OpenWrt – Rev 1

Subversion Repositories:
Rev:
/*
 * ADM5120 HCD (Host Controller Driver) for USB
 *
 * Copyright (C) 2007-2008 Gabor Juhos <juhosg@openwrt.org>
 *
 * This file was derived from: drivers/usb/host/ohci-q.c
 *   (C) Copyright 1999 Roman Weissgaerber <weissg@vienna.at>
 *   (C) Copyright 2000-2002 David Brownell <dbrownell@users.sourceforge.net>
 *
 *  This program is free software; you can redistribute it and/or modify it
 *  under the terms of the GNU General Public License version 2 as published
 *  by the Free Software Foundation.
 *
 */

#include <linux/irq.h>
#include <linux/slab.h>

/*-------------------------------------------------------------------------*/

/*
 * URB goes back to driver, and isn't reissued.
 * It's completely gone from HC data structures.
 * PRECONDITION:  ahcd lock held, irqs blocked.
 */
static void
finish_urb(struct admhcd *ahcd, struct urb *urb, int status)
__releases(ahcd->lock)
__acquires(ahcd->lock)
{
        urb_priv_free(ahcd, urb->hcpriv);

        if (likely(status == -EINPROGRESS))
                status = 0;

        switch (usb_pipetype(urb->pipe)) {
        case PIPE_ISOCHRONOUS:
                admhcd_to_hcd(ahcd)->self.bandwidth_isoc_reqs--;
                break;
        case PIPE_INTERRUPT:
                admhcd_to_hcd(ahcd)->self.bandwidth_int_reqs--;
                break;
        }

#ifdef ADMHC_VERBOSE_DEBUG
        urb_print(ahcd, urb, "RET", usb_pipeout(urb->pipe), status);
#endif

        /* urb->complete() can reenter this HCD */
        usb_hcd_unlink_urb_from_ep(admhcd_to_hcd(ahcd), urb);
        spin_unlock(&ahcd->lock);
        usb_hcd_giveback_urb(admhcd_to_hcd(ahcd), urb, status);
        spin_lock(&ahcd->lock);
}


/*-------------------------------------------------------------------------*
 * ED handling functions
 *-------------------------------------------------------------------------*/

#if 0   /* FIXME */
/* search for the right schedule branch to use for a periodic ed.
 * does some load balancing; returns the branch, or negative errno.
 */
static int balance(struct admhcd *ahcd, int interval, int load)
{
        int     i, branch = -ENOSPC;

        /* iso periods can be huge; iso tds specify frame numbers */
        if (interval > NUM_INTS)
                interval = NUM_INTS;

        /* search for the least loaded schedule branch of that period
         * that has enough bandwidth left unreserved.
         */
        for (i = 0; i < interval ; i++) {
                if (branch < 0 || ahcd->load[branch] > ahcd->load[i]) {
                        int     j;

                        /* usb 1.1 says 90% of one frame */
                        for (j = i; j < NUM_INTS; j += interval) {
                                if ((ahcd->load[j] + load) > 900)
                                        break;
                        }
                        if (j < NUM_INTS)
                                continue;
                        branch = i;
                }
        }
        return branch;
}
#endif

/*-------------------------------------------------------------------------*/

#if 0   /* FIXME */
/* both iso and interrupt requests have periods; this routine puts them
 * into the schedule tree in the apppropriate place.  most iso devices use
 * 1msec periods, but that's not required.
 */
static void periodic_link(struct admhcd *ahcd, struct ed *ed)
{
        unsigned        i;

        admhc_vdbg(ahcd, "link %sed %p branch %d [%dus.], interval %d\n",
                (ed->hwINFO & cpu_to_hc32(ahcd, ED_ISO)) ? "iso " : "",
                ed, ed->branch, ed->load, ed->interval);

        for (i = ed->branch; i < NUM_INTS; i += ed->interval) {
                struct ed       **prev = &ahcd->periodic[i];
                __hc32          *prev_p = &ahcd->hcca->int_table[i];
                struct ed       *here = *prev;

                /* sorting each branch by period (slow before fast)
                 * lets us share the faster parts of the tree.
                 * (plus maybe: put interrupt eds before iso)
                 */
                while (here && ed != here) {
                        if (ed->interval > here->interval)
                                break;
                        prev = &here->ed_next;
                        prev_p = &here->hwNextED;
                        here = *prev;
                }
                if (ed != here) {
                        ed->ed_next = here;
                        if (here)
                                ed->hwNextED = *prev_p;
                        wmb();
                        *prev = ed;
                        *prev_p = cpu_to_hc32(ahcd, ed->dma);
                        wmb();
                }
                ahcd->load[i] += ed->load;
        }
        admhcd_to_hcd(ahcd)->self.bandwidth_allocated += ed->load / ed->interval;
}
#endif

/* link an ed into the HC chain */

static int ed_schedule(struct admhcd *ahcd, struct ed *ed)
{
        struct ed *old_tail;

        if (admhcd_to_hcd(ahcd)->state == HC_STATE_QUIESCING)
                return -EAGAIN;

        ed->state = ED_OPER;

        old_tail = ahcd->ed_tails[ed->type];

        ed->ed_next = old_tail->ed_next;
        if (ed->ed_next) {
                ed->ed_next->ed_prev = ed;
                ed->hwNextED = cpu_to_hc32(ahcd, ed->ed_next->dma);
        }
        ed->ed_prev = old_tail;

        old_tail->ed_next = ed;
        old_tail->hwNextED = cpu_to_hc32(ahcd, ed->dma);

        ahcd->ed_tails[ed->type] = ed;

        admhc_dma_enable(ahcd);

        return 0;
}

/*-------------------------------------------------------------------------*/

#if 0   /* FIXME */
/* scan the periodic table to find and unlink this ED */
static void periodic_unlink(struct admhcd *ahcd, struct ed *ed)
{
        int     i;

        for (i = ed->branch; i < NUM_INTS; i += ed->interval) {
                struct ed       *temp;
                struct ed       **prev = &ahcd->periodic[i];
                __hc32          *prev_p = &ahcd->hcca->int_table[i];

                while (*prev && (temp = *prev) != ed) {
                        prev_p = &temp->hwNextED;
                        prev = &temp->ed_next;
                }
                if (*prev) {
                        *prev_p = ed->hwNextED;
                        *prev = ed->ed_next;
                }
                ahcd->load[i] -= ed->load;
        }

        admhcd_to_hcd(ahcd)->self.bandwidth_allocated -= ed->load / ed->interval;
        admhc_vdbg(ahcd, "unlink %sed %p branch %d [%dus.], interval %d\n",
                (ed->hwINFO & cpu_to_hc32(ahcd, ED_ISO)) ? "iso " : "",
                ed, ed->branch, ed->load, ed->interval);
}
#endif

/* unlink an ed from the HC chain.
 * just the link to the ed is unlinked.
 * the link from the ed still points to another operational ed or 0
 * so the HC can eventually finish the processing of the unlinked ed
 * (assuming it already started that, which needn't be true).
 *
 * ED_UNLINK is a transient state: the HC may still see this ED, but soon
 * it won't.  ED_SKIP means the HC will finish its current transaction,
 * but won't start anything new.  The TD queue may still grow; device
 * drivers don't know about this HCD-internal state.
 *
 * When the HC can't see the ED, something changes ED_UNLINK to one of:
 *
 *  - ED_OPER: when there's any request queued, the ED gets rescheduled
 *    immediately.  HC should be working on them.
 *
 *  - ED_IDLE:  when there's no TD queue. there's no reason for the HC
 *    to care about this ED; safe to disable the endpoint.
 *
 * When finish_unlinks() runs later, after SOF interrupt, it will often
 * complete one or more URB unlinks before making that state change.
 */
static void ed_deschedule(struct admhcd *ahcd, struct ed *ed)
{

#ifdef ADMHC_VERBOSE_DEBUG
        admhc_dump_ed(ahcd, "ED-DESCHED", ed, 1);
#endif

        ed->hwINFO |= cpu_to_hc32(ahcd, ED_SKIP);
        wmb();
        ed->state = ED_UNLINK;

        /* remove this ED from the HC list */
        ed->ed_prev->hwNextED = ed->hwNextED;

        /* and remove it from our list also */
        ed->ed_prev->ed_next = ed->ed_next;

        if (ed->ed_next)
                ed->ed_next->ed_prev = ed->ed_prev;

        if (ahcd->ed_tails[ed->type] == ed)
                ahcd->ed_tails[ed->type] = ed->ed_prev;
}

/*-------------------------------------------------------------------------*/

static struct ed *ed_create(struct admhcd *ahcd, unsigned int type, u32 info)
{
        struct ed *ed;
        struct td *td;

        ed = ed_alloc(ahcd, GFP_ATOMIC);
        if (!ed)
                goto err;

        /* dummy td; end of td list for this ed */
        td = td_alloc(ahcd, GFP_ATOMIC);
        if (!td)
                goto err_free_ed;

        switch (type) {
        case PIPE_INTERRUPT:
                info |= ED_INT;
                break;
        case PIPE_ISOCHRONOUS:
                info |= ED_ISO;
                break;
        }

        ed->dummy = td;
        ed->state = ED_IDLE;
        ed->type = type;

        ed->hwINFO = cpu_to_hc32(ahcd, info);
        ed->hwTailP = cpu_to_hc32(ahcd, td->td_dma);
        ed->hwHeadP = ed->hwTailP;      /* ED_C, ED_H zeroed */

        return ed;

err_free_ed:
        ed_free(ahcd, ed);
err:
        return NULL;
}

/* get and maybe (re)init an endpoint. init _should_ be done only as part
 * of enumeration, usb_set_configuration() or usb_set_interface().
 */
static struct ed *ed_get(struct admhcd *ahcd,   struct usb_host_endpoint *ep,
        struct usb_device *udev, unsigned int pipe, int interval)
{
        struct ed               *ed;
        unsigned long           flags;

        spin_lock_irqsave(&ahcd->lock, flags);

        ed = ep->hcpriv;
        if (!ed) {
                u32             info;

                /* FIXME: usbcore changes dev->devnum before SET_ADDRESS
                 * succeeds ... otherwise we wouldn't need "pipe".
                 */
                info = usb_pipedevice(pipe);
                info |= (ep->desc.bEndpointAddress & ~USB_DIR_IN) << ED_EN_SHIFT;
                info |= le16_to_cpu(ep->desc.wMaxPacketSize) << ED_MPS_SHIFT;
                if (udev->speed == USB_SPEED_FULL)
                        info |= ED_SPEED_FULL;

                ed = ed_create(ahcd, usb_pipetype(pipe), info);
                if (ed)
                        ep->hcpriv = ed;
        }

        spin_unlock_irqrestore(&ahcd->lock, flags);

        return ed;
}

/*-------------------------------------------------------------------------*/

/* request unlinking of an endpoint from an operational HC.
 * put the ep on the rm_list
 * real work is done at the next start frame (SOFI) hardware interrupt
 * caller guarantees HCD is running, so hardware access is safe,
 * and that ed->state is ED_OPER
 */
static void start_ed_unlink(struct admhcd *ahcd, struct ed *ed)
{

#ifdef ADMHC_VERBOSE_DEBUG
        admhc_dump_ed(ahcd, "ED-UNLINK", ed, 1);
#endif

        ed->hwINFO |= cpu_to_hc32(ahcd, ED_DEQUEUE);
        ed_deschedule(ahcd, ed);

        /* add this ED into the remove list */
        ed->ed_rm_next = ahcd->ed_rm_list;
        ahcd->ed_rm_list = ed;

        /* enable SOF interrupt */
        admhc_intr_ack(ahcd, ADMHC_INTR_SOFI);
        admhc_intr_enable(ahcd, ADMHC_INTR_SOFI);
        /* flush those writes */
        admhc_writel_flush(ahcd);

        /* SOF interrupt might get delayed; record the frame counter value that
         * indicates when the HC isn't looking at it, so concurrent unlinks
         * behave.  frame_no wraps every 2^16 msec, and changes right before
         * SOF is triggered.
         */
        ed->tick = admhc_frame_no(ahcd) + 1;
}

/*-------------------------------------------------------------------------*
 * TD handling functions
 *-------------------------------------------------------------------------*/

/* enqueue next TD for this URB (OHCI spec 5.2.8.2) */

static void
td_fill(struct admhcd *ahcd, u32 info, dma_addr_t data, int len,
        struct urb *urb, int index)
{
        struct td               *td, *td_pt;
        struct urb_priv         *urb_priv = urb->hcpriv;
        int                     hash;
        u32                     cbl = 0;

#if 1
        if (index == (urb_priv->td_cnt - 1) &&
                        ((urb->transfer_flags & URB_NO_INTERRUPT) == 0))
                cbl |= TD_IE;
#else
        if (index == (urb_priv->td_cnt - 1))
                cbl |= TD_IE;
#endif

        /* use this td as the next dummy */
        td_pt = urb_priv->td[index];

        /* fill the old dummy TD */
        td = urb_priv->td[index] = urb_priv->ed->dummy;
        urb_priv->ed->dummy = td_pt;

        td->ed = urb_priv->ed;
        td->next_dl_td = NULL;
        td->index = index;
        td->urb = urb;
        td->data_dma = data;
        if (!len)
                data = 0;

        if (data)
                cbl |= (len & TD_BL_MASK);

        info |= TD_OWN;

        /* setup hardware specific fields */
        td->hwINFO = cpu_to_hc32(ahcd, info);
        td->hwDBP = cpu_to_hc32(ahcd, data);
        td->hwCBL = cpu_to_hc32(ahcd, cbl);
        td->hwNextTD = cpu_to_hc32(ahcd, td_pt->td_dma);

        /* append to queue */
        list_add_tail(&td->td_list, &td->ed->td_list);

        /* hash it for later reverse mapping */
        hash = TD_HASH_FUNC(td->td_dma);
        td->td_hash = ahcd->td_hash[hash];
        ahcd->td_hash[hash] = td;

        /* HC might read the TD (or cachelines) right away ... */
        wmb();
        td->ed->hwTailP = td->hwNextTD;
}

/*-------------------------------------------------------------------------*/

/* Prepare all TDs of a transfer, and queue them onto the ED.
 * Caller guarantees HC is active.
 * Usually the ED is already on the schedule, so TDs might be
 * processed as soon as they're queued.
 */
static void td_submit_urb(struct admhcd *ahcd, struct urb *urb)
{
        struct urb_priv *urb_priv = urb->hcpriv;
        dma_addr_t      data;
        int             data_len = urb->transfer_buffer_length;
        int             cnt = 0;
        u32             info = 0;
        int             is_out = usb_pipeout(urb->pipe);
        u32             toggle = 0;

        /* OHCI handles the bulk/interrupt data toggles itself.  We just
         * use the device toggle bits for resetting, and rely on the fact
         * that resetting toggle is meaningless if the endpoint is active.
         */

        if (usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe), is_out)) {
                toggle = TD_T_CARRY;
        } else {
                toggle = TD_T_DATA0;
                usb_settoggle(urb->dev, usb_pipeendpoint (urb->pipe),
                        is_out, 1);
        }

        urb_priv->td_idx = 0;
        list_add(&urb_priv->pending, &ahcd->pending);

        if (data_len)
                data = urb->transfer_dma;
        else
                data = 0;

        /* NOTE:  TD_CC is set so we can tell which TDs the HC processed by
         * using TD_CC_GET, as well as by seeing them on the done list.
         * (CC = NotAccessed ... 0x0F, or 0x0E in PSWs for ISO.)
         */
        switch (urb_priv->ed->type) {
        case PIPE_INTERRUPT:
                info = is_out
                        ? TD_T_CARRY | TD_SCC_NOTACCESSED | TD_DP_OUT
                        : TD_T_CARRY | TD_SCC_NOTACCESSED | TD_DP_IN;

                /* setup service interval and starting frame number */
                info |= (urb->start_frame & TD_FN_MASK);
                info |= (urb->interval & TD_ISI_MASK) << TD_ISI_SHIFT;

                td_fill(ahcd, info, data, data_len, urb, cnt);
                cnt++;

                admhcd_to_hcd(ahcd)->self.bandwidth_int_reqs++;
                break;

        case PIPE_BULK:
                info = is_out
                        ? TD_SCC_NOTACCESSED | TD_DP_OUT
                        : TD_SCC_NOTACCESSED | TD_DP_IN;

                /* TDs _could_ transfer up to 8K each */
                while (data_len > TD_DATALEN_MAX) {
                        td_fill(ahcd, info | ((cnt) ? TD_T_CARRY : toggle),
                                data, TD_DATALEN_MAX, urb, cnt);
                        data += TD_DATALEN_MAX;
                        data_len -= TD_DATALEN_MAX;
                        cnt++;
                }

                td_fill(ahcd, info | ((cnt) ? TD_T_CARRY : toggle), data,
                        data_len, urb, cnt);
                cnt++;

                if ((urb->transfer_flags & URB_ZERO_PACKET)
                                && (cnt < urb_priv->td_cnt)) {
                        td_fill(ahcd, info | ((cnt) ? TD_T_CARRY : toggle),
                                0, 0, urb, cnt);
                        cnt++;
                }
                break;

        /* control manages DATA0/DATA1 toggle per-request; SETUP resets it,
         * any DATA phase works normally, and the STATUS ack is special.
         */
        case PIPE_CONTROL:
                /* fill a TD for the setup */
                info = TD_SCC_NOTACCESSED | TD_DP_SETUP | TD_T_DATA0;
                td_fill(ahcd, info, urb->setup_dma, 8, urb, cnt++);

                if (data_len > 0) {
                        /* fill a TD for the data */
                        info = TD_SCC_NOTACCESSED | TD_T_DATA1;
                        info |= is_out ? TD_DP_OUT : TD_DP_IN;
                        /* NOTE:  mishandles transfers >8K, some >4K */
                        td_fill(ahcd, info, data, data_len, urb, cnt++);
                }

                /* fill a TD for the ACK */
                info = (is_out || data_len == 0)
                        ? TD_SCC_NOTACCESSED | TD_DP_IN | TD_T_DATA1
                        : TD_SCC_NOTACCESSED | TD_DP_OUT | TD_T_DATA1;
                td_fill(ahcd, info, data, 0, urb, cnt++);

                break;

        /* ISO has no retransmit, so no toggle;
         * Each TD could handle multiple consecutive frames (interval 1);
         * we could often reduce the number of TDs here.
         */
        case PIPE_ISOCHRONOUS:
                info = is_out
                        ? TD_T_CARRY | TD_SCC_NOTACCESSED | TD_DP_OUT
                        : TD_T_CARRY | TD_SCC_NOTACCESSED | TD_DP_IN;

                for (cnt = 0; cnt < urb->number_of_packets; cnt++) {
                        int frame = urb->start_frame;

                        frame += cnt * urb->interval;
                        frame &= TD_FN_MASK;
                        td_fill(ahcd, info | frame,
                                data + urb->iso_frame_desc[cnt].offset,
                                urb->iso_frame_desc[cnt].length, urb, cnt);
                }
                admhcd_to_hcd(ahcd)->self.bandwidth_isoc_reqs++;
                break;
        }

        if (urb_priv->td_cnt != cnt)
                admhc_err(ahcd, "bad number of tds created for urb %p\n", urb);
}

/*-------------------------------------------------------------------------*
 * Done List handling functions
 *-------------------------------------------------------------------------*/

/* calculate transfer length/status and update the urb */
static int td_done(struct admhcd *ahcd, struct urb *urb, struct td *td)
{
        struct urb_priv *urb_priv = urb->hcpriv;
        u32     info;
        u32     bl;
        u32     tdDBP;
        int     type = usb_pipetype(urb->pipe);
        int     cc;
        int     status = -EINPROGRESS;

        info = hc32_to_cpup(ahcd, &td->hwINFO);
        tdDBP = hc32_to_cpup(ahcd, &td->hwDBP);
        bl = TD_BL_GET(hc32_to_cpup(ahcd, &td->hwCBL));
        cc = TD_CC_GET(info);

        /* ISO ... drivers see per-TD length/status */
        if (type == PIPE_ISOCHRONOUS) {
                /* TODO */
                int     dlen = 0;

                /* NOTE:  assumes FC in tdINFO == 0, and that
                 * only the first of 0..MAXPSW psws is used.
                 */
                if (info & TD_CC)       /* hc didn't touch? */
                        return status;

                if (usb_pipeout(urb->pipe))
                        dlen = urb->iso_frame_desc[td->index].length;
                else {
                        /* short reads are always OK for ISO */
                        if (cc == TD_CC_DATAUNDERRUN)
                                cc = TD_CC_NOERROR;
                        dlen = tdDBP - td->data_dma + bl;
                }

                urb->actual_length += dlen;
                urb->iso_frame_desc[td->index].actual_length = dlen;
                urb->iso_frame_desc[td->index].status = cc_to_error[cc];

                if (cc != TD_CC_NOERROR)
                        admhc_vdbg(ahcd,
                                "urb %p iso td %p (%d) len %d cc %d\n",
                                urb, td, 1 + td->index, dlen, cc);

        /* BULK, INT, CONTROL ... drivers see aggregate length/status,
         * except that "setup" bytes aren't counted and "short" transfers
         * might not be reported as errors.
         */
        } else {
                /* update packet status if needed (short is normally ok) */
                if (cc == TD_CC_DATAUNDERRUN
                                && !(urb->transfer_flags & URB_SHORT_NOT_OK))
                        cc = TD_CC_NOERROR;

                if (cc != TD_CC_NOERROR && cc < TD_CC_HCD0)
                        status = cc_to_error[cc];


                /* count all non-empty packets except control SETUP packet */
                if ((type != PIPE_CONTROL || td->index != 0) && tdDBP != 0)
                        urb->actual_length += tdDBP - td->data_dma + bl;

                if (cc != TD_CC_NOERROR && cc < TD_CC_HCD0)
                        admhc_vdbg(ahcd,
                                "urb %p td %p (%d) cc %d, len=%d/%d\n",
                                urb, td, td->index, cc,
                                urb->actual_length,
                                urb->transfer_buffer_length);
        }

        list_del(&td->td_list);
        urb_priv->td_idx++;

        return status;
}

/*-------------------------------------------------------------------------*/

static void ed_halted(struct admhcd *ahcd, struct td *td, int cc)
{
        struct urb              *urb = td->urb;
        struct urb_priv         *urb_priv = urb->hcpriv;
        struct ed               *ed = td->ed;
        struct list_head        *tmp = td->td_list.next;
        __hc32                  toggle = ed->hwHeadP & cpu_to_hc32(ahcd, ED_C);

        admhc_dump_ed(ahcd, "ed halted", td->ed, 1);
        /* clear ed halt; this is the td that caused it, but keep it inactive
         * until its urb->complete() has a chance to clean up.
         */
        ed->hwINFO |= cpu_to_hc32(ahcd, ED_SKIP);
        wmb();
        ed->hwHeadP &= ~cpu_to_hc32(ahcd, ED_H);

        /* Get rid of all later tds from this urb. We don't have
         * to be careful: no errors and nothing was transferred.
         * Also patch the ed so it looks as if those tds completed normally.
         */
        while (tmp != &ed->td_list) {
                struct td       *next;

                next = list_entry(tmp, struct td, td_list);
                tmp = next->td_list.next;

                if (next->urb != urb)
                        break;

                /* NOTE: if multi-td control DATA segments get supported,
                 * this urb had one of them, this td wasn't the last td
                 * in that segment (TD_R clear), this ed halted because
                 * of a short read, _and_ URB_SHORT_NOT_OK is clear ...
                 * then we need to leave the control STATUS packet queued
                 * and clear ED_SKIP.
                 */
                list_del(&next->td_list);
                urb_priv->td_cnt++;
                ed->hwHeadP = next->hwNextTD | toggle;
        }

        /* help for troubleshooting:  report anything that
         * looks odd ... that doesn't include protocol stalls
         * (or maybe some other things)
         */
        switch (cc) {
        case TD_CC_DATAUNDERRUN:
                if ((urb->transfer_flags & URB_SHORT_NOT_OK) == 0)
                        break;
                /* fallthrough */
        case TD_CC_STALL:
                if (usb_pipecontrol(urb->pipe))
                        break;
                /* fallthrough */
        default:
                admhc_dbg(ahcd,
                        "urb %p path %s ep%d%s %08x cc %d --> status %d\n",
                        urb, urb->dev->devpath,
                        usb_pipeendpoint (urb->pipe),
                        usb_pipein(urb->pipe) ? "in" : "out",
                        hc32_to_cpu(ahcd, td->hwINFO),
                        cc, cc_to_error[cc]);
        }
}

/*-------------------------------------------------------------------------*/

/* there are some urbs/eds to unlink; called in_irq(), with HCD locked */
static void
finish_unlinks(struct admhcd *ahcd, u16 tick)
{
        struct ed       *ed, **last;

rescan_all:
        for (last = &ahcd->ed_rm_list, ed = *last; ed != NULL; ed = *last) {
                struct list_head        *entry, *tmp;
                int                     completed, modified;
                __hc32                  *prev;

                /* only take off EDs that the HC isn't using, accounting for
                 * frame counter wraps and EDs with partially retired TDs
                 */
                if (likely(HC_IS_RUNNING(admhcd_to_hcd(ahcd)->state))) {
                        if (tick_before(tick, ed->tick)) {
skip_ed:
                                last = &ed->ed_rm_next;
                                continue;
                        }
#if 0
                        if (!list_empty(&ed->td_list)) {
                                struct td       *td;
                                u32             head;

                                td = list_entry(ed->td_list.next, struct td,
                                                        td_list);
                                head = hc32_to_cpu(ahcd, ed->hwHeadP) &
                                                                TD_MASK;

                                /* INTR_WDH may need to clean up first */
                                if (td->td_dma != head)
                                        goto skip_ed;
                        }
#endif
                }

                /* reentrancy:  if we drop the schedule lock, someone might
                 * have modified this list.  normally it's just prepending
                 * entries (which we'd ignore), but paranoia won't hurt.
                 */
                *last = ed->ed_rm_next;
                ed->ed_rm_next = NULL;
                modified = 0;

                /* unlink urbs as requested, but rescan the list after
                 * we call a completion since it might have unlinked
                 * another (earlier) urb
                 *
                 * When we get here, the HC doesn't see this ed.  But it
                 * must not be rescheduled until all completed URBs have
                 * been given back to the driver.
                 */
rescan_this:
                completed = 0;
                prev = &ed->hwHeadP;
                list_for_each_safe(entry, tmp, &ed->td_list) {
                        struct td       *td;
                        struct urb      *urb;
                        struct urb_priv *urb_priv;
                        __hc32          savebits;
                        u32             tdINFO;
                        int             status;

                        td = list_entry(entry, struct td, td_list);
                        urb = td->urb;
                        urb_priv = td->urb->hcpriv;

                        if (!urb->unlinked) {
                                prev = &td->hwNextTD;
                                continue;
                        }

                        if ((urb_priv) == NULL)
                                continue;

                        /* patch pointer hc uses */
                        savebits = *prev & ~cpu_to_hc32(ahcd, TD_MASK);
                        *prev = td->hwNextTD | savebits;
                        /* If this was unlinked, the TD may not have been
                         * retired ... so manually save dhe data toggle.
                         * The controller ignores the value we save for
                         * control and ISO endpoints.
                         */
                        tdINFO = hc32_to_cpup(ahcd, &td->hwINFO);
                        if ((tdINFO & TD_T) == TD_T_DATA0)
                                ed->hwHeadP &= ~cpu_to_hc32(ahcd, ED_C);
                        else if ((tdINFO & TD_T) == TD_T_DATA1)
                                ed->hwHeadP |= cpu_to_hc32(ahcd, ED_C);

                        /* HC may have partly processed this TD */
#ifdef ADMHC_VERBOSE_DEBUG
                        urb_print(ahcd, urb, "PARTIAL", 0);
#endif
                        status = td_done(ahcd, urb, td);

                        /* if URB is done, clean up */
                        if (urb_priv->td_idx == urb_priv->td_cnt) {
                                modified = completed = 1;
                                finish_urb(ahcd, urb, status);
                        }
                }
                if (completed && !list_empty(&ed->td_list))
                        goto rescan_this;

                /* ED's now officially unlinked, hc doesn't see */
                ed->state = ED_IDLE;
                ed->hwHeadP &= ~cpu_to_hc32(ahcd, ED_H);
                ed->hwNextED = 0;
                wmb();
                ed->hwINFO &= ~cpu_to_hc32(ahcd, ED_SKIP | ED_DEQUEUE);

                /* but if there's work queued, reschedule */
                if (!list_empty(&ed->td_list)) {
                        if (HC_IS_RUNNING(admhcd_to_hcd(ahcd)->state))
                                ed_schedule(ahcd, ed);
                }

                if (modified)
                        goto rescan_all;
        }
}

/*-------------------------------------------------------------------------*/
/*
 * Process normal completions (error or success) and clean the schedules.
 *
 * This is the main path for handing urbs back to drivers.  The only other
 * normal path is finish_unlinks(), which unlinks URBs using ed_rm_list,
 * instead of scanning the (re-reversed) donelist as this does.
 */

static void ed_unhalt(struct admhcd *ahcd, struct ed *ed, struct urb *urb)
{
        struct list_head *entry, *tmp;
        __hc32 toggle = ed->hwHeadP & cpu_to_hc32(ahcd, ED_C);

#ifdef ADMHC_VERBOSE_DEBUG
        admhc_dump_ed(ahcd, "UNHALT", ed, 0);
#endif
        /* clear ed halt; this is the td that caused it, but keep it inactive
         * until its urb->complete() has a chance to clean up.
         */
        ed->hwINFO |= cpu_to_hc32(ahcd, ED_SKIP);
        wmb();
        ed->hwHeadP &= ~cpu_to_hc32(ahcd, ED_H);

        list_for_each_safe(entry, tmp, &ed->td_list) {
                struct td *td = list_entry(entry, struct td, td_list);
                __hc32 info;

                if (td->urb != urb)
                        break;

                info = td->hwINFO;
                info &= ~cpu_to_hc32(ahcd, TD_CC | TD_OWN);
                td->hwINFO = info;

                ed->hwHeadP = td->hwNextTD | toggle;
                wmb();
        }

}

static void ed_intr_refill(struct admhcd *ahcd, struct ed *ed)
{
        __hc32 toggle = ed->hwHeadP & cpu_to_hc32(ahcd, ED_C);

        ed->hwHeadP = ed->hwTailP | toggle;
}


static inline int is_ed_halted(struct admhcd *ahcd, struct ed *ed)
{
        return ((hc32_to_cpup(ahcd, &ed->hwHeadP) & ED_H) == ED_H);
}

static inline int is_td_halted(struct admhcd *ahcd, struct ed *ed,
                struct td *td)
{
        return ((hc32_to_cpup(ahcd, &ed->hwHeadP) & TD_MASK) ==
                (hc32_to_cpup(ahcd, &td->hwNextTD) & TD_MASK));
}

static void ed_update(struct admhcd *ahcd, struct ed *ed)
{
        struct list_head *entry, *tmp;

#ifdef ADMHC_VERBOSE_DEBUG
        admhc_dump_ed(ahcd, "UPDATE", ed, 1);
#endif

        list_for_each_safe(entry, tmp, &ed->td_list) {
                struct td *td = list_entry(entry, struct td, td_list);
                struct urb *urb = td->urb;
                struct urb_priv *urb_priv = urb->hcpriv;
                int status;

                if (hc32_to_cpup(ahcd, &td->hwINFO) & TD_OWN)
                        break;

                /* update URB's length and status from TD */
                status = td_done(ahcd, urb, td);
                if (is_ed_halted(ahcd, ed) && is_td_halted(ahcd, ed, td))
                        ed_unhalt(ahcd, ed, urb);

                if (ed->type == PIPE_INTERRUPT)
                        ed_intr_refill(ahcd, ed);

                /* If all this urb's TDs are done, call complete() */
                if (urb_priv->td_idx == urb_priv->td_cnt)
                        finish_urb(ahcd, urb, status);

                /* clean schedule:  unlink EDs that are no longer busy */
                if (list_empty(&ed->td_list)) {
                        if (ed->state == ED_OPER)
                                start_ed_unlink(ahcd, ed);

                /* ... reenabling halted EDs only after fault cleanup */
                } else if ((ed->hwINFO & cpu_to_hc32(ahcd,
                                                ED_SKIP | ED_DEQUEUE))
                                        == cpu_to_hc32(ahcd, ED_SKIP)) {
                        td = list_entry(ed->td_list.next, struct td, td_list);
#if 0
                        if (!(td->hwINFO & cpu_to_hc32(ahcd, TD_DONE))) {
                                ed->hwINFO &= ~cpu_to_hc32(ahcd, ED_SKIP);
                                /* ... hc may need waking-up */
                                switch (ed->type) {
                                case PIPE_CONTROL:
                                        admhc_writel(ahcd, OHCI_CLF,
                                                &ahcd->regs->cmdstatus);
                                        break;
                                case PIPE_BULK:
                                        admhc_writel(ahcd, OHCI_BLF,
                                                &ahcd->regs->cmdstatus);
                                        break;
                                }
                        }
#else
                        if ((td->hwINFO & cpu_to_hc32(ahcd, TD_OWN)))
                                ed->hwINFO &= ~cpu_to_hc32(ahcd, ED_SKIP);
#endif
                }

        }
}

/* there are some tds completed; called in_irq(), with HCD locked */
static void admhc_td_complete(struct admhcd *ahcd)
{
        struct ed       *ed;

        for (ed = ahcd->ed_head; ed; ed = ed->ed_next) {
                if (ed->state != ED_OPER)
                        continue;

                ed_update(ahcd, ed);
        }
}