The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/dev/ic/sl811hs.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*      $NetBSD: sl811hs.c,v 1.112 2022/05/03 20:52:32 andvar Exp $     */
    2 
    3 /*
    4  * Not (c) 2007 Matthew Orgass
    5  * This file is public domain, meaning anyone can make any use of part or all
    6  * of this file including copying into other works without credit.  Any use,
    7  * modified or not, is solely the responsibility of the user.  If this file is
    8  * part of a collection then use in the collection is governed by the terms of
    9  * the collection.
   10  */
   11 
   12 /*
   13  * Cypress/ScanLogic SL811HS/T USB Host Controller
   14  * Datasheet, Errata, and App Note available at www.cypress.com
   15  *
   16  * Uses: Ratoc CFU1U PCMCIA USB Host Controller, Nereid X68k USB HC, ISA
   17  * HCs.  The Ratoc CFU2 uses a different chip.
   18  *
   19  * This chip puts the serial in USB.  It implements USB by means of an eight
   20  * bit I/O interface.  It can be used for ISA, PCMCIA/CF, parallel port,
   21  * serial port, or any eight bit interface.  It has 256 bytes of memory, the
   22  * first 16 of which are used for register access.  There are two sets of
   23  * registers for sending individual bus transactions.  Because USB is polled,
   24  * this organization means that some amount of card access must often be made
   25  * when devices are attached, even if when they are not directly being used.
   26  * A per-ms frame interrupt is necessary and many devices will poll with a
   27  * per-frame bulk transfer.
   28  *
   29  * It is possible to write a little over two bytes to the chip (auto
   30  * incremented) per full speed byte time on the USB.  Unfortunately,
   31  * auto-increment does not work reliably so write and bus speed is
   32  * approximately the same for full speed devices.
   33  *
   34  * In addition to the 240 byte packet size limit for isochronous transfers,
   35  * this chip has no means of determining the current frame number other than
   36  * getting all 1ms SOF interrupts, which is not always possible even on a fast
   37  * system.  Isochronous transfers guarantee that transfers will never be
   38  * retried in a later frame, so this can cause problems with devices beyond
   39  * the difficulty in actually performing the transfer most frames.  I tried
   40  * implementing isoc transfers and was able to play CD-derrived audio via an
   41  * iMic on a 2GHz PC, however it would still be interrupted at times and
   42  * once interrupted, would stay out of sync.  All isoc support has been
   43  * removed.
   44  *
   45  * BUGS: all chip revisions have problems with low speed devices through hubs.
   46  * The chip stops generating SOF with hubs that send SE0 during SOF.  See
   47  * comment in dointr().  All performance enhancing features of this chip seem
   48  * not to work properly, most confirmed buggy in errata doc.
   49  *
   50  */
   51 
   52 /*
   53  * The hard interrupt is the main entry point.  Start, callbacks, and repeat
   54  * are the only others called frequently.
   55  *
   56  * Since this driver attaches to pcmcia, card removal at any point should be
   57  * expected and not cause panics or infinite loops.
   58  */
   59 
   60 /*
   61  * XXX TODO:
   62  *   copy next output packet while transferring
   63  *   usb suspend
   64  *   could keep track of known values of all buffer space?
   65  *   combined print/log function for errors
   66  *
   67  *   ub_usepolling support is untested and may not work
   68  */
   69 
   70 #include <sys/cdefs.h>
   71 __KERNEL_RCSID(0, "$NetBSD: sl811hs.c,v 1.112 2022/05/03 20:52:32 andvar Exp $");
   72 
   73 #ifdef _KERNEL_OPT
   74 #include "opt_slhci.h"
   75 #include "opt_usb.h"
   76 #endif
   77 
   78 #include <sys/param.h>
   79 
   80 #include <sys/bus.h>
   81 #include <sys/cpu.h>
   82 #include <sys/device.h>
   83 #include <sys/gcq.h>
   84 #include <sys/intr.h>
   85 #include <sys/kernel.h>
   86 #include <sys/kmem.h>
   87 #include <sys/proc.h>
   88 #include <sys/queue.h>
   89 #include <sys/sysctl.h>
   90 #include <sys/systm.h>
   91 
   92 #include <dev/usb/usb.h>
   93 #include <dev/usb/usbdi.h>
   94 #include <dev/usb/usbdivar.h>
   95 #include <dev/usb/usbhist.h>
   96 #include <dev/usb/usb_mem.h>
   97 #include <dev/usb/usbdevs.h>
   98 #include <dev/usb/usbroothub.h>
   99 
  100 #include <dev/ic/sl811hsreg.h>
  101 #include <dev/ic/sl811hsvar.h>
  102 
  103 #define Q_CB 0                          /* Control/Bulk */
  104 #define Q_NEXT_CB 1
  105 #define Q_MAX_XFER Q_CB
  106 #define Q_CALLBACKS 2
  107 #define Q_MAX Q_CALLBACKS
  108 
  109 #define F_AREADY                (0x00000001)
  110 #define F_BREADY                (0x00000002)
  111 #define F_AINPROG               (0x00000004)
  112 #define F_BINPROG               (0x00000008)
  113 #define F_LOWSPEED              (0x00000010)
  114 #define F_UDISABLED             (0x00000020) /* Consider disabled for USB */
  115 #define F_NODEV                 (0x00000040)
  116 #define F_ROOTINTR              (0x00000080)
  117 #define F_REALPOWER             (0x00000100) /* Actual power state */
  118 #define F_POWER                 (0x00000200) /* USB reported power state */
  119 #define F_ACTIVE                (0x00000400)
  120 #define F_CALLBACK              (0x00000800) /* Callback scheduled */
  121 #define F_SOFCHECK1             (0x00001000)
  122 #define F_SOFCHECK2             (0x00002000)
  123 #define F_CRESET                (0x00004000) /* Reset done not reported */
  124 #define F_CCONNECT              (0x00008000) /* Connect change not reported */
  125 #define F_RESET                 (0x00010000)
  126 #define F_ISOC_WARNED           (0x00020000)
  127 #define F_LSVH_WARNED           (0x00040000)
  128 
  129 #define F_DISABLED              (F_NODEV|F_UDISABLED)
  130 #define F_CHANGE                (F_CRESET|F_CCONNECT)
  131 
  132 #ifdef SLHCI_TRY_LSVH
  133 unsigned int slhci_try_lsvh = 1;
  134 #else
  135 unsigned int slhci_try_lsvh = 0;
  136 #endif
  137 
  138 #define ADR 0
  139 #define LEN 1
  140 #define PID 2
  141 #define DEV 3
  142 #define STAT 2
  143 #define CONT 3
  144 
  145 #define A 0
  146 #define B 1
  147 
  148 static const uint8_t slhci_tregs[2][4] =
  149 {{SL11_E0ADDR, SL11_E0LEN, SL11_E0PID, SL11_E0DEV },
  150  {SL11_E1ADDR, SL11_E1LEN, SL11_E1PID, SL11_E1DEV }};
  151 
  152 #define PT_ROOT_CTRL    0
  153 #define PT_ROOT_INTR    1
  154 #define PT_CTRL_SETUP   2
  155 #define PT_CTRL_DATA    3
  156 #define PT_CTRL_STATUS  4
  157 #define PT_INTR         5
  158 #define PT_BULK         6
  159 #define PT_MAX          6
  160 
  161 #ifdef SLHCI_DEBUG
  162 #define SLHCI_MEM_ACCOUNTING
  163 #endif
  164 
  165 /*
  166  * Maximum allowable reserved bus time.  Since intr/isoc transfers have
  167  * unconditional priority, this is all that ensures control and bulk transfers
  168  * get a chance.  It is a single value for all frames since all transfers can
  169  * use multiple consecutive frames if an error is encountered.  Note that it
  170  * is not really possible to fill the bus with transfers, so this value should
  171  * be on the low side.  Defaults to giving a warning unless SLHCI_NO_OVERTIME
  172  * is defined.  Full time is 12000 - END_BUSTIME.
  173  */
  174 #ifndef SLHCI_RESERVED_BUSTIME
  175 #define SLHCI_RESERVED_BUSTIME 5000
  176 #endif
  177 
  178 /*
  179  * Rate for "exceeds reserved bus time" warnings (default) or errors.
  180  * Warnings only happen when an endpoint open causes the time to go above
  181  * SLHCI_RESERVED_BUSTIME, not if it is already above.
  182  */
  183 #ifndef SLHCI_OVERTIME_WARNING_RATE
  184 #define SLHCI_OVERTIME_WARNING_RATE { 60, 0 } /* 60 seconds */
  185 #endif
  186 static const struct timeval reserved_warn_rate = SLHCI_OVERTIME_WARNING_RATE;
  187 
  188 /*
  189  * For EOF, the spec says 42 bit times, plus (I think) a possible hub skew of
  190  * 20 bit times.  By default leave 66 bit times to start the transfer beyond
  191  * the required time.  Units are full-speed bit times (a bit over 5us per 64).
  192  * Only multiples of 64 are significant.
  193  */
  194 #define SLHCI_STANDARD_END_BUSTIME 128
  195 #ifndef SLHCI_EXTRA_END_BUSTIME
  196 #define SLHCI_EXTRA_END_BUSTIME 0
  197 #endif
  198 
  199 #define SLHCI_END_BUSTIME (SLHCI_STANDARD_END_BUSTIME+SLHCI_EXTRA_END_BUSTIME)
  200 
  201 /*
  202  * This is an approximation of the USB worst-case timings presented on p. 54 of
  203  * the USB 1.1 spec translated to full speed bit times.
  204  * FS = full speed with handshake, FSII = isoc in, FSIO = isoc out,
  205  * FSI = isoc (worst case), LS = low speed
  206  */
  207 #define SLHCI_FS_CONST          114
  208 #define SLHCI_FSII_CONST        92
  209 #define SLHCI_FSIO_CONST        80
  210 #define SLHCI_FSI_CONST         92
  211 #define SLHCI_LS_CONST          804
  212 #ifndef SLHCI_PRECICE_BUSTIME
  213 /*
  214  * These values are < 3% too high (compared to the multiply and divide) for
  215  * max sized packets.
  216  */
  217 #define SLHCI_FS_DATA_TIME(len) (((u_int)(len)<<3)+(len)+((len)>>1))
  218 #define SLHCI_LS_DATA_TIME(len) (((u_int)(len)<<6)+((u_int)(len)<<4))
  219 #else
  220 #define SLHCI_FS_DATA_TIME(len) (56*(len)/6)
  221 #define SLHCI_LS_DATA_TIME(len) (449*(len)/6)
  222 #endif
  223 
  224 /*
  225  * Set SLHCI_WAIT_SIZE to the desired maximum size of single FS transfer
  226  * to poll for after starting a transfer.  64 gets all full speed transfers.
  227  * Note that even if 0 polling will occur if data equal or greater than the
  228  * transfer size is copied to the chip while the transfer is in progress.
  229  * Setting SLHCI_WAIT_TIME to -12000 will disable polling.
  230  */
  231 #ifndef SLHCI_WAIT_SIZE
  232 #define SLHCI_WAIT_SIZE 8
  233 #endif
  234 #ifndef SLHCI_WAIT_TIME
  235 #define SLHCI_WAIT_TIME (SLHCI_FS_CONST + \
  236     SLHCI_FS_DATA_TIME(SLHCI_WAIT_SIZE))
  237 #endif
  238 const int slhci_wait_time = SLHCI_WAIT_TIME;
  239 
  240 #ifndef SLHCI_MAX_RETRIES
  241 #define SLHCI_MAX_RETRIES 3
  242 #endif
  243 
  244 /* Check IER values for corruption after this many unrecognized interrupts. */
  245 #ifndef SLHCI_IER_CHECK_FREQUENCY
  246 #ifdef SLHCI_DEBUG
  247 #define SLHCI_IER_CHECK_FREQUENCY 1
  248 #else
  249 #define SLHCI_IER_CHECK_FREQUENCY 100
  250 #endif
  251 #endif
  252 
  253 /* Note that buffer points to the start of the buffer for this transfer.  */
  254 struct slhci_pipe {
  255         struct usbd_pipe pipe;
  256         struct usbd_xfer *xfer;         /* xfer in progress */
  257         uint8_t         *buffer;        /* I/O buffer (if needed) */
  258         struct gcq      ap;             /* All pipes */
  259         struct gcq      to;             /* Timeout list */
  260         struct gcq      xq;             /* Xfer queues */
  261         unsigned int    pflags;         /* Pipe flags */
  262 #define PF_GONE         (0x01)          /* Pipe is on disabled device */
  263 #define PF_TOGGLE       (0x02)          /* Data toggle status */
  264 #define PF_LS           (0x04)          /* Pipe is low speed */
  265 #define PF_PREAMBLE     (0x08)          /* Needs preamble */
  266         Frame           to_frame;       /* Frame number for timeout */
  267         Frame           frame;          /* Frame number for intr xfer */
  268         Frame           lastframe;      /* Previous frame number for intr */
  269         uint16_t        bustime;        /* Worst case bus time usage */
  270         uint16_t        newbustime[2];  /* new bustimes (see index below) */
  271         uint8_t         tregs[4];       /* ADR, LEN, PID, DEV */
  272         uint8_t         newlen[2];      /* 0 = short data, 1 = ctrl data */
  273         uint8_t         newpid;         /* for ctrl */
  274         uint8_t         wantshort;      /* last xfer must be short */
  275         uint8_t         control;        /* Host control register settings */
  276         uint8_t         nerrs;          /* Current number of errors */
  277         uint8_t         ptype;          /* Pipe type */
  278 };
  279 
  280 #define SLHCI_BUS2SC(bus)       ((bus)->ub_hcpriv)
  281 #define SLHCI_PIPE2SC(pipe)     SLHCI_BUS2SC((pipe)->up_dev->ud_bus)
  282 #define SLHCI_XFER2SC(xfer)     SLHCI_BUS2SC((xfer)->ux_bus)
  283 
  284 #define SLHCI_PIPE2SPIPE(pipe)  ((struct slhci_pipe *)(pipe))
  285 #define SLHCI_XFER2SPIPE(xfer)  SLHCI_PIPE2SPIPE((xfer)->ux_pipe)
  286 
  287 #define SLHCI_XFER_TYPE(x)      (SLHCI_XFER2SPIPE(xfer)->ptype)
  288 
  289 #ifdef SLHCI_PROFILE_TRANSFER
  290 #if defined(__mips__)
  291 /*
  292  * MIPS cycle counter does not directly count cpu cycles but is a different
  293  * fraction of cpu cycles depending on the cpu.
  294  */
  295 typedef uint32_t cc_type;
  296 #define CC_TYPE_FMT "%u"
  297 #define slhci_cc_set(x) __asm volatile ("mfc0 %[cc], $9\n\tnop\n\tnop\n\tnop" \
  298     : [cc] "=r"(x))
  299 #elif defined(__i386__)
  300 typedef uint64_t cc_type;
  301 #define CC_TYPE_FMT "%llu"
  302 #define slhci_cc_set(x) __asm volatile ("rdtsc" : "=A"(x))
  303 #else
  304 #error "SLHCI_PROFILE_TRANSFER not implemented on this MACHINE_ARCH (see sys/dev/ic/sl811hs.c)"
  305 #endif
  306 struct slhci_cc_time {
  307         cc_type start;
  308         cc_type stop;
  309         unsigned int miscdata;
  310 };
  311 #ifndef SLHCI_N_TIMES
  312 #define SLHCI_N_TIMES 200
  313 #endif
  314 struct slhci_cc_times {
  315         struct slhci_cc_time times[SLHCI_N_TIMES];
  316         int current;
  317         int wraparound;
  318 };
  319 
  320 static struct slhci_cc_times t_ab[2];
  321 static struct slhci_cc_times t_abdone;
  322 static struct slhci_cc_times t_copy_to_dev;
  323 static struct slhci_cc_times t_copy_from_dev;
  324 static struct slhci_cc_times t_intr;
  325 static struct slhci_cc_times t_lock;
  326 static struct slhci_cc_times t_delay;
  327 static struct slhci_cc_times t_hard_int;
  328 static struct slhci_cc_times t_callback;
  329 
  330 static inline void
  331 start_cc_time(struct slhci_cc_times *times, unsigned int misc) {
  332         times->times[times->current].miscdata = misc;
  333         slhci_cc_set(times->times[times->current].start);
  334 }
  335 static inline void
  336 stop_cc_time(struct slhci_cc_times *times) {
  337         slhci_cc_set(times->times[times->current].stop);
  338         if (++times->current >= SLHCI_N_TIMES) {
  339                 times->current = 0;
  340                 times->wraparound = 1;
  341         }
  342 }
  343 
  344 void slhci_dump_cc_times(int);
  345 
  346 void
  347 slhci_dump_cc_times(int n) {
  348         struct slhci_cc_times *times;
  349         int i;
  350 
  351         switch (n) {
  352         default:
  353         case 0:
  354                 printf("USBA start transfer to intr:\n");
  355                 times = &t_ab[A];
  356                 break;
  357         case 1:
  358                 printf("USBB start transfer to intr:\n");
  359                 times = &t_ab[B];
  360                 break;
  361         case 2:
  362                 printf("abdone:\n");
  363                 times = &t_abdone;
  364                 break;
  365         case 3:
  366                 printf("copy to device:\n");
  367                 times = &t_copy_to_dev;
  368                 break;
  369         case 4:
  370                 printf("copy from device:\n");
  371                 times = &t_copy_from_dev;
  372                 break;
  373         case 5:
  374                 printf("intr to intr:\n");
  375                 times = &t_intr;
  376                 break;
  377         case 6:
  378                 printf("lock to release:\n");
  379                 times = &t_lock;
  380                 break;
  381         case 7:
  382                 printf("delay time:\n");
  383                 times = &t_delay;
  384                 break;
  385         case 8:
  386                 printf("hard interrupt enter to exit:\n");
  387                 times = &t_hard_int;
  388                 break;
  389         case 9:
  390                 printf("callback:\n");
  391                 times = &t_callback;
  392                 break;
  393         }
  394 
  395         if (times->wraparound)
  396                 for (i = times->current + 1; i < SLHCI_N_TIMES; i++)
  397                         printf("start " CC_TYPE_FMT " stop " CC_TYPE_FMT
  398                             " difference %8i miscdata %#x\n",
  399                             times->times[i].start, times->times[i].stop,
  400                             (int)(times->times[i].stop -
  401                             times->times[i].start), times->times[i].miscdata);
  402 
  403         for (i = 0; i < times->current; i++)
  404                 printf("start " CC_TYPE_FMT " stop " CC_TYPE_FMT
  405                     " difference %8i miscdata %#x\n", times->times[i].start,
  406                     times->times[i].stop, (int)(times->times[i].stop -
  407                     times->times[i].start), times->times[i].miscdata);
  408 }
  409 #else
  410 #define start_cc_time(x, y)
  411 #define stop_cc_time(x)
  412 #endif /* SLHCI_PROFILE_TRANSFER */
  413 
  414 typedef usbd_status (*LockCallFunc)(struct slhci_softc *, struct slhci_pipe
  415     *, struct usbd_xfer *);
  416 
  417 struct usbd_xfer * slhci_allocx(struct usbd_bus *, unsigned int);
  418 void slhci_freex(struct usbd_bus *, struct usbd_xfer *);
  419 static void slhci_get_lock(struct usbd_bus *, kmutex_t **);
  420 
  421 usbd_status slhci_transfer(struct usbd_xfer *);
  422 usbd_status slhci_start(struct usbd_xfer *);
  423 usbd_status slhci_root_start(struct usbd_xfer *);
  424 usbd_status slhci_open(struct usbd_pipe *);
  425 
  426 static int slhci_roothub_ctrl(struct usbd_bus *, usb_device_request_t *,
  427     void *, int);
  428 
  429 /*
  430  * slhci_supported_rev, slhci_preinit, slhci_attach, slhci_detach,
  431  * slhci_activate
  432  */
  433 
  434 void slhci_abort(struct usbd_xfer *);
  435 void slhci_close(struct usbd_pipe *);
  436 void slhci_clear_toggle(struct usbd_pipe *);
  437 void slhci_poll(struct usbd_bus *);
  438 void slhci_done(struct usbd_xfer *);
  439 void slhci_void(void *);
  440 
  441 /* lock entry functions */
  442 
  443 #ifdef SLHCI_MEM_ACCOUNTING
  444 void slhci_mem_use(struct usbd_bus *, int);
  445 #endif
  446 
  447 void slhci_reset_entry(void *);
  448 usbd_status slhci_lock_call(struct slhci_softc *, LockCallFunc,
  449     struct slhci_pipe *, struct usbd_xfer *);
  450 void slhci_start_entry(struct slhci_softc *, struct slhci_pipe *);
  451 void slhci_callback_entry(void *arg);
  452 void slhci_do_callback(struct slhci_softc *, struct usbd_xfer *);
  453 
  454 /* slhci_intr */
  455 
  456 void slhci_main(struct slhci_softc *);
  457 
  458 /* in lock functions */
  459 
  460 static void slhci_write(struct slhci_softc *, uint8_t, uint8_t);
  461 static uint8_t slhci_read(struct slhci_softc *, uint8_t);
  462 static void slhci_write_multi(struct slhci_softc *, uint8_t, uint8_t *, int);
  463 static void slhci_read_multi(struct slhci_softc *, uint8_t, uint8_t *, int);
  464 
  465 static void slhci_waitintr(struct slhci_softc *, int);
  466 static int slhci_dointr(struct slhci_softc *);
  467 static void slhci_abdone(struct slhci_softc *, int);
  468 static void slhci_tstart(struct slhci_softc *);
  469 static void slhci_dotransfer(struct slhci_softc *);
  470 
  471 static void slhci_callback(struct slhci_softc *);
  472 static void slhci_enter_xfer(struct slhci_softc *, struct slhci_pipe *);
  473 static void slhci_enter_xfers(struct slhci_softc *);
  474 static void slhci_queue_timed(struct slhci_softc *, struct slhci_pipe *);
  475 static void slhci_xfer_timer(struct slhci_softc *, struct slhci_pipe *);
  476 
  477 static void slhci_callback_schedule(struct slhci_softc *);
  478 static void slhci_do_callback_schedule(struct slhci_softc *);
  479 #if 0
  480 void slhci_pollxfer(struct slhci_softc *, struct usbd_xfer *); /* XXX */
  481 #endif
  482 
  483 static usbd_status slhci_do_poll(struct slhci_softc *, struct slhci_pipe *,
  484     struct usbd_xfer *);
  485 static usbd_status slhci_lsvh_warn(struct slhci_softc *, struct slhci_pipe *,
  486     struct usbd_xfer *);
  487 static usbd_status slhci_isoc_warn(struct slhci_softc *, struct slhci_pipe *,
  488     struct usbd_xfer *);
  489 static usbd_status slhci_open_pipe(struct slhci_softc *, struct slhci_pipe *,
  490     struct usbd_xfer *);
  491 static usbd_status slhci_close_pipe(struct slhci_softc *, struct slhci_pipe *,
  492     struct usbd_xfer *);
  493 static usbd_status slhci_do_abort(struct slhci_softc *, struct slhci_pipe *,
  494     struct usbd_xfer *);
  495 static usbd_status slhci_halt(struct slhci_softc *, struct slhci_pipe *,
  496     struct usbd_xfer *);
  497 
  498 static void slhci_intrchange(struct slhci_softc *, uint8_t);
  499 static void slhci_drain(struct slhci_softc *);
  500 static void slhci_reset(struct slhci_softc *);
  501 static int slhci_reserve_bustime(struct slhci_softc *, struct slhci_pipe *,
  502     int);
  503 static void slhci_insert(struct slhci_softc *);
  504 
  505 static usbd_status slhci_clear_feature(struct slhci_softc *, unsigned int);
  506 static usbd_status slhci_set_feature(struct slhci_softc *, unsigned int);
  507 static void slhci_get_status(struct slhci_softc *, usb_port_status_t *);
  508 
  509 #define SLHCIHIST_FUNC()        USBHIST_FUNC()
  510 #define SLHCIHIST_CALLED()      USBHIST_CALLED(slhcidebug)
  511 
  512 #ifdef SLHCI_DEBUG
  513 static int slhci_memtest(struct slhci_softc *);
  514 
  515 void slhci_log_buffer(struct usbd_xfer *);
  516 void slhci_log_req(usb_device_request_t *);
  517 void slhci_log_dumpreg(void);
  518 void slhci_log_xfer(struct usbd_xfer *);
  519 void slhci_log_spipe(struct slhci_pipe *);
  520 void slhci_print_intr(void);
  521 void slhci_log_sc(void);
  522 void slhci_log_slreq(struct slhci_pipe *);
  523 
  524 /* Constified so you can read the values from ddb */
  525 const int SLHCI_D_TRACE =       0x0001;
  526 const int SLHCI_D_MSG =         0x0002;
  527 const int SLHCI_D_XFER =        0x0004;
  528 const int SLHCI_D_MEM =         0x0008;
  529 const int SLHCI_D_INTR =        0x0010;
  530 const int SLHCI_D_SXFER =       0x0020;
  531 const int SLHCI_D_ERR =         0x0080;
  532 const int SLHCI_D_BUF =         0x0100;
  533 const int SLHCI_D_SOFT =        0x0200;
  534 const int SLHCI_D_WAIT =        0x0400;
  535 const int SLHCI_D_ROOT =        0x0800;
  536 /* SOF/NAK alone normally ignored, SOF also needs D_INTR */
  537 const int SLHCI_D_SOF =         0x1000;
  538 const int SLHCI_D_NAK =         0x2000;
  539 
  540 int slhcidebug = 0x1cbc; /* 0xc8c; */ /* 0xffff; */ /* 0xd8c; */
  541 
  542 SYSCTL_SETUP(sysctl_hw_slhci_setup, "sysctl hw.slhci setup")
  543 {
  544         int err;
  545         const struct sysctlnode *rnode;
  546         const struct sysctlnode *cnode;
  547 
  548         err = sysctl_createv(clog, 0, NULL, &rnode,
  549             CTLFLAG_PERMANENT, CTLTYPE_NODE, "slhci",
  550             SYSCTL_DESCR("slhci global controls"),
  551             NULL, 0, NULL, 0, CTL_HW, CTL_CREATE, CTL_EOL);
  552 
  553         if (err)
  554                 goto fail;
  555 
  556         /* control debugging printfs */
  557         err = sysctl_createv(clog, 0, &rnode, &cnode,
  558             CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
  559             "debug", SYSCTL_DESCR("Enable debugging output"),
  560             NULL, 0, &slhcidebug, sizeof(slhcidebug), CTL_CREATE, CTL_EOL);
  561         if (err)
  562                 goto fail;
  563 
  564         return;
  565 fail:
  566         aprint_error("%s: sysctl_createv failed (err = %d)\n", __func__, err);
  567 }
  568 
  569 struct slhci_softc *ssc;
  570 
  571 #define SLHCI_DEXEC(x, y) do { if ((slhcidebug & SLHCI_ ## x)) { y; } \
  572 } while (/*CONSTCOND*/ 0)
  573 #define DDOLOG(f, a, b, c, d) do { KERNHIST_LOG(usbhist, f, a, b, c, d); \
  574 } while (/*CONSTCOND*/0)
  575 #define DLOG(x, f, a, b, c, d) SLHCI_DEXEC(x, DDOLOG(f, a, b, c, d))
  576 
  577 /*
  578  * DDOLOGBUF logs a buffer up to 8 bytes at a time. No identifier so that we
  579  * can make it a real function.
  580  */
  581 static void
  582 DDOLOGBUF(uint8_t *buf, unsigned int length)
  583 {
  584         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
  585         int i;
  586 
  587         for(i = 0; i + 8 <= length; i += 8)
  588                 DDOLOG("%.4x %.4x %.4x %.4x", (buf[i] << 8) | buf[i+1],
  589                     (buf[i+2] << 8) | buf[i+3], (buf[i+4] << 8) | buf[i+5],
  590                     (buf[i+6] << 8) | buf[i+7]);
  591         if (length == i + 7)
  592                 DDOLOG("%.4x %.4x %.4x %.2x", (buf[i] << 8) | buf[i+1],
  593                     (buf[i+2] << 8) | buf[i+3], (buf[i+4] << 8) | buf[i+5],
  594                     buf[i+6]);
  595         else if (length == i + 6)
  596                 DDOLOG("%.4x %.4x %.4x", (buf[i] << 8) | buf[i+1],
  597                     (buf[i+2] << 8) | buf[i+3], (buf[i+4] << 8) | buf[i+5], 0);
  598         else if (length == i + 5)
  599                 DDOLOG("%.4x %.4x %.2x", (buf[i] << 8) | buf[i+1],
  600                     (buf[i+2] << 8) | buf[i+3], buf[i+4], 0);
  601         else if (length == i + 4)
  602                 DDOLOG("%.4x %.4x", (buf[i] << 8) | buf[i+1],
  603                     (buf[i+2] << 8) | buf[i+3], 0,0);
  604         else if (length == i + 3)
  605                 DDOLOG("%.4x %.2x", (buf[i] << 8) | buf[i+1], buf[i+2], 0,0);
  606         else if (length == i + 2)
  607                 DDOLOG("%.4x", (buf[i] << 8) | buf[i+1], 0,0,0);
  608         else if (length == i + 1)
  609                 DDOLOG("%.2x", buf[i], 0,0,0);
  610 }
  611 #define DLOGBUF(x, b, l) SLHCI_DEXEC(x, DDOLOGBUF(b, l))
  612 
  613 #define DDOLOGCTRL(x)   do {                                            \
  614     DDOLOG("CTRL suspend=%jd", !!((x) & SL11_CTRL_SUSPEND), 0, 0, 0);   \
  615     DDOLOG("CTRL ls     =%jd  jk     =%jd  reset  =%jd  sof    =%jd",   \
  616         !!((x) & SL11_CTRL_LOWSPEED), !!((x) & SL11_CTRL_JKSTATE),      \
  617         !!((x) & SL11_CTRL_RESETENGINE), !!((x) & SL11_CTRL_ENABLESOF));\
  618 } while (0)
  619 
  620 #define DDOLOGISR(r)    do {                                            \
  621     DDOLOG("ISR  data   =%jd  det/res=%jd  insert =%jd  sof    =%jd",   \
  622         !!((r) & SL11_ISR_DATA), !!((r) & SL11_ISR_RESUME),             \
  623         !!((r) & SL11_ISR_INSERT), !!!!((r) & SL11_ISR_SOF));           \
  624     DDOLOG("ISR             babble =%jd  usbb   =%jd  usba   =%jd",     \
  625         !!((r) & SL11_ISR_BABBLE), !!((r) & SL11_ISR_USBB),             \
  626         !!((r) & SL11_ISR_USBA), 0);                                    \
  627 } while (0)
  628 
  629 #define DDOLOGIER(r)    do {                                            \
  630     DDOLOG("IER              det/res=%d  insert =%d  sof    =%d",       \
  631         !!((r) & SL11_IER_RESUME),                                      \
  632         !!((r) & SL11_IER_INSERT), !!!!((r) & SL11_IER_SOF), 0);                \
  633     DDOLOG("IER              babble =%d  usbb   =%d  usba   =%d",       \
  634         !!((r) & SL11_IER_BABBLE), !!((r) & SL11_IER_USBB),             \
  635         !!((r) & SL11_IER_USBA), 0);                                    \
  636 } while (0)
  637 
  638 #define DDOLOGSTATUS(s) do {                                            \
  639     DDOLOG("STAT stall   =%d  nak     =%d  overflow =%d  setup   =%d",  \
  640         !!((s) & SL11_EPSTAT_STALL), !!((s) & SL11_EPSTAT_NAK),         \
  641         !!((s) & SL11_EPSTAT_OVERFLOW), !!((s) & SL11_EPSTAT_SETUP));   \
  642     DDOLOG("STAT sequence=%d  timeout =%d  error    =%d  ack     =%d",  \
  643         !!((s) & SL11_EPSTAT_SEQUENCE), !!((s) & SL11_EPSTAT_TIMEOUT),  \
  644         !!((s) & SL11_EPSTAT_ERROR), !!((s) & SL11_EPSTAT_ACK));        \
  645 } while (0)
  646 
  647 #define DDOLOGEPCTRL(r) do {                                            \
  648     DDOLOG("CTRL preamble=%d  toggle  =%d  sof     =%d  iso     =%d",   \
  649         !!((r) & SL11_EPCTRL_PREAMBLE), !!((r) & SL11_EPCTRL_DATATOGGLE),\
  650         !!((r) & SL11_EPCTRL_SOF), !!((r) & SL11_EPCTRL_ISO));          \
  651     DDOLOG("CTRL              out     =%d  enable  =%d  arm     =%d",   \
  652         !!((r) & SL11_EPCTRL_DIRECTION),                                \
  653         !!((r) & SL11_EPCTRL_ENABLE), !!((r) & SL11_EPCTRL_ARM), 0);    \
  654 } while (0)
  655 
  656 #define DDOLOGEPSTAT(r) do {                                            \
  657     DDOLOG("STAT stall   =%d  nak     =%d  overflow =%d  setup   =%d",  \
  658         !!((r) & SL11_EPSTAT_STALL), !!((r) & SL11_EPSTAT_NAK),         \
  659         !!((r) & SL11_EPSTAT_OVERFLOW), !!((r) & SL11_EPSTAT_SETUP));   \
  660     DDOLOG("STAT sequence=%d  timeout =%d  error    =%d  ack   =%d",    \
  661         !!((r) & SL11_EPSTAT_SEQUENCE), !!((r) & SL11_EPSTAT_TIMEOUT),  \
  662         !!((r) & SL11_EPSTAT_ERROR), !!((r) & SL11_EPSTAT_ACK));        \
  663 } while (0)
  664 #else /* now !SLHCI_DEBUG */
  665 #define slhcidebug 0
  666 #define slhci_log_spipe(spipe) ((void)0)
  667 #define slhci_log_xfer(xfer) ((void)0)
  668 #define SLHCI_DEXEC(x, y) ((void)0)
  669 #define DDOLOG(f, a, b, c, d) ((void)0)
  670 #define DLOG(x, f, a, b, c, d) ((void)0)
  671 #define DDOLOGBUF(b, l) ((void)0)
  672 #define DLOGBUF(x, b, l) ((void)0)
  673 #define DDOLOGCTRL(x) ((void)0)
  674 #define DDOLOGISR(r) ((void)0)
  675 #define DDOLOGIER(r) ((void)0)
  676 #define DDOLOGSTATUS(s) ((void)0)
  677 #define DDOLOGEPCTRL(r) ((void)0)
  678 #define DDOLOGEPSTAT(r) ((void)0)
  679 #endif /* SLHCI_DEBUG */
  680 
  681 #ifdef DIAGNOSTIC
  682 #define LK_SLASSERT(exp, sc, spipe, xfer, ext) do {                     \
  683         if (!(exp)) {                                                   \
  684                 printf("%s: assertion %s failed line %u function %s!"   \
  685                 " halted\n", SC_NAME(sc), #exp, __LINE__, __func__);\
  686                 slhci_halt(sc, spipe, xfer);                            \
  687                 ext;                                                    \
  688         }                                                               \
  689 } while (/*CONSTCOND*/0)
  690 #define UL_SLASSERT(exp, sc, spipe, xfer, ext) do {                     \
  691         if (!(exp)) {                                                   \
  692                 printf("%s: assertion %s failed line %u function %s!"   \
  693                 " halted\n", SC_NAME(sc), #exp, __LINE__, __func__);    \
  694                 slhci_lock_call(sc, &slhci_halt, spipe, xfer);          \
  695                 ext;                                                    \
  696         }                                                               \
  697 } while (/*CONSTCOND*/0)
  698 #else
  699 #define LK_SLASSERT(exp, sc, spipe, xfer, ext) ((void)0)
  700 #define UL_SLASSERT(exp, sc, spipe, xfer, ext) ((void)0)
  701 #endif
  702 
  703 const struct usbd_bus_methods slhci_bus_methods = {
  704         .ubm_open = slhci_open,
  705         .ubm_softint = slhci_void,
  706         .ubm_dopoll = slhci_poll,
  707         .ubm_allocx = slhci_allocx,
  708         .ubm_freex = slhci_freex,
  709         .ubm_getlock = slhci_get_lock,
  710         .ubm_rhctrl = slhci_roothub_ctrl,
  711 };
  712 
  713 const struct usbd_pipe_methods slhci_pipe_methods = {
  714         .upm_transfer = slhci_transfer,
  715         .upm_start = slhci_start,
  716         .upm_abort = slhci_abort,
  717         .upm_close = slhci_close,
  718         .upm_cleartoggle = slhci_clear_toggle,
  719         .upm_done = slhci_done,
  720 };
  721 
  722 const struct usbd_pipe_methods slhci_root_methods = {
  723         .upm_transfer = slhci_transfer,
  724         .upm_start = slhci_root_start,
  725         .upm_abort = slhci_abort,
  726         .upm_close = (void (*)(struct usbd_pipe *))slhci_void, /* XXX safe? */
  727         .upm_cleartoggle = slhci_clear_toggle,
  728         .upm_done = slhci_done,
  729 };
  730 
  731 /* Queue inlines */
  732 
  733 #define GOT_FIRST_TO(tvar, t) \
  734     GCQ_GOT_FIRST_TYPED(tvar, &(t)->to, struct slhci_pipe, to)
  735 
  736 #define FIND_TO(var, t, tvar, cond) \
  737     GCQ_FIND_TYPED(var, &(t)->to, tvar, struct slhci_pipe, to, cond)
  738 
  739 #define FOREACH_AP(var, t, tvar) \
  740     GCQ_FOREACH_TYPED(var, &(t)->ap, tvar, struct slhci_pipe, ap)
  741 
  742 #define GOT_FIRST_TIMED_COND(tvar, t, cond) \
  743     GCQ_GOT_FIRST_COND_TYPED(tvar, &(t)->timed, struct slhci_pipe, xq, cond)
  744 
  745 #define GOT_FIRST_CB(tvar, t) \
  746     GCQ_GOT_FIRST_TYPED(tvar, &(t)->q[Q_CB], struct slhci_pipe, xq)
  747 
  748 #define DEQUEUED_CALLBACK(tvar, t) \
  749     GCQ_DEQUEUED_FIRST_TYPED(tvar, &(t)->q[Q_CALLBACKS], struct slhci_pipe, xq)
  750 
  751 #define FIND_TIMED(var, t, tvar, cond) \
  752    GCQ_FIND_TYPED(var, &(t)->timed, tvar, struct slhci_pipe, xq, cond)
  753 
  754 #define DEQUEUED_WAITQ(tvar, sc) \
  755     GCQ_DEQUEUED_FIRST_TYPED(tvar, &(sc)->sc_waitq, struct slhci_pipe, xq)
  756 
  757 static inline void
  758 enter_waitq(struct slhci_softc *sc, struct slhci_pipe *spipe)
  759 {
  760         gcq_insert_tail(&sc->sc_waitq, &spipe->xq);
  761 }
  762 
  763 static inline void
  764 enter_q(struct slhci_transfers *t, struct slhci_pipe *spipe, int i)
  765 {
  766         gcq_insert_tail(&t->q[i], &spipe->xq);
  767 }
  768 
  769 static inline void
  770 enter_callback(struct slhci_transfers *t, struct slhci_pipe *spipe)
  771 {
  772         gcq_insert_tail(&t->q[Q_CALLBACKS], &spipe->xq);
  773 }
  774 
  775 static inline void
  776 enter_all_pipes(struct slhci_transfers *t, struct slhci_pipe *spipe)
  777 {
  778         gcq_insert_tail(&t->ap, &spipe->ap);
  779 }
  780 
  781 /* Start out of lock functions. */
  782 
  783 struct usbd_xfer *
  784 slhci_allocx(struct usbd_bus *bus, unsigned int nframes)
  785 {
  786         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
  787         struct usbd_xfer *xfer;
  788 
  789         xfer = kmem_zalloc(sizeof(*xfer), KM_SLEEP);
  790 
  791         DLOG(D_MEM, "allocx %#jx", (uintptr_t)xfer, 0,0,0);
  792 
  793 #ifdef SLHCI_MEM_ACCOUNTING
  794         slhci_mem_use(bus, 1);
  795 #endif
  796 #ifdef DIAGNOSTIC
  797         if (xfer != NULL)
  798                 xfer->ux_state = XFER_BUSY;
  799 #endif
  800         return xfer;
  801 }
  802 
  803 void
  804 slhci_freex(struct usbd_bus *bus, struct usbd_xfer *xfer)
  805 {
  806         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
  807         DLOG(D_MEM, "freex xfer %#jx spipe %#jx",
  808             (uintptr_t)xfer, (uintptr_t)xfer->ux_pipe,0,0);
  809 
  810 #ifdef SLHCI_MEM_ACCOUNTING
  811         slhci_mem_use(bus, -1);
  812 #endif
  813 #ifdef DIAGNOSTIC
  814         if (xfer->ux_state != XFER_BUSY &&
  815             xfer->ux_status != USBD_NOT_STARTED) {
  816                 struct slhci_softc *sc = SLHCI_BUS2SC(bus);
  817                 printf("%s: slhci_freex: xfer=%p not busy, %#08x halted\n",
  818                     SC_NAME(sc), xfer, xfer->ux_state);
  819                 DDOLOG("xfer=%p not busy, %#08x halted\n", xfer,
  820                     xfer->ux_state, 0, 0);
  821                 slhci_lock_call(sc, &slhci_halt, NULL, NULL);
  822                 return;
  823         }
  824         xfer->ux_state = XFER_FREE;
  825 #endif
  826 
  827         kmem_free(xfer, sizeof(*xfer));
  828 }
  829 
  830 static void
  831 slhci_get_lock(struct usbd_bus *bus, kmutex_t **lock)
  832 {
  833         struct slhci_softc *sc = SLHCI_BUS2SC(bus);
  834 
  835         *lock = &sc->sc_lock;
  836 }
  837 
  838 usbd_status
  839 slhci_transfer(struct usbd_xfer *xfer)
  840 {
  841         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
  842         usbd_status error;
  843 
  844         DLOG(D_TRACE, "transfer type %jd xfer %#jx spipe %#jx ",
  845             SLHCI_XFER_TYPE(xfer), (uintptr_t)xfer, (uintptr_t)xfer->ux_pipe,
  846             0);
  847 
  848         /* Pipe isn't running, so start it first.  */
  849         error = xfer->ux_pipe->up_methods->upm_start(SIMPLEQ_FIRST(&xfer->ux_pipe->up_queue));
  850 
  851         return error;
  852 }
  853 
  854 /* It is not safe for start to return anything other than USBD_INPROG. */
  855 usbd_status
  856 slhci_start(struct usbd_xfer *xfer)
  857 {
  858         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
  859         struct slhci_softc *sc = SLHCI_XFER2SC(xfer);
  860         struct usbd_pipe *pipe = xfer->ux_pipe;
  861         struct slhci_pipe *spipe = SLHCI_PIPE2SPIPE(pipe);
  862         struct slhci_transfers *t = &sc->sc_transfers;
  863         usb_endpoint_descriptor_t *ed = pipe->up_endpoint->ue_edesc;
  864         unsigned int max_packet;
  865 
  866         KASSERT(sc->sc_bus.ub_usepolling || mutex_owned(&sc->sc_lock));
  867 
  868         max_packet = UGETW(ed->wMaxPacketSize);
  869 
  870         DLOG(D_TRACE, "transfer type %jd start xfer %#jx spipe %#jx length %jd",
  871             spipe->ptype, (uintptr_t)xfer, (uintptr_t)spipe, xfer->ux_length);
  872 
  873         /* root transfers use slhci_root_start */
  874 
  875         KASSERT(spipe->xfer == NULL); /* not SLASSERT */
  876 
  877         xfer->ux_actlen = 0;
  878         xfer->ux_status = USBD_IN_PROGRESS;
  879 
  880         spipe->xfer = xfer;
  881 
  882         spipe->nerrs = 0;
  883         spipe->frame = t->frame;
  884         spipe->control = SL11_EPCTRL_ARM_ENABLE;
  885         spipe->tregs[DEV] = pipe->up_dev->ud_addr;
  886         spipe->tregs[PID] = spipe->newpid = UE_GET_ADDR(ed->bEndpointAddress)
  887             | (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN ? SL11_PID_IN :
  888             SL11_PID_OUT);
  889         spipe->newlen[0] = xfer->ux_length % max_packet;
  890         spipe->newlen[1] = uimin(xfer->ux_length, max_packet);
  891 
  892         if (spipe->ptype == PT_BULK || spipe->ptype == PT_INTR) {
  893                 if (spipe->pflags & PF_TOGGLE)
  894                         spipe->control |= SL11_EPCTRL_DATATOGGLE;
  895                 spipe->tregs[LEN] = spipe->newlen[1];
  896                 if (spipe->tregs[LEN])
  897                         spipe->buffer = xfer->ux_buf;
  898                 else
  899                         spipe->buffer = NULL;
  900                 spipe->lastframe = t->frame;
  901                 if (spipe->ptype == PT_INTR) {
  902                         spipe->frame = spipe->lastframe +
  903                             spipe->pipe.up_interval;
  904                 }
  905 
  906 #if defined(DEBUG) || defined(SLHCI_DEBUG)
  907                 if (__predict_false(spipe->ptype == PT_INTR &&
  908                     xfer->ux_length > spipe->tregs[LEN])) {
  909                         printf("%s: Long INTR transfer not supported!\n",
  910                             SC_NAME(sc));
  911                         DDOLOG("Long INTR transfer not supported!", 0, 0, 0, 0);
  912                         xfer->ux_status = USBD_INVAL;
  913                 }
  914 #endif
  915         } else {
  916                 /* ptype may be currently set to any control transfer type. */
  917                 SLHCI_DEXEC(D_TRACE, slhci_log_xfer(xfer));
  918 
  919                 /* SETUP contains IN/OUT bits also */
  920                 spipe->tregs[PID] |= SL11_PID_SETUP;
  921                 spipe->tregs[LEN] = 8;
  922                 spipe->buffer = (uint8_t *)&xfer->ux_request;
  923                 DLOGBUF(D_XFER, spipe->buffer, spipe->tregs[LEN]);
  924                 spipe->ptype = PT_CTRL_SETUP;
  925                 spipe->newpid &= ~SL11_PID_BITS;
  926                 if (xfer->ux_length == 0 ||
  927                     (xfer->ux_request.bmRequestType & UT_READ))
  928                         spipe->newpid |= SL11_PID_IN;
  929                 else
  930                         spipe->newpid |= SL11_PID_OUT;
  931         }
  932 
  933         if (xfer->ux_flags & USBD_FORCE_SHORT_XFER &&
  934             spipe->tregs[LEN] == max_packet &&
  935             (spipe->newpid & SL11_PID_BITS) == SL11_PID_OUT)
  936                 spipe->wantshort = 1;
  937         else
  938                 spipe->wantshort = 0;
  939 
  940         /*
  941          * The goal of newbustime and newlen is to avoid bustime calculation
  942          * in the interrupt.  The calculations are not too complex, but they
  943          * complicate the conditional logic somewhat and doing them all in the
  944          * same place shares constants. Index 0 is "short length" for bulk and
  945          * ctrl data and 1 is "full length" for ctrl data (bulk/intr are
  946          * already set to full length).
  947          */
  948         if (spipe->pflags & PF_LS) {
  949                 /*
  950                  * Setting PREAMBLE for directly connected LS devices will
  951                  * lock up the chip.
  952                  */
  953                 if (spipe->pflags & PF_PREAMBLE)
  954                         spipe->control |= SL11_EPCTRL_PREAMBLE;
  955                 if (max_packet <= 8) {
  956                         spipe->bustime = SLHCI_LS_CONST +
  957                             SLHCI_LS_DATA_TIME(spipe->tregs[LEN]);
  958                         spipe->newbustime[0] = SLHCI_LS_CONST +
  959                             SLHCI_LS_DATA_TIME(spipe->newlen[0]);
  960                         spipe->newbustime[1] = SLHCI_LS_CONST +
  961                             SLHCI_LS_DATA_TIME(spipe->newlen[1]);
  962                 } else
  963                         xfer->ux_status = USBD_INVAL;
  964         } else {
  965                 UL_SLASSERT(pipe->up_dev->ud_speed == USB_SPEED_FULL, sc,
  966                     spipe, xfer, return USBD_IN_PROGRESS);
  967                 if (max_packet <= SL11_MAX_PACKET_SIZE) {
  968                         spipe->bustime = SLHCI_FS_CONST +
  969                             SLHCI_FS_DATA_TIME(spipe->tregs[LEN]);
  970                         spipe->newbustime[0] = SLHCI_FS_CONST +
  971                             SLHCI_FS_DATA_TIME(spipe->newlen[0]);
  972                         spipe->newbustime[1] = SLHCI_FS_CONST +
  973                             SLHCI_FS_DATA_TIME(spipe->newlen[1]);
  974                 } else
  975                         xfer->ux_status = USBD_INVAL;
  976         }
  977 
  978         /*
  979          * The datasheet incorrectly indicates that DIRECTION is for
  980          * "transmit to host".  It is for OUT and SETUP.  The app note
  981          * describes its use correctly.
  982          */
  983         if ((spipe->tregs[PID] & SL11_PID_BITS) != SL11_PID_IN)
  984                 spipe->control |= SL11_EPCTRL_DIRECTION;
  985 
  986         slhci_start_entry(sc, spipe);
  987 
  988         return USBD_IN_PROGRESS;
  989 }
  990 
  991 usbd_status
  992 slhci_root_start(struct usbd_xfer *xfer)
  993 {
  994         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
  995         struct slhci_softc *sc;
  996         struct slhci_pipe *spipe __diagused;
  997 
  998         spipe = SLHCI_PIPE2SPIPE(xfer->ux_pipe);
  999         sc = SLHCI_XFER2SC(xfer);
 1000 
 1001         struct slhci_transfers *t = &sc->sc_transfers;
 1002 
 1003         LK_SLASSERT(spipe != NULL && xfer != NULL, sc, spipe, xfer, return
 1004             USBD_CANCELLED);
 1005 
 1006         DLOG(D_TRACE, "transfer type %jd start",
 1007             SLHCI_XFER_TYPE(xfer), 0, 0, 0);
 1008 
 1009         KASSERT(sc->sc_bus.ub_usepolling || mutex_owned(&sc->sc_lock));
 1010 
 1011         KASSERT(spipe->ptype == PT_ROOT_INTR);
 1012 
 1013         KASSERT(t->rootintr == NULL);
 1014         t->rootintr = xfer;
 1015         xfer->ux_status = USBD_IN_PROGRESS;
 1016 
 1017         return USBD_IN_PROGRESS;
 1018 }
 1019 
 1020 usbd_status
 1021 slhci_open(struct usbd_pipe *pipe)
 1022 {
 1023         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 1024         struct usbd_device *dev;
 1025         struct slhci_softc *sc;
 1026         struct slhci_pipe *spipe;
 1027         usb_endpoint_descriptor_t *ed;
 1028         unsigned int max_packet, pmaxpkt;
 1029         uint8_t rhaddr;
 1030 
 1031         dev = pipe->up_dev;
 1032         sc = SLHCI_PIPE2SC(pipe);
 1033         spipe = SLHCI_PIPE2SPIPE(pipe);
 1034         ed = pipe->up_endpoint->ue_edesc;
 1035         rhaddr = dev->ud_bus->ub_rhaddr;
 1036 
 1037         DLOG(D_TRACE, "slhci_open(addr=%jd,ep=%jd,rootaddr=%jd)",
 1038                 dev->ud_addr, ed->bEndpointAddress, rhaddr, 0);
 1039 
 1040         spipe->pflags = 0;
 1041         spipe->frame = 0;
 1042         spipe->lastframe = 0;
 1043         spipe->xfer = NULL;
 1044         spipe->buffer = NULL;
 1045 
 1046         gcq_init(&spipe->ap);
 1047         gcq_init(&spipe->to);
 1048         gcq_init(&spipe->xq);
 1049 
 1050         /*
 1051          * The endpoint descriptor will not have been set up yet in the case
 1052          * of the standard control pipe, so the max packet checks are also
 1053          * necessary in start.
 1054          */
 1055 
 1056         max_packet = UGETW(ed->wMaxPacketSize);
 1057 
 1058         if (dev->ud_speed == USB_SPEED_LOW) {
 1059                 spipe->pflags |= PF_LS;
 1060                 if (dev->ud_myhub->ud_addr != rhaddr) {
 1061                         spipe->pflags |= PF_PREAMBLE;
 1062                         if (!slhci_try_lsvh)
 1063                                 return slhci_lock_call(sc, &slhci_lsvh_warn,
 1064                                     spipe, NULL);
 1065                 }
 1066                 pmaxpkt = 8;
 1067         } else
 1068                 pmaxpkt = SL11_MAX_PACKET_SIZE;
 1069 
 1070         if (max_packet > pmaxpkt) {
 1071                 DLOG(D_ERR, "packet too large! size %jd spipe %#jx", max_packet,
 1072                     (uintptr_t)spipe, 0,0);
 1073                 return USBD_INVAL;
 1074         }
 1075 
 1076         if (dev->ud_addr == rhaddr) {
 1077                 switch (ed->bEndpointAddress) {
 1078                 case USB_CONTROL_ENDPOINT:
 1079                         spipe->ptype = PT_ROOT_CTRL;
 1080                         pipe->up_interval = 0;
 1081                         pipe->up_methods = &roothub_ctrl_methods;
 1082                         break;
 1083                 case UE_DIR_IN | USBROOTHUB_INTR_ENDPT:
 1084                         spipe->ptype = PT_ROOT_INTR;
 1085                         pipe->up_interval = 1;
 1086                         pipe->up_methods = &slhci_root_methods;
 1087                         break;
 1088                 default:
 1089                         printf("%s: Invalid root endpoint!\n", SC_NAME(sc));
 1090                         DDOLOG("Invalid root endpoint", 0, 0, 0, 0);
 1091                         return USBD_INVAL;
 1092                 }
 1093                 return USBD_NORMAL_COMPLETION;
 1094         } else {
 1095                 switch (ed->bmAttributes & UE_XFERTYPE) {
 1096                 case UE_CONTROL:
 1097                         spipe->ptype = PT_CTRL_SETUP;
 1098                         pipe->up_interval = 0;
 1099                         break;
 1100                 case UE_INTERRUPT:
 1101                         spipe->ptype = PT_INTR;
 1102                         if (pipe->up_interval == USBD_DEFAULT_INTERVAL)
 1103                                 pipe->up_interval = ed->bInterval;
 1104                         break;
 1105                 case UE_ISOCHRONOUS:
 1106                         return slhci_lock_call(sc, &slhci_isoc_warn, spipe,
 1107                             NULL);
 1108                 case UE_BULK:
 1109                         spipe->ptype = PT_BULK;
 1110                         pipe->up_interval = 0;
 1111                         break;
 1112                 }
 1113 
 1114                 DLOG(D_MSG, "open pipe type %jd interval %jd", spipe->ptype,
 1115                     pipe->up_interval, 0,0);
 1116 
 1117                 pipe->up_methods = __UNCONST(&slhci_pipe_methods);
 1118 
 1119                 return slhci_lock_call(sc, &slhci_open_pipe, spipe, NULL);
 1120         }
 1121 }
 1122 
 1123 int
 1124 slhci_supported_rev(uint8_t rev)
 1125 {
 1126         return rev >= SLTYPE_SL811HS_R12 && rev <= SLTYPE_SL811HS_R15;
 1127 }
 1128 
 1129 /*
 1130  * Must be called before the ISR is registered. Interrupts can be shared so
 1131  * slhci_intr could be called as soon as the ISR is registered.
 1132  * Note max_current argument is actual current, but stored as current/2
 1133  */
 1134 void
 1135 slhci_preinit(struct slhci_softc *sc, PowerFunc pow, bus_space_tag_t iot,
 1136     bus_space_handle_t ioh, uint16_t max_current, uint32_t stride)
 1137 {
 1138         struct slhci_transfers *t;
 1139         int i;
 1140 
 1141         t = &sc->sc_transfers;
 1142 
 1143 #ifdef SLHCI_DEBUG
 1144         ssc = sc;
 1145 #endif
 1146 
 1147         mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_SOFTUSB);
 1148         mutex_init(&sc->sc_intr_lock, MUTEX_DEFAULT, IPL_USB);
 1149 
 1150         /* sc->sc_ier = 0;      */
 1151         /* t->rootintr = NULL;  */
 1152         t->flags = F_NODEV|F_UDISABLED;
 1153         t->pend = INT_MAX;
 1154         KASSERT(slhci_wait_time != INT_MAX);
 1155         t->len[0] = t->len[1] = -1;
 1156         if (max_current > 500)
 1157                 max_current = 500;
 1158         t->max_current = (uint8_t)(max_current / 2);
 1159         sc->sc_enable_power = pow;
 1160         sc->sc_iot = iot;
 1161         sc->sc_ioh = ioh;
 1162         sc->sc_stride = stride;
 1163 
 1164         KASSERT(Q_MAX+1 == sizeof(t->q) / sizeof(t->q[0]));
 1165 
 1166         for (i = 0; i <= Q_MAX; i++)
 1167                 gcq_init_head(&t->q[i]);
 1168         gcq_init_head(&t->timed);
 1169         gcq_init_head(&t->to);
 1170         gcq_init_head(&t->ap);
 1171         gcq_init_head(&sc->sc_waitq);
 1172 }
 1173 
 1174 int
 1175 slhci_attach(struct slhci_softc *sc)
 1176 {
 1177         struct slhci_transfers *t;
 1178         const char *rev;
 1179 
 1180         t = &sc->sc_transfers;
 1181 
 1182         /* Detect and check the controller type */
 1183         t->sltype = SL11_GET_REV(slhci_read(sc, SL11_REV));
 1184 
 1185         /* SL11H not supported */
 1186         if (!slhci_supported_rev(t->sltype)) {
 1187                 if (t->sltype == SLTYPE_SL11H)
 1188                         printf("%s: SL11H unsupported or bus error!\n",
 1189                             SC_NAME(sc));
 1190                 else
 1191                         printf("%s: Unknown chip revision!\n", SC_NAME(sc));
 1192                 return -1;
 1193         }
 1194 
 1195 #ifdef SLHCI_DEBUG
 1196         if (slhci_memtest(sc)) {
 1197                 printf("%s: memory/bus error!\n", SC_NAME(sc));
 1198                 return -1;
 1199         }
 1200 #endif
 1201 
 1202         callout_init(&sc->sc_timer, CALLOUT_MPSAFE);
 1203         callout_setfunc(&sc->sc_timer, slhci_reset_entry, sc);
 1204 
 1205         /*
 1206          * It is not safe to call the soft interrupt directly as
 1207          * usb_schedsoftintr does in the ub_usepolling case (due to locking).
 1208          */
 1209         sc->sc_cb_softintr = softint_establish(SOFTINT_NET,
 1210             slhci_callback_entry, sc);
 1211 
 1212         if (t->sltype == SLTYPE_SL811HS_R12)
 1213                 rev = "(rev 1.2)";
 1214         else if (t->sltype == SLTYPE_SL811HS_R14)
 1215                 rev = "(rev 1.4 or 1.5)";
 1216         else
 1217                 rev = "(unknown revision)";
 1218 
 1219         aprint_normal("%s: ScanLogic SL811HS/T USB Host Controller %s\n",
 1220             SC_NAME(sc), rev);
 1221 
 1222         aprint_normal("%s: Max Current %u mA (value by code, not by probe)\n",
 1223             SC_NAME(sc), t->max_current * 2);
 1224 
 1225 #if defined(SLHCI_DEBUG) || defined(SLHCI_NO_OVERTIME) || \
 1226     defined(SLHCI_TRY_LSVH) || defined(SLHCI_PROFILE_TRANSFER)
 1227         aprint_normal("%s: driver options:"
 1228 #ifdef SLHCI_DEBUG
 1229         " SLHCI_DEBUG"
 1230 #endif
 1231 #ifdef SLHCI_TRY_LSVH
 1232         " SLHCI_TRY_LSVH"
 1233 #endif
 1234 #ifdef SLHCI_NO_OVERTIME
 1235         " SLHCI_NO_OVERTIME"
 1236 #endif
 1237 #ifdef SLHCI_PROFILE_TRANSFER
 1238         " SLHCI_PROFILE_TRANSFER"
 1239 #endif
 1240         "\n", SC_NAME(sc));
 1241 #endif
 1242         sc->sc_bus.ub_revision = USBREV_1_1;
 1243         sc->sc_bus.ub_methods = __UNCONST(&slhci_bus_methods);
 1244         sc->sc_bus.ub_pipesize = sizeof(struct slhci_pipe);
 1245         sc->sc_bus.ub_usedma = false;
 1246 
 1247         if (!sc->sc_enable_power)
 1248                 t->flags |= F_REALPOWER;
 1249 
 1250         t->flags |= F_ACTIVE;
 1251 
 1252         /* Attach usb and uhub. */
 1253         sc->sc_child = config_found(SC_DEV(sc), &sc->sc_bus, usbctlprint,
 1254             CFARGS_NONE);
 1255 
 1256         if (!sc->sc_child)
 1257                 return -1;
 1258         else
 1259                 return 0;
 1260 }
 1261 
 1262 int
 1263 slhci_detach(struct slhci_softc *sc, int flags)
 1264 {
 1265         struct slhci_transfers *t;
 1266         int ret;
 1267 
 1268         t = &sc->sc_transfers;
 1269 
 1270         /* By this point bus access is no longer allowed. */
 1271 
 1272         KASSERT(!(t->flags & F_ACTIVE));
 1273 
 1274         /*
 1275          * To be MPSAFE is not sufficient to cancel callouts and soft
 1276          * interrupts and assume they are dead since the code could already be
 1277          * running or about to run.  Wait until they are known to be done.
 1278          */
 1279         while (t->flags & (F_RESET|F_CALLBACK))
 1280                 tsleep(&sc, PPAUSE, "slhci_detach", hz);
 1281 
 1282         softint_disestablish(sc->sc_cb_softintr);
 1283 
 1284         mutex_destroy(&sc->sc_lock);
 1285         mutex_destroy(&sc->sc_intr_lock);
 1286 
 1287         ret = 0;
 1288 
 1289         if (sc->sc_child)
 1290                 ret = config_detach(sc->sc_child, flags);
 1291 
 1292 #ifdef SLHCI_MEM_ACCOUNTING
 1293         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 1294         if (sc->sc_mem_use) {
 1295                 printf("%s: Memory still in use after detach! mem_use (count)"
 1296                     " = %d\n", SC_NAME(sc), sc->sc_mem_use);
 1297                 DDOLOG("Memory still in use after detach! mem_use (count)"
 1298                     " = %d", sc->sc_mem_use, 0, 0, 0);
 1299         }
 1300 #endif
 1301 
 1302         return ret;
 1303 }
 1304 
 1305 int
 1306 slhci_activate(device_t self, enum devact act)
 1307 {
 1308         struct slhci_softc *sc = device_private(self);
 1309 
 1310         switch (act) {
 1311         case DVACT_DEACTIVATE:
 1312                 slhci_lock_call(sc, &slhci_halt, NULL, NULL);
 1313                 return 0;
 1314         default:
 1315                 return EOPNOTSUPP;
 1316         }
 1317 }
 1318 
 1319 void
 1320 slhci_abort(struct usbd_xfer *xfer)
 1321 {
 1322         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 1323         struct slhci_softc *sc;
 1324         struct slhci_pipe *spipe;
 1325 
 1326         spipe = SLHCI_PIPE2SPIPE(xfer->ux_pipe);
 1327 
 1328         if (spipe == NULL)
 1329                 goto callback;
 1330 
 1331         sc = SLHCI_XFER2SC(xfer);
 1332         KASSERT(mutex_owned(&sc->sc_lock));
 1333 
 1334         DLOG(D_TRACE, "transfer type %jd abort xfer %#jx spipe %#jx "
 1335             " spipe->xfer %#jx", spipe->ptype, (uintptr_t)xfer,
 1336             (uintptr_t)spipe, (uintptr_t)spipe->xfer);
 1337 
 1338         slhci_lock_call(sc, &slhci_do_abort, spipe, xfer);
 1339 
 1340 callback:
 1341         xfer->ux_status = USBD_CANCELLED;
 1342         usb_transfer_complete(xfer);
 1343 }
 1344 
 1345 void
 1346 slhci_close(struct usbd_pipe *pipe)
 1347 {
 1348         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 1349         struct slhci_softc *sc;
 1350         struct slhci_pipe *spipe;
 1351 
 1352         sc = SLHCI_PIPE2SC(pipe);
 1353         spipe = SLHCI_PIPE2SPIPE(pipe);
 1354 
 1355         DLOG(D_TRACE, "transfer type %jd close spipe %#jx spipe->xfer %#jx",
 1356             spipe->ptype, (uintptr_t)spipe, (uintptr_t)spipe->xfer, 0);
 1357 
 1358         slhci_lock_call(sc, &slhci_close_pipe, spipe, NULL);
 1359 }
 1360 
 1361 void
 1362 slhci_clear_toggle(struct usbd_pipe *pipe)
 1363 {
 1364         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 1365         struct slhci_pipe *spipe;
 1366 
 1367         spipe = SLHCI_PIPE2SPIPE(pipe);
 1368 
 1369         DLOG(D_TRACE, "transfer type %jd toggle spipe %#jx", spipe->ptype,
 1370             (uintptr_t)spipe, 0, 0);
 1371 
 1372         spipe->pflags &= ~PF_TOGGLE;
 1373 
 1374 #ifdef DIAGNOSTIC
 1375         if (spipe->xfer != NULL) {
 1376                 struct slhci_softc *sc = (struct slhci_softc
 1377                     *)pipe->up_dev->ud_bus;
 1378 
 1379                 printf("%s: Clear toggle on transfer in progress! halted\n",
 1380                     SC_NAME(sc));
 1381                 DDOLOG("Clear toggle on transfer in progress! halted",
 1382                     0, 0, 0, 0);
 1383                 slhci_halt(sc, NULL, NULL);
 1384         }
 1385 #endif
 1386 }
 1387 
 1388 void
 1389 slhci_poll(struct usbd_bus *bus) /* XXX necessary? */
 1390 {
 1391         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 1392         struct slhci_softc *sc;
 1393 
 1394         sc = SLHCI_BUS2SC(bus);
 1395 
 1396         DLOG(D_TRACE, "slhci_poll", 0,0,0,0);
 1397 
 1398         slhci_lock_call(sc, &slhci_do_poll, NULL, NULL);
 1399 }
 1400 
 1401 void
 1402 slhci_done(struct usbd_xfer *xfer)
 1403 {
 1404 }
 1405 
 1406 void
 1407 slhci_void(void *v) {}
 1408 
 1409 /* End out of lock functions. Start lock entry functions. */
 1410 
 1411 #ifdef SLHCI_MEM_ACCOUNTING
 1412 void
 1413 slhci_mem_use(struct usbd_bus *bus, int val)
 1414 {
 1415         struct slhci_softc *sc = SLHCI_BUS2SC(bus);
 1416 
 1417         mutex_enter(&sc->sc_intr_lock);
 1418         sc->sc_mem_use += val;
 1419         mutex_exit(&sc->sc_intr_lock);
 1420 }
 1421 #endif
 1422 
 1423 void
 1424 slhci_reset_entry(void *arg)
 1425 {
 1426         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 1427         struct slhci_softc *sc = arg;
 1428 
 1429         mutex_enter(&sc->sc_intr_lock);
 1430         slhci_reset(sc);
 1431         /*
 1432          * We cannot call the callback directly since we could then be reset
 1433          * again before finishing and need the callout delay for timing.
 1434          * Scheduling the callout again before we exit would defeat the reap
 1435          * mechanism since we could be unlocked while the reset flag is not
 1436          * set. The callback code will check the wait queue.
 1437          */
 1438         slhci_callback_schedule(sc);
 1439         mutex_exit(&sc->sc_intr_lock);
 1440 }
 1441 
 1442 usbd_status
 1443 slhci_lock_call(struct slhci_softc *sc, LockCallFunc lcf, struct slhci_pipe
 1444     *spipe, struct usbd_xfer *xfer)
 1445 {
 1446         usbd_status ret;
 1447 
 1448         mutex_enter(&sc->sc_intr_lock);
 1449         ret = (*lcf)(sc, spipe, xfer);
 1450         slhci_main(sc);
 1451         mutex_exit(&sc->sc_intr_lock);
 1452 
 1453         return ret;
 1454 }
 1455 
 1456 void
 1457 slhci_start_entry(struct slhci_softc *sc, struct slhci_pipe *spipe)
 1458 {
 1459         struct slhci_transfers *t;
 1460 
 1461         mutex_enter(&sc->sc_intr_lock);
 1462         t = &sc->sc_transfers;
 1463 
 1464         if (!(t->flags & (F_AINPROG|F_BINPROG))) {
 1465                 slhci_enter_xfer(sc, spipe);
 1466                 slhci_dotransfer(sc);
 1467                 slhci_main(sc);
 1468         } else {
 1469                 enter_waitq(sc, spipe);
 1470         }
 1471         mutex_exit(&sc->sc_intr_lock);
 1472 }
 1473 
 1474 void
 1475 slhci_callback_entry(void *arg)
 1476 {
 1477         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 1478         struct slhci_softc *sc;
 1479         struct slhci_transfers *t;
 1480 
 1481         sc = (struct slhci_softc *)arg;
 1482 
 1483         mutex_enter(&sc->sc_intr_lock);
 1484         t = &sc->sc_transfers;
 1485         DLOG(D_SOFT, "callback_entry flags %#jx", t->flags, 0,0,0);
 1486 
 1487 repeat:
 1488         slhci_callback(sc);
 1489 
 1490         if (!gcq_empty(&sc->sc_waitq)) {
 1491                 slhci_enter_xfers(sc);
 1492                 slhci_dotransfer(sc);
 1493                 slhci_waitintr(sc, 0);
 1494                 goto repeat;
 1495         }
 1496 
 1497         t->flags &= ~F_CALLBACK;
 1498         mutex_exit(&sc->sc_intr_lock);
 1499 }
 1500 
 1501 void
 1502 slhci_do_callback(struct slhci_softc *sc, struct usbd_xfer *xfer)
 1503 {
 1504         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 1505         KASSERT(mutex_owned(&sc->sc_intr_lock));
 1506 
 1507         start_cc_time(&t_callback, (u_int)xfer);
 1508         mutex_exit(&sc->sc_intr_lock);
 1509 
 1510         mutex_enter(&sc->sc_lock);
 1511         usb_transfer_complete(xfer);
 1512         mutex_exit(&sc->sc_lock);
 1513 
 1514         mutex_enter(&sc->sc_intr_lock);
 1515         stop_cc_time(&t_callback);
 1516 }
 1517 
 1518 int
 1519 slhci_intr(void *arg)
 1520 {
 1521         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 1522         struct slhci_softc *sc = arg;
 1523         int ret = 0;
 1524         int irq;
 1525 
 1526         start_cc_time(&t_hard_int, (unsigned int)arg);
 1527         mutex_enter(&sc->sc_intr_lock);
 1528 
 1529         do {
 1530                 irq = slhci_dointr(sc);
 1531                 ret |= irq;
 1532                 slhci_main(sc);
 1533         } while (irq);
 1534         mutex_exit(&sc->sc_intr_lock);
 1535 
 1536         stop_cc_time(&t_hard_int);
 1537         return ret;
 1538 }
 1539 
 1540 /* called with interrupt lock only held. */
 1541 void
 1542 slhci_main(struct slhci_softc *sc)
 1543 {
 1544         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 1545         struct slhci_transfers *t;
 1546 
 1547         t = &sc->sc_transfers;
 1548 
 1549         KASSERT(mutex_owned(&sc->sc_intr_lock));
 1550 
 1551 waitcheck:
 1552         slhci_waitintr(sc, slhci_wait_time);
 1553 
 1554         /*
 1555          * The direct call is needed in the ub_usepolling and disabled cases
 1556          * since the soft interrupt is not available.  In the disabled case,
 1557          * this code can be reached from the usb detach, after the reaping of
 1558          * the soft interrupt.  That test could be !F_ACTIVE, but there is no
 1559          * reason not to make the callbacks directly in the other DISABLED
 1560          * cases.
 1561          */
 1562         if ((t->flags & F_ROOTINTR) || !gcq_empty(&t->q[Q_CALLBACKS])) {
 1563                 if (__predict_false(sc->sc_bus.ub_usepolling ||
 1564                     t->flags & F_DISABLED))
 1565                         slhci_callback(sc);
 1566                 else
 1567                         slhci_callback_schedule(sc);
 1568         }
 1569 
 1570         if (!gcq_empty(&sc->sc_waitq)) {
 1571                 slhci_enter_xfers(sc);
 1572                 slhci_dotransfer(sc);
 1573                 goto waitcheck;
 1574         }
 1575         DLOG(D_INTR, "... done", 0, 0, 0, 0);
 1576 }
 1577 
 1578 /* End lock entry functions. Start in lock function. */
 1579 
 1580 /* Register read/write routines and barriers. */
 1581 #ifdef SLHCI_BUS_SPACE_BARRIERS
 1582 #define BSB(a, b, c, d, e) bus_space_barrier(a, b, c, d, BUS_SPACE_BARRIER_ # e)
 1583 #define BSB_SYNC(a, b, c, d) bus_space_barrier(a, b, c, d, BUS_SPACE_BARRIER_READ|BUS_SPACE_BARRIER_WRITE)
 1584 #else /* now !SLHCI_BUS_SPACE_BARRIERS */
 1585 #define BSB(a, b, c, d, e) __USE(d)
 1586 #define BSB_SYNC(a, b, c, d)
 1587 #endif /* SLHCI_BUS_SPACE_BARRIERS */
 1588 
 1589 static void
 1590 slhci_write(struct slhci_softc *sc, uint8_t addr, uint8_t data)
 1591 {
 1592         bus_size_t paddr, pdata, pst, psz;
 1593         bus_space_tag_t iot;
 1594         bus_space_handle_t ioh;
 1595 
 1596         paddr = pst = 0;
 1597         pdata = sc->sc_stride;
 1598         psz = pdata * 2;
 1599         iot = sc->sc_iot;
 1600         ioh = sc->sc_ioh;
 1601 
 1602         bus_space_write_1(iot, ioh, paddr, addr);
 1603         BSB(iot, ioh, pst, psz, WRITE_BEFORE_WRITE);
 1604         bus_space_write_1(iot, ioh, pdata, data);
 1605         BSB(iot, ioh, pst, psz, WRITE_BEFORE_WRITE);
 1606 }
 1607 
 1608 static uint8_t
 1609 slhci_read(struct slhci_softc *sc, uint8_t addr)
 1610 {
 1611         bus_size_t paddr, pdata, pst, psz;
 1612         bus_space_tag_t iot;
 1613         bus_space_handle_t ioh;
 1614         uint8_t data;
 1615 
 1616         paddr = pst = 0;
 1617         pdata = sc->sc_stride;
 1618         psz = pdata * 2;
 1619         iot = sc->sc_iot;
 1620         ioh = sc->sc_ioh;
 1621 
 1622         bus_space_write_1(iot, ioh, paddr, addr);
 1623         BSB(iot, ioh, pst, psz, WRITE_BEFORE_READ);
 1624         data = bus_space_read_1(iot, ioh, pdata);
 1625         BSB(iot, ioh, pst, psz, READ_BEFORE_WRITE);
 1626         return data;
 1627 }
 1628 
 1629 #if 0 /* auto-increment mode broken, see errata doc */
 1630 static void
 1631 slhci_write_multi(struct slhci_softc *sc, uint8_t addr, uint8_t *buf, int l)
 1632 {
 1633         bus_size_t paddr, pdata, pst, psz;
 1634         bus_space_tag_t iot;
 1635         bus_space_handle_t ioh;
 1636 
 1637         paddr = pst = 0;
 1638         pdata = sc->sc_stride;
 1639         psz = pdata * 2;
 1640         iot = sc->sc_iot;
 1641         ioh = sc->sc_ioh;
 1642 
 1643         bus_space_write_1(iot, ioh, paddr, addr);
 1644         BSB(iot, ioh, pst, psz, WRITE_BEFORE_WRITE);
 1645         bus_space_write_multi_1(iot, ioh, pdata, buf, l);
 1646         BSB(iot, ioh, pst, psz, WRITE_BEFORE_WRITE);
 1647 }
 1648 
 1649 static void
 1650 slhci_read_multi(struct slhci_softc *sc, uint8_t addr, uint8_t *buf, int l)
 1651 {
 1652         bus_size_t paddr, pdata, pst, psz;
 1653         bus_space_tag_t iot;
 1654         bus_space_handle_t ioh;
 1655 
 1656         paddr = pst = 0;
 1657         pdata = sc->sc_stride;
 1658         psz = pdata * 2;
 1659         iot = sc->sc_iot;
 1660         ioh = sc->sc_ioh;
 1661 
 1662         bus_space_write_1(iot, ioh, paddr, addr);
 1663         BSB(iot, ioh, pst, psz, WRITE_BEFORE_READ);
 1664         bus_space_read_multi_1(iot, ioh, pdata, buf, l);
 1665         BSB(iot, ioh, pst, psz, READ_BEFORE_WRITE);
 1666 }
 1667 #else
 1668 static void
 1669 slhci_write_multi(struct slhci_softc *sc, uint8_t addr, uint8_t *buf, int l)
 1670 {
 1671 #if 1
 1672         for (; l; addr++, buf++, l--)
 1673                 slhci_write(sc, addr, *buf);
 1674 #else
 1675         bus_size_t paddr, pdata, pst, psz;
 1676         bus_space_tag_t iot;
 1677         bus_space_handle_t ioh;
 1678 
 1679         paddr = pst = 0;
 1680         pdata = sc->sc_stride;
 1681         psz = pdata * 2;
 1682         iot = sc->sc_iot;
 1683         ioh = sc->sc_ioh;
 1684 
 1685         for (; l; addr++, buf++, l--) {
 1686                 bus_space_write_1(iot, ioh, paddr, addr);
 1687                 BSB(iot, ioh, pst, psz, WRITE_BEFORE_WRITE);
 1688                 bus_space_write_1(iot, ioh, pdata, *buf);
 1689                 BSB(iot, ioh, pst, psz, WRITE_BEFORE_WRITE);
 1690         }
 1691 #endif
 1692 }
 1693 
 1694 static void
 1695 slhci_read_multi(struct slhci_softc *sc, uint8_t addr, uint8_t *buf, int l)
 1696 {
 1697 #if 1
 1698         for (; l; addr++, buf++, l--)
 1699                 *buf = slhci_read(sc, addr);
 1700 #else
 1701         bus_size_t paddr, pdata, pst, psz;
 1702         bus_space_tag_t iot;
 1703         bus_space_handle_t ioh;
 1704 
 1705         paddr = pst = 0;
 1706         pdata = sc->sc_stride;
 1707         psz = pdata * 2;
 1708         iot = sc->sc_iot;
 1709         ioh = sc->sc_ioh;
 1710 
 1711         for (; l; addr++, buf++, l--) {
 1712                 bus_space_write_1(iot, ioh, paddr, addr);
 1713                 BSB(iot, ioh, pst, psz, WRITE_BEFORE_READ);
 1714                 *buf = bus_space_read_1(iot, ioh, pdata);
 1715                 BSB(iot, ioh, pst, psz, READ_BEFORE_WRITE);
 1716         }
 1717 #endif
 1718 }
 1719 #endif
 1720 
 1721 /*
 1722  * After calling waitintr it is necessary to either call slhci_callback or
 1723  * schedule the callback if necessary.  The callback cannot be called directly
 1724  * from the hard interrupt since it interrupts at a high IPL and callbacks
 1725  * can do copyout and such.
 1726  */
 1727 static void
 1728 slhci_waitintr(struct slhci_softc *sc, int wait_time)
 1729 {
 1730         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 1731         struct slhci_transfers *t;
 1732 
 1733         t = &sc->sc_transfers;
 1734 
 1735         KASSERT(mutex_owned(&sc->sc_intr_lock));
 1736 
 1737         if (__predict_false(sc->sc_bus.ub_usepolling))
 1738                 wait_time = 12000;
 1739 
 1740         while (t->pend <= wait_time) {
 1741                 DLOG(D_WAIT, "waiting... frame %jd pend %jd flags %#jx",
 1742                     t->frame, t->pend, t->flags, 0);
 1743                 LK_SLASSERT(t->flags & F_ACTIVE, sc, NULL, NULL, return);
 1744                 LK_SLASSERT(t->flags & (F_AINPROG|F_BINPROG), sc, NULL, NULL,
 1745                     return);
 1746                 slhci_dointr(sc);
 1747         }
 1748         DLOG(D_WAIT, "... done", 0, 0, 0, 0);
 1749 }
 1750 
 1751 static int
 1752 slhci_dointr(struct slhci_softc *sc)
 1753 {
 1754         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 1755         struct slhci_transfers *t;
 1756         struct slhci_pipe *tosp;
 1757         uint8_t r;
 1758 
 1759         t = &sc->sc_transfers;
 1760 
 1761         KASSERT(mutex_owned(&sc->sc_intr_lock));
 1762 
 1763         if (sc->sc_ier == 0) {
 1764                 DLOG(D_INTR, "sc_ier is zero", 0, 0, 0, 0);
 1765                 return 0;
 1766         }
 1767 
 1768         r = slhci_read(sc, SL11_ISR);
 1769 
 1770 #ifdef SLHCI_DEBUG
 1771         if (slhcidebug & SLHCI_D_INTR && r & sc->sc_ier &&
 1772             ((r & ~(SL11_ISR_SOF|SL11_ISR_DATA)) || slhcidebug & SLHCI_D_SOF)) {
 1773                 uint8_t e, f;
 1774 
 1775                 e = slhci_read(sc, SL11_IER);
 1776                 f = slhci_read(sc, SL11_CTRL);
 1777                 DDOLOG("Flags=%#x IER=%#x ISR=%#x CTRL=%#x", t->flags, e, r, f);
 1778                 DDOLOGCTRL(f);
 1779                 DDOLOGISR(r);
 1780         }
 1781 #endif
 1782 
 1783         /*
 1784          * check IER for corruption occasionally.  Assume that the above
 1785          * sc_ier == 0 case works correctly.
 1786          */
 1787         if (__predict_false(sc->sc_ier_check++ > SLHCI_IER_CHECK_FREQUENCY)) {
 1788                 sc->sc_ier_check = 0;
 1789                 if (sc->sc_ier != slhci_read(sc, SL11_IER)) {
 1790                         printf("%s: IER value corrupted! halted\n",
 1791                             SC_NAME(sc));
 1792                         DDOLOG("IER value corrupted! halted", 0, 0, 0, 0);
 1793                         slhci_halt(sc, NULL, NULL);
 1794                         return 1;
 1795                 }
 1796         }
 1797 
 1798         r &= sc->sc_ier;
 1799 
 1800         if (r == 0) {
 1801                 DLOG(D_INTR, "r is zero", 0, 0, 0, 0);
 1802                 return 0;
 1803         }
 1804 
 1805         sc->sc_ier_check = 0;
 1806 
 1807         slhci_write(sc, SL11_ISR, r);
 1808         BSB_SYNC(sc->iot, sc->ioh, sc->pst, sc->psz);
 1809 
 1810         /* If we have an insertion event we do not care about anything else. */
 1811         if (__predict_false(r & SL11_ISR_INSERT)) {
 1812                 slhci_insert(sc);
 1813                 DLOG(D_INTR, "... done", 0, 0, 0, 0);
 1814                 return 1;
 1815         }
 1816 
 1817         stop_cc_time(&t_intr);
 1818         start_cc_time(&t_intr, r);
 1819 
 1820         if (r & SL11_ISR_SOF) {
 1821                 t->frame++;
 1822 
 1823                 gcq_merge_tail(&t->q[Q_CB], &t->q[Q_NEXT_CB]);
 1824 
 1825                 /*
 1826                  * SOFCHECK flags are cleared in tstart.  Two flags are needed
 1827                  * since the first SOF interrupt processed after the transfer
 1828                  * is started might have been generated before the transfer
 1829                  * was started.
 1830                  */
 1831                 if (__predict_false(t->flags & F_SOFCHECK2 && t->flags &
 1832                     (F_AINPROG|F_BINPROG))) {
 1833                         printf("%s: Missed transfer completion. halted\n",
 1834                             SC_NAME(sc));
 1835                         DDOLOG("Missed transfer completion. halted", 0, 0, 0,
 1836                             0);
 1837                         slhci_halt(sc, NULL, NULL);
 1838                         return 1;
 1839                 } else if (t->flags & F_SOFCHECK1) {
 1840                         t->flags |= F_SOFCHECK2;
 1841                 } else
 1842                         t->flags |= F_SOFCHECK1;
 1843 
 1844                 if (t->flags & F_CHANGE)
 1845                         t->flags |= F_ROOTINTR;
 1846 
 1847                 while (__predict_true(GOT_FIRST_TO(tosp, t)) &&
 1848                     __predict_false(tosp->to_frame <= t->frame)) {
 1849                         tosp->xfer->ux_status = USBD_TIMEOUT;
 1850                         slhci_do_abort(sc, tosp, tosp->xfer);
 1851                         enter_callback(t, tosp);
 1852                 }
 1853 
 1854                 /*
 1855                  * Start any waiting transfers right away.  If none, we will
 1856                  * start any new transfers later.
 1857                  */
 1858                 slhci_tstart(sc);
 1859         }
 1860 
 1861         if (r & (SL11_ISR_USBA|SL11_ISR_USBB)) {
 1862                 int ab;
 1863 
 1864                 if ((r & (SL11_ISR_USBA|SL11_ISR_USBB)) ==
 1865                     (SL11_ISR_USBA|SL11_ISR_USBB)) {
 1866                         if (!(t->flags & (F_AINPROG|F_BINPROG)))
 1867                                 return 1; /* presume card pulled */
 1868 
 1869                         LK_SLASSERT((t->flags & (F_AINPROG|F_BINPROG)) !=
 1870                             (F_AINPROG|F_BINPROG), sc, NULL, NULL, return 1);
 1871 
 1872                         /*
 1873                          * This should never happen (unless card removal just
 1874                          * occurred) but appeared frequently when both
 1875                          * transfers were started at the same time and was
 1876                          * accompanied by data corruption.  It still happens
 1877                          * at times.  I have not seen data correption except
 1878                          * when the STATUS bit gets set, which now causes the
 1879                          * driver to halt, however this should still not
 1880                          * happen so the warning is kept.  See comment in
 1881                          * abdone, below.
 1882                          */
 1883                         printf("%s: Transfer reported done but not started! "
 1884                             "Verify data integrity if not detaching. "
 1885                             " flags %#x r %x\n", SC_NAME(sc), t->flags, r);
 1886 
 1887                         if (!(t->flags & F_AINPROG))
 1888                                 r &= ~SL11_ISR_USBA;
 1889                         else
 1890                                 r &= ~SL11_ISR_USBB;
 1891                 }
 1892                 t->pend = INT_MAX;
 1893 
 1894                 if (r & SL11_ISR_USBA)
 1895                         ab = A;
 1896                 else
 1897                         ab = B;
 1898 
 1899                 /*
 1900                  * This happens when a low speed device is attached to
 1901                  * a hub with chip rev 1.5.  SOF stops, but a few transfers
 1902                  * still work before causing this error.
 1903                  */
 1904                 if (!(t->flags & (ab ? F_BINPROG : F_AINPROG))) {
 1905                         printf("%s: %s done but not in progress! halted\n",
 1906                             SC_NAME(sc), ab ? "B" : "A");
 1907                         DDOLOG("AB=%d done but not in progress! halted", ab,
 1908                             0, 0, 0);
 1909                         slhci_halt(sc, NULL, NULL);
 1910                         return 1;
 1911                 }
 1912 
 1913                 t->flags &= ~(ab ? F_BINPROG : F_AINPROG);
 1914                 slhci_tstart(sc);
 1915                 stop_cc_time(&t_ab[ab]);
 1916                 start_cc_time(&t_abdone, t->flags);
 1917                 slhci_abdone(sc, ab);
 1918                 stop_cc_time(&t_abdone);
 1919         }
 1920 
 1921         slhci_dotransfer(sc);
 1922 
 1923         DLOG(D_INTR, "... done", 0, 0, 0, 0);
 1924 
 1925         return 1;
 1926 }
 1927 
 1928 static void
 1929 slhci_abdone(struct slhci_softc *sc, int ab)
 1930 {
 1931         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 1932         struct slhci_transfers *t;
 1933         struct slhci_pipe *spipe;
 1934         struct usbd_xfer *xfer;
 1935         uint8_t status, buf_start;
 1936         uint8_t *target_buf;
 1937         unsigned int actlen;
 1938         int head;
 1939 
 1940         t = &sc->sc_transfers;
 1941 
 1942         KASSERT(mutex_owned(&sc->sc_intr_lock));
 1943 
 1944         DLOG(D_TRACE, "ABDONE flags %#jx", t->flags, 0,0,0);
 1945 
 1946         DLOG(D_MSG, "DONE AB=%jd spipe %#jx len %jd xfer %#jx", ab,
 1947             t->spipe[ab], (uintptr_t)t->len[ab],
 1948             (uintptr_t)(t->spipe[ab] ? t->spipe[ab]->xfer : NULL));
 1949 
 1950         spipe = t->spipe[ab];
 1951 
 1952         /*
 1953          * skip this one if aborted; do not call return from the rest of the
 1954          * function unless halting, else t->len will not be cleared.
 1955          */
 1956         if (spipe == NULL)
 1957                 goto done;
 1958 
 1959         t->spipe[ab] = NULL;
 1960 
 1961         xfer = spipe->xfer;
 1962 
 1963         gcq_remove(&spipe->to);
 1964 
 1965         LK_SLASSERT(xfer != NULL, sc, spipe, NULL, return);
 1966 
 1967         status = slhci_read(sc, slhci_tregs[ab][STAT]);
 1968 
 1969         /*
 1970          * I saw no status or remaining length greater than the requested
 1971          * length in early driver versions in circumstances I assumed caused
 1972          * excess power draw.  I am no longer able to reproduce this when
 1973          * causing excess power draw circumstances.
 1974          *
 1975          * Disabling a power check and attaching aue to a keyboard and hub
 1976          * that is directly attached (to CFU1U, 100mA max, aue 160mA, keyboard
 1977          * 98mA) sometimes works and sometimes fails to configure.  After
 1978          * removing the aue and attaching a self-powered umass dvd reader
 1979          * (unknown if it draws power from the host also) soon a single Error
 1980          * status occurs then only timeouts. The controller soon halts freeing
 1981          * memory due to being ONQU instead of BUSY.  This may be the same
 1982          * basic sequence that caused the no status/bad length errors.  The
 1983          * umass device seems to work (better at least) with the keyboard hub
 1984          * when not first attaching aue (tested once reading an approximately
 1985          * 200MB file).
 1986          *
 1987          * Overflow can indicate that the device and host disagree about how
 1988          * much data has been transferred.  This may indicate a problem at any
 1989          * point during the transfer, not just when the error occurs.  It may
 1990          * indicate data corruption.  A warning message is printed.
 1991          *
 1992          * Trying to use both A and B transfers at the same time results in
 1993          * incorrect transfer completion ISR reports and the status will then
 1994          * include SL11_EPSTAT_SETUP, which is apparently set while the
 1995          * transfer is in progress.  I also noticed data corruption, even
 1996          * after waiting for the transfer to complete. The driver now avoids
 1997          * trying to start both at the same time.
 1998          *
 1999          * I had accidently initialized the B registers before they were valid
 2000          * in some driver versions.  Since every other performance enhancing
 2001          * feature has been confirmed buggy in the errata doc, I have not
 2002          * tried both transfers at once again with the documented
 2003          * initialization order.
 2004          *
 2005          * However, I have seen this problem again ("done but not started"
 2006          * errors), which in some cases cases the SETUP status bit to remain
 2007          * set on future transfers.  In other cases, the SETUP bit is not set
 2008          * and no data corruption occurs.  This occurred while using both umass
 2009          * and aue on a powered hub (maybe triggered by some local activity
 2010          * also) and needs several reads of the 200MB file to trigger.  The
 2011          * driver now halts if SETUP is detected.
 2012          */
 2013 
 2014         actlen = 0;
 2015 
 2016         if (__predict_false(!status)) {
 2017                 DDOLOG("no status! xfer %p spipe %p", xfer, spipe, 0,0);
 2018                 printf("%s: no status! halted\n", SC_NAME(sc));
 2019                 slhci_halt(sc, spipe, xfer);
 2020                 return;
 2021         }
 2022 
 2023 #ifdef SLHCI_DEBUG
 2024         if ((slhcidebug & SLHCI_D_NAK) ||
 2025             (status & SL11_EPSTAT_ERRBITS) != SL11_EPSTAT_NAK) {
 2026                 DDOLOG("USB Status = %#.2x", status, 0, 0, 0);
 2027                 DDOLOGSTATUS(status);
 2028         }
 2029 #endif
 2030 
 2031         if (!(status & SL11_EPSTAT_ERRBITS)) {
 2032                 unsigned int cont = slhci_read(sc, slhci_tregs[ab][CONT]);
 2033                 unsigned int len = spipe->tregs[LEN];
 2034                 DLOG(D_XFER, "cont %jd len %jd", cont, len, 0, 0);
 2035                 if ((status & SL11_EPSTAT_OVERFLOW) || cont > len) {
 2036                         DDOLOG("overflow - cont %d len %d xfer->ux_length %d "
 2037                             "xfer->actlen %d", cont, len, xfer->ux_length,
 2038                             xfer->ux_actlen);
 2039                         printf("%s: overflow cont %d len %d xfer->ux_length"
 2040                             " %d xfer->ux_actlen %d\n", SC_NAME(sc), cont,
 2041                             len, xfer->ux_length, xfer->ux_actlen);
 2042                         actlen = len;
 2043                 } else {
 2044                         actlen = len - cont;
 2045                 }
 2046                 spipe->nerrs = 0;
 2047         }
 2048 
 2049         /* Actual copyin done after starting next transfer. */
 2050         if (actlen && (spipe->tregs[PID] & SL11_PID_BITS) == SL11_PID_IN) {
 2051                 target_buf = spipe->buffer;
 2052                 buf_start = spipe->tregs[ADR];
 2053         } else {
 2054                 target_buf = NULL;
 2055                 buf_start = 0; /* XXX gcc uninitialized warnings */
 2056         }
 2057 
 2058         if (status & SL11_EPSTAT_ERRBITS) {
 2059                 status &= SL11_EPSTAT_ERRBITS;
 2060                 if (status & SL11_EPSTAT_SETUP) {
 2061                         printf("%s: Invalid controller state detected! "
 2062                             "halted\n", SC_NAME(sc));
 2063                         DDOLOG("Invalid controller state detected! "
 2064                             "halted", 0, 0, 0, 0);
 2065                         slhci_halt(sc, spipe, xfer);
 2066                         return;
 2067                 } else if (__predict_false(sc->sc_bus.ub_usepolling)) {
 2068                         head = Q_CALLBACKS;
 2069                         if (status & SL11_EPSTAT_STALL)
 2070                                 xfer->ux_status = USBD_STALLED;
 2071                         else if (status & SL11_EPSTAT_TIMEOUT)
 2072                                 xfer->ux_status = USBD_TIMEOUT;
 2073                         else if (status & SL11_EPSTAT_NAK)
 2074                                 head = Q_NEXT_CB;
 2075                         else
 2076                                 xfer->ux_status = USBD_IOERROR;
 2077                 } else if (status & SL11_EPSTAT_NAK) {
 2078                         int i = spipe->pipe.up_interval;
 2079                         if (i == 0)
 2080                                 i = 1;
 2081                         DDOLOG("xfer %p spipe %p NAK delay by %d", xfer, spipe,
 2082                             i, 0);
 2083                         spipe->lastframe = spipe->frame = t->frame + i;
 2084                         slhci_queue_timed(sc, spipe);
 2085                         goto queued;
 2086                 } else if (++spipe->nerrs > SLHCI_MAX_RETRIES ||
 2087                     (status & SL11_EPSTAT_STALL)) {
 2088                         DDOLOG("xfer %p spipe %p nerrs %d", xfer, spipe,
 2089                             spipe->nerrs, 0);
 2090                         if (status & SL11_EPSTAT_STALL)
 2091                                 xfer->ux_status = USBD_STALLED;
 2092                         else if (status & SL11_EPSTAT_TIMEOUT)
 2093                                 xfer->ux_status = USBD_TIMEOUT;
 2094                         else
 2095                                 xfer->ux_status = USBD_IOERROR;
 2096 
 2097                         DLOG(D_ERR, "Max retries reached! status %#jx "
 2098                             "xfer->ux_status %jd", status, xfer->ux_status, 0,
 2099                             0);
 2100                         DDOLOGSTATUS(status);
 2101 
 2102                         head = Q_CALLBACKS;
 2103                 } else {
 2104                         head = Q_NEXT_CB;
 2105                 }
 2106         } else if (spipe->ptype == PT_CTRL_SETUP) {
 2107                 spipe->tregs[PID] = spipe->newpid;
 2108 
 2109                 if (xfer->ux_length) {
 2110                         LK_SLASSERT(spipe->newlen[1] != 0, sc, spipe, xfer,
 2111                             return);
 2112                         spipe->tregs[LEN] = spipe->newlen[1];
 2113                         spipe->bustime = spipe->newbustime[1];
 2114                         spipe->buffer = xfer->ux_buf;
 2115                         spipe->ptype = PT_CTRL_DATA;
 2116                 } else {
 2117 status_setup:
 2118                         /* CTRL_DATA swaps direction in PID then jumps here */
 2119                         spipe->tregs[LEN] = 0;
 2120                         if (spipe->pflags & PF_LS)
 2121                                 spipe->bustime = SLHCI_LS_CONST;
 2122                         else
 2123                                 spipe->bustime = SLHCI_FS_CONST;
 2124                         spipe->ptype = PT_CTRL_STATUS;
 2125                         spipe->buffer = NULL;
 2126                 }
 2127 
 2128                 /* Status or first data packet must be DATA1. */
 2129                 spipe->control |= SL11_EPCTRL_DATATOGGLE;
 2130                 if ((spipe->tregs[PID] & SL11_PID_BITS) == SL11_PID_IN)
 2131                         spipe->control &= ~SL11_EPCTRL_DIRECTION;
 2132                 else
 2133                         spipe->control |= SL11_EPCTRL_DIRECTION;
 2134 
 2135                 head = Q_CB;
 2136         } else if (spipe->ptype == PT_CTRL_STATUS) {
 2137                 head = Q_CALLBACKS;
 2138         } else { /* bulk, intr, control data */
 2139                 xfer->ux_actlen += actlen;
 2140                 spipe->control ^= SL11_EPCTRL_DATATOGGLE;
 2141 
 2142                 if (actlen == spipe->tregs[LEN] &&
 2143                     (xfer->ux_length > xfer->ux_actlen || spipe->wantshort)) {
 2144                         spipe->buffer += actlen;
 2145                         LK_SLASSERT(xfer->ux_length >= xfer->ux_actlen, sc,
 2146                             spipe, xfer, return);
 2147                         if (xfer->ux_length - xfer->ux_actlen < actlen) {
 2148                                 spipe->wantshort = 0;
 2149                                 spipe->tregs[LEN] = spipe->newlen[0];
 2150                                 spipe->bustime = spipe->newbustime[0];
 2151                                 LK_SLASSERT(xfer->ux_actlen +
 2152                                     spipe->tregs[LEN] == xfer->ux_length, sc,
 2153                                     spipe, xfer, return);
 2154                         }
 2155                         head = Q_CB;
 2156                 } else if (spipe->ptype == PT_CTRL_DATA) {
 2157                         spipe->tregs[PID] ^= SLHCI_PID_SWAP_IN_OUT;
 2158                         goto status_setup;
 2159                 } else {
 2160                         if (spipe->ptype == PT_INTR) {
 2161                                 spipe->lastframe +=
 2162                                     spipe->pipe.up_interval;
 2163                                 /*
 2164                                  * If ack, we try to keep the
 2165                                  * interrupt rate by using lastframe
 2166                                  * instead of the current frame.
 2167                                  */
 2168                                 spipe->frame = spipe->lastframe +
 2169                                     spipe->pipe.up_interval;
 2170                         }
 2171 
 2172                         /*
 2173                          * Set the toggle for the next transfer.  It
 2174                          * has already been toggled above, so the
 2175                          * current setting will apply to the next
 2176                          * transfer.
 2177                          */
 2178                         if (spipe->control & SL11_EPCTRL_DATATOGGLE)
 2179                                 spipe->pflags |= PF_TOGGLE;
 2180                         else
 2181                                 spipe->pflags &= ~PF_TOGGLE;
 2182 
 2183                         head = Q_CALLBACKS;
 2184                 }
 2185         }
 2186 
 2187         if (head == Q_CALLBACKS) {
 2188                 gcq_remove(&spipe->to);
 2189 
 2190                 if (xfer->ux_status == USBD_IN_PROGRESS) {
 2191                         LK_SLASSERT(xfer->ux_actlen <= xfer->ux_length, sc,
 2192                             spipe, xfer, return);
 2193                         xfer->ux_status = USBD_NORMAL_COMPLETION;
 2194                 }
 2195         }
 2196 
 2197         enter_q(t, spipe, head);
 2198 
 2199 queued:
 2200         if (target_buf != NULL) {
 2201                 slhci_dotransfer(sc);
 2202                 start_cc_time(&t_copy_from_dev, actlen);
 2203                 slhci_read_multi(sc, buf_start, target_buf, actlen);
 2204                 stop_cc_time(&t_copy_from_dev);
 2205                 DLOGBUF(D_BUF, target_buf, actlen);
 2206                 t->pend -= SLHCI_FS_CONST + SLHCI_FS_DATA_TIME(actlen);
 2207         }
 2208 
 2209 done:
 2210         t->len[ab] = -1;
 2211 }
 2212 
 2213 static void
 2214 slhci_tstart(struct slhci_softc *sc)
 2215 {
 2216         struct slhci_transfers *t;
 2217         struct slhci_pipe *spipe;
 2218         int remaining_bustime;
 2219 
 2220         t = &sc->sc_transfers;
 2221 
 2222         KASSERT(mutex_owned(&sc->sc_intr_lock));
 2223 
 2224         if (!(t->flags & (F_AREADY|F_BREADY)))
 2225                 return;
 2226 
 2227         if (t->flags & (F_AINPROG|F_BINPROG|F_DISABLED))
 2228                 return;
 2229 
 2230         /*
 2231          * We have about 6 us to get from the bus time check to
 2232          * starting the transfer or we might babble or the chip might fail to
 2233          * signal transfer complete.  This leaves no time for any other
 2234          * interrupts.
 2235          */
 2236         remaining_bustime = (int)(slhci_read(sc, SL811_CSOF)) << 6;
 2237         remaining_bustime -= SLHCI_END_BUSTIME;
 2238 
 2239         /*
 2240          * Start one transfer only, clearing any aborted transfers that are
 2241          * not yet in progress and skipping missed isoc. It is easier to copy
 2242          * & paste most of the A/B sections than to make the logic work
 2243          * otherwise and this allows better constant use.
 2244          */
 2245         if (t->flags & F_AREADY) {
 2246                 spipe = t->spipe[A];
 2247                 if (spipe == NULL) {
 2248                         t->flags &= ~F_AREADY;
 2249                         t->len[A] = -1;
 2250                 } else if (remaining_bustime >= spipe->bustime) {
 2251                         t->flags &= ~(F_AREADY|F_SOFCHECK1|F_SOFCHECK2);
 2252                         t->flags |= F_AINPROG;
 2253                         start_cc_time(&t_ab[A], spipe->tregs[LEN]);
 2254                         slhci_write(sc, SL11_E0CTRL, spipe->control);
 2255                         goto pend;
 2256                 }
 2257         }
 2258         if (t->flags & F_BREADY) {
 2259                 spipe = t->spipe[B];
 2260                 if (spipe == NULL) {
 2261                         t->flags &= ~F_BREADY;
 2262                         t->len[B] = -1;
 2263                 } else if (remaining_bustime >= spipe->bustime) {
 2264                         t->flags &= ~(F_BREADY|F_SOFCHECK1|F_SOFCHECK2);
 2265                         t->flags |= F_BINPROG;
 2266                         start_cc_time(&t_ab[B], spipe->tregs[LEN]);
 2267                         slhci_write(sc, SL11_E1CTRL, spipe->control);
 2268 pend:
 2269                         t->pend = spipe->bustime;
 2270                 }
 2271         }
 2272 }
 2273 
 2274 static void
 2275 slhci_dotransfer(struct slhci_softc *sc)
 2276 {
 2277         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 2278         struct slhci_transfers *t;
 2279         struct slhci_pipe *spipe;
 2280         int ab, i;
 2281 
 2282         t = &sc->sc_transfers;
 2283 
 2284         KASSERT(mutex_owned(&sc->sc_intr_lock));
 2285 
 2286         while ((t->len[A] == -1 || t->len[B] == -1) &&
 2287             (GOT_FIRST_TIMED_COND(spipe, t, spipe->frame <= t->frame) ||
 2288             GOT_FIRST_CB(spipe, t))) {
 2289                 LK_SLASSERT(spipe->xfer != NULL, sc, spipe, NULL, return);
 2290                 LK_SLASSERT(spipe->ptype != PT_ROOT_CTRL && spipe->ptype !=
 2291                     PT_ROOT_INTR, sc, spipe, NULL, return);
 2292 
 2293                 /* Check that this transfer can fit in the remaining memory. */
 2294                 if (t->len[A] + t->len[B] + spipe->tregs[LEN] + 1 >
 2295                     SL11_MAX_PACKET_SIZE) {
 2296                         DLOG(D_XFER, "Transfer does not fit. alen %jd blen %jd "
 2297                             "len %jd", t->len[A], t->len[B], spipe->tregs[LEN],
 2298                             0);
 2299                         return;
 2300                 }
 2301 
 2302                 gcq_remove(&spipe->xq);
 2303 
 2304                 if (t->len[A] == -1) {
 2305                         ab = A;
 2306                         spipe->tregs[ADR] = SL11_BUFFER_START;
 2307                 } else {
 2308                         ab = B;
 2309                         spipe->tregs[ADR] = SL11_BUFFER_END -
 2310                             spipe->tregs[LEN];
 2311                 }
 2312 
 2313                 t->len[ab] = spipe->tregs[LEN];
 2314 
 2315                 if (spipe->tregs[LEN] && (spipe->tregs[PID] & SL11_PID_BITS)
 2316                     != SL11_PID_IN) {
 2317                         start_cc_time(&t_copy_to_dev,
 2318                             spipe->tregs[LEN]);
 2319                         slhci_write_multi(sc, spipe->tregs[ADR],
 2320                             spipe->buffer, spipe->tregs[LEN]);
 2321                         stop_cc_time(&t_copy_to_dev);
 2322                         t->pend -= SLHCI_FS_CONST +
 2323                             SLHCI_FS_DATA_TIME(spipe->tregs[LEN]);
 2324                 }
 2325 
 2326                 DLOG(D_MSG, "NEW TRANSFER AB=%jd flags %#jx alen %jd blen %jd",
 2327                     ab, t->flags, t->len[0], t->len[1]);
 2328 
 2329                 if (spipe->tregs[LEN])
 2330                         i = 0;
 2331                 else
 2332                         i = 1;
 2333 
 2334                 for (; i <= 3; i++)
 2335                         if (t->current_tregs[ab][i] != spipe->tregs[i]) {
 2336                                 t->current_tregs[ab][i] = spipe->tregs[i];
 2337                                 slhci_write(sc, slhci_tregs[ab][i],
 2338                                     spipe->tregs[i]);
 2339                         }
 2340 
 2341                 DLOG(D_SXFER, "Transfer len %jd pid %#jx dev %jd type %jd",
 2342                     spipe->tregs[LEN], spipe->tregs[PID], spipe->tregs[DEV],
 2343                     spipe->ptype);
 2344 
 2345                 t->spipe[ab] = spipe;
 2346                 t->flags |= ab ? F_BREADY : F_AREADY;
 2347 
 2348                 slhci_tstart(sc);
 2349         }
 2350 }
 2351 
 2352 /*
 2353  * slhci_callback is called after the lock is taken.
 2354  */
 2355 static void
 2356 slhci_callback(struct slhci_softc *sc)
 2357 {
 2358         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 2359         struct slhci_transfers *t;
 2360         struct slhci_pipe *spipe;
 2361         struct usbd_xfer *xfer;
 2362 
 2363         t = &sc->sc_transfers;
 2364 
 2365         KASSERT(mutex_owned(&sc->sc_intr_lock));
 2366 
 2367         DLOG(D_SOFT, "CB flags %#jx", t->flags, 0,0,0);
 2368         for (;;) {
 2369                 if (__predict_false(t->flags & F_ROOTINTR)) {
 2370                         t->flags &= ~F_ROOTINTR;
 2371                         if (t->rootintr != NULL) {
 2372                                 u_char *p;
 2373 
 2374                                 KASSERT(t->rootintr->ux_status ==
 2375                                     USBD_IN_PROGRESS);
 2376                                 p = t->rootintr->ux_buf;
 2377                                 p[0] = 2;
 2378                                 t->rootintr->ux_actlen = 1;
 2379                                 t->rootintr->ux_status = USBD_NORMAL_COMPLETION;
 2380                                 xfer = t->rootintr;
 2381                                 goto do_callback;
 2382                         }
 2383                 }
 2384 
 2385 
 2386                 if (!DEQUEUED_CALLBACK(spipe, t))
 2387                         return;
 2388 
 2389                 xfer = spipe->xfer;
 2390                 LK_SLASSERT(xfer != NULL, sc, spipe, NULL, return);
 2391                 spipe->xfer = NULL;
 2392                 DLOG(D_XFER, "xfer callback length %jd actlen %jd spipe %#jx "
 2393                     "type %jd", xfer->ux_length, (uintptr_t)xfer->ux_actlen,
 2394                     (uintptr_t)spipe, spipe->ptype);
 2395 do_callback:
 2396                 slhci_do_callback(sc, xfer);
 2397         }
 2398 }
 2399 
 2400 static void
 2401 slhci_enter_xfer(struct slhci_softc *sc, struct slhci_pipe *spipe)
 2402 {
 2403         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 2404         struct slhci_transfers *t;
 2405 
 2406         t = &sc->sc_transfers;
 2407 
 2408         KASSERT(mutex_owned(&sc->sc_intr_lock));
 2409 
 2410         if (__predict_false(t->flags & F_DISABLED) ||
 2411             __predict_false(spipe->pflags & PF_GONE)) {
 2412                 DLOG(D_MSG, "slhci_enter_xfer: DISABLED or GONE", 0,0,0,0);
 2413                 spipe->xfer->ux_status = USBD_CANCELLED;
 2414         }
 2415 
 2416         if (spipe->xfer->ux_status == USBD_IN_PROGRESS) {
 2417                 if (spipe->xfer->ux_timeout) {
 2418                         spipe->to_frame = t->frame + spipe->xfer->ux_timeout;
 2419                         slhci_xfer_timer(sc, spipe);
 2420                 }
 2421                 if (spipe->pipe.up_interval)
 2422                         slhci_queue_timed(sc, spipe);
 2423                 else
 2424                         enter_q(t, spipe, Q_CB);
 2425         } else
 2426                 enter_callback(t, spipe);
 2427 }
 2428 
 2429 static void
 2430 slhci_enter_xfers(struct slhci_softc *sc)
 2431 {
 2432         struct slhci_pipe *spipe;
 2433 
 2434         KASSERT(mutex_owned(&sc->sc_intr_lock));
 2435 
 2436         while (DEQUEUED_WAITQ(spipe, sc))
 2437                 slhci_enter_xfer(sc, spipe);
 2438 }
 2439 
 2440 static void
 2441 slhci_queue_timed(struct slhci_softc *sc, struct slhci_pipe *spipe)
 2442 {
 2443         struct slhci_transfers *t;
 2444         struct gcq *q;
 2445         struct slhci_pipe *spp;
 2446 
 2447         t = &sc->sc_transfers;
 2448 
 2449         KASSERT(mutex_owned(&sc->sc_intr_lock));
 2450 
 2451         FIND_TIMED(q, t, spp, spp->frame > spipe->frame);
 2452         gcq_insert_before(q, &spipe->xq);
 2453 }
 2454 
 2455 static void
 2456 slhci_xfer_timer(struct slhci_softc *sc, struct slhci_pipe *spipe)
 2457 {
 2458         struct slhci_transfers *t;
 2459         struct gcq *q;
 2460         struct slhci_pipe *spp;
 2461 
 2462         t = &sc->sc_transfers;
 2463 
 2464         KASSERT(mutex_owned(&sc->sc_intr_lock));
 2465 
 2466         FIND_TO(q, t, spp, spp->to_frame >= spipe->to_frame);
 2467         gcq_insert_before(q, &spipe->to);
 2468 }
 2469 
 2470 static void
 2471 slhci_callback_schedule(struct slhci_softc *sc)
 2472 {
 2473         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 2474         struct slhci_transfers *t;
 2475 
 2476         t = &sc->sc_transfers;
 2477 
 2478         KASSERT(mutex_owned(&sc->sc_intr_lock));
 2479 
 2480         if (t->flags & F_ACTIVE)
 2481                 slhci_do_callback_schedule(sc);
 2482 }
 2483 
 2484 static void
 2485 slhci_do_callback_schedule(struct slhci_softc *sc)
 2486 {
 2487         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 2488         struct slhci_transfers *t;
 2489 
 2490         t = &sc->sc_transfers;
 2491 
 2492         KASSERT(mutex_owned(&sc->sc_intr_lock));
 2493 
 2494         DLOG(D_MSG, "flags %#jx", t->flags, 0, 0, 0);
 2495         if (!(t->flags & F_CALLBACK)) {
 2496                 t->flags |= F_CALLBACK;
 2497                 softint_schedule(sc->sc_cb_softintr);
 2498         }
 2499 }
 2500 
 2501 #if 0
 2502 /* must be called with lock taken. */
 2503 /* XXX static */ void
 2504 slhci_pollxfer(struct slhci_softc *sc, struct usbd_xfer *xfer)
 2505 {
 2506         KASSERT(mutex_owned(&sc->sc_intr_lock));
 2507         slhci_dotransfer(sc);
 2508         do {
 2509                 slhci_dointr(sc);
 2510         } while (xfer->ux_status == USBD_IN_PROGRESS);
 2511         slhci_do_callback(sc, xfer);
 2512 }
 2513 #endif
 2514 
 2515 static usbd_status
 2516 slhci_do_poll(struct slhci_softc *sc, struct slhci_pipe *spipe, struct
 2517     usbd_xfer *xfer)
 2518 {
 2519         slhci_waitintr(sc, 0);
 2520 
 2521         return USBD_NORMAL_COMPLETION;
 2522 }
 2523 
 2524 static usbd_status
 2525 slhci_lsvh_warn(struct slhci_softc *sc, struct slhci_pipe *spipe, struct
 2526     usbd_xfer *xfer)
 2527 {
 2528         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 2529         struct slhci_transfers *t;
 2530 
 2531         t = &sc->sc_transfers;
 2532 
 2533         if (!(t->flags & F_LSVH_WARNED)) {
 2534                 printf("%s: Low speed device via hub disabled, "
 2535                     "see slhci(4)\n", SC_NAME(sc));
 2536                 DDOLOG("Low speed device via hub disabled, "
 2537                     "see slhci(4)", SC_NAME(sc), 0,0,0);
 2538                 t->flags |= F_LSVH_WARNED;
 2539         }
 2540         return USBD_INVAL;
 2541 }
 2542 
 2543 static usbd_status
 2544 slhci_isoc_warn(struct slhci_softc *sc, struct slhci_pipe *spipe, struct
 2545     usbd_xfer *xfer)
 2546 {
 2547         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 2548         struct slhci_transfers *t;
 2549 
 2550         t = &sc->sc_transfers;
 2551 
 2552         if (!(t->flags & F_ISOC_WARNED)) {
 2553                 printf("%s: ISOC transfer not supported "
 2554                     "(see slhci(4))\n", SC_NAME(sc));
 2555                 DDOLOG("ISOC transfer not supported "
 2556                     "(see slhci(4))", 0, 0, 0, 0);
 2557                 t->flags |= F_ISOC_WARNED;
 2558         }
 2559         return USBD_INVAL;
 2560 }
 2561 
 2562 static usbd_status
 2563 slhci_open_pipe(struct slhci_softc *sc, struct slhci_pipe *spipe, struct
 2564     usbd_xfer *xfer)
 2565 {
 2566         struct slhci_transfers *t;
 2567         struct usbd_pipe *pipe;
 2568 
 2569         t = &sc->sc_transfers;
 2570         pipe = &spipe->pipe;
 2571 
 2572         if (t->flags & F_DISABLED)
 2573                 return USBD_CANCELLED;
 2574         else if (pipe->up_interval && !slhci_reserve_bustime(sc, spipe, 1))
 2575                 return USBD_PENDING_REQUESTS;
 2576         else {
 2577                 enter_all_pipes(t, spipe);
 2578                 return USBD_NORMAL_COMPLETION;
 2579         }
 2580 }
 2581 
 2582 static usbd_status
 2583 slhci_close_pipe(struct slhci_softc *sc, struct slhci_pipe *spipe, struct
 2584     usbd_xfer *xfer)
 2585 {
 2586         struct usbd_pipe *pipe;
 2587 
 2588         pipe = &spipe->pipe;
 2589 
 2590         if (pipe->up_interval && spipe->ptype != PT_ROOT_INTR)
 2591                 slhci_reserve_bustime(sc, spipe, 0);
 2592         gcq_remove(&spipe->ap);
 2593         return USBD_NORMAL_COMPLETION;
 2594 }
 2595 
 2596 static usbd_status
 2597 slhci_do_abort(struct slhci_softc *sc, struct slhci_pipe *spipe, struct
 2598     usbd_xfer *xfer)
 2599 {
 2600         struct slhci_transfers *t;
 2601 
 2602         t = &sc->sc_transfers;
 2603 
 2604         KASSERT(mutex_owned(&sc->sc_intr_lock));
 2605 
 2606         if (spipe->xfer == xfer) {
 2607                 if (spipe->ptype == PT_ROOT_INTR) {
 2608                         if (t->rootintr == spipe->xfer) /* XXX assert? */
 2609                                 t->rootintr = NULL;
 2610                 } else {
 2611                         gcq_remove(&spipe->to);
 2612                         gcq_remove(&spipe->xq);
 2613 
 2614                         if (t->spipe[A] == spipe) {
 2615                                 t->spipe[A] = NULL;
 2616                                 if (!(t->flags & F_AINPROG))
 2617                                         t->len[A] = -1;
 2618                         } else if (t->spipe[B] == spipe) {
 2619                                         t->spipe[B] = NULL;
 2620                                 if (!(t->flags & F_BINPROG))
 2621                                         t->len[B] = -1;
 2622                         }
 2623                 }
 2624 
 2625                 if (xfer->ux_status != USBD_TIMEOUT) {
 2626                         spipe->xfer = NULL;
 2627                         spipe->pipe.up_repeat = 0; /* XXX timeout? */
 2628                 }
 2629         }
 2630 
 2631         return USBD_NORMAL_COMPLETION;
 2632 }
 2633 
 2634 /*
 2635  * Called to deactivate or stop use of the controller instead of panicking.
 2636  * Will cancel the xfer correctly even when not on a list.
 2637  */
 2638 static usbd_status
 2639 slhci_halt(struct slhci_softc *sc, struct slhci_pipe *spipe,
 2640     struct usbd_xfer *xfer)
 2641 {
 2642         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 2643         struct slhci_transfers *t;
 2644 
 2645         KASSERT(mutex_owned(&sc->sc_intr_lock));
 2646 
 2647         t = &sc->sc_transfers;
 2648 
 2649         DDOLOG("Halt! sc %p spipe %p xfer %p", sc, spipe, xfer, 0);
 2650 
 2651         if (spipe != NULL)
 2652                 slhci_log_spipe(spipe);
 2653 
 2654         if (xfer != NULL)
 2655                 slhci_log_xfer(xfer);
 2656 
 2657         if (spipe != NULL && xfer != NULL && spipe->xfer == xfer &&
 2658             !gcq_onlist(&spipe->xq) && t->spipe[A] != spipe && t->spipe[B] !=
 2659             spipe) {
 2660                 xfer->ux_status = USBD_CANCELLED;
 2661                 enter_callback(t, spipe);
 2662         }
 2663 
 2664         if (t->flags & F_ACTIVE) {
 2665                 slhci_intrchange(sc, 0);
 2666                 /*
 2667                  * leave power on when halting in case flash devices or disks
 2668                  * are attached, which may be writing and could be damaged
 2669                  * by abrupt power loss.  The root hub clear power feature
 2670                  * should still work after halting.
 2671                  */
 2672         }
 2673 
 2674         t->flags &= ~F_ACTIVE;
 2675         t->flags |= F_UDISABLED;
 2676         if (!(t->flags & F_NODEV))
 2677                 t->flags |= F_NODEV|F_CCONNECT|F_ROOTINTR;
 2678         slhci_drain(sc);
 2679 
 2680         /* One last callback for the drain and device removal. */
 2681         slhci_do_callback_schedule(sc);
 2682 
 2683         return USBD_NORMAL_COMPLETION;
 2684 }
 2685 
 2686 /*
 2687  * There are three interrupt states: no interrupts during reset and after
 2688  * device deactivation, INSERT only for no device present but power on, and
 2689  * SOF, INSERT, ADONE, and BDONE when device is present.
 2690  */
 2691 static void
 2692 slhci_intrchange(struct slhci_softc *sc, uint8_t new_ier)
 2693 {
 2694         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 2695         KASSERT(mutex_owned(&sc->sc_intr_lock));
 2696         if (sc->sc_ier != new_ier) {
 2697                 DLOG(D_INTR, "New IER %#jx", new_ier, 0, 0, 0);
 2698                 sc->sc_ier = new_ier;
 2699                 slhci_write(sc, SL11_IER, new_ier);
 2700                 BSB_SYNC(sc->iot, sc->ioh, sc->pst, sc->psz);
 2701         }
 2702 }
 2703 
 2704 /*
 2705  * Drain: cancel all pending transfers and put them on the callback list and
 2706  * set the UDISABLED flag.  UDISABLED is cleared only by reset.
 2707  */
 2708 static void
 2709 slhci_drain(struct slhci_softc *sc)
 2710 {
 2711         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 2712         struct slhci_transfers *t;
 2713         struct slhci_pipe *spipe;
 2714         struct gcq *q;
 2715         int i;
 2716 
 2717         KASSERT(mutex_owned(&sc->sc_intr_lock));
 2718 
 2719         t = &sc->sc_transfers;
 2720 
 2721         DLOG(D_MSG, "DRAIN flags %#jx", t->flags, 0,0,0);
 2722 
 2723         t->pend = INT_MAX;
 2724 
 2725         for (i = 0; i <= 1; i++) {
 2726                 t->len[i] = -1;
 2727                 if (t->spipe[i] != NULL) {
 2728                         enter_callback(t, t->spipe[i]);
 2729                         t->spipe[i] = NULL;
 2730                 }
 2731         }
 2732 
 2733         /* Merge the queues into the callback queue. */
 2734         gcq_merge_tail(&t->q[Q_CALLBACKS], &t->q[Q_CB]);
 2735         gcq_merge_tail(&t->q[Q_CALLBACKS], &t->q[Q_NEXT_CB]);
 2736         gcq_merge_tail(&t->q[Q_CALLBACKS], &t->timed);
 2737 
 2738         /*
 2739          * Cancel all pipes.  Note that not all of these may be on the
 2740          * callback queue yet; some could be in slhci_start, for example.
 2741          */
 2742         FOREACH_AP(q, t, spipe) {
 2743                 spipe->pflags |= PF_GONE;
 2744                 spipe->pipe.up_repeat = 0;
 2745                 spipe->pipe.up_aborting = 1;
 2746                 if (spipe->xfer != NULL)
 2747                         spipe->xfer->ux_status = USBD_CANCELLED;
 2748         }
 2749 
 2750         gcq_remove_all(&t->to);
 2751 
 2752         t->flags |= F_UDISABLED;
 2753         t->flags &= ~(F_AREADY|F_BREADY|F_AINPROG|F_BINPROG|F_LOWSPEED);
 2754 }
 2755 
 2756 /*
 2757  * RESET: SL11_CTRL_RESETENGINE=1 and SL11_CTRL_JKSTATE=0 for 50ms
 2758  * reconfigure SOF after reset, must wait 2.5us before USB bus activity (SOF)
 2759  * check attached device speed.
 2760  * must wait 100ms before USB transaction according to app note, 10ms
 2761  * by spec.  uhub does this delay
 2762  *
 2763  * Started from root hub set feature reset, which does step one.
 2764  * ub_usepolling will call slhci_reset directly, otherwise the callout goes
 2765  * through slhci_reset_entry.
 2766  */
 2767 void
 2768 slhci_reset(struct slhci_softc *sc)
 2769 {
 2770         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 2771         struct slhci_transfers *t;
 2772         struct slhci_pipe *spipe;
 2773         struct gcq *q;
 2774         uint8_t r, pol, ctrl;
 2775 
 2776         t = &sc->sc_transfers;
 2777         KASSERT(mutex_owned(&sc->sc_intr_lock));
 2778 
 2779         stop_cc_time(&t_delay);
 2780 
 2781         KASSERT(t->flags & F_ACTIVE);
 2782 
 2783         start_cc_time(&t_delay, 0);
 2784         stop_cc_time(&t_delay);
 2785 
 2786         slhci_write(sc, SL11_CTRL, 0);
 2787         start_cc_time(&t_delay, 3);
 2788         DELAY(3);
 2789         stop_cc_time(&t_delay);
 2790         slhci_write(sc, SL11_ISR, 0xff);
 2791 
 2792         r = slhci_read(sc, SL11_ISR);
 2793 
 2794         if (r & SL11_ISR_INSERT)
 2795                 slhci_write(sc, SL11_ISR, SL11_ISR_INSERT);
 2796 
 2797         if (r & SL11_ISR_NODEV) {
 2798                 DLOG(D_MSG, "NC", 0,0,0,0);
 2799                 /*
 2800                  * Normally, the hard interrupt insert routine will issue
 2801                  * CCONNECT, however we need to do it here if the detach
 2802                  * happened during reset.
 2803                  */
 2804                 if (!(t->flags & F_NODEV))
 2805                         t->flags |= F_CCONNECT|F_ROOTINTR|F_NODEV;
 2806                 slhci_intrchange(sc, SL11_IER_INSERT);
 2807         } else {
 2808                 if (t->flags & F_NODEV)
 2809                         t->flags |= F_CCONNECT;
 2810                 t->flags &= ~(F_NODEV|F_LOWSPEED);
 2811                 if (r & SL11_ISR_DATA) {
 2812                         DLOG(D_MSG, "FS", 0,0,0,0);
 2813                         pol = ctrl = 0;
 2814                 } else {
 2815                         DLOG(D_MSG, "LS", 0,0,0,0);
 2816                         pol  = SL811_CSOF_POLARITY;
 2817                         ctrl = SL11_CTRL_LOWSPEED;
 2818                         t->flags |= F_LOWSPEED;
 2819                 }
 2820 
 2821                 /* Enable SOF auto-generation */
 2822                 t->frame = 0;   /* write to SL811_CSOF will reset frame */
 2823                 slhci_write(sc, SL11_SOFTIME, 0xe0);
 2824                 slhci_write(sc, SL811_CSOF, pol|SL811_CSOF_MASTER|0x2e);
 2825                 slhci_write(sc, SL11_CTRL, ctrl|SL11_CTRL_ENABLESOF);
 2826 
 2827                 /*
 2828                  * According to the app note, ARM must be set
 2829                  * for SOF generation to work.  We initialize all
 2830                  * USBA registers here for current_tregs.
 2831                  */
 2832                 slhci_write(sc, SL11_E0ADDR, SL11_BUFFER_START);
 2833                 slhci_write(sc, SL11_E0LEN, 0);
 2834                 slhci_write(sc, SL11_E0PID, SL11_PID_SOF);
 2835                 slhci_write(sc, SL11_E0DEV, 0);
 2836                 slhci_write(sc, SL11_E0CTRL, SL11_EPCTRL_ARM);
 2837 
 2838                 /*
 2839                  * Initialize B registers.  This can't be done earlier since
 2840                  * they are not valid until the SL811_CSOF register is written
 2841                  * above due to SL11H compatibility.
 2842                  */
 2843                 slhci_write(sc, SL11_E1ADDR, SL11_BUFFER_END - 8);
 2844                 slhci_write(sc, SL11_E1LEN, 0);
 2845                 slhci_write(sc, SL11_E1PID, 0);
 2846                 slhci_write(sc, SL11_E1DEV, 0);
 2847 
 2848                 t->current_tregs[0][ADR] = SL11_BUFFER_START;
 2849                 t->current_tregs[0][LEN] = 0;
 2850                 t->current_tregs[0][PID] = SL11_PID_SOF;
 2851                 t->current_tregs[0][DEV] = 0;
 2852                 t->current_tregs[1][ADR] = SL11_BUFFER_END - 8;
 2853                 t->current_tregs[1][LEN] = 0;
 2854                 t->current_tregs[1][PID] = 0;
 2855                 t->current_tregs[1][DEV] = 0;
 2856 
 2857                 /* SOF start will produce USBA interrupt */
 2858                 t->len[A] = 0;
 2859                 t->flags |= F_AINPROG;
 2860 
 2861                 slhci_intrchange(sc, SLHCI_NORMAL_INTERRUPTS);
 2862         }
 2863 
 2864         t->flags &= ~(F_UDISABLED|F_RESET);
 2865         t->flags |= F_CRESET|F_ROOTINTR;
 2866         FOREACH_AP(q, t, spipe) {
 2867                 spipe->pflags &= ~PF_GONE;
 2868                 spipe->pipe.up_aborting = 0;
 2869         }
 2870         DLOG(D_MSG, "RESET done flags %#jx", t->flags, 0,0,0);
 2871 }
 2872 
 2873 
 2874 #ifdef SLHCI_DEBUG
 2875 static int
 2876 slhci_memtest(struct slhci_softc *sc)
 2877 {
 2878         enum { ASC, DESC, EITHER = ASC };       /* direction */
 2879         enum { READ, WRITE };                   /* operation */
 2880         const char *ptr, *elem;
 2881         size_t i;
 2882         const int low = SL11_BUFFER_START, high = SL11_BUFFER_END;
 2883         int addr = 0, dir = ASC, op = READ;
 2884         /* Extended March C- test algorithm (SOFs also) */
 2885         const char test[] = "E(w0) A(r0w1r1) A(r1w0r0) D(r0w1) D(r1w0) E(r0)";
 2886         char c;
 2887         const uint8_t dbs[] = { 0x00, 0x0f, 0x33, 0x55 }; /* data backgrounds */
 2888         uint8_t db;
 2889 
 2890         /* Perform memory test for all data backgrounds. */
 2891         for (i = 0; i < __arraycount(dbs); i++) {
 2892                 ptr = test;
 2893                 elem = ptr;
 2894                 /* Walk test algorithm string. */
 2895                 while ((c = *ptr++) != '\0')
 2896                         switch (tolower((int)c)) {
 2897                         case 'a':
 2898                                 /* Address sequence is in ascending order. */
 2899                                 dir = ASC;
 2900                                 break;
 2901                         case 'd':
 2902                                 /* Address sequence is in descending order. */
 2903                                 dir = DESC;
 2904                                 break;
 2905                         case 'e':
 2906                                 /* Address sequence is in either order. */
 2907                                 dir = EITHER;
 2908                                 break;
 2909                         case '(':
 2910                                 /* Start of test element (sequence). */
 2911                                 elem = ptr;
 2912                                 addr = (dir == ASC) ? low : high;
 2913                                 break;
 2914                         case 'r':
 2915                                 /* read operation */
 2916                                 op = READ;
 2917                                 break;
 2918                         case 'w':
 2919                                 /* write operation */
 2920                                 op = WRITE;
 2921                                 break;
 2922                         case '':
 2923                         case '1':
 2924                                 /*
 2925                                  * Execute previously set-up operation by
 2926                                  * reading/writing non-inverted ('') or
 2927                                  * inverted ('1') data background.
 2928                                  */
 2929                                 db = (c - '') ? ~dbs[i] : dbs[i];
 2930                                 if (op == READ) {
 2931                                         if (slhci_read(sc, addr) != db)
 2932                                                 return -1;
 2933                                 } else
 2934                                         slhci_write(sc, addr, db);
 2935                                 break;
 2936                         case ')':
 2937                                 /*
 2938                                  * End of element: Repeat same element with next
 2939                                  * address or continue to next element.
 2940                                  */
 2941                                 addr = (dir == ASC) ? addr + 1 : addr - 1;
 2942                                 if (addr >= low && addr <= high)
 2943                                         ptr = elem;
 2944                                 break;
 2945                         default:
 2946                                 /* Do nothing. */
 2947                                 break;
 2948                         }
 2949         }
 2950 
 2951         return 0;
 2952 }
 2953 #endif
 2954 
 2955 /* returns 1 if succeeded, 0 if failed, reserve == 0 is unreserve */
 2956 static int
 2957 slhci_reserve_bustime(struct slhci_softc *sc, struct slhci_pipe *spipe, int
 2958     reserve)
 2959 {
 2960         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 2961         struct slhci_transfers *t;
 2962         int bustime, max_packet;
 2963 
 2964         KASSERT(mutex_owned(&sc->sc_intr_lock));
 2965 
 2966         t = &sc->sc_transfers;
 2967         max_packet = UGETW(spipe->pipe.up_endpoint->ue_edesc->wMaxPacketSize);
 2968 
 2969         if (spipe->pflags & PF_LS)
 2970                 bustime = SLHCI_LS_CONST + SLHCI_LS_DATA_TIME(max_packet);
 2971         else
 2972                 bustime = SLHCI_FS_CONST + SLHCI_FS_DATA_TIME(max_packet);
 2973 
 2974         if (!reserve) {
 2975                 t->reserved_bustime -= bustime;
 2976 #ifdef DIAGNOSTIC
 2977                 if (t->reserved_bustime < 0) {
 2978                         printf("%s: reserved_bustime %d < 0!\n",
 2979                             SC_NAME(sc), t->reserved_bustime);
 2980                         DDOLOG("reserved_bustime %d < 0!",
 2981                             t->reserved_bustime, 0, 0, 0);
 2982                         t->reserved_bustime = 0;
 2983                 }
 2984 #endif
 2985                 return 1;
 2986         }
 2987 
 2988         if (t->reserved_bustime + bustime > SLHCI_RESERVED_BUSTIME) {
 2989                 if (ratecheck(&sc->sc_reserved_warn_rate,
 2990                     &reserved_warn_rate))
 2991 #ifdef SLHCI_NO_OVERTIME
 2992                 {
 2993                         printf("%s: Max reserved bus time exceeded! "
 2994                             "Erroring request.\n", SC_NAME(sc));
 2995                         DDOLOG("%s: Max reserved bus time exceeded! "
 2996                             "Erroring request.", 0, 0, 0, 0);
 2997                 }
 2998                 return 0;
 2999 #else
 3000                 {
 3001                         printf("%s: Reserved bus time exceeds %d!\n",
 3002                             SC_NAME(sc), SLHCI_RESERVED_BUSTIME);
 3003                         DDOLOG("Reserved bus time exceeds %d!",
 3004                             SLHCI_RESERVED_BUSTIME, 0, 0, 0);
 3005                 }
 3006 #endif
 3007         }
 3008 
 3009         t->reserved_bustime += bustime;
 3010         return 1;
 3011 }
 3012 
 3013 /* Device insertion/removal interrupt */
 3014 static void
 3015 slhci_insert(struct slhci_softc *sc)
 3016 {
 3017         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 3018         struct slhci_transfers *t;
 3019 
 3020         t = &sc->sc_transfers;
 3021 
 3022         KASSERT(mutex_owned(&sc->sc_intr_lock));
 3023 
 3024         if (t->flags & F_NODEV)
 3025                 slhci_intrchange(sc, 0);
 3026         else {
 3027                 slhci_drain(sc);
 3028                 slhci_intrchange(sc, SL11_IER_INSERT);
 3029         }
 3030         t->flags ^= F_NODEV;
 3031         t->flags |= F_ROOTINTR|F_CCONNECT;
 3032         DLOG(D_MSG, "INSERT intr: flags after %#jx", t->flags, 0,0,0);
 3033 }
 3034 
 3035 /*
 3036  * Data structures and routines to emulate the root hub.
 3037  */
 3038 
 3039 static usbd_status
 3040 slhci_clear_feature(struct slhci_softc *sc, unsigned int what)
 3041 {
 3042         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 3043         struct slhci_transfers *t;
 3044         usbd_status error;
 3045 
 3046         t = &sc->sc_transfers;
 3047         error = USBD_NORMAL_COMPLETION;
 3048 
 3049         KASSERT(mutex_owned(&sc->sc_intr_lock));
 3050 
 3051         if (what == UHF_PORT_POWER) {
 3052                 DLOG(D_MSG, "POWER_OFF", 0,0,0,0);
 3053                 t->flags &= ~F_POWER;
 3054                 if (!(t->flags & F_NODEV))
 3055                         t->flags |= F_NODEV|F_CCONNECT|F_ROOTINTR;
 3056                 /* for x68k Nereid USB controller */
 3057                 if (sc->sc_enable_power && (t->flags & F_REALPOWER)) {
 3058                         t->flags &= ~F_REALPOWER;
 3059                         sc->sc_enable_power(sc, POWER_OFF);
 3060                 }
 3061                 slhci_intrchange(sc, 0);
 3062                 slhci_drain(sc);
 3063         } else if (what == UHF_C_PORT_CONNECTION) {
 3064                 t->flags &= ~F_CCONNECT;
 3065         } else if (what == UHF_C_PORT_RESET) {
 3066                 t->flags &= ~F_CRESET;
 3067         } else if (what == UHF_PORT_ENABLE) {
 3068                 slhci_drain(sc);
 3069         } else if (what != UHF_PORT_SUSPEND) {
 3070                 DDOLOG("ClrPortFeatERR:value=%#.4x", what, 0,0,0);
 3071                 error = USBD_IOERROR;
 3072         }
 3073 
 3074         return error;
 3075 }
 3076 
 3077 static usbd_status
 3078 slhci_set_feature(struct slhci_softc *sc, unsigned int what)
 3079 {
 3080         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 3081         struct slhci_transfers *t;
 3082         uint8_t r;
 3083 
 3084         t = &sc->sc_transfers;
 3085 
 3086         KASSERT(mutex_owned(&sc->sc_intr_lock));
 3087 
 3088         if (what == UHF_PORT_RESET) {
 3089                 if (!(t->flags & F_ACTIVE)) {
 3090                         DDOLOG("SET PORT_RESET when not ACTIVE!",
 3091                             0,0,0,0);
 3092                         return USBD_INVAL;
 3093                 }
 3094                 if (!(t->flags & F_POWER)) {
 3095                         DDOLOG("SET PORT_RESET without PORT_POWER! flags %p",
 3096                             t->flags, 0,0,0);
 3097                         return USBD_INVAL;
 3098                 }
 3099                 if (t->flags & F_RESET)
 3100                         return USBD_NORMAL_COMPLETION;
 3101                 DLOG(D_MSG, "RESET flags %#jx", t->flags, 0,0,0);
 3102                 slhci_intrchange(sc, 0);
 3103                 slhci_drain(sc);
 3104                 slhci_write(sc, SL11_CTRL, SL11_CTRL_RESETENGINE);
 3105                 /* usb spec says delay >= 10ms, app note 50ms */
 3106                 start_cc_time(&t_delay, 50000);
 3107                 if (sc->sc_bus.ub_usepolling) {
 3108                         DELAY(50000);
 3109                         slhci_reset(sc);
 3110                 } else {
 3111                         t->flags |= F_RESET;
 3112                         callout_schedule(&sc->sc_timer, uimax(mstohz(50), 2));
 3113                 }
 3114         } else if (what == UHF_PORT_SUSPEND) {
 3115                 printf("%s: USB Suspend not implemented!\n", SC_NAME(sc));
 3116                 DDOLOG("USB Suspend not implemented!", 0, 0, 0, 0);
 3117         } else if (what == UHF_PORT_POWER) {
 3118                 DLOG(D_MSG, "PORT_POWER", 0,0,0,0);
 3119                 /* for x68k Nereid USB controller */
 3120                 if (!(t->flags & F_ACTIVE))
 3121                         return USBD_INVAL;
 3122                 if (t->flags & F_POWER)
 3123                         return USBD_NORMAL_COMPLETION;
 3124                 if (!(t->flags & F_REALPOWER)) {
 3125                         if (sc->sc_enable_power)
 3126                                 sc->sc_enable_power(sc, POWER_ON);
 3127                         t->flags |= F_REALPOWER;
 3128                 }
 3129                 t->flags |= F_POWER;
 3130                 r = slhci_read(sc, SL11_ISR);
 3131                 if (r & SL11_ISR_INSERT)
 3132                         slhci_write(sc, SL11_ISR, SL11_ISR_INSERT);
 3133                 if (r & SL11_ISR_NODEV) {
 3134                         slhci_intrchange(sc, SL11_IER_INSERT);
 3135                         t->flags |= F_NODEV;
 3136                 } else {
 3137                         t->flags &= ~F_NODEV;
 3138                         t->flags |= F_CCONNECT|F_ROOTINTR;
 3139                 }
 3140         } else {
 3141                 DDOLOG("SetPortFeatERR=%#.8x", what, 0,0,0);
 3142                 return USBD_IOERROR;
 3143         }
 3144 
 3145         return USBD_NORMAL_COMPLETION;
 3146 }
 3147 
 3148 static void
 3149 slhci_get_status(struct slhci_softc *sc, usb_port_status_t *ps)
 3150 {
 3151         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 3152         struct slhci_transfers *t;
 3153         unsigned int status, change;
 3154 
 3155         t = &sc->sc_transfers;
 3156 
 3157         KASSERT(mutex_owned(&sc->sc_intr_lock));
 3158 
 3159         /*
 3160          * We do not have a way to detect over current or babble and
 3161          * suspend is currently not implemented, so connect and reset
 3162          * are the only changes that need to be reported.
 3163          */
 3164         change = 0;
 3165         if (t->flags & F_CCONNECT)
 3166                 change |= UPS_C_CONNECT_STATUS;
 3167         if (t->flags & F_CRESET)
 3168                 change |= UPS_C_PORT_RESET;
 3169 
 3170         status = 0;
 3171         if (!(t->flags & F_NODEV))
 3172                 status |= UPS_CURRENT_CONNECT_STATUS;
 3173         if (!(t->flags & F_UDISABLED))
 3174                 status |= UPS_PORT_ENABLED;
 3175         if (t->flags & F_RESET)
 3176                 status |= UPS_RESET;
 3177         if (t->flags & F_POWER)
 3178                 status |= UPS_PORT_POWER;
 3179         if (t->flags & F_LOWSPEED)
 3180                 status |= UPS_LOW_SPEED;
 3181         USETW(ps->wPortStatus, status);
 3182         USETW(ps->wPortChange, change);
 3183         DLOG(D_ROOT, "status=%#.4jx, change=%#.4jx", status, change, 0,0);
 3184 }
 3185 
 3186 static int
 3187 slhci_roothub_ctrl(struct usbd_bus *bus, usb_device_request_t *req,
 3188     void *buf, int buflen)
 3189 {
 3190         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 3191         struct slhci_softc *sc = SLHCI_BUS2SC(bus);
 3192         struct slhci_transfers *t = &sc->sc_transfers;
 3193         usbd_status error = USBD_IOERROR; /* XXX should be STALL */
 3194         uint16_t len, value, index;
 3195         uint8_t type;
 3196         int actlen = 0;
 3197 
 3198         len = UGETW(req->wLength);
 3199         value = UGETW(req->wValue);
 3200         index = UGETW(req->wIndex);
 3201 
 3202         type = req->bmRequestType;
 3203 
 3204         SLHCI_DEXEC(D_TRACE, slhci_log_req(req));
 3205 
 3206         /*
 3207          * USB requests for hubs have two basic types, standard and class.
 3208          * Each could potentially have recipients of device, interface,
 3209          * endpoint, or other.  For the hub class, CLASS_OTHER means the port
 3210          * and CLASS_DEVICE means the hub.  For standard requests, OTHER
 3211          * is not used.  Standard request are described in section 9.4 of the
 3212          * standard, hub class requests in 11.16.  Each request is either read
 3213          * or write.
 3214          *
 3215          * Clear Feature, Set Feature, and Status are defined for each of the
 3216          * used recipients.  Get Descriptor and Set Descriptor are defined for
 3217          * both standard and hub class types with different descriptors.
 3218          * Other requests have only one defined recipient and type.  These
 3219          * include: Get/Set Address, Get/Set Configuration, Get/Set Interface,
 3220          * and Synch Frame for standard requests and Get Bus State for hub
 3221          * class.
 3222          *
 3223          * When a device is first powered up it has address 0 until the
 3224          * address is set.
 3225          *
 3226          * Hubs are only allowed to support one interface and may not have
 3227          * isochronous endpoints.  The results of the related requests are
 3228          * undefined.
 3229          *
 3230          * The standard requires invalid or unsupported requests to return
 3231          * STALL in the data stage, however this does not work well with
 3232          * current error handling. XXX
 3233          *
 3234          * Some unsupported fields:
 3235          * Clear Hub Feature is for C_HUB_LOCAL_POWER and C_HUB_OVER_CURRENT
 3236          * Set Device Features is for ENDPOINT_HALT and DEVICE_REMOTE_WAKEUP
 3237          * Get Bus State is optional sample of D- and D+ at EOF2
 3238          */
 3239 
 3240         switch (req->bRequest) {
 3241         /* Write Requests */
 3242         case UR_CLEAR_FEATURE:
 3243                 if (type == UT_WRITE_CLASS_OTHER) {
 3244                         if (index == 1 /* Port */) {
 3245                                 mutex_enter(&sc->sc_intr_lock);
 3246                                 error = slhci_clear_feature(sc, value);
 3247                                 mutex_exit(&sc->sc_intr_lock);
 3248                         } else
 3249                                 DLOG(D_ROOT, "Clear Port Feature "
 3250                                     "index = %#.4jx", index, 0,0,0);
 3251                 }
 3252                 break;
 3253         case UR_SET_FEATURE:
 3254                 if (type == UT_WRITE_CLASS_OTHER) {
 3255                         if (index == 1 /* Port */) {
 3256                                 mutex_enter(&sc->sc_intr_lock);
 3257                                 error = slhci_set_feature(sc, value);
 3258                                 mutex_exit(&sc->sc_intr_lock);
 3259                         } else
 3260                                 DLOG(D_ROOT, "Set Port Feature "
 3261                                     "index = %#.4jx", index, 0,0,0);
 3262                 } else if (type != UT_WRITE_CLASS_DEVICE)
 3263                         DLOG(D_ROOT, "Set Device Feature "
 3264                             "ENDPOINT_HALT or DEVICE_REMOTE_WAKEUP "
 3265                             "not supported", 0,0,0,0);
 3266                 break;
 3267 
 3268         /* Read Requests */
 3269         case UR_GET_STATUS:
 3270                 if (type == UT_READ_CLASS_OTHER) {
 3271                         if (index == 1 /* Port */ && len == /* XXX >=? */
 3272                             sizeof(usb_port_status_t)) {
 3273                                 mutex_enter(&sc->sc_intr_lock);
 3274                                 slhci_get_status(sc, (usb_port_status_t *)
 3275                                     buf);
 3276                                 mutex_exit(&sc->sc_intr_lock);
 3277                                 actlen = sizeof(usb_port_status_t);
 3278                                 error = USBD_NORMAL_COMPLETION;
 3279                         } else
 3280                                 DLOG(D_ROOT, "Get Port Status index = %#.4jx "
 3281                                     "len = %#.4jx", index, len, 0,0);
 3282                 } else if (type == UT_READ_CLASS_DEVICE) { /* XXX index? */
 3283                         if (len == sizeof(usb_hub_status_t)) {
 3284                                 DLOG(D_ROOT, "Get Hub Status",
 3285                                     0,0,0,0);
 3286                                 actlen = sizeof(usb_hub_status_t);
 3287                                 memset(buf, 0, actlen);
 3288                                 error = USBD_NORMAL_COMPLETION;
 3289                         } else
 3290                                 DLOG(D_ROOT, "Get Hub Status bad len %#.4jx",
 3291                                     len, 0,0,0);
 3292                 }
 3293                 break;
 3294         case UR_GET_DESCRIPTOR:
 3295                 if (type == UT_READ_DEVICE) {
 3296                         /* value is type (&0xff00) and index (0xff) */
 3297                         if (value == (UDESC_DEVICE<<8)) {
 3298                                 actlen = buflen;
 3299                                 error = USBD_NORMAL_COMPLETION;
 3300                         } else if (value == (UDESC_CONFIG<<8)) {
 3301                                 struct usb_roothub_descriptors confd;
 3302 
 3303                                 actlen = uimin(buflen, sizeof(confd));
 3304                                 memcpy(&confd, buf, actlen);
 3305 
 3306                                 /* 2 mA units */
 3307                                 confd.urh_confd.bMaxPower = t->max_current;
 3308                                 memcpy(buf, &confd, actlen);
 3309                                 error = USBD_NORMAL_COMPLETION;
 3310                         } else if (value == ((UDESC_STRING<<8)|1)) {
 3311                                 /* Vendor */
 3312                                 actlen = buflen;
 3313                                 error = USBD_NORMAL_COMPLETION;
 3314                         } else if (value == ((UDESC_STRING<<8)|2)) {
 3315                                 /* Product */
 3316                                 actlen = usb_makestrdesc((usb_string_descriptor_t *)
 3317                                     buf, len, "SL811HS/T root hub");
 3318                                 error = USBD_NORMAL_COMPLETION;
 3319                         } else
 3320                                 DDOLOG("Unknown Get Descriptor %#.4x",
 3321                                     value, 0,0,0);
 3322                 } else if (type == UT_READ_CLASS_DEVICE) {
 3323                         /* Descriptor number is 0 */
 3324                         if (value == (UDESC_HUB<<8)) {
 3325                                 usb_hub_descriptor_t hubd;
 3326 
 3327                                 actlen = uimin(buflen, sizeof(hubd));
 3328                                 memcpy(&hubd, buf, actlen);
 3329                                 hubd.bHubContrCurrent =
 3330                                     500 - t->max_current;
 3331                                 memcpy(buf, &hubd, actlen);
 3332                                 error = USBD_NORMAL_COMPLETION;
 3333                         } else
 3334                                 DDOLOG("Unknown Get Hub Descriptor %#.4x",
 3335                                     value, 0,0,0);
 3336                 }
 3337                 break;
 3338         default:
 3339                 /* default from usbroothub */
 3340                 return buflen;
 3341         }
 3342 
 3343         if (error == USBD_NORMAL_COMPLETION)
 3344                 return actlen;
 3345 
 3346         return -1;
 3347 }
 3348 
 3349 /* End in lock functions. Start debug functions. */
 3350 
 3351 #ifdef SLHCI_DEBUG
 3352 void
 3353 slhci_log_buffer(struct usbd_xfer *xfer)
 3354 {
 3355         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 3356         u_char *buf;
 3357 
 3358         if(xfer->ux_length > 0 &&
 3359             UE_GET_DIR(xfer->ux_pipe->up_endpoint->ue_edesc->bEndpointAddress) ==
 3360             UE_DIR_IN) {
 3361                 buf = xfer->ux_buf;
 3362                 DDOLOGBUF(buf, xfer->ux_actlen);
 3363                 DDOLOG("len %d actlen %d short %d", xfer->ux_length,
 3364                     xfer->ux_actlen, xfer->ux_length - xfer->ux_actlen, 0);
 3365         }
 3366 }
 3367 
 3368 void
 3369 slhci_log_req(usb_device_request_t *r)
 3370 {
 3371         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 3372         int req, type, value, index, len;
 3373 
 3374         req   = r->bRequest;
 3375         type  = r->bmRequestType;
 3376         value = UGETW(r->wValue);
 3377         index = UGETW(r->wIndex);
 3378         len   = UGETW(r->wLength);
 3379 
 3380         DDOLOG("request: type %#x", type, 0, 0, 0);
 3381         DDOLOG("request: r=%d,v=%d,i=%d,l=%d ", req, value, index, len);
 3382 }
 3383 
 3384 void
 3385 slhci_log_dumpreg(void)
 3386 {
 3387         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 3388         uint8_t r;
 3389         unsigned int aaddr, alen, baddr, blen;
 3390         static u_char buf[240];
 3391 
 3392         r = slhci_read(ssc, SL11_E0CTRL);
 3393         DDOLOG("USB A Host Control = %#.2x", r, 0, 0, 0);
 3394         DDOLOGEPCTRL(r);
 3395 
 3396         aaddr = slhci_read(ssc, SL11_E0ADDR);
 3397         DDOLOG("USB A Base Address = %u", aaddr, 0,0,0);
 3398         alen = slhci_read(ssc, SL11_E0LEN);
 3399         DDOLOG("USB A Length = %u", alen, 0,0,0);
 3400         r = slhci_read(ssc, SL11_E0STAT);
 3401         DDOLOG("USB A Status = %#.2x", r, 0,0,0);
 3402         DDOLOGEPSTAT(r);
 3403 
 3404         r = slhci_read(ssc, SL11_E0CONT);
 3405         DDOLOG("USB A Remaining or Overflow Length = %u", r, 0,0,0);
 3406         r = slhci_read(ssc, SL11_E1CTRL);
 3407         DDOLOG("USB B Host Control = %#.2x", r, 0,0,0);
 3408         DDOLOGEPCTRL(r);
 3409 
 3410         baddr = slhci_read(ssc, SL11_E1ADDR);
 3411         DDOLOG("USB B Base Address = %u", baddr, 0,0,0);
 3412         blen = slhci_read(ssc, SL11_E1LEN);
 3413         DDOLOG("USB B Length = %u", blen, 0,0,0);
 3414         r = slhci_read(ssc, SL11_E1STAT);
 3415         DDOLOG("USB B Status = %#.2x", r, 0,0,0);
 3416         DDOLOGEPSTAT(r);
 3417 
 3418         r = slhci_read(ssc, SL11_E1CONT);
 3419         DDOLOG("USB B Remaining or Overflow Length = %u", r, 0,0,0);
 3420 
 3421         r = slhci_read(ssc, SL11_CTRL);
 3422         DDOLOG("Control = %#.2x", r, 0,0,0);
 3423         DDOLOGCTRL(r);
 3424 
 3425         r = slhci_read(ssc, SL11_IER);
 3426         DDOLOG("Interrupt Enable = %#.2x", r, 0,0,0);
 3427         DDOLOGIER(r);
 3428 
 3429         r = slhci_read(ssc, SL11_ISR);
 3430         DDOLOG("Interrupt Status = %#.2x", r, 0,0,0);
 3431         DDOLOGISR(r);
 3432 
 3433         r = slhci_read(ssc, SL11_REV);
 3434         DDOLOG("Revision = %#.2x", r, 0,0,0);
 3435         r = slhci_read(ssc, SL811_CSOF);
 3436         DDOLOG("SOF Counter = %#.2x", r, 0,0,0);
 3437 
 3438         if (alen && aaddr >= SL11_BUFFER_START && aaddr < SL11_BUFFER_END &&
 3439             alen <= SL11_MAX_PACKET_SIZE && aaddr + alen <= SL11_BUFFER_END) {
 3440                 slhci_read_multi(ssc, aaddr, buf, alen);
 3441                 DDOLOG("USBA Buffer: start %u len %u", aaddr, alen, 0,0);
 3442                 DDOLOGBUF(buf, alen);
 3443         } else if (alen)
 3444                 DDOLOG("USBA Buffer Invalid", 0,0,0,0);
 3445 
 3446         if (blen && baddr >= SL11_BUFFER_START && baddr < SL11_BUFFER_END &&
 3447             blen <= SL11_MAX_PACKET_SIZE && baddr + blen <= SL11_BUFFER_END) {
 3448                 slhci_read_multi(ssc, baddr, buf, blen);
 3449                 DDOLOG("USBB Buffer: start %u len %u", baddr, blen, 0,0);
 3450                 DDOLOGBUF(buf, blen);
 3451         } else if (blen)
 3452                 DDOLOG("USBB Buffer Invalid", 0,0,0,0);
 3453 }
 3454 
 3455 void
 3456 slhci_log_xfer(struct usbd_xfer *xfer)
 3457 {
 3458         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 3459         DDOLOG("xfer: length=%u, actlen=%u, flags=%#x, timeout=%u,",
 3460                 xfer->ux_length, xfer->ux_actlen, xfer->ux_flags, xfer->ux_timeout);
 3461         DDOLOG("buffer=%p", xfer->ux_buf, 0,0,0);
 3462         slhci_log_req(&xfer->ux_request);
 3463 }
 3464 
 3465 void
 3466 slhci_log_spipe(struct slhci_pipe *spipe)
 3467 {
 3468         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 3469         DDOLOG("spipe %p onlists: AP=%d TO=%d XQ=%d", spipe,
 3470             gcq_onlist(&spipe->ap) ? 1 : 0,
 3471             gcq_onlist(&spipe->to) ? 1 : 0,
 3472             gcq_onlist(&spipe->xq) ? 1 : 0);
 3473         DDOLOG("spipe: xfer %p buffer %p pflags %#x ptype %d",
 3474             spipe->xfer, spipe->buffer, spipe->pflags, spipe->ptype);
 3475 }
 3476 
 3477 void
 3478 slhci_print_intr(void)
 3479 {
 3480         unsigned int ier, isr;
 3481         ier = slhci_read(ssc, SL11_IER);
 3482         isr = slhci_read(ssc, SL11_ISR);
 3483         printf("IER: %#x ISR: %#x \n", ier, isr);
 3484 }
 3485 
 3486 #if 0
 3487 void
 3488 slhci_log_sc(void)
 3489 {
 3490         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 3491 
 3492         struct slhci_transfers *t;
 3493         int i;
 3494 
 3495         t = &ssc->sc_transfers;
 3496 
 3497         DDOLOG("Flags=%#x", t->flags, 0,0,0);
 3498         DDOLOG("a = %p Alen=%d b = %p Blen=%d", t->spipe[0], t->len[0],
 3499             t->spipe[1], t->len[1]);
 3500 
 3501         for (i = 0; i <= Q_MAX; i++)
 3502                 DDOLOG("Q %d: %p", i, gcq_hq(&t->q[i]), 0,0);
 3503 
 3504         DDOLOG("TIMED: %p", GCQ_ITEM(gcq_hq(&t->to),
 3505             struct slhci_pipe, to), 0,0,0);
 3506 
 3507         DDOLOG("frame=%d rootintr=%p", t->frame, t->rootintr, 0,0);
 3508 
 3509         DDOLOG("ub_usepolling=%d", ssc->sc_bus.ub_usepolling, 0, 0, 0);
 3510 }
 3511 
 3512 void
 3513 slhci_log_slreq(struct slhci_pipe *r)
 3514 {
 3515         SLHCIHIST_FUNC(); SLHCIHIST_CALLED();
 3516         DDOLOG("xfer: %p", r->xfer, 0,0,0);
 3517         DDOLOG("buffer: %p", r->buffer, 0,0,0);
 3518         DDOLOG("bustime: %u", r->bustime, 0,0,0);
 3519         DDOLOG("control: %#x", r->control, 0,0,0);
 3520         DDOLOGEPCTRL(r->control);
 3521 
 3522         DDOLOG("pid: %#x", r->tregs[PID], 0,0,0);
 3523         DDOLOG("dev: %u", r->tregs[DEV], 0,0,0);
 3524         DDOLOG("len: %u", r->tregs[LEN], 0,0,0);
 3525 
 3526         if (r->xfer)
 3527                 slhci_log_xfer(r->xfer);
 3528 }
 3529 #endif
 3530 #endif /* SLHCI_DEBUG */
 3531 /* End debug functions. */

Cache object: cba3f4496df724161013027f2060c1e5


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.