[PATCH] USB: UHCI: fix obscure bug in enqueue()
[linux-2.6] / drivers / usb / host / uhci-q.c
1 /*
2  * Universal Host Controller Interface driver for USB.
3  *
4  * Maintainer: Alan Stern <stern@rowland.harvard.edu>
5  *
6  * (C) Copyright 1999 Linus Torvalds
7  * (C) Copyright 1999-2002 Johannes Erdfelt, johannes@erdfelt.com
8  * (C) Copyright 1999 Randy Dunlap
9  * (C) Copyright 1999 Georg Acher, acher@in.tum.de
10  * (C) Copyright 1999 Deti Fliegl, deti@fliegl.de
11  * (C) Copyright 1999 Thomas Sailer, sailer@ife.ee.ethz.ch
12  * (C) Copyright 1999 Roman Weissgaerber, weissg@vienna.at
13  * (C) Copyright 2000 Yggdrasil Computing, Inc. (port of new PCI interface
14  *               support from usb-ohci.c by Adam Richter, adam@yggdrasil.com).
15  * (C) Copyright 1999 Gregory P. Smith (from usb-ohci.c)
16  * (C) Copyright 2004-2005 Alan Stern, stern@rowland.harvard.edu
17  */
18
19 static void uhci_free_pending_tds(struct uhci_hcd *uhci);
20
21 /*
22  * Technically, updating td->status here is a race, but it's not really a
23  * problem. The worst that can happen is that we set the IOC bit again
24  * generating a spurious interrupt. We could fix this by creating another
25  * QH and leaving the IOC bit always set, but then we would have to play
26  * games with the FSBR code to make sure we get the correct order in all
27  * the cases. I don't think it's worth the effort
28  */
29 static void uhci_set_next_interrupt(struct uhci_hcd *uhci)
30 {
31         if (uhci->is_stopped)
32                 mod_timer(&uhci_to_hcd(uhci)->rh_timer, jiffies);
33         uhci->term_td->status |= cpu_to_le32(TD_CTRL_IOC); 
34 }
35
36 static inline void uhci_clear_next_interrupt(struct uhci_hcd *uhci)
37 {
38         uhci->term_td->status &= ~cpu_to_le32(TD_CTRL_IOC);
39 }
40
41 static struct uhci_td *uhci_alloc_td(struct uhci_hcd *uhci)
42 {
43         dma_addr_t dma_handle;
44         struct uhci_td *td;
45
46         td = dma_pool_alloc(uhci->td_pool, GFP_ATOMIC, &dma_handle);
47         if (!td)
48                 return NULL;
49
50         td->dma_handle = dma_handle;
51         td->frame = -1;
52
53         INIT_LIST_HEAD(&td->list);
54         INIT_LIST_HEAD(&td->remove_list);
55         INIT_LIST_HEAD(&td->fl_list);
56
57         return td;
58 }
59
60 static void uhci_free_td(struct uhci_hcd *uhci, struct uhci_td *td)
61 {
62         if (!list_empty(&td->list))
63                 dev_warn(uhci_dev(uhci), "td %p still in list!\n", td);
64         if (!list_empty(&td->remove_list))
65                 dev_warn(uhci_dev(uhci), "td %p still in remove_list!\n", td);
66         if (!list_empty(&td->fl_list))
67                 dev_warn(uhci_dev(uhci), "td %p still in fl_list!\n", td);
68
69         dma_pool_free(uhci->td_pool, td, td->dma_handle);
70 }
71
72 static inline void uhci_fill_td(struct uhci_td *td, u32 status,
73                 u32 token, u32 buffer)
74 {
75         td->status = cpu_to_le32(status);
76         td->token = cpu_to_le32(token);
77         td->buffer = cpu_to_le32(buffer);
78 }
79
80 /*
81  * We insert Isochronous URBs directly into the frame list at the beginning
82  */
83 static inline void uhci_insert_td_in_frame_list(struct uhci_hcd *uhci,
84                 struct uhci_td *td, unsigned framenum)
85 {
86         framenum &= (UHCI_NUMFRAMES - 1);
87
88         td->frame = framenum;
89
90         /* Is there a TD already mapped there? */
91         if (uhci->frame_cpu[framenum]) {
92                 struct uhci_td *ftd, *ltd;
93
94                 ftd = uhci->frame_cpu[framenum];
95                 ltd = list_entry(ftd->fl_list.prev, struct uhci_td, fl_list);
96
97                 list_add_tail(&td->fl_list, &ftd->fl_list);
98
99                 td->link = ltd->link;
100                 wmb();
101                 ltd->link = cpu_to_le32(td->dma_handle);
102         } else {
103                 td->link = uhci->frame[framenum];
104                 wmb();
105                 uhci->frame[framenum] = cpu_to_le32(td->dma_handle);
106                 uhci->frame_cpu[framenum] = td;
107         }
108 }
109
110 static inline void uhci_remove_td_from_frame_list(struct uhci_hcd *uhci,
111                 struct uhci_td *td)
112 {
113         /* If it's not inserted, don't remove it */
114         if (td->frame == -1) {
115                 WARN_ON(!list_empty(&td->fl_list));
116                 return;
117         }
118
119         if (uhci->frame_cpu[td->frame] == td) {
120                 if (list_empty(&td->fl_list)) {
121                         uhci->frame[td->frame] = td->link;
122                         uhci->frame_cpu[td->frame] = NULL;
123                 } else {
124                         struct uhci_td *ntd;
125
126                         ntd = list_entry(td->fl_list.next, struct uhci_td, fl_list);
127                         uhci->frame[td->frame] = cpu_to_le32(ntd->dma_handle);
128                         uhci->frame_cpu[td->frame] = ntd;
129                 }
130         } else {
131                 struct uhci_td *ptd;
132
133                 ptd = list_entry(td->fl_list.prev, struct uhci_td, fl_list);
134                 ptd->link = td->link;
135         }
136
137         list_del_init(&td->fl_list);
138         td->frame = -1;
139 }
140
141 /*
142  * Remove all the TDs for an Isochronous URB from the frame list
143  */
144 static void uhci_unlink_isochronous_tds(struct uhci_hcd *uhci, struct urb *urb)
145 {
146         struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
147         struct uhci_td *td;
148
149         list_for_each_entry(td, &urbp->td_list, list)
150                 uhci_remove_td_from_frame_list(uhci, td);
151         wmb();
152 }
153
154 static struct uhci_qh *uhci_alloc_qh(struct uhci_hcd *uhci,
155                 struct usb_device *udev, struct usb_host_endpoint *hep)
156 {
157         dma_addr_t dma_handle;
158         struct uhci_qh *qh;
159
160         qh = dma_pool_alloc(uhci->qh_pool, GFP_ATOMIC, &dma_handle);
161         if (!qh)
162                 return NULL;
163
164         qh->dma_handle = dma_handle;
165
166         qh->element = UHCI_PTR_TERM;
167         qh->link = UHCI_PTR_TERM;
168
169         INIT_LIST_HEAD(&qh->queue);
170         INIT_LIST_HEAD(&qh->node);
171
172         if (udev) {             /* Normal QH */
173                 qh->dummy_td = uhci_alloc_td(uhci);
174                 if (!qh->dummy_td) {
175                         dma_pool_free(uhci->qh_pool, qh, dma_handle);
176                         return NULL;
177                 }
178                 qh->state = QH_STATE_IDLE;
179                 qh->hep = hep;
180                 qh->udev = udev;
181                 hep->hcpriv = qh;
182                 qh->type = hep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK;
183
184         } else {                /* Skeleton QH */
185                 qh->state = QH_STATE_ACTIVE;
186                 qh->udev = NULL;
187                 qh->type = -1;
188         }
189         return qh;
190 }
191
192 static void uhci_free_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
193 {
194         WARN_ON(qh->state != QH_STATE_IDLE && qh->udev);
195         if (!list_empty(&qh->queue))
196                 dev_warn(uhci_dev(uhci), "qh %p list not empty!\n", qh);
197
198         list_del(&qh->node);
199         if (qh->udev) {
200                 qh->hep->hcpriv = NULL;
201                 uhci_free_td(uhci, qh->dummy_td);
202         }
203         dma_pool_free(uhci->qh_pool, qh, qh->dma_handle);
204 }
205
206 /*
207  * When the currently executing URB is dequeued, save its current toggle value
208  */
209 static void uhci_save_toggle(struct uhci_qh *qh, struct urb *urb)
210 {
211         struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
212         struct uhci_td *td;
213
214         /* If the QH element pointer is UHCI_PTR_TERM then then currently
215          * executing URB has already been unlinked, so this one isn't it. */
216         if (qh_element(qh) == UHCI_PTR_TERM ||
217                                 qh->queue.next != &urbp->node)
218                 return;
219         qh->element = UHCI_PTR_TERM;
220
221         /* Only bulk and interrupt pipes have to worry about toggles */
222         if (!(qh->type == USB_ENDPOINT_XFER_BULK ||
223                         qh->type == USB_ENDPOINT_XFER_INT))
224                 return;
225
226         /* Find the first active TD; that's the device's toggle state */
227         list_for_each_entry(td, &urbp->td_list, list) {
228                 if (td_status(td) & TD_CTRL_ACTIVE) {
229                         qh->needs_fixup = 1;
230                         qh->initial_toggle = uhci_toggle(td_token(td));
231                         return;
232                 }
233         }
234
235         WARN_ON(1);
236 }
237
238 /*
239  * Fix up the data toggles for URBs in a queue, when one of them
240  * terminates early (short transfer, error, or dequeued).
241  */
242 static void uhci_fixup_toggles(struct uhci_qh *qh, int skip_first)
243 {
244         struct urb_priv *urbp = NULL;
245         struct uhci_td *td;
246         unsigned int toggle = qh->initial_toggle;
247         unsigned int pipe;
248
249         /* Fixups for a short transfer start with the second URB in the
250          * queue (the short URB is the first). */
251         if (skip_first)
252                 urbp = list_entry(qh->queue.next, struct urb_priv, node);
253
254         /* When starting with the first URB, if the QH element pointer is
255          * still valid then we know the URB's toggles are okay. */
256         else if (qh_element(qh) != UHCI_PTR_TERM)
257                 toggle = 2;
258
259         /* Fix up the toggle for the URBs in the queue.  Normally this
260          * loop won't run more than once: When an error or short transfer
261          * occurs, the queue usually gets emptied. */
262         urbp = list_prepare_entry(urbp, &qh->queue, node);
263         list_for_each_entry_continue(urbp, &qh->queue, node) {
264
265                 /* If the first TD has the right toggle value, we don't
266                  * need to change any toggles in this URB */
267                 td = list_entry(urbp->td_list.next, struct uhci_td, list);
268                 if (toggle > 1 || uhci_toggle(td_token(td)) == toggle) {
269                         td = list_entry(urbp->td_list.next, struct uhci_td,
270                                         list);
271                         toggle = uhci_toggle(td_token(td)) ^ 1;
272
273                 /* Otherwise all the toggles in the URB have to be switched */
274                 } else {
275                         list_for_each_entry(td, &urbp->td_list, list) {
276                                 td->token ^= __constant_cpu_to_le32(
277                                                         TD_TOKEN_TOGGLE);
278                                 toggle ^= 1;
279                         }
280                 }
281         }
282
283         wmb();
284         pipe = list_entry(qh->queue.next, struct urb_priv, node)->urb->pipe;
285         usb_settoggle(qh->udev, usb_pipeendpoint(pipe),
286                         usb_pipeout(pipe), toggle);
287         qh->needs_fixup = 0;
288 }
289
290 /*
291  * Put a QH on the schedule in both hardware and software
292  */
293 static void uhci_activate_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
294 {
295         struct uhci_qh *pqh;
296
297         WARN_ON(list_empty(&qh->queue));
298
299         /* Set the element pointer if it isn't set already.
300          * This isn't needed for Isochronous queues, but it doesn't hurt. */
301         if (qh_element(qh) == UHCI_PTR_TERM) {
302                 struct urb_priv *urbp = list_entry(qh->queue.next,
303                                 struct urb_priv, node);
304                 struct uhci_td *td = list_entry(urbp->td_list.next,
305                                 struct uhci_td, list);
306
307                 qh->element = cpu_to_le32(td->dma_handle);
308         }
309
310         if (qh->state == QH_STATE_ACTIVE)
311                 return;
312         qh->state = QH_STATE_ACTIVE;
313
314         /* Move the QH from its old list to the end of the appropriate
315          * skeleton's list */
316         if (qh == uhci->next_qh)
317                 uhci->next_qh = list_entry(qh->node.next, struct uhci_qh,
318                                 node);
319         list_move_tail(&qh->node, &qh->skel->node);
320
321         /* Link it into the schedule */
322         pqh = list_entry(qh->node.prev, struct uhci_qh, node);
323         qh->link = pqh->link;
324         wmb();
325         pqh->link = UHCI_PTR_QH | cpu_to_le32(qh->dma_handle);
326 }
327
328 /*
329  * Take a QH off the hardware schedule
330  */
331 static void uhci_unlink_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
332 {
333         struct uhci_qh *pqh;
334
335         if (qh->state == QH_STATE_UNLINKING)
336                 return;
337         WARN_ON(qh->state != QH_STATE_ACTIVE || !qh->udev);
338         qh->state = QH_STATE_UNLINKING;
339
340         /* Unlink the QH from the schedule and record when we did it */
341         pqh = list_entry(qh->node.prev, struct uhci_qh, node);
342         pqh->link = qh->link;
343         mb();
344
345         uhci_get_current_frame_number(uhci);
346         qh->unlink_frame = uhci->frame_number;
347
348         /* Force an interrupt so we know when the QH is fully unlinked */
349         if (list_empty(&uhci->skel_unlink_qh->node))
350                 uhci_set_next_interrupt(uhci);
351
352         /* Move the QH from its old list to the end of the unlinking list */
353         if (qh == uhci->next_qh)
354                 uhci->next_qh = list_entry(qh->node.next, struct uhci_qh,
355                                 node);
356         list_move_tail(&qh->node, &uhci->skel_unlink_qh->node);
357 }
358
359 /*
360  * When we and the controller are through with a QH, it becomes IDLE.
361  * This happens when a QH has been off the schedule (on the unlinking
362  * list) for more than one frame, or when an error occurs while adding
363  * the first URB onto a new QH.
364  */
365 static void uhci_make_qh_idle(struct uhci_hcd *uhci, struct uhci_qh *qh)
366 {
367         WARN_ON(qh->state == QH_STATE_ACTIVE);
368
369         if (qh == uhci->next_qh)
370                 uhci->next_qh = list_entry(qh->node.next, struct uhci_qh,
371                                 node);
372         list_move(&qh->node, &uhci->idle_qh_list);
373         qh->state = QH_STATE_IDLE;
374
375         /* If anyone is waiting for a QH to become idle, wake them up */
376         if (uhci->num_waiting)
377                 wake_up_all(&uhci->waitqh);
378 }
379
380 static inline struct urb_priv *uhci_alloc_urb_priv(struct uhci_hcd *uhci,
381                 struct urb *urb)
382 {
383         struct urb_priv *urbp;
384
385         urbp = kmem_cache_alloc(uhci_up_cachep, SLAB_ATOMIC);
386         if (!urbp)
387                 return NULL;
388
389         memset((void *)urbp, 0, sizeof(*urbp));
390
391         urbp->urb = urb;
392         urb->hcpriv = urbp;
393         
394         INIT_LIST_HEAD(&urbp->node);
395         INIT_LIST_HEAD(&urbp->td_list);
396
397         return urbp;
398 }
399
400 static void uhci_add_td_to_urb(struct urb *urb, struct uhci_td *td)
401 {
402         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
403
404         list_add_tail(&td->list, &urbp->td_list);
405 }
406
407 static void uhci_remove_td_from_urb(struct uhci_td *td)
408 {
409         if (list_empty(&td->list))
410                 return;
411
412         list_del_init(&td->list);
413 }
414
415 static void uhci_free_urb_priv(struct uhci_hcd *uhci,
416                 struct urb_priv *urbp)
417 {
418         struct uhci_td *td, *tmp;
419
420         if (!list_empty(&urbp->node))
421                 dev_warn(uhci_dev(uhci), "urb %p still on QH's list!\n",
422                                 urbp->urb);
423
424         uhci_get_current_frame_number(uhci);
425         if (uhci->frame_number + uhci->is_stopped != uhci->td_remove_age) {
426                 uhci_free_pending_tds(uhci);
427                 uhci->td_remove_age = uhci->frame_number;
428         }
429
430         /* Check to see if the remove list is empty. Set the IOC bit */
431         /* to force an interrupt so we can remove the TDs. */
432         if (list_empty(&uhci->td_remove_list))
433                 uhci_set_next_interrupt(uhci);
434
435         list_for_each_entry_safe(td, tmp, &urbp->td_list, list) {
436                 uhci_remove_td_from_urb(td);
437                 list_add(&td->remove_list, &uhci->td_remove_list);
438         }
439
440         urbp->urb->hcpriv = NULL;
441         kmem_cache_free(uhci_up_cachep, urbp);
442 }
443
444 static void uhci_inc_fsbr(struct uhci_hcd *uhci, struct urb *urb)
445 {
446         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
447
448         if ((!(urb->transfer_flags & URB_NO_FSBR)) && !urbp->fsbr) {
449                 urbp->fsbr = 1;
450                 if (!uhci->fsbr++ && !uhci->fsbrtimeout)
451                         uhci->skel_term_qh->link = cpu_to_le32(uhci->skel_fs_control_qh->dma_handle) | UHCI_PTR_QH;
452         }
453 }
454
455 static void uhci_dec_fsbr(struct uhci_hcd *uhci, struct urb *urb)
456 {
457         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
458
459         if ((!(urb->transfer_flags & URB_NO_FSBR)) && urbp->fsbr) {
460                 urbp->fsbr = 0;
461                 if (!--uhci->fsbr)
462                         uhci->fsbrtimeout = jiffies + FSBR_DELAY;
463         }
464 }
465
466 /*
467  * Map status to standard result codes
468  *
469  * <status> is (td_status(td) & 0xF60000), a.k.a.
470  * uhci_status_bits(td_status(td)).
471  * Note: <status> does not include the TD_CTRL_NAK bit.
472  * <dir_out> is True for output TDs and False for input TDs.
473  */
474 static int uhci_map_status(int status, int dir_out)
475 {
476         if (!status)
477                 return 0;
478         if (status & TD_CTRL_BITSTUFF)                  /* Bitstuff error */
479                 return -EPROTO;
480         if (status & TD_CTRL_CRCTIMEO) {                /* CRC/Timeout */
481                 if (dir_out)
482                         return -EPROTO;
483                 else
484                         return -EILSEQ;
485         }
486         if (status & TD_CTRL_BABBLE)                    /* Babble */
487                 return -EOVERFLOW;
488         if (status & TD_CTRL_DBUFERR)                   /* Buffer error */
489                 return -ENOSR;
490         if (status & TD_CTRL_STALLED)                   /* Stalled */
491                 return -EPIPE;
492         WARN_ON(status & TD_CTRL_ACTIVE);               /* Active */
493         return 0;
494 }
495
496 /*
497  * Control transfers
498  */
499 static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb,
500                 struct uhci_qh *qh)
501 {
502         struct uhci_td *td;
503         unsigned long destination, status;
504         int maxsze = le16_to_cpu(qh->hep->desc.wMaxPacketSize);
505         int len = urb->transfer_buffer_length;
506         dma_addr_t data = urb->transfer_dma;
507         __le32 *plink;
508
509         /* The "pipe" thing contains the destination in bits 8--18 */
510         destination = (urb->pipe & PIPE_DEVEP_MASK) | USB_PID_SETUP;
511
512         /* 3 errors, dummy TD remains inactive */
513         status = uhci_maxerr(3);
514         if (urb->dev->speed == USB_SPEED_LOW)
515                 status |= TD_CTRL_LS;
516
517         /*
518          * Build the TD for the control request setup packet
519          */
520         td = qh->dummy_td;
521         uhci_add_td_to_urb(urb, td);
522         uhci_fill_td(td, status, destination | uhci_explen(8),
523                         urb->setup_dma);
524         plink = &td->link;
525         status |= TD_CTRL_ACTIVE;
526
527         /*
528          * If direction is "send", change the packet ID from SETUP (0x2D)
529          * to OUT (0xE1).  Else change it from SETUP to IN (0x69) and
530          * set Short Packet Detect (SPD) for all data packets.
531          */
532         if (usb_pipeout(urb->pipe))
533                 destination ^= (USB_PID_SETUP ^ USB_PID_OUT);
534         else {
535                 destination ^= (USB_PID_SETUP ^ USB_PID_IN);
536                 status |= TD_CTRL_SPD;
537         }
538
539         /*
540          * Build the DATA TDs
541          */
542         while (len > 0) {
543                 int pktsze = min(len, maxsze);
544
545                 td = uhci_alloc_td(uhci);
546                 if (!td)
547                         goto nomem;
548                 *plink = cpu_to_le32(td->dma_handle);
549
550                 /* Alternate Data0/1 (start with Data1) */
551                 destination ^= TD_TOKEN_TOGGLE;
552         
553                 uhci_add_td_to_urb(urb, td);
554                 uhci_fill_td(td, status, destination | uhci_explen(pktsze),
555                                 data);
556                 plink = &td->link;
557
558                 data += pktsze;
559                 len -= pktsze;
560         }
561
562         /*
563          * Build the final TD for control status 
564          */
565         td = uhci_alloc_td(uhci);
566         if (!td)
567                 goto nomem;
568         *plink = cpu_to_le32(td->dma_handle);
569
570         /*
571          * It's IN if the pipe is an output pipe or we're not expecting
572          * data back.
573          */
574         destination &= ~TD_TOKEN_PID_MASK;
575         if (usb_pipeout(urb->pipe) || !urb->transfer_buffer_length)
576                 destination |= USB_PID_IN;
577         else
578                 destination |= USB_PID_OUT;
579
580         destination |= TD_TOKEN_TOGGLE;         /* End in Data1 */
581
582         status &= ~TD_CTRL_SPD;
583
584         uhci_add_td_to_urb(urb, td);
585         uhci_fill_td(td, status | TD_CTRL_IOC,
586                         destination | uhci_explen(0), 0);
587         plink = &td->link;
588
589         /*
590          * Build the new dummy TD and activate the old one
591          */
592         td = uhci_alloc_td(uhci);
593         if (!td)
594                 goto nomem;
595         *plink = cpu_to_le32(td->dma_handle);
596
597         uhci_fill_td(td, 0, USB_PID_OUT | uhci_explen(0), 0);
598         wmb();
599         qh->dummy_td->status |= __constant_cpu_to_le32(TD_CTRL_ACTIVE);
600         qh->dummy_td = td;
601
602         /* Low-speed transfers get a different queue, and won't hog the bus.
603          * Also, some devices enumerate better without FSBR; the easiest way
604          * to do that is to put URBs on the low-speed queue while the device
605          * isn't in the CONFIGURED state. */
606         if (urb->dev->speed == USB_SPEED_LOW ||
607                         urb->dev->state != USB_STATE_CONFIGURED)
608                 qh->skel = uhci->skel_ls_control_qh;
609         else {
610                 qh->skel = uhci->skel_fs_control_qh;
611                 uhci_inc_fsbr(uhci, urb);
612         }
613         return 0;
614
615 nomem:
616         /* Remove the dummy TD from the td_list so it doesn't get freed */
617         uhci_remove_td_from_urb(qh->dummy_td);
618         return -ENOMEM;
619 }
620
621 /*
622  * If control-IN transfer was short, the status packet wasn't sent.
623  * This routine changes the element pointer in the QH to point at the
624  * status TD.  It's safe to do this even while the QH is live, because
625  * the hardware only updates the element pointer following a successful
626  * transfer.  The inactive TD for the short packet won't cause an update,
627  * so the pointer won't get overwritten.  The next time the controller
628  * sees this QH, it will send the status packet.
629  */
630 static int usb_control_retrigger_status(struct uhci_hcd *uhci, struct urb *urb)
631 {
632         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
633         struct uhci_td *td;
634
635         urbp->short_transfer = 1;
636
637         td = list_entry(urbp->td_list.prev, struct uhci_td, list);
638         urbp->qh->element = cpu_to_le32(td->dma_handle);
639
640         return -EINPROGRESS;
641 }
642
643
644 static int uhci_result_control(struct uhci_hcd *uhci, struct urb *urb)
645 {
646         struct list_head *tmp, *head;
647         struct urb_priv *urbp = urb->hcpriv;
648         struct uhci_td *td;
649         unsigned int status;
650         int ret = 0;
651
652         head = &urbp->td_list;
653         if (urbp->short_transfer) {
654                 tmp = head->prev;
655                 goto status_stage;
656         }
657
658         urb->actual_length = 0;
659
660         tmp = head->next;
661         td = list_entry(tmp, struct uhci_td, list);
662
663         /* The first TD is the SETUP stage, check the status, but skip */
664         /*  the count */
665         status = uhci_status_bits(td_status(td));
666         if (status & TD_CTRL_ACTIVE)
667                 return -EINPROGRESS;
668
669         if (status)
670                 goto td_error;
671
672         /* The rest of the TDs (but the last) are data */
673         tmp = tmp->next;
674         while (tmp != head && tmp->next != head) {
675                 unsigned int ctrlstat;
676
677                 td = list_entry(tmp, struct uhci_td, list);
678                 tmp = tmp->next;
679
680                 ctrlstat = td_status(td);
681                 status = uhci_status_bits(ctrlstat);
682                 if (status & TD_CTRL_ACTIVE)
683                         return -EINPROGRESS;
684
685                 urb->actual_length += uhci_actual_length(ctrlstat);
686
687                 if (status)
688                         goto td_error;
689
690                 /* Check to see if we received a short packet */
691                 if (uhci_actual_length(ctrlstat) <
692                                 uhci_expected_length(td_token(td))) {
693                         if (urb->transfer_flags & URB_SHORT_NOT_OK) {
694                                 ret = -EREMOTEIO;
695                                 goto err;
696                         }
697
698                         return usb_control_retrigger_status(uhci, urb);
699                 }
700         }
701
702 status_stage:
703         td = list_entry(tmp, struct uhci_td, list);
704
705         /* Control status stage */
706         status = td_status(td);
707
708 #ifdef I_HAVE_BUGGY_APC_BACKUPS
709         /* APC BackUPS Pro kludge */
710         /* It tries to send all of the descriptor instead of the amount */
711         /*  we requested */
712         if (status & TD_CTRL_IOC &&     /* IOC is masked out by uhci_status_bits */
713             status & TD_CTRL_ACTIVE &&
714             status & TD_CTRL_NAK)
715                 return 0;
716 #endif
717
718         status = uhci_status_bits(status);
719         if (status & TD_CTRL_ACTIVE)
720                 return -EINPROGRESS;
721
722         if (status)
723                 goto td_error;
724
725         return 0;
726
727 td_error:
728         ret = uhci_map_status(status, uhci_packetout(td_token(td)));
729
730 err:
731         if ((debug == 1 && ret != -EPIPE) || debug > 1) {
732                 /* Some debugging code */
733                 dev_dbg(uhci_dev(uhci), "%s: failed with status %x\n",
734                                 __FUNCTION__, status);
735
736                 if (errbuf) {
737                         /* Print the chain for debugging purposes */
738                         uhci_show_qh(urbp->qh, errbuf, ERRBUF_LEN, 0);
739                         lprintk(errbuf);
740                 }
741         }
742
743         /* Note that the queue has stopped */
744         urbp->qh->element = UHCI_PTR_TERM;
745         urbp->qh->is_stopped = 1;
746         return ret;
747 }
748
749 /*
750  * Common submit for bulk and interrupt
751  */
752 static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
753                 struct uhci_qh *qh)
754 {
755         struct uhci_td *td;
756         unsigned long destination, status;
757         int maxsze = le16_to_cpu(qh->hep->desc.wMaxPacketSize);
758         int len = urb->transfer_buffer_length;
759         dma_addr_t data = urb->transfer_dma;
760         __le32 *plink;
761         unsigned int toggle;
762
763         if (len < 0)
764                 return -EINVAL;
765
766         /* The "pipe" thing contains the destination in bits 8--18 */
767         destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
768         toggle = usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe),
769                          usb_pipeout(urb->pipe));
770
771         /* 3 errors, dummy TD remains inactive */
772         status = uhci_maxerr(3);
773         if (urb->dev->speed == USB_SPEED_LOW)
774                 status |= TD_CTRL_LS;
775         if (usb_pipein(urb->pipe))
776                 status |= TD_CTRL_SPD;
777
778         /*
779          * Build the DATA TDs
780          */
781         plink = NULL;
782         td = qh->dummy_td;
783         do {    /* Allow zero length packets */
784                 int pktsze = maxsze;
785
786                 if (len <= pktsze) {            /* The last packet */
787                         pktsze = len;
788                         if (!(urb->transfer_flags & URB_SHORT_NOT_OK))
789                                 status &= ~TD_CTRL_SPD;
790                 }
791
792                 if (plink) {
793                         td = uhci_alloc_td(uhci);
794                         if (!td)
795                                 goto nomem;
796                         *plink = cpu_to_le32(td->dma_handle);
797                 }
798                 uhci_add_td_to_urb(urb, td);
799                 uhci_fill_td(td, status,
800                                 destination | uhci_explen(pktsze) |
801                                         (toggle << TD_TOKEN_TOGGLE_SHIFT),
802                                 data);
803                 plink = &td->link;
804                 status |= TD_CTRL_ACTIVE;
805
806                 data += pktsze;
807                 len -= maxsze;
808                 toggle ^= 1;
809         } while (len > 0);
810
811         /*
812          * URB_ZERO_PACKET means adding a 0-length packet, if direction
813          * is OUT and the transfer_length was an exact multiple of maxsze,
814          * hence (len = transfer_length - N * maxsze) == 0
815          * however, if transfer_length == 0, the zero packet was already
816          * prepared above.
817          */
818         if ((urb->transfer_flags & URB_ZERO_PACKET) &&
819                         usb_pipeout(urb->pipe) && len == 0 &&
820                         urb->transfer_buffer_length > 0) {
821                 td = uhci_alloc_td(uhci);
822                 if (!td)
823                         goto nomem;
824                 *plink = cpu_to_le32(td->dma_handle);
825
826                 uhci_add_td_to_urb(urb, td);
827                 uhci_fill_td(td, status,
828                                 destination | uhci_explen(0) |
829                                         (toggle << TD_TOKEN_TOGGLE_SHIFT),
830                                 data);
831                 plink = &td->link;
832
833                 toggle ^= 1;
834         }
835
836         /* Set the interrupt-on-completion flag on the last packet.
837          * A more-or-less typical 4 KB URB (= size of one memory page)
838          * will require about 3 ms to transfer; that's a little on the
839          * fast side but not enough to justify delaying an interrupt
840          * more than 2 or 3 URBs, so we will ignore the URB_NO_INTERRUPT
841          * flag setting. */
842         td->status |= __constant_cpu_to_le32(TD_CTRL_IOC);
843
844         /*
845          * Build the new dummy TD and activate the old one
846          */
847         td = uhci_alloc_td(uhci);
848         if (!td)
849                 goto nomem;
850         *plink = cpu_to_le32(td->dma_handle);
851
852         uhci_fill_td(td, 0, USB_PID_OUT | uhci_explen(0), 0);
853         wmb();
854         qh->dummy_td->status |= __constant_cpu_to_le32(TD_CTRL_ACTIVE);
855         qh->dummy_td = td;
856
857         usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
858                         usb_pipeout(urb->pipe), toggle);
859         return 0;
860
861 nomem:
862         /* Remove the dummy TD from the td_list so it doesn't get freed */
863         uhci_remove_td_from_urb(qh->dummy_td);
864         return -ENOMEM;
865 }
866
867 /*
868  * Common result for bulk and interrupt
869  */
870 static int uhci_result_common(struct uhci_hcd *uhci, struct urb *urb)
871 {
872         struct urb_priv *urbp = urb->hcpriv;
873         struct uhci_td *td;
874         unsigned int status = 0;
875         int ret = 0;
876
877         urb->actual_length = 0;
878
879         list_for_each_entry(td, &urbp->td_list, list) {
880                 unsigned int ctrlstat = td_status(td);
881
882                 status = uhci_status_bits(ctrlstat);
883                 if (status & TD_CTRL_ACTIVE)
884                         return -EINPROGRESS;
885
886                 urb->actual_length += uhci_actual_length(ctrlstat);
887
888                 if (status)
889                         goto td_error;
890
891                 if (uhci_actual_length(ctrlstat) <
892                                 uhci_expected_length(td_token(td))) {
893                         if (urb->transfer_flags & URB_SHORT_NOT_OK) {
894                                 ret = -EREMOTEIO;
895                                 goto err;
896                         }
897
898                         /*
899                          * This URB stopped short of its end.  We have to
900                          * fix up the toggles of the following URBs on the
901                          * queue and restart the queue.
902                          *
903                          * Do this only the first time we encounter the
904                          * short URB.
905                          */
906                         if (!urbp->short_transfer) {
907                                 urbp->short_transfer = 1;
908                                 urbp->qh->initial_toggle =
909                                                 uhci_toggle(td_token(td)) ^ 1;
910                                 uhci_fixup_toggles(urbp->qh, 1);
911
912                                 td = list_entry(urbp->td_list.prev,
913                                                 struct uhci_td, list);
914                                 urbp->qh->element = td->link;
915                         }
916                         break;
917                 }
918         }
919
920         return 0;
921
922 td_error:
923         ret = uhci_map_status(status, uhci_packetout(td_token(td)));
924
925         if ((debug == 1 && ret != -EPIPE) || debug > 1) {
926                 /* Some debugging code */
927                 dev_dbg(uhci_dev(uhci), "%s: failed with status %x\n",
928                                 __FUNCTION__, status);
929
930                 if (debug > 1 && errbuf) {
931                         /* Print the chain for debugging purposes */
932                         uhci_show_qh(urbp->qh, errbuf, ERRBUF_LEN, 0);
933                         lprintk(errbuf);
934                 }
935         }
936 err:
937
938         /* Note that the queue has stopped and save the next toggle value */
939         urbp->qh->element = UHCI_PTR_TERM;
940         urbp->qh->is_stopped = 1;
941         urbp->qh->needs_fixup = 1;
942         urbp->qh->initial_toggle = uhci_toggle(td_token(td)) ^
943                         (ret == -EREMOTEIO);
944         return ret;
945 }
946
947 static inline int uhci_submit_bulk(struct uhci_hcd *uhci, struct urb *urb,
948                 struct uhci_qh *qh)
949 {
950         int ret;
951
952         /* Can't have low-speed bulk transfers */
953         if (urb->dev->speed == USB_SPEED_LOW)
954                 return -EINVAL;
955
956         qh->skel = uhci->skel_bulk_qh;
957         ret = uhci_submit_common(uhci, urb, qh);
958         if (ret == 0)
959                 uhci_inc_fsbr(uhci, urb);
960         return ret;
961 }
962
963 static inline int uhci_submit_interrupt(struct uhci_hcd *uhci, struct urb *urb,
964                 struct uhci_qh *qh)
965 {
966         /* USB 1.1 interrupt transfers only involve one packet per interval.
967          * Drivers can submit URBs of any length, but longer ones will need
968          * multiple intervals to complete.
969          */
970         qh->skel = uhci->skelqh[__interval_to_skel(urb->interval)];
971         return uhci_submit_common(uhci, urb, qh);
972 }
973
974 /*
975  * Isochronous transfers
976  */
977 static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
978                 struct uhci_qh *qh)
979 {
980         struct uhci_td *td = NULL;      /* Since urb->number_of_packets > 0 */
981         int i, frame;
982         unsigned long destination, status;
983         struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
984
985         if (urb->number_of_packets > 900)       /* 900? Why? */
986                 return -EFBIG;
987
988         status = TD_CTRL_ACTIVE | TD_CTRL_IOS;
989         destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
990
991         /* Figure out the starting frame number */
992         if (urb->transfer_flags & URB_ISO_ASAP) {
993                 if (list_empty(&qh->queue)) {
994                         uhci_get_current_frame_number(uhci);
995                         urb->start_frame = (uhci->frame_number + 10);
996
997                 } else {                /* Go right after the last one */
998                         struct urb *last_urb;
999
1000                         last_urb = list_entry(qh->queue.prev,
1001                                         struct urb_priv, node)->urb;
1002                         urb->start_frame = (last_urb->start_frame +
1003                                         last_urb->number_of_packets *
1004                                         last_urb->interval);
1005                 }
1006         } else {
1007                 /* FIXME: Sanity check */
1008         }
1009         urb->start_frame &= (UHCI_NUMFRAMES - 1);
1010
1011         for (i = 0; i < urb->number_of_packets; i++) {
1012                 td = uhci_alloc_td(uhci);
1013                 if (!td)
1014                         return -ENOMEM;
1015
1016                 uhci_add_td_to_urb(urb, td);
1017                 uhci_fill_td(td, status, destination |
1018                                 uhci_explen(urb->iso_frame_desc[i].length),
1019                                 urb->transfer_dma +
1020                                         urb->iso_frame_desc[i].offset);
1021         }
1022
1023         /* Set the interrupt-on-completion flag on the last packet. */
1024         td->status |= __constant_cpu_to_le32(TD_CTRL_IOC);
1025
1026         qh->skel = uhci->skel_iso_qh;
1027
1028         /* Add the TDs to the frame list */
1029         frame = urb->start_frame;
1030         list_for_each_entry(td, &urbp->td_list, list) {
1031                 uhci_insert_td_in_frame_list(uhci, td, frame);
1032                 frame += urb->interval;
1033         }
1034
1035         return 0;
1036 }
1037
1038 static int uhci_result_isochronous(struct uhci_hcd *uhci, struct urb *urb)
1039 {
1040         struct uhci_td *td;
1041         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
1042         int status;
1043         int i, ret = 0;
1044
1045         urb->actual_length = urb->error_count = 0;
1046
1047         i = 0;
1048         list_for_each_entry(td, &urbp->td_list, list) {
1049                 int actlength;
1050                 unsigned int ctrlstat = td_status(td);
1051
1052                 if (ctrlstat & TD_CTRL_ACTIVE)
1053                         return -EINPROGRESS;
1054
1055                 actlength = uhci_actual_length(ctrlstat);
1056                 urb->iso_frame_desc[i].actual_length = actlength;
1057                 urb->actual_length += actlength;
1058
1059                 status = uhci_map_status(uhci_status_bits(ctrlstat),
1060                                 usb_pipeout(urb->pipe));
1061                 urb->iso_frame_desc[i].status = status;
1062                 if (status) {
1063                         urb->error_count++;
1064                         ret = status;
1065                 }
1066
1067                 i++;
1068         }
1069
1070         return ret;
1071 }
1072
1073 static int uhci_urb_enqueue(struct usb_hcd *hcd,
1074                 struct usb_host_endpoint *hep,
1075                 struct urb *urb, gfp_t mem_flags)
1076 {
1077         int ret;
1078         struct uhci_hcd *uhci = hcd_to_uhci(hcd);
1079         unsigned long flags;
1080         struct urb_priv *urbp;
1081         struct uhci_qh *qh;
1082         int bustime;
1083
1084         spin_lock_irqsave(&uhci->lock, flags);
1085
1086         ret = urb->status;
1087         if (ret != -EINPROGRESS)                /* URB already unlinked! */
1088                 goto done;
1089
1090         ret = -ENOMEM;
1091         urbp = uhci_alloc_urb_priv(uhci, urb);
1092         if (!urbp)
1093                 goto done;
1094
1095         if (hep->hcpriv)
1096                 qh = (struct uhci_qh *) hep->hcpriv;
1097         else {
1098                 qh = uhci_alloc_qh(uhci, urb->dev, hep);
1099                 if (!qh)
1100                         goto err_no_qh;
1101         }
1102         urbp->qh = qh;
1103
1104         switch (qh->type) {
1105         case USB_ENDPOINT_XFER_CONTROL:
1106                 ret = uhci_submit_control(uhci, urb, qh);
1107                 break;
1108         case USB_ENDPOINT_XFER_BULK:
1109                 ret = uhci_submit_bulk(uhci, urb, qh);
1110                 break;
1111         case USB_ENDPOINT_XFER_INT:
1112                 if (list_empty(&qh->queue)) {
1113                         bustime = usb_check_bandwidth(urb->dev, urb);
1114                         if (bustime < 0)
1115                                 ret = bustime;
1116                         else {
1117                                 ret = uhci_submit_interrupt(uhci, urb, qh);
1118                                 if (ret == 0)
1119                                         usb_claim_bandwidth(urb->dev, urb, bustime, 0);
1120                         }
1121                 } else {        /* inherit from parent */
1122                         struct urb_priv *eurbp;
1123
1124                         eurbp = list_entry(qh->queue.prev, struct urb_priv,
1125                                         node);
1126                         urb->bandwidth = eurbp->urb->bandwidth;
1127                         ret = uhci_submit_interrupt(uhci, urb, qh);
1128                 }
1129                 break;
1130         case USB_ENDPOINT_XFER_ISOC:
1131                 bustime = usb_check_bandwidth(urb->dev, urb);
1132                 if (bustime < 0) {
1133                         ret = bustime;
1134                         break;
1135                 }
1136
1137                 ret = uhci_submit_isochronous(uhci, urb, qh);
1138                 if (ret == 0)
1139                         usb_claim_bandwidth(urb->dev, urb, bustime, 1);
1140                 break;
1141         }
1142         if (ret != 0)
1143                 goto err_submit_failed;
1144
1145         /* Add this URB to the QH */
1146         urbp->qh = qh;
1147         list_add_tail(&urbp->node, &qh->queue);
1148
1149         /* If the new URB is the first and only one on this QH then either
1150          * the QH is new and idle or else it's unlinked and waiting to
1151          * become idle, so we can activate it right away.  But only if the
1152          * queue isn't stopped. */
1153         if (qh->queue.next == &urbp->node && !qh->is_stopped)
1154                 uhci_activate_qh(uhci, qh);
1155         goto done;
1156
1157 err_submit_failed:
1158         if (qh->state == QH_STATE_IDLE)
1159                 uhci_make_qh_idle(uhci, qh);    /* Reclaim unused QH */
1160
1161 err_no_qh:
1162         uhci_free_urb_priv(uhci, urbp);
1163
1164 done:
1165         spin_unlock_irqrestore(&uhci->lock, flags);
1166         return ret;
1167 }
1168
1169 static int uhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
1170 {
1171         struct uhci_hcd *uhci = hcd_to_uhci(hcd);
1172         unsigned long flags;
1173         struct urb_priv *urbp;
1174
1175         spin_lock_irqsave(&uhci->lock, flags);
1176         urbp = urb->hcpriv;
1177         if (!urbp)                      /* URB was never linked! */
1178                 goto done;
1179
1180         /* Remove Isochronous TDs from the frame list ASAP */
1181         if (urbp->qh->type == USB_ENDPOINT_XFER_ISOC)
1182                 uhci_unlink_isochronous_tds(uhci, urb);
1183         uhci_unlink_qh(uhci, urbp->qh);
1184
1185 done:
1186         spin_unlock_irqrestore(&uhci->lock, flags);
1187         return 0;
1188 }
1189
1190 /*
1191  * Finish unlinking an URB and give it back
1192  */
1193 static void uhci_giveback_urb(struct uhci_hcd *uhci, struct uhci_qh *qh,
1194                 struct urb *urb, struct pt_regs *regs)
1195 __releases(uhci->lock)
1196 __acquires(uhci->lock)
1197 {
1198         struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
1199
1200         /* Isochronous TDs get unlinked directly from the frame list */
1201         if (qh->type == USB_ENDPOINT_XFER_ISOC)
1202                 uhci_unlink_isochronous_tds(uhci, urb);
1203
1204         /* If the URB isn't first on its queue, adjust the link pointer
1205          * of the last TD in the previous URB. */
1206         else if (qh->queue.next != &urbp->node) {
1207                 struct urb_priv *purbp;
1208                 struct uhci_td *ptd, *ltd;
1209
1210                 purbp = list_entry(urbp->node.prev, struct urb_priv, node);
1211                 ptd = list_entry(purbp->td_list.prev, struct uhci_td,
1212                                 list);
1213                 ltd = list_entry(urbp->td_list.prev, struct uhci_td,
1214                                 list);
1215                 ptd->link = ltd->link;
1216         }
1217
1218         /* Take the URB off the QH's queue.  If the queue is now empty,
1219          * this is a perfect time for a toggle fixup. */
1220         list_del_init(&urbp->node);
1221         if (list_empty(&qh->queue) && qh->needs_fixup) {
1222                 usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
1223                                 usb_pipeout(urb->pipe), qh->initial_toggle);
1224                 qh->needs_fixup = 0;
1225         }
1226
1227         uhci_dec_fsbr(uhci, urb);       /* Safe since it checks */
1228         uhci_free_urb_priv(uhci, urbp);
1229
1230         switch (qh->type) {
1231         case USB_ENDPOINT_XFER_ISOC:
1232                 /* Release bandwidth for Interrupt or Isoc. transfers */
1233                 if (urb->bandwidth)
1234                         usb_release_bandwidth(urb->dev, urb, 1);
1235                 break;
1236         case USB_ENDPOINT_XFER_INT:
1237                 /* Release bandwidth for Interrupt or Isoc. transfers */
1238                 /* Make sure we don't release if we have a queued URB */
1239                 if (list_empty(&qh->queue) && urb->bandwidth)
1240                         usb_release_bandwidth(urb->dev, urb, 0);
1241                 else
1242                         /* bandwidth was passed on to queued URB, */
1243                         /* so don't let usb_unlink_urb() release it */
1244                         urb->bandwidth = 0;
1245                 break;
1246         }
1247
1248         spin_unlock(&uhci->lock);
1249         usb_hcd_giveback_urb(uhci_to_hcd(uhci), urb, regs);
1250         spin_lock(&uhci->lock);
1251
1252         /* If the queue is now empty, we can unlink the QH and give up its
1253          * reserved bandwidth. */
1254         if (list_empty(&qh->queue)) {
1255                 uhci_unlink_qh(uhci, qh);
1256
1257                 /* Bandwidth stuff not yet implemented */
1258         }
1259 }
1260
1261 /*
1262  * Scan the URBs in a QH's queue
1263  */
1264 #define QH_FINISHED_UNLINKING(qh)                       \
1265                 (qh->state == QH_STATE_UNLINKING &&     \
1266                 uhci->frame_number + uhci->is_stopped != qh->unlink_frame)
1267
1268 static void uhci_scan_qh(struct uhci_hcd *uhci, struct uhci_qh *qh,
1269                 struct pt_regs *regs)
1270 {
1271         struct urb_priv *urbp;
1272         struct urb *urb;
1273         int status;
1274
1275         while (!list_empty(&qh->queue)) {
1276                 urbp = list_entry(qh->queue.next, struct urb_priv, node);
1277                 urb = urbp->urb;
1278
1279                 switch (qh->type) {
1280                 case USB_ENDPOINT_XFER_CONTROL:
1281                         status = uhci_result_control(uhci, urb);
1282                         break;
1283                 case USB_ENDPOINT_XFER_ISOC:
1284                         status = uhci_result_isochronous(uhci, urb);
1285                         break;
1286                 default:        /* USB_ENDPOINT_XFER_BULK or _INT */
1287                         status = uhci_result_common(uhci, urb);
1288                         break;
1289                 }
1290                 if (status == -EINPROGRESS)
1291                         break;
1292
1293                 spin_lock(&urb->lock);
1294                 if (urb->status == -EINPROGRESS)        /* Not dequeued */
1295                         urb->status = status;
1296                 else
1297                         status = ECONNRESET;            /* Not -ECONNRESET */
1298                 spin_unlock(&urb->lock);
1299
1300                 /* Dequeued but completed URBs can't be given back unless
1301                  * the QH is stopped or has finished unlinking. */
1302                 if (status == ECONNRESET) {
1303                         if (QH_FINISHED_UNLINKING(qh))
1304                                 qh->is_stopped = 1;
1305                         else if (!qh->is_stopped)
1306                                 return;
1307                 }
1308
1309                 uhci_giveback_urb(uhci, qh, urb, regs);
1310                 if (status < 0)
1311                         break;
1312         }
1313
1314         /* If the QH is neither stopped nor finished unlinking (normal case),
1315          * our work here is done. */
1316         if (QH_FINISHED_UNLINKING(qh))
1317                 qh->is_stopped = 1;
1318         else if (!qh->is_stopped)
1319                 return;
1320
1321         /* Otherwise give back each of the dequeued URBs */
1322 restart:
1323         list_for_each_entry(urbp, &qh->queue, node) {
1324                 urb = urbp->urb;
1325                 if (urb->status != -EINPROGRESS) {
1326                         uhci_save_toggle(qh, urb);
1327                         uhci_giveback_urb(uhci, qh, urb, regs);
1328                         goto restart;
1329                 }
1330         }
1331         qh->is_stopped = 0;
1332
1333         /* There are no more dequeued URBs.  If there are still URBs on the
1334          * queue, the QH can now be re-activated. */
1335         if (!list_empty(&qh->queue)) {
1336                 if (qh->needs_fixup)
1337                         uhci_fixup_toggles(qh, 0);
1338                 uhci_activate_qh(uhci, qh);
1339         }
1340
1341         /* The queue is empty.  The QH can become idle if it is fully
1342          * unlinked. */
1343         else if (QH_FINISHED_UNLINKING(qh))
1344                 uhci_make_qh_idle(uhci, qh);
1345 }
1346
1347 static void uhci_free_pending_tds(struct uhci_hcd *uhci)
1348 {
1349         struct uhci_td *td, *tmp;
1350
1351         list_for_each_entry_safe(td, tmp, &uhci->td_remove_list, remove_list) {
1352                 list_del_init(&td->remove_list);
1353
1354                 uhci_free_td(uhci, td);
1355         }
1356 }
1357
1358 /*
1359  * Process events in the schedule, but only in one thread at a time
1360  */
1361 static void uhci_scan_schedule(struct uhci_hcd *uhci, struct pt_regs *regs)
1362 {
1363         int i;
1364         struct uhci_qh *qh;
1365
1366         /* Don't allow re-entrant calls */
1367         if (uhci->scan_in_progress) {
1368                 uhci->need_rescan = 1;
1369                 return;
1370         }
1371         uhci->scan_in_progress = 1;
1372  rescan:
1373         uhci->need_rescan = 0;
1374
1375         uhci_clear_next_interrupt(uhci);
1376         uhci_get_current_frame_number(uhci);
1377
1378         if (uhci->frame_number + uhci->is_stopped != uhci->td_remove_age)
1379                 uhci_free_pending_tds(uhci);
1380
1381         /* Go through all the QH queues and process the URBs in each one */
1382         for (i = 0; i < UHCI_NUM_SKELQH - 1; ++i) {
1383                 uhci->next_qh = list_entry(uhci->skelqh[i]->node.next,
1384                                 struct uhci_qh, node);
1385                 while ((qh = uhci->next_qh) != uhci->skelqh[i]) {
1386                         uhci->next_qh = list_entry(qh->node.next,
1387                                         struct uhci_qh, node);
1388                         uhci_scan_qh(uhci, qh, regs);
1389                 }
1390         }
1391
1392         if (uhci->need_rescan)
1393                 goto rescan;
1394         uhci->scan_in_progress = 0;
1395
1396         /* If the controller is stopped, we can finish these off right now */
1397         if (uhci->is_stopped)
1398                 uhci_free_pending_tds(uhci);
1399
1400         if (list_empty(&uhci->td_remove_list) &&
1401                         list_empty(&uhci->skel_unlink_qh->node))
1402                 uhci_clear_next_interrupt(uhci);
1403         else
1404                 uhci_set_next_interrupt(uhci);
1405 }
1406
1407 static void check_fsbr(struct uhci_hcd *uhci)
1408 {
1409         /* For now, don't scan URBs for FSBR timeouts.
1410          * Add it back in later... */
1411
1412         /* Really disable FSBR */
1413         if (!uhci->fsbr && uhci->fsbrtimeout && time_after_eq(jiffies, uhci->fsbrtimeout)) {
1414                 uhci->fsbrtimeout = 0;
1415                 uhci->skel_term_qh->link = UHCI_PTR_TERM;
1416         }
1417 }