1 files changed, 55 insertions, 17 deletions

diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index 96ce4c87c871..7acc23473c63 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -763,6 +763,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
         wmb();
         qh->dummy_td->status |= __constant_cpu_to_le32(TD_CTRL_ACTIVE);
         qh->dummy_td = td;
+        qh->period = urb->interval;
 
         usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
                         usb_pipeout(urb->pipe), toggle);
@@ -790,14 +791,30 @@ static inline int uhci_submit_bulk(struct uhci_hcd *uhci, struct urb *urb,
         return ret;
 }
 
-static inline int uhci_submit_interrupt(struct uhci_hcd *uhci, struct urb *urb,
+static int uhci_submit_interrupt(struct uhci_hcd *uhci, struct urb *urb,
                 struct uhci_qh *qh)
 {
+        int exponent;
+
         /* USB 1.1 interrupt transfers only involve one packet per interval.
          * Drivers can submit URBs of any length, but longer ones will need
          * multiple intervals to complete.
          */
-        qh->skel = uhci->skelqh[__interval_to_skel(urb->interval)];
+
+        /* Figure out which power-of-two queue to use */
+        for (exponent = 7; exponent >= 0; --exponent) {
+                if ((1 << exponent) <= urb->interval)
+                        break;
+        }
+        if (exponent < 0)
+                return -EINVAL;
+        urb->interval = 1 << exponent;
+
+        if (qh->period == 0)
+                qh->skel = uhci->skelqh[UHCI_SKEL_INDEX(exponent)];
+        else if (qh->period != urb->interval)
+                return -EINVAL;         /* Can't change the period */
+
         return uhci_submit_common(uhci, urb, qh);
 }
 
@@ -937,31 +954,50 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
         unsigned long destination, status;
         struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
 
-        if (urb->number_of_packets > 900)       /* 900? Why? */
+        /* Values must not be too big (could overflow below) */
+        if (urb->interval >= UHCI_NUMFRAMES ||
+                        urb->number_of_packets >= UHCI_NUMFRAMES)
                 return -EFBIG;
 
-        status = TD_CTRL_ACTIVE | TD_CTRL_IOS;
-        destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
+        /* Check the period and figure out the starting frame number */
+        uhci_get_current_frame_number(uhci);
+        if (qh->period == 0) {
+                if (urb->transfer_flags & URB_ISO_ASAP) {
+                        urb->start_frame = uhci->frame_number + 10;
+                } else {
+                        i = urb->start_frame - uhci->frame_number;
+                        if (i <= 0 || i >= UHCI_NUMFRAMES)
+                                return -EINVAL;
+                }
+        } else if (qh->period != urb->interval) {
+                return -EINVAL;         /* Can't change the period */
 
-        /* Figure out the starting frame number */
-        if (urb->transfer_flags & URB_ISO_ASAP) {
+        } else {        /* Pick up where the last URB leaves off */
                 if (list_empty(&qh->queue)) {
-                        uhci_get_current_frame_number(uhci);
-                        urb->start_frame = (uhci->frame_number + 10);
-
-                } else {                /* Go right after the last one */
-                        struct urb *last_urb;
+                        frame = uhci->frame_number + 10;
+                } else {
+                        struct urb *lurb;
 
-                        last_urb = list_entry(qh->queue.prev,
+                        lurb = list_entry(qh->queue.prev,
                                         struct urb_priv, node)->urb;
-                        urb->start_frame = (last_urb->start_frame +
-                                        last_urb->number_of_packets *
-                                        last_urb->interval);
+                        frame = lurb->start_frame +
+                                        lurb->number_of_packets *
+                                        lurb->interval;
                 }
-        } else {
+                if (urb->transfer_flags & URB_ISO_ASAP)
+                        urb->start_frame = frame;
                 /* FIXME: Sanity check */
         }
 
+        /* Make sure we won't have to go too far into the future */
+        if (uhci_frame_before_eq(uhci->frame_number + UHCI_NUMFRAMES,
+                        urb->start_frame + urb->number_of_packets *
+                                urb->interval))
+                return -EFBIG;
+
+        status = TD_CTRL_ACTIVE | TD_CTRL_IOS;
+        destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
+
         for (i = 0; i < urb->number_of_packets; i++) {
                 td = uhci_alloc_td(uhci);
                 if (!td)
@@ -978,6 +1014,7 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
         td->status |= __constant_cpu_to_le32(TD_CTRL_IOC);
 
         qh->skel = uhci->skel_iso_qh;
+        qh->period = urb->interval;
 
         /* Add the TDs to the frame list */
         frame = urb->start_frame;
@@ -1206,6 +1243,7 @@ __acquires(uhci->lock)
                 uhci_unlink_qh(uhci, qh);
 
                 /* Bandwidth stuff not yet implemented */
+                qh->period = 0;
         }
 }