/*
 * WUSB Wire Adapter: WLP interface
 * Deal with TX (massaging data to transmit, handling it)
 *
 * Copyright (C) 2005-2006 Intel Corporation
 * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License version
 * 2 as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 *
 *
 * Transmission engine. Get an skb, create from that a WLP transmit
 * context, add a WLP TX header (which we keep prefilled in the
 * device's instance), fill out the target-specific fields and
 * fire it.
 *
 * ROADMAP:
 *
 *   Entry points:
 *
 *     i1480u_tx_release(): called by i1480u_disconnect() to release
 *                          pending tx contexts.
 *
 *     i1480u_tx_cb(): callback for TX contexts (USB URBs)
 *       i1480u_tx_destroy():
 *
 *     i1480u_tx_timeout(): called for timeout handling from the
 *                          network stack.
 *
 *     i1480u_hard_start_xmit(): called for transmitting an skb from
 *                               the network stack. Will interact with WLP
 *                               substack to verify and prepare frame.
 *       i1480u_xmit_frame(): actual transmission on hardware
 *
 *         i1480u_tx_create()	    Creates TX context
 *            i1480u_tx_create_1()    For packets in 1 fragment
 *            i1480u_tx_create_n()    For packets in >1 fragments
 *
 * TODO:
 *
 * - FIXME: rewrite using usb_sg_*(), add asynch support to
 *          usb_sg_*(). It might not make too much sense as most of
 *          the times the MTU will be smaller than one page...
 */

#include "i1480u-wlp.h"
#define D_LOCAL 5
#include <linux/uwb/debug.h>

enum {
	/* This is only for Next and Last TX packets */
	i1480u_MAX_PL_SIZE = i1480u_MAX_FRG_SIZE
		- sizeof(struct untd_hdr_rst),
};

/** Free resources allocated to a i1480u tx context. */
static
void i1480u_tx_free(struct i1480u_tx *wtx)
{
	kfree(wtx->buf);
	if (wtx->skb)
		dev_kfree_skb_irq(wtx->skb);
	usb_free_urb(wtx->urb);
	kfree(wtx);
}

static
void i1480u_tx_destroy(struct i1480u *i1480u, struct i1480u_tx *wtx)
{
	unsigned long flags;
	spin_lock_irqsave(&i1480u->tx_list_lock, flags);	/* not active any more */
	list_del(&wtx->list_node);
	i1480u_tx_free(wtx);
	spin_unlock_irqrestore(&i1480u->tx_list_lock, flags);
}

static
void i1480u_tx_unlink_urbs(struct i1480u *i1480u)
{
	unsigned long flags;
	struct i1480u_tx *wtx, *next;

	spin_lock_irqsave(&i1480u->tx_list_lock, flags);
	list_for_each_entry_safe(wtx, next, &i1480u->tx_list, list_node) {
		usb_unlink_urb(wtx->urb);
	}
	spin_unlock_irqrestore(&i1480u->tx_list_lock, flags);
}


/**
 * Callback for a completed tx USB URB.
 *
 * TODO:
 *
 * - FIXME: recover errors more gracefully
 * - FIXME: handle NAKs (I dont think they come here) for flow ctl
 */
static
void i1480u_tx_cb(struct urb *urb)
{
	struct i1480u_tx *wtx = urb->context;
	struct i1480u *i1480u = wtx->i1480u;
	struct net_device *net_dev = i1480u->net_dev;
	struct device *dev = &i1480u->usb_iface->dev;
	unsigned long flags;

	switch (urb->status) {
	case 0:
		spin_lock_irqsave(&i1480u->lock, flags);
		i1480u->stats.tx_packets++;
		i1480u->stats.tx_bytes += urb->actual_length;
		spin_unlock_irqrestore(&i1480u->lock, flags);
		break;
	case -ECONNRESET:	/* Not an error, but a controlled situation; */
	case -ENOENT:		/* (we killed the URB)...so, no broadcast */
		dev_dbg(dev, "notif endp: reset/noent %d\n", urb->status);
		netif_stop_queue(net_dev);
		break;
	case -ESHUTDOWN:	/* going away! */
		dev_dbg(dev, "notif endp: down %d\n", urb->status);
		netif_stop_queue(net_dev);
		break;
	default:
		dev_err(dev, "TX: unknown URB status %d\n", urb->status);
		if (edc_inc(&i1480u->tx_errors, EDC_MAX_ERRORS,
					EDC_ERROR_TIMEFRAME)) {
			dev_err(dev, "TX: max acceptable errors exceeded."
					"Reset device.\n");
			netif_stop_queue(net_dev);
			i1480u_tx_unlink_urbs(i1480u);
			wlp_reset_all(&i1480u->wlp);
		}
		break;
	}
	i1480u_tx_destroy(i1480u, wtx);
	if (atomic_dec_return(&i1480u->tx_inflight.count)
	    <= i1480u->tx_inflight.threshold
	    && netif_queue_stopped(net_dev)
	    && i1480u->tx_inflight.threshold != 0) {
		if (d_test(2) && printk_ratelimit())
			d_printf(2, dev, "Restart queue. \n");
		netif_start_queue(net_dev);
		atomic_inc(&i1480u->tx_inflight.restart_count);
	}
	return;
}


/**
 * Given a buffer that doesn't fit in a single fragment, create an
 * scatter/gather structure for delivery to the USB pipe.
 *
 * Implements functionality of i1480u_tx_create().
 *
 * @wtx:	tx descriptor
 * @skb:	skb to send
 * @gfp_mask:	gfp allocation mask
 * @returns:    Pointer to @wtx if ok, NULL on error.
 *
 * Sorry, TOO LONG a function, but breaking it up is kind of hard
 *
 * This will break the buffer in chunks smaller than
 * i1480u_MAX_FRG_SIZE (including the header) and add proper headers
 * to each:
 *
 *   1st header           \
 *   i1480 tx header      |  fragment 1
 *   fragment data        /
 *   nxt header           \  fragment 2
 *   fragment data        /
 *   ..
 *   ..
 *   last header          \  fragment 3
 *   last fragment data   /
 *
 * This does not fill the i1480 TX header, it is left up to the
 * caller to do that; you can get it from @wtx->wlp_tx_hdr.
 *
 * This function consumes the skb unless there is an error.
 */
static
int i1480u_tx_create_n(struct i1480u_tx *wtx, struct sk_buff *skb,
		       gfp_t gfp_mask)
{
	int result;
	void *pl;
	size_t pl_size;

	void *pl_itr, *buf_itr;
	size_t pl_size_left, frgs, pl_size_1st, frg_pl_size = 0;
	struct untd_hdr_1st *untd_hdr_1st;
	struct wlp_tx_hdr *wlp_tx_hdr;
	struct untd_hdr_rst *untd_hdr_rst;

	wtx->skb = NULL;
	pl = skb->data;
	pl_itr = pl;
	pl_size = skb->len;
	pl_size_left = pl_size;	/* payload size */
	/* First fragment; fits as much as i1480u_MAX_FRG_SIZE minus
	 * the headers */
	pl_size_1st = i1480u_MAX_FRG_SIZE
		- sizeof(struct untd_hdr_1st) - sizeof(struct wlp_tx_hdr);
	BUG_ON(pl_size_1st > pl_size);
	pl_size_left -= pl_size_1st;
	/* The rest have an smaller header (no i1480 TX header). We
	 * need to break up the payload in blocks smaller than
	 * i1480u_MAX_PL_SIZE (payload excluding header). */
	frgs = (pl_size_left + i1480u_MAX_PL_SIZE - 1) / i1480u_MAX_PL_SIZE;
	/* Allocate space for the new buffer. In this new buffer we'll
	 * place the headers followed by the data fragment, headers,
	 * data fragments, etc..
	 */
	result = -ENOMEM;
	wtx->buf_size = sizeof(*untd_hdr_1st)
		+ sizeof(*wlp_tx_hdr)
		+ frgs * sizeof(*untd_hdr_rst)
		+ pl_size;
	wtx->buf = kmalloc(wtx->buf_size, gfp_mask);
	if (wtx->buf == NULL)
		goto error_buf_alloc;

	buf_itr = wtx->buf;		/* We got the space, let's fill it up */
	/* Fill 1st fragment */
	untd_hdr_1st = buf_itr;
	buf_itr += sizeof(*untd_hdr_1st);
	untd_hdr_set_type(&untd_hdr_1st->hdr, i1480u_PKT_FRAG_1ST);
	untd_hdr_set_rx_tx(&untd_hdr_1st->hdr, 0);
	untd_hdr_1st->hdr.len = cpu_to_le16(pl_size + sizeof(*wlp_tx_hdr));
	untd_hdr_1st->fragment_len =
		cpu_to_le16(pl_size_1st + sizeof(*wlp_tx_hdr));
	memset(untd_hdr_1st->padding, 0, sizeof(untd_hdr_1st->padding));
	/* Set up i1480 header info */
	wlp_tx_hdr = wtx->wlp_tx_hdr = buf_itr;
	buf_itr += sizeof(*wlp_tx_hdr);
	/* Copy the first fragment */
	memcpy(buf_itr, pl_itr, pl_size_1st);
	pl_itr += pl_size_1st;
	buf_itr += pl_size_1st;

	/* Now do each remaining fragment */
	result = -EINVAL;
	while (pl_size_left > 0) {
		d_printf(5, NULL, "ITR HDR: pl_size_left %zu buf_itr %zu\n",
			 pl_size_left, buf_itr - wtx->buf);
		if (buf_itr + sizeof(*untd_hdr_rst) - wtx->buf
		    > wtx->buf_size) {
			printk(KERN_ERR "BUG: no space for header\n");
			goto error_bug;
		}
		d_printf(5, NULL, "ITR HDR 2: pl_size_left %zu buf_itr %zu\n",
			 pl_size_left, buf_itr - wtx->buf);
		untd_hdr_rst = buf_itr;
		buf_itr += sizeof(*untd_hdr_rst);
		if (pl_size_left > i1480u_MAX_PL_SIZE) {
			frg_pl_size = i1480u_MAX_PL_SIZE;
			untd_hdr_set_type(&untd_hdr_rst->hdr, i1480u_PKT_FRAG_NXT);
		} else {
			frg_pl_size = pl_size_left;
			untd_hdr_set_type(&untd_hdr_rst->hdr, i1480u_PKT_FRAG_LST);
		}
		d_printf(5, NULL,
			 "ITR PL: pl_size_left %zu buf_itr %zu frg_pl_size %zu\n",
			 pl_size_left, buf_itr - wtx->buf, frg_pl_size);
		untd_hdr_set_rx_tx(&untd_hdr_rst->hdr, 0);
		untd_hdr_rst->hdr.len = cpu_to_le16(frg_pl_size);
		untd_hdr_rst->padding = 0;
		if (buf_itr + frg_pl_size - wtx->buf
		    > wtx->buf_size) {
			printk(KERN_ERR "BUG: no space for payload\n");
			goto error_bug;
		}
		memcpy(buf_itr, pl_itr, frg_pl_size);
		buf_itr += frg_pl_size;
		pl_itr += frg_pl_size;
		pl_size_left -= frg_pl_size;
		d_printf(5, NULL,
			 "ITR PL 2: pl_size_left %zu buf_itr %zu frg_pl_size %zu\n",
			 pl_size_left, buf_itr - wtx->buf, frg_pl_size);
	}
	dev_kfree_skb_irq(skb);
	return 0;

error_bug:
	printk(KERN_ERR
	       "BUG: skb %u bytes\n"
	       "BUG: frg_pl_size %zd i1480u_MAX_FRG_SIZE %u\n"
	       "BUG: buf_itr %zu buf_size %zu pl_size_left %zu\n",
	       skb->len,
	       frg_pl_size, i1480u_MAX_FRG_SIZE,
	       buf_itr - wtx->buf, wtx->buf_size, pl_size_left);

	kfree(wtx->buf);
error_buf_alloc:
	return result;
}


/**
 * Given a buffer that fits in a single fragment, fill out a @wtx
 * struct for transmitting it down the USB pipe.
 *
 * Uses the fact that we have space reserved in front of the skbuff
 * for hardware headers :]
 *
 * This does not fill the i1480 TX header, it is left up to the
 * caller to do that; you can get it from @wtx->wlp_tx_hdr.
 *
 * @pl:		pointer to payload data
 * @pl_size:    size of the payuload
 *
 * This function does not consume the @skb.
 */
static
int i1480u_tx_create_1(struct i1480u_tx *wtx, struct sk_buff *skb,
		       gfp_t gfp_mask)
{
	struct untd_hdr_cmp *untd_hdr_cmp;
	struct wlp_tx_hdr *wlp_tx_hdr;

	wtx->buf = NULL;
	wtx->skb = skb;
	BUG_ON(skb_headroom(skb) < sizeof(*wlp_tx_hdr));
	wlp_tx_hdr = (void *) __skb_push(skb, sizeof(*wlp_tx_hdr));
	wtx->wlp_tx_hdr = wlp_tx_hdr;
	BUG_ON(skb_headroom(skb) < sizeof(*untd_hdr_cmp));
	untd_hdr_cmp = (void *) __skb_push(skb, sizeof(*untd_hdr_cmp));

	untd_hdr_set_type(&untd_hdr_cmp->hdr, i1480u_PKT_FRAG_CMP);
	untd_hdr_set_rx_tx(&untd_hdr_cmp->hdr, 0);
	untd_hdr_cmp->hdr.len = cpu_to_le16(skb->len - sizeof(*untd_hdr_cmp));
	untd_hdr_cmp->padding = 0;
	return 0;
}


/**
 * Given a skb to transmit, massage it to become palatable for the TX pipe
 *
 * This will break the buffer in chunks smaller than
 * i1480u_MAX_FRG_SIZE and add proper headers to each.
 *
 *   1st header           \
 *   i1480 tx header      |  fragment 1
 *   fragment data        /
 *   nxt header           \  fragment 2
 *   fragment data        /
 *   ..
 *   ..
 *   last header          \  fragment 3
 *   last fragment data   /
 *
 * Each fragment will be always smaller or equal to i1480u_MAX_FRG_SIZE.
 *
 * If the first fragment is smaller than i1480u_MAX_FRG_SIZE, then the
 * following is composed:
 *
 *   complete header      \
 *   i1480 tx header      | single fragment
 *   packet data          /
 *
 * We were going to use s/g support, but because the interface is
 * synch and at the end there is plenty of overhead to do it, it
 * didn't seem that worth for data that is going to be smaller than
 * one page.
 */
static
struct i1480u_tx *i1480u_tx_create(struct i1480u *i1480u,
				   struct sk_buff *skb, gfp_t gfp_mask)
{
	int result;
	struct usb_endpoint_descriptor *epd;
	int usb_pipe;
	unsigned long flags;

	struct i1480u_tx *wtx;
	const size_t pl_max_size =
		i1480u_MAX_FRG_SIZE - sizeof(struct untd_hdr_cmp)
		- sizeof(struct wlp_tx_hdr);

	wtx = kmalloc(sizeof(*wtx), gfp_mask);
	if (wtx == NULL)
		goto error_wtx_alloc;
	wtx->urb = usb_alloc_urb(0, gfp_mask);
	if (wtx->urb == NULL)
		goto error_urb_alloc;
	epd = &i1480u->usb_iface->cur_altsetting->endpoint[2].desc;
	usb_pipe = usb_sndbulkpipe(i1480u->usb_dev, epd->bEndpointAddress);
	/* Fits in a single complete packet or need to split? */
	if (skb->len > pl_max_size) {
		result = i1480u_tx_create_n(wtx, skb, gfp_mask);
		if (result < 0)
			goto error_create;
		usb_fill_bulk_urb(wtx->urb, i1480u->usb_dev, usb_pipe,
				  wtx->buf, wtx->buf_size, i1480u_tx_cb, wtx);
	} else {
		result = i1480u_tx_create_1(wtx, skb, gfp_mask);
		if (result < 0)
			goto error_create;
		usb_fill_bulk_urb(wtx->urb, i1480u->usb_dev, usb_pipe,
				  skb->data, skb->len, i1480u_tx_cb, wtx);
	}
	spin_lock_irqsave(&i1480u->tx_list_lock, flags);
	list_add(&wtx->list_node, &i1480u->tx_list);
	spin_unlock_irqrestore(&i1480u->tx_list_lock, flags);
	return wtx;

error_create:
	kfree(wtx->urb);
error_urb_alloc:
	kfree(wtx);
error_wtx_alloc:
	return NULL;
}

/**
 * Actual fragmentation and transmission of frame
 *
 * @wlp:  WLP substack data structure
 * @skb:  To be transmitted
 * @dst:  Device address of destination
 * @returns: 0 on success, <0 on failure
 *
 * This function can also be called directly (not just from
 * hard_start_xmit), so we also check here if the interface is up before
 * taking sending anything.
 */
int i1480u_xmit_frame(struct wlp *wlp, struct sk_buff *skb,
		      struct uwb_dev_addr *dst)
{
	int result = -ENXIO;
	struct i1480u *i1480u = container_of(wlp, struct i1480u, wlp);
	struct device *dev = &i1480u->usb_iface->dev;
	struct net_device *net_dev = i1480u->net_dev;
	struct i1480u_tx *wtx;
	struct wlp_tx_hdr *wlp_tx_hdr;
	static unsigned char dev_bcast[2] = { 0xff, 0xff };
#if 0
	int lockup = 50;
#endif

	d_fnstart(6, dev, "(skb %p (%u), net_dev %p)\n", skb, skb->len,
		  net_dev);
	BUG_ON(i1480u->wlp.rc == NULL);
	if ((net_dev->flags & IFF_UP) == 0)
		goto out;
	result = -EBUSY;
	if (atomic_read(&i1480u->tx_inflight.count) >= i1480u->tx_inflight.max) {
		if (d_test(2) && printk_ratelimit())
			d_printf(2, dev, "Max frames in flight "
				 "stopping queue.\n");
		netif_stop_queue(net_dev);
		goto error_max_inflight;
	}
	result = -ENOMEM;
	wtx = i1480u_tx_create(i1480u, skb, GFP_ATOMIC);
	if (unlikely(wtx == NULL)) {
		if (printk_ratelimit())
			dev_err(dev, "TX: no memory for WLP TX URB,"
				"dropping packet (in flight %d)\n",
				atomic_read(&i1480u->tx_inflight.count));
		netif_stop_queue(net_dev);
		goto error_wtx_alloc;
	}
	wtx->i1480u = i1480u;
	/* Fill out the i1480 header; @i1480u->def_tx_hdr read without
	 * locking. We do so because they are kind of orthogonal to
	 * each other (and thus not changed in an atomic batch).
	 * The ETH header is right after the WLP TX header. */
	wlp_tx_hdr = wtx->wlp_tx_hdr;
	*wlp_tx_hdr = i1480u->options.def_tx_hdr;
	wlp_tx_hdr->dstaddr = *dst;
	if (!memcmp(&wlp_tx_hdr->dstaddr, dev_bcast, sizeof(dev_bcast))
	    && (wlp_tx_hdr_delivery_id_type(wlp_tx_hdr) & WLP_DRP)) {
		/*Broadcast message directed to DRP host. Send as best effort
		 * on PCA. */
		wlp_tx_hdr_set_delivery_id_type(wlp_tx_hdr, i1480u->options.pca_base_priority);
	}

#if 0
	dev_info(dev, "TX delivering skb -> USB, %zu bytes\n", skb->len);
	dump_bytes(dev, skb->data, skb->len > 72 ? 72 : skb->len);
#endif
#if 0
	/* simulates a device lockup after every lockup# packets */
	if (lockup && ((i1480u->stats.tx_packets + 1) % lockup) == 0) {
		/* Simulate a dropped transmit interrupt */
		net_dev->trans_start = jiffies;
		netif_stop_queue(net_dev);
		dev_err(dev, "Simulate lockup at %ld\n", jiffies);
		return result;
	}
#endif

	result = usb_submit_urb(wtx->urb, GFP_ATOMIC);		/* Go baby */
	if (result < 0) {
		dev_err(dev, "TX: cannot submit URB: %d\n", result);
		/* We leave the freeing of skb to calling function */
		wtx->skb = NULL;
		goto error_tx_urb_submit;
	}
	atomic_inc(&i1480u->tx_inflight.count);
	net_dev->trans_start = jiffies;
	d_fnend(6, dev, "(skb %p (%u), net_dev %p) = %d\n", skb, skb->len,
		net_dev, result);
	return result;

error_tx_urb_submit:
	i1480u_tx_destroy(i1480u, wtx);
error_wtx_alloc:
error_max_inflight:
out:
	d_fnend(6, dev, "(skb %p (%u), net_dev %p) = %d\n", skb, skb->len,
		net_dev, result);
	return result;
}


/**
 * Transmit an skb  Called when an skbuf has to be transmitted
 *
 * The skb is first passed to WLP substack to ensure this is a valid
 * frame. If valid the device address of destination will be filled and
 * the WLP header prepended to the skb. If this step fails we fake sending
 * the frame, if we return an error the network stack will just keep trying.
 *
 * Broadcast frames inside a WSS needs to be treated special as multicast is
 * not supported. A broadcast frame is sent as unicast to each member of the
 * WSS - this is done by the WLP substack when it finds a broadcast frame.
 * So, we test if the WLP substack took over the skb and only transmit it
 * if it has not (been taken over).
 *
 * @net_dev->xmit_lock is held
 */
int i1480u_hard_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
{
	int result;
	struct i1480u *i1480u = netdev_priv(net_dev);
	struct device *dev = &i1480u->usb_iface->dev;
	struct uwb_dev_addr dst;

	d_fnstart(6, dev, "(skb %p (%u), net_dev %p)\n", skb, skb->len,
		  net_dev);
	BUG_ON(i1480u->wlp.rc == NULL);
	if ((net_dev->flags & IFF_UP) == 0)
		goto error;
	result = wlp_prepare_tx_frame(dev, &i1480u->wlp, skb, &dst);
	if (result < 0) {
		dev_err(dev, "WLP verification of TX frame failed (%d). "
			"Dropping packet.\n", result);
		goto error;
	} else if (result == 1) {
		d_printf(6, dev, "WLP will transmit frame. \n");
		/* trans_start time will be set when WLP actually transmits
		 * the frame */
		goto out;
	}
	d_printf(6, dev, "Transmitting frame. \n");
	result = i1480u_xmit_frame(&i1480u->wlp, skb, &dst);
	if (result < 0) {
		dev_err(dev, "Frame TX failed (%d).\n", result);
		goto error;
	}
	d_fnend(6, dev, "(skb %p (%u), net_dev %p) = %d\n", skb, skb->len,
		net_dev, result);
	return NETDEV_TX_OK;
error:
	dev_kfree_skb_any(skb);
	i1480u->stats.tx_dropped++;
out:
	d_fnend(6, dev, "(skb %p (%u), net_dev %p) = %d\n", skb, skb->len,
		net_dev, result);
	return NETDEV_TX_OK;
}


/**
 * Called when a pkt transmission doesn't complete in a reasonable period
 * Device reset may sleep - do it outside of interrupt context (delayed)
 */
void i1480u_tx_timeout(struct net_device *net_dev)
{
	struct i1480u *i1480u = netdev_priv(net_dev);

	wlp_reset_all(&i1480u->wlp);
}


void i1480u_tx_release(struct i1480u *i1480u)
{
	unsigned long flags;
	struct i1480u_tx *wtx, *next;
	int count = 0, empty;

	spin_lock_irqsave(&i1480u->tx_list_lock, flags);
	list_for_each_entry_safe(wtx, next, &i1480u->tx_list, list_node) {
		count++;
		usb_unlink_urb(wtx->urb);
	}
	spin_unlock_irqrestore(&i1480u->tx_list_lock, flags);
	count = count*10; /* i1480ut 200ms per unlinked urb (intervals of 20ms) */
	/*
	 * We don't like this sollution too much (dirty as it is), but
	 * it is cheaper than putting a refcount on each i1480u_tx and
	 * i1480uting for all of them to go away...
	 *
	 * Called when no more packets can be added to tx_list
	 * so can i1480ut for it to be empty.
	 */
	while (1) {
		spin_lock_irqsave(&i1480u->tx_list_lock, flags);
		empty = list_empty(&i1480u->tx_list);
		spin_unlock_irqrestore(&i1480u->tx_list_lock, flags);
		if (empty)
			break;
		count--;
		BUG_ON(count == 0);
		msleep(20);
	}
}