5 files changed, 253 insertions, 75 deletions

diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 6edf4097d2d2..d673cb9c36b1 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -81,7 +81,6 @@ static void ohci_dump (struct ohci_hcd *ohci, int verbose);
 static int ohci_init (struct ohci_hcd *ohci);
 static void ohci_stop (struct usb_hcd *hcd);
 static int ohci_restart (struct ohci_hcd *ohci);
-static void ohci_quirk_nec_worker (struct work_struct *work);
 
 #include "ohci-hub.c"
 #include "ohci-dbg.c"
@@ -314,6 +313,8 @@ rescan:
         if (!HC_IS_RUNNING (hcd->state)) {
 sanitize:
                 ed->state = ED_IDLE;
+                if (quirk_zfmicro(ohci) && ed->type == PIPE_INTERRUPT)
+                        ohci->eds_scheduled--;
                 finish_unlinks (ohci, 0);
         }
 
@@ -321,7 +322,12 @@ sanitize:
         case ED_UNLINK:         /* wait for hw to finish? */
                 /* major IRQ delivery trouble loses INTR_SF too... */
                 if (limit-- == 0) {
-                        ohci_warn (ohci, "IRQ INTR_SF lossage\n");
+                        ohci_warn(ohci, "ED unlink timeout\n");
+                        if (quirk_zfmicro(ohci)) {
+                                ohci_warn(ohci, "Attempting ZF TD recovery\n");
+                                ohci->ed_to_check = ed;
+                                ohci->zf_delay = 2;
+                        }
                         goto sanitize;
                 }
                 spin_unlock_irqrestore (&ohci->lock, flags);
@@ -379,6 +385,93 @@ ohci_shutdown (struct usb_hcd *hcd)
         (void) ohci_readl (ohci, &ohci->regs->control);
 }
 
+static int check_ed(struct ohci_hcd *ohci, struct ed *ed)
+{
+        return (hc32_to_cpu(ohci, ed->hwINFO) & ED_IN) != 0
+                && (hc32_to_cpu(ohci, ed->hwHeadP) & TD_MASK)
+                        == (hc32_to_cpu(ohci, ed->hwTailP) & TD_MASK)
+                && !list_empty(&ed->td_list);
+}
+
+/* ZF Micro watchdog timer callback. The ZF Micro chipset sometimes completes
+ * an interrupt TD but neglects to add it to the donelist.  On systems with
+ * this chipset, we need to periodically check the state of the queues to look
+ * for such "lost" TDs.
+ */
+static void unlink_watchdog_func(unsigned long _ohci)
+{
+        long            flags;
+        unsigned        max;
+        unsigned        seen_count = 0;
+        unsigned        i;
+        struct ed       **seen = NULL;
+        struct ohci_hcd *ohci = (struct ohci_hcd *) _ohci;
+
+        spin_lock_irqsave(&ohci->lock, flags);
+        max = ohci->eds_scheduled;
+        if (!max)
+                goto done;
+
+        if (ohci->ed_to_check)
+                goto out;
+
+        seen = kcalloc(max, sizeof *seen, GFP_ATOMIC);
+        if (!seen)
+                goto out;
+
+        for (i = 0; i < NUM_INTS; i++) {
+                struct ed       *ed = ohci->periodic[i];
+
+                while (ed) {
+                        unsigned        temp;
+
+                        /* scan this branch of the periodic schedule tree */
+                        for (temp = 0; temp < seen_count; temp++) {
+                                if (seen[temp] == ed) {
+                                        /* we've checked it and what's after */
+                                        ed = NULL;
+                                        break;
+                                }
+                        }
+                        if (!ed)
+                                break;
+                        seen[seen_count++] = ed;
+                        if (!check_ed(ohci, ed)) {
+                                ed = ed->ed_next;
+                                continue;
+                        }
+
+                        /* HC's TD list is empty, but HCD sees at least one
+                         * TD that's not been sent through the donelist.
+                         */
+                        ohci->ed_to_check = ed;
+                        ohci->zf_delay = 2;
+
+                        /* The HC may wait until the next frame to report the
+                         * TD as done through the donelist and INTR_WDH.  (We
+                         * just *assume* it's not a multi-TD interrupt URB;
+                         * those could defer the IRQ more than one frame, using
+                         * DI...)  Check again after the next INTR_SF.
+                         */
+                        ohci_writel(ohci, OHCI_INTR_SF,
+                                        &ohci->regs->intrstatus);
+                        ohci_writel(ohci, OHCI_INTR_SF,
+                                        &ohci->regs->intrenable);
+
+                        /* flush those writes */
+                        (void) ohci_readl(ohci, &ohci->regs->control);
+
+                        goto out;
+                }
+        }
+out:
+        kfree(seen);
+        if (ohci->eds_scheduled)
+                mod_timer(&ohci->unlink_watchdog, round_jiffies_relative(HZ));
+done:
+        spin_unlock_irqrestore(&ohci->lock, flags);
+}
+
 /*-------------------------------------------------------------------------*
  * HC functions
  *-------------------------------------------------------------------------*/
@@ -616,6 +709,15 @@ retry:
         mdelay ((temp >> 23) & 0x1fe);
         hcd->state = HC_STATE_RUNNING;
 
+        if (quirk_zfmicro(ohci)) {
+                /* Create timer to watch for bad queue state on ZF Micro */
+                setup_timer(&ohci->unlink_watchdog, unlink_watchdog_func,
+                                (unsigned long) ohci);
+
+                ohci->eds_scheduled = 0;
+                ohci->ed_to_check = NULL;
+        }
+
         ohci_dump (ohci, 1);
 
         return 0;
@@ -629,10 +731,11 @@ static irqreturn_t ohci_irq (struct usb_hcd *hcd)
 {
         struct ohci_hcd         *ohci = hcd_to_ohci (hcd);
         struct ohci_regs __iomem *regs = ohci->regs;
-        int                     ints; 
+        int                     ints;
 
         /* we can eliminate a (slow) ohci_readl()
-           if _only_ WDH caused this irq */
+         * if _only_ WDH caused this irq
+         */
         if ((ohci->hcca->done_head != 0)
                         && ! (hc32_to_cpup (ohci, &ohci->hcca->done_head)
                                 & 0x01)) {
@@ -651,7 +754,7 @@ static irqreturn_t ohci_irq (struct usb_hcd *hcd)
 
         if (ints & OHCI_INTR_UE) {
                 // e.g. due to PCI Master/Target Abort
-                if (ohci->flags & OHCI_QUIRK_NEC) {
+                if (quirk_nec(ohci)) {
                         /* Workaround for a silicon bug in some NEC chips used
                          * in Apple's PowerBooks. Adapted from Darwin code.
                          */
@@ -713,6 +816,31 @@ static irqreturn_t ohci_irq (struct usb_hcd *hcd)
                         ohci_writel (ohci, OHCI_INTR_WDH, &regs->intrenable);
         }
 
+        if (quirk_zfmicro(ohci) && (ints & OHCI_INTR_SF)) {
+                spin_lock(&ohci->lock);
+                if (ohci->ed_to_check) {
+                        struct ed *ed = ohci->ed_to_check;
+
+                        if (check_ed(ohci, ed)) {
+                                /* HC thinks the TD list is empty; HCD knows
+                                 * at least one TD is outstanding
+                                 */
+                                if (--ohci->zf_delay == 0) {
+                                        struct td *td = list_entry(
+                                                ed->td_list.next,
+                                                struct td, td_list);
+                                        ohci_warn(ohci,
+                                                  "Reclaiming orphan TD %p\n",
+                                                  td);
+                                        takeback_td(ohci, td);
+                                        ohci->ed_to_check = NULL;
+                                }
+                        } else
+                                ohci->ed_to_check = NULL;
+                }
+                spin_unlock(&ohci->lock);
+        }
+
         /* could track INTR_SO to reduce available PCI/... bandwidth */
 
         /* handle any pending URB/ED unlinks, leaving INTR_SF enabled
@@ -721,7 +849,9 @@ static irqreturn_t ohci_irq (struct usb_hcd *hcd)
         spin_lock (&ohci->lock);
         if (ohci->ed_rm_list)
                 finish_unlinks (ohci, ohci_frame_no(ohci));
-        if ((ints & OHCI_INTR_SF) != 0 && !ohci->ed_rm_list
+        if ((ints & OHCI_INTR_SF) != 0
+                        && !ohci->ed_rm_list
+                        && !ohci->ed_to_check
                         && HC_IS_RUNNING(hcd->state))
                 ohci_writel (ohci, OHCI_INTR_SF, &regs->intrdisable);
         spin_unlock (&ohci->lock);
@@ -751,6 +881,9 @@ static void ohci_stop (struct usb_hcd *hcd)
         free_irq(hcd->irq, hcd);
         hcd->irq = -1;
 
+        if (quirk_zfmicro(ohci))
+                del_timer(&ohci->unlink_watchdog);
+
         remove_debug_files (ohci);
         ohci_mem_cleanup (ohci);
         if (ohci->hcca) {
@@ -828,27 +961,6 @@ static int ohci_restart (struct ohci_hcd *ohci)
 
 /*-------------------------------------------------------------------------*/
 
-/* NEC workaround */
-static void ohci_quirk_nec_worker(struct work_struct *work)
-{
-        struct ohci_hcd *ohci = container_of(work, struct ohci_hcd, nec_work);
-        int status;
-
-        status = ohci_init(ohci);
-        if (status != 0) {
-                ohci_err(ohci, "Restarting NEC controller failed "
-                         "in ohci_init, %d\n", status);
-                return;
-        }
-
-        status = ohci_restart(ohci);
-        if (status != 0)
-                ohci_err(ohci, "Restarting NEC controller failed "
-                         "in ohci_restart, %d\n", status);
-}
-
-/*-------------------------------------------------------------------------*/
-
 #define DRIVER_INFO DRIVER_VERSION " " DRIVER_DESC
 
 MODULE_AUTHOR (DRIVER_AUTHOR);
diff --git a/drivers/usb/host/ohci-mem.c b/drivers/usb/host/ohci-mem.c
index 450c7b460c5a..2f20d3dc895b 100644
--- a/drivers/usb/host/ohci-mem.c
+++ b/drivers/usb/host/ohci-mem.c
@@ -28,7 +28,6 @@ static void ohci_hcd_init (struct ohci_hcd *ohci)
         ohci->next_statechange = jiffies;
         spin_lock_init (&ohci->lock);
         INIT_LIST_HEAD (&ohci->pending);
-        INIT_WORK (&ohci->nec_work, ohci_quirk_nec_worker);
 }
 
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index a5e2eb85d073..d0360f65ebd9 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -84,7 +84,7 @@ static int ohci_quirk_zfmicro(struct usb_hcd *hcd)
         struct ohci_hcd *ohci = hcd_to_ohci (hcd);
 
         ohci->flags |= OHCI_QUIRK_ZFMICRO;
-        ohci_dbg (ohci, "enabled Compaq ZFMicro chipset quirk\n");
+        ohci_dbg(ohci, "enabled Compaq ZFMicro chipset quirks\n");
 
         return 0;
 }
@@ -113,11 +113,31 @@ static int ohci_quirk_toshiba_scc(struct usb_hcd *hcd)
 
 /* Check for NEC chip and apply quirk for allegedly lost interrupts.
  */
+
+static void ohci_quirk_nec_worker(struct work_struct *work)
+{
+        struct ohci_hcd *ohci = container_of(work, struct ohci_hcd, nec_work);
+        int status;
+
+        status = ohci_init(ohci);
+        if (status != 0) {
+                ohci_err(ohci, "Restarting NEC controller failed in %s, %d\n",
+                         "ohci_init", status);
+                return;
+        }
+
+        status = ohci_restart(ohci);
+        if (status != 0)
+                ohci_err(ohci, "Restarting NEC controller failed in %s, %d\n",
+                         "ohci_restart", status);
+}
+
 static int ohci_quirk_nec(struct usb_hcd *hcd)
 {
         struct ohci_hcd *ohci = hcd_to_ohci (hcd);
 
         ohci->flags |= OHCI_QUIRK_NEC;
+        INIT_WORK(&ohci->nec_work, ohci_quirk_nec_worker);
         ohci_dbg (ohci, "enabled NEC chipset lost interrupt quirk\n");
 
         return 0;
diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
index 830a3fe8615e..547d39be3eb9 100644
--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -179,6 +179,10 @@ static int ed_schedule (struct ohci_hcd *ohci, struct ed *ed)
         ed->ed_prev = NULL;
         ed->ed_next = NULL;
         ed->hwNextED = 0;
+        if (quirk_zfmicro(ohci)
+                        && (ed->type == PIPE_INTERRUPT)
+                        && !(ohci->eds_scheduled++))
+                mod_timer(&ohci->unlink_watchdog, round_jiffies_relative(HZ));
         wmb ();
 
         /* we care about rm_list when setting CLE/BLE in case the HC was at
@@ -940,8 +944,12 @@ skip_ed:
                                                                 TD_MASK;
 
                                 /* INTR_WDH may need to clean up first */
-                                if (td->td_dma != head)
-                                        goto skip_ed;
+                                if (td->td_dma != head) {
+                                        if (ed == ohci->ed_to_check)
+                                                ohci->ed_to_check = NULL;
+                                        else
+                                                goto skip_ed;
+                                }
                         }
                 }
 
@@ -998,6 +1006,8 @@ rescan_this:
 
                 /* ED's now officially unlinked, hc doesn't see */
                 ed->state = ED_IDLE;
+                if (quirk_zfmicro(ohci) && ed->type == PIPE_INTERRUPT)
+                        ohci->eds_scheduled--;
                 ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_H);
                 ed->hwNextED = 0;
                 wmb ();
@@ -1021,7 +1031,7 @@ rescan_this:
 
                 if (ohci->ed_controltail) {
                         command |= OHCI_CLF;
-                        if (ohci->flags & OHCI_QUIRK_ZFMICRO)
+                        if (quirk_zfmicro(ohci))
                                 mdelay(1);
                         if (!(ohci->hc_control & OHCI_CTRL_CLE)) {
                                 control |= OHCI_CTRL_CLE;
@@ -1031,7 +1041,7 @@ rescan_this:
                 }
                 if (ohci->ed_bulktail) {
                         command |= OHCI_BLF;
-                        if (ohci->flags & OHCI_QUIRK_ZFMICRO)
+                        if (quirk_zfmicro(ohci))
                                 mdelay(1);
                         if (!(ohci->hc_control & OHCI_CTRL_BLE)) {
                                 control |= OHCI_CTRL_BLE;
@@ -1043,13 +1053,13 @@ rescan_this:
                 /* CLE/BLE to enable, CLF/BLF to (maybe) kickstart */
                 if (control) {
                         ohci->hc_control |= control;
-                        if (ohci->flags & OHCI_QUIRK_ZFMICRO)
+                        if (quirk_zfmicro(ohci))
                                 mdelay(1);
                         ohci_writel (ohci, ohci->hc_control,
                                         &ohci->regs->control);
                 }
                 if (command) {
-                        if (ohci->flags & OHCI_QUIRK_ZFMICRO)
+                        if (quirk_zfmicro(ohci))
                                 mdelay(1);
                         ohci_writel (ohci, command, &ohci->regs->cmdstatus);
                 }
@@ -1061,11 +1071,59 @@ rescan_this:
 /*-------------------------------------------------------------------------*/
 
 /*
+ * Used to take back a TD from the host controller. This would normally be
+ * called from within dl_done_list, however it may be called directly if the
+ * HC no longer sees the TD and it has not appeared on the donelist (after
+ * two frames).  This bug has been observed on ZF Micro systems.
+ */
+static void takeback_td(struct ohci_hcd *ohci, struct td *td)
+{
+        struct urb      *urb = td->urb;
+        urb_priv_t      *urb_priv = urb->hcpriv;
+        struct ed       *ed = td->ed;
+
+        /* update URB's length and status from TD */
+        td_done(ohci, urb, td);
+        urb_priv->td_cnt++;
+
+        /* If all this urb's TDs are done, call complete() */
+        if (urb_priv->td_cnt == urb_priv->length)
+                finish_urb(ohci, urb);
+
+        /* clean schedule:  unlink EDs that are no longer busy */
+        if (list_empty(&ed->td_list)) {
+                if (ed->state == ED_OPER)
+                        start_ed_unlink(ohci, ed);
+
+        /* ... reenabling halted EDs only after fault cleanup */
+        } else if ((ed->hwINFO & cpu_to_hc32(ohci, ED_SKIP | ED_DEQUEUE))
+                        == cpu_to_hc32(ohci, ED_SKIP)) {
+                td = list_entry(ed->td_list.next, struct td, td_list);
+                if (!(td->hwINFO & cpu_to_hc32(ohci, TD_DONE))) {
+                        ed->hwINFO &= ~cpu_to_hc32(ohci, ED_SKIP);
+                        /* ... hc may need waking-up */
+                        switch (ed->type) {
+                        case PIPE_CONTROL:
+                                ohci_writel(ohci, OHCI_CLF,
+                                                &ohci->regs->cmdstatus);
+                                break;
+                        case PIPE_BULK:
+                                ohci_writel(ohci, OHCI_BLF,
+                                                &ohci->regs->cmdstatus);
+                                break;
+                        }
+                }
+        }
+}
+
+/*
  * Process normal completions (error or success) and clean the schedules.
  *
  * This is the main path for handing urbs back to drivers.  The only other
- * path is finish_unlinks(), which unlinks URBs using ed_rm_list, instead of
- * scanning the (re-reversed) donelist as this does.
+ * normal path is finish_unlinks(), which unlinks URBs using ed_rm_list,
+ * instead of scanning the (re-reversed) donelist as this does.  There's
+ * an abnormal path too, handling a quirk in some Compaq silicon:  URBs
+ * with TDs that appear to be orphaned are directly reclaimed.
  */
 static void
 dl_done_list (struct ohci_hcd *ohci)
@@ -1074,44 +1132,7 @@ dl_done_list (struct ohci_hcd *ohci)
 
         while (td) {
                 struct td       *td_next = td->next_dl_td;
-                struct urb      *urb = td->urb;
-                urb_priv_t      *urb_priv = urb->hcpriv;
-                struct ed       *ed = td->ed;
-
-                /* update URB's length and status from TD */
-                td_done (ohci, urb, td);
-                urb_priv->td_cnt++;
-
-                /* If all this urb's TDs are done, call complete() */
-                if (urb_priv->td_cnt == urb_priv->length)
-                        finish_urb (ohci, urb);
-
-                /* clean schedule:  unlink EDs that are no longer busy */
-                if (list_empty (&ed->td_list)) {
-                        if (ed->state == ED_OPER)
-                                start_ed_unlink (ohci, ed);
-
-                /* ... reenabling halted EDs only after fault cleanup */
-                } else if ((ed->hwINFO & cpu_to_hc32 (ohci,
-                                                ED_SKIP | ED_DEQUEUE))
-                                        == cpu_to_hc32 (ohci, ED_SKIP)) {
-                        td = list_entry (ed->td_list.next, struct td, td_list);
-                        if (!(td->hwINFO & cpu_to_hc32 (ohci, TD_DONE))) {
-                                ed->hwINFO &= ~cpu_to_hc32 (ohci, ED_SKIP);
-                                /* ... hc may need waking-up */
-                                switch (ed->type) {
-                                case PIPE_CONTROL:
-                                        ohci_writel (ohci, OHCI_CLF,
-                                                &ohci->regs->cmdstatus);
-                                        break;
-                                case PIPE_BULK:
-                                        ohci_writel (ohci, OHCI_BLF,
-                                                &ohci->regs->cmdstatus);
-                                        break;
-                                }
-                        }
-                }
-
+                takeback_td(ohci, td);
                 td = td_next;
         }
 }
diff --git a/drivers/usb/host/ohci.h b/drivers/usb/host/ohci.h
index 4ada43cf1387..dd4d5b4dcb6c 100644
--- a/drivers/usb/host/ohci.h
+++ b/drivers/usb/host/ohci.h
@@ -401,8 +401,34 @@ struct ohci_hcd {
         // there are also chip quirks/bugs in init logic
 
         struct work_struct      nec_work;       /* Worker for NEC quirk */
+
+        /* Needed for ZF Micro quirk */
+        struct timer_list       unlink_watchdog;
+        unsigned                eds_scheduled;
+        struct ed               *ed_to_check;
+        unsigned                zf_delay;
 };
 
+#ifdef CONFIG_PCI
+static inline int quirk_nec(struct ohci_hcd *ohci)
+{
+        return ohci->flags & OHCI_QUIRK_NEC;
+}
+static inline int quirk_zfmicro(struct ohci_hcd *ohci)
+{
+        return ohci->flags & OHCI_QUIRK_ZFMICRO;
+}
+#else
+static inline int quirk_nec(struct ohci_hcd *ohci)
+{
+        return 0;
+}
+static inline int quirk_zfmicro(struct ohci_hcd *ohci)
+{
+        return 0;
+}
+#endif
+
 /* convert between an hcd pointer and the corresponding ohci_hcd */
 static inline struct ohci_hcd *hcd_to_ohci (struct usb_hcd *hcd)
 {