usb-uhci: reorganize wait_qh into wait_pipe

usb-uhci: reorganize wait_qh into wait_pipe

Four changes:

1) Add explicit GET_FLATPTR/SET_FLATPTR.

2) Pass the whole pipe to wait_qh so that we can get the iobase from there.

3) Clean up the pipe upon timeout, since that is the only sensible
thing to do: tds are on the stack, and leaving pointers to them in
the pipe is not a good idea.

4) Add a variable timeout argument, since bulk transfers might take more
than 500 ms.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>