drivers/usb/host/uhci-q.c

   1 /*
   2  * Universal Host Controller Interface driver for USB.
   3  *
   4  * Maintainer: Alan Stern <stern@rowland.harvard.edu>
   5  *
   6  * (C) Copyright 1999 Linus Torvalds
   7  * (C) Copyright 1999-2002 Johannes Erdfelt, johannes@erdfelt.com
   8  * (C) Copyright 1999 Randy Dunlap
   9  * (C) Copyright 1999 Georg Acher, acher@in.tum.de
  10  * (C) Copyright 1999 Deti Fliegl, deti@fliegl.de
  11  * (C) Copyright 1999 Thomas Sailer, sailer@ife.ee.ethz.ch
  12  * (C) Copyright 1999 Roman Weissgaerber, weissg@vienna.at
  13  * (C) Copyright 2000 Yggdrasil Computing, Inc. (port of new PCI interface
  14  *               support from usb-ohci.c by Adam Richter, adam@yggdrasil.com).
  15  * (C) Copyright 1999 Gregory P. Smith (from usb-ohci.c)
  16  * (C) Copyright 2004-2006 Alan Stern, stern@rowland.harvard.edu
  17  */
  18
  19
  20 /*
  21  * Technically, updating td->status here is a race, but it's not really a
  22  * problem. The worst that can happen is that we set the IOC bit again
  23  * generating a spurious interrupt. We could fix this by creating another
  24  * QH and leaving the IOC bit always set, but then we would have to play
  25  * games with the FSBR code to make sure we get the correct order in all
  26  * the cases. I don't think it's worth the effort
  27  */
  28 static void uhci_set_next_interrupt(struct uhci_hcd *uhci)
  29 {
  30         if (uhci->is_stopped)
  31                 mod_timer(&uhci_to_hcd(uhci)->rh_timer, jiffies);
  32         uhci->term_td->status |= cpu_to_le32(TD_CTRL_IOC);
  33 }
  34
  35 static inline void uhci_clear_next_interrupt(struct uhci_hcd *uhci)
  36 {
  37         uhci->term_td->status &= ~cpu_to_le32(TD_CTRL_IOC);
  38 }
  39
  40
  41 /*
  42  * Full-Speed Bandwidth Reclamation (FSBR).
  43  * We turn on FSBR whenever a queue that wants it is advancing,
  44  * and leave it on for a short time thereafter.
  45  */
  46 static void uhci_fsbr_on(struct uhci_hcd *uhci)
  47 {
  48         uhci->fsbr_is_on = 1;
  49         uhci->skel_term_qh->link = cpu_to_le32(
  50                         uhci->skel_fs_control_qh->dma_handle) | UHCI_PTR_QH;
  51 }
  52
  53 static void uhci_fsbr_off(struct uhci_hcd *uhci)
  54 {
  55         uhci->fsbr_is_on = 0;
  56         uhci->skel_term_qh->link = UHCI_PTR_TERM;
  57 }
  58
  59 static void uhci_add_fsbr(struct uhci_hcd *uhci, struct urb *urb)
  60 {
  61         struct urb_priv *urbp = urb->hcpriv;
  62
  63         if (!(urb->transfer_flags & URB_NO_FSBR))
  64                 urbp->fsbr = 1;
  65 }
  66
  67 static void uhci_urbp_wants_fsbr(struct uhci_hcd *uhci, struct urb_priv *urbp)
  68 {
  69         if (urbp->fsbr) {
  70                 uhci->fsbr_is_wanted = 1;
  71                 if (!uhci->fsbr_is_on)
  72                         uhci_fsbr_on(uhci);
  73                 else if (uhci->fsbr_expiring) {
  74                         uhci->fsbr_expiring = 0;
  75                         del_timer(&uhci->fsbr_timer);
  76                 }
  77         }
  78 }
  79
  80 static void uhci_fsbr_timeout(unsigned long _uhci)
  81 {
  82         struct uhci_hcd *uhci = (struct uhci_hcd *) _uhci;
  83         unsigned long flags;
  84
  85         spin_lock_irqsave(&uhci->lock, flags);
  86         if (uhci->fsbr_expiring) {
  87                 uhci->fsbr_expiring = 0;
  88                 uhci_fsbr_off(uhci);
  89         }
  90         spin_unlock_irqrestore(&uhci->lock, flags);
  91 }
  92
  93
  94 static struct uhci_td *uhci_alloc_td(struct uhci_hcd *uhci)
  95 {
  96         dma_addr_t dma_handle;
  97         struct uhci_td *td;
  98
  99         td = dma_pool_alloc(uhci->td_pool, GFP_ATOMIC, &dma_handle);
 100         if (!td)
 101                 return NULL;
 102
 103         td->dma_handle = dma_handle;
 104         td->frame = -1;
 105
 106         INIT_LIST_HEAD(&td->list);
 107         INIT_LIST_HEAD(&td->fl_list);
 108
 109         return td;
 110 }
 111
 112 static void uhci_free_td(struct uhci_hcd *uhci, struct uhci_td *td)
 113 {
 114         if (!list_empty(&td->list))
 115                 dev_warn(uhci_dev(uhci), "td %p still in list!\n", td);
 116         if (!list_empty(&td->fl_list))
 117                 dev_warn(uhci_dev(uhci), "td %p still in fl_list!\n", td);
 118
 119         dma_pool_free(uhci->td_pool, td, td->dma_handle);
 120 }
 121
 122 static inline void uhci_fill_td(struct uhci_td *td, u32 status,
 123                 u32 token, u32 buffer)
 124 {
 125         td->status = cpu_to_le32(status);
 126         td->token = cpu_to_le32(token);
 127         td->buffer = cpu_to_le32(buffer);
 128 }
 129
 130 static void uhci_add_td_to_urbp(struct uhci_td *td, struct urb_priv *urbp)
 131 {
 132         list_add_tail(&td->list, &urbp->td_list);
 133 }
 134
 135 static void uhci_remove_td_from_urbp(struct uhci_td *td)
 136 {
 137         list_del_init(&td->list);
 138 }
 139
 140 /*
 141  * We insert Isochronous URBs directly into the frame list at the beginning
 142  */
 143 static inline void uhci_insert_td_in_frame_list(struct uhci_hcd *uhci,
 144                 struct uhci_td *td, unsigned framenum)
 145 {
 146         framenum &= (UHCI_NUMFRAMES - 1);
 147
 148         td->frame = framenum;
 149
 150         /* Is there a TD already mapped there? */
 151         if (uhci->frame_cpu[framenum]) {
 152                 struct uhci_td *ftd, *ltd;
 153
 154                 ftd = uhci->frame_cpu[framenum];
 155                 ltd = list_entry(ftd->fl_list.prev, struct uhci_td, fl_list);
 156
 157                 list_add_tail(&td->fl_list, &ftd->fl_list);
 158
 159                 td->link = ltd->link;
 160                 wmb();
 161                 ltd->link = cpu_to_le32(td->dma_handle);
 162         } else {
 163                 td->link = uhci->frame[framenum];
 164                 wmb();
 165                 uhci->frame[framenum] = cpu_to_le32(td->dma_handle);
 166                 uhci->frame_cpu[framenum] = td;
 167         }
 168 }
 169
 170 static inline void uhci_remove_td_from_frame_list(struct uhci_hcd *uhci,
 171                 struct uhci_td *td)
 172 {
 173         /* If it's not inserted, don't remove it */
 174         if (td->frame == -1) {
 175                 WARN_ON(!list_empty(&td->fl_list));
 176                 return;
 177         }
 178
 179         if (uhci->frame_cpu[td->frame] == td) {
 180                 if (list_empty(&td->fl_list)) {
 181                         uhci->frame[td->frame] = td->link;
 182                         uhci->frame_cpu[td->frame] = NULL;
 183                 } else {
 184                         struct uhci_td *ntd;
 185
 186                         ntd = list_entry(td->fl_list.next, struct uhci_td, fl_list);
 187                         uhci->frame[td->frame] = cpu_to_le32(ntd->dma_handle);
 188                         uhci->frame_cpu[td->frame] = ntd;
 189                 }
 190         } else {
 191                 struct uhci_td *ptd;
 192
 193                 ptd = list_entry(td->fl_list.prev, struct uhci_td, fl_list);
 194                 ptd->link = td->link;
 195         }
 196
 197         list_del_init(&td->fl_list);
 198         td->frame = -1;
 199 }
 200
 201 static inline void uhci_remove_tds_from_frame(struct uhci_hcd *uhci,
 202                 unsigned int framenum)
 203 {
 204         struct uhci_td *ftd, *ltd;
 205
 206         framenum &= (UHCI_NUMFRAMES - 1);
 207
 208         ftd = uhci->frame_cpu[framenum];
 209         if (ftd) {
 210                 ltd = list_entry(ftd->fl_list.prev, struct uhci_td, fl_list);
 211                 uhci->frame[framenum] = ltd->link;
 212                 uhci->frame_cpu[framenum] = NULL;
 213
 214                 while (!list_empty(&ftd->fl_list))
 215                         list_del_init(ftd->fl_list.prev);
 216         }
 217 }
 218
 219 /*
 220  * Remove all the TDs for an Isochronous URB from the frame list
 221  */
 222 static void uhci_unlink_isochronous_tds(struct uhci_hcd *uhci, struct urb *urb)
 223 {
 224         struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
 225         struct uhci_td *td;
 226
 227         list_for_each_entry(td, &urbp->td_list, list)
 228                 uhci_remove_td_from_frame_list(uhci, td);
 229 }
 230
 231 static struct uhci_qh *uhci_alloc_qh(struct uhci_hcd *uhci,
 232                 struct usb_device *udev, struct usb_host_endpoint *hep)
 233 {
 234         dma_addr_t dma_handle;
 235         struct uhci_qh *qh;
 236
 237         qh = dma_pool_alloc(uhci->qh_pool, GFP_ATOMIC, &dma_handle);
 238         if (!qh)
 239                 return NULL;
 240
 241         memset(qh, 0, sizeof(*qh));
 242         qh->dma_handle = dma_handle;
 243
 244         qh->element = UHCI_PTR_TERM;
 245         qh->link = UHCI_PTR_TERM;
 246
 247         INIT_LIST_HEAD(&qh->queue);
 248         INIT_LIST_HEAD(&qh->node);
 249
 250         if (udev) {             /* Normal QH */
 251                 qh->type = hep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK;
 252                 if (qh->type != USB_ENDPOINT_XFER_ISOC) {
 253                         qh->dummy_td = uhci_alloc_td(uhci);
 254                         if (!qh->dummy_td) {
 255                                 dma_pool_free(uhci->qh_pool, qh, dma_handle);
 256                                 return NULL;
 257                         }
 258                 }
 259                 qh->state = QH_STATE_IDLE;
 260                 qh->hep = hep;
 261                 qh->udev = udev;
 262                 hep->hcpriv = qh;
 263
 264         } else {                /* Skeleton QH */
 265                 qh->state = QH_STATE_ACTIVE;
 266                 qh->type = -1;
 267         }
 268         return qh;
 269 }
 270
 271 static void uhci_free_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
 272 {
 273         WARN_ON(qh->state != QH_STATE_IDLE && qh->udev);
 274         if (!list_empty(&qh->queue))
 275                 dev_warn(uhci_dev(uhci), "qh %p list not empty!\n", qh);
 276
 277         list_del(&qh->node);
 278         if (qh->udev) {
 279                 qh->hep->hcpriv = NULL;
 280                 if (qh->dummy_td)
 281                         uhci_free_td(uhci, qh->dummy_td);
 282         }
 283         dma_pool_free(uhci->qh_pool, qh, qh->dma_handle);
 284 }
 285
 286 /*
 287  * When a queue is stopped and a dequeued URB is given back, adjust
 288  * the previous TD link (if the URB isn't first on the queue) or
 289  * save its toggle value (if it is first and is currently executing).
 290  *
 291  * Returns 0 if the URB should not yet be given back, 1 otherwise.
 292  */
 293 static int uhci_cleanup_queue(struct uhci_hcd *uhci, struct uhci_qh *qh,
 294                 struct urb *urb)
 295 {
 296         struct urb_priv *urbp = urb->hcpriv;
 297         struct uhci_td *td;
 298         int ret = 1;
 299
 300         /* Isochronous pipes don't use toggles and their TD link pointers
 301          * get adjusted during uhci_urb_dequeue().  But since their queues
 302          * cannot truly be stopped, we have to watch out for dequeues
 303          * occurring after the nominal unlink frame. */
 304         if (qh->type == USB_ENDPOINT_XFER_ISOC) {
 305                 ret = (uhci->frame_number + uhci->is_stopped !=
 306                                 qh->unlink_frame);
 307                 goto done;
 308         }
 309
 310         /* If the URB isn't first on its queue, adjust the link pointer
 311          * of the last TD in the previous URB.  The toggle doesn't need
 312          * to be saved since this URB can't be executing yet. */
 313         if (qh->queue.next != &urbp->node) {
 314                 struct urb_priv *purbp;
 315                 struct uhci_td *ptd;
 316
 317                 purbp = list_entry(urbp->node.prev, struct urb_priv, node);
 318                 WARN_ON(list_empty(&purbp->td_list));
 319                 ptd = list_entry(purbp->td_list.prev, struct uhci_td,
 320                                 list);
 321                 td = list_entry(urbp->td_list.prev, struct uhci_td,
 322                                 list);
 323                 ptd->link = td->link;
 324                 goto done;
 325         }
 326
 327         /* If the QH element pointer is UHCI_PTR_TERM then then currently
 328          * executing URB has already been unlinked, so this one isn't it. */
 329         if (qh_element(qh) == UHCI_PTR_TERM)
 330                 goto done;
 331         qh->element = UHCI_PTR_TERM;
 332
 333         /* Control pipes don't have to worry about toggles */
 334         if (qh->type == USB_ENDPOINT_XFER_CONTROL)
 335                 goto done;
 336
 337         /* Save the next toggle value */
 338         WARN_ON(list_empty(&urbp->td_list));
 339         td = list_entry(urbp->td_list.next, struct uhci_td, list);
 340         qh->needs_fixup = 1;
 341         qh->initial_toggle = uhci_toggle(td_token(td));
 342
 343 done:
 344         return ret;
 345 }
 346
 347 /*
 348  * Fix up the data toggles for URBs in a queue, when one of them
 349  * terminates early (short transfer, error, or dequeued).
 350  */
 351 static void uhci_fixup_toggles(struct uhci_qh *qh, int skip_first)
 352 {
 353         struct urb_priv *urbp = NULL;
 354         struct uhci_td *td;
 355         unsigned int toggle = qh->initial_toggle;
 356         unsigned int pipe;
 357
 358         /* Fixups for a short transfer start with the second URB in the
 359          * queue (the short URB is the first). */
 360         if (skip_first)
 361                 urbp = list_entry(qh->queue.next, struct urb_priv, node);
 362
 363         /* When starting with the first URB, if the QH element pointer is
 364          * still valid then we know the URB's toggles are okay. */
 365         else if (qh_element(qh) != UHCI_PTR_TERM)
 366                 toggle = 2;
 367
 368         /* Fix up the toggle for the URBs in the queue.  Normally this
 369          * loop won't run more than once: When an error or short transfer
 370          * occurs, the queue usually gets emptied. */
 371         urbp = list_prepare_entry(urbp, &qh->queue, node);
 372         list_for_each_entry_continue(urbp, &qh->queue, node) {
 373
 374                 /* If the first TD has the right toggle value, we don't
 375                  * need to change any toggles in this URB */
 376                 td = list_entry(urbp->td_list.next, struct uhci_td, list);
 377                 if (toggle > 1 || uhci_toggle(td_token(td)) == toggle) {
 378                         td = list_entry(urbp->td_list.prev, struct uhci_td,
 379                                         list);
 380                         toggle = uhci_toggle(td_token(td)) ^ 1;
 381
 382                 /* Otherwise all the toggles in the URB have to be switched */
 383                 } else {
 384                         list_for_each_entry(td, &urbp->td_list, list) {
 385                                 td->token ^= __constant_cpu_to_le32(
 386                                                         TD_TOKEN_TOGGLE);
 387                                 toggle ^= 1;
 388                         }
 389                 }
 390         }
 391
 392         wmb();
 393         pipe = list_entry(qh->queue.next, struct urb_priv, node)->urb->pipe;
 394         usb_settoggle(qh->udev, usb_pipeendpoint(pipe),
 395                         usb_pipeout(pipe), toggle);
 396         qh->needs_fixup = 0;
 397 }
 398
 399 /*
 400  * Put a QH on the schedule in both hardware and software
 401  */
 402 static void uhci_activate_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
 403 {
 404         struct uhci_qh *pqh;
 405
 406         WARN_ON(list_empty(&qh->queue));
 407
 408         /* Set the element pointer if it isn't set already.
 409          * This isn't needed for Isochronous queues, but it doesn't hurt. */
 410         if (qh_element(qh) == UHCI_PTR_TERM) {
 411                 struct urb_priv *urbp = list_entry(qh->queue.next,
 412                                 struct urb_priv, node);
 413                 struct uhci_td *td = list_entry(urbp->td_list.next,
 414                                 struct uhci_td, list);
 415
 416                 qh->element = cpu_to_le32(td->dma_handle);
 417         }
 418
 419         /* Treat the queue as if it has just advanced */
 420         qh->wait_expired = 0;
 421         qh->advance_jiffies = jiffies;
 422
 423         if (qh->state == QH_STATE_ACTIVE)
 424                 return;
 425         qh->state = QH_STATE_ACTIVE;
 426
 427         /* Move the QH from its old list to the end of the appropriate
 428          * skeleton's list */
 429         if (qh == uhci->next_qh)
 430                 uhci->next_qh = list_entry(qh->node.next, struct uhci_qh,
 431                                 node);
 432         list_move_tail(&qh->node, &qh->skel->node);
 433
 434         /* Link it into the schedule */
 435         pqh = list_entry(qh->node.prev, struct uhci_qh, node);
 436         qh->link = pqh->link;
 437         wmb();
 438         pqh->link = UHCI_PTR_QH | cpu_to_le32(qh->dma_handle);
 439 }
 440
 441 /*
 442  * Take a QH off the hardware schedule
 443  */
 444 static void uhci_unlink_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
 445 {
 446         struct uhci_qh *pqh;
 447
 448         if (qh->state == QH_STATE_UNLINKING)
 449                 return;
 450         WARN_ON(qh->state != QH_STATE_ACTIVE || !qh->udev);
 451         qh->state = QH_STATE_UNLINKING;
 452
 453         /* Unlink the QH from the schedule and record when we did it */
 454         pqh = list_entry(qh->node.prev, struct uhci_qh, node);
 455         pqh->link = qh->link;
 456         mb();
 457
 458         uhci_get_current_frame_number(uhci);
 459         qh->unlink_frame = uhci->frame_number;
 460
 461         /* Force an interrupt so we know when the QH is fully unlinked */
 462         if (list_empty(&uhci->skel_unlink_qh->node))
 463                 uhci_set_next_interrupt(uhci);
 464
 465         /* Move the QH from its old list to the end of the unlinking list */
 466         if (qh == uhci->next_qh)
 467                 uhci->next_qh = list_entry(qh->node.next, struct uhci_qh,
 468                                 node);
 469         list_move_tail(&qh->node, &uhci->skel_unlink_qh->node);
 470 }
 471
 472 /*
 473  * When we and the controller are through with a QH, it becomes IDLE.
 474  * This happens when a QH has been off the schedule (on the unlinking
 475  * list) for more than one frame, or when an error occurs while adding
 476  * the first URB onto a new QH.
 477  */
 478 static void uhci_make_qh_idle(struct uhci_hcd *uhci, struct uhci_qh *qh)
 479 {
 480         WARN_ON(qh->state == QH_STATE_ACTIVE);
 481
 482         if (qh == uhci->next_qh)
 483                 uhci->next_qh = list_entry(qh->node.next, struct uhci_qh,
 484                                 node);
 485         list_move(&qh->node, &uhci->idle_qh_list);
 486         qh->state = QH_STATE_IDLE;
 487
 488         /* Now that the QH is idle, its post_td isn't being used */
 489         if (qh->post_td) {
 490                 uhci_free_td(uhci, qh->post_td);
 491                 qh->post_td = NULL;
 492         }
 493
 494         /* If anyone is waiting for a QH to become idle, wake them up */
 495         if (uhci->num_waiting)
 496                 wake_up_all(&uhci->waitqh);
 497 }
 498
 499 static inline struct urb_priv *uhci_alloc_urb_priv(struct uhci_hcd *uhci,
 500                 struct urb *urb)
 501 {
 502         struct urb_priv *urbp;
 503
 504         urbp = kmem_cache_alloc(uhci_up_cachep, GFP_ATOMIC);
 505         if (!urbp)
 506                 return NULL;
 507
 508         memset((void *)urbp, 0, sizeof(*urbp));
 509
 510         urbp->urb = urb;
 511         urb->hcpriv = urbp;
 512
 513         INIT_LIST_HEAD(&urbp->node);
 514         INIT_LIST_HEAD(&urbp->td_list);
 515
 516         return urbp;
 517 }
 518
 519 static void uhci_free_urb_priv(struct uhci_hcd *uhci,
 520                 struct urb_priv *urbp)
 521 {
 522         struct uhci_td *td, *tmp;
 523
 524         if (!list_empty(&urbp->node))
 525                 dev_warn(uhci_dev(uhci), "urb %p still on QH's list!\n",
 526                                 urbp->urb);
 527
 528         list_for_each_entry_safe(td, tmp, &urbp->td_list, list) {
 529                 uhci_remove_td_from_urbp(td);
 530                 uhci_free_td(uhci, td);
 531         }
 532
 533         urbp->urb->hcpriv = NULL;
 534         kmem_cache_free(uhci_up_cachep, urbp);
 535 }
 536
 537 /*
 538  * Map status to standard result codes
 539  *
 540  * <status> is (td_status(td) & 0xF60000), a.k.a.
 541  * uhci_status_bits(td_status(td)).
 542  * Note: <status> does not include the TD_CTRL_NAK bit.
 543  * <dir_out> is True for output TDs and False for input TDs.
 544  */
 545 static int uhci_map_status(int status, int dir_out)
 546 {
 547         if (!status)
 548                 return 0;
 549         if (status & TD_CTRL_BITSTUFF)                  /* Bitstuff error */
 550                 return -EPROTO;
 551         if (status & TD_CTRL_CRCTIMEO) {                /* CRC/Timeout */
 552                 if (dir_out)
 553                         return -EPROTO;
 554                 else
 555                         return -EILSEQ;
 556         }
 557         if (status & TD_CTRL_BABBLE)                    /* Babble */
 558                 return -EOVERFLOW;
 559         if (status & TD_CTRL_DBUFERR)                   /* Buffer error */
 560                 return -ENOSR;
 561         if (status & TD_CTRL_STALLED)                   /* Stalled */
 562                 return -EPIPE;
 563         return 0;
 564 }
 565
 566 /*
 567  * Control transfers
 568  */
 569 static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb,
 570                 struct uhci_qh *qh)
 571 {
 572         struct uhci_td *td;
 573         unsigned long destination, status;
 574         int maxsze = le16_to_cpu(qh->hep->desc.wMaxPacketSize);
 575         int len = urb->transfer_buffer_length;
 576         dma_addr_t data = urb->transfer_dma;
 577         __le32 *plink;
 578         struct urb_priv *urbp = urb->hcpriv;
 579
 580         /* The "pipe" thing contains the destination in bits 8--18 */
 581         destination = (urb->pipe & PIPE_DEVEP_MASK) | USB_PID_SETUP;
 582
 583         /* 3 errors, dummy TD remains inactive */
 584         status = uhci_maxerr(3);
 585         if (urb->dev->speed == USB_SPEED_LOW)
 586                 status |= TD_CTRL_LS;
 587
 588         /*
 589          * Build the TD for the control request setup packet
 590          */
 591         td = qh->dummy_td;
 592         uhci_add_td_to_urbp(td, urbp);
 593         uhci_fill_td(td, status, destination | uhci_explen(8),
 594                         urb->setup_dma);
 595         plink = &td->link;
 596         status |= TD_CTRL_ACTIVE;
 597
 598         /*
 599          * If direction is "send", change the packet ID from SETUP (0x2D)
 600          * to OUT (0xE1).  Else change it from SETUP to IN (0x69) and
 601          * set Short Packet Detect (SPD) for all data packets.
 602          */
 603         if (usb_pipeout(urb->pipe))
 604                 destination ^= (USB_PID_SETUP ^ USB_PID_OUT);
 605         else {
 606                 destination ^= (USB_PID_SETUP ^ USB_PID_IN);
 607                 status |= TD_CTRL_SPD;
 608         }
 609
 610         /*
 611          * Build the DATA TDs
 612          */
 613         while (len > 0) {
 614                 int pktsze = min(len, maxsze);
 615
 616                 td = uhci_alloc_td(uhci);
 617                 if (!td)
 618                         goto nomem;
 619                 *plink = cpu_to_le32(td->dma_handle);
 620
 621                 /* Alternate Data0/1 (start with Data1) */
 622                 destination ^= TD_TOKEN_TOGGLE;
 623
 624                 uhci_add_td_to_urbp(td, urbp);
 625                 uhci_fill_td(td, status, destination | uhci_explen(pktsze),
 626                                 data);
 627                 plink = &td->link;
 628
 629                 data += pktsze;
 630                 len -= pktsze;
 631         }
 632
 633         /*
 634          * Build the final TD for control status
 635          */
 636         td = uhci_alloc_td(uhci);
 637         if (!td)
 638                 goto nomem;
 639         *plink = cpu_to_le32(td->dma_handle);
 640
 641         /*
 642          * It's IN if the pipe is an output pipe or we're not expecting
 643          * data back.
 644          */
 645         destination &= ~TD_TOKEN_PID_MASK;
 646         if (usb_pipeout(urb->pipe) || !urb->transfer_buffer_length)
 647                 destination |= USB_PID_IN;
 648         else
 649                 destination |= USB_PID_OUT;
 650
 651         destination |= TD_TOKEN_TOGGLE;         /* End in Data1 */
 652
 653         status &= ~TD_CTRL_SPD;
 654
 655         uhci_add_td_to_urbp(td, urbp);
 656         uhci_fill_td(td, status | TD_CTRL_IOC,
 657                         destination | uhci_explen(0), 0);
 658         plink = &td->link;
 659
 660         /*
 661          * Build the new dummy TD and activate the old one
 662          */
 663         td = uhci_alloc_td(uhci);
 664         if (!td)
 665                 goto nomem;
 666         *plink = cpu_to_le32(td->dma_handle);
 667
 668         uhci_fill_td(td, 0, USB_PID_OUT | uhci_explen(0), 0);
 669         wmb();
 670         qh->dummy_td->status |= __constant_cpu_to_le32(TD_CTRL_ACTIVE);
 671         qh->dummy_td = td;
 672
 673         /* Low-speed transfers get a different queue, and won't hog the bus.
 674          * Also, some devices enumerate better without FSBR; the easiest way
 675          * to do that is to put URBs on the low-speed queue while the device
 676          * isn't in the CONFIGURED state. */
 677         if (urb->dev->speed == USB_SPEED_LOW ||
 678                         urb->dev->state != USB_STATE_CONFIGURED)
 679                 qh->skel = uhci->skel_ls_control_qh;
 680         else {
 681                 qh->skel = uhci->skel_fs_control_qh;
 682                 uhci_add_fsbr(uhci, urb);
 683         }
 684
 685         urb->actual_length = -8;        /* Account for the SETUP packet */
 686         return 0;
 687
 688 nomem:
 689         /* Remove the dummy TD from the td_list so it doesn't get freed */
 690         uhci_remove_td_from_urbp(qh->dummy_td);
 691         return -ENOMEM;
 692 }
 693
 694 /*
 695  * Common submit for bulk and interrupt
 696  */
 697 static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
 698                 struct uhci_qh *qh)
 699 {
 700         struct uhci_td *td;
 701         unsigned long destination, status;
 702         int maxsze = le16_to_cpu(qh->hep->desc.wMaxPacketSize);
 703         int len = urb->transfer_buffer_length;
 704         dma_addr_t data = urb->transfer_dma;
 705         __le32 *plink;
 706         struct urb_priv *urbp = urb->hcpriv;
 707         unsigned int toggle;
 708
 709         if (len < 0)
 710                 return -EINVAL;
 711
 712         /* The "pipe" thing contains the destination in bits 8--18 */
 713         destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
 714         toggle = usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe),
 715                          usb_pipeout(urb->pipe));
 716
 717         /* 3 errors, dummy TD remains inactive */
 718         status = uhci_maxerr(3);
 719         if (urb->dev->speed == USB_SPEED_LOW)
 720                 status |= TD_CTRL_LS;
 721         if (usb_pipein(urb->pipe))
 722                 status |= TD_CTRL_SPD;
 723
 724         /*
 725          * Build the DATA TDs
 726          */
 727         plink = NULL;
 728         td = qh->dummy_td;
 729         do {    /* Allow zero length packets */
 730                 int pktsze = maxsze;
 731
 732                 if (len <= pktsze) {            /* The last packet */
 733                         pktsze = len;
 734                         if (!(urb->transfer_flags & URB_SHORT_NOT_OK))
 735                                 status &= ~TD_CTRL_SPD;
 736                 }
 737
 738                 if (plink) {
 739                         td = uhci_alloc_td(uhci);
 740                         if (!td)
 741                                 goto nomem;
 742                         *plink = cpu_to_le32(td->dma_handle);
 743                 }
 744                 uhci_add_td_to_urbp(td, urbp);
 745                 uhci_fill_td(td, status,
 746                                 destination | uhci_explen(pktsze) |
 747                                         (toggle << TD_TOKEN_TOGGLE_SHIFT),
 748                                 data);
 749                 plink = &td->link;
 750                 status |= TD_CTRL_ACTIVE;
 751
 752                 data += pktsze;
 753                 len -= maxsze;
 754                 toggle ^= 1;
 755         } while (len > 0);
 756
 757         /*
 758          * URB_ZERO_PACKET means adding a 0-length packet, if direction
 759          * is OUT and the transfer_length was an exact multiple of maxsze,
 760          * hence (len = transfer_length - N * maxsze) == 0
 761          * however, if transfer_length == 0, the zero packet was already
 762          * prepared above.
 763          */
 764         if ((urb->transfer_flags & URB_ZERO_PACKET) &&
 765                         usb_pipeout(urb->pipe) && len == 0 &&
 766                         urb->transfer_buffer_length > 0) {
 767                 td = uhci_alloc_td(uhci);
 768                 if (!td)
 769                         goto nomem;
 770                 *plink = cpu_to_le32(td->dma_handle);
 771
 772                 uhci_add_td_to_urbp(td, urbp);
 773                 uhci_fill_td(td, status,
 774                                 destination | uhci_explen(0) |
 775                                         (toggle << TD_TOKEN_TOGGLE_SHIFT),
 776                                 data);
 777                 plink = &td->link;
 778
 779                 toggle ^= 1;
 780         }
 781
 782         /* Set the interrupt-on-completion flag on the last packet.
 783          * A more-or-less typical 4 KB URB (= size of one memory page)
 784          * will require about 3 ms to transfer; that's a little on the
 785          * fast side but not enough to justify delaying an interrupt
 786          * more than 2 or 3 URBs, so we will ignore the URB_NO_INTERRUPT
 787          * flag setting. */
 788         td->status |= __constant_cpu_to_le32(TD_CTRL_IOC);
 789
 790         /*
 791          * Build the new dummy TD and activate the old one
 792          */
 793         td = uhci_alloc_td(uhci);
 794         if (!td)
 795                 goto nomem;
 796         *plink = cpu_to_le32(td->dma_handle);
 797
 798         uhci_fill_td(td, 0, USB_PID_OUT | uhci_explen(0), 0);
 799         wmb();
 800         qh->dummy_td->status |= __constant_cpu_to_le32(TD_CTRL_ACTIVE);
 801         qh->dummy_td = td;
 802         qh->period = urb->interval;
 803
 804         usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
 805                         usb_pipeout(urb->pipe), toggle);
 806         return 0;
 807
 808 nomem:
 809         /* Remove the dummy TD from the td_list so it doesn't get freed */
 810         uhci_remove_td_from_urbp(qh->dummy_td);
 811         return -ENOMEM;
 812 }
 813
 814 static inline int uhci_submit_bulk(struct uhci_hcd *uhci, struct urb *urb,
 815                 struct uhci_qh *qh)
 816 {
 817         int ret;
 818
 819         /* Can't have low-speed bulk transfers */
 820         if (urb->dev->speed == USB_SPEED_LOW)
 821                 return -EINVAL;
 822
 823         qh->skel = uhci->skel_bulk_qh;
 824         ret = uhci_submit_common(uhci, urb, qh);
 825         if (ret == 0)
 826                 uhci_add_fsbr(uhci, urb);
 827         return ret;
 828 }
 829
 830 static int uhci_submit_interrupt(struct uhci_hcd *uhci, struct urb *urb,
 831                 struct uhci_qh *qh)
 832 {
 833         int exponent;
 834
 835         /* USB 1.1 interrupt transfers only involve one packet per interval.
 836          * Drivers can submit URBs of any length, but longer ones will need
 837          * multiple intervals to complete.
 838          */
 839
 840         /* Figure out which power-of-two queue to use */
 841         for (exponent = 7; exponent >= 0; --exponent) {
 842                 if ((1 << exponent) <= urb->interval)
 843                         break;
 844         }
 845         if (exponent < 0)
 846                 return -EINVAL;
 847         urb->interval = 1 << exponent;
 848
 849         if (qh->period == 0)
 850                 qh->skel = uhci->skelqh[UHCI_SKEL_INDEX(exponent)];
 851         else if (qh->period != urb->interval)
 852                 return -EINVAL;         /* Can't change the period */
 853
 854         return uhci_submit_common(uhci, urb, qh);
 855 }
 856
 857 /*
 858  * Fix up the data structures following a short transfer
 859  */
 860 static int uhci_fixup_short_transfer(struct uhci_hcd *uhci,
 861                 struct uhci_qh *qh, struct urb_priv *urbp)
 862 {
 863         struct uhci_td *td;
 864         struct list_head *tmp;
 865         int ret;
 866
 867         td = list_entry(urbp->td_list.prev, struct uhci_td, list);
 868         if (qh->type == USB_ENDPOINT_XFER_CONTROL) {
 869
 870                 /* When a control transfer is short, we have to restart
 871                  * the queue at the status stage transaction, which is
 872                  * the last TD. */
 873                 WARN_ON(list_empty(&urbp->td_list));
 874                 qh->element = cpu_to_le32(td->dma_handle);
 875                 tmp = td->list.prev;
 876                 ret = -EINPROGRESS;
 877
 878         } else {
 879
 880                 /* When a bulk/interrupt transfer is short, we have to
 881                  * fix up the toggles of the following URBs on the queue
 882                  * before restarting the queue at the next URB. */
 883                 qh->initial_toggle = uhci_toggle(td_token(qh->post_td)) ^ 1;
 884                 uhci_fixup_toggles(qh, 1);
 885
 886                 if (list_empty(&urbp->td_list))
 887                         td = qh->post_td;
 888                 qh->element = td->link;
 889                 tmp = urbp->td_list.prev;
 890                 ret = 0;
 891         }
 892
 893         /* Remove all the TDs we skipped over, from tmp back to the start */
 894         while (tmp != &urbp->td_list) {
 895                 td = list_entry(tmp, struct uhci_td, list);
 896                 tmp = tmp->prev;
 897
 898                 uhci_remove_td_from_urbp(td);
 899                 uhci_free_td(uhci, td);
 900         }
 901         return ret;
 902 }
 903
 904 /*
 905  * Common result for control, bulk, and interrupt
 906  */
 907 static int uhci_result_common(struct uhci_hcd *uhci, struct urb *urb)
 908 {
 909         struct urb_priv *urbp = urb->hcpriv;
 910         struct uhci_qh *qh = urbp->qh;
 911         struct uhci_td *td, *tmp;
 912         unsigned status;
 913         int ret = 0;
 914
 915         list_for_each_entry_safe(td, tmp, &urbp->td_list, list) {
 916                 unsigned int ctrlstat;
 917                 int len;
 918
 919                 ctrlstat = td_status(td);
 920                 status = uhci_status_bits(ctrlstat);
 921                 if (status & TD_CTRL_ACTIVE)
 922                         return -EINPROGRESS;
 923
 924                 len = uhci_actual_length(ctrlstat);
 925                 urb->actual_length += len;
 926
 927                 if (status) {
 928                         ret = uhci_map_status(status,
 929                                         uhci_packetout(td_token(td)));
 930                         if ((debug == 1 && ret != -EPIPE) || debug > 1) {
 931                                 /* Some debugging code */
 932                                 dev_dbg(&urb->dev->dev,
 933                                                 "%s: failed with status %x\n",
 934                                                 __FUNCTION__, status);
 935
 936                                 if (debug > 1 && errbuf) {
 937                                         /* Print the chain for debugging */
 938                                         uhci_show_qh(urbp->qh, errbuf,
 939                                                         ERRBUF_LEN, 0);
 940                                         lprintk(errbuf);
 941                                 }
 942                         }
 943
 944                 } else if (len < uhci_expected_length(td_token(td))) {
 945
 946                         /* We received a short packet */
 947                         if (urb->transfer_flags & URB_SHORT_NOT_OK)
 948                                 ret = -EREMOTEIO;
 949
 950                         /* Fixup needed only if this isn't the URB's last TD */
 951                         else if (&td->list != urbp->td_list.prev)
 952                                 ret = 1;
 953                 }
 954
 955                 uhci_remove_td_from_urbp(td);
 956                 if (qh->post_td)
 957                         uhci_free_td(uhci, qh->post_td);
 958                 qh->post_td = td;
 959
 960                 if (ret != 0)
 961                         goto err;
 962         }
 963         return ret;
 964
 965 err:
 966         if (ret < 0) {
 967                 /* In case a control transfer gets an error
 968                  * during the setup stage */
 969                 urb->actual_length = max(urb->actual_length, 0);
 970
 971                 /* Note that the queue has stopped and save
 972                  * the next toggle value */
 973                 qh->element = UHCI_PTR_TERM;
 974                 qh->is_stopped = 1;
 975                 qh->needs_fixup = (qh->type != USB_ENDPOINT_XFER_CONTROL);
 976                 qh->initial_toggle = uhci_toggle(td_token(td)) ^
 977                                 (ret == -EREMOTEIO);
 978
 979         } else          /* Short packet received */
 980                 ret = uhci_fixup_short_transfer(uhci, qh, urbp);
 981         return ret;
 982 }
 983
 984 /*
 985  * Isochronous transfers
 986  */
 987 static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
 988                 struct uhci_qh *qh)
 989 {
 990         struct uhci_td *td = NULL;      /* Since urb->number_of_packets > 0 */
 991         int i, frame;
 992         unsigned long destination, status;
 993         struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
 994
 995         /* Values must not be too big (could overflow below) */
 996         if (urb->interval >= UHCI_NUMFRAMES ||
 997                         urb->number_of_packets >= UHCI_NUMFRAMES)
 998                 return -EFBIG;
 999
1000         /* Check the period and figure out the starting frame number */
1001         if (qh->period == 0) {
1002                 if (urb->transfer_flags & URB_ISO_ASAP) {
1003                         uhci_get_current_frame_number(uhci);
1004                         urb->start_frame = uhci->frame_number + 10;
1005                 } else {
1006                         i = urb->start_frame - uhci->last_iso_frame;
1007                         if (i <= 0 || i >= UHCI_NUMFRAMES)
1008                                 return -EINVAL;
1009                 }
1010         } else if (qh->period != urb->interval) {
1011                 return -EINVAL;         /* Can't change the period */
1012
1013         } else {        /* Pick up where the last URB leaves off */
1014                 if (list_empty(&qh->queue)) {
1015                         frame = qh->iso_frame;
1016                 } else {
1017                         struct urb *lurb;
1018
1019                         lurb = list_entry(qh->queue.prev,
1020                                         struct urb_priv, node)->urb;
1021                         frame = lurb->start_frame +
1022                                         lurb->number_of_packets *
1023                                         lurb->interval;
1024                 }
1025                 if (urb->transfer_flags & URB_ISO_ASAP)
1026                         urb->start_frame = frame;
1027                 else if (urb->start_frame != frame)
1028                         return -EINVAL;
1029         }
1030
1031         /* Make sure we won't have to go too far into the future */
1032         if (uhci_frame_before_eq(uhci->last_iso_frame + UHCI_NUMFRAMES,
1033                         urb->start_frame + urb->number_of_packets *
1034                                 urb->interval))
1035                 return -EFBIG;
1036
1037         status = TD_CTRL_ACTIVE | TD_CTRL_IOS;
1038         destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
1039
1040         for (i = 0; i < urb->number_of_packets; i++) {
1041                 td = uhci_alloc_td(uhci);
1042                 if (!td)
1043                         return -ENOMEM;
1044
1045                 uhci_add_td_to_urbp(td, urbp);
1046                 uhci_fill_td(td, status, destination |
1047                                 uhci_explen(urb->iso_frame_desc[i].length),
1048                                 urb->transfer_dma +
1049                                         urb->iso_frame_desc[i].offset);
1050         }
1051
1052         /* Set the interrupt-on-completion flag on the last packet. */
1053         td->status |= __constant_cpu_to_le32(TD_CTRL_IOC);
1054
1055         qh->skel = uhci->skel_iso_qh;
1056         qh->period = urb->interval;
1057
1058         /* Add the TDs to the frame list */
1059         frame = urb->start_frame;
1060         list_for_each_entry(td, &urbp->td_list, list) {
1061                 uhci_insert_td_in_frame_list(uhci, td, frame);
1062                 frame += qh->period;
1063         }
1064
1065         if (list_empty(&qh->queue)) {
1066                 qh->iso_packet_desc = &urb->iso_frame_desc[0];
1067                 qh->iso_frame = urb->start_frame;
1068                 qh->iso_status = 0;
1069         }
1070
1071         return 0;
1072 }
1073
1074 static int uhci_result_isochronous(struct uhci_hcd *uhci, struct urb *urb)
1075 {
1076         struct uhci_td *td, *tmp;
1077         struct urb_priv *urbp = urb->hcpriv;
1078         struct uhci_qh *qh = urbp->qh;
1079
1080         list_for_each_entry_safe(td, tmp, &urbp->td_list, list) {
1081                 unsigned int ctrlstat;
1082                 int status;
1083                 int actlength;
1084
1085                 if (uhci_frame_before_eq(uhci->cur_iso_frame, qh->iso_frame))
1086                         return -EINPROGRESS;
1087
1088                 uhci_remove_tds_from_frame(uhci, qh->iso_frame);
1089
1090                 ctrlstat = td_status(td);
1091                 if (ctrlstat & TD_CTRL_ACTIVE) {
1092                         status = -EXDEV;        /* TD was added too late? */
1093                 } else {
1094                         status = uhci_map_status(uhci_status_bits(ctrlstat),
1095                                         usb_pipeout(urb->pipe));
1096                         actlength = uhci_actual_length(ctrlstat);
1097
1098                         urb->actual_length += actlength;
1099                         qh->iso_packet_desc->actual_length = actlength;
1100                         qh->iso_packet_desc->status = status;
1101                 }
1102
1103                 if (status) {
1104                         urb->error_count++;
1105                         qh->iso_status = status;
1106                 }
1107
1108                 uhci_remove_td_from_urbp(td);
1109                 uhci_free_td(uhci, td);
1110                 qh->iso_frame += qh->period;
1111                 ++qh->iso_packet_desc;
1112         }
1113         return qh->iso_status;
1114 }
1115
1116 static int uhci_urb_enqueue(struct usb_hcd *hcd,
1117                 struct usb_host_endpoint *hep,
1118                 struct urb *urb, gfp_t mem_flags)
1119 {
1120         int ret;
1121         struct uhci_hcd *uhci = hcd_to_uhci(hcd);
1122         unsigned long flags;
1123         struct urb_priv *urbp;
1124         struct uhci_qh *qh;
1125         int bustime;
1126
1127         spin_lock_irqsave(&uhci->lock, flags);
1128
1129         ret = urb->status;
1130         if (ret != -EINPROGRESS)                /* URB already unlinked! */
1131                 goto done;
1132
1133         ret = -ENOMEM;
1134         urbp = uhci_alloc_urb_priv(uhci, urb);
1135         if (!urbp)
1136                 goto done;
1137
1138         if (hep->hcpriv)
1139                 qh = (struct uhci_qh *) hep->hcpriv;
1140         else {
1141                 qh = uhci_alloc_qh(uhci, urb->dev, hep);
1142                 if (!qh)
1143                         goto err_no_qh;
1144         }
1145         urbp->qh = qh;
1146
1147         switch (qh->type) {
1148         case USB_ENDPOINT_XFER_CONTROL:
1149                 ret = uhci_submit_control(uhci, urb, qh);
1150                 break;
1151         case USB_ENDPOINT_XFER_BULK:
1152                 ret = uhci_submit_bulk(uhci, urb, qh);
1153                 break;
1154         case USB_ENDPOINT_XFER_INT:
1155                 if (list_empty(&qh->queue)) {
1156                         bustime = usb_check_bandwidth(urb->dev, urb);
1157                         if (bustime < 0)
1158                                 ret = bustime;
1159                         else {
1160                                 ret = uhci_submit_interrupt(uhci, urb, qh);
1161                                 if (ret == 0)
1162                                         usb_claim_bandwidth(urb->dev, urb, bustime, 0);
1163                         }
1164                 } else {        /* inherit from parent */
1165                         struct urb_priv *eurbp;
1166
1167                         eurbp = list_entry(qh->queue.prev, struct urb_priv,
1168                                         node);
1169                         urb->bandwidth = eurbp->urb->bandwidth;
1170                         ret = uhci_submit_interrupt(uhci, urb, qh);
1171                 }
1172                 break;
1173         case USB_ENDPOINT_XFER_ISOC:
1174                 urb->error_count = 0;
1175                 bustime = usb_check_bandwidth(urb->dev, urb);
1176                 if (bustime < 0) {
1177                         ret = bustime;
1178                         break;
1179                 }
1180
1181                 ret = uhci_submit_isochronous(uhci, urb, qh);
1182                 if (ret == 0)
1183                         usb_claim_bandwidth(urb->dev, urb, bustime, 1);
1184                 break;
1185         }
1186         if (ret != 0)
1187                 goto err_submit_failed;
1188
1189         /* Add this URB to the QH */
1190         urbp->qh = qh;
1191         list_add_tail(&urbp->node, &qh->queue);
1192
1193         /* If the new URB is the first and only one on this QH then either
1194          * the QH is new and idle or else it's unlinked and waiting to
1195          * become idle, so we can activate it right away.  But only if the
1196          * queue isn't stopped. */
1197         if (qh->queue.next == &urbp->node && !qh->is_stopped) {
1198                 uhci_activate_qh(uhci, qh);
1199                 uhci_urbp_wants_fsbr(uhci, urbp);
1200         }
1201         goto done;
1202
1203 err_submit_failed:
1204         if (qh->state == QH_STATE_IDLE)
1205                 uhci_make_qh_idle(uhci, qh);    /* Reclaim unused QH */
1206
1207 err_no_qh:
1208         uhci_free_urb_priv(uhci, urbp);
1209
1210 done:
1211         spin_unlock_irqrestore(&uhci->lock, flags);
1212         return ret;
1213 }
1214
1215 static int uhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
1216 {
1217         struct uhci_hcd *uhci = hcd_to_uhci(hcd);
1218         unsigned long flags;
1219         struct urb_priv *urbp;
1220         struct uhci_qh *qh;
1221
1222         spin_lock_irqsave(&uhci->lock, flags);
1223         urbp = urb->hcpriv;
1224         if (!urbp)                      /* URB was never linked! */
1225                 goto done;
1226         qh = urbp->qh;
1227
1228         /* Remove Isochronous TDs from the frame list ASAP */
1229         if (qh->type == USB_ENDPOINT_XFER_ISOC) {
1230                 uhci_unlink_isochronous_tds(uhci, urb);
1231                 mb();
1232
1233                 /* If the URB has already started, update the QH unlink time */
1234                 uhci_get_current_frame_number(uhci);
1235                 if (uhci_frame_before_eq(urb->start_frame, uhci->frame_number))
1236                         qh->unlink_frame = uhci->frame_number;
1237         }
1238
1239         uhci_unlink_qh(uhci, qh);
1240
1241 done:
1242         spin_unlock_irqrestore(&uhci->lock, flags);
1243         return 0;
1244 }
1245
1246 /*
1247  * Finish unlinking an URB and give it back
1248  */
1249 static void uhci_giveback_urb(struct uhci_hcd *uhci, struct uhci_qh *qh,
1250                 struct urb *urb)
1251 __releases(uhci->lock)
1252 __acquires(uhci->lock)
1253 {
1254         struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
1255
1256         /* When giving back the first URB in an Isochronous queue,
1257          * reinitialize the QH's iso-related members for the next URB. */
1258         if (qh->type == USB_ENDPOINT_XFER_ISOC &&
1259                         urbp->node.prev == &qh->queue &&
1260                         urbp->node.next != &qh->queue) {
1261                 struct urb *nurb = list_entry(urbp->node.next,
1262                                 struct urb_priv, node)->urb;
1263
1264                 qh->iso_packet_desc = &nurb->iso_frame_desc[0];
1265                 qh->iso_frame = nurb->start_frame;
1266                 qh->iso_status = 0;
1267         }
1268
1269         /* Take the URB off the QH's queue.  If the queue is now empty,
1270          * this is a perfect time for a toggle fixup. */
1271         list_del_init(&urbp->node);
1272         if (list_empty(&qh->queue) && qh->needs_fixup) {
1273                 usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
1274                                 usb_pipeout(urb->pipe), qh->initial_toggle);
1275                 qh->needs_fixup = 0;
1276         }
1277
1278         uhci_free_urb_priv(uhci, urbp);
1279
1280         switch (qh->type) {
1281         case USB_ENDPOINT_XFER_ISOC:
1282                 /* Release bandwidth for Interrupt or Isoc. transfers */
1283                 if (urb->bandwidth)
1284                         usb_release_bandwidth(urb->dev, urb, 1);
1285                 break;
1286         case USB_ENDPOINT_XFER_INT:
1287                 /* Release bandwidth for Interrupt or Isoc. transfers */
1288                 /* Make sure we don't release if we have a queued URB */
1289                 if (list_empty(&qh->queue) && urb->bandwidth)
1290                         usb_release_bandwidth(urb->dev, urb, 0);
1291                 else
1292                         /* bandwidth was passed on to queued URB, */
1293                         /* so don't let usb_unlink_urb() release it */
1294                         urb->bandwidth = 0;
1295                 break;
1296         }
1297
1298         spin_unlock(&uhci->lock);
1299         usb_hcd_giveback_urb(uhci_to_hcd(uhci), urb);
1300         spin_lock(&uhci->lock);
1301
1302         /* If the queue is now empty, we can unlink the QH and give up its
1303          * reserved bandwidth. */
1304         if (list_empty(&qh->queue)) {
1305                 uhci_unlink_qh(uhci, qh);
1306
1307                 /* Bandwidth stuff not yet implemented */
1308                 qh->period = 0;
1309         }
1310 }
1311
1312 /*
1313  * Scan the URBs in a QH's queue
1314  */
1315 #define QH_FINISHED_UNLINKING(qh)                       \
1316                 (qh->state == QH_STATE_UNLINKING &&     \
1317                 uhci->frame_number + uhci->is_stopped != qh->unlink_frame)
1318
1319 static void uhci_scan_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
1320 {
1321         struct urb_priv *urbp;
1322         struct urb *urb;
1323         int status;
1324
1325         while (!list_empty(&qh->queue)) {
1326                 urbp = list_entry(qh->queue.next, struct urb_priv, node);
1327                 urb = urbp->urb;
1328
1329                 if (qh->type == USB_ENDPOINT_XFER_ISOC)
1330                         status = uhci_result_isochronous(uhci, urb);
1331                 else
1332                         status = uhci_result_common(uhci, urb);
1333                 if (status == -EINPROGRESS)
1334                         break;
1335
1336                 spin_lock(&urb->lock);
1337                 if (urb->status == -EINPROGRESS)        /* Not dequeued */
1338                         urb->status = status;
1339                 else
1340                         status = ECONNRESET;            /* Not -ECONNRESET */
1341                 spin_unlock(&urb->lock);
1342
1343                 /* Dequeued but completed URBs can't be given back unless
1344                  * the QH is stopped or has finished unlinking. */
1345                 if (status == ECONNRESET) {
1346                         if (QH_FINISHED_UNLINKING(qh))
1347                                 qh->is_stopped = 1;
1348                         else if (!qh->is_stopped)
1349                                 return;
1350                 }
1351
1352                 uhci_giveback_urb(uhci, qh, urb);
1353                 if (status < 0 && qh->type != USB_ENDPOINT_XFER_ISOC)
1354                         break;
1355         }
1356
1357         /* If the QH is neither stopped nor finished unlinking (normal case),
1358          * our work here is done. */
1359         if (QH_FINISHED_UNLINKING(qh))
1360                 qh->is_stopped = 1;
1361         else if (!qh->is_stopped)
1362                 return;
1363
1364         /* Otherwise give back each of the dequeued URBs */
1365 restart:
1366         list_for_each_entry(urbp, &qh->queue, node) {
1367                 urb = urbp->urb;
1368                 if (urb->status != -EINPROGRESS) {
1369
1370                         /* Fix up the TD links and save the toggles for
1371                          * non-Isochronous queues.  For Isochronous queues,
1372                          * test for too-recent dequeues. */
1373                         if (!uhci_cleanup_queue(uhci, qh, urb)) {
1374                                 qh->is_stopped = 0;
1375                                 return;
1376                         }
1377                         uhci_giveback_urb(uhci, qh, urb);
1378                         goto restart;
1379                 }
1380         }
1381         qh->is_stopped = 0;
1382
1383         /* There are no more dequeued URBs.  If there are still URBs on the
1384          * queue, the QH can now be re-activated. */
1385         if (!list_empty(&qh->queue)) {
1386                 if (qh->needs_fixup)
1387                         uhci_fixup_toggles(qh, 0);
1388
1389                 /* If the first URB on the queue wants FSBR but its time
1390                  * limit has expired, set the next TD to interrupt on
1391                  * completion before reactivating the QH. */
1392                 urbp = list_entry(qh->queue.next, struct urb_priv, node);
1393                 if (urbp->fsbr && qh->wait_expired) {
1394                         struct uhci_td *td = list_entry(urbp->td_list.next,
1395                                         struct uhci_td, list);
1396
1397                         td->status |= __cpu_to_le32(TD_CTRL_IOC);
1398                 }
1399
1400                 uhci_activate_qh(uhci, qh);
1401         }
1402
1403         /* The queue is empty.  The QH can become idle if it is fully
1404          * unlinked. */
1405         else if (QH_FINISHED_UNLINKING(qh))
1406                 uhci_make_qh_idle(uhci, qh);
1407 }
1408
1409 /*
1410  * Check for queues that have made some forward progress.
1411  * Returns 0 if the queue is not Isochronous, is ACTIVE, and
1412  * has not advanced since last examined; 1 otherwise.
1413  *
1414  * Early Intel controllers have a bug which causes qh->element sometimes
1415  * not to advance when a TD completes successfully.  The queue remains
1416  * stuck on the inactive completed TD.  We detect such cases and advance
1417  * the element pointer by hand.
1418  */
1419 static int uhci_advance_check(struct uhci_hcd *uhci, struct uhci_qh *qh)
1420 {
1421         struct urb_priv *urbp = NULL;
1422         struct uhci_td *td;
1423         int ret = 1;
1424         unsigned status;
1425
1426         if (qh->type == USB_ENDPOINT_XFER_ISOC)
1427                 goto done;
1428
1429         /* Treat an UNLINKING queue as though it hasn't advanced.
1430          * This is okay because reactivation will treat it as though
1431          * it has advanced, and if it is going to become IDLE then
1432          * this doesn't matter anyway.  Furthermore it's possible
1433          * for an UNLINKING queue not to have any URBs at all, or
1434          * for its first URB not to have any TDs (if it was dequeued
1435          * just as it completed).  So it's not easy in any case to
1436          * test whether such queues have advanced. */
1437         if (qh->state != QH_STATE_ACTIVE) {
1438                 urbp = NULL;
1439                 status = 0;
1440
1441         } else {
1442                 urbp = list_entry(qh->queue.next, struct urb_priv, node);
1443                 td = list_entry(urbp->td_list.next, struct uhci_td, list);
1444                 status = td_status(td);
1445                 if (!(status & TD_CTRL_ACTIVE)) {
1446
1447                         /* We're okay, the queue has advanced */
1448                         qh->wait_expired = 0;
1449                         qh->advance_jiffies = jiffies;
1450                         goto done;
1451                 }
1452                 ret = 0;
1453         }
1454
1455         /* The queue hasn't advanced; check for timeout */
1456         if (qh->wait_expired)
1457                 goto done;
1458
1459         if (time_after(jiffies, qh->advance_jiffies + QH_WAIT_TIMEOUT)) {
1460
1461                 /* Detect the Intel bug and work around it */
1462                 if (qh->post_td && qh_element(qh) ==
1463                                 cpu_to_le32(qh->post_td->dma_handle)) {
1464                         qh->element = qh->post_td->link;
1465                         qh->advance_jiffies = jiffies;
1466                         ret = 1;
1467                         goto done;
1468                 }
1469
1470                 qh->wait_expired = 1;
1471
1472                 /* If the current URB wants FSBR, unlink it temporarily
1473                  * so that we can safely set the next TD to interrupt on
1474                  * completion.  That way we'll know as soon as the queue
1475                  * starts moving again. */
1476                 if (urbp && urbp->fsbr && !(status & TD_CTRL_IOC))
1477                         uhci_unlink_qh(uhci, qh);
1478
1479         } else {
1480                 /* Unmoving but not-yet-expired queues keep FSBR alive */
1481                 if (urbp)
1482                         uhci_urbp_wants_fsbr(uhci, urbp);
1483         }
1484
1485 done:
1486         return ret;
1487 }
1488
1489 /*
1490  * Process events in the schedule, but only in one thread at a time
1491  */
1492 static void uhci_scan_schedule(struct uhci_hcd *uhci)
1493 {
1494         int i;
1495         struct uhci_qh *qh;
1496
1497         /* Don't allow re-entrant calls */
1498         if (uhci->scan_in_progress) {
1499                 uhci->need_rescan = 1;
1500                 return;
1501         }
1502         uhci->scan_in_progress = 1;
1503 rescan:
1504         uhci->need_rescan = 0;
1505         uhci->fsbr_is_wanted = 0;
1506
1507         uhci_clear_next_interrupt(uhci);
1508         uhci_get_current_frame_number(uhci);
1509         uhci->cur_iso_frame = uhci->frame_number;
1510
1511         /* Go through all the QH queues and process the URBs in each one */
1512         for (i = 0; i < UHCI_NUM_SKELQH - 1; ++i) {
1513                 uhci->next_qh = list_entry(uhci->skelqh[i]->node.next,
1514                                 struct uhci_qh, node);
1515                 while ((qh = uhci->next_qh) != uhci->skelqh[i]) {
1516                         uhci->next_qh = list_entry(qh->node.next,
1517                                         struct uhci_qh, node);
1518
1519                         if (uhci_advance_check(uhci, qh)) {
1520                                 uhci_scan_qh(uhci, qh);
1521                                 if (qh->state == QH_STATE_ACTIVE) {
1522                                         uhci_urbp_wants_fsbr(uhci,
1523         list_entry(qh->queue.next, struct urb_priv, node));
1524                                 }
1525                         }
1526                 }
1527         }
1528
1529         uhci->last_iso_frame = uhci->cur_iso_frame;
1530         if (uhci->need_rescan)
1531                 goto rescan;
1532         uhci->scan_in_progress = 0;
1533
1534         if (uhci->fsbr_is_on && !uhci->fsbr_is_wanted &&
1535                         !uhci->fsbr_expiring) {
1536                 uhci->fsbr_expiring = 1;
1537                 mod_timer(&uhci->fsbr_timer, jiffies + FSBR_OFF_DELAY);
1538         }
1539
1540         if (list_empty(&uhci->skel_unlink_qh->node))
1541                 uhci_clear_next_interrupt(uhci);
1542         else
1543                 uhci_set_next_interrupt(uhci);
1544 }