File: /usr/src/linux/drivers/usb/usb-uhci.c

1     /* 
2      * Universal Host Controller Interface driver for USB (take II).
3      *
4      * (c) 1999-2001 Georg Acher, acher@in.tum.de (executive slave) (base guitar)
5      *               Deti Fliegl, deti@fliegl.de (executive slave) (lead voice)
6      *               Thomas Sailer, sailer@ife.ee.ethz.ch (chief consultant) (cheer leader)
7      *               Roman Weissgaerber, weissg@vienna.at (virt root hub) (studio porter)
8      * (c) 2000      Yggdrasil Computing, Inc. (port of new PCI interface support
9      *               from usb-ohci.c by Adam Richter, adam@yggdrasil.com).
10      * (C) 2000      David Brownell, david-b@pacbell.net (usb-ohci.c)
11      *          
12      * HW-initalization based on material of
13      *
14      * (C) Copyright 1999 Linus Torvalds
15      * (C) Copyright 1999 Johannes Erdfelt
16      * (C) Copyright 1999 Randy Dunlap
17      * (C) Copyright 1999 Gregory P. Smith
18      *
19      * $Id: usb-uhci.c,v 1.268 2001/08/29 14:08:43 acher Exp $
20      */
21     
22     #include <linux/config.h>
23     #include <linux/module.h>
24     #include <linux/pci.h>
25     #include <linux/kernel.h>
26     #include <linux/delay.h>
27     #include <linux/ioport.h>
28     #include <linux/sched.h>
29     #include <linux/slab.h>
30     #include <linux/smp_lock.h>
31     #include <linux/errno.h>
32     #include <linux/unistd.h>
33     #include <linux/interrupt.h>	/* for in_interrupt() */
34     #include <linux/init.h>
35     #include <linux/version.h>
36     #include <linux/pm.h>
37     
38     #include <asm/uaccess.h>
39     #include <asm/io.h>
40     #include <asm/irq.h>
41     #include <asm/system.h>
42     
43     /* This enables more detailed sanity checks in submit_iso */
44     //#define ISO_SANITY_CHECK
45     
46     /* This enables debug printks */
47     #define DEBUG
48     
49     /* This enables all symbols to be exported, to ease debugging oopses */
50     //#define DEBUG_SYMBOLS
51     
52     /* This enables an extra UHCI slab for memory debugging */
53     #define DEBUG_SLAB
54     
55     #define VERSTR "$Revision: 1.268 $ time " __TIME__ " " __DATE__
56     
57     #include <linux/usb.h>
58     #include "usb-uhci.h"
59     #include "usb-uhci-debug.h"
60     
61     /*
62      * Version Information
63      */
64     #define DRIVER_VERSION "v1.268"
65     #define DRIVER_AUTHOR "Georg Acher, Deti Fliegl, Thomas Sailer, Roman Weissgaerber"
66     #define DRIVER_DESC "USB Universal Host Controller Interface driver"
67     
68     #undef DEBUG
69     #undef dbg
70     #define dbg(format, arg...) do {} while (0)
71     #define DEBUG_SYMBOLS
72     #ifdef DEBUG_SYMBOLS
73     	#define _static
74     	#ifndef EXPORT_SYMTAB
75     		#define EXPORT_SYMTAB
76     	#endif
77     #else
78     	#define _static static
79     #endif
80     
81     #define queue_dbg dbg //err
82     #define async_dbg dbg //err
83     
84     #ifdef DEBUG_SLAB
85     	static kmem_cache_t *urb_priv_kmem;
86     #endif
87     
88     #define SLAB_FLAG     (in_interrupt ()? SLAB_ATOMIC : SLAB_KERNEL)
89     #define KMALLOC_FLAG  (in_interrupt ()? GFP_ATOMIC : GFP_KERNEL)
90     
91     /* CONFIG_USB_UHCI_HIGH_BANDWITH turns on Full Speed Bandwidth
92      * Reclamation: feature that puts loop on descriptor loop when
93      * there's some transfer going on. With FSBR, USB performance
94      * is optimal, but PCI can be slowed down up-to 5 times, slowing down
95      * system performance (eg. framebuffer devices).
96      */
97     #define CONFIG_USB_UHCI_HIGH_BANDWIDTH 
98     
99     /* *_DEPTH_FIRST puts descriptor in depth-first mode. This has
100      * somehow similar effect to FSBR (higher speed), but does not
101      * slow PCI down. OTOH USB performace is slightly slower than
102      * in FSBR case and single device could hog whole USB, starving
103      * other devices.
104      */
105     #define USE_CTRL_DEPTH_FIRST 0  // 0: Breadth first, 1: Depth first
106     #define USE_BULK_DEPTH_FIRST 0  // 0: Breadth first, 1: Depth first
107     
108     /* Turning off both CONFIG_USB_UHCI_HIGH_BANDWITH and *_DEPTH_FIRST
109      * will lead to <64KB/sec performance over USB for bulk transfers targeting
110      * one device's endpoint. You probably do not want to do that.
111      */
112     
113     // stop bandwidth reclamation after (roughly) 50ms
114     #define IDLE_TIMEOUT  (HZ/20)
115     
116     // Suppress HC interrupt error messages for 5s
117     #define ERROR_SUPPRESSION_TIME (HZ*5)
118     
119     _static int rh_submit_urb (urb_t *urb);
120     _static int rh_unlink_urb (urb_t *urb);
121     _static int delete_qh (uhci_t *s, uhci_desc_t *qh);
122     _static int process_transfer (uhci_t *s, urb_t *urb, int mode);
123     _static int process_interrupt (uhci_t *s, urb_t *urb);
124     _static int process_iso (uhci_t *s, urb_t *urb, int force);
125     
126     // How much URBs with ->next are walked
127     #define MAX_NEXT_COUNT 2048
128     
129     static uhci_t *devs = NULL;
130     
131     /* used by userspace UHCI data structure dumper */
132     uhci_t **uhci_devices = &devs;
133     
134     /*-------------------------------------------------------------------*/
135     // Cleans up collected QHs, but not more than 100 in one go
136     void clean_descs(uhci_t *s, int force)
137     {
138     	struct list_head *q;
139     	uhci_desc_t *qh;
140     	int now=UHCI_GET_CURRENT_FRAME(s), n=0;
141     
142     	q=s->free_desc.prev;
143     
144     	while (q != &s->free_desc && (force || n<100)) {
145     		qh = list_entry (q, uhci_desc_t, horizontal);		
146     		q=qh->horizontal.prev;
147     
148     		if ((qh->last_used!=now) || force)
149     			delete_qh(s,qh);
150     		n++;
151     	}
152     }
153     /*-------------------------------------------------------------------*/
154     _static void uhci_switch_timer_int(uhci_t *s)
155     {
156     
157     	if (!list_empty(&s->urb_unlinked))
158     		set_td_ioc(s->td1ms);
159     	else
160     		clr_td_ioc(s->td1ms);
161     
162     	if (s->timeout_urbs)
163     		set_td_ioc(s->td32ms);
164     	else
165     		clr_td_ioc(s->td32ms);
166     	wmb();
167     }
168     /*-------------------------------------------------------------------*/
169     #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH
170     _static void enable_desc_loop(uhci_t *s, urb_t *urb)
171     {
172     	int flags;
173     
174     	if (urb->transfer_flags & USB_NO_FSBR)
175     		return;
176     
177     	spin_lock_irqsave (&s->qh_lock, flags);
178     	s->chain_end->hw.qh.head&=cpu_to_le32(~UHCI_PTR_TERM);
179     	mb();
180     	s->loop_usage++;
181     	((urb_priv_t*)urb->hcpriv)->use_loop=1;
182     	spin_unlock_irqrestore (&s->qh_lock, flags);
183     }
184     /*-------------------------------------------------------------------*/
185     _static void disable_desc_loop(uhci_t *s, urb_t *urb)
186     {
187     	int flags;
188     
189     	if (urb->transfer_flags & USB_NO_FSBR)
190     		return;
191     
192     	spin_lock_irqsave (&s->qh_lock, flags);
193     	if (((urb_priv_t*)urb->hcpriv)->use_loop) {
194     		s->loop_usage--;
195     
196     		if (!s->loop_usage) {
197     			s->chain_end->hw.qh.head|=cpu_to_le32(UHCI_PTR_TERM);
198     			mb();
199     		}
200     		((urb_priv_t*)urb->hcpriv)->use_loop=0;
201     	}
202     	spin_unlock_irqrestore (&s->qh_lock, flags);
203     }
204     #endif
205     /*-------------------------------------------------------------------*/
206     _static void queue_urb_unlocked (uhci_t *s, urb_t *urb)
207     {
208     	struct list_head *p=&urb->urb_list;
209     #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH
210     	{
211     		int type;
212     		type=usb_pipetype (urb->pipe);
213     
214     		if ((type == PIPE_BULK) || (type == PIPE_CONTROL))
215     			enable_desc_loop(s, urb);
216     	}
217     #endif
218     	urb->status = -EINPROGRESS;
219     	((urb_priv_t*)urb->hcpriv)->started=jiffies;
220     	list_add (p, &s->urb_list);
221     	if (urb->timeout)
222     		s->timeout_urbs++;
223     	uhci_switch_timer_int(s);
224     }
225     /*-------------------------------------------------------------------*/
226     _static void queue_urb (uhci_t *s, urb_t *urb)
227     {
228     	unsigned long flags=0;
229     
230     	spin_lock_irqsave (&s->urb_list_lock, flags);
231     	queue_urb_unlocked(s,urb);
232     	spin_unlock_irqrestore (&s->urb_list_lock, flags);
233     }
234     /*-------------------------------------------------------------------*/
235     _static void dequeue_urb (uhci_t *s, urb_t *urb)
236     {
237     #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH
238     	int type;
239     
240     	type=usb_pipetype (urb->pipe);
241     
242     	if ((type == PIPE_BULK) || (type == PIPE_CONTROL))
243     		disable_desc_loop(s, urb);
244     #endif
245     
246     	list_del (&urb->urb_list);
247     	if (urb->timeout && s->timeout_urbs)
248     		s->timeout_urbs--;
249     
250     }
251     /*-------------------------------------------------------------------*/
252     _static int alloc_td (uhci_t *s, uhci_desc_t ** new, int flags)
253     {
254     	dma_addr_t dma_handle;
255     
256     	*new = pci_pool_alloc(s->desc_pool, GFP_DMA | GFP_ATOMIC, &dma_handle);
257     	if (!*new)
258     		return -ENOMEM;
259     	memset (*new, 0, sizeof (uhci_desc_t));
260     	(*new)->dma_addr = dma_handle;
261     	set_td_link((*new), UHCI_PTR_TERM | (flags & UHCI_PTR_BITS));	// last by default
262     	(*new)->type = TD_TYPE;
263     	mb();
264     	INIT_LIST_HEAD (&(*new)->vertical);
265     	INIT_LIST_HEAD (&(*new)->horizontal);
266     	
267     	return 0;
268     }
269     /*-------------------------------------------------------------------*/
270     // append a qh to td.link physically, the SW linkage is not affected
271     _static void append_qh(uhci_t *s, uhci_desc_t *td, uhci_desc_t* qh, int  flags)
272     {
273     	unsigned long xxx;
274     	
275     	spin_lock_irqsave (&s->td_lock, xxx);
276     
277     	set_td_link(td, qh->dma_addr | (flags & UHCI_PTR_DEPTH) | UHCI_PTR_QH);
278            
279     	mb();
280     	spin_unlock_irqrestore (&s->td_lock, xxx);
281     }
282     /*-------------------------------------------------------------------*/
283     /* insert td at last position in td-list of qh (vertical) */
284     _static int insert_td (uhci_t *s, uhci_desc_t *qh, uhci_desc_t* new, int flags)
285     {
286     	uhci_desc_t *prev;
287     	unsigned long xxx;
288     	
289     	spin_lock_irqsave (&s->td_lock, xxx);
290     
291     	list_add_tail (&new->vertical, &qh->vertical);
292     
293     	prev = list_entry (new->vertical.prev, uhci_desc_t, vertical);
294     
295     	if (qh == prev ) {
296     		// virgin qh without any tds
297     		set_qh_element(qh, new->dma_addr | UHCI_PTR_TERM);
298     	}
299     	else {
300     		// already tds inserted, implicitely remove TERM bit of prev
301     		set_td_link(prev, new->dma_addr | (flags & UHCI_PTR_DEPTH));
302     	}
303     	mb();
304     	spin_unlock_irqrestore (&s->td_lock, xxx);
305     	
306     	return 0;
307     }
308     /*-------------------------------------------------------------------*/
309     /* insert new_td after td (horizontal) */
310     _static int insert_td_horizontal (uhci_t *s, uhci_desc_t *td, uhci_desc_t* new)
311     {
312     	uhci_desc_t *next;
313     	unsigned long flags;
314     	
315     	spin_lock_irqsave (&s->td_lock, flags);
316     
317     	next = list_entry (td->horizontal.next, uhci_desc_t, horizontal);
318     	list_add (&new->horizontal, &td->horizontal);
319     	new->hw.td.link = td->hw.td.link;
320     	set_td_link(td, new->dma_addr);
321     	mb();
322     	spin_unlock_irqrestore (&s->td_lock, flags);	
323     	
324     	return 0;
325     }
326     /*-------------------------------------------------------------------*/
327     _static int unlink_td (uhci_t *s, uhci_desc_t *element, int phys_unlink)
328     {
329     	uhci_desc_t *next, *prev;
330     	int dir = 0;
331     	unsigned long flags;
332     	
333     	spin_lock_irqsave (&s->td_lock, flags);
334     	
335     	next = list_entry (element->vertical.next, uhci_desc_t, vertical);
336     	
337     	if (next == element) {
338     		dir = 1;
339     		prev = list_entry (element->horizontal.prev, uhci_desc_t, horizontal);
340     	}
341     	else 
342     		prev = list_entry (element->vertical.prev, uhci_desc_t, vertical);
343     	
344     	if (phys_unlink) {
345     		// really remove HW linking
346     		if (prev->type == TD_TYPE)
347     			prev->hw.td.link = element->hw.td.link;
348     		else
349     			prev->hw.qh.element = element->hw.td.link;
350     	}
351     
352     	mb ();
353     
354     	if (dir == 0)
355     		list_del (&element->vertical);
356     	else
357     		list_del (&element->horizontal);
358     	
359     	spin_unlock_irqrestore (&s->td_lock, flags);	
360     	
361     	return 0;
362     }
363     
364     /*-------------------------------------------------------------------*/
365     _static int delete_desc (uhci_t *s, uhci_desc_t *element)
366     {
367     	pci_pool_free(s->desc_pool, element, element->dma_addr);
368     	return 0;
369     }
370     /*-------------------------------------------------------------------*/
371     // Allocates qh element
372     _static int alloc_qh (uhci_t *s, uhci_desc_t ** new)
373     {
374     	dma_addr_t dma_handle;
375     
376     	*new = pci_pool_alloc(s->desc_pool, GFP_DMA | GFP_ATOMIC, &dma_handle);
377     	if (!*new)
378     		return -ENOMEM;
379     	memset (*new, 0, sizeof (uhci_desc_t));
380     	(*new)->dma_addr = dma_handle;
381     	set_qh_head(*new, UHCI_PTR_TERM);
382     	set_qh_element(*new, UHCI_PTR_TERM);
383     	(*new)->type = QH_TYPE;
384     	
385     	mb();
386     	INIT_LIST_HEAD (&(*new)->horizontal);
387     	INIT_LIST_HEAD (&(*new)->vertical);
388     	
389     	dbg("Allocated qh @ %p", *new);
390     	
391     	return 0;
392     }
393     /*-------------------------------------------------------------------*/
394     // inserts new qh before/after the qh at pos
395     // flags: 0: insert before pos, 1: insert after pos (for low speed transfers)
396     _static int insert_qh (uhci_t *s, uhci_desc_t *pos, uhci_desc_t *new, int order)
397     {
398     	uhci_desc_t *old;
399     	unsigned long flags;
400     
401     	spin_lock_irqsave (&s->qh_lock, flags);
402     
403     	if (!order) {
404     		// (OLD) (POS) -> (OLD) (NEW) (POS)
405     		old = list_entry (pos->horizontal.prev, uhci_desc_t, horizontal);
406     		list_add_tail (&new->horizontal, &pos->horizontal);
407     		set_qh_head(new, MAKE_QH_ADDR (pos)) ;
408     		if (!(old->hw.qh.head & cpu_to_le32(UHCI_PTR_TERM)))
409     			set_qh_head(old, MAKE_QH_ADDR (new)) ;
410     	}
411     	else {
412     		// (POS) (OLD) -> (POS) (NEW) (OLD)
413     		old = list_entry (pos->horizontal.next, uhci_desc_t, horizontal);
414     		list_add (&new->horizontal, &pos->horizontal);
415     		set_qh_head(new, MAKE_QH_ADDR (old));
416     		set_qh_head(pos, MAKE_QH_ADDR (new)) ;
417     	}
418     
419     	mb ();
420     	
421     	spin_unlock_irqrestore (&s->qh_lock, flags);
422     
423     	return 0;
424     }
425     
426     /*-------------------------------------------------------------------*/
427     _static int unlink_qh (uhci_t *s, uhci_desc_t *element)
428     {
429     	uhci_desc_t  *prev;
430     	unsigned long flags;
431     
432     	spin_lock_irqsave (&s->qh_lock, flags);
433     	
434     	prev = list_entry (element->horizontal.prev, uhci_desc_t, horizontal);
435     	prev->hw.qh.head = element->hw.qh.head;
436     
437     	dbg("unlink qh %p, pqh %p, nxqh %p, to %08x", element, prev, 
438     	    list_entry (element->horizontal.next, uhci_desc_t, horizontal),le32_to_cpu(element->hw.qh.head) &~15);
439     	
440     	list_del(&element->horizontal);
441     
442     	mb ();
443     	spin_unlock_irqrestore (&s->qh_lock, flags);
444     	
445     	return 0;
446     }
447     /*-------------------------------------------------------------------*/
448     _static int delete_qh (uhci_t *s, uhci_desc_t *qh)
449     {
450     	uhci_desc_t *td;
451     	struct list_head *p;
452     	
453     	list_del (&qh->horizontal);
454     
455     	while ((p = qh->vertical.next) != &qh->vertical) {
456     		td = list_entry (p, uhci_desc_t, vertical);
457     		dbg("unlink td @ %p",td);
458     		unlink_td (s, td, 0); // no physical unlink
459     		delete_desc (s, td);
460     	}
461     
462     	delete_desc (s, qh);
463     	
464     	return 0;
465     }
466     /*-------------------------------------------------------------------*/
467     _static void clean_td_chain (uhci_t *s, uhci_desc_t *td)
468     {
469     	struct list_head *p;
470     	uhci_desc_t *td1;
471     
472     	if (!td)
473     		return;
474     	
475     	while ((p = td->horizontal.next) != &td->horizontal) {
476     		td1 = list_entry (p, uhci_desc_t, horizontal);
477     		delete_desc (s, td1);
478     	}
479     	
480     	delete_desc (s, td);
481     }
482     
483     /*-------------------------------------------------------------------*/
484     _static void fill_td (uhci_desc_t *td, int status, int info, __u32 buffer)
485     {
486     	td->hw.td.status = cpu_to_le32(status);
487     	td->hw.td.info = cpu_to_le32(info);
488     	td->hw.td.buffer = cpu_to_le32(buffer);
489     }
490     /*-------------------------------------------------------------------*/
491     // Removes ALL qhs in chain (paranoia!)
492     _static void cleanup_skel (uhci_t *s)
493     {
494     	unsigned int n;
495     	uhci_desc_t *td;
496     
497     	dbg("cleanup_skel");
498     
499     	clean_descs(s,1);
500     
501     	
502     	if (s->td32ms) {
503     	
504     		unlink_td(s,s->td32ms,1);
505     		delete_desc(s, s->td32ms);
506     	}
507     
508     	for (n = 0; n < 8; n++) {
509     		td = s->int_chain[n];
510     		clean_td_chain (s, td);
511     	}
512     
513     	if (s->iso_td) {
514     		for (n = 0; n < 1024; n++) {
515     			td = s->iso_td[n];
516     			clean_td_chain (s, td);
517     		}
518     		kfree (s->iso_td);
519     	}
520     
521     	if (s->framelist)
522     		pci_free_consistent(s->uhci_pci, PAGE_SIZE,
523     				    s->framelist, s->framelist_dma);
524     
525     	if (s->control_chain) {
526     		// completed init_skel?
527     		struct list_head *p;
528     		uhci_desc_t *qh, *qh1;
529     
530     		qh = s->control_chain;
531     		while ((p = qh->horizontal.next) != &qh->horizontal) {
532     			qh1 = list_entry (p, uhci_desc_t, horizontal);
533     			delete_qh (s, qh1);
534     		}
535     
536     		delete_qh (s, qh);
537     	}
538     	else {
539     		if (s->ls_control_chain)
540     			delete_desc (s, s->ls_control_chain);
541     		if (s->control_chain)
542     			delete_desc (s, s->control_chain);
543     		if (s->bulk_chain)
544     			delete_desc (s, s->bulk_chain);
545     		if (s->chain_end)
546     			delete_desc (s, s->chain_end);
547     	}
548     
549     	if (s->desc_pool) {
550     		pci_pool_destroy(s->desc_pool);
551     		s->desc_pool = NULL;
552     	}
553     
554     	dbg("cleanup_skel finished");	
555     }
556     /*-------------------------------------------------------------------*/
557     // allocates framelist and qh-skeletons
558     // only HW-links provide continous linking, SW-links stay in their domain (ISO/INT)
559     _static int init_skel (uhci_t *s)
560     {
561     	int n, ret;
562     	uhci_desc_t *qh, *td;
563     	
564     	dbg("init_skel");
565     	
566     	s->framelist = pci_alloc_consistent(s->uhci_pci, PAGE_SIZE,
567     					    &s->framelist_dma);
568     
569     	if (!s->framelist)
570     		return -ENOMEM;
571     
572     	memset (s->framelist, 0, 4096);
573     
574     	dbg("creating descriptor pci_pool");
575     
576     	s->desc_pool = pci_pool_create("uhci_desc", s->uhci_pci,
577     				       sizeof(uhci_desc_t), 16, 0,
578     				       GFP_DMA | GFP_ATOMIC);	
579     	if (!s->desc_pool)
580     		goto init_skel_cleanup;
581     
582     	dbg("allocating iso desc pointer list");
583     	s->iso_td = (uhci_desc_t **) kmalloc (1024 * sizeof (uhci_desc_t*), GFP_KERNEL);
584     	
585     	if (!s->iso_td)
586     		goto init_skel_cleanup;
587     
588     	s->ls_control_chain = NULL;
589     	s->control_chain = NULL;
590     	s->bulk_chain = NULL;
591     	s->chain_end = NULL;
592     
593     	dbg("allocating iso descs");
594     	for (n = 0; n < 1024; n++) {
595     	 	// allocate skeleton iso/irq-tds
596     		if (alloc_td (s, &td, 0))
597     			goto init_skel_cleanup;
598     
599     		s->iso_td[n] = td;
600     		s->framelist[n] = cpu_to_le32((__u32) td->dma_addr);
601     	}
602     
603     	dbg("allocating qh: chain_end");
604     	if (alloc_qh (s, &qh))	
605     		goto init_skel_cleanup;
606     				
607     	s->chain_end = qh;
608     
609     	if (alloc_td (s, &td, 0))
610     		goto init_skel_cleanup;
611     	
612     	fill_td (td, 0 * TD_CTRL_IOC, 0, 0); // generate 1ms interrupt (enabled on demand)
613     	insert_td (s, qh, td, 0);
614     	qh->hw.qh.element &= cpu_to_le32(~UHCI_PTR_TERM); // remove TERM bit
615     	s->td1ms=td;
616     
617     	dbg("allocating qh: bulk_chain");
618     	if (alloc_qh (s, &qh))
619     		goto init_skel_cleanup;
620     	
621     	insert_qh (s, s->chain_end, qh, 0);
622     	s->bulk_chain = qh;
623     
624     	dbg("allocating qh: control_chain");
625     	ret = alloc_qh (s, &qh);
626     	if (ret)
627     		goto init_skel_cleanup;
628     	
629     	insert_qh (s, s->bulk_chain, qh, 0);
630     	s->control_chain = qh;
631     
632     #ifdef	CONFIG_USB_UHCI_HIGH_BANDWIDTH
633     	// disabled reclamation loop
634     	set_qh_head(s->chain_end, s->control_chain->dma_addr | UHCI_PTR_QH | UHCI_PTR_TERM);
635     #endif
636     
637     	dbg("allocating qh: ls_control_chain");
638     	if (alloc_qh (s, &qh))
639     		goto init_skel_cleanup;
640     	
641     	insert_qh (s, s->control_chain, qh, 0);
642     	s->ls_control_chain = qh;
643     
644     	for (n = 0; n < 8; n++)
645     		s->int_chain[n] = 0;
646     
647     	dbg("allocating skeleton INT-TDs");
648     	
649     	for (n = 0; n < 8; n++) {
650     		uhci_desc_t *td;
651     
652     		if (alloc_td (s, &td, 0))
653     			goto init_skel_cleanup;
654     
655     		s->int_chain[n] = td;
656     		if (n == 0) {
657     			set_td_link(s->int_chain[0], s->ls_control_chain->dma_addr | UHCI_PTR_QH);
658     		}
659     		else {
660     			set_td_link(s->int_chain[n], s->int_chain[0]->dma_addr);
661     		}
662     	}
663     
664     	dbg("Linking skeleton INT-TDs");
665     	
666     	for (n = 0; n < 1024; n++) {
667     		// link all iso-tds to the interrupt chains
668     		int m, o;
669     		dbg("framelist[%i]=%x",n,le32_to_cpu(s->framelist[n]));
670     		if ((n&127)==127) 
671     			((uhci_desc_t*) s->iso_td[n])->hw.td.link = cpu_to_le32(s->int_chain[0]->dma_addr);
672     		else 
673     			for (o = 1, m = 2; m <= 128; o++, m += m)
674     				if ((n & (m - 1)) == ((m - 1) / 2))
675     					set_td_link(((uhci_desc_t*) s->iso_td[n]), s->int_chain[o]->dma_addr);
676     	}
677     
678     	if (alloc_td (s, &td, 0))
679     		goto init_skel_cleanup;
680     	
681     	fill_td (td, 0 * TD_CTRL_IOC, 0, 0); // generate 32ms interrupt (activated later)
682     	s->td32ms=td;
683     
684     	insert_td_horizontal (s, s->int_chain[5], td);
685     
686     	mb();
687     	//uhci_show_queue(s->control_chain);   
688     	dbg("init_skel exit");
689     	return 0;
690     
691           init_skel_cleanup:
692     	cleanup_skel (s);
693     	return -ENOMEM;
694     }
695     
696     /*-------------------------------------------------------------------*/
697     //                         LOW LEVEL STUFF
698     //          assembles QHs und TDs for control, bulk and iso
699     /*-------------------------------------------------------------------*/
700     _static int uhci_submit_control_urb (urb_t *urb)
701     {
702     	uhci_desc_t *qh, *td;
703     	uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
704     	urb_priv_t *urb_priv = urb->hcpriv;
705     	unsigned long destination, status;
706     	int maxsze = usb_maxpacket (urb->dev, urb->pipe, usb_pipeout (urb->pipe));
707     	unsigned long len;
708     	char *data;
709     	int depth_first=USE_CTRL_DEPTH_FIRST;  // UHCI descriptor chasing method
710     
711     	dbg("uhci_submit_control start");
712     	if (alloc_qh (s, &qh))		// alloc qh for this request
713     		return -ENOMEM;
714     
715     	if (alloc_td (s, &td, UHCI_PTR_DEPTH * depth_first))		// get td for setup stage
716     	{
717     		delete_qh (s, qh);
718     		return -ENOMEM;
719     	}
720     
721     	/* The "pipe" thing contains the destination in bits 8--18 */
722     	destination = (urb->pipe & PIPE_DEVEP_MASK) | USB_PID_SETUP;
723     
724     	/* 3 errors */
725     	status = (urb->pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE |
726     		(urb->transfer_flags & USB_DISABLE_SPD ? 0 : TD_CTRL_SPD) | (3 << 27);
727     
728     	/*  Build the TD for the control request, try forever, 8 bytes of data */
729     	fill_td (td, status, destination | (7 << 21), urb_priv->setup_packet_dma);
730     
731     	insert_td (s, qh, td, 0);	// queue 'setup stage'-td in qh
732     #if 0
733     	{
734     		char *sp=urb->setup_packet;
735     		dbg("SETUP to pipe %x: %x %x %x %x %x %x %x %x", urb->pipe,
736     		    sp[0],sp[1],sp[2],sp[3],sp[4],sp[5],sp[6],sp[7]);
737     	}
738     	//uhci_show_td(td);
739     #endif
740     
741     	len = urb->transfer_buffer_length;
742     	data = urb->transfer_buffer;
743     
744     	/* If direction is "send", change the frame from SETUP (0x2D)
745     	   to OUT (0xE1). Else change it from SETUP to IN (0x69). */
746     
747     	destination = (urb->pipe & PIPE_DEVEP_MASK) | (usb_pipeout (urb->pipe)?USB_PID_OUT:USB_PID_IN);
748     
749     	while (len > 0) {
750     		int pktsze = len;
751     
752     		if (alloc_td (s, &td, UHCI_PTR_DEPTH * depth_first))
753     			goto fail_unmap_enomem;
754     
755     		if (pktsze > maxsze)
756     			pktsze = maxsze;
757     
758     		destination ^= 1 << TD_TOKEN_TOGGLE;	// toggle DATA0/1
759     
760     		// Status, pktsze bytes of data
761     		fill_td (td, status, destination | ((pktsze - 1) << 21),
762     			 urb_priv->transfer_buffer_dma + (data - (char *)urb->transfer_buffer));
763     
764     		insert_td (s, qh, td, UHCI_PTR_DEPTH * depth_first);	// queue 'data stage'-td in qh
765     
766     		data += pktsze;
767     		len -= pktsze;
768     	}
769     
770     	/* Build the final TD for control status */
771     	/* It's only IN if the pipe is out AND we aren't expecting data */
772     
773     	destination &= ~UHCI_PID;
774     
775     	if (usb_pipeout (urb->pipe) || (urb->transfer_buffer_length == 0))
776     		destination |= USB_PID_IN;
777     	else
778     		destination |= USB_PID_OUT;
779     
780     	destination |= 1 << TD_TOKEN_TOGGLE;	/* End in Data1 */
781     
782     	if (alloc_td (s, &td, UHCI_PTR_DEPTH))
783     		goto fail_unmap_enomem;
784     
785     	status &=~TD_CTRL_SPD;
786     
787     	/* no limit on errors on final packet , 0 bytes of data */
788     	fill_td (td, status | TD_CTRL_IOC, destination | (UHCI_NULL_DATA_SIZE << 21),
789     		 0);
790     
791     	insert_td (s, qh, td, UHCI_PTR_DEPTH * depth_first);	// queue status td
792     
793     	list_add (&qh->desc_list, &urb_priv->desc_list);
794     
795     	queue_urb (s, urb);	// queue before inserting in desc chain
796     
797     	qh->hw.qh.element &= cpu_to_le32(~UHCI_PTR_TERM);
798     
799     	//uhci_show_queue(qh);
800     	/* Start it up... put low speed first */
801     	if (urb->pipe & TD_CTRL_LS)
802     		insert_qh (s, s->control_chain, qh, 0);
803     	else
804     		insert_qh (s, s->bulk_chain, qh, 0);
805     
806     	dbg("uhci_submit_control end");
807     	return 0;
808     
809     fail_unmap_enomem:
810     	delete_qh(s, qh);
811     	return -ENOMEM;
812     }
813     /*-------------------------------------------------------------------*/
814     // For queued bulk transfers, two additional QH helpers are allocated (nqh, bqh)
815     // Due to the linking with other bulk urbs, it has to be locked with urb_list_lock!
816     
817     _static int uhci_submit_bulk_urb (urb_t *urb, urb_t *bulk_urb)
818     {
819     	uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
820     	urb_priv_t *urb_priv = urb->hcpriv, *upriv, *bpriv=NULL;
821     	uhci_desc_t *qh, *td, *nqh=NULL, *bqh=NULL, *first_td=NULL;
822     	unsigned long destination, status;
823     	char *data;
824     	unsigned int pipe = urb->pipe;
825     	int maxsze = usb_maxpacket (urb->dev, pipe, usb_pipeout (pipe));
826     	int info, len, last;
827     	int depth_first=USE_BULK_DEPTH_FIRST;  // UHCI descriptor chasing method
828     
829     	if (usb_endpoint_halted (urb->dev, usb_pipeendpoint (pipe), usb_pipeout (pipe)))
830     		return -EPIPE;
831     
832     	queue_dbg("uhci_submit_bulk_urb: urb %p, old %p, pipe %08x, len %i",
833     		  urb,bulk_urb,urb->pipe,urb->transfer_buffer_length);
834     
835     	upriv = (urb_priv_t*)urb->hcpriv;
836     
837     	if (!bulk_urb) {
838     		if (alloc_qh (s, &qh))		// get qh for this request
839     			return -ENOMEM;
840     
841     		if (urb->transfer_flags & USB_QUEUE_BULK) {
842     			if (alloc_qh(s, &nqh)) // placeholder for clean unlink
843     			{
844     				delete_desc (s, qh);
845     				return -ENOMEM;
846     			}
847     			upriv->next_qh = nqh;
848     			queue_dbg("new next qh %p",nqh);
849     		}
850     	}
851     	else { 
852     		bpriv = (urb_priv_t*)bulk_urb->hcpriv;
853     		qh = bpriv->bottom_qh;  // re-use bottom qh and next qh
854     		nqh = bpriv->next_qh;
855     		upriv->next_qh=nqh;	
856     		upriv->prev_queued_urb=bulk_urb;
857     	}
858     
859     	if (urb->transfer_flags & USB_QUEUE_BULK) {
860     		if (alloc_qh (s, &bqh))  // "bottom" QH
861     		{
862     			if (!bulk_urb) { 
863     				delete_desc(s, qh);
864     				delete_desc(s, nqh);
865     			}
866     			return -ENOMEM;
867     		}
868     		set_qh_element(bqh, UHCI_PTR_TERM);
869     		set_qh_head(bqh, nqh->dma_addr | UHCI_PTR_QH); // element
870     		upriv->bottom_qh = bqh;
871     	}
872     	queue_dbg("uhci_submit_bulk: qh %p bqh %p nqh %p",qh, bqh, nqh);
873     
874     	/* The "pipe" thing contains the destination in bits 8--18. */
875     	destination = (pipe & PIPE_DEVEP_MASK) | usb_packetid (pipe);
876     
877     	/* 3 errors */
878     	status = (pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE |
879     		((urb->transfer_flags & USB_DISABLE_SPD) ? 0 : TD_CTRL_SPD) | (3 << 27);
880     
881     	/* Build the TDs for the bulk request */
882     	len = urb->transfer_buffer_length;
883     	data = urb->transfer_buffer;
884     	
885     	do {					// TBD: Really allow zero-length packets?
886     		int pktsze = len;
887     
888     		if (alloc_td (s, &td, UHCI_PTR_DEPTH * depth_first))
889     		{
890     			delete_qh (s, qh);
891     			return -ENOMEM;
892     		}
893     
894     		if (pktsze > maxsze)
895     			pktsze = maxsze;
896     
897     		// pktsze bytes of data 
898     		info = destination | (((pktsze - 1)&UHCI_NULL_DATA_SIZE) << 21) |
899     			(usb_gettoggle (urb->dev, usb_pipeendpoint (pipe), usb_pipeout (pipe)) << TD_TOKEN_TOGGLE);
900     
901     		fill_td (td, status, info,
902     			 urb_priv->transfer_buffer_dma + (data - (char *)urb->transfer_buffer));
903     
904     		data += pktsze;
905     		len -= pktsze;
906     		// Use USB_ZERO_PACKET to finish bulk OUTs always with a zero length packet
907     		last = (len == 0 && (usb_pipein(pipe) || pktsze < maxsze || !(urb->transfer_flags & USB_ZERO_PACKET)));
908     
909     		if (last)
910     			set_td_ioc(td);	// last one generates INT
911     
912     		insert_td (s, qh, td, UHCI_PTR_DEPTH * depth_first);
913     		if (!first_td)
914     			first_td=td;
915     		usb_dotoggle (urb->dev, usb_pipeendpoint (pipe), usb_pipeout (pipe));
916     
917     	} while (!last);
918     
919     	if (bulk_urb && bpriv)   // everything went OK, link with old bulk URB
920     		bpriv->next_queued_urb=urb;
921     
922     	list_add (&qh->desc_list, &urb_priv->desc_list);
923     
924     	if (urb->transfer_flags & USB_QUEUE_BULK)
925     		append_qh(s, td, bqh, UHCI_PTR_DEPTH * depth_first);
926     
927     	queue_urb_unlocked (s, urb);
928     	
929     	if (urb->transfer_flags & USB_QUEUE_BULK)
930     		set_qh_element(qh, first_td->dma_addr);
931     	else
932     		qh->hw.qh.element &= cpu_to_le32(~UHCI_PTR_TERM);    // arm QH
933     
934     	if (!bulk_urb) { 					// new bulk queue	
935     		if (urb->transfer_flags & USB_QUEUE_BULK) {
936     			spin_lock (&s->td_lock);		// both QHs in one go
937     			insert_qh (s, s->chain_end, qh, 0);	// Main QH
938     			insert_qh (s, s->chain_end, nqh, 0);	// Helper QH
939     			spin_unlock (&s->td_lock);
940     		}
941     		else
942     			insert_qh (s, s->chain_end, qh, 0);
943     	}
944     	
945     	//uhci_show_queue(s->bulk_chain);
946     	//dbg("uhci_submit_bulk_urb: exit\n");
947     	return 0;
948     }
949     /*-------------------------------------------------------------------*/
950     _static void uhci_clean_iso_step1(uhci_t *s, urb_priv_t *urb_priv)
951     {
952     	struct list_head *p;
953     	uhci_desc_t *td;
954     
955     	for (p = urb_priv->desc_list.next; p != &urb_priv->desc_list; p = p->next) {
956     				td = list_entry (p, uhci_desc_t, desc_list);
957     				unlink_td (s, td, 1);
958     	}
959     }
960     /*-------------------------------------------------------------------*/
961     _static void uhci_clean_iso_step2(uhci_t *s, urb_priv_t *urb_priv)
962     {
963     	struct list_head *p;
964     	uhci_desc_t *td;
965     
966     	while ((p = urb_priv->desc_list.next) != &urb_priv->desc_list) {
967     				td = list_entry (p, uhci_desc_t, desc_list);
968     				list_del (p);
969     				delete_desc (s, td);
970     	}
971     }
972     /*-------------------------------------------------------------------*/
973     /* mode: CLEAN_TRANSFER_NO_DELETION: unlink but no deletion mark (step 1 of async_unlink)
974              CLEAN_TRANSFER_REGULAR: regular (unlink/delete-mark)
975              CLEAN_TRANSFER_DELETION_MARK: deletion mark for QH (step 2 of async_unlink)
976      looks a bit complicated because of all the bulk queueing goodies
977     */
978     
979     _static void uhci_clean_transfer (uhci_t *s, urb_t *urb, uhci_desc_t *qh, int mode)
980     {
981     	uhci_desc_t *bqh, *nqh, *prevqh, *prevtd;
982     	int now;
983     	urb_priv_t *priv=(urb_priv_t*)urb->hcpriv;
984     
985     	now=UHCI_GET_CURRENT_FRAME(s);
986     
987     	bqh=priv->bottom_qh;	
988     	
989     	if (!priv->next_queued_urb)  { // no more appended bulk queues
990     
991     		queue_dbg("uhci_clean_transfer: No more bulks for urb %p, qh %p, bqh %p, nqh %p", urb, qh, bqh, priv->next_qh);	
992     	
993     		if (priv->prev_queued_urb && mode != CLEAN_TRANSFER_DELETION_MARK) {  // qh not top of the queue
994     				unsigned long flags; 
995     				urb_priv_t* ppriv=(urb_priv_t*)priv->prev_queued_urb->hcpriv;
996     
997     				spin_lock_irqsave (&s->qh_lock, flags);
998     				prevqh = list_entry (ppriv->desc_list.next, uhci_desc_t, desc_list);
999     				prevtd = list_entry (prevqh->vertical.prev, uhci_desc_t, vertical);
1000     				set_td_link(prevtd, priv->bottom_qh->dma_addr | UHCI_PTR_QH); // skip current qh
1001     				mb();
1002     				queue_dbg("uhci_clean_transfer: relink pqh %p, ptd %p",prevqh, prevtd);
1003     				spin_unlock_irqrestore (&s->qh_lock, flags);
1004     
1005     				ppriv->bottom_qh = priv->bottom_qh;
1006     				ppriv->next_queued_urb = NULL;
1007     			}
1008     		else {   // queue is dead, qh is top of the queue
1009     			
1010     			if (mode != CLEAN_TRANSFER_DELETION_MARK) 				
1011     				unlink_qh(s, qh); // remove qh from horizontal chain
1012     
1013     			if (bqh) {  // remove remainings of bulk queue
1014     				nqh=priv->next_qh;
1015     
1016     				if (mode != CLEAN_TRANSFER_DELETION_MARK) 
1017     					unlink_qh(s, nqh);  // remove nqh from horizontal chain
1018     				
1019     				if (mode != CLEAN_TRANSFER_NO_DELETION) {  // add helper QHs to free desc list
1020     					nqh->last_used = bqh->last_used = now;
1021     					list_add_tail (&nqh->horizontal, &s->free_desc);
1022     					list_add_tail (&bqh->horizontal, &s->free_desc);
1023     				}			
1024     			}
1025     		}
1026     	}
1027     	else { // there are queued urbs following
1028     	
1029     	  queue_dbg("uhci_clean_transfer: urb %p, prevurb %p, nexturb %p, qh %p, bqh %p, nqh %p",
1030     		       urb, priv->prev_queued_urb,  priv->next_queued_urb, qh, bqh, priv->next_qh);	
1031            	
1032     		if (mode != CLEAN_TRANSFER_DELETION_MARK) {	// no work for cleanup at unlink-completion
1033     			urb_t *nurb;
1034     			unsigned long flags;
1035     
1036     			nurb = priv->next_queued_urb;
1037     			spin_lock_irqsave (&s->qh_lock, flags);		
1038     
1039     			if (!priv->prev_queued_urb) { // top QH
1040     				
1041     				prevqh = list_entry (qh->horizontal.prev, uhci_desc_t, horizontal);
1042     				set_qh_head(prevqh, bqh->dma_addr | UHCI_PTR_QH);
1043     				list_del (&qh->horizontal);  // remove this qh form horizontal chain
1044     				list_add (&bqh->horizontal, &prevqh->horizontal); // insert next bqh in horizontal chain
1045     			}
1046     			else {		// intermediate QH
1047     				urb_priv_t* ppriv=(urb_priv_t*)priv->prev_queued_urb->hcpriv;
1048     				urb_priv_t* npriv=(urb_priv_t*)nurb->hcpriv;
1049     				uhci_desc_t * bnqh;
1050     				
1051     				bnqh = list_entry (npriv->desc_list.next, uhci_desc_t, desc_list);
1052     				ppriv->bottom_qh = bnqh;
1053     				ppriv->next_queued_urb = nurb;				
1054     				prevqh = list_entry (ppriv->desc_list.next, uhci_desc_t, desc_list);
1055     				set_qh_head(prevqh, bqh->dma_addr | UHCI_PTR_QH);
1056     			}
1057     
1058     			mb();
1059     			((urb_priv_t*)nurb->hcpriv)->prev_queued_urb=priv->prev_queued_urb;
1060     			spin_unlock_irqrestore (&s->qh_lock, flags);
1061     		}		
1062     	}
1063     
1064     	if (mode != CLEAN_TRANSFER_NO_DELETION) {
1065     		qh->last_used = now;	
1066     		list_add_tail (&qh->horizontal, &s->free_desc); // mark qh for later deletion/kfree
1067     	}
1068     }
1069     /*-------------------------------------------------------------------*/
1070     // Release bandwidth for Interrupt or Isoc. transfers 
1071     _static void uhci_release_bandwidth(urb_t *urb)
1072     {       
1073     	if (urb->bandwidth) {
1074     		switch (usb_pipetype(urb->pipe)) {
1075     		case PIPE_INTERRUPT:
1076     			usb_release_bandwidth (urb->dev, urb, 0);
1077     			break;
1078     		case PIPE_ISOCHRONOUS:
1079     			usb_release_bandwidth (urb->dev, urb, 1);
1080     			break;
1081     		default:
1082     			break;
1083     		}
1084     	}	
1085     }
1086     
1087     _static void uhci_urb_dma_sync(uhci_t *s, urb_t *urb, urb_priv_t *urb_priv)
1088     {
1089     	if (urb_priv->setup_packet_dma)
1090     		pci_dma_sync_single(s->uhci_pci, urb_priv->setup_packet_dma,
1091     				    sizeof(devrequest), PCI_DMA_TODEVICE);
1092     
1093     	if (urb_priv->transfer_buffer_dma)
1094     		pci_dma_sync_single(s->uhci_pci, urb_priv->transfer_buffer_dma,
1095     				    urb->transfer_buffer_length,
1096     				    usb_pipein(urb->pipe) ?
1097     				    PCI_DMA_FROMDEVICE :
1098     				    PCI_DMA_TODEVICE);
1099     }
1100     
1101     _static void uhci_urb_dma_unmap(uhci_t *s, urb_t *urb, urb_priv_t *urb_priv)
1102     {
1103     	if (urb_priv->setup_packet_dma) {
1104     		pci_unmap_single(s->uhci_pci, urb_priv->setup_packet_dma,
1105     				 sizeof(devrequest), PCI_DMA_TODEVICE);
1106     		urb_priv->setup_packet_dma = 0;
1107     	}
1108     	if (urb_priv->transfer_buffer_dma) {
1109     		pci_unmap_single(s->uhci_pci, urb_priv->transfer_buffer_dma,
1110     				 urb->transfer_buffer_length,
1111     				 usb_pipein(urb->pipe) ?
1112     				 PCI_DMA_FROMDEVICE :
1113     				 PCI_DMA_TODEVICE);
1114     		urb_priv->transfer_buffer_dma = 0;
1115     	}
1116     }
1117     /*-------------------------------------------------------------------*/
1118     /* needs urb_list_lock!
1119        mode: UNLINK_ASYNC_STORE_URB: unlink and move URB into unlinked list
1120              UNLINK_ASYNC_DONT_STORE: unlink, don't move URB into unlinked list
1121     */
1122     _static int uhci_unlink_urb_async (uhci_t *s,urb_t *urb, int mode)
1123     {
1124     	uhci_desc_t *qh;
1125     	urb_priv_t *urb_priv;
1126     	
1127     	async_dbg("unlink_urb_async called %p",urb);
1128     
1129     	if ((urb->status == -EINPROGRESS) ||
1130     	    ((usb_pipetype (urb->pipe) ==  PIPE_INTERRUPT) && ((urb_priv_t*)urb->hcpriv)->flags))
1131     	{
1132     		((urb_priv_t*)urb->hcpriv)->started = ~0;  // mark
1133     		dequeue_urb (s, urb);
1134     
1135     		if (mode==UNLINK_ASYNC_STORE_URB)
1136     			list_add_tail (&urb->urb_list, &s->urb_unlinked); // store urb
1137     
1138     		uhci_switch_timer_int(s);
1139            		s->unlink_urb_done = 1;
1140     		uhci_release_bandwidth(urb);
1141     
1142     		urb->status = -ECONNABORTED;	// mark urb as "waiting to be killed"	
1143     		urb_priv = (urb_priv_t*)urb->hcpriv;
1144     
1145     		switch (usb_pipetype (urb->pipe)) {
1146     		case PIPE_INTERRUPT:
1147     			usb_dotoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe));
1148     
1149     		case PIPE_ISOCHRONOUS:
1150     			uhci_clean_iso_step1 (s, urb_priv);
1151     			break;
1152     
1153     		case PIPE_BULK:
1154     		case PIPE_CONTROL:
1155     			qh = list_entry (urb_priv->desc_list.next, uhci_desc_t, desc_list);
1156     			uhci_clean_transfer (s, urb, qh, CLEAN_TRANSFER_NO_DELETION);
1157     			break;
1158     		}
1159     		((urb_priv_t*)urb->hcpriv)->started = UHCI_GET_CURRENT_FRAME(s);
1160     		return -EINPROGRESS;  // completion will follow
1161     	}		
1162     
1163     	return 0;    // URB already dead
1164     }
1165     /*-------------------------------------------------------------------*/
1166     // kills an urb by unlinking descriptors and waiting for at least one frame
1167     _static int uhci_unlink_urb_sync (uhci_t *s, urb_t *urb)
1168     {
1169     	uhci_desc_t *qh;
1170     	urb_priv_t *urb_priv;
1171     	unsigned long flags=0;
1172     	struct usb_device *usb_dev;
1173     
1174     	spin_lock_irqsave (&s->urb_list_lock, flags);
1175     
1176     	if (urb->status == -EINPROGRESS) {
1177     
1178     		// move descriptors out the the running chains, dequeue urb
1179     		uhci_unlink_urb_async(s, urb, UNLINK_ASYNC_DONT_STORE);
1180     
1181     		urb_priv = urb->hcpriv;
1182     		urb->status = -ENOENT;	// prevent from double deletion after unlock		
1183     		spin_unlock_irqrestore (&s->urb_list_lock, flags);
1184     		
1185     		// cleanup the rest
1186     		switch (usb_pipetype (urb->pipe)) {
1187     
1188     		case PIPE_ISOCHRONOUS:
1189     			uhci_wait_ms(1);
1190     			uhci_clean_iso_step2(s, urb_priv);
1191     			break;
1192     
1193     		case PIPE_BULK:
1194     		case PIPE_CONTROL:
1195     			qh = list_entry (urb_priv->desc_list.next, uhci_desc_t, desc_list);
1196     			uhci_clean_transfer(s, urb, qh, CLEAN_TRANSFER_DELETION_MARK);
1197     			uhci_wait_ms(1);
1198     		}
1199     		urb->status = -ENOENT;	// mark urb as killed		
1200     					
1201     		uhci_urb_dma_unmap(s, urb, urb->hcpriv);
1202     
1203     #ifdef DEBUG_SLAB
1204     		kmem_cache_free (urb_priv_kmem, urb->hcpriv);
1205     #else
1206     		kfree (urb->hcpriv);
1207     #endif
1208     		usb_dev = urb->dev;
1209     		if (urb->complete) {
1210     			dbg("unlink_urb: calling completion");
1211     			urb->dev = NULL;
1212     			urb->complete ((struct urb *) urb);
1213     		}
1214     		usb_dec_dev_use (usb_dev);
1215     	}
1216     	else
1217     		spin_unlock_irqrestore (&s->urb_list_lock, flags);
1218     
1219     	return 0;
1220     }
1221     /*-------------------------------------------------------------------*/
1222     // async unlink_urb completion/cleanup work
1223     // has to be protected by urb_list_lock!
1224     // features: if set in transfer_flags, the resulting status of the killed
1225     // transaction is not overwritten
1226     
1227     _static void uhci_cleanup_unlink(uhci_t *s, int force)
1228     {
1229     	struct list_head *q;
1230     	urb_t *urb;
1231     	struct usb_device *dev;
1232     	int now, type;
1233     	urb_priv_t *urb_priv;
1234     
1235     	q=s->urb_unlinked.next;
1236     	now=UHCI_GET_CURRENT_FRAME(s);
1237     
1238     	while (q != &s->urb_unlinked) {
1239     
1240     		urb = list_entry (q, urb_t, urb_list);
1241     
1242     		urb_priv = (urb_priv_t*)urb->hcpriv;
1243     		q = urb->urb_list.next;
1244     		
1245     		if (!urb_priv) // avoid crash when URB is corrupted
1246     			break;
1247     			
1248     		if (force || ((urb_priv->started != ~0) && (urb_priv->started != now))) {
1249     			async_dbg("async cleanup %p",urb);
1250     			type=usb_pipetype (urb->pipe);
1251     
1252     			switch (type) { // process descriptors
1253     			case PIPE_CONTROL:
1254     				process_transfer (s, urb, CLEAN_TRANSFER_DELETION_MARK);  // don't unlink (already done)
1255     				break;
1256     			case PIPE_BULK:
1257     				if (!s->avoid_bulk.counter)
1258     					process_transfer (s, urb, CLEAN_TRANSFER_DELETION_MARK); // don't unlink (already done)
1259     				else
1260     					continue;
1261     				break;
1262     			case PIPE_ISOCHRONOUS:
1263     				process_iso (s, urb, PROCESS_ISO_FORCE); // force, don't unlink
1264     				break;
1265     			case PIPE_INTERRUPT:
1266     				process_interrupt (s, urb);
1267     				break;
1268     			}
1269     
1270     			if (!(urb->transfer_flags & USB_TIMEOUT_KILLED))
1271     		  		urb->status = -ECONNRESET; // mark as asynchronously killed
1272     
1273     			dev = urb->dev;	// completion may destroy all...
1274     			urb_priv = urb->hcpriv;
1275     			list_del (&urb->urb_list);
1276     			
1277     			uhci_urb_dma_sync(s, urb, urb_priv);
1278     			if (urb->complete) {
1279     				spin_unlock(&s->urb_list_lock);
1280     				urb->dev = NULL;
1281     				urb->complete ((struct urb *) urb);
1282     				spin_lock(&s->urb_list_lock);
1283     			}
1284     
1285     			if (!(urb->transfer_flags & USB_TIMEOUT_KILLED))
1286     				urb->status = -ENOENT;  // now the urb is really dead
1287     
1288     			switch (type) {
1289     			case PIPE_ISOCHRONOUS:
1290     			case PIPE_INTERRUPT:
1291     				uhci_clean_iso_step2(s, urb_priv);
1292     				break;
1293     			}
1294     	
1295     			uhci_urb_dma_unmap(s, urb, urb_priv);
1296     
1297     			usb_dec_dev_use (dev);
1298     #ifdef DEBUG_SLAB
1299     			kmem_cache_free (urb_priv_kmem, urb_priv);
1300     #else
1301     			kfree (urb_priv);
1302     #endif
1303     
1304     		}
1305     	}
1306     }
1307      
1308     /*-------------------------------------------------------------------*/
1309     _static int uhci_unlink_urb (urb_t *urb)
1310     {
1311     	uhci_t *s;
1312     	unsigned long flags=0;
1313     	dbg("uhci_unlink_urb called for %p",urb);
1314     	if (!urb || !urb->dev)		// you never know...
1315     		return -EINVAL;
1316     	
1317     	s = (uhci_t*) urb->dev->bus->hcpriv;
1318     
1319     	if (usb_pipedevice (urb->pipe) == s->rh.devnum)
1320     		return rh_unlink_urb (urb);
1321     
1322     	if (!urb->hcpriv)
1323     		return -EINVAL;
1324     
1325     	if (urb->transfer_flags & USB_ASYNC_UNLINK) {
1326     		int ret;
1327            		spin_lock_irqsave (&s->urb_list_lock, flags);
1328            		
1329     		uhci_release_bandwidth(urb);
1330     		ret = uhci_unlink_urb_async(s, urb, UNLINK_ASYNC_STORE_URB);
1331     
1332     		spin_unlock_irqrestore (&s->urb_list_lock, flags);	
1333     		return ret;
1334     	}
1335     	else
1336     		return uhci_unlink_urb_sync(s, urb);
1337     }
1338     /*-------------------------------------------------------------------*/
1339     // In case of ASAP iso transfer, search the URB-list for already queued URBs
1340     // for this EP and calculate the earliest start frame for the new
1341     // URB (easy seamless URB continuation!)
1342     _static int find_iso_limits (urb_t *urb, unsigned int *start, unsigned int *end)
1343     {
1344     	urb_t *u, *last_urb = NULL;
1345     	uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
1346     	struct list_head *p;
1347     	int ret=-1;
1348     	unsigned long flags;
1349     	
1350     	spin_lock_irqsave (&s->urb_list_lock, flags);
1351     	p=s->urb_list.prev;
1352     
1353     	for (; p != &s->urb_list; p = p->prev) {
1354     		u = list_entry (p, urb_t, urb_list);
1355     		// look for pending URBs with identical pipe handle
1356     		// works only because iso doesn't toggle the data bit!
1357     		if ((urb->pipe == u->pipe) && (urb->dev == u->dev) && (u->status == -EINPROGRESS)) {
1358     			if (!last_urb)
1359     				*start = u->start_frame;
1360     			last_urb = u;
1361     		}
1362     	}
1363     	
1364     	if (last_urb) {
1365     		*end = (last_urb->start_frame + last_urb->number_of_packets) & 1023;
1366     		ret=0;
1367     	}
1368     	
1369     	spin_unlock_irqrestore(&s->urb_list_lock, flags);
1370     	
1371     	return ret;
1372     }
1373     /*-------------------------------------------------------------------*/
1374     // adjust start_frame according to scheduling constraints (ASAP etc)
1375     
1376     _static int iso_find_start (urb_t *urb)
1377     {
1378     	uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
1379     	unsigned int now;
1380     	unsigned int start_limit = 0, stop_limit = 0, queued_size;
1381     	int limits;
1382     
1383     	now = UHCI_GET_CURRENT_FRAME (s) & 1023;
1384     
1385     	if ((unsigned) urb->number_of_packets > 900)
1386     		return -EFBIG;
1387     	
1388     	limits = find_iso_limits (urb, &start_limit, &stop_limit);
1389     	queued_size = (stop_limit - start_limit) & 1023;
1390     
1391     	if (urb->transfer_flags & USB_ISO_ASAP) {
1392     		// first iso
1393     		if (limits) {
1394     			// 10ms setup should be enough //FIXME!
1395     			urb->start_frame = (now + 10) & 1023;
1396     		}
1397     		else {
1398     			urb->start_frame = stop_limit;		//seamless linkage
1399     
1400     			if (((now - urb->start_frame) & 1023) <= (unsigned) urb->number_of_packets) {
1401     				info("iso_find_start: gap in seamless isochronous scheduling");
1402     				dbg("iso_find_start: now %u start_frame %u number_of_packets %u pipe 0x%08x",
1403     					now, urb->start_frame, urb->number_of_packets, urb->pipe);
1404     				urb->start_frame = (now + 5) & 1023;	// 5ms setup should be enough //FIXME!
1405     			}
1406     		}
1407     	}
1408     	else {
1409     		urb->start_frame &= 1023;
1410     		if (((now - urb->start_frame) & 1023) < (unsigned) urb->number_of_packets) {
1411     			dbg("iso_find_start: now between start_frame and end");
1412     			return -EAGAIN;
1413     		}
1414     	}
1415     
1416     	/* check if either start_frame or start_frame+number_of_packets-1 lies between start_limit and stop_limit */
1417     	if (limits)
1418     		return 0;
1419     
1420     	if (((urb->start_frame - start_limit) & 1023) < queued_size ||
1421     	    ((urb->start_frame + urb->number_of_packets - 1 - start_limit) & 1023) < queued_size) {
1422     		dbg("iso_find_start: start_frame %u number_of_packets %u start_limit %u stop_limit %u",
1423     			urb->start_frame, urb->number_of_packets, start_limit, stop_limit);
1424     		return -EAGAIN;
1425     	}
1426     
1427     	return 0;
1428     }
1429     /*-------------------------------------------------------------------*/
1430     // submits USB interrupt (ie. polling ;-) 
1431     // ASAP-flag set implicitely
1432     // if period==0, the transfer is only done once
1433     
1434     _static int uhci_submit_int_urb (urb_t *urb)
1435     {
1436     	uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
1437     	urb_priv_t *urb_priv = urb->hcpriv;
1438     	int nint, n;
1439     	uhci_desc_t *td;
1440     	int status, destination;
1441     	int info;
1442     	unsigned int pipe = urb->pipe;
1443     
1444     	if (urb->interval < 0 || urb->interval >= 256)
1445     		return -EINVAL;
1446     
1447     	if (urb->interval == 0)
1448     		nint = 0;
1449     	else {
1450     		for (nint = 0, n = 1; nint <= 8; nint++, n += n)	// round interval down to 2^n
1451     		 {
1452     			if (urb->interval < n) {
1453     				urb->interval = n / 2;
1454     				break;
1455     			}
1456     		}
1457     		nint--;
1458     	}
1459     
1460     	dbg("Rounded interval to %i, chain  %i", urb->interval, nint);
1461     
1462     	urb->start_frame = UHCI_GET_CURRENT_FRAME (s) & 1023;	// remember start frame, just in case...
1463     
1464     	urb->number_of_packets = 1;
1465     
1466     	// INT allows only one packet
1467     	if (urb->transfer_buffer_length > usb_maxpacket (urb->dev, pipe, usb_pipeout (pipe)))
1468     		return -EINVAL;
1469     
1470     	if (alloc_td (s, &td, UHCI_PTR_DEPTH))
1471     		return -ENOMEM;
1472     
1473     	status = (pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE | TD_CTRL_IOC |
1474     		(urb->transfer_flags & USB_DISABLE_SPD ? 0 : TD_CTRL_SPD) | (3 << 27);
1475     
1476     	destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid (urb->pipe) |
1477     		(((urb->transfer_buffer_length - 1) & 0x7ff) << 21);
1478     
1479     
1480     	info = destination | (usb_gettoggle (urb->dev, usb_pipeendpoint (pipe), usb_pipeout (pipe)) << TD_TOKEN_TOGGLE);
1481     
1482     	fill_td (td, status, info, urb_priv->transfer_buffer_dma);
1483     	list_add_tail (&td->desc_list, &urb_priv->desc_list);
1484     
1485     	queue_urb (s, urb);
1486     
1487     	insert_td_horizontal (s, s->int_chain[nint], td);	// store in INT-TDs
1488     
1489     	usb_dotoggle (urb->dev, usb_pipeendpoint (pipe), usb_pipeout (pipe));
1490     
1491     	return 0;
1492     }
1493     /*-------------------------------------------------------------------*/
1494     _static int uhci_submit_iso_urb (urb_t *urb)
1495     {
1496     	uhci_t *s = (uhci_t*) urb->dev->bus->hcpriv;
1497     	urb_priv_t *urb_priv = urb->hcpriv;
1498     #ifdef ISO_SANITY_CHECK
1499     	int pipe=urb->pipe;
1500     	int maxsze = usb_maxpacket (urb->dev, pipe, usb_pipeout (pipe));
1501     #endif
1502     	int n, ret, last=0;
1503     	uhci_desc_t *td, **tdm;
1504     	int status, destination;
1505     	unsigned long flags;
1506     
1507     	__save_flags(flags);
1508     	__cli();		      // Disable IRQs to schedule all ISO-TDs in time
1509     	ret = iso_find_start (urb);	// adjusts urb->start_frame for later use
1510     	
1511     	if (ret)
1512     		goto err;
1513     
1514     	tdm = (uhci_desc_t **) kmalloc (urb->number_of_packets * sizeof (uhci_desc_t*), KMALLOC_FLAG);
1515     
1516     	if (!tdm) {
1517     		ret = -ENOMEM;
1518     		goto err;
1519     	}
1520     
1521     	memset(tdm, 0, urb->number_of_packets * sizeof (uhci_desc_t*));
1522     
1523     	// First try to get all TDs. Cause: Removing already inserted TDs can only be done 
1524     	// racefree in three steps: unlink TDs, wait one frame, delete TDs. 
1525     	// So, this solutions seems simpler...
1526     
1527     	for (n = 0; n < urb->number_of_packets; n++) {
1528     		dbg("n:%d urb->iso_frame_desc[n].length:%d", n, urb->iso_frame_desc[n].length);
1529     		if (!urb->iso_frame_desc[n].length)
1530     			continue;  // allows ISO striping by setting length to zero in iso_descriptor
1531     
1532     
1533     #ifdef ISO_SANITY_CHECK
1534     		if(urb->iso_frame_desc[n].length > maxsze) {
1535     
1536     			err("submit_iso: urb->iso_frame_desc[%d].length(%d)>%d",n , urb->iso_frame_desc[n].length, maxsze);
1537     			ret=-EINVAL;		
1538     		}
1539     		else
1540     #endif
1541     		if (alloc_td (s, &td, UHCI_PTR_DEPTH)) {
1542     			int i;	// Cleanup allocated TDs
1543     
1544     			for (i = 0; i < n; n++)
1545     				if (tdm[i])
1546     					 delete_desc(s, tdm[i]);
1547     			kfree (tdm);
1548     			goto err;
1549     		}
1550     		last=n;
1551     		tdm[n] = td;
1552     	}
1553     
1554     	status = TD_CTRL_ACTIVE | TD_CTRL_IOS;
1555     
1556     	destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid (urb->pipe);
1557     
1558     	// Queue all allocated TDs
1559     	for (n = 0; n < urb->number_of_packets; n++) {
1560     		td = tdm[n];
1561     		if (!td)
1562     			continue;
1563     			
1564     		if (n  == last) {
1565     			status |= TD_CTRL_IOC;
1566     			queue_urb (s, urb);
1567     		}
1568     
1569     		fill_td (td, status, destination | (((urb->iso_frame_desc[n].length - 1) & 0x7ff) << 21),
1570     			 urb_priv->transfer_buffer_dma + urb->iso_frame_desc[n].offset);
1571     		list_add_tail (&td->desc_list, &urb_priv->desc_list);
1572     	
1573     		insert_td_horizontal (s, s->iso_td[(urb->start_frame + n) & 1023], td);	// store in iso-tds
1574     	}
1575     
1576     	kfree (tdm);
1577     	dbg("ISO-INT# %i, start %i, now %i", urb->number_of_packets, urb->start_frame, UHCI_GET_CURRENT_FRAME (s) & 1023);
1578     	ret = 0;
1579     
1580           err:
1581     	__restore_flags(flags);
1582     	return ret;
1583     }
1584     /*-------------------------------------------------------------------*/
1585     // returns: 0 (no transfer queued), urb* (this urb already queued)
1586      
1587     _static urb_t* search_dev_ep (uhci_t *s, urb_t *urb)
1588     {
1589     	struct list_head *p;
1590     	urb_t *tmp;
1591     	unsigned int mask = usb_pipecontrol(urb->pipe) ? (~USB_DIR_IN) : (~0);
1592     
1593     	dbg("search_dev_ep:");
1594     
1595     	p=s->urb_list.next;
1596     
1597     	for (; p != &s->urb_list; p = p->next) {
1598     		tmp = list_entry (p, urb_t, urb_list);
1599     		dbg("urb: %p", tmp);
1600     		// we can accept this urb if it is not queued at this time 
1601     		// or if non-iso transfer requests should be scheduled for the same device and pipe
1602     		if ((!usb_pipeisoc(urb->pipe) && (tmp->dev == urb->dev) && !((tmp->pipe ^ urb->pipe) & mask)) ||
1603     		    (urb == tmp)) {
1604     			return tmp;	// found another urb already queued for processing
1605     		}
1606     	}
1607     
1608     	return 0;
1609     }
1610     /*-------------------------------------------------------------------*/
1611     _static int uhci_submit_urb (urb_t *urb)
1612     {
1613     	uhci_t *s;
1614     	urb_priv_t *urb_priv;
1615     	int ret = 0, type;
1616     	unsigned long flags;
1617     	urb_t *queued_urb=NULL;
1618     	int bustime;
1619     		
1620     	if (!urb->dev || !urb->dev->bus)
1621     		return -ENODEV;
1622     
1623     	s = (uhci_t*) urb->dev->bus->hcpriv;
1624     	//dbg("submit_urb: %p type %d",urb,usb_pipetype(urb->pipe));
1625     	
1626     	if (!s->running)
1627     		return -ENODEV;
1628     	
1629     	type = usb_pipetype (urb->pipe);
1630     
1631     	if (usb_pipedevice (urb->pipe) == s->rh.devnum)
1632     		return rh_submit_urb (urb);	/* virtual root hub */
1633     
1634     	// Sanity checks
1635     	if (usb_maxpacket (urb->dev, urb->pipe, usb_pipeout (urb->pipe)) <= 0) {		
1636     		err("uhci_submit_urb: pipesize for pipe %x is zero", urb->pipe);
1637     		return -EMSGSIZE;
1638     	}
1639     
1640     	if (urb->transfer_buffer_length < 0 && type != PIPE_ISOCHRONOUS) {
1641     		err("uhci_submit_urb: Negative transfer length for urb %p", urb);
1642     		return -EINVAL;
1643     	}
1644     
1645     	usb_inc_dev_use (urb->dev);
1646     
1647     	spin_lock_irqsave (&s->urb_list_lock, flags);
1648     
1649     	queued_urb = search_dev_ep (s, urb); // returns already queued urb for that pipe
1650     
1651     	if (queued_urb) {
1652     
1653     		queue_dbg("found bulk urb %p\n", queued_urb);
1654     
1655     		if (( type != PIPE_BULK) ||
1656     		    ((type == PIPE_BULK) &&
1657     		     (!(urb->transfer_flags & USB_QUEUE_BULK) || !(queued_urb->transfer_flags & USB_QUEUE_BULK)))) {
1658     			spin_unlock_irqrestore (&s->urb_list_lock, flags);
1659     			usb_dec_dev_use (urb->dev);
1660     			err("ENXIO %08x, flags %x, urb %p, burb %p",urb->pipe,urb->transfer_flags,urb,queued_urb);
1661     			return -ENXIO;	// urb already queued
1662     		}
1663     	}
1664     
1665     #ifdef DEBUG_SLAB
1666     	urb_priv = kmem_cache_alloc(urb_priv_kmem, SLAB_FLAG);
1667     #else
1668     	urb_priv = kmalloc (sizeof (urb_priv_t), KMALLOC_FLAG);
1669     #endif
1670     	if (!urb_priv) {
1671     		usb_dec_dev_use (urb->dev);
1672     		spin_unlock_irqrestore (&s->urb_list_lock, flags);
1673     		return -ENOMEM;
1674     	}
1675     
1676     	memset(urb_priv, 0, sizeof(urb_priv_t));
1677     	urb->hcpriv = urb_priv;
1678     	INIT_LIST_HEAD (&urb_priv->desc_list);
1679     
1680     	dbg("submit_urb: scheduling %p", urb);
1681     	
1682     	if (type == PIPE_CONTROL)
1683     		urb_priv->setup_packet_dma = pci_map_single(s->uhci_pci, urb->setup_packet,
1684     							    sizeof(devrequest), PCI_DMA_TODEVICE);
1685     
1686     	if (urb->transfer_buffer_length)
1687     		urb_priv->transfer_buffer_dma = pci_map_single(s->uhci_pci,
1688     							       urb->transfer_buffer,
1689     							       urb->transfer_buffer_length,
1690     							       usb_pipein(urb->pipe) ?
1691     							       PCI_DMA_FROMDEVICE :
1692     							       PCI_DMA_TODEVICE);
1693     
1694     	if (type == PIPE_BULK) {
1695     	
1696     		if (queued_urb) {
1697     			while (((urb_priv_t*)queued_urb->hcpriv)->next_queued_urb)  // find last queued bulk
1698     				queued_urb=((urb_priv_t*)queued_urb->hcpriv)->next_queued_urb;
1699     			
1700     			((urb_priv_t*)queued_urb->hcpriv)->next_queued_urb=urb;
1701     		}
1702     		atomic_inc (&s->avoid_bulk);
1703     		ret = uhci_submit_bulk_urb (urb, queued_urb);
1704     		atomic_dec (&s->avoid_bulk);
1705     		spin_unlock_irqrestore (&s->urb_list_lock, flags);
1706     	}
1707     	else {
1708     		spin_unlock_irqrestore (&s->urb_list_lock, flags);
1709     		switch (type) {
1710     		case PIPE_ISOCHRONOUS:			
1711     			if (urb->bandwidth == 0) {      /* not yet checked/allocated */
1712     				if (urb->number_of_packets <= 0) {
1713     					ret = -EINVAL;
1714     					break;
1715     				}
1716     
1717     				bustime = usb_check_bandwidth (urb->dev, urb);
1718     				if (bustime < 0) 
1719     					ret = bustime;
1720     				else {
1721     					ret = uhci_submit_iso_urb(urb);
1722     					if (ret == 0)
1723     						usb_claim_bandwidth (urb->dev, urb, bustime, 1);
1724     				}
1725     			} else {        /* bandwidth is already set */
1726     				ret = uhci_submit_iso_urb(urb);
1727     			}
1728     			break;
1729     		case PIPE_INTERRUPT:
1730     			if (urb->bandwidth == 0) {      /* not yet checked/allocated */
1731     				bustime = usb_check_bandwidth (urb->dev, urb);
1732     				if (bustime < 0)
1733     					ret = bustime;
1734     				else {
1735     					ret = uhci_submit_int_urb(urb);
1736     					if (ret == 0)
1737     						usb_claim_bandwidth (urb->dev, urb, bustime, 0);
1738     				}
1739     			} else {        /* bandwidth is already set */
1740     				ret = uhci_submit_int_urb(urb);
1741     			}
1742     			break;
1743     		case PIPE_CONTROL:
1744     			ret = uhci_submit_control_urb (urb);
1745     			break;
1746     		default:
1747     			ret = -EINVAL;
1748     		}
1749     	}
1750     
1751     	dbg("submit_urb: scheduled with ret: %d", ret);
1752     	
1753     	if (ret != 0) {
1754     		uhci_urb_dma_unmap(s, urb, urb_priv);
1755     		usb_dec_dev_use (urb->dev);
1756     #ifdef DEBUG_SLAB
1757     		kmem_cache_free(urb_priv_kmem, urb_priv);
1758     #else
1759     		kfree (urb_priv);
1760     #endif
1761     		return ret;
1762     	}
1763     
1764     	return 0;
1765     }
1766     
1767     // Checks for URB timeout and removes bandwidth reclamation if URB idles too long
1768     _static void uhci_check_timeouts(uhci_t *s)
1769     {
1770     	struct list_head *p,*p2;
1771     	urb_t *urb;
1772     	int type;	
1773     
1774     	p = s->urb_list.prev;	
1775     
1776     	while (p != &s->urb_list) {
1777     		urb_priv_t *hcpriv;
1778     
1779     		p2 = p;
1780     		p = p->prev;
1781     		urb = list_entry (p2, urb_t, urb_list);
1782     		type = usb_pipetype (urb->pipe);
1783     
1784     		hcpriv = (urb_priv_t*)urb->hcpriv;
1785     				
1786     		if ( urb->timeout && 
1787     			((hcpriv->started + urb->timeout) < jiffies)) {
1788     			urb->transfer_flags |= USB_TIMEOUT_KILLED | USB_ASYNC_UNLINK;
1789     			async_dbg("uhci_check_timeout: timeout for %p",urb);
1790     			uhci_unlink_urb_async(s, urb, UNLINK_ASYNC_STORE_URB);
1791     		}
1792     #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH
1793     		else if (((type == PIPE_BULK) || (type == PIPE_CONTROL)) &&  
1794     		     (hcpriv->use_loop) &&
1795     		     ((hcpriv->started + IDLE_TIMEOUT) < jiffies))
1796     			disable_desc_loop(s, urb);
1797     #endif
1798     
1799     	}
1800     	s->timeout_check=jiffies;
1801     }
1802     
1803     /*-------------------------------------------------------------------
1804      Virtual Root Hub
1805      -------------------------------------------------------------------*/
1806     
1807     _static __u8 root_hub_dev_des[] =
1808     {
1809     	0x12,			/*  __u8  bLength; */
1810     	0x01,			/*  __u8  bDescriptorType; Device */
1811     	0x00,			/*  __u16 bcdUSB; v1.0 */
1812     	0x01,
1813     	0x09,			/*  __u8  bDeviceClass; HUB_CLASSCODE */
1814     	0x00,			/*  __u8  bDeviceSubClass; */
1815     	0x00,			/*  __u8  bDeviceProtocol; */
1816     	0x08,			/*  __u8  bMaxPacketSize0; 8 Bytes */
1817     	0x00,			/*  __u16 idVendor; */
1818     	0x00,
1819     	0x00,			/*  __u16 idProduct; */
1820     	0x00,
1821     	0x00,			/*  __u16 bcdDevice; */
1822     	0x00,
1823     	0x00,			/*  __u8  iManufacturer; */
1824     	0x02,			/*  __u8  iProduct; */
1825     	0x01,			/*  __u8  iSerialNumber; */
1826     	0x01			/*  __u8  bNumConfigurations; */
1827     };
1828     
1829     
1830     /* Configuration descriptor */
1831     _static __u8 root_hub_config_des[] =
1832     {
1833     	0x09,			/*  __u8  bLength; */
1834     	0x02,			/*  __u8  bDescriptorType; Configuration */
1835     	0x19,			/*  __u16 wTotalLength; */
1836     	0x00,
1837     	0x01,			/*  __u8  bNumInterfaces; */
1838     	0x01,			/*  __u8  bConfigurationValue; */
1839     	0x00,			/*  __u8  iConfiguration; */
1840     	0x40,			/*  __u8  bmAttributes; 
1841     				   Bit 7: Bus-powered, 6: Self-powered, 5 Remote-wakwup, 4..0: resvd */
1842     	0x00,			/*  __u8  MaxPower; */
1843     
1844          /* interface */
1845     	0x09,			/*  __u8  if_bLength; */
1846     	0x04,			/*  __u8  if_bDescriptorType; Interface */
1847     	0x00,			/*  __u8  if_bInterfaceNumber; */
1848     	0x00,			/*  __u8  if_bAlternateSetting; */
1849     	0x01,			/*  __u8  if_bNumEndpoints; */
1850     	0x09,			/*  __u8  if_bInterfaceClass; HUB_CLASSCODE */
1851     	0x00,			/*  __u8  if_bInterfaceSubClass; */
1852     	0x00,			/*  __u8  if_bInterfaceProtocol; */
1853     	0x00,			/*  __u8  if_iInterface; */
1854     
1855          /* endpoint */
1856     	0x07,			/*  __u8  ep_bLength; */
1857     	0x05,			/*  __u8  ep_bDescriptorType; Endpoint */
1858     	0x81,			/*  __u8  ep_bEndpointAddress; IN Endpoint 1 */
1859     	0x03,			/*  __u8  ep_bmAttributes; Interrupt */
1860     	0x08,			/*  __u16 ep_wMaxPacketSize; 8 Bytes */
1861     	0x00,
1862     	0xff			/*  __u8  ep_bInterval; 255 ms */
1863     };
1864     
1865     
1866     _static __u8 root_hub_hub_des[] =
1867     {
1868     	0x09,			/*  __u8  bLength; */
1869     	0x29,			/*  __u8  bDescriptorType; Hub-descriptor */
1870     	0x02,			/*  __u8  bNbrPorts; */
1871     	0x00,			/* __u16  wHubCharacteristics; */
1872     	0x00,
1873     	0x01,			/*  __u8  bPwrOn2pwrGood; 2ms */
1874     	0x00,			/*  __u8  bHubContrCurrent; 0 mA */
1875     	0x00,			/*  __u8  DeviceRemovable; *** 7 Ports max *** */
1876     	0xff			/*  __u8  PortPwrCtrlMask; *** 7 ports max *** */
1877     };
1878     
1879     /*-------------------------------------------------------------------------*/
1880     /* prepare Interrupt pipe transaction data; HUB INTERRUPT ENDPOINT */
1881     _static int rh_send_irq (urb_t *urb)
1882     {
1883     	int len = 1;
1884     	int i;
1885     	uhci_t *uhci = urb->dev->bus->hcpriv;
1886     	unsigned int io_addr = uhci->io_addr;
1887     	__u16 data = 0;
1888     
1889     	for (i = 0; i < uhci->rh.numports; i++) {
1890     		data |= ((inw (io_addr + USBPORTSC1 + i * 2) & 0xa) > 0 ? (1 << (i + 1)) : 0);
1891     		len = (i + 1) / 8 + 1;
1892     	}
1893     
1894     	*(__u16 *) urb->transfer_buffer = cpu_to_le16 (data);
1895     	urb->actual_length = len;
1896     	urb->status = 0;
1897     	
1898     	if ((data > 0) && (uhci->rh.send != 0)) {
1899     		dbg("Root-Hub INT complete: port1: %x port2: %x data: %x",
1900     		     inw (io_addr + USBPORTSC1), inw (io_addr + USBPORTSC2), data);
1901     		urb->complete (urb);
1902     	}
1903     	return 0;
1904     }
1905     
1906     /*-------------------------------------------------------------------------*/
1907     /* Virtual Root Hub INTs are polled by this timer every "intervall" ms */
1908     _static int rh_init_int_timer (urb_t *urb);
1909     
1910     _static void rh_int_timer_do (unsigned long ptr)
1911     {
1912     	int len;
1913     	urb_t *urb = (urb_t*) ptr;
1914     	uhci_t *uhci = urb->dev->bus->hcpriv;
1915     
1916     	if (uhci->rh.send) {
1917     		len = rh_send_irq (urb);
1918     		if (len > 0) {
1919     			urb->actual_length = len;
1920     			if (urb->complete)
1921     				urb->complete (urb);
1922     		}
1923     	}
1924     	rh_init_int_timer (urb);
1925     }
1926     
1927     /*-------------------------------------------------------------------------*/
1928     /* Root Hub INTs are polled by this timer, polling interval 20ms */
1929     
1930     _static int rh_init_int_timer (urb_t *urb)
1931     {
1932     	uhci_t *uhci = urb->dev->bus->hcpriv;
1933     
1934     	uhci->rh.interval = urb->interval;
1935     	init_timer (&uhci->rh.rh_int_timer);
1936     	uhci->rh.rh_int_timer.function = rh_int_timer_do;
1937     	uhci->rh.rh_int_timer.data = (unsigned long) urb;
1938     	uhci->rh.rh_int_timer.expires = jiffies + (HZ * 20) / 1000;
1939     	add_timer (&uhci->rh.rh_int_timer);
1940     
1941     	return 0;
1942     }
1943     
1944     /*-------------------------------------------------------------------------*/
1945     #define OK(x) 			len = (x); break
1946     
1947     #define CLR_RH_PORTSTAT(x) \
1948     		status = inw(io_addr+USBPORTSC1+2*(wIndex-1)); \
1949     		status = (status & 0xfff5) & ~(x); \
1950     		outw(status, io_addr+USBPORTSC1+2*(wIndex-1))
1951     
1952     #define SET_RH_PORTSTAT(x) \
1953     		status = inw(io_addr+USBPORTSC1+2*(wIndex-1)); \
1954     		status = (status & 0xfff5) | (x); \
1955     		outw(status, io_addr+USBPORTSC1+2*(wIndex-1))
1956     
1957     
1958     /*-------------------------------------------------------------------------*/
1959     /****
1960      ** Root Hub Control Pipe
1961      *************************/
1962     
1963     
1964     _static int rh_submit_urb (urb_t *urb)
1965     {
1966     	struct usb_device *usb_dev = urb->dev;
1967     	uhci_t *uhci = usb_dev->bus->hcpriv;
1968     	unsigned int pipe = urb->pipe;
1969     	devrequest *cmd = (devrequest *) urb->setup_packet;
1970     	void *data = urb->transfer_buffer;
1971     	int leni = urb->transfer_buffer_length;
1972     	int len = 0;
1973     	int status = 0;
1974     	int stat = 0;
1975     	int i;
1976     	unsigned int io_addr = uhci->io_addr;
1977     	__u16 cstatus;
1978     
1979     	__u16 bmRType_bReq;
1980     	__u16 wValue;
1981     	__u16 wIndex;
1982     	__u16 wLength;
1983     
1984     	if (usb_pipetype (pipe) == PIPE_INTERRUPT) {
1985     		dbg("Root-Hub submit IRQ: every %d ms", urb->interval);
1986     		uhci->rh.urb = urb;
1987     		uhci->rh.send = 1;
1988     		uhci->rh.interval = urb->interval;
1989     		rh_init_int_timer (urb);
1990     
1991     		return 0;
1992     	}
1993     
1994     
1995     	bmRType_bReq = cmd->requesttype | cmd->request << 8;
1996     	wValue = le16_to_cpu (cmd->value);
1997     	wIndex = le16_to_cpu (cmd->index);
1998     	wLength = le16_to_cpu (cmd->length);
1999     
2000     	for (i = 0; i < 8; i++)
2001     		uhci->rh.c_p_r[i] = 0;
2002     
2003     	dbg("Root-Hub: adr: %2x cmd(%1x): %04x %04x %04x %04x",
2004     	     uhci->rh.devnum, 8, bmRType_bReq, wValue, wIndex, wLength);
2005     
2006     	switch (bmRType_bReq) {
2007     		/* Request Destination:
2008     		   without flags: Device, 
2009     		   RH_INTERFACE: interface, 
2010     		   RH_ENDPOINT: endpoint,
2011     		   RH_CLASS means HUB here, 
2012     		   RH_OTHER | RH_CLASS  almost ever means HUB_PORT here 
2013     		 */
2014     
2015     	case RH_GET_STATUS:
2016     		*(__u16 *) data = cpu_to_le16 (1);
2017     		OK (2);
2018     	case RH_GET_STATUS | RH_INTERFACE:
2019     		*(__u16 *) data = cpu_to_le16 (0);
2020     		OK (2);
2021     	case RH_GET_STATUS | RH_ENDPOINT:
2022     		*(__u16 *) data = cpu_to_le16 (0);
2023     		OK (2);
2024     	case RH_GET_STATUS | RH_CLASS:
2025     		*(__u32 *) data = cpu_to_le32 (0);
2026     		OK (4);		/* hub power ** */
2027     	case RH_GET_STATUS | RH_OTHER | RH_CLASS:
2028     		status = inw (io_addr + USBPORTSC1 + 2 * (wIndex - 1));
2029     		cstatus = ((status & USBPORTSC_CSC) >> (1 - 0)) |
2030     			((status & USBPORTSC_PEC) >> (3 - 1)) |
2031     			(uhci->rh.c_p_r[wIndex - 1] << (0 + 4));
2032     		status = (status & USBPORTSC_CCS) |
2033     			((status & USBPORTSC_PE) >> (2 - 1)) |
2034     			((status & USBPORTSC_SUSP) >> (12 - 2)) |
2035     			((status & USBPORTSC_PR) >> (9 - 4)) |
2036     			(1 << 8) |	/* power on ** */
2037     			((status & USBPORTSC_LSDA) << (-8 + 9));
2038     
2039     		*(__u16 *) data = cpu_to_le16 (status);
2040     		*(__u16 *) (data + 2) = cpu_to_le16 (cstatus);
2041     		OK (4);
2042     
2043     	case RH_CLEAR_FEATURE | RH_ENDPOINT:
2044     		switch (wValue) {
2045     		case (RH_ENDPOINT_STALL):
2046     			OK (0);
2047     		}
2048     		break;
2049     
2050     	case RH_CLEAR_FEATURE | RH_CLASS:
2051     		switch (wValue) {
2052     		case (RH_C_HUB_OVER_CURRENT):
2053     			OK (0);	/* hub power over current ** */
2054     		}
2055     		break;
2056     
2057     	case RH_CLEAR_FEATURE | RH_OTHER | RH_CLASS:
2058     		switch (wValue) {
2059     		case (RH_PORT_ENABLE):
2060     			CLR_RH_PORTSTAT (USBPORTSC_PE);
2061     			OK (0);
2062     		case (RH_PORT_SUSPEND):
2063     			CLR_RH_PORTSTAT (USBPORTSC_SUSP);
2064     			OK (0);
2065     		case (RH_PORT_POWER):
2066     			OK (0);	/* port power ** */
2067     		case (RH_C_PORT_CONNECTION):
2068     			SET_RH_PORTSTAT (USBPORTSC_CSC);
2069     			OK (0);
2070     		case (RH_C_PORT_ENABLE):
2071     			SET_RH_PORTSTAT (USBPORTSC_PEC);
2072     			OK (0);
2073     		case (RH_C_PORT_SUSPEND):
2074     /*** WR_RH_PORTSTAT(RH_PS_PSSC); */
2075     			OK (0);
2076     		case (RH_C_PORT_OVER_CURRENT):
2077     			OK (0);	/* port power over current ** */
2078     		case (RH_C_PORT_RESET):
2079     			uhci->rh.c_p_r[wIndex - 1] = 0;
2080     			OK (0);
2081     		}
2082     		break;
2083     
2084     	case RH_SET_FEATURE | RH_OTHER | RH_CLASS:
2085     		switch (wValue) {
2086     		case (RH_PORT_SUSPEND):
2087     			SET_RH_PORTSTAT (USBPORTSC_SUSP);
2088     			OK (0);
2089     		case (RH_PORT_RESET):
2090     			SET_RH_PORTSTAT (USBPORTSC_PR);
2091     			uhci_wait_ms (10);
2092     			uhci->rh.c_p_r[wIndex - 1] = 1;
2093     			CLR_RH_PORTSTAT (USBPORTSC_PR);
2094     			udelay (10);
2095     			SET_RH_PORTSTAT (USBPORTSC_PE);
2096     			uhci_wait_ms (10);
2097     			SET_RH_PORTSTAT (0xa);
2098     			OK (0);
2099     		case (RH_PORT_POWER):
2100     			OK (0);	/* port power ** */
2101     		case (RH_PORT_ENABLE):
2102     			SET_RH_PORTSTAT (USBPORTSC_PE);
2103     			OK (0);
2104     		}
2105     		break;
2106     
2107     	case RH_SET_ADDRESS:
2108     		uhci->rh.devnum = wValue;
2109     		OK (0);
2110     
2111     	case RH_GET_DESCRIPTOR:
2112     		switch ((wValue & 0xff00) >> 8) {
2113     		case (0x01):	/* device descriptor */
2114     			len = min_t(unsigned int, leni,
2115     				  min_t(unsigned int,
2116     				      sizeof (root_hub_dev_des), wLength));
2117     			memcpy (data, root_hub_dev_des, len);
2118     			OK (len);
2119     		case (0x02):	/* configuration descriptor */
2120     			len = min_t(unsigned int, leni,
2121     				  min_t(unsigned int,
2122     				      sizeof (root_hub_config_des), wLength));
2123     			memcpy (data, root_hub_config_des, len);
2124     			OK (len);
2125     		case (0x03):	/* string descriptors */
2126     			len = usb_root_hub_string (wValue & 0xff,
2127     			        uhci->io_addr, "UHCI",
2128     				data, wLength);
2129     			if (len > 0) {
2130     				OK(min_t(int, leni, len));
2131     			} else 
2132     				stat = -EPIPE;
2133     		}
2134     		break;
2135     
2136     	case RH_GET_DESCRIPTOR | RH_CLASS:
2137     		root_hub_hub_des[2] = uhci->rh.numports;
2138     		len = min_t(unsigned int, leni,
2139     			  min_t(unsigned int, sizeof (root_hub_hub_des), wLength));
2140     		memcpy (data, root_hub_hub_des, len);
2141     		OK (len);
2142     
2143     	case RH_GET_CONFIGURATION:
2144     		*(__u8 *) data = 0x01;
2145     		OK (1);
2146     
2147     	case RH_SET_CONFIGURATION:
2148     		OK (0);
2149     	default:
2150     		stat = -EPIPE;
2151     	}
2152     
2153     	dbg("Root-Hub stat port1: %x port2: %x",
2154     	     inw (io_addr + USBPORTSC1), inw (io_addr + USBPORTSC2));
2155     
2156     	urb->actual_length = len;
2157     	urb->status = stat;
2158     	urb->dev=NULL;
2159     	if (urb->complete)
2160     		urb->complete (urb);
2161     	return 0;
2162     }
2163     /*-------------------------------------------------------------------------*/
2164     
2165     _static int rh_unlink_urb (urb_t *urb)
2166     {
2167     	uhci_t *uhci = urb->dev->bus->hcpriv;
2168     
2169     	if (uhci->rh.urb==urb) {
2170     		dbg("Root-Hub unlink IRQ");
2171     		uhci->rh.send = 0;
2172     		del_timer (&uhci->rh.rh_int_timer);
2173     	}
2174     	return 0;
2175     }
2176     /*-------------------------------------------------------------------*/
2177     
2178     /*
2179      * Map status to standard result codes
2180      *
2181      * <status> is (td->status & 0xFE0000) [a.k.a. uhci_status_bits(td->status)
2182      * <dir_out> is True for output TDs and False for input TDs.
2183      */
2184     _static int uhci_map_status (int status, int dir_out)
2185     {
2186     	if (!status)
2187     		return 0;
2188     	if (status & TD_CTRL_BITSTUFF)	/* Bitstuff error */
2189     		return -EPROTO;
2190     	if (status & TD_CTRL_CRCTIMEO) {	/* CRC/Timeout */
2191     		if (dir_out)
2192     			return -ETIMEDOUT;
2193     		else
2194     			return -EILSEQ;
2195     	}
2196     	if (status & TD_CTRL_NAK)	/* NAK */
2197     		return -ETIMEDOUT;
2198     	if (status & TD_CTRL_BABBLE)	/* Babble */
2199     		return -EPIPE;
2200     	if (status & TD_CTRL_DBUFERR)	/* Buffer error */
2201     		return -ENOSR;
2202     	if (status & TD_CTRL_STALLED)	/* Stalled */
2203     		return -EPIPE;
2204     	if (status & TD_CTRL_ACTIVE)	/* Active */
2205     		return 0;
2206     
2207     	return -EPROTO;
2208     }
2209     
2210     /*
2211      * Only the USB core should call uhci_alloc_dev and uhci_free_dev
2212      */
2213     _static int uhci_alloc_dev (struct usb_device *usb_dev)
2214     {
2215     	return 0;
2216     }
2217     
2218     _static void uhci_unlink_urbs(uhci_t *s, struct usb_device *usb_dev, int remove_all)
2219     {
2220     	unsigned long flags;
2221     	struct list_head *p;
2222     	struct list_head *p2;
2223     	urb_t *urb;
2224     
2225     	spin_lock_irqsave (&s->urb_list_lock, flags);
2226     	p = s->urb_list.prev;	
2227     	while (p != &s->urb_list) {
2228     		p2 = p;
2229     		p = p->prev ;
2230     		urb = list_entry (p2, urb_t, urb_list);
2231     		dbg("urb: %p, dev %p, %p", urb, usb_dev,urb->dev);
2232     		
2233     		//urb->transfer_flags |=USB_ASYNC_UNLINK; 
2234     			
2235     		if (remove_all || (usb_dev == urb->dev)) {
2236     			spin_unlock_irqrestore (&s->urb_list_lock, flags);
2237     			warn("forced removing of queued URB %p due to disconnect",urb);
2238     			uhci_unlink_urb(urb);
2239     			urb->dev = NULL; // avoid further processing of this URB
2240     			spin_lock_irqsave (&s->urb_list_lock, flags);
2241     			p = s->urb_list.prev;	
2242     		}
2243     	}
2244     	spin_unlock_irqrestore (&s->urb_list_lock, flags);
2245     }
2246     
2247     _static int uhci_free_dev (struct usb_device *usb_dev)
2248     {
2249     	uhci_t *s;
2250     	
2251     
2252     	if(!usb_dev || !usb_dev->bus || !usb_dev->bus->hcpriv)
2253     		return -EINVAL;
2254     	
2255     	s=(uhci_t*) usb_dev->bus->hcpriv;	
2256     	uhci_unlink_urbs(s, usb_dev, 0);
2257     
2258     	return 0;
2259     }
2260     
2261     /*
2262      * uhci_get_current_frame_number()
2263      *
2264      * returns the current frame number for a USB bus/controller.
2265      */
2266     _static int uhci_get_current_frame_number (struct usb_device *usb_dev)
2267     {
2268     	return UHCI_GET_CURRENT_FRAME ((uhci_t*) usb_dev->bus->hcpriv);
2269     }
2270     
2271     struct usb_operations uhci_device_operations =
2272     {
2273     	uhci_alloc_dev,
2274     	uhci_free_dev,
2275     	uhci_get_current_frame_number,
2276     	uhci_submit_urb,
2277     	uhci_unlink_urb
2278     };
2279     
2280     _static void correct_data_toggles(urb_t *urb)
2281     {
2282     	usb_settoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe), 
2283     		       !usb_gettoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe)));
2284     
2285     	while(urb) {
2286     		urb_priv_t *priv=urb->hcpriv;		
2287     		uhci_desc_t *qh = list_entry (priv->desc_list.next, uhci_desc_t, desc_list);
2288     		struct list_head *p = qh->vertical.next;
2289     		uhci_desc_t *td;
2290     		dbg("URB to correct %p\n", urb);
2291     	
2292     		for (; p != &qh->vertical; p = p->next) {
2293     			td = list_entry (p, uhci_desc_t, vertical);
2294     			td->hw.td.info^=cpu_to_le32(1<<TD_TOKEN_TOGGLE);
2295     		}
2296     		urb=priv->next_queued_urb;
2297     	}
2298     }
2299     
2300     /* 
2301      * For IN-control transfers, process_transfer gets a bit more complicated,
2302      * since there are devices that return less data (eg. strings) than they
2303      * have announced. This leads to a queue abort due to the short packet,
2304      * the status stage is not executed. If this happens, the status stage
2305      * is manually re-executed.
2306      * mode: PROCESS_TRANSFER_REGULAR: regular (unlink QH)
2307      *       PROCESS_TRANSFER_DONT_UNLINK: QHs already unlinked (for async unlink_urb)
2308      */
2309     
2310     _static int process_transfer (uhci_t *s, urb_t *urb, int mode)
2311     {
2312     	int ret = 0;
2313     	urb_priv_t *urb_priv = urb->hcpriv;
2314     	struct list_head *qhl = urb_priv->desc_list.next;
2315     	uhci_desc_t *qh = list_entry (qhl, uhci_desc_t, desc_list);
2316     	struct list_head *p = qh->vertical.next;
2317     	uhci_desc_t *desc= list_entry (urb_priv->desc_list.prev, uhci_desc_t, desc_list);
2318     	uhci_desc_t *last_desc = list_entry (desc->vertical.prev, uhci_desc_t, vertical);
2319     	int data_toggle = usb_gettoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe));	// save initial data_toggle
2320     	int maxlength; 	// extracted and remapped info from TD
2321     	int actual_length;
2322     	int status = 0;
2323     
2324     	//dbg("process_transfer: urb %p, urb_priv %p, qh %p last_desc %p\n",urb,urb_priv, qh, last_desc);
2325     
2326     	/* if the status phase has been retriggered and the
2327     	   queue is empty or the last status-TD is inactive, the retriggered
2328     	   status stage is completed
2329     	 */
2330     
2331     	if (urb_priv->flags && 
2332     	    ((qh->hw.qh.element == cpu_to_le32(UHCI_PTR_TERM)) || !is_td_active(desc)))
2333     		goto transfer_finished;
2334     
2335     	urb->actual_length=0;
2336     
2337     	for (; p != &qh->vertical; p = p->next) {
2338     		desc = list_entry (p, uhci_desc_t, vertical);
2339     
2340     		if (is_td_active(desc)) {	// do not process active TDs
2341     			if (mode == CLEAN_TRANSFER_DELETION_MARK) // if called from async_unlink
2342     				uhci_clean_transfer(s, urb, qh, CLEAN_TRANSFER_DELETION_MARK);
2343     			return ret;
2344     		}
2345     	
2346     		actual_length = uhci_actual_length(le32_to_cpu(desc->hw.td.status));		// extract transfer parameters from TD
2347     		maxlength = (((le32_to_cpu(desc->hw.td.info) >> 21) & 0x7ff) + 1) & 0x7ff;
2348     		status = uhci_map_status (uhci_status_bits (le32_to_cpu(desc->hw.td.status)), usb_pipeout (urb->pipe));
2349     
2350     		if (status == -EPIPE) { 		// see if EP is stalled
2351     			// set up stalled condition
2352     			usb_endpoint_halt (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe));
2353     		}
2354     
2355     		if (status && (status != -EPIPE)) {	// if any error occurred stop processing of further TDs
2356     			// only set ret if status returned an error
2357       is_error:
2358     			ret = status;
2359     			urb->error_count++;
2360     			break;
2361     		}
2362     		else if ((le32_to_cpu(desc->hw.td.info) & 0xff) != USB_PID_SETUP)
2363     			urb->actual_length += actual_length;
2364     
2365     		// got less data than requested
2366     		if ( (actual_length < maxlength)) {
2367     			if (urb->transfer_flags & USB_DISABLE_SPD) {
2368     				status = -EREMOTEIO;	// treat as real error
2369     				dbg("process_transfer: SPD!!");
2370     				break;	// exit after this TD because SP was detected
2371     			}
2372     
2373     			// short read during control-IN: re-start status stage
2374     			if ((usb_pipetype (urb->pipe) == PIPE_CONTROL)) {
2375     				if (uhci_packetid(le32_to_cpu(last_desc->hw.td.info)) == USB_PID_OUT) {
2376     			
2377     					set_qh_element(qh, last_desc->dma_addr);  // re-trigger status stage
2378     					dbg("short packet during control transfer, retrigger status stage @ %p",last_desc);
2379     					urb_priv->flags = 1; // mark as short control packet
2380     					return 0;
2381     				}
2382     			}
2383     			// all other cases: short read is OK
2384     			data_toggle = uhci_toggle (le32_to_cpu(desc->hw.td.info));
2385     			break;
2386     		}
2387     		else if (status)
2388     			goto is_error;
2389     
2390     		data_toggle = uhci_toggle (le32_to_cpu(desc->hw.td.info));
2391     		queue_dbg("process_transfer: len:%d status:%x mapped:%x toggle:%d", actual_length, le32_to_cpu(desc->hw.td.status),status, data_toggle);      
2392     
2393     	}
2394     
2395     	if (usb_pipetype (urb->pipe) == PIPE_BULK ) {  /* toggle correction for short bulk transfers (nonqueued/queued) */
2396     
2397     		urb_priv_t *priv=(urb_priv_t*)urb->hcpriv;
2398     		urb_t *next_queued_urb=priv->next_queued_urb;
2399     
2400     		if (next_queued_urb) {
2401     			urb_priv_t *next_priv=(urb_priv_t*)next_queued_urb->hcpriv;
2402     			uhci_desc_t *qh = list_entry (next_priv->desc_list.next, uhci_desc_t, desc_list);
2403     			uhci_desc_t *first_td=list_entry (qh->vertical.next, uhci_desc_t, vertical);
2404     
2405     			if (data_toggle == uhci_toggle (le32_to_cpu(first_td->hw.td.info))) {
2406     				err("process_transfer: fixed toggle");
2407     				correct_data_toggles(next_queued_urb);
2408     			}						
2409     		}
2410     		else
2411     			usb_settoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe), !data_toggle);		
2412     	}
2413     
2414      transfer_finished:
2415     	
2416     	uhci_clean_transfer(s, urb, qh, mode);
2417     
2418     	urb->status = status;
2419     
2420     #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH	
2421     	disable_desc_loop(s,urb);
2422     #endif	
2423     
2424     	queue_dbg("process_transfer: (end) urb %p, wanted len %d, len %d status %x err %d",
2425     		urb,urb->transfer_buffer_length,urb->actual_length, urb->status, urb->error_count);
2426     	return ret;
2427     }
2428     
2429     _static int process_interrupt (uhci_t *s, urb_t *urb)
2430     {
2431     	int i, ret = -EINPROGRESS;
2432     	urb_priv_t *urb_priv = urb->hcpriv;
2433     	struct list_head *p = urb_priv->desc_list.next;
2434     	uhci_desc_t *desc = list_entry (urb_priv->desc_list.prev, uhci_desc_t, desc_list);
2435     
2436     	int actual_length;
2437     	int status = 0;
2438     
2439     	//dbg("urb contains interrupt request");
2440     
2441     	for (i = 0; p != &urb_priv->desc_list; p = p->next, i++)	// Maybe we allow more than one TD later ;-)
2442     	{
2443     		desc = list_entry (p, uhci_desc_t, desc_list);
2444     
2445     		if (is_td_active(desc)) {
2446     			// do not process active TDs
2447     			//dbg("TD ACT Status @%p %08x",desc,le32_to_cpu(desc->hw.td.status));
2448     			break;
2449     		}
2450     
2451     		if (!desc->hw.td.status & cpu_to_le32(TD_CTRL_IOC)) {
2452     			// do not process one-shot TDs, no recycling
2453     			break;
2454     		}
2455     		// extract transfer parameters from TD
2456     
2457     		actual_length = uhci_actual_length(le32_to_cpu(desc->hw.td.status));
2458     		status = uhci_map_status (uhci_status_bits (le32_to_cpu(desc->hw.td.status)), usb_pipeout (urb->pipe));
2459     
2460     		// see if EP is stalled
2461     		if (status == -EPIPE) {
2462     			// set up stalled condition
2463     			usb_endpoint_halt (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe));
2464     		}
2465     
2466     		// if any error occurred: ignore this td, and continue
2467     		if (status != 0) {
2468     			//uhci_show_td (desc);
2469     			urb->error_count++;
2470     			goto recycle;
2471     		}
2472     		else
2473     			urb->actual_length = actual_length;
2474     
2475     	recycle:
2476     		uhci_urb_dma_sync(s, urb, urb->hcpriv);
2477     		if (urb->complete) {
2478     			//dbg("process_interrupt: calling completion, status %i",status);
2479     			urb->status = status;
2480     			((urb_priv_t*)urb->hcpriv)->flags=1; // if unlink_urb is called during completion
2481     
2482     			spin_unlock(&s->urb_list_lock);
2483     			
2484     			urb->complete ((struct urb *) urb);
2485     			
2486     			spin_lock(&s->urb_list_lock);
2487     
2488     			((urb_priv_t*)urb->hcpriv)->flags=0;		       			
2489     		}
2490     		
2491     		if ((urb->status != -ECONNABORTED) && (urb->status != ECONNRESET) &&
2492     			    (urb->status != -ENOENT)) {
2493     
2494     			urb->status = -EINPROGRESS;
2495     
2496     			// Recycle INT-TD if interval!=0, else mark TD as one-shot
2497     			if (urb->interval) {
2498     				
2499     				desc->hw.td.info &= cpu_to_le32(~(1 << TD_TOKEN_TOGGLE));
2500     				if (status==0) {
2501     					((urb_priv_t*)urb->hcpriv)->started=jiffies;
2502     					desc->hw.td.info |= cpu_to_le32((usb_gettoggle (urb->dev, usb_pipeendpoint (urb->pipe),
2503     									    usb_pipeout (urb->pipe)) << TD_TOKEN_TOGGLE));
2504     					usb_dotoggle (urb->dev, usb_pipeendpoint (urb->pipe), usb_pipeout (urb->pipe));
2505     				} else {
2506     					desc->hw.td.info |= cpu_to_le32((!usb_gettoggle (urb->dev, usb_pipeendpoint (urb->pipe),
2507     									     usb_pipeout (urb->pipe)) << TD_TOKEN_TOGGLE));
2508     				}
2509     				desc->hw.td.status= cpu_to_le32((urb->pipe & TD_CTRL_LS) | TD_CTRL_ACTIVE | TD_CTRL_IOC |
2510     					(urb->transfer_flags & USB_DISABLE_SPD ? 0 : TD_CTRL_SPD) | (3 << 27));
2511     				mb();
2512     			}
2513     			else {
2514     				uhci_unlink_urb_async(s, urb, UNLINK_ASYNC_STORE_URB);
2515     				clr_td_ioc(desc); // inactivate TD
2516     			}
2517     		}
2518     	}
2519     
2520     	return ret;
2521     }
2522     
2523     // mode: PROCESS_ISO_REGULAR: processing only for done TDs, unlink TDs
2524     // mode: PROCESS_ISO_FORCE: force processing, don't unlink TDs (already unlinked)
2525     
2526     _static int process_iso (uhci_t *s, urb_t *urb, int mode)
2527     {
2528     	int i;
2529     	int ret = 0;
2530     	urb_priv_t *urb_priv = urb->hcpriv;
2531     	struct list_head *p = urb_priv->desc_list.next;
2532     	uhci_desc_t *desc = list_entry (urb_priv->desc_list.prev, uhci_desc_t, desc_list);
2533     
2534     	dbg("urb contains iso request");
2535     	if (is_td_active(desc) && mode==PROCESS_ISO_REGULAR)
2536     		return -EXDEV;	// last TD not finished
2537     
2538     	urb->error_count = 0;
2539     	urb->actual_length = 0;
2540     	urb->status = 0;
2541     	dbg("process iso urb %p, %li, %i, %i, %i %08x",urb,jiffies,UHCI_GET_CURRENT_FRAME(s),
2542     	    urb->number_of_packets,mode,le32_to_cpu(desc->hw.td.status));
2543     
2544     	for (i = 0; p != &urb_priv->desc_list;  i++) {
2545     		desc = list_entry (p, uhci_desc_t, desc_list);
2546     		
2547     		//uhci_show_td(desc);
2548     		if (is_td_active(desc)) {
2549     			// means we have completed the last TD, but not the TDs before
2550     			desc->hw.td.status &= cpu_to_le32(~TD_CTRL_ACTIVE);
2551     			dbg("TD still active (%x)- grrr. paranoia!", le32_to_cpu(desc->hw.td.status));
2552     			ret = -EXDEV;
2553     			urb->iso_frame_desc[i].status = ret;
2554     			unlink_td (s, desc, 1);
2555     			// FIXME: immediate deletion may be dangerous
2556     			goto err;
2557     		}
2558     
2559     		if (mode == PROCESS_ISO_REGULAR)
2560     			unlink_td (s, desc, 1);
2561     
2562     		if (urb->number_of_packets <= i) {
2563     			dbg("urb->number_of_packets (%d)<=(%d)", urb->number_of_packets, i);
2564     			ret = -EINVAL;
2565     			goto err;
2566     		}
2567     
2568     		urb->iso_frame_desc[i].actual_length = uhci_actual_length(le32_to_cpu(desc->hw.td.status));
2569     		urb->iso_frame_desc[i].status = uhci_map_status (uhci_status_bits (le32_to_cpu(desc->hw.td.status)), usb_pipeout (urb->pipe));
2570     		urb->actual_length += urb->iso_frame_desc[i].actual_length;
2571     
2572     	      err:
2573     
2574     		if (urb->iso_frame_desc[i].status != 0) {
2575     			urb->error_count++;
2576     			urb->status = urb->iso_frame_desc[i].status;
2577     		}
2578     		dbg("process_iso: %i: len:%d %08x status:%x",
2579     		     i, urb->iso_frame_desc[i].actual_length, le32_to_cpu(desc->hw.td.status),urb->iso_frame_desc[i].status);
2580     
2581     		list_del (p);
2582     		p = p->next;
2583     		delete_desc (s, desc);
2584     	}
2585     	
2586     	dbg("process_iso: exit %i (%d), actual_len %i", i, ret,urb->actual_length);
2587     	return ret;
2588     }
2589     
2590     
2591     _static int process_urb (uhci_t *s, struct list_head *p)
2592     {
2593     	int ret = 0;
2594     	urb_t *urb;
2595     
2596     	urb=list_entry (p, urb_t, urb_list);
2597     	//dbg("process_urb: found queued urb: %p", urb);
2598     
2599     	switch (usb_pipetype (urb->pipe)) {
2600     	case PIPE_CONTROL:
2601     		ret = process_transfer (s, urb, CLEAN_TRANSFER_REGULAR);
2602     		break;
2603     	case PIPE_BULK:
2604     		if (!s->avoid_bulk.counter)
2605     			ret = process_transfer (s, urb, CLEAN_TRANSFER_REGULAR);
2606     		else
2607     			return 0;
2608     		break;
2609     	case PIPE_ISOCHRONOUS:
2610     		ret = process_iso (s, urb, PROCESS_ISO_REGULAR);
2611     		break;
2612     	case PIPE_INTERRUPT:
2613     		ret = process_interrupt (s, urb);
2614     		break;
2615     	}
2616     
2617     	if (urb->status != -EINPROGRESS) {
2618     		urb_priv_t *urb_priv;
2619     		struct usb_device *usb_dev;
2620     		
2621     		usb_dev=urb->dev;
2622     
2623     		/* Release bandwidth for Interrupt or Iso transfers */
2624     		if (urb->bandwidth) {
2625     			if (usb_pipetype(urb->pipe)==PIPE_ISOCHRONOUS)
2626     				usb_release_bandwidth (urb->dev, urb, 1);
2627     			else if (usb_pipetype(urb->pipe)==PIPE_INTERRUPT && urb->interval)
2628     				usb_release_bandwidth (urb->dev, urb, 0);
2629     		}
2630     
2631     		dbg("dequeued urb: %p", urb);
2632     		dequeue_urb (s, urb);
2633     
2634     		urb_priv = urb->hcpriv;
2635     
2636     		uhci_urb_dma_unmap(s, urb, urb_priv);
2637     
2638     #ifdef DEBUG_SLAB
2639     		kmem_cache_free(urb_priv_kmem, urb_priv);
2640     #else
2641     		kfree (urb_priv);
2642     #endif
2643     
2644     		if ((usb_pipetype (urb->pipe) != PIPE_INTERRUPT)) {  // process_interrupt does completion on its own		
2645     			urb_t *next_urb = urb->next;
2646     			int is_ring = 0;
2647     			int contains_killed = 0;
2648     			int loop_count=0;
2649     			
2650     			if (next_urb) {
2651     				// Find out if the URBs are linked to a ring
2652     				while  (next_urb != NULL && next_urb != urb && loop_count < MAX_NEXT_COUNT) {
2653     					if (next_urb->status == -ENOENT) {// killed URBs break ring structure & resubmission
2654     						contains_killed = 1;
2655     						break;
2656     					}	
2657     					next_urb = next_urb->next;
2658     					loop_count++;
2659     				}
2660     				
2661     				if (loop_count == MAX_NEXT_COUNT)
2662     					err("process_urb: Too much linked URBs in ring detection!");
2663     
2664     				if (next_urb == urb)
2665     					is_ring=1;
2666     			}			
2667     
2668     			// Submit idle/non-killed URBs linked with urb->next
2669     			// Stop before the current URB				
2670     			
2671     			next_urb = urb->next;	
2672     			if (next_urb && !contains_killed) {
2673     				int ret_submit;
2674     				next_urb = urb->next;	
2675     				
2676     				loop_count=0;
2677     				while (next_urb != NULL && next_urb != urb && loop_count < MAX_NEXT_COUNT) {
2678     					if (next_urb->status != -EINPROGRESS) {
2679     					
2680     						if (next_urb->status == -ENOENT) 
2681     							break;
2682     
2683     						spin_unlock(&s->urb_list_lock);
2684     
2685     						ret_submit=uhci_submit_urb(next_urb);
2686     						spin_lock(&s->urb_list_lock);
2687     						
2688     						if (ret_submit)
2689     							break;						
2690     					}
2691     					loop_count++;
2692     					next_urb = next_urb->next;
2693     				}
2694     				if (loop_count == MAX_NEXT_COUNT)
2695     					err("process_urb: Too much linked URBs in resubmission!");
2696     			}
2697     
2698     			// Completion
2699     			if (urb->complete) {
2700     				int was_unlinked = (urb->status == -ENOENT);
2701     				urb->dev = NULL;
2702     				spin_unlock(&s->urb_list_lock);
2703     
2704     				urb->complete ((struct urb *) urb);
2705     
2706     				// Re-submit the URB if ring-linked
2707     				if (is_ring && !was_unlinked && !contains_killed) {
2708     					urb->dev=usb_dev;
2709     					uhci_submit_urb (urb);
2710     				}
2711     				spin_lock(&s->urb_list_lock);
2712     			}
2713     			
2714     			usb_dec_dev_use (usb_dev);
2715     		}
2716     	}
2717     
2718     	return ret;
2719     }
2720     
2721     _static void uhci_interrupt (int irq, void *__uhci, struct pt_regs *regs)
2722     {
2723     	uhci_t *s = __uhci;
2724     	unsigned int io_addr = s->io_addr;
2725     	unsigned short status;
2726     	struct list_head *p, *p2;
2727     	int restarts, work_done;
2728     	
2729     	/*
2730     	 * Read the interrupt status, and write it back to clear the
2731     	 * interrupt cause
2732     	 */
2733     
2734     	status = inw (io_addr + USBSTS);
2735     
2736     	if (!status)		/* shared interrupt, not mine */
2737     		return;
2738     
2739     	dbg("interrupt");
2740     
2741     	if (status != 1) {
2742     		// Avoid too much error messages at a time
2743     		if ((jiffies - s->last_error_time > ERROR_SUPPRESSION_TIME)) {
2744     			warn("interrupt, status %x, frame# %i", status, 
2745     			     UHCI_GET_CURRENT_FRAME(s));
2746     			s->last_error_time = jiffies;
2747     		}
2748     		
2749     		// remove host controller halted state
2750     		if ((status&0x20) && (s->running)) {
2751     			err("Host controller halted, trying to restart.");
2752     			outw (USBCMD_RS | inw(io_addr + USBCMD), io_addr + USBCMD);
2753     		}
2754     		//uhci_show_status (s);
2755     	}
2756     	/*
2757     	 * traverse the list in *reverse* direction, because new entries
2758     	 * may be added at the end.
2759     	 * also, because process_urb may unlink the current urb,
2760     	 * we need to advance the list before
2761     	 * New: check for max. workload and restart count
2762     	 */
2763     
2764     	spin_lock (&s->urb_list_lock);
2765     
2766     	restarts=0;
2767     	work_done=0;
2768     
2769     restart:
2770     	s->unlink_urb_done=0;
2771     	p = s->urb_list.prev;	
2772     
2773     	while (p != &s->urb_list && (work_done < 1024)) {
2774     		p2 = p;
2775     		p = p->prev;
2776     
2777     		process_urb (s, p2);
2778     		
2779     		work_done++;
2780     
2781     		if (s->unlink_urb_done) {
2782     			s->unlink_urb_done=0;
2783     			restarts++;
2784     			
2785     			if (restarts<16)	// avoid endless restarts
2786     				goto restart;
2787     			else 
2788     				break;
2789     		}
2790     	}
2791     	if ((jiffies - s->timeout_check) > (HZ/30)) 
2792     		uhci_check_timeouts(s);
2793     
2794     	clean_descs(s, CLEAN_NOT_FORCED);
2795     	uhci_cleanup_unlink(s, CLEAN_NOT_FORCED);
2796     	uhci_switch_timer_int(s);
2797     							
2798     	spin_unlock (&s->urb_list_lock);
2799     	
2800     	outw (status, io_addr + USBSTS);
2801     
2802     	//dbg("uhci_interrupt: done");
2803     }
2804     
2805     _static void reset_hc (uhci_t *s)
2806     {
2807     	unsigned int io_addr = s->io_addr;
2808     
2809     	s->apm_state = 0;
2810     	/* Global reset for 50ms */
2811     	outw (USBCMD_GRESET, io_addr + USBCMD);
2812     	uhci_wait_ms (50);
2813     	outw (0, io_addr + USBCMD);
2814     	uhci_wait_ms (10);
2815     }
2816     
2817     _static void start_hc (uhci_t *s)
2818     {
2819     	unsigned int io_addr = s->io_addr;
2820     	int timeout = 1000;
2821     
2822     	/*
2823     	 * Reset the HC - this will force us to get a
2824     	 * new notification of any already connected
2825     	 * ports due to the virtual disconnect that it
2826     	 * implies.
2827     	 */
2828     	outw (USBCMD_HCRESET, io_addr + USBCMD);
2829     
2830     	while (inw (io_addr + USBCMD) & USBCMD_HCRESET) {
2831     		if (!--timeout) {
2832     			err("USBCMD_HCRESET timed out!");
2833     			break;
2834     		}
2835     	}
2836     
2837     	/* Turn on all interrupts */
2838     	outw (USBINTR_TIMEOUT | USBINTR_RESUME | USBINTR_IOC | USBINTR_SP, io_addr + USBINTR);
2839     
2840     	/* Start at frame 0 */
2841     	outw (0, io_addr + USBFRNUM);
2842     	outl (s->framelist_dma, io_addr + USBFLBASEADD);
2843     
2844     	/* Run and mark it configured with a 64-byte max packet */
2845     	outw (USBCMD_RS | USBCMD_CF | USBCMD_MAXP, io_addr + USBCMD);
2846     	s->apm_state = 1;
2847     	s->running = 1;
2848     }
2849     
2850     _static void __devexit
2851     uhci_pci_remove (struct pci_dev *dev)
2852     {
2853     	uhci_t *s = (uhci_t*) dev->driver_data;
2854     	struct usb_device *root_hub = s->bus->root_hub;
2855     
2856     	s->running = 0;		    // Don't allow submit_urb
2857     
2858     	if (root_hub)
2859     		usb_disconnect (&root_hub);
2860     
2861     	reset_hc (s);
2862     	wait_ms (1);
2863     
2864     	uhci_unlink_urbs (s, 0, CLEAN_FORCED);  // Forced unlink of remaining URBs
2865     	uhci_cleanup_unlink (s, CLEAN_FORCED);  // force cleanup of async killed URBs
2866     	
2867     	usb_deregister_bus (s->bus);
2868     
2869     	release_region (s->io_addr, s->io_size);
2870     	free_irq (s->irq, s);
2871     	usb_free_bus (s->bus);
2872     	cleanup_skel (s);
2873     	kfree (s);
2874     }
2875     
2876     _static int __init uhci_start_usb (uhci_t *s)
2877     {				/* start it up */
2878     	/* connect the virtual root hub */
2879     	struct usb_device *usb_dev;
2880     
2881     	usb_dev = usb_alloc_dev (NULL, s->bus);
2882     	if (!usb_dev)
2883     		return -1;
2884     
2885     	s->bus->root_hub = usb_dev;
2886     	usb_connect (usb_dev);
2887     
2888     	if (usb_new_device (usb_dev) != 0) {
2889     		usb_free_dev (usb_dev);
2890     		return -1;
2891     	}
2892     
2893     	return 0;
2894     }
2895     
2896     #ifdef CONFIG_PM
2897     _static int
2898     uhci_pci_suspend (struct pci_dev *dev, u32 state)
2899     {
2900     	reset_hc((uhci_t *) dev->driver_data);
2901     	return 0;
2902     }
2903     
2904     _static int
2905     uhci_pci_resume (struct pci_dev *dev)
2906     {
2907     	start_hc((uhci_t *) dev->driver_data);
2908     	return 0;
2909     }
2910     #endif
2911     
2912     _static int __devinit alloc_uhci (struct pci_dev *dev, int irq, unsigned int io_addr, unsigned int io_size)
2913     {
2914     	uhci_t *s;
2915     	struct usb_bus *bus;
2916     	char buf[8], *bufp = buf;
2917     
2918     #ifndef __sparc__
2919     	sprintf(buf, "%d", irq);
2920     #else
2921     	bufp = __irq_itoa(irq);
2922     #endif
2923     	printk(KERN_INFO __FILE__ ": USB UHCI at I/O 0x%x, IRQ %s\n",
2924     		io_addr, bufp);
2925     
2926     	s = kmalloc (sizeof (uhci_t), GFP_KERNEL);
2927     	if (!s)
2928     		return -1;
2929     
2930     	memset (s, 0, sizeof (uhci_t));
2931     	INIT_LIST_HEAD (&s->free_desc);
2932     	INIT_LIST_HEAD (&s->urb_list);
2933     	INIT_LIST_HEAD (&s->urb_unlinked);
2934     	spin_lock_init (&s->urb_list_lock);
2935     	spin_lock_init (&s->qh_lock);
2936     	spin_lock_init (&s->td_lock);
2937     	atomic_set(&s->avoid_bulk, 0);
2938     	s->irq = -1;
2939     	s->io_addr = io_addr;
2940     	s->io_size = io_size;
2941     	s->uhci_pci=dev;
2942     
2943     	bus = usb_alloc_bus (&uhci_device_operations);
2944     	if (!bus) {
2945     		kfree (s);
2946     		return -1;
2947     	}
2948     
2949     	s->bus = bus;
2950     	bus->hcpriv = s;
2951     
2952     	/* UHCI specs says devices must have 2 ports, but goes on to say */
2953     	/* they may have more but give no way to determine how many they */
2954     	/* have, so default to 2 */
2955     	/* According to the UHCI spec, Bit 7 is always set to 1. So we try */
2956     	/* to use this to our advantage */
2957     
2958     	for (s->maxports = 0; s->maxports < (io_size - 0x10) / 2; s->maxports++) {
2959     		unsigned int portstatus;
2960     
2961     		portstatus = inw (io_addr + 0x10 + (s->maxports * 2));
2962     		dbg("port %i, adr %x status %x", s->maxports,
2963     			io_addr + 0x10 + (s->maxports * 2), portstatus);
2964     		if (!(portstatus & 0x0080))
2965     			break;
2966     	}
2967     	warn("Detected %d ports", s->maxports);
2968     
2969     	/* This is experimental so anything less than 2 or greater than 8 is */
2970     	/*  something weird and we'll ignore it */
2971     	if (s->maxports < 2 || s->maxports > 8) {
2972     		dbg("Port count misdetected, forcing to 2 ports");
2973     		s->maxports = 2;
2974     	}
2975     
2976     	s->rh.numports = s->maxports;
2977     	s->loop_usage=0;
2978     	if (init_skel (s)) {
2979     		usb_free_bus (bus);
2980     		kfree(s);
2981     		return -1;
2982     	}
2983     
2984     	request_region (s->io_addr, io_size, MODNAME);
2985     	reset_hc (s);
2986     	usb_register_bus (s->bus);
2987     
2988     	start_hc (s);
2989     
2990     	if (request_irq (irq, uhci_interrupt, SA_SHIRQ, MODNAME, s)) {
2991     		err("request_irq %d failed!",irq);
2992     		usb_free_bus (bus);
2993     		reset_hc (s);
2994     		release_region (s->io_addr, s->io_size);
2995     		cleanup_skel(s);
2996     		kfree(s);
2997     		return -1;
2998     	}
2999     
3000     	/* Enable PIRQ */
3001     	pci_write_config_word (dev, USBLEGSUP, USBLEGSUP_DEFAULT);
3002     
3003     	s->irq = irq;
3004     
3005     	if(uhci_start_usb (s) < 0) {
3006     		uhci_pci_remove(dev);
3007     		return -1;
3008     	}
3009     
3010     	//chain new uhci device into global list
3011     	dev->driver_data = s;
3012     	devs=s;
3013     
3014     	return 0;
3015     }
3016     
3017     _static int __devinit
3018     uhci_pci_probe (struct pci_dev *dev, const struct pci_device_id *id)
3019     {
3020     	int i;
3021     
3022     	if (pci_enable_device(dev) < 0)
3023     		return -ENODEV;
3024     		
3025     	if (!dev->irq) {
3026     		err("found UHCI device with no IRQ assigned. check BIOS settings!");
3027     		return -ENODEV;
3028     	}
3029     	
3030     	pci_set_master(dev);
3031     
3032     	/* Search for the IO base address.. */
3033     	for (i = 0; i < 6; i++) {
3034     
3035     		unsigned int io_addr = pci_resource_start(dev, i);
3036     		unsigned int io_size = pci_resource_len(dev, i);
3037     		if (!(pci_resource_flags(dev,i) & IORESOURCE_IO))
3038     			continue;
3039     
3040     		/* Is it already in use? */
3041     		if (check_region (io_addr, io_size))
3042     			break;
3043     		/* disable legacy emulation */
3044     		pci_write_config_word (dev, USBLEGSUP, 0);
3045     	
3046     		return alloc_uhci(dev, dev->irq, io_addr, io_size);
3047     	}
3048     	return -ENODEV;
3049     }
3050     
3051     /*-------------------------------------------------------------------------*/
3052     
3053     static const struct pci_device_id __devinitdata uhci_pci_ids [] = { {
3054     
3055     	/* handle any USB UHCI controller */
3056     	class: 		((PCI_CLASS_SERIAL_USB << 8) | 0x00),
3057     	class_mask: 	~0,
3058     
3059     	/* no matter who makes it */
3060     	vendor:		PCI_ANY_ID,
3061     	device:		PCI_ANY_ID,
3062     	subvendor:	PCI_ANY_ID,
3063     	subdevice:	PCI_ANY_ID,
3064     
3065     	}, { /* end: all zeroes */ }
3066     };
3067     
3068     MODULE_DEVICE_TABLE (pci, uhci_pci_ids);
3069     
3070     static struct pci_driver uhci_pci_driver = {
3071     	name:		"usb-uhci",
3072     	id_table:	&uhci_pci_ids [0],
3073     
3074     	probe:		uhci_pci_probe,
3075     	remove:		uhci_pci_remove,
3076     
3077     #ifdef	CONFIG_PM
3078     	suspend:	uhci_pci_suspend,
3079     	resume:		uhci_pci_resume,
3080     #endif	/* PM */
3081     
3082     };
3083     
3084     /*-------------------------------------------------------------------------*/
3085     
3086     static int __init uhci_hcd_init (void) 
3087     {
3088     	int retval;
3089     
3090     #ifdef DEBUG_SLAB
3091     	urb_priv_kmem = kmem_cache_create("urb_priv", sizeof(urb_priv_t), 0, SLAB_HWCACHE_ALIGN, NULL, NULL);
3092     	
3093     	if(!urb_priv_kmem) {
3094     		err("kmem_cache_create for urb_priv_t failed (out of memory)");
3095     		return -ENOMEM;
3096     	}
3097     #endif	
3098     	info(VERSTR);
3099     
3100     #ifdef CONFIG_USB_UHCI_HIGH_BANDWIDTH
3101     	info("High bandwidth mode enabled");	
3102     #endif
3103     
3104     	retval = pci_module_init (&uhci_pci_driver);
3105     
3106     #ifdef DEBUG_SLAB
3107     	if (retval < 0 ) {
3108     		if (kmem_cache_destroy(urb_priv_kmem))
3109     			err("urb_priv_kmem remained");
3110     	}
3111     #endif
3112     	
3113     	info(DRIVER_VERSION ":" DRIVER_DESC);
3114     
3115     	return retval;
3116     }
3117     
3118     static void __exit uhci_hcd_cleanup (void) 
3119     {      
3120     	pci_unregister_driver (&uhci_pci_driver);
3121     	
3122     #ifdef DEBUG_SLAB
3123     	if(kmem_cache_destroy(urb_priv_kmem))
3124     		err("urb_priv_kmem remained");
3125     #endif
3126     }
3127     
3128     module_init (uhci_hcd_init);
3129     module_exit (uhci_hcd_cleanup);
3130     
3131     
3132     MODULE_AUTHOR( DRIVER_AUTHOR );
3133     MODULE_DESCRIPTION( DRIVER_DESC );
3134     
3135