usb_pipeout (urb->pipe)?USB_PID_OUT:USB_PID_IN);
 751
 752         while (len > 0) {
 753                 int pktsze = len;
 754
 755                 if (alloc_td (s, &td, UHCI_PTR_DEPTH * depth_first))
 756                         goto fail_unmap_enomem;
 757
 758                 if (pktsze > maxsze)
 759                         pktsze = maxsze;
 760
 761                 destination ^= 1 << TD_TOKEN_TOGGLE;    // toggle DATA0/1
 762
 763                 // Status, pktsze bytes of data
 764                 fill_td (td, status, destination | ((pktsze - 1) << 21),
 765                          urb_priv->transfer_buffer_dma + (data - (char *)urb->transfer_buffer));
 766
 767                 insert_td (s, qh, td, UHCI_PTR_DEPTH * depth_first);    // queue 'data stage'-td in qh
 768
 769                 data += pktsze;
 770                 len -= pktsze;
 771         }
 772
 773         /* Build the final TD for control status */
 774         /* It's only IN if the pipe is out AND we aren't expecting data */
 775
 776         destination &= ~UHCI_PID;
 777
 778         if (usb_pipeout (urb->pipe) || (urb->transfer_buffer_length == 0))
 779                 destination |= USB_PID_IN;
 780         else
 781                 destination |= USB_PID_OUT;
 782
 783         destination |= 1 << TD_TOKEN_TOGGLE;    /* End in Data1 */
 784
 785         if (alloc_td (s, &td, UHCI_PTR_DEPTH))
 786                 goto fail_unmap_enomem;
 787
 788         status &=~TD_CTRL_SPD;
 789
 790         /* no limit on errors on final packet , 0 bytes of data */
 791         fill_td (td, status | TD_CTRL_IOC, destination | (UHCI_NULL_DATA_SIZE << 21),
 792                  0);
 793
 794         insert_td (s, qh, td, UHCI_PTR_DEPTH * depth_first);    // queue status td
 795
 796         list_add (&qh->desc_list, &urb_priv->desc_list);
 797
 798         queue_urb (s, urb);     // queue before inserting in desc chain
 799
 800         qh->hw.qh.element &= cpu_to_le32(~UHCI_PTR_TERM);
 801
 802         //uhci_show_queue(qh);
 803         /* Start it up... put low speed first */
 804         if (urb->pipe & TD_CTRL_LS)
 805                 insert_qh (s, s->control_chain, qh, 0);
 806         else
 807                 insert_qh (s, s->bulk_chain, qh, 0);
 808
 809         dbg("uhci_submit_control end");
 810         return 0;
 811
 812 fail_unmap_enomem:
 813         delete_qh(s, qh);
 814         return -ENOMEM;
 815 }
 816 /*-------------------------------------------------------------------*/
 817 // For queued bulk transfers, two additional QH helpers are allocated (nqh, bqh)
 818 // Due to the linking with other bulk urbs, it has to be locked with urb_list_lock!
 819
 820 _static int uhci_submit_bulk_urb (struct urb *urb, struct urb *bulk_urb)
 821 {
 822         uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
 823         urb_priv_t *urb_priv = urb->hcpriv, *upriv, *bpriv=NULL;
 824         uhci_desc_t *qh, *td, *nqh=NULL, *bqh=NULL, *first_td=NULL;
 825         unsigned long destination, status;
 826         char *data;
 827         unsigned int pipe = urb->pipe;
 828         int maxsze = usb_maxpacket (urb->dev, pipe, usb_pipeout (pipe));
 829         int info, len, last;
 830         int depth_first=USE_BULK_DEPTH_FIRST;  // UHCI descriptor chasing method
 831
 832         if (usb_endpoint_halted (urb->dev, usb_pipeendpoint (pipe), usb_pipeout (pipe)))
 833                 return -EPIPE;
 834
 835         queue_dbg("uhci_submit_bulk_urb: urb %p, old %p, pipe %08x, len %i",
 836                   urb,bulk_urb,urb->pipe,urb->transfer_buffer_length);
 837
 838         upriv = (urb_priv_t*)urb->hcpriv;
 839
 840         if (!bulk_urb) {
 841                 if (alloc_qh (s, &qh))          // get qh for this request
 842                         return -ENOMEM;
 843
 844                 if (urb->transfer_flags & USB_QUEUE_BULK) {
 845                         if (alloc_qh(s, &nqh)) // placeholder for clean unlink
 846                         {
 847                                 delete_desc (s, qh);
 848                                 return -ENOMEM;
 849                         }
 850                         upriv->next_qh = nqh;
 851                         queue_dbg("new next qh %p",nqh);
 852                 }
 853         }
 854         else {
 855                 bpriv = (urb_priv_t*)bulk_urb->hcpriv;
 856                 qh = bpriv->bottom_qh;  // re-use bottom qh and next qh
 857                 nqh = bpriv->next_qh;
 858                 upriv->next_qh=nqh;
 859                 upriv->prev_queued_urb=bulk_urb;
 860         }
 861
 862         if (urb->transfer_flags & USB_QUEUE_BULK) {
 863                 if (alloc_qh (s, &bqh))  // "bottom" QH
 864                 {
 865                         if (!bulk_urb) {
 866                                 delete_desc(s, qh);
 867                                 delete_desc(s, nqh);
 868                         }
 869                         return -ENOMEM;
 870                 }
 871                 set_qh_element(bqh, UHCI_PTR_TERM);
 872                 set_qh_head(bqh, nqh->dma_addr | UHCI_PTR_QH); // element
 873                 upriv->bottom_qh = bqh;
 874         }
 875         queue_dbg("uhci_submit_bulk: qh %p bqh %p nqh %p",qh, bqh, nqh);
 876
 877         /* The "pipe" thing contains the destination in bits 8--18. */
 878         destination = (pipe & PIPE_DEVEP_MASK) | usb_packetid (pipe);
 879
 880         /* 3 errors */
 881         status = (pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE |
 882                 ((urb->transfer_flags & USB_DISABLE_SPD) ? 0 : TD_CTRL_SPD) | (3 << 27);
 883
 884         /* Build the TDs for the bulk request */
 885         len = urb->transfer_buffer_length;
 886         data = urb->transfer_buffer;
 887
 888         do {                                    // TBD: Really allow zero-length packets?
 889                 int pktsze = len;
 890
 891                 if (alloc_td (s, &td, UHCI_PTR_DEPTH * depth_first))
 892                 {
 893                         delete_qh (s, qh);
 894                         return -ENOMEM;
 895                 }
 896
 897                 if (pktsze > maxsze)
 898                         pktsze = maxsze;
 899
 900                 // pktsze bytes of data
 901                 info = destination | (((pktsze - 1)&UHCI_NULL_DATA_SIZE) << 21) |
 902                         (usb_gettoggle (urb->dev, usb_pipeendpoint (pipe), usb_pipeout (pipe)) << TD_TOKEN_TOGGLE);
 903
 904                 fill_td (td, status, info,
 905                          urb_priv->transfer_buffer_dma + (data - (char *)urb->transfer_buffer));
 906
 907                 data += pktsze;
 908                 len -= pktsze;
 909                 // Use USB_ZERO_PACKET to finish bulk OUTs always with a zero length packet
 910                 last = (len == 0 && (usb_pipein(pipe) || pktsze < maxsze || !(urb->transfer_flags & USB_ZERO_PACKET)));
 911
 912                 if (last)
 913                         set_td_ioc(td); // last one generates INT
 914
 915                 insert_td (s, qh, td, UHCI_PTR_DEPTH * depth_first);
 916                 if (!first_td)
 917                         first_td=td;
 918                 usb_dotoggle (urb->dev, usb_pipeendpoint (pipe), usb_pipeout (pipe));
 919
 920         } while (!last);
 921
 922         if (bulk_urb && bpriv)   // everything went OK, link with old bulk URB
 923                 bpriv->next_queued_urb=urb;
 924
 925         list_add (&qh->desc_list, &urb_priv->desc_list);
 926
 927         if (urb->transfer_flags & USB_QUEUE_BULK)
 928                 append_qh(s, td, bqh, UHCI_PTR_DEPTH * depth_first);
 929
 930         queue_urb_unlocked (s, urb);
 931
 932         if (urb->transfer_flags & USB_QUEUE_BULK)
 933                 set_qh_element(qh, first_td->dma_addr);
 934         else
 935                 qh->hw.qh.element &= cpu_to_le32(~UHCI_PTR_TERM);    // arm QH
 936
 937         if (!bulk_urb) {                                        // new bulk queue
 938                 if (urb->transfer_flags & USB_QUEUE_BULK) {
 939                         spin_lock (&s->td_lock);                // both QHs in one go
 940                         insert_qh (s, s->chain_end, qh, 0);     // Main QH
 941                         insert_qh (s, s->chain_end, nqh, 0);    // Helper QH
 942                         spin_unlock (&s->td_lock);
 943                 }
 944                 else
 945                         insert_qh (s, s->chain_end, qh, 0);
 946         }
 947
 948         //uhci_show_queue(s->bulk_chain);
 949         //dbg("uhci_submit_bulk_urb: exit\n");
 950         return 0;
 951 }
 952 /*-------------------------------------------------------------------*/
 953 _static void uhci_clean_iso_step1(uhci_t *s, urb_priv_t *urb_priv)
 954 {
 955         struct list_head *p;
 956         uhci_desc_t *td;
 957
 958         for (p = urb_priv->desc_list.next; p != &urb_priv->desc_list; p = p->next) {
 959                                 td = list_entry (p, uhci_desc_t, desc_list);
 960                                 unlink_td (s, td, 1);
 961         }
 962 }
 963 /*-------------------------------------------------------------------*/
 964 _static void uhci_clean_iso_step2(uhci_t *s, urb_priv_t *urb_priv)
 965 {
 966         struct list_head *p;
 967         uhci_desc_t *td;
 968
 969         while ((p = urb_priv->desc_list.next) != &urb_priv->desc_list) {
 970                                 td = list_entry (p, uhci_desc_t, desc_list);
 971                                 list_del (p);
 972                                 delete_desc (s, td);
 973         }
 974 }
 975 /*-------------------------------------------------------------------*/
 976 /* mode: CLEAN_TRANSFER_NO_DELETION: unlink but no deletion mark (step 1 of async_unlink)
 977          CLEAN_TRANSFER_REGULAR: regular (unlink/delete-mark)
 978          CLEAN_TRANSFER_DELETION_MARK: deletion mark for QH (step 2 of async_unlink)
 979  looks a bit complicated because of all the bulk queueing goodies
 980 */
 981
 982 _static void uhci_clean_transfer (uhci_t *s, struct urb *urb, uhci_desc_t *qh, int mode)
 983 {
 984         uhci_desc_t *bqh, *nqh, *prevqh, *prevtd;
 985         int now;
 986         urb_priv_t *priv=(urb_priv_t*)urb->hcpriv;
 987
 988         now=UHCI_GET_CURRENT_FRAME(s);
 989
 990         bqh=priv->bottom_qh;
 991
 992         if (!priv->next_queued_urb)  { // no more appended bulk queues
 993
 994                 queue_dbg("uhci_clean_transfer: No more bulks for urb %p, qh %p, bqh %p, nqh %p", urb, qh, bqh, priv->next_qh);
 995
 996                 if (priv->prev_queued_urb && mode != CLEAN_TRANSFER_DELETION_MARK) {  // qh not top of the queue
 997                                 unsigned long flags;
 998                                 urb_priv_t* ppriv=(urb_priv_t*)priv->prev_queued_urb->hcpriv;
 999
1000                                 spin_lock_irqsave (&s->qh_lock, flags);
1001                                 prevqh = list_entry (ppriv->desc_list.next, uhci_desc_t, desc_list);
1002                                 prevtd = list_entry (prevqh->vertical.prev, uhci_desc_t, vertical);
1003                                 set_td_link(prevtd, priv->bottom_qh->dma_addr | UHCI_PTR_QH); // skip current qh
1004                                 mb();
1005                                 queue_dbg("uhci_clean_transfer: relink pqh %p, ptd %p",prevqh, prevtd);
1006                                 spin_unlock_irqrestore (&s->qh_lock, flags);
1007
1008                                 ppriv->bottom_qh = priv->bottom_qh;
1009                                 ppriv->next_queued_urb = NULL;
1010                         }
1011                 else {   // queue is dead, qh is top of the queue
1012
1013                         if (mode != CLEAN_TRANSFER_DELETION_MARK)
1014                                 unlink_qh(s, qh); // remove qh from horizontal chain
1015
1016                         if (bqh) {  // remove remainings of bulk queue
1017                                 nqh=priv->next_qh;
1018
1019                                 if (mode != CLEAN_TRANSFER_DELETION_MARK)
1020                                         unlink_qh(s, nqh);  // remove nqh from horizontal chain
1021
1022                                 if (mode != CLEAN_TRANSFER_NO_DELETION) {  // add helper QHs to free desc list
1023                                         nqh->last_used = bqh->last_used = now;
1024                                         list_add_tail (&nqh->horizontal, &s->free_desc);
1025                                         list_add_tail (&bqh->horizontal, &s->free_desc);
1026                                 }
1027                         }
1028                 }
1029         }
1030         else { // there are queued urbs following
1031
1032           queue_dbg("uhci_clean_transfer: urb %p, prevurb %p, nexturb %p, qh %p, bqh %p, nqh %p",
1033                        urb, priv->prev_queued_urb,  priv->next_queued_urb, qh, bqh, priv->next_qh);
1034
1035                 if (mode != CLEAN_TRANSFER_DELETION_MARK) {     // no work for cleanup at unlink-completion
1036                         struct urb *nurb;
1037                         unsigned long flags;
1038
1039                         nurb = priv->next_queued_urb;
1040                         spin_lock_irqsave (&s->qh_lock, flags);
1041
1042                         if (!priv->prev_queued_urb) { // top QH
1043
1044                                 prevqh = list_entry (qh->horizontal.prev, uhci_desc_t, horizontal);
1045                                 set_qh_head(prevqh, bqh->dma_addr | UHCI_PTR_QH);
1046                                 list_del (&qh->horizontal);  // remove this qh form horizontal chain
1047                                 list_add (&bqh->horizontal, &prevqh->horizontal); // insert next bqh in horizontal chain
1048                         }
1049                         else {          // intermediate QH
1050                                 urb_priv_t* ppriv=(urb_priv_t*)priv->prev_queued_urb->hcpriv;
1051                                 urb_priv_t* npriv=(urb_priv_t*)nurb->hcpriv;
1052                                 uhci_desc_t * bnqh;
1053
1054                                 bnqh = list_entry (npriv->desc_list.next, uhci_desc_t, desc_list);
1055                                 ppriv->bottom_qh = bnqh;
1056                                 ppriv->next_queued_urb = nurb;
1057                                 prevqh = list_entry (ppriv->desc_list.next, uhci_desc_t, desc_list);
1058                                 set_qh_head(prevqh, bqh->dma_addr | UHCI_PTR_QH);
1059                         }
1060
1061                         mb();
1062                         ((urb_priv_t*)nurb->hcpriv)->prev_queued_urb=priv->prev_queued_urb;
1063                         spin_unlock_irqrestore (&s->qh_lock, flags);
1064                 }
1065         }
1066
1067         if (mode != CLEAN_TRANSFER_NO_DELETION) {
1068                 qh->last_used = now;
1069                 list_add_tail (&qh->horizontal, &s->free_desc); // mark qh for later deletion/kfree
1070         }
1071 }
1072 /*-------------------------------------------------------------------*/
1073 // Release bandwidth for Interrupt or Isoc. transfers
1074 _static void uhci_release_bandwidth(struct urb *urb)
1075 {
1076         if (urb->bandwidth) {
1077                 switch (usb_pipetype(urb->pipe)) {
1078                 case PIPE_INTERRUPT:
1079                         usb_release_bandwidth (urb->dev, urb, 0);
1080                         break;
1081                 case PIPE_ISOCHRONOUS:
1082                         usb_release_bandwidth (urb->dev, urb, 1);
1083                         break;
1084                 default:
1085                         break;
1086                 }
1087         }
1088 }
1089
1090 _static void uhci_urb_dma_sync(uhci_t *s, struct urb *urb, urb_priv_t *urb_priv)
1091 {
1092         if (urb_priv->setup_packet_dma)
1093                 pci_dma_sync_single(s->uhci_pci, urb_priv->setup_packet_dma,
1094                                     sizeof(struct usb_ctrlrequest), PCI_DMA_TODEVICE);
1095
1096         if (urb_priv->transfer_buffer_dma)
1097                 pci_dma_sync_single(s->uhci_pci, urb_priv->transfer_buffer_dma,
1098                                     urb->transfer_buffer_length,
1099                                     usb_pipein(urb->pipe) ?
1100                                     PCI_DMA_FROMDEVICE :
1101                                     PCI_DMA_TODEVICE);
1102 }
1103
1104 _static void uhci_urb_dma_unmap(uhci_t *s, struct urb *urb, urb_priv_t *urb_priv)
1105 {
1106         if (urb_priv->setup_packet_dma) {
1107                 pci_unmap_single(s->uhci_pci, urb_priv->setup_packet_dma,
1108                                  sizeof(struct usb_ctrlrequest), PCI_DMA_TODEVICE);
1109                 urb_priv->setup_packet_dma = 0;
1110         }
1111         if (urb_priv->transfer_buffer_dma) {
1112                 pci_unmap_single(s->uhci_pci, urb_priv->transfer_buffer_dma,
1113                                  urb->transfer_buffer_length,
1114                                  usb_pipein(urb->pipe) ?
1115                                  PCI_DMA_FROMDEVICE :
1116                                  PCI_DMA_TODEVICE);
1117                 urb_priv->transfer_buffer_dma = 0;
1118         }
1119 }
1120 /*-------------------------------------------------------------------*/
1121 /* needs urb_list_lock!
1122    mode: UNLINK_ASYNC_STORE_URB: unlink and move URB into unlinked list
1123          UNLINK_ASYNC_DONT_STORE: unlink, don't move URB into unlinked list
1124 */
1125 _static int uhci_unlink_urb_async (uhci_t *s,struct urb *urb, int mode)
1126 {
1127         uhci_desc_t *qh;
1128         urb_priv_t *urb_priv;
1129
1130         async_dbg("unlink_urb_async called %p",urb);
1131
1132         if ((urb->status == -EINPROGRESS) ||
1133             ((usb_pipetype (urb->pipe) ==  PIPE_INTERRUPT) && ((urb_priv_t*)urb->hcpriv)->flags))
1134         {
1135                 ((urb_priv_t*)urb->hcpriv)->started = ~0;  // mark
1136                 dequeue_urb (s, urb);
1137
1138                 if (mode==UNLINK_ASYNC_STORE_URB)
1139                         list_add_tail (&urb->urb_list, &s->urb_unlinked); // store urb
1140
1141                 uhci_switch_timer_int(s);
1142                 s->unlink_urb_done = 1;
1143                 uhci_release_bandwidth(urb);
1144
1145                 urb->status = -ECONNABORTED;    // mark urb as "waiting to be killed"
1146                 urb_priv = (urb_priv_t*)urb->hcpriv;
1147
1148                 switch (usb_pipetype (urb->pipe)) {
1149                 case PIPE_INTERRUPT:
1150                         usb_dotoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe));
1151
1152                 case PIPE_ISOCHRONOUS:
1153                         uhci_clean_iso_step1 (s, urb_priv);
1154                         break;
1155
1156                 case PIPE_BULK:
1157                 case PIPE_CONTROL:
1158                         qh = list_entry (urb_priv->desc_list.next, uhci_desc_t, desc_list);
1159                         uhci_clean_transfer (s, urb, qh, CLEAN_TRANSFER_NO_DELETION);
1160                         break;
1161                 }
1162                 ((urb_priv_t*)urb->hcpriv)->started = UHCI_GET_CURRENT_FRAME(s);
1163                 return -EINPROGRESS;  // completion will follow
1164         }
1165
1166         return 0;    // URB already dead
1167 }
1168 /*-------------------------------------------------------------------*/
1169 // kills an urb by unlinking descriptors and waiting for at least one frame
1170 _static int uhci_unlink_urb_sync (uhci_t *s, struct urb *urb)
1171 {
1172         uhci_desc_t *qh;
1173         urb_priv_t *urb_priv;
1174         unsigned long flags=0;
1175         struct usb_device *usb_dev;
1176
1177         spin_lock_irqsave (&s->urb_list_lock, flags);
1178
1179         if (urb->status == -EINPROGRESS) {
1180
1181                 // move descriptors out of the running chains, dequeue urb
1182                 uhci_unlink_urb_async(s, urb, UNLINK_ASYNC_DONT_STORE);
1183
1184                 urb_priv = urb->hcpriv;
1185                 urb->status = -ENOENT;  // prevent from double deletion after unlock
1186                 spin_unlock_irqrestore (&s->urb_list_lock, flags);
1187
1188                 // cleanup the rest
1189                 switch (usb_pipetype (urb->pipe)) {
1190
1191                 case PIPE_INTERRUPT:
1192                 case PIPE_ISOCHRONOUS:
1193                         uhci_wait_ms(1);
1194                         uhci_clean_iso_step2(s, urb_priv);
1195                         break;
1196
1197                 case PIPE_BULK:
1198                 case PIPE_CONTROL:
1199                         qh = list_entry (urb_priv->desc_list.next, uhci_desc_t, desc_list);
1200                         uhci_clean_transfer(s, urb, qh, CLEAN_TRANSFER_DELETION_MARK);
1201                         uhci_wait_ms(1);
1202                 }
1203                 urb->status = -ENOENT;  // mark urb as killed
1204
1205                 uhci_urb_dma_unmap(s, urb, urb->hcpriv);
1206
1207 #ifdef DEBUG_SLAB
1208                 kmem_cache_free (urb_priv_kmem, urb->hcpriv);
1209 #else
1210                 kfree (urb->hcpriv);
1211 #endif
1212                 usb_dev = urb->dev;
1213                 if (urb->complete) {
1214                         dbg("unlink_urb: calling completion");
1215                         urb->dev = NULL;
1216                         urb->complete ((struct urb *) urb);
1217                 }
1218                 usb_dec_dev_use (usb_dev);
1219         }
1220         else
1221                 spin_unlock_irqrestore (&s->urb_list_lock, flags);
1222
1223         return 0;
1224 }
1225 /*-------------------------------------------------------------------*/
1226 // async unlink_urb completion/cleanup work
1227 // has to be protected by urb_list_lock!
1228 // features: if set in transfer_flags, the resulting status of the killed
1229 // transaction is not overwritten
1230
1231 _static void uhci_cleanup_unlink(uhci_t *s, int force)
1232 {
1233         struct list_head *q;
1234         struct urb *urb;
1235         struct usb_device *dev;
1236         int now, type;
1237         urb_priv_t *urb_priv;
1238
1239         q=s->urb_unlinked.next;
1240         now=UHCI_GET_CURRENT_FRAME(s);
1241
1242         while (q != &s->urb_unlinked) {
1243
1244                 urb = list_entry (q, struct urb, urb_list);
1245
1246                 urb_priv = (urb_priv_t*)urb->hcpriv;
1247                 q = urb->urb_list.next;
1248
1249                 if (!urb_priv) // avoid crash when URB is corrupted
1250                         break;
1251
1252                 if (force || ((urb_priv->started != ~0) && (urb_priv->started != now))) {
1253                         async_dbg("async cleanup %p",urb);
1254                         type=usb_pipetype (urb->pipe);
1255
1256                         switch (type) { // process descriptors
1257                         case PIPE_CONTROL:
1258                                 process_transfer (s, urb, CLEAN_TRANSFER_DELETION_MARK);  // don't unlink (already done)
1259                                 break;
1260                         case PIPE_BULK:
1261                                 if (!s->avoid_bulk.counter)
1262                                         process_transfer (s, urb, CLEAN_TRANSFER_DELETION_MARK); // don't unlink (already done)
1263                                 else
1264                                         continue;
1265                                 break;
1266                         case PIPE_ISOCHRONOUS:
1267                                 process_iso (s, urb, PROCESS_ISO_FORCE); // force, don't unlink
1268                                 break;
1269                         case PIPE_INTERRUPT:
1270                                 process_interrupt (s, urb);
1271                                 break;
1272                         }
1273
1274                         if (!(urb->transfer_flags & USB_TIMEOUT_KILLED))
1275                                 urb->status = -ECONNRESET; // mark as asynchronously killed
1276
1277                         dev = urb->dev; // completion may destroy all...
1278                         urb_priv = urb->hcpriv;
1279                         list_del (&urb->urb_list);
1280
1281                         uhci_urb_dma_sync(s, urb, urb_priv);
1282                         if (urb->complete) {
1283                                 spin_unlock(&s->urb_list_lock);
1284                                 urb->dev = NULL;
1285                                 urb->complete ((struct urb *) urb);
1286                                 spin_lock(&s->urb_list_lock);
1287                         }
1288
1289                         if (!(urb->transfer_flags & USB_TIMEOUT_KILLED))
1290                                 urb->status = -ENOENT;  // now the urb is really dead
1291
1292                         switch (type) {
1293                         case PIPE_ISOCHRONOUS:
1294                         case PIPE_INTERRUPT:
1295                                 uhci_clean_iso_step2(s, urb_priv);
1296                                 break;
1297                         }
1298
1299                         uhci_urb_dma_unmap(s, urb, urb_priv);
1300
1301                         usb_dec_dev_use (dev);
1302 #ifdef DEBUG_SLAB
1303                         kmem_cache_free (urb_priv_kmem, urb_priv);
1304 #else
1305                         kfree (urb_priv);
1306 #endif
1307
1308                 }
1309         }
1310 }
1311
1312 /*-------------------------------------------------------------------*/
1313 _static int uhci_unlink_urb (struct urb *urb)
1314 {
1315         uhci_t *s;
1316         unsigned long flags=0;
1317         dbg("uhci_unlink_urb called for %p",urb);
1318         if (!urb || !urb->dev)          // you never know...
1319                 return -EINVAL;
1320
1321         s = (uhci_t*) urb->dev->bus->hcpriv;
1322
1323         if (usb_pipedevice (urb->pipe) == s->rh.devnum)
1324                 return rh_unlink_urb (urb);
1325
1326         if (!urb->hcpriv)
1327                 return -EINVAL;
1328
1329         if (urb->transfer_flags & USB_ASYNC_UNLINK) {
1330                 int ret;
1331                 spin_lock_irqsave (&s->urb_list_lock, flags);
1332
1333                 uhci_release_bandwidth(urb);
1334                 ret = uhci_unlink_urb_async(s, urb, UNLINK_ASYNC_STORE_URB);
1335
1336                 spin_unlock_irqrestore (&s->urb_list_lock, flags);
1337                 return ret;
1338         }
1339         else
1340                 return uhci_unlink_urb_sync(s, urb);
1341 }
1342 /*-------------------------------------------------------------------*/
1343 // In case of ASAP iso transfer, search the URB-list for already queued URBs
1344 // for this EP and calculate the earliest start frame for the new
1345 // URB (easy seamless URB continuation!)
1346 _static int find_iso_limits (struct urb *urb, unsigned int *start, unsigned int *end)
1347 {
1348         struct urb *u, *last_urb = NULL;
1349         uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
1350         struct list_head *p;
1351         int ret=-1;
1352         unsigned long flags;
1353
1354         spin_lock_irqsave (&s->urb_list_lock, flags);
1355         p=s->urb_list.prev;
1356
1357         for (; p != &s->urb_list; p = p->prev) {
1358                 u = list_entry (p, struct urb, urb_list);
1359                 // look for pending URBs with identical pipe handle
1360                 // works only because iso doesn't toggle the data bit!
1361                 if ((urb->pipe == u->pipe) && (urb->dev == u->dev) && (u->status == -EINPROGRESS)) {
1362                         if (!last_urb)
1363                                 *start = u->start_frame;
1364                         last_urb = u;
1365                 }
1366         }
1367
1368         if (last_urb) {
1369                 *end = (last_urb->start_frame + last_urb->number_of_packets) & 1023;
1370                 ret=0;
1371         }
1372
1373         spin_unlock_irqrestore(&s->urb_list_lock, flags);
1374
1375         return ret;
1376 }
1377 /*-------------------------------------------------------------------*/
1378 // adjust start_frame according to scheduling constraints (ASAP etc)
1379
1380 _static int iso_find_start (struct urb *urb)
1381 {
1382         uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
1383         unsigned int now;
1384         unsigned int start_limit = 0, stop_limit = 0, queued_size;
1385         int limits;
1386
1387         now = UHCI_GET_CURRENT_FRAME (s) & 1023;
1388
1389         if ((unsigned) urb->number_of_packets > 900)
1390                 return -EFBIG;
1391
1392         limits = find_iso_limits (urb, &start_limit, &stop_limit);
1393         queued_size = (stop_limit - start_limit) & 1023;
1394
1395         if (urb->transfer_flags & USB_ISO_ASAP) {
1396                 // first iso
1397                 if (limits) {
1398                         // 10ms setup should be enough //FIXME!
1399                         urb->start_frame = (now + 10) & 1023;
1400                 }
1401                 else {
1402                         urb->start_frame = stop_limit;          //seamless linkage
1403
1404                         if (((now - urb->start_frame) & 1023) <= (unsigned) urb->number_of_packets) {
1405                                 info("iso_find_start: gap in seamless isochronous scheduling");
1406                                 dbg("iso_find_start: now %u start_frame %u number_of_packets %u pipe 0x%08x",
1407                                         now, urb->start_frame, urb->number_of_packets, urb->pipe);
1408                                 urb->start_frame = (now + 5) & 1023;    // 5ms setup should be enough //FIXME!
1409                         }
1410                 }
1411         }
1412         else {
1413                 urb->start_frame &= 1023;
1414                 if (((now - urb->start_frame) & 1023) < (unsigned) urb->number_of_packets) {
1415                         dbg("iso_find_start: now between start_frame and end");
1416                         return -EAGAIN;
1417                 }
1418         }
1419
1420         /* check if either start_frame or start_frame+number_of_packets-1 lies between start_limit and stop_limit */
1421         if (limits)
1422                 return 0;
1423
1424         if (((urb->start_frame - start_limit) & 1023) < queued_size ||
1425             ((urb->start_frame + urb->number_of_packets - 1 - start_limit) & 1023) < queued_size) {
1426                 dbg("iso_find_start: start_frame %u number_of_packets %u start_limit %u stop_limit %u",
1427                         urb->start_frame, urb->number_of_packets, start_limit, stop_limit);
1428                 return -EAGAIN;
1429         }
1430
1431         return 0;
1432 }
1433 /*-------------------------------------------------------------------*/
1434 // submits USB interrupt (ie. polling ;-)
1435 // ASAP-flag set implicitely
1436 // if period==0, the transfer is only done once
1437
1438 _static int uhci_submit_int_urb (struct urb *urb)
1439 {
1440         uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
1441         urb_priv_t *urb_priv = urb->hcpriv;
1442         int nint, n;
1443         uhci_desc_t *td;
1444         int status, destination;
1445         int info;
1446         unsigned int pipe = urb->pipe;
1447
1448         if (urb->interval < 0 || urb->interval >= 256)
1449                 return -EINVAL;
1450
1451         if (urb->interval == 0)
1452                 nint = 0;
1453         else {
1454                 for (nint = 0, n = 1; nint <= 8; nint++, n += n)        // round interval down to 2^n
1455                  {
1456                         if (urb->interval < n) {
1457                                 urb->interval = n / 2;
1458                                 break;
1459                         }
1460                 }
1461                 nint--;
1462         }
1463
1464         dbg("Rounded interval to %i, chain  %i", urb->interval, nint);
1465
1466         urb->start_frame = UHCI_GET_CURRENT_FRAME (s) & 1023;   // remember start frame, just in case...
1467
1468         urb->number_of_packets = 1;
1469
1470         // INT allows only one packet
1471         if (urb->transfer_buffer_length > usb_maxpacket (urb->dev, pipe, usb_pipeout (pipe)))
1472                 return -EINVAL;
1473
1474         if (alloc_td (s, &td, UHCI_PTR_DEPTH))
1475                 return -ENOMEM;
1476
1477         status = (pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE | TD_CTRL_IOC |
1478                 (urb->transfer_flags & USB_DISABLE_SPD ? 0 : TD_CTRL_SPD) | (3 << 27);
1479
1480         destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid (urb->pipe) |
1481                 (((urb->transfer_buffer_length - 1) & 0x7ff) << 21);
1482
1483
1484         info = destination | (usb_gettoggle (urb->dev, usb_pipeendpoint (pipe), usb_pipeout (pipe)) << TD_TOKEN_TOGGLE);
1485
1486         fill_td (td, status, info, urb_priv->transfer_buffer_dma);
1487         list_add_tail (&td->desc_list, &urb_priv->desc_list);
1488
1489         queue_urb (s, urb);
1490
1491         insert_td_horizontal (s, s->int_chain[nint], td);       // store in INT-TDs
1492
1493         usb_dotoggle (urb->dev, usb_pipeendpoint (pipe), usb_pipeout (pipe));
1494
1495         return 0;
1496 }
1497 /*-------------------------------------------------------------------*/
1498 _static int uhci_submit_iso_urb (struct urb *urb)
1499 {
1500         uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
1501         urb_priv_t *urb_priv = urb->hcpriv;
1502 #ifdef ISO_SANITY_CHECK
1503         int pipe=urb->pipe;
1504         int maxsze = usb_maxpacket (urb->dev, pipe, usb_pipeout (pipe));
1505 #endif
1506         int n, ret, last=0;
1507         uhci_desc_t *td, **tdm;
1508         int status, destination;
1509         unsigned long flags;
1510
1511         __save_flags(flags);
1512         __cli();                      // Disable IRQs to schedule all ISO-TDs in time
1513         ret = iso_find_start (urb);     // adjusts urb->start_frame for later use
1514
1515         if (ret)
1516                 goto err;
1517
1518         tdm = (uhci_desc_t **) kmalloc (urb->number_of_packets * sizeof (uhci_desc_t*), KMALLOC_FLAG);
1519
1520         if (!tdm) {
1521                 ret = -ENOMEM;
1522                 goto err;
1523         }
1524
1525         memset(tdm, 0, urb->number_of_packets * sizeof (uhci_desc_t*));
1526
1527         // First try to get all TDs. Cause: Removing already inserted TDs can only be done
1528         // racefree in three steps: unlink TDs, wait one frame, delete TDs.
1529         // So, this solutions seems simpler...
1530
1531         for (n = 0; n < urb->number_of_packets; n++) {
1532                 dbg("n:%d urb->iso_frame_desc[n].length:%d", n, urb->iso_frame_desc[n].length);
1533                 if (!urb->iso_frame_desc[n].length)
1534                         continue;  // allows ISO striping by setting length to zero in iso_descriptor
1535
1536
1537 #ifdef ISO_SANITY_CHECK
1538                 if(urb->iso_frame_desc[n].length > maxsze) {
1539
1540                         err("submit_iso: urb->iso_frame_desc[%d].length(%d)>%d",n , urb->iso_frame_desc[n].length, maxsze);
1541                         ret=-EINVAL;
1542                 }
1543                 else
1544 #endif
1545                 if (alloc_td (s, &td, UHCI_PTR_DEPTH)) {
1546                         int i;  // Cleanup allocated TDs
1547
1548                         for (i = 0; i < n; n++)
1549                                 if (tdm[i])
1550                                          delete_desc(s, tdm[i]);
1551                         kfree (tdm);
1552                         goto err;
1553                 }
1554                 last=n;
1555                 tdm[n] = td;
1556         }
1557
1558         status = TD_CTRL_ACTIVE | TD_CTRL_IOS;
1559
1560         destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid (urb->pipe);
1561
1562         // Queue all allocated TDs
1563         for (n = 0; n < urb->number_of_packets; n++) {
1564                 td = tdm[n];
1565                 if (!td)
1566                         continue;
1567
1568                 if (n  == last) {
1569                         status |= TD_CTRL_IOC;
1570                         queue_urb (s, urb);
1571                 }
1572
1573                 fill_td (td, status, destination | (((urb->iso_frame_desc[n].length - 1) & 0x7ff) << 21),
1574                          urb_priv->transfer_buffer_dma + urb->iso_frame_desc[n].offset);
1575                 list_add_tail (&td->desc_list, &urb_priv->desc_list);
1576
1577                 insert_td_horizontal (s, s->iso_td[(urb->start_frame + n) & 1023], td); // store in iso-tds
1578         }
1579
1580         kfree (tdm);
1581         dbg("ISO-INT# %i, start %i, now %i", urb->number_of_packets, urb->start_frame, UHCI_GET_CURRENT_FRAME (s) & 1023);
1582         ret = 0;
1583
1584       err:
1585         __restore_flags(flags);
1586         return ret;
1587 }
1588 /*-------------------------------------------------------------------*/
1589 // returns: 0 (no transfer queued), urb* (this urb already queued)
1590
1591 _static struct urb* search_dev_ep (uhci_t *s, struct urb *urb)
1592 {
1593         struct list_head *p;
1594         struct urb *tmp;
1595         unsigned int mask = usb_pipecontrol(urb->pipe) ? (~USB_DIR_IN) : (~0);
1596
1597         dbg("search_dev_ep:");
1598
1599         p=s->urb_list.next;
1600
1601         for (; p != &s->urb_list; p = p->next) {
1602                 tmp = list_entry (p, struct urb, urb_list);
1603                 dbg("urb: %p", tmp);
1604                 // we can accept this urb if it is not queued at this time
1605                 // or if non-iso transfer requests should be scheduled for the same device and pipe
1606                 if ((!usb_pipeisoc(urb->pipe) && (tmp->dev == urb->dev) && !((tmp->pipe ^ urb->pipe) & mask)) ||
1607                     (urb == tmp)) {
1608                         return tmp;     // found another urb already queued for processing
1609                 }
1610         }
1611
1612         return 0;
1613 }
1614 /*-------------------------------------------------------------------*/
1615 _static int uhci_submit_urb (struct urb *urb)
1616 {
1617         uhci_t *s;
1618         urb_priv_t *urb_priv;
1619         int ret = 0, type;
1620         unsigned long flags;
1621         struct urb *queued_urb=NULL;
1622         int bustime;
1623
1624         if (!urb->dev || !urb->dev->bus)
1625                 return -ENODEV;
1626
1627         s = (uhci_t*) urb->dev->bus->hcpriv;
1628         //dbg("submit_urb: %p type %d",urb,usb_pipetype(urb->pipe));
1629
1630         if (!s->running)
1631                 return -ENODEV;
1632
1633         type = usb_pipetype (urb->pipe);
1634
1635         if (usb_pipedevice (urb->pipe) == s->rh.devnum)
1636                 return rh_submit_urb (urb);     /* virtual root hub */
1637
1638         // Sanity checks
1639         if (usb_maxpacket (urb->dev, urb->pipe, usb_pipeout (urb->pipe)) <= 0) {
1640                 err("uhci_submit_urb: pipesize for pipe %x is zero", urb->pipe);
1641                 return -EMSGSIZE;
1642         }
1643
1644         if (urb->transfer_buffer_length < 0 && type != PIPE_ISOCHRONOUS) {
1645                 err("uhci_submit_urb: Negative transfer length for urb %p", urb);
1646                 return -EINVAL;
1647         }
1648
1649         usb_inc_dev_use (urb->dev);
1650
1651         spin_lock_irqsave (&s->urb_list_lock, flags);
1652
1653         queued_urb = search_dev_ep (s, urb); // returns already queued urb for that pipe
1654
1655         if (queued_urb) {
1656
1657                 queue_dbg("found bulk urb %p\n", queued_urb);
1658
1659                 if (( type != PIPE_BULK) ||
1660                     ((type == PIPE_BULK) &&
1661                      (!(urb->transfer_flags & USB_QUEUE_BULK) || !(queued_urb->transfer_flags & USB_QUEUE_BULK)))) {
1662                         spin_unlock_irqrestore (&s->urb_list_lock, flags);
1663                         usb_dec_dev_use (urb->dev);
1664                         err("ENXIO %08x, flags %x, urb %p, burb %p",urb->pipe,urb->transfer_flags,urb,queued_urb);
1665                         return -ENXIO;  // urb already queued
1666                 }
1667         }
1668
1669 #ifdef DEBUG_SLAB
1670         urb_priv = kmem_cache_alloc(urb_priv_kmem, SLAB_FLAG);
1671 #else
1672         urb_priv = kmalloc (sizeof (urb_priv_t), KMALLOC_FLAG);
1673 #endif
1674         if (!urb_priv) {
1675                 usb_dec_dev_use (urb->dev);
1676                 spin_unlock_irqrestore (&s->urb_list_lock, flags);
1677                 return -ENOMEM;
1678         }
1679
1680         memset(urb_priv, 0, sizeof(urb_priv_t));
1681         urb->hcpriv = urb_priv;
1682         INIT_LIST_HEAD (&urb_priv->desc_list);
1683
1684         dbg("submit_urb: scheduling %p", urb);
1685
1686         if (type == PIPE_CONTROL)
1687                 urb_priv->setup_packet_dma = pci_map_single(s->uhci_pci, urb->setup_packet,
1688                                                             sizeof(struct usb_ctrlrequest), PCI_DMA_TODEVICE);
1689
1690         if (urb->transfer_buffer_length)
1691                 urb_priv->transfer_buffer_dma = pci_map_single(s->uhci_pci,
1692                                                                urb->transfer_buffer,
1693                                                                urb->transfer_buffer_length,
1694                                                                usb_pipein(urb->pipe) ?
1695                                                                PCI_DMA_FROMDEVICE :
1696                                                                PCI_DMA_TODEVICE);
1697
1698         if (type == PIPE_BULK) {
1699
1700                 if (queued_urb) {
1701                         while (((urb_priv_t*)queued_urb->hcpriv)->next_queued_urb)  // find last queued bulk
1702                                 queued_urb=((urb_priv_t*)queued_urb->hcpriv)->next_queued_urb;
1703
1704                         ((urb_priv_t*)queued_urb->hcpriv)->next_queued_urb=urb;
1705                 }
1706                 atomic_inc (&s->avoid_bulk);
1707                 ret = uhci_submit_bulk_urb (urb, queued_urb);
1708                 atomic_dec (&s->avoid_bulk);
1709                 spin_unlock_irqrestore (&s->urb_list_lock, flags);
1710         }
1711         else {
1712                 spin_unlock_irqrestore (&s->urb_list_lock, flags);
1713                 switch (type) {
1714                 case PIPE_ISOCHRONOUS:
1715                         if (urb->bandwidth == 0) {      /* not yet checked/allocated */
1716                                 if (urb->number_of_packets <= 0) {
1717                                         ret = -EINVAL;
1718                                         break;
1719                                 }
1720
1721                                 bustime = usb_check_bandwidth (urb->dev, urb);
1722                                 if (bustime < 0)
1723                                         ret = bustime;
1724                                 else {
1725                                         ret = uhci_submit_iso_urb(urb);
1726                                         if (ret == 0)
1727                                                 usb_claim_bandwidth (urb->dev, urb, bustime, 1);
1728                                 }
1729                         } else {        /* bandwidth is already set */
1730                                 ret = uhci_submit_iso_urb(urb);
1731                         }
1732                         break;
1733                 case PIPE_INTERRUPT:
1734                         if (urb->bandwidth == 0) {      /* not yet checked/allocated */
1735                                 bustime = usb_check_bandwidth (urb->dev, urb);
1736                                 if (bustime < 0)
1737                                         ret = bustime;
1738                                 else {
1739                                         ret = uhci_submit_int_urb(urb);
1740                                         if (ret == 0)
1741                                                 usb_claim_bandwidth (urb->dev, urb, bustime, 0);
1742                                 }
1743                         } else {        /* bandwidth is already set */
1744                                 ret = uhci_submit_int_urb(urb);
1745                         }
1746                         break;
1747                 case PIPE_CONTROL:
1748                         ret = uhci_submit_control_urb (urb);
1749                         break;
1750                 default:
1751                         ret = -EINVAL;
1752                 }
1753         }
1754
1755         dbg("submit_urb: scheduled with ret: %d", ret);
1756
1757         if (ret != 0) {
1758                 uhci_urb_dma_unmap(s, urb, urb_priv);
1759                 usb_dec_dev_use (urb->dev);
1760 #ifdef DEBUG_SLAB
1761                 kmem_cache_free(urb_priv_kmem, urb_priv);
1762 #else
1763                 kfree (urb_priv);
1764 #endif
1765                 return ret;
1766         }
1767
1768         return 0;
1769 }
1770
1771 // Checks for URB timeout and removes bandwidth reclamation if URB idles too long
1772 _static void uhci_check_timeouts(uhci_t *s)
1773 {
1774         struct list_head *p,*p2;
1775         struct urb *urb;
1776         int type;
1777
1778         p = s->urb_list.prev;
1779
1780         while (p != &s->urb_list) {
1781                 urb_priv_t *hcpriv;
1782
1783                 p2 = p;
1784                 p = p->prev;
1785                 urb = list_entry (p2, struct urb, urb_list);
1786                 type = usb_pipetype (urb->pipe);
1787
1788                 hcpriv = (urb_priv_t*)urb->hcpriv;
1789
1790                 if ( urb->timeout && time_after(jiffies, hcpriv->started + urb->timeout)) {
1791                         urb->transfer_flags |= USB_TIMEOUT_KILLED | USB_ASYNC_UNLINK;
1792                         async_dbg("uhci_check_timeout: timeout for %p",urb);
1793                         uhci_unlink_urb_async(s, urb, UNLINK_ASYNC_STORE_URB);
1794                 }
1795 #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH
1796                 else if (((type == PIPE_BULK) || (type == PIPE_CONTROL)) &&
1797                          (hcpriv->use_loop) && time_after(jiffies, hcpriv->started + IDLE_TIMEOUT))
1798                         disable_desc_loop(s, urb);
1799 #endif
1800
1801         }
1802         s->timeout_check=jiffies;
1803 }
1804
1805 /*-------------------------------------------------------------------
1806  Virtual Root Hub
1807  -------------------------------------------------------------------*/
1808
1809 _static __u8 root_hub_dev_des[] =
1810 {
1811         0x12,                   /*  __u8  bLength; */
1812         0x01,                   /*  __u8  bDescriptorType; Device */
1813         0x00,                   /*  __u16 bcdUSB; v1.0 */
1814         0x01,
1815         0x09,                   /*  __u8  bDeviceClass; HUB_CLASSCODE */
1816         0x00,                   /*  __u8  bDeviceSubClass; */
1817         0x00,                   /*  __u8  bDeviceProtocol; */
1818         0x08,                   /*  __u8  bMaxPacketSize0; 8 Bytes */
1819         0x00,                   /*  __u16 idVendor; */
1820         0x00,
1821         0x00,                   /*  __u16 idProduct; */
1822         0x00,
1823         0x00,                   /*  __u16 bcdDevice; */
1824         0x00,
1825         0x00,                   /*  __u8  iManufacturer; */
1826         0x02,                   /*  __u8  iProduct; */
1827         0x01,                   /*  __u8  iSerialNumber; */
1828         0x01                    /*  __u8  bNumConfigurations; */
1829 };
1830
1831
1832 /* Configuration descriptor */
1833 _static __u8 root_hub_config_des[] =
1834 {
1835         0x09,                   /*  __u8  bLength; */
1836         0x02,                   /*  __u8  bDescriptorType; Configuration */
1837         0x19,                   /*  __u16 wTotalLength; */
1838         0x00,
1839         0x01,                   /*  __u8  bNumInterfaces; */
1840         0x01,                   /*  __u8  bConfigurationValue; */
1841         0x00,                   /*  __u8  iConfiguration; */
1842         0x40,                   /*  __u8  bmAttributes;
1843                                    Bit 7: Bus-powered, 6: Self-powered, 5 Remote-wakwup, 4..0: resvd */
1844         0x00,                   /*  __u8  MaxPower; */
1845
1846      /* interface */
1847         0x09,                   /*  __u8  if_bLength; */
1848         0x04,                   /*  __u8  if_bDescriptorType; Interface */
1849         0x00,                   /*  __u8  if_bInterfaceNumber; */
1850         0x00,                   /*  __u8  if_bAlternateSetting; */
1851         0x01,                   /*  __u8  if_bNumEndpoints; */
1852         0x09,                   /*  __u8  if_bInterfaceClass; HUB_CLASSCODE */
1853         0x00,                   /*  __u8  if_bInterfaceSubClass; */
1854         0x00,                   /*  __u8  if_bInterfaceProtocol; */
1855         0x00,                   /*  __u8  if_iInterface; */
1856
1857      /* endpoint */
1858         0x07,                   /*  __u8  ep_bLength; */
1859         0x05,                   /*  __u8  ep_bDescriptorType; Endpoint */
1860         0x81,                   /*  __u8  ep_bEndpointAddress; IN Endpoint 1 */
1861         0x03,                   /*  __u8  ep_bmAttributes; Interrupt */
1862         0x08,                   /*  __u16 ep_wMaxPacketSize; 8 Bytes */
1863         0x00,
1864         0xff                    /*  __u8  ep_bInterval; 255 ms */
1865 };
1866
1867
1868 _static __u8 root_hub_hub_des[] =
1869 {
1870         0x09,                   /*  __u8  bLength; */
1871         0x29,                   /*  __u8  bDescriptorType; Hub-descriptor */
1872         0x02,                   /*  __u8  bNbrPorts; */
1873         0x00,                   /* __u16  wHubCharacteristics; */
1874         0x00,
1875         0x01,                   /*  __u8  bPwrOn2pwrGood; 2ms */
1876         0x00,                   /*  __u8  bHubContrCurrent; 0 mA */
1877         0x00,                   /*  __u8  DeviceRemovable; *** 7 Ports max *** */
1878         0xff                    /*  __u8  PortPwrCtrlMask; *** 7 ports max *** */
1879 };
1880
1881 /*-------------------------------------------------------------------------*/
1882 /* prepare Interrupt pipe transaction data; HUB INTERRUPT ENDPOINT */
1883 _static int rh_send_irq (struct urb *urb)
1884 {
1885         int len = 1;
1886         int i;
1887         uhci_t *uhci = urb->dev->bus->hcpriv;
1888         unsigned int io_addr = uhci->io_addr;
1889         __u16 data = 0;
1890
1891         for (i = 0; i < uhci->rh.numports; i++) {
1892                 data |= ((inw (io_addr + USBPORTSC1 + i * 2) & 0xa) > 0 ? (1 << (i + 1)) : 0);
1893                 len = (i + 1) / 8 + 1;
1894         }
1895
1896         *(__u16 *) urb->transfer_buffer = cpu_to_le16 (data);
1897         urb->actual_length = len;
1898         urb->status = 0;
1899
1900         if ((data > 0) && (uhci->rh.send != 0)) {
1901                 dbg("Root-Hub INT complete: port1: %x port2: %x data: %x",
1902                      inw (io_addr + USBPORTSC1), inw (io_addr + USBPORTSC2), data);
1903                 urb->complete (urb);
1904         }
1905         return 0;
1906 }
1907
1908 /*-------------------------------------------------------------------------*/
1909 /* Virtual Root Hub INTs are polled by this timer every "intervall" ms */
1910 _static int rh_init_int_timer (struct urb *urb);
1911
1912 _static void rh_int_timer_do (unsigned long ptr)
1913 {
1914         int len;
1915         struct urb *urb = (struct urb*) ptr;
1916         uhci_t *uhci = urb->dev->bus->hcpriv;
1917
1918         if (uhci->rh.send) {
1919                 len = rh_send_irq (urb);
1920                 if (len > 0) {
1921                         urb->actual_length = len;
1922                         if (urb->complete)
1923                                 urb->complete (urb);
1924                 }
1925         }
1926         rh_init_int_timer (urb);
1927 }
1928
1929 /*-------------------------------------------------------------------------*/
1930 /* Root Hub INTs are polled by this timer, polling interval 20ms */
1931
1932 _static int rh_init_int_timer (struct urb *urb)
1933 {
1934         uhci_t *uhci = urb->dev->bus->hcpriv;
1935
1936         uhci->rh.interval = urb->interval;
1937         init_timer (&uhci->rh.rh_int_timer);
1938         uhci->rh.rh_int_timer.function = rh_int_timer_do;
1939         uhci->rh.rh_int_timer.data = (unsigned long) urb;
1940         uhci->rh.rh_int_timer.expires = jiffies + (HZ * 20) / 1000;
1941         add_timer (&uhci->rh.rh_int_timer);
1942
1943         return 0;
1944 }
1945
1946 /*-------------------------------------------------------------------------*/
1947 #define OK(x)                   len = (x); break
1948
1949 #define CLR_RH_PORTSTAT(x) \
1950                 status = inw(io_addr+USBPORTSC1+2*(wIndex-1)); \
1951                 status = (status & 0xfff5) & ~(x); \
1952                 outw(status, io_addr+USBPORTSC1+2*(wIndex-1))
1953
1954 #define SET_RH_PORTSTAT(x) \
1955                 status = inw(io_addr+USBPORTSC1+2*(wIndex-1)); \
1956                 status = (status & 0xfff5) | (x); \
1957                 outw(status, io_addr+USBPORTSC1+2*(wIndex-1))
1958
1959
1960 /*-------------------------------------------------------------------------*/
1961 /****
1962  ** Root Hub Control Pipe
1963  *************************/
1964
1965
1966 _static int rh_submit_urb (struct urb *urb)
1967 {
1968         struct usb_device *usb_dev = urb->dev;
1969         uhci_t *uhci = usb_dev->bus->hcpriv;
1970         unsigned int pipe = urb->pipe;
1971         struct usb_ctrlrequest *cmd = (struct usb_ctrlrequest *) urb->setup_packet;
1972         void *data = urb->transfer_buffer;
1973         int leni = urb->transfer_buffer_length;
1974         int len = 0;
1975         int status = 0;
1976         int stat = 0;
1977         int i;
1978         unsigned int io_addr = uhci->io_addr;
1979         __u16 cstatus;
1980
1981         __u16 bmRType_bReq;
1982         __u16 wValue;
1983         __u16 wIndex;
1984         __u16 wLength;
1985
1986         if (usb_pipetype (pipe) == PIPE_INTERRUPT) {
1987                 dbg("Root-Hub submit IRQ: every %d ms", urb->interval);
1988                 uhci->rh.urb = urb;
1989                 uhci->rh.send = 1;
1990                 uhci->rh.interval = urb->interval;
1991                 rh_init_int_timer (urb);
1992
1993                 return 0;
1994         }
1995
1996
1997         bmRType_bReq = cmd->bRequestType | cmd->bRequest << 8;
1998         wValue = le16_to_cpu (cmd->wValue);
1999         wIndex = le16_to_cpu (cmd->wIndex);
2000         wLength = le16_to_cpu (cmd->wLength);
2001
2002         for (i = 0; i < 8; i++)
2003                 uhci->rh.c_p_r[i] = 0;
2004
2005         dbg("Root-Hub: adr: %2x cmd(%1x): %04x %04x %04x %04x",
2006              uhci->rh.devnum, 8, bmRType_bReq, wValue, wIndex, wLength);
2007
2008         switch (bmRType_bReq) {
2009                 /* Request Destination:
2010                    without flags: Device,
2011                    RH_INTERFACE: interface,
2012                    RH_ENDPOINT: endpoint,
2013                    RH_CLASS means HUB here,
2014                    RH_OTHER | RH_CLASS  almost ever means HUB_PORT here
2015                  */
2016
2017         case RH_GET_STATUS:
2018                 *(__u16 *) data = cpu_to_le16 (1);
2019                 OK (2);
2020         case RH_GET_STATUS | RH_INTERFACE:
2021                 *(__u16 *) data = cpu_to_le16 (0);
2022                 OK (2);
2023         case RH_GET_STATUS | RH_ENDPOINT:
2024                 *(__u16 *) data = cpu_to_le16 (0);
2025                 OK (2);
2026         case RH_GET_STATUS | RH_CLASS:
2027                 *(__u32 *) data = cpu_to_le32 (0);
2028                 OK (4);         /* hub power ** */
2029         case RH_GET_STATUS | RH_OTHER | RH_CLASS:
2030                 status = inw (io_addr + USBPORTSC1 + 2 * (wIndex - 1));
2031                 cstatus = ((status & USBPORTSC_CSC) >> (1 - 0)) |
2032                         ((status & USBPORTSC_PEC) >> (3 - 1)) |
2033                         (uhci->rh.c_p_r[wIndex - 1] << (0 + 4));
2034                 status = (status & USBPORTSC_CCS) |
2035                         ((status & USBPORTSC_PE) >> (2 - 1)) |
2036                         ((status & USBPORTSC_SUSP) >> (12 - 2)) |
2037                         ((status & USBPORTSC_PR) >> (9 - 4)) |
2038                         (1 << 8) |      /* power on ** */
2039                         ((status & USBPORTSC_LSDA) << (-8 + 9));
2040
2041                 *(__u16 *) data = cpu_to_le16 (status);
2042                 *(__u16 *) (data + 2) = cpu_to_le16 (cstatus);
2043                 OK (4);
2044
2045         case RH_CLEAR_FEATURE | RH_ENDPOINT:
2046                 switch (wValue) {
2047                 case (RH_ENDPOINT_STALL):
2048                         OK (0);
2049                 }
2050                 break;
2051
2052         case RH_CLEAR_FEATURE | RH_CLASS:
2053                 switch (wValue) {
2054                 case (RH_C_HUB_OVER_CURRENT):
2055                         OK (0); /* hub power over current ** */
2056                 }
2057                 break;
2058
2059         case RH_CLEAR_FEATURE | RH_OTHER | RH_CLASS:
2060                 switch (wValue) {
2061                 case (RH_PORT_ENABLE):
2062                         CLR_RH_PORTSTAT (USBPORTSC_PE);
2063                         OK (0);
2064                 case (RH_PORT_SUSPEND):
2065                         CLR_RH_PORTSTAT (USBPORTSC_SUSP);
2066                         OK (0);
2067                 case (RH_PORT_POWER):
2068                         OK (0); /* port power ** */
2069                 case (RH_C_PORT_CONNECTION):
2070                         SET_RH_PORTSTAT (USBPORTSC_CSC);
2071                         OK (0);
2072                 case (RH_C_PORT_ENABLE):
2073                         SET_RH_PORTSTAT (USBPORTSC_PEC);
2074                         OK (0);
2075                 case (RH_C_PORT_SUSPEND):
2076 /*** WR_RH_PORTSTAT(RH_PS_PSSC); */
2077                         OK (0);
2078                 case (RH_C_PORT_OVER_CURRENT):
2079                         OK (0); /* port power over current ** */
2080                 case (RH_C_PORT_RESET):
2081                         uhci->rh.c_p_r[wIndex - 1] = 0;
2082                         OK (0);
2083                 }
2084                 break;
2085
2086         case RH_SET_FEATURE | RH_OTHER | RH_CLASS:
2087                 switch (wValue) {
2088                 case (RH_PORT_SUSPEND):
2089                         SET_RH_PORTSTAT (USBPORTSC_SUSP);
2090                         OK (0);
2091                 case (RH_PORT_RESET):
2092                         SET_RH_PORTSTAT (USBPORTSC_PR);
2093                         uhci_wait_ms (10);
2094                         uhci->rh.c_p_r[wIndex - 1] = 1;
2095                         CLR_RH_PORTSTAT (USBPORTSC_PR);
2096                         udelay (10);
2097                         SET_RH_PORTSTAT (USBPORTSC_PE);
2098                         uhci_wait_ms (10);
2099                         SET_RH_PORTSTAT (0xa);
2100                         OK (0);
2101                 case (RH_PORT_POWER):
2102                         OK (0); /* port power ** */
2103                 case (RH_PORT_ENABLE):
2104                         SET_RH_PORTSTAT (USBPORTSC_PE);
2105                         OK (0);
2106                 }
2107                 break;
2108
2109         case RH_SET_ADDRESS:
2110                 uhci->rh.devnum = wValue;
2111                 OK (0);
2112
2113         case RH_GET_DESCRIPTOR:
2114                 switch ((wValue & 0xff00) >> 8) {
2115                 case (0x01):    /* device descriptor */
2116                         len = min_t(unsigned int, leni,
2117                                   min_t(unsigned int,
2118                                       sizeof (root_hub_dev_des), wLength));
2119                         memcpy (data, root_hub_dev_des, len);
2120                         OK (len);
2121                 case (0x02):    /* configuration descriptor */
2122                         len = min_t(unsigned int, leni,
2123                                   min_t(unsigned int,
2124                                       sizeof (root_hub_config_des), wLength));
2125                         memcpy (data, root_hub_config_des, len);
2126                         OK (len);
2127                 case (0x03):    /* string descriptors */
2128                         len = usb_root_hub_string (wValue & 0xff,
2129                                 uhci->io_addr, "UHCI",
2130                                 data, wLength);
2131                         if (len > 0) {
2132                                 OK(min_t(int, leni, len));
2133                         } else
2134                                 stat = -EPIPE;
2135                 }
2136                 break;
2137
2138         case RH_GET_DESCRIPTOR | RH_CLASS:
2139                 root_hub_hub_des[2] = uhci->rh.numports;
2140                 len = min_t(unsigned int, leni,
2141                           min_t(unsigned int, sizeof (root_hub_hub_des), wLength));
2142                 memcpy (data, root_hub_hub_des, len);
2143                 OK (len);
2144
2145         case RH_GET_CONFIGURATION:
2146                 *(__u8 *) data = 0x01;
2147                 OK (1);
2148
2149         case RH_SET_CONFIGURATION:
2150                 OK (0);
2151         default:
2152                 stat = -EPIPE;
2153         }
2154
2155         dbg("Root-Hub stat port1: %x port2: %x",
2156              inw (io_addr + USBPORTSC1), inw (io_addr + USBPORTSC2));
2157
2158         urb->actual_length = len;
2159         urb->status = stat;
2160         urb->dev=NULL;
2161         if (urb->complete)
2162                 urb->complete (urb);
2163         return 0;
2164 }
2165 /*-------------------------------------------------------------------------*/
2166
2167 _static int rh_unlink_urb (struct urb *urb)
2168 {
2169         uhci_t *uhci = urb->dev->bus->hcpriv;
2170
2171         if (uhci->rh.urb==urb) {
2172                 dbg("Root-Hub unlink IRQ");
2173                 uhci->rh.send = 0;
2174                 del_timer (&uhci->rh.rh_int_timer);
2175         }
2176         return 0;
2177 }
2178 /*-------------------------------------------------------------------*/
2179
2180 /*
2181  * Map status to standard result codes
2182  *
2183  * <status> is (td->status & 0xFE0000) [a.k.a. uhci_status_bits(td->status)
2184  * <dir_out> is True for output TDs and False for input TDs.
2185  */
2186 _static int uhci_map_status (int status, int dir_out)
2187 {
2188         if (!status)
2189                 return 0;
2190         if (status & TD_CTRL_BITSTUFF)  /* Bitstuff error */
2191                 return -EPROTO;
2192         if (status & TD_CTRL_CRCTIMEO) {        /* CRC/Timeout */
2193                 if (dir_out)
2194                         return -ETIMEDOUT;
2195                 else
2196                         return -EILSEQ;
2197         }
2198         if (status & TD_CTRL_NAK)       /* NAK */
2199                 return -ETIMEDOUT;
2200         if (status & TD_CTRL_BABBLE)    /* Babble */
2201                 return -EOVERFLOW;
2202         if (status & TD_CTRL_DBUFERR)   /* Buffer error */
2203                 return -ENOSR;
2204         if (status & TD_CTRL_STALLED)   /* Stalled */
2205                 return -EPIPE;
2206         if (status & TD_CTRL_ACTIVE)    /* Active */
2207                 return 0;
2208
2209         return -EPROTO;
2210 }
2211
2212 /*
2213  * Only the USB core should call uhci_alloc_dev and uhci_free_dev
2214  */
2215 _static int uhci_alloc_dev (struct usb_device *usb_dev)
2216 {
2217         return 0;
2218 }
2219
2220 _static void uhci_unlink_urbs(uhci_t *s, struct usb_device *usb_dev, int remove_all)
2221 {
2222         unsigned long flags;
2223         struct list_head *p;
2224         struct list_head *p2;
2225         struct urb *urb;
2226
2227         spin_lock_irqsave (&s->urb_list_lock, flags);
2228         p = s->urb_list.prev;
2229         while (p != &s->urb_list) {
2230                 p2 = p;
2231                 p = p->prev ;
2232                 urb = list_entry (p2, struct urb, urb_list);
2233                 dbg("urb: %p, dev %p, %p", urb, usb_dev,urb->dev);
2234
2235                 //urb->transfer_flags |=USB_ASYNC_UNLINK;
2236
2237                 if (remove_all || (usb_dev == urb->dev)) {
2238                         spin_unlock_irqrestore (&s->urb_list_lock, flags);
2239                         warn("forced removing of queued URB %p due to disconnect",urb);
2240                         uhci_unlink_urb(urb);
2241                         urb->dev = NULL; // avoid further processing of this URB
2242                         spin_lock_irqsave (&s->urb_list_lock, flags);
2243                         p = s->urb_list.prev;
2244                 }
2245         }
2246         spin_unlock_irqrestore (&s->urb_list_lock, flags);
2247 }
2248
2249 _static int uhci_free_dev (struct usb_device *usb_dev)
2250 {
2251         uhci_t *s;
2252
2253
2254         if(!usb_dev || !usb_dev->bus || !usb_dev->bus->hcpriv)
2255                 return -EINVAL;
2256
2257         s=(uhci_t*) usb_dev->bus->hcpriv;
2258         uhci_unlink_urbs(s, usb_dev, 0);
2259
2260         return 0;
2261 }
2262
2263 /*
2264  * uhci_get_current_frame_number()
2265  *
2266  * returns the current frame number for a USB bus/controller.
2267  */
2268 _static int uhci_get_current_frame_number (struct usb_device *usb_dev)
2269 {
2270         return UHCI_GET_CURRENT_FRAME ((uhci_t*) usb_dev->bus->hcpriv);
2271 }
2272
2273 struct usb_operations uhci_device_operations =
2274 {
2275         uhci_alloc_dev,
2276         uhci_free_dev,
2277         uhci_get_current_frame_number,
2278         uhci_submit_urb,
2279         uhci_unlink_urb
2280 };
2281
2282 _static void correct_data_toggles(struct urb *urb)
2283 {
2284         usb_settoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe),
2285                        !usb_gettoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe)));
2286
2287         while(urb) {
2288                 urb_priv_t *priv=urb->hcpriv;
2289                 uhci_desc_t *qh = list_entry (priv->desc_list.next, uhci_desc_t, desc_list);
2290                 struct list_head *p = qh->vertical.next;
2291                 uhci_desc_t *td;
2292                 dbg("URB to correct %p\n", urb);
2293
2294                 for (; p != &qh->vertical; p = p->next) {
2295                         td = list_entry (p, uhci_desc_t, vertical);
2296                         td->hw.td.info^=cpu_to_le32(1<<TD_TOKEN_TOGGLE);
2297                 }
2298                 urb=priv->next_queued_urb;
2299         }
2300 }
2301
2302 /*
2303  * For IN-control transfers, process_transfer gets a bit more complicated,
2304  * since there are devices that return less data (eg. strings) than they
2305  * have announced. This leads to a queue abort due to the short packet,
2306  * the status stage is not executed. If this happens, the status stage
2307  * is manually re-executed.
2308  * mode: PROCESS_TRANSFER_REGULAR: regular (unlink QH)
2309  *       PROCESS_TRANSFER_DONT_UNLINK: QHs already unlinked (for async unlink_urb)
2310  */
2311
2312 _static int process_transfer (uhci_t *s, struct urb *urb, int mode)
2313 {
2314         int ret = 0;
2315         urb_priv_t *urb_priv = urb->hcpriv;
2316         struct list_head *qhl = urb_priv->desc_list.next;
2317         uhci_desc_t *qh = list_entry (qhl, uhci_desc_t, desc_list);
2318         struct list_head *p = qh->vertical.next;
2319         uhci_desc_t *desc= list_entry (urb_priv->desc_list.prev, uhci_desc_t, desc_list);
2320         uhci_desc_t *last_desc = list_entry (desc->vertical.prev, uhci_desc_t, vertical);
2321         int data_toggle = usb_gettoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe));      // save initial data_toggle
2322         int maxlength;  // extracted and remapped info from TD
2323         int actual_length;
2324         int status = 0;
2325
2326         //dbg("process_transfer: urb %p, urb_priv %p, qh %p last_desc %p\n",urb,urb_priv, qh, last_desc);
2327
2328         /* if the status phase has been retriggered and the
2329            queue is empty or the last status-TD is inactive, the retriggered
2330            status stage is completed
2331          */
2332
2333         if (urb_priv->flags &&
2334             ((qh->hw.qh.element == cpu_to_le32(UHCI_PTR_TERM)) || !is_td_active(desc)))
2335                 goto transfer_finished;
2336
2337         urb->actual_length=0;
2338
2339         for (; p != &qh->vertical; p = p->next) {
2340                 desc = list_entry (p, uhci_desc_t, vertical);
2341
2342                 if (is_td_active(desc)) {       // do not process active TDs
2343                         if (mode == CLEAN_TRANSFER_DELETION_MARK) // if called from async_unlink
2344                                 uhci_clean_transfer(s, urb, qh, CLEAN_TRANSFER_DELETION_MARK);
2345                         return ret;
2346                 }
2347
2348                 actual_length = uhci_actual_length(le32_to_cpu(desc->hw.td.status));            // extract transfer parameters from TD
2349                 maxlength = (((le32_to_cpu(desc->hw.td.info) >> 21) & 0x7ff) + 1) & 0x7ff;
2350                 status = uhci_map_status (uhci_status_bits (le32_to_cpu(desc->hw.td.status)), usb_pipeout (urb->pipe));
2351
2352                 if (status == -EPIPE) {                 // see if EP is stalled
2353                         // set up stalled condition
2354                         usb_endpoint_halt (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe));
2355                 }
2356
2357                 if (status && (status != -EPIPE)) {     // if any error occurred stop processing of further TDs
2358                         // only set ret if status returned an error
2359   is_error:
2360                         ret = status;
2361                         urb->error_count++;
2362                         break;
2363                 }
2364                 else if ((le32_to_cpu(desc->hw.td.info) & 0xff) != USB_PID_SETUP)
2365                         urb->actual_length += actual_length;
2366
2367                 // got less data than requested
2368                 if ( (actual_length < maxlength)) {
2369                         if (urb->transfer_flags & USB_DISABLE_SPD) {
2370                                 status = -EREMOTEIO;    // treat as real error
2371                                 dbg("process_transfer: SPD!!");
2372                                 break;  // exit after this TD because SP was detected
2373                         }
2374
2375                         // short read during control-IN: re-start status stage
2376                         if ((usb_pipetype (urb->pipe) == PIPE_CONTROL)) {
2377                                 if (uhci_packetid(le32_to_cpu(last_desc->hw.td.info)) == USB_PID_OUT) {
2378
2379                                         set_qh_element(qh, last_desc->dma_addr);  // re-trigger status stage
2380                                         dbg("short packet during control transfer, retrigger status stage @ %p",last_desc);
2381                                         urb_priv->flags = 1; // mark as short control packet
2382                                         return 0;
2383                                 }
2384                         }
2385                         // all other cases: short read is OK
2386                         data_toggle = uhci_toggle (le32_to_cpu(desc->hw.td.info));
2387                         break;
2388                 }
2389                 else if (status)
2390                         goto is_error;
2391
2392                 data_toggle = uhci_toggle (le32_to_cpu(desc->hw.td.info));
2393                 queue_dbg("process_transfer: len:%d status:%x mapped:%x toggle:%d", actual_length, le32_to_cpu(desc->hw.td.status),status, data_toggle);
2394
2395         }
2396
2397         if (usb_pipetype (urb->pipe) == PIPE_BULK ) {  /* toggle correction for short bulk transfers (nonqueued/queued) */
2398
2399                 urb_priv_t *priv=(urb_priv_t*)urb->hcpriv;
2400                 struct urb *next_queued_urb=priv->next_queued_urb;
2401
2402                 if (next_queued_urb) {
2403                         urb_priv_t *next_priv=(urb_priv_t*)next_queued_urb->hcpriv;
2404                         uhci_desc_t *qh = list_entry (next_priv->desc_list.next, uhci_desc_t, desc_list);
2405                         uhci_desc_t *first_td=list_entry (qh->vertical.next, uhci_desc_t, vertical);
2406
2407                         if (data_toggle == uhci_toggle (le32_to_cpu(first_td->hw.td.info))) {
2408                                 err("process_transfer: fixed toggle");
2409                                 correct_data_toggles(next_queued_urb);
2410                         }
2411                 }
2412                 else
2413                         usb_settoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe), !data_toggle);
2414         }
2415
2416  transfer_finished:
2417
2418         uhci_clean_transfer(s, urb, qh, mode);
2419
2420         urb->status = status;
2421
2422 #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH
2423         disable_desc_loop(s,urb);
2424 #endif
2425
2426         queue_dbg("process_transfer: (end) urb %p, wanted len %d, len %d status %x err %d",
2427                 urb,urb->transfer_buffer_length,urb->actual_length, urb->status, urb->error_count);
2428         return ret;
2429 }
2430
2431 _static int process_interrupt (uhci_t *s, struct urb *urb)
2432 {
2433         int ret = -EINPROGRESS;
2434         urb_priv_t *urb_priv = urb->hcpriv;
2435         struct list_head *p;
2436         uhci_desc_t *desc = list_entry (urb_priv->desc_list.prev, uhci_desc_t, desc_list);
2437
2438         int actual_length;
2439         int status = 0;
2440
2441         //dbg("urb contains interrupt request");
2442
2443         // Maybe we allow more than one TD later ;-)
2444         while ((p = urb_priv->desc_list.next) != &urb_priv->desc_list) {
2445
2446                 desc = list_entry (p, uhci_desc_t, desc_list);
2447
2448                 if (is_td_active(desc)) {
2449                         // do not process active TDs
2450                         //dbg("TD ACT Status @%p %08x",desc,le32_to_cpu(desc->hw.td.status));
2451                         break;
2452                 }
2453
2454                 if (!(desc->hw.td.status & cpu_to_le32(TD_CTRL_IOC))) {
2455                         // do not process one-shot TDs, no recycling
2456                         break;
2457                 }
2458                 // extract transfer parameters from TD
2459
2460                 actual_length = uhci_actual_length(le32_to_cpu(desc->hw.td.status));
2461                 status = uhci_map_status (uhci_status_bits (le32_to_cpu(desc->hw.td.status)), usb_pipeout (urb->pipe));
2462
2463                 // see if EP is stalled
2464                 if (status == -EPIPE) {
2465                         // set up stalled condition
2466                         usb_endpoint_halt (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe));
2467                 }
2468
2469                 // if any error occurred: ignore this td, and continue
2470                 if (status != 0) {
2471                         //uhci_show_td (desc);
2472                         urb->error_count++;
2473                         goto recycle;
2474                 }
2475                 else
2476                         urb->actual_length = actual_length;
2477
2478         recycle:
2479                 uhci_urb_dma_sync(s, urb, urb->hcpriv);
2480                 if (urb->complete) {
2481                         //dbg("process_interrupt: calling completion, status %i",status);
2482                         urb->status = status;
2483                         ((urb_priv_t*)urb->hcpriv)->flags=1; // if unlink_urb is called during completion
2484
2485                         spin_unlock(&s->urb_list_lock);
2486
2487                         urb->complete ((struct urb *) urb);
2488
2489                         spin_lock(&s->urb_list_lock);
2490
2491                         ((urb_priv_t*)urb->hcpriv)->flags=0;
2492                 }
2493
2494                 if ((urb->status != -ECONNABORTED) && (urb->status != -ECONNRESET) &&
2495                             (urb->status != -ENOENT)) {
2496
2497                         urb->status = -EINPROGRESS;
2498
2499                         // Recycle INT-TD if interval!=0, else mark TD as one-shot
2500                         if (urb->interval) {
2501
2502                                 desc->hw.td.info &= cpu_to_le32(~(1 << TD_TOKEN_TOGGLE));
2503                                 if (status==0) {
2504                                         ((urb_priv_t*)urb->hcpriv)->started=jiffies;
2505                                         desc->hw.td.info |= cpu_to_le32((usb_gettoggle (urb->dev, usb_pipeendpoint (urb->pipe),
2506                                                                             usb_pipeout (urb->pipe)) << TD_TOKEN_TOGGLE));
2507                                         usb_dotoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe));
2508                                 } else {
2509                                         desc->hw.td.info |= cpu_to_le32((!usb_gettoggle (urb->dev, usb_pipeendpoint (urb->pipe),
2510                                                                              usb_pipeout (urb->pipe)) << TD_TOKEN_TOGGLE));
2511                                 }
2512                                 desc->hw.td.status= cpu_to_le32((urb->pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE | TD_CTRL_IOC |
2513                                         (urb->transfer_flags & USB_DISABLE_SPD ? 0 : TD_CTRL_SPD) | (3 << 27));
2514                                 mb();
2515                         }
2516                         else {
2517                                 uhci_unlink_urb_async(s, urb, UNLINK_ASYNC_STORE_URB);
2518                                 uhci_clean_iso_step2(s, urb_priv);
2519                                 // correct toggle after unlink
2520                                 usb_dotoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe));
2521                                 clr_td_ioc(desc); // inactivate TD
2522                         }
2523                 }
2524         }
2525
2526         return ret;
2527 }
2528
2529 // mode: PROCESS_ISO_REGULAR: processing only for done TDs, unlink TDs
2530 // mode: PROCESS_ISO_FORCE: force processing, don't unlink TDs (already unlinked)
2531
2532 _static int process_iso (uhci_t *s, struct urb *urb, int mode)
2533 {
2534         int i;
2535         int ret = 0;
2536         urb_priv_t *urb_priv = urb->hcpriv;
2537         struct list_head *p = urb_priv->desc_list.next, *p_tmp;
2538         uhci_desc_t *desc = list_entry (urb_priv->desc_list.prev, uhci_desc_t, desc_list);
2539
2540         dbg("urb contains iso request");
2541         if (is_td_active(desc) && mode==PROCESS_ISO_REGULAR)
2542                 return -EXDEV;  // last TD not finished
2543
2544         urb->error_count = 0;
2545         urb->actual_length = 0;
2546         urb->status = 0;
2547         dbg("process iso urb %p, %li, %i, %i, %i %08x",urb,jiffies,UHCI_GET_CURRENT_FRAME(s),
2548             urb->number_of_packets,mode,le32_to_cpu(desc->hw.td.status));
2549
2550         for (i = 0; p != &urb_priv->desc_list;  i++) {
2551                 desc = list_entry (p, uhci_desc_t, desc_list);
2552
2553                 //uhci_show_td(desc);
2554                 if (is_td_active(desc)) {
2555                         // means we have completed the last TD, but not the TDs before
2556                         desc->hw.td.status &= cpu_to_le32(~TD_CTRL_ACTIVE);
2557                         dbg("TD still active (%x)- grrr. paranoia!", le32_to_cpu(desc->hw.td.status));
2558                         ret = -EXDEV;
2559                         urb->iso_frame_desc[i].status = ret;
2560                         unlink_td (s, desc, 1);
2561                         // FIXME: immediate deletion may be dangerous
2562                         goto err;
2563                 }
2564
2565                 if (mode == PROCESS_ISO_REGULAR)
2566                         unlink_td (s, desc, 1);
2567
2568                 if (urb->number_of_packets <= i) {
2569                         dbg("urb->number_of_packets (%d)<=(%d)", urb->number_of_packets, i);
2570                         ret = -EINVAL;
2571                         goto err;
2572                 }
2573
2574                 urb->iso_frame_desc[i].actual_length = uhci_actual_length(le32_to_cpu(desc->hw.td.status));
2575                 urb->iso_frame_desc[i].status = uhci_map_status (uhci_status_bits (le32_to_cpu(desc->hw.td.status)), usb_pipeout (urb->pipe));
2576                 urb->actual_length += urb->iso_frame_desc[i].actual_length;
2577
2578               err:
2579
2580                 if (urb->iso_frame_desc[i].status != 0) {
2581                         urb->error_count++;
2582                         urb->status = urb->iso_frame_desc[i].status;
2583                 }
2584                 dbg("process_iso: %i: len:%d %08x status:%x",
2585                      i, urb->iso_frame_desc[i].actual_length, le32_to_cpu(desc->hw.td.status),urb->iso_frame_desc[i].status);
2586
2587                 p_tmp = p;
2588                 p = p->next;
2589                 list_del (p_tmp);
2590                 delete_desc (s, desc);
2591         }
2592
2593         dbg("process_iso: exit %i (%d), actual_len %i", i, ret,urb->actual_length);
2594         return ret;
2595 }
2596
2597
2598 _static int process_urb (uhci_t *s, struct list_head *p)
2599 {
2600         int ret = 0;
2601         struct urb *urb;
2602
2603         urb=list_entry (p, struct urb, urb_list);
2604         //dbg("process_urb: found queued urb: %p", urb);
2605
2606         switch (usb_pipetype (urb->pipe)) {
2607         case PIPE_CONTROL:
2608                 ret = process_transfer (s, urb, CLEAN_TRANSFER_REGULAR);
2609                 break;
2610         case PIPE_BULK:
2611                 if (!s->avoid_bulk.counter)
2612                         ret = process_transfer (s, urb, CLEAN_TRANSFER_REGULAR);
2613                 else
2614                         return 0;
2615                 break;
2616         case PIPE_ISOCHRONOUS:
2617                 ret = process_iso (s, urb, PROCESS_ISO_REGULAR);
2618                 break;
2619         case PIPE_INTERRUPT:
2620                 ret = process_interrupt (s, urb);
2621                 break;
2622         }
2623
2624         if (urb->status != -EINPROGRESS) {
2625                 urb_priv_t *urb_priv;
2626                 struct usb_device *usb_dev;
2627
2628                 usb_dev=urb->dev;
2629
2630                 /* Release bandwidth for Interrupt or Iso transfers */
2631                 if (urb->bandwidth) {
2632                         if (usb_pipetype(urb->pipe)==PIPE_ISOCHRONOUS)
2633                                 usb_release_bandwidth (urb->dev, urb, 1);
2634                         else if (usb_pipetype(urb->pipe)==PIPE_INTERRUPT && urb->interval)
2635                                 usb_release_bandwidth (urb->dev, urb, 0);
2636                 }
2637
2638                 dbg("dequeued urb: %p", urb);
2639                 dequeue_urb (s, urb);
2640
2641                 urb_priv = urb->hcpriv;
2642
2643                 uhci_urb_dma_unmap(s, urb, urb_priv);
2644
2645 #ifdef DEBUG_SLAB
2646                 kmem_cache_free(urb_priv_kmem, urb_priv);
2647 #else
2648                 kfree (urb_priv);
2649 #endif
2650
2651                 if ((usb_pipetype (urb->pipe) != PIPE_INTERRUPT)) {  // process_interrupt does completion on its own
2652                         struct urb *next_urb = urb->next;
2653                         int is_ring = 0;
2654                         int contains_killed = 0;
2655                         int loop_count=0;
2656
2657                         if (next_urb) {
2658                                 // Find out if the URBs are linked to a ring
2659                                 while  (next_urb != NULL && next_urb != urb && loop_count < MAX_NEXT_COUNT) {
2660                                         if (next_urb->status == -ENOENT) {// killed URBs break ring structure & resubmission
2661                                                 contains_killed = 1;
2662                                                 break;
2663                                         }
2664                                         next_urb = next_urb->next;
2665                                         loop_count++;
2666                                 }
2667
2668                                 if (loop_count == MAX_NEXT_COUNT)
2669                                         err("process_urb: Too much linked URBs in ring detection!");
2670
2671                                 if (next_urb == urb)
2672                                         is_ring=1;
2673                         }
2674
2675                         // Submit idle/non-killed URBs linked with urb->next
2676                         // Stop before the current URB
2677
2678                         next_urb = urb->next;
2679                         if (next_urb && !contains_killed) {
2680                                 int ret_submit;
2681                                 next_urb = urb->next;
2682
2683                                 loop_count=0;
2684                                 while (next_urb != NULL && next_urb != urb && loop_count < MAX_NEXT_COUNT) {
2685                                         if (next_urb->status != -EINPROGRESS) {
2686
2687                                                 if (next_urb->status == -ENOENT)
2688                                                         break;
2689
2690                                                 spin_unlock(&s->urb_list_lock);
2691
2692                                                 ret_submit=uhci_submit_urb(next_urb);
2693                                                 spin_lock(&s->urb_list_lock);
2694
2695                                                 if (ret_submit)
2696                                                         break;
2697                                         }
2698                                         loop_count++;
2699                                         next_urb = next_urb->next;
2700                                 }
2701                                 if (loop_count == MAX_NEXT_COUNT)
2702                                         err("process_urb: Too much linked URBs in resubmission!");
2703                         }
2704
2705                         // Completion
2706                         if (urb->complete) {
2707                                 int was_unlinked = (urb->status == -ENOENT);
2708                                 urb->dev = NULL;
2709                                 spin_unlock(&s->urb_list_lock);
2710
2711                                 urb->complete ((struct urb *) urb);
2712
2713                                 // Re-submit the URB if ring-linked
2714                                 if (is_ring && !was_unlinked && !contains_killed) {
2715                                         urb->dev=usb_dev;
2716                                         uhci_submit_urb (urb);
2717                                 }
2718                                 spin_lock(&s->urb_list_lock);
2719                         }
2720
2721                         usb_dec_dev_use (usb_dev);
2722                 }
2723         }
2724
2725         return ret;
2726 }
2727
2728 _static void uhci_interrupt (int irq, void *__uhci, struct pt_regs *regs)
2729 {
2730         uhci_t *s = __uhci;
2731         unsigned int io_addr = s->io_addr;
2732         unsigned short status;
2733         struct list_head *p, *p2;
2734         int restarts, work_done;
2735
2736         /*
2737          * Read the interrupt status, and write it back to clear the
2738          * interrupt cause
2739          */
2740
2741         status = inw (io_addr + USBSTS);
2742
2743         if (!status)            /* shared interrupt, not mine */
2744                 return;
2745
2746         dbg("interrupt");
2747
2748         if (status != 1) {
2749                 dbg("status %x, frame# %i", status, UHCI_GET_CURRENT_FRAME(s));
2750
2751                 // remove host controller halted state
2752                 if ((status&0x20) && (s->running)) {
2753                         err("Host controller halted, trying to restart.");
2754                         outw (USBCMD_RS | inw(io_addr + USBCMD), io_addr + USBCMD);
2755                 }
2756                 //uhci_show_status (s);
2757         }
2758         /*
2759          * traverse the list in *reverse* direction, because new entries
2760          * may be added at the end.
2761          * also, because process_urb may unlink the current urb,
2762          * we need to advance the list before
2763          * New: check for max. workload and restart count
2764          */
2765
2766         spin_lock (&s->urb_list_lock);
2767
2768         restarts=0;
2769         work_done=0;
2770
2771 restart:
2772         s->unlink_urb_done=0;
2773         p = s->urb_list.prev;
2774
2775         while (p != &s->urb_list && (work_done < 1024)) {
2776                 p2 = p;
2777                 p = p->prev;
2778
2779                 process_urb (s, p2);
2780
2781                 work_done++;
2782
2783                 if (s->unlink_urb_done) {
2784                         s->unlink_urb_done=0;
2785                         restarts++;
2786
2787                         if (restarts<16)        // avoid endless restarts
2788                                 goto restart;
2789                         else
2790                                 break;
2791                 }
2792         }
2793         if (time_after(jiffies, s->timeout_check + (HZ/30)))
2794                 uhci_check_timeouts(s);
2795
2796         clean_descs(s, CLEAN_NOT_FORCED);
2797         uhci_cleanup_unlink(s, CLEAN_NOT_FORCED);
2798         uhci_switch_timer_int(s);
2799
2800         spin_unlock (&s->urb_list_lock);
2801
2802         outw (status, io_addr + USBSTS);
2803
2804         //dbg("uhci_interrupt: done");
2805 }
2806
2807 _static void reset_hc (uhci_t *s)
2808 {
2809         unsigned int io_addr = s->io_addr;
2810
2811         s->apm_state = 0;
2812         /* Global reset for 50ms */
2813         outw (USBCMD_GRESET, io_addr + USBCMD);
2814         uhci_wait_ms (50);
2815         outw (0, io_addr + USBCMD);
2816         uhci_wait_ms (10);
2817 }
2818
2819 _static void start_hc (uhci_t *s)
2820 {
2821         unsigned int io_addr = s->io_addr;
2822         int timeout = 10;
2823
2824         /*
2825          * Reset the HC - this will force us to get a
2826          * new notification of any already connected
2827          * ports due to the virtual disconnect that it
2828          * implies.
2829          */
2830         outw (USBCMD_HCRESET, io_addr + USBCMD);
2831
2832         while (inw (io_addr + USBCMD) & USBCMD_HCRESET) {
2833                 if (!--timeout) {
2834                         err("USBCMD_HCRESET timed out!");
2835                         break;
2836                 }
2837                 udelay(1);
2838         }
2839
2840         /* Turn on all interrupts */
2841         outw (USBINTR_TIMEOUT | USBINTR_RESUME | USBINTR_IOC | USBINTR_SP, io_addr + USBINTR);
2842
2843         /* Start at frame 0 */
2844         outw (0, io_addr + USBFRNUM);
2845         outl (s->framelist_dma, io_addr + USBFLBASEADD);
2846
2847         /* Run and mark it configured with a 64-byte max packet */
2848         outw (USBCMD_RS | USBCMD_CF | USBCMD_MAXP, io_addr + USBCMD);
2849         s->apm_state = 1;
2850         s->running = 1;
2851 }
2852
2853 /* No  __devexit, since it maybe called from alloc_uhci() */
2854 _static void
2855 uhci_pci_remove (struct pci_dev *dev)
2856 {
2857         uhci_t *s = pci_get_drvdata(dev);
2858         struct usb_device *root_hub = s->bus->root_hub;
2859
2860         s->running = 0;             // Don't allow submit_urb
2861
2862         if (root_hub)
2863                 usb_disconnect (&root_hub);
2864
2865         reset_hc (s);
2866         wait_ms (1);
2867
2868         uhci_unlink_urbs (s, 0, CLEAN_FORCED);  // Forced unlink of remaining URBs
2869         uhci_cleanup_unlink (s, CLEAN_FORCED);  // force cleanup of async killed URBs
2870
2871         usb_deregister_bus (s->bus);
2872
2873         release_region (s->io_addr, s->io_size);
2874         free_irq (s->irq, s);
2875         usb_free_bus (s->bus);
2876         cleanup_skel (s);
2877         kfree (s);
2878 }
2879
2880 _static int __init uhci_start_usb (uhci_t *s)
2881 {                               /* start it up */
2882         /* connect the virtual root hub */
2883         struct usb_device *usb_dev;
2884
2885         usb_dev = usb_alloc_dev (NULL, s->bus);
2886         if (!usb_dev)
2887                 return -1;
2888
2889         s->bus->root_hub = usb_dev;
2890         usb_connect (usb_dev);
2891
2892         if (usb_new_device (usb_dev) != 0) {
2893                 usb_free_dev (usb_dev);
2894                 return -1;
2895         }
2896
2897         return 0;
2898 }
2899
2900 #ifdef CONFIG_PM
2901 _static int
2902 uhci_pci_suspend (struct pci_dev *dev, u32 state)
2903 {
2904         reset_hc((uhci_t *) pci_get_drvdata(dev));
2905         return 0;
2906 }
2907
2908 _static int
2909 uhci_pci_resume (struct pci_dev *dev)
2910 {
2911         start_hc((uhci_t *) pci_get_drvdata(dev));
2912         return 0;
2913 }
2914 #endif
2915
2916 _static int __devinit alloc_uhci (struct pci_dev *dev, int irq, unsigned int io_addr, unsigned int io_size)
2917 {
2918         uhci_t *s;
2919         struct usb_bus *bus;
2920         char buf[8], *bufp = buf;
2921
2922 #ifndef __sparc__
2923         sprintf(buf, "%d", irq);
2924 #else
2925         bufp = __irq_itoa(irq);
2926 #endif
2927         printk(KERN_INFO __FILE__ ": USB UHCI at I/O 0x%x, IRQ %s\n",
2928                 io_addr, bufp);
2929
2930         s = kmalloc (sizeof (uhci_t), GFP_KERNEL);
2931         if (!s)
2932                 return -1;
2933
2934         memset (s, 0, sizeof (uhci_t));
2935         INIT_LIST_HEAD (&s->free_desc);
2936         INIT_LIST_HEAD (&s->urb_list);
2937         INIT_LIST_HEAD (&s->urb_unlinked);
2938         spin_lock_init (&s->urb_list_lock);
2939         spin_lock_init (&s->qh_lock);
2940         spin_lock_init (&s->td_lock);
2941         atomic_set(&s->avoid_bulk, 0);
2942         s->irq = -1;
2943         s->io_addr = io_addr;
2944         s->io_size = io_size;
2945         s->uhci_pci=dev;
2946
2947         bus = usb_alloc_bus (&uhci_device_operations);
2948         if (!bus) {
2949                 kfree (s);
2950                 return -1;
2951         }
2952
2953         s->bus = bus;
2954         bus->bus_name = dev->slot_name;
2955         bus->hcpriv = s;
2956
2957         /* UHCI specs says devices must have 2 ports, but goes on to say */
2958         /* they may have more but give no way to determine how many they */
2959         /* have, so default to 2 */
2960         /* According to the UHCI spec, Bit 7 is always set to 1. So we try */
2961         /* to use this to our advantage */
2962
2963         for (s->maxports = 0; s->maxports < (io_size - 0x10) / 2; s->maxports++) {
2964                 unsigned int portstatus;
2965
2966                 portstatus = inw (io_addr + 0x10 + (s->maxports * 2));
2967                 dbg("port %i, adr %x status %x", s->maxports,
2968                         io_addr + 0x10 + (s->maxports * 2), portstatus);
2969                 if (!(portstatus & 0x0080))
2970                         break;
2971         }
2972         warn("Detected %d ports", s->maxports);
2973
2974         /* This is experimental so anything less than 2 or greater than 8 is */
2975         /*  something weird and we'll ignore it */
2976         if (s->maxports < 2 || s->maxports > 8) {
2977                 dbg("Port count misdetected, forcing to 2 ports");
2978                 s->maxports = 2;
2979         }
2980
2981         s->rh.numports = s->maxports;
2982         s->loop_usage=0;
2983         if (init_skel (s)) {
2984                 usb_free_bus (bus);
2985                 kfree(s);
2986                 return -1;
2987         }
2988
2989         request_region (s->io_addr, io_size, MODNAME);
2990         reset_hc (s);
2991         usb_register_bus (s->bus);
2992
2993         start_hc (s);
2994
2995         if (request_irq (irq, uhci_interrupt, SA_SHIRQ, MODNAME, s)) {
2996                 err("request_irq %d failed!",irq);
2997                 usb_free_bus (bus);
2998                 reset_hc (s);
2999                 release_region (s->io_addr, s->io_size);
3000                 cleanup_skel(s);
3001                 kfree(s);
3002                 return -1;
3003         }
3004
3005         /* Enable PIRQ */
3006         pci_write_config_word (dev, USBLEGSUP, USBLEGSUP_DEFAULT);
3007
3008         s->irq = irq;
3009
3010         if(uhci_start_usb (s) < 0) {
3011                 uhci_pci_remove(dev);
3012                 return -1;
3013         }
3014
3015         //chain new uhci device into global list
3016         pci_set_drvdata(dev, s);
3017         devs=s;
3018
3019         return 0;
3020 }
3021
3022 _static int __devinit
3023 uhci_pci_probe (struct pci_dev *dev, const struct pci_device_id *id)
3024 {
3025         int i;
3026
3027         if (pci_enable_device(dev) < 0)
3028                 return -ENODEV;
3029
3030         if (!dev->irq) {
3031                 err("found UHCI device with no IRQ assigned. check BIOS settings!");
3032                 return -ENODEV;
3033         }
3034
3035         pci_set_master(dev);
3036
3037         /* Search for the IO base address.. */
3038         for (i = 0; i < 6; i++) {
3039
3040                 unsigned int io_addr = pci_resource_start(dev, i);
3041                 unsigned int io_size = pci_resource_len(dev, i);
3042                 if (!(pci_resource_flags(dev,i) & IORESOURCE_IO))
3043                         continue;
3044
3045                 /* Is it already in use? */
3046                 if (check_region (io_addr, io_size))
3047                         break;
3048                 /* disable legacy emulation */
3049                 pci_write_config_word (dev, USBLEGSUP, 0);
3050
3051                 return alloc_uhci(dev, dev->irq, io_addr, io_size);
3052         }
3053         return -ENODEV;
3054 }
3055
3056 /*-------------------------------------------------------------------------*/
3057
3058 static const struct pci_device_id __devinitdata uhci_pci_ids [] = { {
3059
3060         /* handle any USB UHCI controller */
3061         class:          ((PCI_CLASS_SERIAL_USB << 8) | 0x00),
3062         class_mask:     ~0,
3063
3064         /* no matter who makes it */
3065         vendor:         PCI_ANY_ID,
3066         device:         PCI_ANY_ID,
3067         subvendor:      PCI_ANY_ID,
3068         subdevice:      PCI_ANY_ID,
3069
3070         }, { /* end: all zeroes */ }
3071 };
3072
3073 MODULE_DEVICE_TABLE (pci, uhci_pci_ids);
3074
3075 static struct pci_driver uhci_pci_driver = {
3076         name:           "usb-uhci",
3077         id_table:       &uhci_pci_ids [0],
3078
3079         probe:          uhci_pci_probe,
3080         remove:         uhci_pci_remove,
3081
3082 #ifdef  CONFIG_PM
3083         suspend:        uhci_pci_suspend,
3084         resume:         uhci_pci_resume,
3085 #endif  /* PM */
3086
3087 };
3088
3089 /*-------------------------------------------------------------------------*/
3090
3091 static int __init uhci_hcd_init (void)
3092 {
3093         int retval;
3094
3095 #ifdef DEBUG_SLAB
3096         urb_priv_kmem = kmem_cache_create("urb_priv", sizeof(urb_priv_t), 0, SLAB_HWCACHE_ALIGN, NULL, NULL);
3097
3098         if(!urb_priv_kmem) {
3099                 err("kmem_cache_create for urb_priv_t failed (out of memory)");
3100                 return -ENOMEM;
3101         }
3102 #endif
3103         info(VERSTR);
3104
3105 #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH
3106         info("High bandwidth mode enabled");
3107 #endif
3108
3109         retval = pci_module_init (&uhci_pci_driver);
3110
3111 #ifdef DEBUG_SLAB
3112         if (retval < 0 ) {
3113                 if (kmem_cache_destroy(urb_priv_kmem))
3114                         err("urb_priv_kmem remained");
3115         }
3116 #endif
3117
3118         info(DRIVER_VERSION ":" DRIVER_DESC);
3119
3120         return retval;
3121 }
3122
3123 static void __exit uhci_hcd_cleanup (void)
3124 {
3125         pci_unregister_driver (&uhci_pci_driver);
3126
3127 #ifdef DEBUG_SLAB
3128         if(kmem_cache_destroy(urb_priv_kmem))
3129                 err("urb_priv_kmem remained");
3130 #endif
3131 }
3132
3133 module_init (uhci_hcd_init);
3134 module_exit (uhci_hcd_cleanup);
3135
3136
3137 MODULE_AUTHOR( DRIVER_AUTHOR );
3138 MODULE_DESCRIPTION( DRIVER_DESC );
3139 MODULE_LICENSE("GPL");