xref: /netbsd-src/sys/dev/usb/ehci.c (revision 37afb7eb6895c833050f8bfb1d1bb2f99f332539)
1 /*	$NetBSD: ehci.c,v 1.242 2015/07/11 03:06:25 msaitoh Exp $ */
2 
3 /*
4  * Copyright (c) 2004-2012 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Lennart Augustsson (lennart@augustsson.net), Charles M. Hannum,
9  * Jeremy Morse (jeremy.morse@gmail.com), Jared D. McNeill
10  * (jmcneill@invisible.ca) and Matthew R. Green (mrg@eterna.com.au).
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
23  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
24  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
25  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 /*
35  * USB Enhanced Host Controller Driver, a.k.a. USB 2.0 controller.
36  *
37  * The EHCI 1.0 spec can be found at
38  * http://www.intel.com/technology/usb/spec.htm
39  * and the USB 2.0 spec at
40  * http://www.usb.org/developers/docs/
41  *
42  */
43 
44 /*
45  * TODO:
46  * 1) hold off explorations by companion controllers until ehci has started.
47  *
48  * 2) The hub driver needs to handle and schedule the transaction translator,
49  *    to assign place in frame where different devices get to go. See chapter
50  *    on hubs in USB 2.0 for details.
51  *
52  * 3) Command failures are not recovered correctly.
53  */
54 
55 #include <sys/cdefs.h>
56 __KERNEL_RCSID(0, "$NetBSD: ehci.c,v 1.242 2015/07/11 03:06:25 msaitoh Exp $");
57 
58 #include "ohci.h"
59 #include "uhci.h"
60 #include "opt_usb.h"
61 
62 #include <sys/param.h>
63 
64 #include <sys/bus.h>
65 #include <sys/cpu.h>
66 #include <sys/device.h>
67 #include <sys/kernel.h>
68 #include <sys/kmem.h>
69 #include <sys/mutex.h>
70 #include <sys/proc.h>
71 #include <sys/queue.h>
72 #include <sys/select.h>
73 #include <sys/sysctl.h>
74 #include <sys/systm.h>
75 
76 #include <machine/endian.h>
77 
78 #include <dev/usb/usb.h>
79 #include <dev/usb/usbdi.h>
80 #include <dev/usb/usbdivar.h>
81 #include <dev/usb/usbhist.h>
82 #include <dev/usb/usb_mem.h>
83 #include <dev/usb/usb_quirks.h>
84 #include <dev/usb/usbroothub_subr.h>
85 
86 #include <dev/usb/ehcireg.h>
87 #include <dev/usb/ehcivar.h>
88 
89 
90 #ifdef USB_DEBUG
91 #ifndef EHCI_DEBUG
92 #define ehcidebug 0
93 #else
94 static int ehcidebug = 0;
95 
96 SYSCTL_SETUP(sysctl_hw_ehci_setup, "sysctl hw.ehci setup")
97 {
98 	int err;
99 	const struct sysctlnode *rnode;
100 	const struct sysctlnode *cnode;
101 
102 	err = sysctl_createv(clog, 0, NULL, &rnode,
103 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "ehci",
104 	    SYSCTL_DESCR("ehci global controls"),
105 	    NULL, 0, NULL, 0, CTL_HW, CTL_CREATE, CTL_EOL);
106 
107 	if (err)
108 		goto fail;
109 
110 	/* control debugging printfs */
111 	err = sysctl_createv(clog, 0, &rnode, &cnode,
112 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
113 	    "debug", SYSCTL_DESCR("Enable debugging output"),
114 	    NULL, 0, &ehcidebug, sizeof(ehcidebug), CTL_CREATE, CTL_EOL);
115 	if (err)
116 		goto fail;
117 
118 	return;
119 fail:
120 	aprint_error("%s: sysctl_createv failed (err = %d)\n", __func__, err);
121 }
122 
123 #endif /* EHCI_DEBUG */
124 #endif /* USB_DEBUG */
125 
126 struct ehci_pipe {
127 	struct usbd_pipe pipe;
128 	int nexttoggle;
129 
130 	ehci_soft_qh_t *sqh;
131 	union {
132 		ehci_soft_qtd_t *qtd;
133 		/* ehci_soft_itd_t *itd; */
134 	} tail;
135 	union {
136 		/* Control pipe */
137 		struct {
138 			usb_dma_t reqdma;
139 		} ctl;
140 		/* Interrupt pipe */
141 		struct {
142 			u_int length;
143 		} intr;
144 		/* Bulk pipe */
145 		struct {
146 			u_int length;
147 		} bulk;
148 		/* Iso pipe */
149 		struct {
150 			u_int next_frame;
151 			u_int cur_xfers;
152 		} isoc;
153 	} u;
154 };
155 
156 Static usbd_status	ehci_open(usbd_pipe_handle);
157 Static void		ehci_poll(struct usbd_bus *);
158 Static void		ehci_softintr(void *);
159 Static int		ehci_intr1(ehci_softc_t *);
160 Static void		ehci_waitintr(ehci_softc_t *, usbd_xfer_handle);
161 Static void		ehci_check_intr(ehci_softc_t *, struct ehci_xfer *);
162 Static void		ehci_check_qh_intr(ehci_softc_t *, struct ehci_xfer *);
163 Static void		ehci_check_itd_intr(ehci_softc_t *, struct ehci_xfer *);
164 Static void		ehci_idone(struct ehci_xfer *);
165 Static void		ehci_timeout(void *);
166 Static void		ehci_timeout_task(void *);
167 Static void		ehci_intrlist_timeout(void *);
168 Static void		ehci_doorbell(void *);
169 Static void		ehci_pcd(void *);
170 
171 Static usbd_status	ehci_allocm(struct usbd_bus *, usb_dma_t *, u_int32_t);
172 Static void		ehci_freem(struct usbd_bus *, usb_dma_t *);
173 
174 Static usbd_xfer_handle	ehci_allocx(struct usbd_bus *);
175 Static void		ehci_freex(struct usbd_bus *, usbd_xfer_handle);
176 Static void		ehci_get_lock(struct usbd_bus *, kmutex_t **);
177 
178 Static usbd_status	ehci_root_ctrl_transfer(usbd_xfer_handle);
179 Static usbd_status	ehci_root_ctrl_start(usbd_xfer_handle);
180 Static void		ehci_root_ctrl_abort(usbd_xfer_handle);
181 Static void		ehci_root_ctrl_close(usbd_pipe_handle);
182 Static void		ehci_root_ctrl_done(usbd_xfer_handle);
183 
184 Static usbd_status	ehci_root_intr_transfer(usbd_xfer_handle);
185 Static usbd_status	ehci_root_intr_start(usbd_xfer_handle);
186 Static void		ehci_root_intr_abort(usbd_xfer_handle);
187 Static void		ehci_root_intr_close(usbd_pipe_handle);
188 Static void		ehci_root_intr_done(usbd_xfer_handle);
189 
190 Static usbd_status	ehci_device_ctrl_transfer(usbd_xfer_handle);
191 Static usbd_status	ehci_device_ctrl_start(usbd_xfer_handle);
192 Static void		ehci_device_ctrl_abort(usbd_xfer_handle);
193 Static void		ehci_device_ctrl_close(usbd_pipe_handle);
194 Static void		ehci_device_ctrl_done(usbd_xfer_handle);
195 
196 Static usbd_status	ehci_device_bulk_transfer(usbd_xfer_handle);
197 Static usbd_status	ehci_device_bulk_start(usbd_xfer_handle);
198 Static void		ehci_device_bulk_abort(usbd_xfer_handle);
199 Static void		ehci_device_bulk_close(usbd_pipe_handle);
200 Static void		ehci_device_bulk_done(usbd_xfer_handle);
201 
202 Static usbd_status	ehci_device_intr_transfer(usbd_xfer_handle);
203 Static usbd_status	ehci_device_intr_start(usbd_xfer_handle);
204 Static void		ehci_device_intr_abort(usbd_xfer_handle);
205 Static void		ehci_device_intr_close(usbd_pipe_handle);
206 Static void		ehci_device_intr_done(usbd_xfer_handle);
207 
208 Static usbd_status	ehci_device_isoc_transfer(usbd_xfer_handle);
209 Static usbd_status	ehci_device_isoc_start(usbd_xfer_handle);
210 Static void		ehci_device_isoc_abort(usbd_xfer_handle);
211 Static void		ehci_device_isoc_close(usbd_pipe_handle);
212 Static void		ehci_device_isoc_done(usbd_xfer_handle);
213 
214 Static void		ehci_device_clear_toggle(usbd_pipe_handle pipe);
215 Static void		ehci_noop(usbd_pipe_handle pipe);
216 
217 Static void		ehci_disown(ehci_softc_t *, int, int);
218 
219 Static ehci_soft_qh_t  *ehci_alloc_sqh(ehci_softc_t *);
220 Static void		ehci_free_sqh(ehci_softc_t *, ehci_soft_qh_t *);
221 
222 Static ehci_soft_qtd_t  *ehci_alloc_sqtd(ehci_softc_t *);
223 Static void		ehci_free_sqtd(ehci_softc_t *, ehci_soft_qtd_t *);
224 Static usbd_status	ehci_alloc_sqtd_chain(struct ehci_pipe *,
225 			    ehci_softc_t *, int, int, usbd_xfer_handle,
226 			    ehci_soft_qtd_t **, ehci_soft_qtd_t **);
227 Static void		ehci_free_sqtd_chain(ehci_softc_t *, ehci_soft_qtd_t *,
228 					    ehci_soft_qtd_t *);
229 
230 Static ehci_soft_itd_t	*ehci_alloc_itd(ehci_softc_t *sc);
231 Static void		ehci_free_itd(ehci_softc_t *sc, ehci_soft_itd_t *itd);
232 Static void 		ehci_rem_free_itd_chain(ehci_softc_t *sc,
233 						struct ehci_xfer *exfer);
234 Static void 		ehci_abort_isoc_xfer(usbd_xfer_handle xfer,
235 						usbd_status status);
236 
237 Static usbd_status	ehci_device_request(usbd_xfer_handle xfer);
238 
239 Static usbd_status	ehci_device_setintr(ehci_softc_t *, ehci_soft_qh_t *,
240 			    int ival);
241 
242 Static void		ehci_add_qh(ehci_softc_t *, ehci_soft_qh_t *,
243 				    ehci_soft_qh_t *);
244 Static void		ehci_rem_qh(ehci_softc_t *, ehci_soft_qh_t *,
245 				    ehci_soft_qh_t *);
246 Static void		ehci_set_qh_qtd(ehci_soft_qh_t *, ehci_soft_qtd_t *);
247 Static void		ehci_sync_hc(ehci_softc_t *);
248 
249 Static void		ehci_close_pipe(usbd_pipe_handle, ehci_soft_qh_t *);
250 Static void		ehci_abort_xfer(usbd_xfer_handle, usbd_status);
251 
252 #ifdef EHCI_DEBUG
253 Static ehci_softc_t 	*theehci;
254 void			ehci_dump(void);
255 #endif
256 
257 #ifdef EHCI_DEBUG
258 Static void		ehci_dump_regs(ehci_softc_t *);
259 Static void		ehci_dump_sqtds(ehci_soft_qtd_t *);
260 Static void		ehci_dump_sqtd(ehci_soft_qtd_t *);
261 Static void		ehci_dump_qtd(ehci_qtd_t *);
262 Static void		ehci_dump_sqh(ehci_soft_qh_t *);
263 Static void		ehci_dump_sitd(struct ehci_soft_itd *itd);
264 Static void		ehci_dump_itd(struct ehci_soft_itd *);
265 Static void		ehci_dump_exfer(struct ehci_xfer *);
266 #endif
267 
268 #define EHCI_NULL htole32(EHCI_LINK_TERMINATE)
269 
270 #define EHCI_INTR_ENDPT 1
271 
272 #define ehci_add_intr_list(sc, ex) \
273 	TAILQ_INSERT_TAIL(&(sc)->sc_intrhead, (ex), inext);
274 #define ehci_del_intr_list(sc, ex) \
275 	do { \
276 		TAILQ_REMOVE(&sc->sc_intrhead, (ex), inext); \
277 		(ex)->inext.tqe_prev = NULL; \
278 	} while (0)
279 #define ehci_active_intr_list(ex) ((ex)->inext.tqe_prev != NULL)
280 
281 Static const struct usbd_bus_methods ehci_bus_methods = {
282 	.open_pipe =	ehci_open,
283 	.soft_intr =	ehci_softintr,
284 	.do_poll =	ehci_poll,
285 	.allocm =	ehci_allocm,
286 	.freem =	ehci_freem,
287 	.allocx =	ehci_allocx,
288 	.freex =	ehci_freex,
289 	.get_lock =	ehci_get_lock,
290 	.new_device =	NULL,
291 };
292 
293 Static const struct usbd_pipe_methods ehci_root_ctrl_methods = {
294 	.transfer =	ehci_root_ctrl_transfer,
295 	.start =	ehci_root_ctrl_start,
296 	.abort =	ehci_root_ctrl_abort,
297 	.close =	ehci_root_ctrl_close,
298 	.cleartoggle =	ehci_noop,
299 	.done =		ehci_root_ctrl_done,
300 };
301 
302 Static const struct usbd_pipe_methods ehci_root_intr_methods = {
303 	.transfer =	ehci_root_intr_transfer,
304 	.start =	ehci_root_intr_start,
305 	.abort =	ehci_root_intr_abort,
306 	.close =	ehci_root_intr_close,
307 	.cleartoggle =	ehci_noop,
308 	.done =		ehci_root_intr_done,
309 };
310 
311 Static const struct usbd_pipe_methods ehci_device_ctrl_methods = {
312 	.transfer =	ehci_device_ctrl_transfer,
313 	.start =	ehci_device_ctrl_start,
314 	.abort =	ehci_device_ctrl_abort,
315 	.close =	ehci_device_ctrl_close,
316 	.cleartoggle =	ehci_noop,
317 	.done =		ehci_device_ctrl_done,
318 };
319 
320 Static const struct usbd_pipe_methods ehci_device_intr_methods = {
321 	.transfer =	ehci_device_intr_transfer,
322 	.start =	ehci_device_intr_start,
323 	.abort =	ehci_device_intr_abort,
324 	.close =	ehci_device_intr_close,
325 	.cleartoggle =	ehci_device_clear_toggle,
326 	.done =		ehci_device_intr_done,
327 };
328 
329 Static const struct usbd_pipe_methods ehci_device_bulk_methods = {
330 	.transfer =	ehci_device_bulk_transfer,
331 	.start =	ehci_device_bulk_start,
332 	.abort =	ehci_device_bulk_abort,
333 	.close =	ehci_device_bulk_close,
334 	.cleartoggle =	ehci_device_clear_toggle,
335 	.done =		ehci_device_bulk_done,
336 };
337 
338 Static const struct usbd_pipe_methods ehci_device_isoc_methods = {
339 	.transfer =	ehci_device_isoc_transfer,
340 	.start =	ehci_device_isoc_start,
341 	.abort =	ehci_device_isoc_abort,
342 	.close =	ehci_device_isoc_close,
343 	.cleartoggle =	ehci_noop,
344 	.done =		ehci_device_isoc_done,
345 };
346 
347 static const uint8_t revbits[EHCI_MAX_POLLRATE] = {
348 0x00,0x40,0x20,0x60,0x10,0x50,0x30,0x70,0x08,0x48,0x28,0x68,0x18,0x58,0x38,0x78,
349 0x04,0x44,0x24,0x64,0x14,0x54,0x34,0x74,0x0c,0x4c,0x2c,0x6c,0x1c,0x5c,0x3c,0x7c,
350 0x02,0x42,0x22,0x62,0x12,0x52,0x32,0x72,0x0a,0x4a,0x2a,0x6a,0x1a,0x5a,0x3a,0x7a,
351 0x06,0x46,0x26,0x66,0x16,0x56,0x36,0x76,0x0e,0x4e,0x2e,0x6e,0x1e,0x5e,0x3e,0x7e,
352 0x01,0x41,0x21,0x61,0x11,0x51,0x31,0x71,0x09,0x49,0x29,0x69,0x19,0x59,0x39,0x79,
353 0x05,0x45,0x25,0x65,0x15,0x55,0x35,0x75,0x0d,0x4d,0x2d,0x6d,0x1d,0x5d,0x3d,0x7d,
354 0x03,0x43,0x23,0x63,0x13,0x53,0x33,0x73,0x0b,0x4b,0x2b,0x6b,0x1b,0x5b,0x3b,0x7b,
355 0x07,0x47,0x27,0x67,0x17,0x57,0x37,0x77,0x0f,0x4f,0x2f,0x6f,0x1f,0x5f,0x3f,0x7f,
356 };
357 
358 usbd_status
359 ehci_init(ehci_softc_t *sc)
360 {
361 	u_int32_t vers, sparams, cparams, hcr;
362 	u_int i;
363 	usbd_status err;
364 	ehci_soft_qh_t *sqh;
365 	u_int ncomp;
366 
367 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
368 #ifdef EHCI_DEBUG
369 	theehci = sc;
370 #endif
371 
372 	mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_SOFTUSB);
373 	mutex_init(&sc->sc_intr_lock, MUTEX_DEFAULT, IPL_SCHED);
374 	cv_init(&sc->sc_softwake_cv, "ehciab");
375 	cv_init(&sc->sc_doorbell, "ehcidi");
376 
377 	sc->sc_xferpool = pool_cache_init(sizeof(struct ehci_xfer), 0, 0, 0,
378 	    "ehcixfer", NULL, IPL_USB, NULL, NULL, NULL);
379 
380 	sc->sc_doorbell_si = softint_establish(SOFTINT_NET | SOFTINT_MPSAFE,
381 	    ehci_doorbell, sc);
382 	KASSERT(sc->sc_doorbell_si != NULL);
383 	sc->sc_pcd_si = softint_establish(SOFTINT_NET | SOFTINT_MPSAFE,
384 	    ehci_pcd, sc);
385 	KASSERT(sc->sc_pcd_si != NULL);
386 
387 	sc->sc_offs = EREAD1(sc, EHCI_CAPLENGTH);
388 
389 	vers = EREAD2(sc, EHCI_HCIVERSION);
390 	aprint_verbose("%s: EHCI version %x.%x\n", device_xname(sc->sc_dev),
391 	       vers >> 8, vers & 0xff);
392 
393 	sparams = EREAD4(sc, EHCI_HCSPARAMS);
394 	USBHIST_LOG(ehcidebug, "sparams=%#x", sparams, 0, 0, 0);
395 	sc->sc_npcomp = EHCI_HCS_N_PCC(sparams);
396 	ncomp = EHCI_HCS_N_CC(sparams);
397 	if (ncomp != sc->sc_ncomp) {
398 		aprint_verbose("%s: wrong number of companions (%d != %d)\n",
399 			       device_xname(sc->sc_dev), ncomp, sc->sc_ncomp);
400 #if NOHCI == 0 || NUHCI == 0
401 		aprint_error("%s: ohci or uhci probably not configured\n",
402 			     device_xname(sc->sc_dev));
403 #endif
404 		if (ncomp < sc->sc_ncomp)
405 			sc->sc_ncomp = ncomp;
406 	}
407 	if (sc->sc_ncomp > 0) {
408 		KASSERT(!(sc->sc_flags & EHCIF_ETTF));
409 		aprint_normal("%s: companion controller%s, %d port%s each:",
410 		    device_xname(sc->sc_dev), sc->sc_ncomp!=1 ? "s" : "",
411 		    EHCI_HCS_N_PCC(sparams),
412 		    EHCI_HCS_N_PCC(sparams)!=1 ? "s" : "");
413 		for (i = 0; i < sc->sc_ncomp; i++)
414 			aprint_normal(" %s", device_xname(sc->sc_comps[i]));
415 		aprint_normal("\n");
416 	}
417 	sc->sc_noport = EHCI_HCS_N_PORTS(sparams);
418 	cparams = EREAD4(sc, EHCI_HCCPARAMS);
419 	USBHIST_LOG(ehcidebug, "cparams=%#x", cparams, 0, 0, 0);
420 	sc->sc_hasppc = EHCI_HCS_PPC(sparams);
421 
422 	if (EHCI_HCC_64BIT(cparams)) {
423 		/* MUST clear segment register if 64 bit capable. */
424 		EOWRITE4(sc, EHCI_CTRLDSSEGMENT, 0);
425 	}
426 
427 	sc->sc_bus.usbrev = USBREV_2_0;
428 
429 	usb_setup_reserve(sc->sc_dev, &sc->sc_dma_reserve, sc->sc_bus.dmatag,
430 	    USB_MEM_RESERVE);
431 
432 	/* Reset the controller */
433 	USBHIST_LOG(ehcidebug, "resetting", 0, 0, 0, 0);
434 	EOWRITE4(sc, EHCI_USBCMD, 0);	/* Halt controller */
435 	usb_delay_ms(&sc->sc_bus, 1);
436 	EOWRITE4(sc, EHCI_USBCMD, EHCI_CMD_HCRESET);
437 	for (i = 0; i < 100; i++) {
438 		usb_delay_ms(&sc->sc_bus, 1);
439 		hcr = EOREAD4(sc, EHCI_USBCMD) & EHCI_CMD_HCRESET;
440 		if (!hcr)
441 			break;
442 	}
443 	if (hcr) {
444 		aprint_error("%s: reset timeout\n", device_xname(sc->sc_dev));
445 		return (USBD_IOERROR);
446 	}
447 	if (sc->sc_vendor_init)
448 		sc->sc_vendor_init(sc);
449 
450 	/*
451 	 * If we are doing embedded transaction translation function, force
452 	 * the controller to host mode.
453 	 */
454 	if (sc->sc_flags & EHCIF_ETTF) {
455 		uint32_t usbmode = EOREAD4(sc, EHCI_USBMODE);
456 		usbmode &= ~EHCI_USBMODE_CM;
457 		usbmode |= EHCI_USBMODE_CM_HOST;
458 		EOWRITE4(sc, EHCI_USBMODE, usbmode);
459 	}
460 
461 	/* XXX need proper intr scheduling */
462 	sc->sc_rand = 96;
463 
464 	/* frame list size at default, read back what we got and use that */
465 	switch (EHCI_CMD_FLS(EOREAD4(sc, EHCI_USBCMD))) {
466 	case 0: sc->sc_flsize = 1024; break;
467 	case 1: sc->sc_flsize = 512; break;
468 	case 2: sc->sc_flsize = 256; break;
469 	case 3: return (USBD_IOERROR);
470 	}
471 	err = usb_allocmem(&sc->sc_bus, sc->sc_flsize * sizeof(ehci_link_t),
472 	    EHCI_FLALIGN_ALIGN, &sc->sc_fldma);
473 	if (err)
474 		return (err);
475 	USBHIST_LOG(ehcidebug, "flsize=%d", sc->sc_flsize, 0, 0, 0);
476 	sc->sc_flist = KERNADDR(&sc->sc_fldma, 0);
477 
478 	for (i = 0; i < sc->sc_flsize; i++) {
479 		sc->sc_flist[i] = EHCI_NULL;
480 	}
481 
482 	EOWRITE4(sc, EHCI_PERIODICLISTBASE, DMAADDR(&sc->sc_fldma, 0));
483 
484 	sc->sc_softitds = kmem_zalloc(sc->sc_flsize * sizeof(ehci_soft_itd_t *),
485 				     KM_SLEEP);
486 	if (sc->sc_softitds == NULL)
487 		return ENOMEM;
488 	LIST_INIT(&sc->sc_freeitds);
489 	TAILQ_INIT(&sc->sc_intrhead);
490 
491 	/* Set up the bus struct. */
492 	sc->sc_bus.methods = &ehci_bus_methods;
493 	sc->sc_bus.pipe_size = sizeof(struct ehci_pipe);
494 
495 	sc->sc_eintrs = EHCI_NORMAL_INTRS;
496 
497 	/*
498 	 * Allocate the interrupt dummy QHs. These are arranged to give poll
499 	 * intervals that are powers of 2 times 1ms.
500 	 */
501 	for (i = 0; i < EHCI_INTRQHS; i++) {
502 		sqh = ehci_alloc_sqh(sc);
503 		if (sqh == NULL) {
504 			err = USBD_NOMEM;
505 			goto bad1;
506 		}
507 		sc->sc_islots[i].sqh = sqh;
508 	}
509 	for (i = 0; i < EHCI_INTRQHS; i++) {
510 		sqh = sc->sc_islots[i].sqh;
511 		if (i == 0) {
512 			/* The last (1ms) QH terminates. */
513 			sqh->qh.qh_link = EHCI_NULL;
514 			sqh->next = NULL;
515 		} else {
516 			/* Otherwise the next QH has half the poll interval */
517 			sqh->next = sc->sc_islots[(i + 1) / 2 - 1].sqh;
518 			sqh->qh.qh_link = htole32(sqh->next->physaddr |
519 			    EHCI_LINK_QH);
520 		}
521 		sqh->qh.qh_endp = htole32(EHCI_QH_SET_EPS(EHCI_QH_SPEED_HIGH));
522 		sqh->qh.qh_endphub = htole32(EHCI_QH_SET_MULT(1));
523 		sqh->qh.qh_curqtd = EHCI_NULL;
524 		sqh->qh.qh_qtd.qtd_next = EHCI_NULL;
525 		sqh->qh.qh_qtd.qtd_altnext = EHCI_NULL;
526 		sqh->qh.qh_qtd.qtd_status = htole32(EHCI_QTD_HALTED);
527 		sqh->sqtd = NULL;
528 		usb_syncmem(&sqh->dma, sqh->offs, sizeof(sqh->qh),
529 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
530 	}
531 	/* Point the frame list at the last level (128ms). */
532 	for (i = 0; i < sc->sc_flsize; i++) {
533 		int j;
534 
535 		j = (i & ~(EHCI_MAX_POLLRATE-1)) |
536 		    revbits[i & (EHCI_MAX_POLLRATE-1)];
537 		sc->sc_flist[j] = htole32(EHCI_LINK_QH |
538 		    sc->sc_islots[EHCI_IQHIDX(EHCI_IPOLLRATES - 1,
539 		    i)].sqh->physaddr);
540 	}
541 	usb_syncmem(&sc->sc_fldma, 0, sc->sc_flsize * sizeof(ehci_link_t),
542 	    BUS_DMASYNC_PREWRITE);
543 
544 	/* Allocate dummy QH that starts the async list. */
545 	sqh = ehci_alloc_sqh(sc);
546 	if (sqh == NULL) {
547 		err = USBD_NOMEM;
548 		goto bad1;
549 	}
550 	/* Fill the QH */
551 	sqh->qh.qh_endp =
552 	    htole32(EHCI_QH_SET_EPS(EHCI_QH_SPEED_HIGH) | EHCI_QH_HRECL);
553 	sqh->qh.qh_link =
554 	    htole32(sqh->physaddr | EHCI_LINK_QH);
555 	sqh->qh.qh_curqtd = EHCI_NULL;
556 	sqh->next = NULL;
557 	/* Fill the overlay qTD */
558 	sqh->qh.qh_qtd.qtd_next = EHCI_NULL;
559 	sqh->qh.qh_qtd.qtd_altnext = EHCI_NULL;
560 	sqh->qh.qh_qtd.qtd_status = htole32(EHCI_QTD_HALTED);
561 	sqh->sqtd = NULL;
562 	usb_syncmem(&sqh->dma, sqh->offs, sizeof(sqh->qh),
563 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
564 #ifdef EHCI_DEBUG
565 	USBHIST_LOGN(ehcidebug, 5, "--- dump start ---", 0, 0, 0, 0);
566 	ehci_dump_sqh(sqh);
567 	USBHIST_LOGN(ehcidebug, 5, "--- dump end ---", 0, 0, 0, 0);
568 #endif
569 
570 	/* Point to async list */
571 	sc->sc_async_head = sqh;
572 	EOWRITE4(sc, EHCI_ASYNCLISTADDR, sqh->physaddr | EHCI_LINK_QH);
573 
574 	callout_init(&sc->sc_tmo_intrlist, CALLOUT_MPSAFE);
575 
576 	/* Turn on controller */
577 	EOWRITE4(sc, EHCI_USBCMD,
578 		 EHCI_CMD_ITC_2 | /* 2 microframes interrupt delay */
579 		 (EOREAD4(sc, EHCI_USBCMD) & EHCI_CMD_FLS_M) |
580 		 EHCI_CMD_ASE |
581 		 EHCI_CMD_PSE |
582 		 EHCI_CMD_RS);
583 
584 	/* Take over port ownership */
585 	EOWRITE4(sc, EHCI_CONFIGFLAG, EHCI_CONF_CF);
586 
587 	for (i = 0; i < 100; i++) {
588 		usb_delay_ms(&sc->sc_bus, 1);
589 		hcr = EOREAD4(sc, EHCI_USBSTS) & EHCI_STS_HCH;
590 		if (!hcr)
591 			break;
592 	}
593 	if (hcr) {
594 		aprint_error("%s: run timeout\n", device_xname(sc->sc_dev));
595 		return (USBD_IOERROR);
596 	}
597 
598 	/* Enable interrupts */
599 	USBHIST_LOG(ehcidebug, "enabling interupts", 0, 0, 0, 0);
600 	EOWRITE4(sc, EHCI_USBINTR, sc->sc_eintrs);
601 
602 	return (USBD_NORMAL_COMPLETION);
603 
604 #if 0
605  bad2:
606 	ehci_free_sqh(sc, sc->sc_async_head);
607 #endif
608  bad1:
609 	usb_freemem(&sc->sc_bus, &sc->sc_fldma);
610 	return (err);
611 }
612 
613 int
614 ehci_intr(void *v)
615 {
616 	ehci_softc_t *sc = v;
617 	int ret = 0;
618 
619 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
620 
621 	if (sc == NULL)
622 		return 0;
623 
624 	mutex_spin_enter(&sc->sc_intr_lock);
625 
626 	if (sc->sc_dying || !device_has_power(sc->sc_dev))
627 		goto done;
628 
629 	/* If we get an interrupt while polling, then just ignore it. */
630 	if (sc->sc_bus.use_polling) {
631 		u_int32_t intrs = EHCI_STS_INTRS(EOREAD4(sc, EHCI_USBSTS));
632 
633 		if (intrs)
634 			EOWRITE4(sc, EHCI_USBSTS, intrs); /* Acknowledge */
635 #ifdef DIAGNOSTIC
636 		USBHIST_LOGN(ehcidebug, 16,
637 		    "ignored interrupt while polling", 0, 0, 0, 0);
638 #endif
639 		goto done;
640 	}
641 
642 	ret = ehci_intr1(sc);
643 
644 done:
645 	mutex_spin_exit(&sc->sc_intr_lock);
646 	return ret;
647 }
648 
649 Static int
650 ehci_intr1(ehci_softc_t *sc)
651 {
652 	u_int32_t intrs, eintrs;
653 
654 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
655 
656 	/* In case the interrupt occurs before initialization has completed. */
657 	if (sc == NULL) {
658 #ifdef DIAGNOSTIC
659 		printf("ehci_intr1: sc == NULL\n");
660 #endif
661 		return (0);
662 	}
663 
664 	KASSERT(mutex_owned(&sc->sc_intr_lock));
665 
666 	intrs = EHCI_STS_INTRS(EOREAD4(sc, EHCI_USBSTS));
667 	if (!intrs)
668 		return (0);
669 
670 	eintrs = intrs & sc->sc_eintrs;
671 	USBHIST_LOG(ehcidebug, "sc=%p intrs=%#x(%#x) eintrs=%#x",
672 	    sc, intrs, EOREAD4(sc, EHCI_USBSTS), eintrs);
673 	if (!eintrs)
674 		return (0);
675 
676 	EOWRITE4(sc, EHCI_USBSTS, intrs); /* Acknowledge */
677 	sc->sc_bus.no_intrs++;
678 	if (eintrs & EHCI_STS_IAA) {
679 		USBHIST_LOG(ehcidebug, "door bell", 0, 0, 0, 0);
680 		kpreempt_disable();
681 		KASSERT(sc->sc_doorbell_si != NULL);
682 		softint_schedule(sc->sc_doorbell_si);
683 		kpreempt_enable();
684 		eintrs &= ~EHCI_STS_IAA;
685 	}
686 	if (eintrs & (EHCI_STS_INT | EHCI_STS_ERRINT)) {
687 		USBHIST_LOG(ehcidebug, "INT=%d  ERRINT=%d",
688 		    eintrs & EHCI_STS_INT ? 1 : 0,
689 		    eintrs & EHCI_STS_ERRINT ? 1 : 0, 0, 0);
690 		usb_schedsoftintr(&sc->sc_bus);
691 		eintrs &= ~(EHCI_STS_INT | EHCI_STS_ERRINT);
692 	}
693 	if (eintrs & EHCI_STS_HSE) {
694 		printf("%s: unrecoverable error, controller halted\n",
695 		       device_xname(sc->sc_dev));
696 		/* XXX what else */
697 	}
698 	if (eintrs & EHCI_STS_PCD) {
699 		kpreempt_disable();
700 		KASSERT(sc->sc_pcd_si != NULL);
701 		softint_schedule(sc->sc_pcd_si);
702 		kpreempt_enable();
703 		eintrs &= ~EHCI_STS_PCD;
704 	}
705 
706 	if (eintrs != 0) {
707 		/* Block unprocessed interrupts. */
708 		sc->sc_eintrs &= ~eintrs;
709 		EOWRITE4(sc, EHCI_USBINTR, sc->sc_eintrs);
710 		printf("%s: blocking intrs 0x%x\n",
711 		       device_xname(sc->sc_dev), eintrs);
712 	}
713 
714 	return (1);
715 }
716 
717 Static void
718 ehci_doorbell(void *addr)
719 {
720 	ehci_softc_t *sc = addr;
721 
722 	mutex_enter(&sc->sc_lock);
723 	cv_broadcast(&sc->sc_doorbell);
724 	mutex_exit(&sc->sc_lock);
725 }
726 
727 Static void
728 ehci_pcd(void *addr)
729 {
730 	ehci_softc_t *sc = addr;
731 	usbd_xfer_handle xfer;
732 	u_char *p;
733 	int i, m;
734 
735 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
736 
737 	mutex_enter(&sc->sc_lock);
738 	xfer = sc->sc_intrxfer;
739 
740 	if (xfer == NULL) {
741 		/* Just ignore the change. */
742 		goto done;
743 	}
744 
745 	p = KERNADDR(&xfer->dmabuf, 0);
746 	m = min(sc->sc_noport, xfer->length * 8 - 1);
747 	memset(p, 0, xfer->length);
748 	for (i = 1; i <= m; i++) {
749 		/* Pick out CHANGE bits from the status reg. */
750 		if (EOREAD4(sc, EHCI_PORTSC(i)) & EHCI_PS_CLEAR)
751 			p[i/8] |= 1 << (i%8);
752 		if (i % 8 == 7)
753 			USBHIST_LOG(ehcidebug, "change(%d)=0x%02x", i / 8,
754 			    p[i/8], 0, 0);
755 	}
756 	xfer->actlen = xfer->length;
757 	xfer->status = USBD_NORMAL_COMPLETION;
758 
759 	usb_transfer_complete(xfer);
760 
761 done:
762 	mutex_exit(&sc->sc_lock);
763 }
764 
765 Static void
766 ehci_softintr(void *v)
767 {
768 	struct usbd_bus *bus = v;
769 	ehci_softc_t *sc = bus->hci_private;
770 	struct ehci_xfer *ex, *nextex;
771 
772 	KASSERT(sc->sc_bus.use_polling || mutex_owned(&sc->sc_lock));
773 
774 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
775 
776 	/*
777 	 * The only explanation I can think of for why EHCI is as brain dead
778 	 * as UHCI interrupt-wise is that Intel was involved in both.
779 	 * An interrupt just tells us that something is done, we have no
780 	 * clue what, so we need to scan through all active transfers. :-(
781 	 */
782 	for (ex = TAILQ_FIRST(&sc->sc_intrhead); ex; ex = nextex) {
783 		nextex = TAILQ_NEXT(ex, inext);
784 		ehci_check_intr(sc, ex);
785 	}
786 
787 	/* Schedule a callout to catch any dropped transactions. */
788 	if ((sc->sc_flags & EHCIF_DROPPED_INTR_WORKAROUND) &&
789 	    !TAILQ_EMPTY(&sc->sc_intrhead))
790 		callout_reset(&sc->sc_tmo_intrlist,
791 		    hz, ehci_intrlist_timeout, sc);
792 
793 	if (sc->sc_softwake) {
794 		sc->sc_softwake = 0;
795 		cv_broadcast(&sc->sc_softwake_cv);
796 	}
797 }
798 
799 /* Check for an interrupt. */
800 Static void
801 ehci_check_intr(ehci_softc_t *sc, struct ehci_xfer *ex)
802 {
803 	int attr;
804 
805 	USBHIST_FUNC();	USBHIST_CALLED(ehcidebug);
806 	USBHIST_LOG(ehcidebug, "ex = %p", ex, 0, 0, 0);
807 
808 	KASSERT(sc->sc_bus.use_polling || mutex_owned(&sc->sc_lock));
809 
810 	attr = ex->xfer.pipe->endpoint->edesc->bmAttributes;
811 	if (UE_GET_XFERTYPE(attr) == UE_ISOCHRONOUS)
812 		ehci_check_itd_intr(sc, ex);
813 	else
814 		ehci_check_qh_intr(sc, ex);
815 
816 	return;
817 }
818 
819 Static void
820 ehci_check_qh_intr(ehci_softc_t *sc, struct ehci_xfer *ex)
821 {
822 	ehci_soft_qtd_t *sqtd, *lsqtd;
823 	__uint32_t status;
824 
825 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
826 
827 	KASSERT(sc->sc_bus.use_polling || mutex_owned(&sc->sc_lock));
828 
829 	if (ex->sqtdstart == NULL) {
830 		printf("ehci_check_qh_intr: not valid sqtd\n");
831 		return;
832 	}
833 
834 	lsqtd = ex->sqtdend;
835 #ifdef DIAGNOSTIC
836 	if (lsqtd == NULL) {
837 		printf("ehci_check_qh_intr: lsqtd==0\n");
838 		return;
839 	}
840 #endif
841 	/*
842 	 * If the last TD is still active we need to check whether there
843 	 * is an error somewhere in the middle, or whether there was a
844 	 * short packet (SPD and not ACTIVE).
845 	 */
846 	usb_syncmem(&lsqtd->dma,
847 	    lsqtd->offs + offsetof(ehci_qtd_t, qtd_status),
848 	    sizeof(lsqtd->qtd.qtd_status),
849 	    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
850 	status = le32toh(lsqtd->qtd.qtd_status);
851 	usb_syncmem(&lsqtd->dma,
852 	    lsqtd->offs + offsetof(ehci_qtd_t, qtd_status),
853 	    sizeof(lsqtd->qtd.qtd_status), BUS_DMASYNC_PREREAD);
854 	if (status & EHCI_QTD_ACTIVE) {
855 		USBHIST_LOGN(ehcidebug, 10, "active ex=%p", ex, 0, 0, 0);
856 		for (sqtd = ex->sqtdstart; sqtd != lsqtd; sqtd=sqtd->nextqtd) {
857 			usb_syncmem(&sqtd->dma,
858 			    sqtd->offs + offsetof(ehci_qtd_t, qtd_status),
859 			    sizeof(sqtd->qtd.qtd_status),
860 			    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
861 			status = le32toh(sqtd->qtd.qtd_status);
862 			usb_syncmem(&sqtd->dma,
863 			    sqtd->offs + offsetof(ehci_qtd_t, qtd_status),
864 			    sizeof(sqtd->qtd.qtd_status), BUS_DMASYNC_PREREAD);
865 			/* If there's an active QTD the xfer isn't done. */
866 			if (status & EHCI_QTD_ACTIVE)
867 				break;
868 			/* Any kind of error makes the xfer done. */
869 			if (status & EHCI_QTD_HALTED)
870 				goto done;
871 			/* Handle short packets */
872 			if (EHCI_QTD_GET_BYTES(status) != 0) {
873 				usbd_pipe_handle pipe = ex->xfer.pipe;
874 				usb_endpoint_descriptor_t *ed =
875 				    pipe->endpoint->edesc;
876 				uint8_t xt = UE_GET_XFERTYPE(ed->bmAttributes);
877 
878 				/*
879 				 * If we get here for a control transfer then
880 				 * we need to let the hardware complete the
881 				 * status phase.  That is, we're not done
882 				 * quite yet.
883 				 *
884 				 * Otherwise, we're done.
885 				 */
886 				if (xt == UE_CONTROL) {
887 					break;
888 				}
889 				goto done;
890 			}
891 		}
892 		USBHIST_LOGN(ehcidebug, 10, "ex=%p std=%p still active",
893 		    ex, ex->sqtdstart, 0, 0);
894 #ifdef EHCI_DEBUG
895 		USBHIST_LOGN(ehcidebug, 5, "--- still active start ---", 0, 0, 0, 0);
896 		ehci_dump_sqtds(ex->sqtdstart);
897 		USBHIST_LOGN(ehcidebug, 5, "--- still active end ---", 0, 0, 0, 0);
898 #endif
899 
900 		return;
901 	}
902  done:
903 	USBHIST_LOGN(ehcidebug, 10, "ex=%p done", ex, 0, 0, 0);
904 	callout_stop(&ex->xfer.timeout_handle);
905 	ehci_idone(ex);
906 }
907 
908 Static void
909 ehci_check_itd_intr(ehci_softc_t *sc, struct ehci_xfer *ex)
910 {
911 	ehci_soft_itd_t *itd;
912 	int i;
913 
914 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
915 
916 	KASSERT(mutex_owned(&sc->sc_lock));
917 
918 	if (&ex->xfer != SIMPLEQ_FIRST(&ex->xfer.pipe->queue))
919 		return;
920 
921 	if (ex->itdstart == NULL) {
922 		printf("ehci_check_itd_intr: not valid itd\n");
923 		return;
924 	}
925 
926 	itd = ex->itdend;
927 #ifdef DIAGNOSTIC
928 	if (itd == NULL) {
929 		printf("ehci_check_itd_intr: itdend == 0\n");
930 		return;
931 	}
932 #endif
933 
934 	/*
935 	 * check no active transfers in last itd, meaning we're finished
936 	 */
937 
938 	usb_syncmem(&itd->dma, itd->offs + offsetof(ehci_itd_t, itd_ctl),
939 		    sizeof(itd->itd.itd_ctl), BUS_DMASYNC_POSTWRITE |
940 		    BUS_DMASYNC_POSTREAD);
941 
942 	for (i = 0; i < EHCI_ITD_NUFRAMES; i++) {
943 		if (le32toh(itd->itd.itd_ctl[i]) & EHCI_ITD_ACTIVE)
944 			break;
945 	}
946 
947 	if (i == EHCI_ITD_NUFRAMES) {
948 		goto done; /* All 8 descriptors inactive, it's done */
949 	}
950 
951 	USBHIST_LOGN(ehcidebug, 10, "ex %p itd %p still active", ex,
952 	    ex->itdstart, 0, 0);
953 	return;
954 done:
955 	USBHIST_LOG(ehcidebug, "ex %p done", ex, 0, 0, 0);
956 	callout_stop(&ex->xfer.timeout_handle);
957 	ehci_idone(ex);
958 }
959 
960 Static void
961 ehci_idone(struct ehci_xfer *ex)
962 {
963 	usbd_xfer_handle xfer = &ex->xfer;
964 	struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
965 	struct ehci_softc *sc = xfer->pipe->device->bus->hci_private;
966 	ehci_soft_qtd_t *sqtd, *lsqtd;
967 	u_int32_t status = 0, nstatus = 0;
968 	int actlen;
969 
970 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
971 
972 	KASSERT(sc->sc_bus.use_polling || mutex_owned(&sc->sc_lock));
973 
974 	USBHIST_LOG(ehcidebug, "ex=%p", ex, 0, 0, 0);
975 
976 #ifdef DIAGNOSTIC
977 	if (ex->isdone) {
978 		printf("ehci_idone: ex=%p is done!\n", ex);
979 #ifdef EHCI_DEBUG
980 		ehci_dump_exfer(ex);
981 #endif
982 		return;
983 	}
984 	ex->isdone = 1;
985 #endif
986 
987 	if (xfer->status == USBD_CANCELLED ||
988 	    xfer->status == USBD_TIMEOUT) {
989 		USBHIST_LOG(ehcidebug, "aborted xfer=%p", xfer, 0, 0, 0);
990 		return;
991 	}
992 
993 	USBHIST_LOG(ehcidebug, "xfer=%p, pipe=%p ready", xfer, epipe, 0, 0);
994 #ifdef EHCI_DEBUG
995 	ehci_dump_sqtds(ex->sqtdstart);
996 #endif
997 
998 	/* The transfer is done, compute actual length and status. */
999 
1000 	if (UE_GET_XFERTYPE(xfer->pipe->endpoint->edesc->bmAttributes)
1001 				== UE_ISOCHRONOUS) {
1002 		/* Isoc transfer */
1003 		struct ehci_soft_itd *itd;
1004 		int i, nframes, len, uframes;
1005 
1006 		nframes = 0;
1007 		actlen = 0;
1008 
1009 		i = xfer->pipe->endpoint->edesc->bInterval;
1010 		uframes = min(1 << (i - 1), USB_UFRAMES_PER_FRAME);
1011 
1012 		for (itd = ex->itdstart; itd != NULL; itd = itd->xfer_next) {
1013 			usb_syncmem(&itd->dma,itd->offs + offsetof(ehci_itd_t,itd_ctl),
1014 			    sizeof(itd->itd.itd_ctl), BUS_DMASYNC_POSTWRITE |
1015 			    BUS_DMASYNC_POSTREAD);
1016 
1017 			for (i = 0; i < EHCI_ITD_NUFRAMES; i += uframes) {
1018 				/* XXX - driver didn't fill in the frame full
1019 				 *   of uframes. This leads to scheduling
1020 				 *   inefficiencies, but working around
1021 				 *   this doubles complexity of tracking
1022 				 *   an xfer.
1023 				 */
1024 				if (nframes >= xfer->nframes)
1025 					break;
1026 
1027 				status = le32toh(itd->itd.itd_ctl[i]);
1028 				len = EHCI_ITD_GET_LEN(status);
1029 				if (EHCI_ITD_GET_STATUS(status) != 0)
1030 					len = 0; /*No valid data on error*/
1031 
1032 				xfer->frlengths[nframes++] = len;
1033 				actlen += len;
1034 			}
1035 
1036 			if (nframes >= xfer->nframes)
1037 				break;
1038 	    	}
1039 
1040 		xfer->actlen = actlen;
1041 		xfer->status = USBD_NORMAL_COMPLETION;
1042 		goto end;
1043 	}
1044 
1045 	/* Continue processing xfers using queue heads */
1046 
1047 	lsqtd = ex->sqtdend;
1048 	actlen = 0;
1049 	for (sqtd = ex->sqtdstart; sqtd != lsqtd->nextqtd;
1050 	     sqtd = sqtd->nextqtd) {
1051 		usb_syncmem(&sqtd->dma, sqtd->offs, sizeof(sqtd->qtd),
1052 		    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
1053 		nstatus = le32toh(sqtd->qtd.qtd_status);
1054 		if (nstatus & EHCI_QTD_ACTIVE)
1055 			break;
1056 
1057 		status = nstatus;
1058 		if (EHCI_QTD_GET_PID(status) != EHCI_QTD_PID_SETUP)
1059 			actlen += sqtd->len - EHCI_QTD_GET_BYTES(status);
1060 	}
1061 
1062 
1063 	/*
1064 	 * If there are left over TDs we need to update the toggle.
1065 	 * The default pipe doesn't need it since control transfers
1066 	 * start the toggle at 0 every time.
1067 	 * For a short transfer we need to update the toggle for the missing
1068 	 * packets within the qTD.
1069 	 */
1070 	if ((sqtd != lsqtd->nextqtd || EHCI_QTD_GET_BYTES(status)) &&
1071 	    xfer->pipe->device->default_pipe != xfer->pipe) {
1072 		USBHIST_LOG(ehcidebug,
1073 		    "toggle update status=0x%08x nstatus=0x%08x",
1074 		    status, nstatus, 0, 0);
1075 #if 0
1076 		ehci_dump_sqh(epipe->sqh);
1077 		ehci_dump_sqtds(ex->sqtdstart);
1078 #endif
1079 		epipe->nexttoggle = EHCI_QTD_GET_TOGGLE(nstatus);
1080 	}
1081 
1082 	USBHIST_LOG(ehcidebug, "len=%d actlen=%d status=0x%08x", xfer->length,
1083 	    actlen, status, 0);
1084 	xfer->actlen = actlen;
1085 	if (status & EHCI_QTD_HALTED) {
1086 #ifdef EHCI_DEBUG
1087 		USBHIST_LOG(ehcidebug, "halted addr=%d endpt=0x%02x",
1088 		    xfer->pipe->device->address,
1089 		    xfer->pipe->endpoint->edesc->bEndpointAddress, 0, 0);
1090 		USBHIST_LOG(ehcidebug, "cerr=%d pid=%d stat=%#x",
1091 		    EHCI_QTD_GET_CERR(status), EHCI_QTD_GET_PID(status),
1092 		    status, 0);
1093 		USBHIST_LOG(ehcidebug,
1094 		    "active =%d halted=%d buferr=%d babble=%d",
1095 		    status & EHCI_QTD_ACTIVE ? 1 : 0,
1096 		    status & EHCI_QTD_HALTED ? 1 : 0,
1097 		    status & EHCI_QTD_BUFERR ? 1 : 0,
1098 		    status & EHCI_QTD_BABBLE ? 1 : 0);
1099 
1100 		USBHIST_LOG(ehcidebug,
1101 		    "xacterr=%d missed=%d split =%d ping  =%d",
1102 		    status & EHCI_QTD_XACTERR ? 1 : 0,
1103 		    status & EHCI_QTD_MISSEDMICRO ? 1 : 0,
1104 		    status & EHCI_QTD_SPLITXSTATE ? 1 : 0,
1105 		    status & EHCI_QTD_PINGSTATE ? 1 : 0);
1106 
1107 		ehci_dump_sqh(epipe->sqh);
1108 		ehci_dump_sqtds(ex->sqtdstart);
1109 #endif
1110 		/* low&full speed has an extra error flag */
1111 		if (EHCI_QH_GET_EPS(epipe->sqh->qh.qh_endp) !=
1112 		    EHCI_QH_SPEED_HIGH)
1113 			status &= EHCI_QTD_STATERRS | EHCI_QTD_PINGSTATE;
1114 		else
1115 			status &= EHCI_QTD_STATERRS;
1116 		if (status == 0) /* no other errors means a stall */ {
1117 			xfer->status = USBD_STALLED;
1118 		} else {
1119 			xfer->status = USBD_IOERROR; /* more info XXX */
1120 		}
1121 		/* XXX need to reset TT on missed microframe */
1122 		if (status & EHCI_QTD_MISSEDMICRO) {
1123 			printf("%s: missed microframe, TT reset not "
1124 			    "implemented, hub might be inoperational\n",
1125 			    device_xname(sc->sc_dev));
1126 		}
1127 	} else {
1128 		xfer->status = USBD_NORMAL_COMPLETION;
1129 	}
1130 
1131     end:
1132 	/* XXX transfer_complete memcpys out transfer data (for in endpoints)
1133 	 * during this call, before methods->done is called: dma sync required
1134 	 * beforehand? */
1135 	usb_transfer_complete(xfer);
1136 	USBHIST_LOG(ehcidebug, "ex=%p done", ex, 0, 0, 0);
1137 }
1138 
1139 /*
1140  * Wait here until controller claims to have an interrupt.
1141  * Then call ehci_intr and return.  Use timeout to avoid waiting
1142  * too long.
1143  */
1144 Static void
1145 ehci_waitintr(ehci_softc_t *sc, usbd_xfer_handle xfer)
1146 {
1147 	int timo;
1148 	u_int32_t intrs;
1149 
1150 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
1151 
1152 	xfer->status = USBD_IN_PROGRESS;
1153 	for (timo = xfer->timeout; timo >= 0; timo--) {
1154 		usb_delay_ms(&sc->sc_bus, 1);
1155 		if (sc->sc_dying)
1156 			break;
1157 		intrs = EHCI_STS_INTRS(EOREAD4(sc, EHCI_USBSTS)) &
1158 			sc->sc_eintrs;
1159 		USBHIST_LOG(ehcidebug, "0x%04x", intrs, 0, 0, 0);
1160 #ifdef EHCI_DEBUG
1161 		if (ehcidebug > 15)
1162 			ehci_dump_regs(sc);
1163 #endif
1164 		if (intrs) {
1165 			mutex_spin_enter(&sc->sc_intr_lock);
1166 			ehci_intr1(sc);
1167 			mutex_spin_exit(&sc->sc_intr_lock);
1168 			if (xfer->status != USBD_IN_PROGRESS)
1169 				return;
1170 		}
1171 	}
1172 
1173 	/* Timeout */
1174 	USBHIST_LOG(ehcidebug, "timeout", 0, 0, 0, 0);
1175 	xfer->status = USBD_TIMEOUT;
1176 	mutex_enter(&sc->sc_lock);
1177 	usb_transfer_complete(xfer);
1178 	mutex_exit(&sc->sc_lock);
1179 	/* XXX should free TD */
1180 }
1181 
1182 Static void
1183 ehci_poll(struct usbd_bus *bus)
1184 {
1185 	ehci_softc_t *sc = bus->hci_private;
1186 
1187 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
1188 
1189 #ifdef EHCI_DEBUG
1190 	static int last;
1191 	int new;
1192 	new = EHCI_STS_INTRS(EOREAD4(sc, EHCI_USBSTS));
1193 	if (new != last) {
1194 		USBHIST_LOG(ehcidebug, "intrs=0x%04x", new, 0, 0, 0);
1195 		last = new;
1196 	}
1197 #endif
1198 
1199 	if (EOREAD4(sc, EHCI_USBSTS) & sc->sc_eintrs) {
1200 		mutex_spin_enter(&sc->sc_intr_lock);
1201 		ehci_intr1(sc);
1202 		mutex_spin_exit(&sc->sc_intr_lock);
1203 	}
1204 }
1205 
1206 void
1207 ehci_childdet(device_t self, device_t child)
1208 {
1209 	struct ehci_softc *sc = device_private(self);
1210 
1211 	KASSERT(sc->sc_child == child);
1212 	sc->sc_child = NULL;
1213 }
1214 
1215 int
1216 ehci_detach(struct ehci_softc *sc, int flags)
1217 {
1218 	int rv = 0;
1219 
1220 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
1221 
1222 	if (sc->sc_child != NULL)
1223 		rv = config_detach(sc->sc_child, flags);
1224 
1225 	if (rv != 0)
1226 		return (rv);
1227 
1228 	callout_halt(&sc->sc_tmo_intrlist, NULL);
1229 	callout_destroy(&sc->sc_tmo_intrlist);
1230 
1231 	/* XXX free other data structures XXX */
1232 	if (sc->sc_softitds)
1233 		kmem_free(sc->sc_softitds,
1234 		    sc->sc_flsize * sizeof(ehci_soft_itd_t *));
1235 	cv_destroy(&sc->sc_doorbell);
1236 	cv_destroy(&sc->sc_softwake_cv);
1237 
1238 #if 0
1239 	/* XXX destroyed in ehci_pci.c as it controls ehci_intr access */
1240 
1241 	softint_disestablish(sc->sc_doorbell_si);
1242 	softint_disestablish(sc->sc_pcd_si);
1243 
1244 	mutex_destroy(&sc->sc_lock);
1245 	mutex_destroy(&sc->sc_intr_lock);
1246 #endif
1247 
1248 	pool_cache_destroy(sc->sc_xferpool);
1249 
1250 	EOWRITE4(sc, EHCI_CONFIGFLAG, 0);
1251 
1252 	return (rv);
1253 }
1254 
1255 
1256 int
1257 ehci_activate(device_t self, enum devact act)
1258 {
1259 	struct ehci_softc *sc = device_private(self);
1260 
1261 	switch (act) {
1262 	case DVACT_DEACTIVATE:
1263 		sc->sc_dying = 1;
1264 		return 0;
1265 	default:
1266 		return EOPNOTSUPP;
1267 	}
1268 }
1269 
1270 /*
1271  * Handle suspend/resume.
1272  *
1273  * We need to switch to polling mode here, because this routine is
1274  * called from an interrupt context.  This is all right since we
1275  * are almost suspended anyway.
1276  *
1277  * Note that this power handler isn't to be registered directly; the
1278  * bus glue needs to call out to it.
1279  */
1280 bool
1281 ehci_suspend(device_t dv, const pmf_qual_t *qual)
1282 {
1283 	ehci_softc_t *sc = device_private(dv);
1284 	int i;
1285 	uint32_t cmd, hcr;
1286 
1287 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
1288 
1289 	mutex_spin_enter(&sc->sc_intr_lock);
1290 	sc->sc_bus.use_polling++;
1291 	mutex_spin_exit(&sc->sc_intr_lock);
1292 
1293 	for (i = 1; i <= sc->sc_noport; i++) {
1294 		cmd = EOREAD4(sc, EHCI_PORTSC(i)) & ~EHCI_PS_CLEAR;
1295 		if ((cmd & EHCI_PS_PO) == 0 && (cmd & EHCI_PS_PE) == EHCI_PS_PE)
1296 			EOWRITE4(sc, EHCI_PORTSC(i), cmd | EHCI_PS_SUSP);
1297 	}
1298 
1299 	sc->sc_cmd = EOREAD4(sc, EHCI_USBCMD);
1300 
1301 	cmd = sc->sc_cmd & ~(EHCI_CMD_ASE | EHCI_CMD_PSE);
1302 	EOWRITE4(sc, EHCI_USBCMD, cmd);
1303 
1304 	for (i = 0; i < 100; i++) {
1305 		hcr = EOREAD4(sc, EHCI_USBSTS) & (EHCI_STS_ASS | EHCI_STS_PSS);
1306 		if (hcr == 0)
1307 			break;
1308 
1309 		usb_delay_ms(&sc->sc_bus, 1);
1310 	}
1311 	if (hcr != 0)
1312 		printf("%s: reset timeout\n", device_xname(dv));
1313 
1314 	cmd &= ~EHCI_CMD_RS;
1315 	EOWRITE4(sc, EHCI_USBCMD, cmd);
1316 
1317 	for (i = 0; i < 100; i++) {
1318 		hcr = EOREAD4(sc, EHCI_USBSTS) & EHCI_STS_HCH;
1319 		if (hcr == EHCI_STS_HCH)
1320 			break;
1321 
1322 		usb_delay_ms(&sc->sc_bus, 1);
1323 	}
1324 	if (hcr != EHCI_STS_HCH)
1325 		printf("%s: config timeout\n", device_xname(dv));
1326 
1327 	mutex_spin_enter(&sc->sc_intr_lock);
1328 	sc->sc_bus.use_polling--;
1329 	mutex_spin_exit(&sc->sc_intr_lock);
1330 
1331 	return true;
1332 }
1333 
1334 bool
1335 ehci_resume(device_t dv, const pmf_qual_t *qual)
1336 {
1337 	ehci_softc_t *sc = device_private(dv);
1338 	int i;
1339 	uint32_t cmd, hcr;
1340 
1341 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
1342 
1343 	/* restore things in case the bios sucks */
1344 	EOWRITE4(sc, EHCI_CTRLDSSEGMENT, 0);
1345 	EOWRITE4(sc, EHCI_PERIODICLISTBASE, DMAADDR(&sc->sc_fldma, 0));
1346 	EOWRITE4(sc, EHCI_ASYNCLISTADDR,
1347 	    sc->sc_async_head->physaddr | EHCI_LINK_QH);
1348 
1349 	EOWRITE4(sc, EHCI_USBINTR, sc->sc_eintrs & ~EHCI_INTR_PCIE);
1350 
1351 	EOWRITE4(sc, EHCI_USBCMD, sc->sc_cmd);
1352 
1353 	hcr = 0;
1354 	for (i = 1; i <= sc->sc_noport; i++) {
1355 		cmd = EOREAD4(sc, EHCI_PORTSC(i)) & ~EHCI_PS_CLEAR;
1356 		if ((cmd & EHCI_PS_PO) == 0 &&
1357 		    (cmd & EHCI_PS_SUSP) == EHCI_PS_SUSP) {
1358 			EOWRITE4(sc, EHCI_PORTSC(i), cmd | EHCI_PS_FPR);
1359 			hcr = 1;
1360 		}
1361 	}
1362 
1363 	if (hcr) {
1364 		usb_delay_ms(&sc->sc_bus, USB_RESUME_WAIT);
1365 
1366 		for (i = 1; i <= sc->sc_noport; i++) {
1367 			cmd = EOREAD4(sc, EHCI_PORTSC(i)) & ~EHCI_PS_CLEAR;
1368 			if ((cmd & EHCI_PS_PO) == 0 &&
1369 			    (cmd & EHCI_PS_SUSP) == EHCI_PS_SUSP)
1370 				EOWRITE4(sc, EHCI_PORTSC(i),
1371 				    cmd & ~EHCI_PS_FPR);
1372 		}
1373 	}
1374 
1375 	EOWRITE4(sc, EHCI_USBCMD, sc->sc_cmd);
1376 	EOWRITE4(sc, EHCI_USBINTR, sc->sc_eintrs);
1377 
1378 	for (i = 0; i < 100; i++) {
1379 		hcr = EOREAD4(sc, EHCI_USBSTS) & EHCI_STS_HCH;
1380 		if (hcr != EHCI_STS_HCH)
1381 			break;
1382 
1383 		usb_delay_ms(&sc->sc_bus, 1);
1384 	}
1385 	if (hcr == EHCI_STS_HCH)
1386 		printf("%s: config timeout\n", device_xname(dv));
1387 
1388 	return true;
1389 }
1390 
1391 /*
1392  * Shut down the controller when the system is going down.
1393  */
1394 bool
1395 ehci_shutdown(device_t self, int flags)
1396 {
1397 	ehci_softc_t *sc = device_private(self);
1398 
1399 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
1400 
1401 	EOWRITE4(sc, EHCI_USBCMD, 0);	/* Halt controller */
1402 	EOWRITE4(sc, EHCI_USBCMD, EHCI_CMD_HCRESET);
1403 	return true;
1404 }
1405 
1406 Static usbd_status
1407 ehci_allocm(struct usbd_bus *bus, usb_dma_t *dma, u_int32_t size)
1408 {
1409 	struct ehci_softc *sc = bus->hci_private;
1410 	usbd_status err;
1411 
1412 	err = usb_allocmem_flags(&sc->sc_bus, size, 0, dma, USBMALLOC_MULTISEG);
1413 #ifdef EHCI_DEBUG
1414 	if (err)
1415 		printf("ehci_allocm: usb_allocmem_flags()= %s (%d)\n",
1416 			usbd_errstr(err), err);
1417 #endif
1418 	if (err == USBD_NOMEM)
1419 		err = usb_reserve_allocm(&sc->sc_dma_reserve, dma, size);
1420 #ifdef EHCI_DEBUG
1421 	if (err)
1422 		printf("ehci_allocm: usb_reserve_allocm()= %s (%d)\n",
1423 			usbd_errstr(err), err);
1424 #endif
1425 	return (err);
1426 }
1427 
1428 Static void
1429 ehci_freem(struct usbd_bus *bus, usb_dma_t *dma)
1430 {
1431 	struct ehci_softc *sc = bus->hci_private;
1432 
1433 	if (dma->block->flags & USB_DMA_RESERVE) {
1434 		usb_reserve_freem(&sc->sc_dma_reserve,
1435 		    dma);
1436 		return;
1437 	}
1438 	usb_freemem(&sc->sc_bus, dma);
1439 }
1440 
1441 Static usbd_xfer_handle
1442 ehci_allocx(struct usbd_bus *bus)
1443 {
1444 	struct ehci_softc *sc = bus->hci_private;
1445 	usbd_xfer_handle xfer;
1446 
1447 	xfer = pool_cache_get(sc->sc_xferpool, PR_NOWAIT);
1448 	if (xfer != NULL) {
1449 		memset(xfer, 0, sizeof(struct ehci_xfer));
1450 #ifdef DIAGNOSTIC
1451 		EXFER(xfer)->isdone = 1;
1452 		xfer->busy_free = XFER_BUSY;
1453 #endif
1454 	}
1455 	return (xfer);
1456 }
1457 
1458 Static void
1459 ehci_freex(struct usbd_bus *bus, usbd_xfer_handle xfer)
1460 {
1461 	struct ehci_softc *sc = bus->hci_private;
1462 
1463 #ifdef DIAGNOSTIC
1464 	if (xfer->busy_free != XFER_BUSY) {
1465 		printf("ehci_freex: xfer=%p not busy, 0x%08x\n", xfer,
1466 		       xfer->busy_free);
1467 	}
1468 	xfer->busy_free = XFER_FREE;
1469 	if (!EXFER(xfer)->isdone) {
1470 		printf("ehci_freex: !isdone\n");
1471 	}
1472 #endif
1473 	pool_cache_put(sc->sc_xferpool, xfer);
1474 }
1475 
1476 Static void
1477 ehci_get_lock(struct usbd_bus *bus, kmutex_t **lock)
1478 {
1479 	struct ehci_softc *sc = bus->hci_private;
1480 
1481 	*lock = &sc->sc_lock;
1482 }
1483 
1484 Static void
1485 ehci_device_clear_toggle(usbd_pipe_handle pipe)
1486 {
1487 	struct ehci_pipe *epipe = (struct ehci_pipe *)pipe;
1488 
1489 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
1490 
1491 	USBHIST_LOG(ehcidebug, "epipe=%p status=0x%08x",
1492 	    epipe, epipe->sqh->qh.qh_qtd.qtd_status, 0, 0);
1493 #ifdef EHCI_DEBUG
1494 	if (ehcidebug)
1495 		usbd_dump_pipe(pipe);
1496 #endif
1497 	epipe->nexttoggle = 0;
1498 }
1499 
1500 Static void
1501 ehci_noop(usbd_pipe_handle pipe)
1502 {
1503 }
1504 
1505 #ifdef EHCI_DEBUG
1506 /*
1507  * Unused function - this is meant to be called from a kernel
1508  * debugger.
1509  */
1510 void
1511 ehci_dump(void)
1512 {
1513 	ehci_softc_t *sc = theehci;
1514 	int i;
1515 	printf("cmd=0x%08x, sts=0x%08x, ien=0x%08x\n",
1516 	    EOREAD4(sc, EHCI_USBCMD),
1517 	    EOREAD4(sc, EHCI_USBSTS),
1518 	    EOREAD4(sc, EHCI_USBINTR));
1519 	printf("frindex=0x%08x ctrdsegm=0x%08x periodic=0x%08x async=0x%08x\n",
1520 	    EOREAD4(sc, EHCI_FRINDEX),
1521 	    EOREAD4(sc, EHCI_CTRLDSSEGMENT),
1522 	    EOREAD4(sc, EHCI_PERIODICLISTBASE),
1523 	    EOREAD4(sc, EHCI_ASYNCLISTADDR));
1524 	for (i = 1; i <= sc->sc_noport; i++)
1525 		printf("port %d status=0x%08x\n", i,
1526 		    EOREAD4(sc, EHCI_PORTSC(i)));
1527 }
1528 
1529 Static void
1530 ehci_dump_regs(ehci_softc_t *sc)
1531 {
1532 	int i;
1533 
1534 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
1535 
1536 	USBHIST_LOG(ehcidebug,
1537 	    "cmd     = 0x%08x  sts      = 0x%08x  ien      = 0x%08x",
1538 	    EOREAD4(sc, EHCI_USBCMD), EOREAD4(sc, EHCI_USBSTS),
1539 	    EOREAD4(sc, EHCI_USBINTR), 0);
1540 	USBHIST_LOG(ehcidebug,
1541 	    "frindex = 0x%08x  ctrdsegm = 0x%08x  periodic = 0x%08x  "
1542 	    "async   = 0x%08x",
1543 	    EOREAD4(sc, EHCI_FRINDEX), EOREAD4(sc, EHCI_CTRLDSSEGMENT),
1544 	    EOREAD4(sc, EHCI_PERIODICLISTBASE),
1545 	    EOREAD4(sc, EHCI_ASYNCLISTADDR));
1546 	for (i = 1; i <= sc->sc_noport; i += 2) {
1547 		if (i == sc->sc_noport) {
1548 			USBHIST_LOG(ehcidebug,
1549 			    "port %d status = 0x%08x", i,
1550 			    EOREAD4(sc, EHCI_PORTSC(i)), 0, 0);
1551 		} else {
1552 			USBHIST_LOG(ehcidebug,
1553 			    "port %d status = 0x%08x  port %d status = 0x%08x",
1554 			    i, EOREAD4(sc, EHCI_PORTSC(i)),
1555 			    i+1, EOREAD4(sc, EHCI_PORTSC(i+1)));
1556 		}
1557 	}
1558 }
1559 
1560 #ifdef EHCI_DEBUG
1561 #define ehci_dump_link(link, type) do {					\
1562 	USBHIST_LOG(ehcidebug, "    link 0x%08x (T = %d):",		\
1563 	    link,							\
1564 	    link & EHCI_LINK_TERMINATE ? 1 : 0, 0, 0);			\
1565 	if (type) {							\
1566 		USBHIST_LOG(ehcidebug,					\
1567 		    "        ITD  = %d  QH   = %d  SITD = %d  FSTN = %d",\
1568 		    EHCI_LINK_TYPE(link) == EHCI_LINK_ITD ? 1 : 0,	\
1569 		    EHCI_LINK_TYPE(link) == EHCI_LINK_QH ? 1 : 0,	\
1570 		    EHCI_LINK_TYPE(link) == EHCI_LINK_SITD ? 1 : 0,	\
1571 		    EHCI_LINK_TYPE(link) == EHCI_LINK_FSTN ? 1 : 0);	\
1572 	}								\
1573 } while(0)
1574 #else
1575 #define ehci_dump_link(link, type)
1576 #endif
1577 
1578 Static void
1579 ehci_dump_sqtds(ehci_soft_qtd_t *sqtd)
1580 {
1581 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
1582 	int i;
1583 	uint32_t stop = 0;
1584 
1585 	for (i = 0; sqtd && i < 20 && !stop; sqtd = sqtd->nextqtd, i++) {
1586 		ehci_dump_sqtd(sqtd);
1587 		usb_syncmem(&sqtd->dma,
1588 		    sqtd->offs + offsetof(ehci_qtd_t, qtd_next),
1589 		    sizeof(sqtd->qtd),
1590 		    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
1591 		stop = sqtd->qtd.qtd_next & htole32(EHCI_LINK_TERMINATE);
1592 		usb_syncmem(&sqtd->dma,
1593 		    sqtd->offs + offsetof(ehci_qtd_t, qtd_next),
1594 		    sizeof(sqtd->qtd), BUS_DMASYNC_PREREAD);
1595 	}
1596 	if (!stop)
1597 		USBHIST_LOG(ehcidebug,
1598 		    "dump aborted, too many TDs", 0, 0, 0, 0);
1599 }
1600 
1601 Static void
1602 ehci_dump_sqtd(ehci_soft_qtd_t *sqtd)
1603 {
1604 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
1605 
1606 	usb_syncmem(&sqtd->dma, sqtd->offs,
1607 	    sizeof(sqtd->qtd), BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
1608 
1609 	USBHIST_LOGN(ehcidebug, 10,
1610 	    "QTD(%p) at 0x%08x:", sqtd, sqtd->physaddr, 0, 0);
1611 	ehci_dump_qtd(&sqtd->qtd);
1612 
1613 	usb_syncmem(&sqtd->dma, sqtd->offs,
1614 	    sizeof(sqtd->qtd), BUS_DMASYNC_PREREAD);
1615 }
1616 
1617 Static void
1618 ehci_dump_qtd(ehci_qtd_t *qtd)
1619 {
1620 	USBHIST_FUNC();	USBHIST_CALLED(ehcidebug);
1621 
1622 #ifdef USBHIST
1623 	uint32_t s = le32toh(qtd->qtd_status);
1624 #endif
1625 
1626 	USBHIST_LOGN(ehcidebug, 10,
1627 	    "     next = 0x%08x  altnext = 0x%08x  status = 0x%08x",
1628 	    qtd->qtd_next, qtd->qtd_altnext, s, 0);
1629 	USBHIST_LOGN(ehcidebug, 10,
1630 	    "   toggle = %d ioc = %d bytes = %#x "
1631 	    "c_page = %#x", EHCI_QTD_GET_TOGGLE(s), EHCI_QTD_GET_IOC(s),
1632 	    EHCI_QTD_GET_BYTES(s), EHCI_QTD_GET_C_PAGE(s));
1633 	USBHIST_LOGN(ehcidebug, 10,
1634 	    "     cerr = %d pid = %d stat  = %x",
1635 	    EHCI_QTD_GET_CERR(s), EHCI_QTD_GET_PID(s), EHCI_QTD_GET_STATUS(s),
1636 	    0);
1637 	USBHIST_LOGN(ehcidebug, 10,
1638 	    "active =%d halted=%d buferr=%d babble=%d",
1639 	    s & EHCI_QTD_ACTIVE ? 1 : 0,
1640 	    s & EHCI_QTD_HALTED ? 1 : 0,
1641 	    s & EHCI_QTD_BUFERR ? 1 : 0,
1642 	    s & EHCI_QTD_BABBLE ? 1 : 0);
1643 	USBHIST_LOGN(ehcidebug, 10,
1644 	    "xacterr=%d missed=%d split =%d ping  =%d",
1645 	    s & EHCI_QTD_XACTERR ? 1 : 0,
1646 	    s & EHCI_QTD_MISSEDMICRO ? 1 : 0,
1647 	    s & EHCI_QTD_SPLITXSTATE ? 1 : 0,
1648 	    s & EHCI_QTD_PINGSTATE ? 1 : 0);
1649 	USBHIST_LOGN(ehcidebug, 10,
1650 	    "buffer[0] = %#x  buffer[1] = %#x  "
1651 	    "buffer[2] = %#x  buffer[3] = %#x",
1652 	    le32toh(qtd->qtd_buffer[0]), le32toh(qtd->qtd_buffer[1]),
1653 	    le32toh(qtd->qtd_buffer[2]), le32toh(qtd->qtd_buffer[3]));
1654 	USBHIST_LOGN(ehcidebug, 10,
1655 	    "buffer[4] = %#x", le32toh(qtd->qtd_buffer[4]), 0, 0, 0);
1656 }
1657 
1658 Static void
1659 ehci_dump_sqh(ehci_soft_qh_t *sqh)
1660 {
1661 #ifdef USBHIST
1662 	ehci_qh_t *qh = &sqh->qh;
1663 	ehci_link_t link;
1664 #endif
1665 	u_int32_t endp, endphub;
1666 	USBHIST_FUNC();	USBHIST_CALLED(ehcidebug);
1667 
1668 	usb_syncmem(&sqh->dma, sqh->offs,
1669 	    sizeof(sqh->qh), BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
1670 
1671 	USBHIST_LOGN(ehcidebug, 10,
1672 	    "QH(%p) at %#x:", sqh, sqh->physaddr, 0, 0);
1673 	link = le32toh(qh->qh_link);
1674 	ehci_dump_link(link, true);
1675 
1676 	endp = le32toh(qh->qh_endp);
1677 	USBHIST_LOGN(ehcidebug, 10,
1678 	    "    endp = %#x", endp, 0, 0, 0);
1679 	USBHIST_LOGN(ehcidebug, 10,
1680 	    "        addr = 0x%02x  inact = %d  endpt = %d  eps = %d",
1681 	    EHCI_QH_GET_ADDR(endp), EHCI_QH_GET_INACT(endp),
1682 	    EHCI_QH_GET_ENDPT(endp), EHCI_QH_GET_EPS(endp));
1683 	USBHIST_LOGN(ehcidebug, 10,
1684 	    "        dtc  = %d     hrecl = %d",
1685 	    EHCI_QH_GET_DTC(endp), EHCI_QH_GET_HRECL(endp), 0, 0);
1686 	USBHIST_LOGN(ehcidebug, 10,
1687 	    "        ctl  = %d     nrl   = %d  mpl   = %#x(%d)",
1688 	    EHCI_QH_GET_CTL(endp),EHCI_QH_GET_NRL(endp),
1689 	    EHCI_QH_GET_MPL(endp), EHCI_QH_GET_MPL(endp));
1690 
1691 	endphub = le32toh(qh->qh_endphub);
1692 	USBHIST_LOGN(ehcidebug, 10,
1693 	    " endphub = %#x", endphub, 0, 0, 0);
1694 	USBHIST_LOGN(ehcidebug, 10,
1695 	    "      smask = 0x%02x  cmask = 0x%02x",
1696 	    EHCI_QH_GET_SMASK(endphub), EHCI_QH_GET_CMASK(endphub), 1, 0);
1697 	USBHIST_LOGN(ehcidebug, 10,
1698 	    "      huba  = 0x%02x  port  = %d  mult = %d",
1699 	    EHCI_QH_GET_HUBA(endphub), EHCI_QH_GET_PORT(endphub),
1700 	    EHCI_QH_GET_MULT(endphub), 0);
1701 
1702 	link = le32toh(qh->qh_curqtd);
1703 	ehci_dump_link(link, false);
1704 	USBHIST_LOGN(ehcidebug, 10, "Overlay qTD:", 0, 0, 0, 0);
1705 	ehci_dump_qtd(&qh->qh_qtd);
1706 
1707 	usb_syncmem(&sqh->dma, sqh->offs,
1708 	    sizeof(sqh->qh), BUS_DMASYNC_PREREAD);
1709 }
1710 
1711 Static void
1712 ehci_dump_itd(struct ehci_soft_itd *itd)
1713 {
1714 	ehci_isoc_trans_t t;
1715 	ehci_isoc_bufr_ptr_t b, b2, b3;
1716 	int i;
1717 
1718 	USBHIST_FUNC();	USBHIST_CALLED(ehcidebug);
1719 
1720 	USBHIST_LOG(ehcidebug, "ITD: next phys = %#x", itd->itd.itd_next, 0,
1721 	    0, 0);
1722 
1723 	for (i = 0; i < EHCI_ITD_NUFRAMES; i++) {
1724 		t = le32toh(itd->itd.itd_ctl[i]);
1725 		USBHIST_LOG(ehcidebug, "ITDctl %d: stat = %x len = %x",
1726 		    i, EHCI_ITD_GET_STATUS(t), EHCI_ITD_GET_LEN(t), 0);
1727 		USBHIST_LOG(ehcidebug, "     ioc = %x pg = %x offs = %x",
1728 		    EHCI_ITD_GET_IOC(t), EHCI_ITD_GET_PG(t),
1729 		    EHCI_ITD_GET_OFFS(t), 0);
1730 	}
1731 	USBHIST_LOG(ehcidebug, "ITDbufr: ", 0, 0, 0, 0);
1732 	for (i = 0; i < EHCI_ITD_NBUFFERS; i++)
1733 		USBHIST_LOG(ehcidebug, "      %x",
1734 		    EHCI_ITD_GET_BPTR(le32toh(itd->itd.itd_bufr[i])), 0, 0, 0);
1735 
1736 	b = le32toh(itd->itd.itd_bufr[0]);
1737 	b2 = le32toh(itd->itd.itd_bufr[1]);
1738 	b3 = le32toh(itd->itd.itd_bufr[2]);
1739 	USBHIST_LOG(ehcidebug, "     ep = %x daddr = %x dir = %d",
1740 	    EHCI_ITD_GET_EP(b), EHCI_ITD_GET_DADDR(b), EHCI_ITD_GET_DIR(b2), 0);
1741 	USBHIST_LOG(ehcidebug, "     maxpkt = %x multi = %x",
1742 	    EHCI_ITD_GET_MAXPKT(b2), EHCI_ITD_GET_MULTI(b3), 0, 0);
1743 }
1744 
1745 Static void
1746 ehci_dump_sitd(struct ehci_soft_itd *itd)
1747 {
1748 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
1749 
1750 	USBHIST_LOG(ehcidebug, "SITD %p next = %p prev = %p",
1751 	    itd, itd->u.frame_list.next, itd->u.frame_list.prev, 0);
1752 	USBHIST_LOG(ehcidebug, "        xfernext=%p physaddr=%X slot=%d",
1753 	    itd->xfer_next, itd->physaddr, itd->slot, 0);
1754 }
1755 
1756 Static void
1757 ehci_dump_exfer(struct ehci_xfer *ex)
1758 {
1759 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
1760 
1761 	USBHIST_LOG(ehcidebug, "ex = %p sqtdstart = %p end = %p",
1762 	    ex, ex->sqtdstart, ex->sqtdend, 0);
1763 	USBHIST_LOG(ehcidebug, "     itdstart = %p end = %p isdone = %d",
1764 	    ex->itdstart, ex->itdend, ex->isdone, 0);
1765 }
1766 #endif
1767 
1768 Static usbd_status
1769 ehci_open(usbd_pipe_handle pipe)
1770 {
1771 	usbd_device_handle dev = pipe->device;
1772 	ehci_softc_t *sc = dev->bus->hci_private;
1773 	usb_endpoint_descriptor_t *ed = pipe->endpoint->edesc;
1774 	u_int8_t addr = dev->address;
1775 	u_int8_t xfertype = UE_GET_XFERTYPE(ed->bmAttributes);
1776 	struct ehci_pipe *epipe = (struct ehci_pipe *)pipe;
1777 	ehci_soft_qh_t *sqh;
1778 	usbd_status err;
1779 	int ival, speed, naks;
1780 	int hshubaddr, hshubport;
1781 
1782 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
1783 
1784 	USBHIST_LOG(ehcidebug, "pipe=%p, addr=%d, endpt=%d (%d)",
1785 	    pipe, addr, ed->bEndpointAddress, sc->sc_addr);
1786 
1787 	if (dev->myhsport) {
1788 		/*
1789 		 * When directly attached FS/LS device while doing embedded
1790 		 * transaction translations and we are the hub, set the hub
1791 		 * address to 0 (us).
1792 		 */
1793 		if (!(sc->sc_flags & EHCIF_ETTF)
1794 		    || (dev->myhsport->parent->address != sc->sc_addr)) {
1795 			hshubaddr = dev->myhsport->parent->address;
1796 		} else {
1797 			hshubaddr = 0;
1798 		}
1799 		hshubport = dev->myhsport->portno;
1800 	} else {
1801 		hshubaddr = 0;
1802 		hshubport = 0;
1803 	}
1804 
1805 	if (sc->sc_dying)
1806 		return (USBD_IOERROR);
1807 
1808 	/* toggle state needed for bulk endpoints */
1809 	epipe->nexttoggle = pipe->endpoint->datatoggle;
1810 
1811 	if (addr == sc->sc_addr) {
1812 		switch (ed->bEndpointAddress) {
1813 		case USB_CONTROL_ENDPOINT:
1814 			pipe->methods = &ehci_root_ctrl_methods;
1815 			break;
1816 		case UE_DIR_IN | EHCI_INTR_ENDPT:
1817 			pipe->methods = &ehci_root_intr_methods;
1818 			break;
1819 		default:
1820 			USBHIST_LOG(ehcidebug,
1821 			    "bad bEndpointAddress 0x%02x",
1822 			    ed->bEndpointAddress, 0, 0, 0);
1823 			return (USBD_INVAL);
1824 		}
1825 		return (USBD_NORMAL_COMPLETION);
1826 	}
1827 
1828 	/* XXX All this stuff is only valid for async. */
1829 	switch (dev->speed) {
1830 	case USB_SPEED_LOW:  speed = EHCI_QH_SPEED_LOW;  break;
1831 	case USB_SPEED_FULL: speed = EHCI_QH_SPEED_FULL; break;
1832 	case USB_SPEED_HIGH: speed = EHCI_QH_SPEED_HIGH; break;
1833 	default: panic("ehci_open: bad device speed %d", dev->speed);
1834 	}
1835 	if (speed != EHCI_QH_SPEED_HIGH && xfertype == UE_ISOCHRONOUS) {
1836 		aprint_error_dev(sc->sc_dev, "error opening low/full speed "
1837 		    "isoc endpoint.\n");
1838 		aprint_normal_dev(sc->sc_dev, "a low/full speed device is "
1839 		    "attached to a USB2 hub, and transaction translations are "
1840 		    "not yet supported.\n");
1841 		aprint_normal_dev(sc->sc_dev, "reattach the device to the "
1842 		    "root hub instead.\n");
1843 		USBHIST_LOG(ehcidebug, "hshubaddr=%d hshubport=%d",
1844 			    hshubaddr, hshubport, 0, 0);
1845 		return USBD_INVAL;
1846 	}
1847 
1848 	/*
1849 	 * For interrupt transfer, nak throttling must be disabled, but for
1850 	 * the other transfer type, nak throttling should be enabled from the
1851 	 * viewpoint that avoids the memory thrashing.
1852 	 */
1853 	naks = (xfertype == UE_INTERRUPT) ? 0
1854 	    : ((speed == EHCI_QH_SPEED_HIGH) ? 4 : 0);
1855 
1856 	/* Allocate sqh for everything, save isoc xfers */
1857 	if (xfertype != UE_ISOCHRONOUS) {
1858 		sqh = ehci_alloc_sqh(sc);
1859 		if (sqh == NULL)
1860 			return (USBD_NOMEM);
1861 		/* qh_link filled when the QH is added */
1862 		sqh->qh.qh_endp = htole32(
1863 		    EHCI_QH_SET_ADDR(addr) |
1864 		    EHCI_QH_SET_ENDPT(UE_GET_ADDR(ed->bEndpointAddress)) |
1865 		    EHCI_QH_SET_EPS(speed) |
1866 		    EHCI_QH_DTC |
1867 		    EHCI_QH_SET_MPL(UGETW(ed->wMaxPacketSize)) |
1868 		    (speed != EHCI_QH_SPEED_HIGH && xfertype == UE_CONTROL ?
1869 		     EHCI_QH_CTL : 0) |
1870 		    EHCI_QH_SET_NRL(naks)
1871 		    );
1872 		sqh->qh.qh_endphub = htole32(
1873 		    EHCI_QH_SET_MULT(1) |
1874 		    EHCI_QH_SET_SMASK(xfertype == UE_INTERRUPT ? 0x02 : 0)
1875 		    );
1876 		if (speed != EHCI_QH_SPEED_HIGH)
1877 			sqh->qh.qh_endphub |= htole32(
1878 			    EHCI_QH_SET_PORT(hshubport) |
1879 			    EHCI_QH_SET_HUBA(hshubaddr) |
1880 			    EHCI_QH_SET_CMASK(0x08) /* XXX */
1881 			);
1882 		sqh->qh.qh_curqtd = EHCI_NULL;
1883 		/* Fill the overlay qTD */
1884 		sqh->qh.qh_qtd.qtd_next = EHCI_NULL;
1885 		sqh->qh.qh_qtd.qtd_altnext = EHCI_NULL;
1886 		sqh->qh.qh_qtd.qtd_status = htole32(0);
1887 
1888 		usb_syncmem(&sqh->dma, sqh->offs, sizeof(sqh->qh),
1889 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
1890 		epipe->sqh = sqh;
1891 	} else {
1892 		sqh = NULL;
1893 	} /*xfertype == UE_ISOC*/
1894 
1895 	switch (xfertype) {
1896 	case UE_CONTROL:
1897 		err = usb_allocmem(&sc->sc_bus, sizeof(usb_device_request_t),
1898 				   0, &epipe->u.ctl.reqdma);
1899 #ifdef EHCI_DEBUG
1900 		if (err)
1901 			printf("ehci_open: usb_allocmem()=%d\n", err);
1902 #endif
1903 		if (err)
1904 			goto bad;
1905 		pipe->methods = &ehci_device_ctrl_methods;
1906 		mutex_enter(&sc->sc_lock);
1907 		ehci_add_qh(sc, sqh, sc->sc_async_head);
1908 		mutex_exit(&sc->sc_lock);
1909 		break;
1910 	case UE_BULK:
1911 		pipe->methods = &ehci_device_bulk_methods;
1912 		mutex_enter(&sc->sc_lock);
1913 		ehci_add_qh(sc, sqh, sc->sc_async_head);
1914 		mutex_exit(&sc->sc_lock);
1915 		break;
1916 	case UE_INTERRUPT:
1917 		pipe->methods = &ehci_device_intr_methods;
1918 		ival = pipe->interval;
1919 		if (ival == USBD_DEFAULT_INTERVAL) {
1920 			if (speed == EHCI_QH_SPEED_HIGH) {
1921 				if (ed->bInterval > 16) {
1922 					/*
1923 					 * illegal with high-speed, but there
1924 					 * were documentation bugs in the spec,
1925 					 * so be generous
1926 					 */
1927 					ival = 256;
1928 				} else
1929 					ival = (1 << (ed->bInterval - 1)) / 8;
1930 			} else
1931 				ival = ed->bInterval;
1932 		}
1933 		err = ehci_device_setintr(sc, sqh, ival);
1934 		if (err)
1935 			goto bad;
1936 		break;
1937 	case UE_ISOCHRONOUS:
1938 		pipe->methods = &ehci_device_isoc_methods;
1939 		if (ed->bInterval == 0 || ed->bInterval > 16) {
1940 			printf("ehci: opening pipe with invalid bInterval\n");
1941 			err = USBD_INVAL;
1942 			goto bad;
1943 		}
1944 		if (UGETW(ed->wMaxPacketSize) == 0) {
1945 			printf("ehci: zero length endpoint open request\n");
1946 			err = USBD_INVAL;
1947 			goto bad;
1948 		}
1949 		epipe->u.isoc.next_frame = 0;
1950 		epipe->u.isoc.cur_xfers = 0;
1951 		break;
1952 	default:
1953 		USBHIST_LOG(ehcidebug, "bad xfer type %d", xfertype, 0, 0, 0);
1954 		err = USBD_INVAL;
1955 		goto bad;
1956 	}
1957 	return (USBD_NORMAL_COMPLETION);
1958 
1959  bad:
1960 	if (sqh != NULL)
1961 		ehci_free_sqh(sc, sqh);
1962 	return (err);
1963 }
1964 
1965 /*
1966  * Add an ED to the schedule.  Called with USB lock held.
1967  */
1968 Static void
1969 ehci_add_qh(ehci_softc_t *sc, ehci_soft_qh_t *sqh, ehci_soft_qh_t *head)
1970 {
1971 
1972 	KASSERT(mutex_owned(&sc->sc_lock));
1973 
1974 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
1975 
1976 	usb_syncmem(&head->dma, head->offs + offsetof(ehci_qh_t, qh_link),
1977 	    sizeof(head->qh.qh_link), BUS_DMASYNC_POSTWRITE);
1978 
1979 	sqh->next = head->next;
1980 	sqh->qh.qh_link = head->qh.qh_link;
1981 
1982 	usb_syncmem(&sqh->dma, sqh->offs + offsetof(ehci_qh_t, qh_link),
1983 	    sizeof(sqh->qh.qh_link), BUS_DMASYNC_PREWRITE);
1984 
1985 	head->next = sqh;
1986 	head->qh.qh_link = htole32(sqh->physaddr | EHCI_LINK_QH);
1987 
1988 	usb_syncmem(&head->dma, head->offs + offsetof(ehci_qh_t, qh_link),
1989 	    sizeof(head->qh.qh_link), BUS_DMASYNC_PREWRITE);
1990 
1991 #ifdef EHCI_DEBUG
1992 	ehci_dump_sqh(sqh);
1993 #endif
1994 }
1995 
1996 /*
1997  * Remove an ED from the schedule.  Called with USB lock held.
1998  */
1999 Static void
2000 ehci_rem_qh(ehci_softc_t *sc, ehci_soft_qh_t *sqh, ehci_soft_qh_t *head)
2001 {
2002 	ehci_soft_qh_t *p;
2003 
2004 	KASSERT(mutex_owned(&sc->sc_lock));
2005 
2006 	/* XXX */
2007 	for (p = head; p != NULL && p->next != sqh; p = p->next)
2008 		;
2009 	if (p == NULL)
2010 		panic("ehci_rem_qh: ED not found");
2011 	usb_syncmem(&sqh->dma, sqh->offs + offsetof(ehci_qh_t, qh_link),
2012 	    sizeof(sqh->qh.qh_link), BUS_DMASYNC_POSTWRITE);
2013 	p->next = sqh->next;
2014 	p->qh.qh_link = sqh->qh.qh_link;
2015 	usb_syncmem(&p->dma, p->offs + offsetof(ehci_qh_t, qh_link),
2016 	    sizeof(p->qh.qh_link), BUS_DMASYNC_PREWRITE);
2017 
2018 	ehci_sync_hc(sc);
2019 }
2020 
2021 Static void
2022 ehci_set_qh_qtd(ehci_soft_qh_t *sqh, ehci_soft_qtd_t *sqtd)
2023 {
2024 	int i;
2025 	u_int32_t status;
2026 
2027 	/* Save toggle bit and ping status. */
2028 	usb_syncmem(&sqh->dma, sqh->offs, sizeof(sqh->qh),
2029 	    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
2030 	status = sqh->qh.qh_qtd.qtd_status &
2031 	    htole32(EHCI_QTD_TOGGLE_MASK |
2032 		    EHCI_QTD_SET_STATUS(EHCI_QTD_PINGSTATE));
2033 	/* Set HALTED to make hw leave it alone. */
2034 	sqh->qh.qh_qtd.qtd_status =
2035 	    htole32(EHCI_QTD_SET_STATUS(EHCI_QTD_HALTED));
2036 	usb_syncmem(&sqh->dma,
2037 	    sqh->offs + offsetof(ehci_qh_t, qh_qtd.qtd_status),
2038 	    sizeof(sqh->qh.qh_qtd.qtd_status),
2039 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
2040 	sqh->qh.qh_curqtd = 0;
2041 	sqh->qh.qh_qtd.qtd_next = htole32(sqtd->physaddr);
2042 	sqh->qh.qh_qtd.qtd_altnext = EHCI_NULL;
2043 	for (i = 0; i < EHCI_QTD_NBUFFERS; i++)
2044 		sqh->qh.qh_qtd.qtd_buffer[i] = 0;
2045 	sqh->sqtd = sqtd;
2046 	usb_syncmem(&sqh->dma, sqh->offs, sizeof(sqh->qh),
2047 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
2048 	/* Set !HALTED && !ACTIVE to start execution, preserve some fields */
2049 	sqh->qh.qh_qtd.qtd_status = status;
2050 	usb_syncmem(&sqh->dma,
2051 	    sqh->offs + offsetof(ehci_qh_t, qh_qtd.qtd_status),
2052 	    sizeof(sqh->qh.qh_qtd.qtd_status),
2053 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
2054 }
2055 
2056 /*
2057  * Ensure that the HC has released all references to the QH.  We do this
2058  * by asking for a Async Advance Doorbell interrupt and then we wait for
2059  * the interrupt.
2060  * To make this easier we first obtain exclusive use of the doorbell.
2061  */
2062 Static void
2063 ehci_sync_hc(ehci_softc_t *sc)
2064 {
2065 	int error __diagused;
2066 
2067 	KASSERT(mutex_owned(&sc->sc_lock));
2068 
2069 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
2070 
2071 	if (sc->sc_dying) {
2072 		USBHIST_LOG(ehcidebug, "dying", 0, 0, 0, 0);
2073 		return;
2074 	}
2075 	/* ask for doorbell */
2076 	EOWRITE4(sc, EHCI_USBCMD, EOREAD4(sc, EHCI_USBCMD) | EHCI_CMD_IAAD);
2077 	USBHIST_LOG(ehcidebug, "cmd = 0x%08x sts = 0x%08x",
2078 		    EOREAD4(sc, EHCI_USBCMD), EOREAD4(sc, EHCI_USBSTS), 0, 0);
2079 
2080 	error = cv_timedwait(&sc->sc_doorbell, &sc->sc_lock, hz); /* bell wait */
2081 
2082 	USBHIST_LOG(ehcidebug, "cmd = 0x%08x sts = 0x%08x",
2083 		    EOREAD4(sc, EHCI_USBCMD), EOREAD4(sc, EHCI_USBSTS), 0, 0);
2084 #ifdef DIAGNOSTIC
2085 	if (error)
2086 		printf("ehci_sync_hc: cv_timedwait() = %d\n", error);
2087 #endif
2088 }
2089 
2090 Static void
2091 ehci_rem_free_itd_chain(ehci_softc_t *sc, struct ehci_xfer *exfer)
2092 {
2093 	struct ehci_soft_itd *itd, *prev;
2094 
2095 	prev = NULL;
2096 
2097 	if (exfer->itdstart == NULL || exfer->itdend == NULL)
2098 		panic("ehci isoc xfer being freed, but with no itd chain");
2099 
2100 	for (itd = exfer->itdstart; itd != NULL; itd = itd->xfer_next) {
2101 		prev = itd->u.frame_list.prev;
2102 		/* Unlink itd from hardware chain, or frame array */
2103 		if (prev == NULL) { /* We're at the table head */
2104 			sc->sc_softitds[itd->slot] = itd->u.frame_list.next;
2105 			sc->sc_flist[itd->slot] = itd->itd.itd_next;
2106 			usb_syncmem(&sc->sc_fldma,
2107 			    sizeof(ehci_link_t) * itd->slot,
2108                 	    sizeof(ehci_link_t),
2109 			    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
2110 
2111 			if (itd->u.frame_list.next != NULL)
2112 				itd->u.frame_list.next->u.frame_list.prev = NULL;
2113 		} else {
2114 			/* XXX this part is untested... */
2115 			prev->itd.itd_next = itd->itd.itd_next;
2116 			usb_syncmem(&itd->dma,
2117 			    itd->offs + offsetof(ehci_itd_t, itd_next),
2118                 	    sizeof(itd->itd.itd_next), BUS_DMASYNC_PREWRITE);
2119 
2120 			prev->u.frame_list.next = itd->u.frame_list.next;
2121 			if (itd->u.frame_list.next != NULL)
2122 				itd->u.frame_list.next->u.frame_list.prev = prev;
2123 		}
2124 	}
2125 
2126 	prev = NULL;
2127 	for (itd = exfer->itdstart; itd != NULL; itd = itd->xfer_next) {
2128 		if (prev != NULL)
2129 			ehci_free_itd(sc, prev);
2130 		prev = itd;
2131 	}
2132 	if (prev)
2133 		ehci_free_itd(sc, prev);
2134 	exfer->itdstart = NULL;
2135 	exfer->itdend = NULL;
2136 }
2137 
2138 /***********/
2139 
2140 /*
2141  * Data structures and routines to emulate the root hub.
2142  */
2143 Static usb_device_descriptor_t ehci_devd = {
2144 	USB_DEVICE_DESCRIPTOR_SIZE,
2145 	UDESC_DEVICE,		/* type */
2146 	{0x00, 0x02},		/* USB version */
2147 	UDCLASS_HUB,		/* class */
2148 	UDSUBCLASS_HUB,		/* subclass */
2149 	UDPROTO_HSHUBSTT,	/* protocol */
2150 	64,			/* max packet */
2151 	{0},{0},{0x00,0x01},	/* device id */
2152 	1,2,0,			/* string indicies */
2153 	1			/* # of configurations */
2154 };
2155 
2156 Static const usb_device_qualifier_t ehci_odevd = {
2157 	USB_DEVICE_DESCRIPTOR_SIZE,
2158 	UDESC_DEVICE_QUALIFIER,	/* type */
2159 	{0x00, 0x02},		/* USB version */
2160 	UDCLASS_HUB,		/* class */
2161 	UDSUBCLASS_HUB,		/* subclass */
2162 	UDPROTO_FSHUB,		/* protocol */
2163 	64,			/* max packet */
2164 	1,			/* # of configurations */
2165 	0
2166 };
2167 
2168 Static const usb_config_descriptor_t ehci_confd = {
2169 	USB_CONFIG_DESCRIPTOR_SIZE,
2170 	UDESC_CONFIG,
2171 	{USB_CONFIG_DESCRIPTOR_SIZE +
2172 	 USB_INTERFACE_DESCRIPTOR_SIZE +
2173 	 USB_ENDPOINT_DESCRIPTOR_SIZE},
2174 	1,
2175 	1,
2176 	0,
2177 	UC_ATTR_MBO | UC_SELF_POWERED,
2178 	0			/* max power */
2179 };
2180 
2181 Static const usb_interface_descriptor_t ehci_ifcd = {
2182 	USB_INTERFACE_DESCRIPTOR_SIZE,
2183 	UDESC_INTERFACE,
2184 	0,
2185 	0,
2186 	1,
2187 	UICLASS_HUB,
2188 	UISUBCLASS_HUB,
2189 	UIPROTO_HSHUBSTT,
2190 	0
2191 };
2192 
2193 Static const usb_endpoint_descriptor_t ehci_endpd = {
2194 	USB_ENDPOINT_DESCRIPTOR_SIZE,
2195 	UDESC_ENDPOINT,
2196 	UE_DIR_IN | EHCI_INTR_ENDPT,
2197 	UE_INTERRUPT,
2198 	{8, 0},			/* max packet */
2199 	12
2200 };
2201 
2202 Static const usb_hub_descriptor_t ehci_hubd = {
2203 	USB_HUB_DESCRIPTOR_SIZE,
2204 	UDESC_HUB,
2205 	0,
2206 	{0,0},
2207 	0,
2208 	0,
2209 	{""},
2210 	{""},
2211 };
2212 
2213 /*
2214  * Simulate a hardware hub by handling all the necessary requests.
2215  */
2216 Static usbd_status
2217 ehci_root_ctrl_transfer(usbd_xfer_handle xfer)
2218 {
2219 	ehci_softc_t *sc = xfer->pipe->device->bus->hci_private;
2220 	usbd_status err;
2221 
2222 	/* Insert last in queue. */
2223 	mutex_enter(&sc->sc_lock);
2224 	err = usb_insert_transfer(xfer);
2225 	mutex_exit(&sc->sc_lock);
2226 	if (err)
2227 		return (err);
2228 
2229 	/* Pipe isn't running, start first */
2230 	return (ehci_root_ctrl_start(SIMPLEQ_FIRST(&xfer->pipe->queue)));
2231 }
2232 
2233 Static usbd_status
2234 ehci_root_ctrl_start(usbd_xfer_handle xfer)
2235 {
2236 	ehci_softc_t *sc = xfer->pipe->device->bus->hci_private;
2237 	usb_device_request_t *req;
2238 	void *buf = NULL;
2239 	int port, i;
2240 	int len, value, index, l, totlen = 0;
2241 	usb_port_status_t ps;
2242 	usb_hub_descriptor_t hubd;
2243 	usbd_status err;
2244 	u_int32_t v;
2245 
2246 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
2247 
2248 	if (sc->sc_dying)
2249 		return (USBD_IOERROR);
2250 
2251 #ifdef DIAGNOSTIC
2252 	if (!(xfer->rqflags & URQ_REQUEST))
2253 		/* XXX panic */
2254 		return (USBD_INVAL);
2255 #endif
2256 	req = &xfer->request;
2257 
2258 	USBHIST_LOG(ehcidebug, "type=0x%02x request=%02x",
2259 		    req->bmRequestType, req->bRequest, 0, 0);
2260 
2261 	len = UGETW(req->wLength);
2262 	value = UGETW(req->wValue);
2263 	index = UGETW(req->wIndex);
2264 
2265 	if (len != 0)
2266 		buf = KERNADDR(&xfer->dmabuf, 0);
2267 
2268 #define C(x,y) ((x) | ((y) << 8))
2269 	switch(C(req->bRequest, req->bmRequestType)) {
2270 	case C(UR_CLEAR_FEATURE, UT_WRITE_DEVICE):
2271 	case C(UR_CLEAR_FEATURE, UT_WRITE_INTERFACE):
2272 	case C(UR_CLEAR_FEATURE, UT_WRITE_ENDPOINT):
2273 		/*
2274 		 * DEVICE_REMOTE_WAKEUP and ENDPOINT_HALT are no-ops
2275 		 * for the integrated root hub.
2276 		 */
2277 		break;
2278 	case C(UR_GET_CONFIG, UT_READ_DEVICE):
2279 		if (len > 0) {
2280 			*(u_int8_t *)buf = sc->sc_conf;
2281 			totlen = 1;
2282 		}
2283 		break;
2284 	case C(UR_GET_DESCRIPTOR, UT_READ_DEVICE):
2285 		USBHIST_LOG(ehcidebug, "wValue=0x%04x", value, 0, 0, 0);
2286 		if (len == 0)
2287 			break;
2288 		switch(value >> 8) {
2289 		case UDESC_DEVICE:
2290 			if ((value & 0xff) != 0) {
2291 				err = USBD_IOERROR;
2292 				goto ret;
2293 			}
2294 			totlen = l = min(len, USB_DEVICE_DESCRIPTOR_SIZE);
2295 			USETW(ehci_devd.idVendor, sc->sc_id_vendor);
2296 			memcpy(buf, &ehci_devd, l);
2297 			break;
2298 		/*
2299 		 * We can't really operate at another speed, but the spec says
2300 		 * we need this descriptor.
2301 		 */
2302 		case UDESC_DEVICE_QUALIFIER:
2303 			if ((value & 0xff) != 0) {
2304 				err = USBD_IOERROR;
2305 				goto ret;
2306 			}
2307 			totlen = l = min(len, USB_DEVICE_DESCRIPTOR_SIZE);
2308 			memcpy(buf, &ehci_odevd, l);
2309 			break;
2310 		/*
2311 		 * We can't really operate at another speed, but the spec says
2312 		 * we need this descriptor.
2313 		 */
2314 		case UDESC_OTHER_SPEED_CONFIGURATION:
2315 		case UDESC_CONFIG:
2316 			if ((value & 0xff) != 0) {
2317 				err = USBD_IOERROR;
2318 				goto ret;
2319 			}
2320 			totlen = l = min(len, USB_CONFIG_DESCRIPTOR_SIZE);
2321 			memcpy(buf, &ehci_confd, l);
2322 			((usb_config_descriptor_t *)buf)->bDescriptorType =
2323 				value >> 8;
2324 			buf = (char *)buf + l;
2325 			len -= l;
2326 			l = min(len, USB_INTERFACE_DESCRIPTOR_SIZE);
2327 			totlen += l;
2328 			memcpy(buf, &ehci_ifcd, l);
2329 			buf = (char *)buf + l;
2330 			len -= l;
2331 			l = min(len, USB_ENDPOINT_DESCRIPTOR_SIZE);
2332 			totlen += l;
2333 			memcpy(buf, &ehci_endpd, l);
2334 			break;
2335 		case UDESC_STRING:
2336 #define sd ((usb_string_descriptor_t *)buf)
2337 			switch (value & 0xff) {
2338 			case 0: /* Language table */
2339 				totlen = usb_makelangtbl(sd, len);
2340 				break;
2341 			case 1: /* Vendor */
2342 				totlen = usb_makestrdesc(sd, len,
2343 							 sc->sc_vendor);
2344 				break;
2345 			case 2: /* Product */
2346 				totlen = usb_makestrdesc(sd, len,
2347 							 "EHCI root hub");
2348 				break;
2349 			}
2350 #undef sd
2351 			break;
2352 		default:
2353 			err = USBD_IOERROR;
2354 			goto ret;
2355 		}
2356 		break;
2357 	case C(UR_GET_INTERFACE, UT_READ_INTERFACE):
2358 		if (len > 0) {
2359 			*(u_int8_t *)buf = 0;
2360 			totlen = 1;
2361 		}
2362 		break;
2363 	case C(UR_GET_STATUS, UT_READ_DEVICE):
2364 		if (len > 1) {
2365 			USETW(((usb_status_t *)buf)->wStatus,UDS_SELF_POWERED);
2366 			totlen = 2;
2367 		}
2368 		break;
2369 	case C(UR_GET_STATUS, UT_READ_INTERFACE):
2370 	case C(UR_GET_STATUS, UT_READ_ENDPOINT):
2371 		if (len > 1) {
2372 			USETW(((usb_status_t *)buf)->wStatus, 0);
2373 			totlen = 2;
2374 		}
2375 		break;
2376 	case C(UR_SET_ADDRESS, UT_WRITE_DEVICE):
2377 		if (value >= USB_MAX_DEVICES) {
2378 			err = USBD_IOERROR;
2379 			goto ret;
2380 		}
2381 		sc->sc_addr = value;
2382 		break;
2383 	case C(UR_SET_CONFIG, UT_WRITE_DEVICE):
2384 		if (value != 0 && value != 1) {
2385 			err = USBD_IOERROR;
2386 			goto ret;
2387 		}
2388 		sc->sc_conf = value;
2389 		break;
2390 	case C(UR_SET_DESCRIPTOR, UT_WRITE_DEVICE):
2391 		break;
2392 	case C(UR_SET_FEATURE, UT_WRITE_DEVICE):
2393 	case C(UR_SET_FEATURE, UT_WRITE_INTERFACE):
2394 	case C(UR_SET_FEATURE, UT_WRITE_ENDPOINT):
2395 		err = USBD_IOERROR;
2396 		goto ret;
2397 	case C(UR_SET_INTERFACE, UT_WRITE_INTERFACE):
2398 		break;
2399 	case C(UR_SYNCH_FRAME, UT_WRITE_ENDPOINT):
2400 		break;
2401 	/* Hub requests */
2402 	case C(UR_CLEAR_FEATURE, UT_WRITE_CLASS_DEVICE):
2403 		break;
2404 	case C(UR_CLEAR_FEATURE, UT_WRITE_CLASS_OTHER):
2405 		USBHIST_LOG(ehcidebug,
2406 		    "UR_CLEAR_PORT_FEATURE port=%d feature=%d", index, value,
2407 		    0, 0);
2408 		if (index < 1 || index > sc->sc_noport) {
2409 			err = USBD_IOERROR;
2410 			goto ret;
2411 		}
2412 		port = EHCI_PORTSC(index);
2413 		v = EOREAD4(sc, port);
2414 		USBHIST_LOG(ehcidebug, "portsc=0x%08x", v, 0, 0, 0);
2415 		v &= ~EHCI_PS_CLEAR;
2416 		switch(value) {
2417 		case UHF_PORT_ENABLE:
2418 			EOWRITE4(sc, port, v &~ EHCI_PS_PE);
2419 			break;
2420 		case UHF_PORT_SUSPEND:
2421 			if (!(v & EHCI_PS_SUSP)) /* not suspended */
2422 				break;
2423 			v &= ~EHCI_PS_SUSP;
2424 			EOWRITE4(sc, port, v | EHCI_PS_FPR);
2425 			/* see USB2 spec ch. 7.1.7.7 */
2426 			usb_delay_ms(&sc->sc_bus, 20);
2427 			EOWRITE4(sc, port, v);
2428 			usb_delay_ms(&sc->sc_bus, 2);
2429 #ifdef DEBUG
2430 			v = EOREAD4(sc, port);
2431 			if (v & (EHCI_PS_FPR | EHCI_PS_SUSP))
2432 				printf("ehci: resume failed: %x\n", v);
2433 #endif
2434 			break;
2435 		case UHF_PORT_POWER:
2436 			if (sc->sc_hasppc)
2437 				EOWRITE4(sc, port, v &~ EHCI_PS_PP);
2438 			break;
2439 		case UHF_PORT_TEST:
2440 			USBHIST_LOG(ehcidebug, "clear port test "
2441 				    "%d", index, 0, 0, 0);
2442 			break;
2443 		case UHF_PORT_INDICATOR:
2444 			USBHIST_LOG(ehcidebug, "clear port ind "
2445 				    "%d", index, 0, 0, 0);
2446 			EOWRITE4(sc, port, v &~ EHCI_PS_PIC);
2447 			break;
2448 		case UHF_C_PORT_CONNECTION:
2449 			EOWRITE4(sc, port, v | EHCI_PS_CSC);
2450 			break;
2451 		case UHF_C_PORT_ENABLE:
2452 			EOWRITE4(sc, port, v | EHCI_PS_PEC);
2453 			break;
2454 		case UHF_C_PORT_SUSPEND:
2455 			/* how? */
2456 			break;
2457 		case UHF_C_PORT_OVER_CURRENT:
2458 			EOWRITE4(sc, port, v | EHCI_PS_OCC);
2459 			break;
2460 		case UHF_C_PORT_RESET:
2461 			sc->sc_isreset[index] = 0;
2462 			break;
2463 		default:
2464 			err = USBD_IOERROR;
2465 			goto ret;
2466 		}
2467 #if 0
2468 		switch(value) {
2469 		case UHF_C_PORT_CONNECTION:
2470 		case UHF_C_PORT_ENABLE:
2471 		case UHF_C_PORT_SUSPEND:
2472 		case UHF_C_PORT_OVER_CURRENT:
2473 		case UHF_C_PORT_RESET:
2474 		default:
2475 			break;
2476 		}
2477 #endif
2478 		break;
2479 	case C(UR_GET_DESCRIPTOR, UT_READ_CLASS_DEVICE):
2480 		if (len == 0)
2481 			break;
2482 		if ((value & 0xff) != 0) {
2483 			err = USBD_IOERROR;
2484 			goto ret;
2485 		}
2486 		hubd = ehci_hubd;
2487 		hubd.bNbrPorts = sc->sc_noport;
2488 		v = EOREAD4(sc, EHCI_HCSPARAMS);
2489 		USETW(hubd.wHubCharacteristics,
2490 		    EHCI_HCS_PPC(v) ? UHD_PWR_INDIVIDUAL : UHD_PWR_NO_SWITCH |
2491 		    EHCI_HCS_P_INDICATOR(EREAD4(sc, EHCI_HCSPARAMS))
2492 			? UHD_PORT_IND : 0);
2493 		hubd.bPwrOn2PwrGood = 200; /* XXX can't find out? */
2494 		for (i = 0, l = sc->sc_noport; l > 0; i++, l -= 8, v >>= 8)
2495 			hubd.DeviceRemovable[i++] = 0; /* XXX can't find out? */
2496 		hubd.bDescLength = USB_HUB_DESCRIPTOR_SIZE + i;
2497 		l = min(len, hubd.bDescLength);
2498 		totlen = l;
2499 		memcpy(buf, &hubd, l);
2500 		break;
2501 	case C(UR_GET_STATUS, UT_READ_CLASS_DEVICE):
2502 		if (len != 4) {
2503 			err = USBD_IOERROR;
2504 			goto ret;
2505 		}
2506 		memset(buf, 0, len); /* ? XXX */
2507 		totlen = len;
2508 		break;
2509 	case C(UR_GET_STATUS, UT_READ_CLASS_OTHER):
2510 		USBHIST_LOG(ehcidebug, "get port status i=%d", index, 0, 0, 0);
2511 		if (index < 1 || index > sc->sc_noport) {
2512 			err = USBD_IOERROR;
2513 			goto ret;
2514 		}
2515 		if (len != 4) {
2516 			err = USBD_IOERROR;
2517 			goto ret;
2518 		}
2519 		v = EOREAD4(sc, EHCI_PORTSC(index));
2520 		USBHIST_LOG(ehcidebug, "port status=0x%04x", v, 0, 0, 0);
2521 
2522 		i = UPS_HIGH_SPEED;
2523 		if (sc->sc_flags & EHCIF_ETTF) {
2524 			/*
2525 			 * If we are doing embedded transaction translation,
2526 			 * then directly attached LS/FS devices are reset by
2527 			 * the EHCI controller itself.  PSPD is encoded
2528 			 * the same way as in USBSTATUS.
2529 			 */
2530 			i = __SHIFTOUT(v, EHCI_PS_PSPD) * UPS_LOW_SPEED;
2531 		}
2532 		if (v & EHCI_PS_CS)	i |= UPS_CURRENT_CONNECT_STATUS;
2533 		if (v & EHCI_PS_PE)	i |= UPS_PORT_ENABLED;
2534 		if (v & EHCI_PS_SUSP)	i |= UPS_SUSPEND;
2535 		if (v & EHCI_PS_OCA)	i |= UPS_OVERCURRENT_INDICATOR;
2536 		if (v & EHCI_PS_PR)	i |= UPS_RESET;
2537 		if (v & EHCI_PS_PP)	i |= UPS_PORT_POWER;
2538 		if (sc->sc_vendor_port_status)
2539 			i = sc->sc_vendor_port_status(sc, v, i);
2540 		USETW(ps.wPortStatus, i);
2541 		i = 0;
2542 		if (v & EHCI_PS_CSC)	i |= UPS_C_CONNECT_STATUS;
2543 		if (v & EHCI_PS_PEC)	i |= UPS_C_PORT_ENABLED;
2544 		if (v & EHCI_PS_OCC)	i |= UPS_C_OVERCURRENT_INDICATOR;
2545 		if (sc->sc_isreset[index]) i |= UPS_C_PORT_RESET;
2546 		USETW(ps.wPortChange, i);
2547 		l = min(len, sizeof ps);
2548 		memcpy(buf, &ps, l);
2549 		totlen = l;
2550 		break;
2551 	case C(UR_SET_DESCRIPTOR, UT_WRITE_CLASS_DEVICE):
2552 		err = USBD_IOERROR;
2553 		goto ret;
2554 	case C(UR_SET_FEATURE, UT_WRITE_CLASS_DEVICE):
2555 		break;
2556 	case C(UR_SET_FEATURE, UT_WRITE_CLASS_OTHER):
2557 		if (index < 1 || index > sc->sc_noport) {
2558 			err = USBD_IOERROR;
2559 			goto ret;
2560 		}
2561 		port = EHCI_PORTSC(index);
2562 		v = EOREAD4(sc, port);
2563 		USBHIST_LOG(ehcidebug, "portsc=0x%08x", v, 0, 0, 0);
2564 		v &= ~EHCI_PS_CLEAR;
2565 		switch(value) {
2566 		case UHF_PORT_ENABLE:
2567 			EOWRITE4(sc, port, v | EHCI_PS_PE);
2568 			break;
2569 		case UHF_PORT_SUSPEND:
2570 			EOWRITE4(sc, port, v | EHCI_PS_SUSP);
2571 			break;
2572 		case UHF_PORT_RESET:
2573 			USBHIST_LOG(ehcidebug, "reset port %d", index, 0, 0, 0);
2574 			if (EHCI_PS_IS_LOWSPEED(v)
2575 			    && sc->sc_ncomp > 0
2576 			    && !(sc->sc_flags & EHCIF_ETTF)) {
2577 				/*
2578 				 * Low speed device on non-ETTF controller or
2579 				 * unaccompanied controller, give up ownership.
2580 				 */
2581 				ehci_disown(sc, index, 1);
2582 				break;
2583 			}
2584 			/* Start reset sequence. */
2585 			v &= ~ (EHCI_PS_PE | EHCI_PS_PR);
2586 			EOWRITE4(sc, port, v | EHCI_PS_PR);
2587 			/* Wait for reset to complete. */
2588 			usb_delay_ms(&sc->sc_bus, USB_PORT_ROOT_RESET_DELAY);
2589 			if (sc->sc_dying) {
2590 				err = USBD_IOERROR;
2591 				goto ret;
2592 			}
2593 			/*
2594 			 * An embedded transaction translator will automatically
2595 			 * terminate the reset sequence so there's no need to
2596 			 * it.
2597 			 */
2598 			v = EOREAD4(sc, port);
2599 			if (v & EHCI_PS_PR) {
2600 				/* Terminate reset sequence. */
2601 				EOWRITE4(sc, port, v & ~EHCI_PS_PR);
2602 				/* Wait for HC to complete reset. */
2603 				usb_delay_ms(&sc->sc_bus,
2604 				    EHCI_PORT_RESET_COMPLETE);
2605 				if (sc->sc_dying) {
2606 					err = USBD_IOERROR;
2607 					goto ret;
2608 				}
2609 			}
2610 
2611 			v = EOREAD4(sc, port);
2612 			USBHIST_LOG(ehcidebug,
2613 			    "ehci after reset, status=0x%08x", v, 0, 0, 0);
2614 			if (v & EHCI_PS_PR) {
2615 				printf("%s: port reset timeout\n",
2616 				       device_xname(sc->sc_dev));
2617 				return (USBD_TIMEOUT);
2618 			}
2619 			if (!(v & EHCI_PS_PE)) {
2620 				/* Not a high speed device, give up ownership.*/
2621 				ehci_disown(sc, index, 0);
2622 				break;
2623 			}
2624 			sc->sc_isreset[index] = 1;
2625 			USBHIST_LOG(ehcidebug,
2626 			    "ehci port %d reset, status = 0x%08x", index, v, 0,
2627 			    0);
2628 			break;
2629 		case UHF_PORT_POWER:
2630 			USBHIST_LOG(ehcidebug,
2631 			    "set port power %d (has PPC = %d)", index,
2632 			    sc->sc_hasppc, 0, 0);
2633 			if (sc->sc_hasppc)
2634 				EOWRITE4(sc, port, v | EHCI_PS_PP);
2635 			break;
2636 		case UHF_PORT_TEST:
2637 			USBHIST_LOG(ehcidebug, "set port test %d",
2638 				index, 0, 0, 0);
2639 			break;
2640 		case UHF_PORT_INDICATOR:
2641 			USBHIST_LOG(ehcidebug, "set port ind %d",
2642 				index, 0, 0, 0);
2643 			EOWRITE4(sc, port, v | EHCI_PS_PIC);
2644 			break;
2645 		default:
2646 			err = USBD_IOERROR;
2647 			goto ret;
2648 		}
2649 		break;
2650 	case C(UR_CLEAR_TT_BUFFER, UT_WRITE_CLASS_OTHER):
2651 	case C(UR_RESET_TT, UT_WRITE_CLASS_OTHER):
2652 	case C(UR_GET_TT_STATE, UT_READ_CLASS_OTHER):
2653 	case C(UR_STOP_TT, UT_WRITE_CLASS_OTHER):
2654 		break;
2655 	default:
2656 		err = USBD_IOERROR;
2657 		goto ret;
2658 	}
2659 	xfer->actlen = totlen;
2660 	err = USBD_NORMAL_COMPLETION;
2661  ret:
2662 	mutex_enter(&sc->sc_lock);
2663 	xfer->status = err;
2664 	usb_transfer_complete(xfer);
2665 	mutex_exit(&sc->sc_lock);
2666 	return (USBD_IN_PROGRESS);
2667 }
2668 
2669 Static void
2670 ehci_disown(ehci_softc_t *sc, int index, int lowspeed)
2671 {
2672 	int port;
2673 	u_int32_t v;
2674 
2675 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
2676 
2677 	USBHIST_LOG(ehcidebug, "index=%d lowspeed=%d", index, lowspeed, 0, 0);
2678 #ifdef DIAGNOSTIC
2679 	if (sc->sc_npcomp != 0) {
2680 		int i = (index-1) / sc->sc_npcomp;
2681 		if (i >= sc->sc_ncomp)
2682 			printf("%s: strange port\n",
2683 			       device_xname(sc->sc_dev));
2684 		else
2685 			printf("%s: handing over %s speed device on "
2686 			       "port %d to %s\n",
2687 			       device_xname(sc->sc_dev),
2688 			       lowspeed ? "low" : "full",
2689 			       index, device_xname(sc->sc_comps[i]));
2690 	} else {
2691 		printf("%s: npcomp == 0\n", device_xname(sc->sc_dev));
2692 	}
2693 #endif
2694 	port = EHCI_PORTSC(index);
2695 	v = EOREAD4(sc, port) &~ EHCI_PS_CLEAR;
2696 	EOWRITE4(sc, port, v | EHCI_PS_PO);
2697 }
2698 
2699 /* Abort a root control request. */
2700 Static void
2701 ehci_root_ctrl_abort(usbd_xfer_handle xfer)
2702 {
2703 	/* Nothing to do, all transfers are synchronous. */
2704 }
2705 
2706 /* Close the root pipe. */
2707 Static void
2708 ehci_root_ctrl_close(usbd_pipe_handle pipe)
2709 {
2710 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
2711 	/* Nothing to do. */
2712 }
2713 
2714 Static void
2715 ehci_root_ctrl_done(usbd_xfer_handle xfer)
2716 {
2717 	xfer->hcpriv = NULL;
2718 }
2719 
2720 Static usbd_status
2721 ehci_root_intr_transfer(usbd_xfer_handle xfer)
2722 {
2723 	ehci_softc_t *sc = xfer->pipe->device->bus->hci_private;
2724 	usbd_status err;
2725 
2726 	/* Insert last in queue. */
2727 	mutex_enter(&sc->sc_lock);
2728 	err = usb_insert_transfer(xfer);
2729 	mutex_exit(&sc->sc_lock);
2730 	if (err)
2731 		return (err);
2732 
2733 	/* Pipe isn't running, start first */
2734 	return (ehci_root_intr_start(SIMPLEQ_FIRST(&xfer->pipe->queue)));
2735 }
2736 
2737 Static usbd_status
2738 ehci_root_intr_start(usbd_xfer_handle xfer)
2739 {
2740 	usbd_pipe_handle pipe = xfer->pipe;
2741 	ehci_softc_t *sc = pipe->device->bus->hci_private;
2742 
2743 	if (sc->sc_dying)
2744 		return (USBD_IOERROR);
2745 
2746 	mutex_enter(&sc->sc_lock);
2747 	sc->sc_intrxfer = xfer;
2748 	mutex_exit(&sc->sc_lock);
2749 
2750 	return (USBD_IN_PROGRESS);
2751 }
2752 
2753 /* Abort a root interrupt request. */
2754 Static void
2755 ehci_root_intr_abort(usbd_xfer_handle xfer)
2756 {
2757 	ehci_softc_t *sc = xfer->pipe->device->bus->hci_private;
2758 
2759 	KASSERT(mutex_owned(&sc->sc_lock));
2760 	KASSERT(xfer->pipe->intrxfer == xfer);
2761 
2762 	sc->sc_intrxfer = NULL;
2763 
2764 	xfer->status = USBD_CANCELLED;
2765 	usb_transfer_complete(xfer);
2766 }
2767 
2768 /* Close the root pipe. */
2769 Static void
2770 ehci_root_intr_close(usbd_pipe_handle pipe)
2771 {
2772 	ehci_softc_t *sc = pipe->device->bus->hci_private;
2773 
2774 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
2775 
2776 	KASSERT(mutex_owned(&sc->sc_lock));
2777 
2778 	sc->sc_intrxfer = NULL;
2779 }
2780 
2781 Static void
2782 ehci_root_intr_done(usbd_xfer_handle xfer)
2783 {
2784 	xfer->hcpriv = NULL;
2785 }
2786 
2787 /************************/
2788 
2789 Static ehci_soft_qh_t *
2790 ehci_alloc_sqh(ehci_softc_t *sc)
2791 {
2792 	ehci_soft_qh_t *sqh;
2793 	usbd_status err;
2794 	int i, offs;
2795 	usb_dma_t dma;
2796 
2797 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
2798 
2799 	if (sc->sc_freeqhs == NULL) {
2800 		USBHIST_LOG(ehcidebug, "allocating chunk", 0, 0, 0, 0);
2801 		err = usb_allocmem(&sc->sc_bus, EHCI_SQH_SIZE * EHCI_SQH_CHUNK,
2802 			  EHCI_PAGE_SIZE, &dma);
2803 #ifdef EHCI_DEBUG
2804 		if (err)
2805 			printf("ehci_alloc_sqh: usb_allocmem()=%d\n", err);
2806 #endif
2807 		if (err)
2808 			return (NULL);
2809 		for(i = 0; i < EHCI_SQH_CHUNK; i++) {
2810 			offs = i * EHCI_SQH_SIZE;
2811 			sqh = KERNADDR(&dma, offs);
2812 			sqh->physaddr = DMAADDR(&dma, offs);
2813 			sqh->dma = dma;
2814 			sqh->offs = offs;
2815 			sqh->next = sc->sc_freeqhs;
2816 			sc->sc_freeqhs = sqh;
2817 		}
2818 	}
2819 	sqh = sc->sc_freeqhs;
2820 	sc->sc_freeqhs = sqh->next;
2821 	memset(&sqh->qh, 0, sizeof(ehci_qh_t));
2822 	sqh->next = NULL;
2823 	return (sqh);
2824 }
2825 
2826 Static void
2827 ehci_free_sqh(ehci_softc_t *sc, ehci_soft_qh_t *sqh)
2828 {
2829 	sqh->next = sc->sc_freeqhs;
2830 	sc->sc_freeqhs = sqh;
2831 }
2832 
2833 Static ehci_soft_qtd_t *
2834 ehci_alloc_sqtd(ehci_softc_t *sc)
2835 {
2836 	ehci_soft_qtd_t *sqtd = NULL;
2837 	usbd_status err;
2838 	int i, offs;
2839 	usb_dma_t dma;
2840 
2841 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
2842 
2843 	if (sc->sc_freeqtds == NULL) {
2844 		USBHIST_LOG(ehcidebug, "allocating chunk", 0, 0, 0, 0);
2845 
2846 		err = usb_allocmem(&sc->sc_bus, EHCI_SQTD_SIZE*EHCI_SQTD_CHUNK,
2847 			  EHCI_PAGE_SIZE, &dma);
2848 #ifdef EHCI_DEBUG
2849 		if (err)
2850 			printf("ehci_alloc_sqtd: usb_allocmem()=%d\n", err);
2851 #endif
2852 		if (err)
2853 			goto done;
2854 
2855 		for(i = 0; i < EHCI_SQTD_CHUNK; i++) {
2856 			offs = i * EHCI_SQTD_SIZE;
2857 			sqtd = KERNADDR(&dma, offs);
2858 			sqtd->physaddr = DMAADDR(&dma, offs);
2859 			sqtd->dma = dma;
2860 			sqtd->offs = offs;
2861 
2862 			sqtd->nextqtd = sc->sc_freeqtds;
2863 			sc->sc_freeqtds = sqtd;
2864 		}
2865 	}
2866 
2867 	sqtd = sc->sc_freeqtds;
2868 	sc->sc_freeqtds = sqtd->nextqtd;
2869 	memset(&sqtd->qtd, 0, sizeof(ehci_qtd_t));
2870 	sqtd->nextqtd = NULL;
2871 	sqtd->xfer = NULL;
2872 
2873 done:
2874 	return (sqtd);
2875 }
2876 
2877 Static void
2878 ehci_free_sqtd(ehci_softc_t *sc, ehci_soft_qtd_t *sqtd)
2879 {
2880 
2881 	KASSERT(sc->sc_bus.use_polling || mutex_owned(&sc->sc_lock));
2882 
2883 	sqtd->nextqtd = sc->sc_freeqtds;
2884 	sc->sc_freeqtds = sqtd;
2885 }
2886 
2887 Static usbd_status
2888 ehci_alloc_sqtd_chain(struct ehci_pipe *epipe, ehci_softc_t *sc,
2889 		     int alen, int rd, usbd_xfer_handle xfer,
2890 		     ehci_soft_qtd_t **sp, ehci_soft_qtd_t **ep)
2891 {
2892 	ehci_soft_qtd_t *next, *cur;
2893 	ehci_physaddr_t nextphys;
2894 	u_int32_t qtdstatus;
2895 	int len, curlen, mps;
2896 	int i, tog;
2897 	int pages, pageoffs;
2898 	bus_size_t curoffs;
2899 	vaddr_t va, va_offs;
2900 	usb_dma_t *dma = &xfer->dmabuf;
2901 	u_int16_t flags = xfer->flags;
2902 	paddr_t a;
2903 
2904 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
2905 
2906 	USBHIST_LOG(ehcidebug, "start len=%d", alen, 0, 0, 0);
2907 
2908 	len = alen;
2909 	qtdstatus = EHCI_QTD_ACTIVE |
2910 	    EHCI_QTD_SET_PID(rd ? EHCI_QTD_PID_IN : EHCI_QTD_PID_OUT) |
2911 	    EHCI_QTD_SET_CERR(3)
2912 	    /* IOC set below */
2913 	    /* BYTES set below */
2914 	    ;
2915 	mps = UGETW(epipe->pipe.endpoint->edesc->wMaxPacketSize);
2916 	tog = epipe->nexttoggle;
2917 	qtdstatus |= EHCI_QTD_SET_TOGGLE(tog);
2918 
2919 	cur = ehci_alloc_sqtd(sc);
2920 	*sp = cur;
2921 	if (cur == NULL)
2922 		goto nomem;
2923 
2924 	usb_syncmem(dma, 0, alen,
2925 	    rd ? BUS_DMASYNC_PREREAD : BUS_DMASYNC_PREWRITE);
2926 	curoffs = 0;
2927 	for (;;) {
2928 		/* The EHCI hardware can handle at most 5 pages. */
2929 		va_offs = (vaddr_t)KERNADDR(dma, curoffs);
2930 		va_offs = EHCI_PAGE_OFFSET(va_offs);
2931 		if (len-curoffs < EHCI_QTD_NBUFFERS*EHCI_PAGE_SIZE - va_offs) {
2932 			/* we can handle it in this QTD */
2933 			curlen = len - curoffs;
2934 		} else {
2935 			/* must use multiple TDs, fill as much as possible. */
2936 			curlen = EHCI_QTD_NBUFFERS * EHCI_PAGE_SIZE - va_offs;
2937 
2938 			/* the length must be a multiple of the max size */
2939 			curlen -= curlen % mps;
2940 			USBHIST_LOG(ehcidebug, "multiple QTDs, "
2941 				    "curlen=%d", curlen, 0, 0, 0);
2942 #ifdef DIAGNOSTIC
2943 			if (curlen == 0)
2944 				panic("ehci_alloc_sqtd_chain: curlen == 0");
2945 #endif
2946 		}
2947 		USBHIST_LOG(ehcidebug, "len=%d curlen=%d curoffs=%zu",
2948 			len, curlen, (size_t)curoffs, 0);
2949 
2950 		/*
2951 		 * Allocate another transfer if there's more data left,
2952 		 * or if force last short transfer flag is set and we're
2953 		 * allocating a multiple of the max packet size.
2954 		 */
2955 
2956 		if (curoffs + curlen != len ||
2957 		    ((curlen % mps) == 0 && !rd && curlen != 0 &&
2958 		     (flags & USBD_FORCE_SHORT_XFER))) {
2959 			next = ehci_alloc_sqtd(sc);
2960 			if (next == NULL)
2961 				goto nomem;
2962 			nextphys = htole32(next->physaddr);
2963 		} else {
2964 			next = NULL;
2965 			nextphys = EHCI_NULL;
2966 		}
2967 
2968 		/* Find number of pages we'll be using, insert dma addresses */
2969 		pages = EHCI_PAGE(curlen + EHCI_PAGE_SIZE -1) >> 12;
2970 		KASSERT(pages <= EHCI_QTD_NBUFFERS);
2971 		pageoffs = EHCI_PAGE(curoffs);
2972 		for (i = 0; i < pages; i++) {
2973 			a = DMAADDR(dma, pageoffs + i * EHCI_PAGE_SIZE);
2974 			cur->qtd.qtd_buffer[i] = htole32(a & 0xFFFFF000);
2975 			/* Cast up to avoid compiler warnings */
2976 			cur->qtd.qtd_buffer_hi[i] = htole32((uint64_t)a >> 32);
2977 		}
2978 
2979 		/* First buffer pointer requires a page offset to start at */
2980 		va = (vaddr_t)KERNADDR(dma, curoffs);
2981 		cur->qtd.qtd_buffer[0] |= htole32(EHCI_PAGE_OFFSET(va));
2982 
2983 		cur->nextqtd = next;
2984 		cur->qtd.qtd_next = cur->qtd.qtd_altnext = nextphys;
2985 		cur->qtd.qtd_status =
2986 		    htole32(qtdstatus | EHCI_QTD_SET_BYTES(curlen));
2987 		cur->xfer = xfer;
2988 		cur->len = curlen;
2989 
2990 		USBHIST_LOG(ehcidebug, "cbp=0x%08zx end=0x%08zx",
2991 		    (size_t)curoffs, (size_t)(curoffs + curlen), 0, 0);
2992 
2993 		/* adjust the toggle based on the number of packets in this
2994 		   qtd */
2995 		if (((curlen + mps - 1) / mps) & 1) {
2996 			tog ^= 1;
2997 			qtdstatus ^= EHCI_QTD_TOGGLE_MASK;
2998 		}
2999 		if (next == NULL)
3000 			break;
3001 		usb_syncmem(&cur->dma, cur->offs, sizeof(cur->qtd),
3002 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
3003 		USBHIST_LOG(ehcidebug, "extend chain", 0, 0, 0, 0);
3004 		if (len)
3005 			curoffs += curlen;
3006 		cur = next;
3007 	}
3008 	cur->qtd.qtd_status |= htole32(EHCI_QTD_IOC);
3009 	usb_syncmem(&cur->dma, cur->offs, sizeof(cur->qtd),
3010 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
3011 	*ep = cur;
3012 	epipe->nexttoggle = tog;
3013 
3014 	USBHIST_LOG(ehcidebug, "return sqtd=%p sqtdend=%p",
3015 	    *sp, *ep, 0, 0);
3016 
3017 	return (USBD_NORMAL_COMPLETION);
3018 
3019  nomem:
3020 	/* XXX free chain */
3021 	USBHIST_LOG(ehcidebug, "no memory", 0, 0, 0, 0);
3022 	return (USBD_NOMEM);
3023 }
3024 
3025 Static void
3026 ehci_free_sqtd_chain(ehci_softc_t *sc, ehci_soft_qtd_t *sqtd,
3027 		    ehci_soft_qtd_t *sqtdend)
3028 {
3029 	ehci_soft_qtd_t *p;
3030 	int i;
3031 
3032 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
3033 
3034 	USBHIST_LOG(ehcidebug, "sqtd=%p sqtdend=%p",
3035 	    sqtd, sqtdend, 0, 0);
3036 
3037 	for (i = 0; sqtd != sqtdend; sqtd = p, i++) {
3038 		p = sqtd->nextqtd;
3039 		ehci_free_sqtd(sc, sqtd);
3040 	}
3041 }
3042 
3043 Static ehci_soft_itd_t *
3044 ehci_alloc_itd(ehci_softc_t *sc)
3045 {
3046 	struct ehci_soft_itd *itd, *freeitd;
3047 	usbd_status err;
3048 	int i, offs, frindex, previndex;
3049 	usb_dma_t dma;
3050 
3051 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
3052 
3053 	mutex_enter(&sc->sc_lock);
3054 
3055 	/* Find an itd that wasn't freed this frame or last frame. This can
3056 	 * discard itds that were freed before frindex wrapped around
3057 	 * XXX - can this lead to thrashing? Could fix by enabling wrap-around
3058 	 *       interrupt and fiddling with list when that happens */
3059 	frindex = (EOREAD4(sc, EHCI_FRINDEX) + 1) >> 3;
3060 	previndex = (frindex != 0) ? frindex - 1 : sc->sc_flsize;
3061 
3062 	freeitd = NULL;
3063 	LIST_FOREACH(itd, &sc->sc_freeitds, u.free_list) {
3064 		if (itd == NULL)
3065 			break;
3066 		if (itd->slot != frindex && itd->slot != previndex) {
3067 			freeitd = itd;
3068 			break;
3069 		}
3070 	}
3071 
3072 	if (freeitd == NULL) {
3073 		USBHIST_LOG(ehcidebug, "allocating chunk", 0, 0, 0, 0);
3074 		err = usb_allocmem(&sc->sc_bus, EHCI_ITD_SIZE * EHCI_ITD_CHUNK,
3075 				EHCI_PAGE_SIZE, &dma);
3076 
3077 		if (err) {
3078 			USBHIST_LOG(ehcidebug,
3079 			    "alloc returned %d", err, 0, 0, 0);
3080 			mutex_exit(&sc->sc_lock);
3081 			return NULL;
3082 		}
3083 
3084 		for (i = 0; i < EHCI_ITD_CHUNK; i++) {
3085 			offs = i * EHCI_ITD_SIZE;
3086 			itd = KERNADDR(&dma, offs);
3087 			itd->physaddr = DMAADDR(&dma, offs);
3088 	 		itd->dma = dma;
3089 			itd->offs = offs;
3090 			LIST_INSERT_HEAD(&sc->sc_freeitds, itd, u.free_list);
3091 		}
3092 		freeitd = LIST_FIRST(&sc->sc_freeitds);
3093 	}
3094 
3095 	itd = freeitd;
3096 	LIST_REMOVE(itd, u.free_list);
3097 	memset(&itd->itd, 0, sizeof(ehci_itd_t));
3098 	usb_syncmem(&itd->dma, itd->offs + offsetof(ehci_itd_t, itd_next),
3099                     sizeof(itd->itd.itd_next), BUS_DMASYNC_PREWRITE |
3100                     BUS_DMASYNC_PREREAD);
3101 
3102 	itd->u.frame_list.next = NULL;
3103 	itd->u.frame_list.prev = NULL;
3104 	itd->xfer_next = NULL;
3105 	itd->slot = 0;
3106 
3107 	mutex_exit(&sc->sc_lock);
3108 
3109 	return itd;
3110 }
3111 
3112 Static void
3113 ehci_free_itd(ehci_softc_t *sc, ehci_soft_itd_t *itd)
3114 {
3115 
3116 	KASSERT(mutex_owned(&sc->sc_lock));
3117 
3118 	LIST_INSERT_HEAD(&sc->sc_freeitds, itd, u.free_list);
3119 }
3120 
3121 /****************/
3122 
3123 /*
3124  * Close a reqular pipe.
3125  * Assumes that there are no pending transactions.
3126  */
3127 Static void
3128 ehci_close_pipe(usbd_pipe_handle pipe, ehci_soft_qh_t *head)
3129 {
3130 	struct ehci_pipe *epipe = (struct ehci_pipe *)pipe;
3131 	ehci_softc_t *sc = pipe->device->bus->hci_private;
3132 	ehci_soft_qh_t *sqh = epipe->sqh;
3133 
3134 	KASSERT(mutex_owned(&sc->sc_lock));
3135 
3136 	ehci_rem_qh(sc, sqh, head);
3137 	ehci_free_sqh(sc, epipe->sqh);
3138 }
3139 
3140 /*
3141  * Abort a device request.
3142  * If this routine is called at splusb() it guarantees that the request
3143  * will be removed from the hardware scheduling and that the callback
3144  * for it will be called with USBD_CANCELLED status.
3145  * It's impossible to guarantee that the requested transfer will not
3146  * have happened since the hardware runs concurrently.
3147  * If the transaction has already happened we rely on the ordinary
3148  * interrupt processing to process it.
3149  * XXX This is most probably wrong.
3150  * XXXMRG this doesn't make sense anymore.
3151  */
3152 Static void
3153 ehci_abort_xfer(usbd_xfer_handle xfer, usbd_status status)
3154 {
3155 #define exfer EXFER(xfer)
3156 	struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
3157 	ehci_softc_t *sc = epipe->pipe.device->bus->hci_private;
3158 	ehci_soft_qh_t *sqh = epipe->sqh;
3159 	ehci_soft_qtd_t *sqtd;
3160 	ehci_physaddr_t cur;
3161 	u_int32_t qhstatus;
3162 	int hit;
3163 	int wake;
3164 
3165 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
3166 
3167 	USBHIST_LOG(ehcidebug, "xfer=%p pipe=%p", xfer, epipe, 0, 0);
3168 
3169 	KASSERT(mutex_owned(&sc->sc_lock));
3170 
3171 	if (sc->sc_dying) {
3172 		/* If we're dying, just do the software part. */
3173 		xfer->status = status;	/* make software ignore it */
3174 		callout_stop(&xfer->timeout_handle);
3175 		usb_transfer_complete(xfer);
3176 		return;
3177 	}
3178 
3179 	if (cpu_intr_p() || cpu_softintr_p())
3180 		panic("ehci_abort_xfer: not in process context");
3181 
3182 	/*
3183 	 * If an abort is already in progress then just wait for it to
3184 	 * complete and return.
3185 	 */
3186 	if (xfer->hcflags & UXFER_ABORTING) {
3187 		USBHIST_LOG(ehcidebug, "already aborting", 0, 0, 0, 0);
3188 #ifdef DIAGNOSTIC
3189 		if (status == USBD_TIMEOUT)
3190 			printf("ehci_abort_xfer: TIMEOUT while aborting\n");
3191 #endif
3192 		/* Override the status which might be USBD_TIMEOUT. */
3193 		xfer->status = status;
3194 		USBHIST_LOG(ehcidebug, "waiting for abort to finish",
3195 			0, 0, 0, 0);
3196 		xfer->hcflags |= UXFER_ABORTWAIT;
3197 		while (xfer->hcflags & UXFER_ABORTING)
3198 			cv_wait(&xfer->hccv, &sc->sc_lock);
3199 		return;
3200 	}
3201 	xfer->hcflags |= UXFER_ABORTING;
3202 
3203 	/*
3204 	 * Step 1: Make interrupt routine and hardware ignore xfer.
3205 	 */
3206 	xfer->status = status;	/* make software ignore it */
3207 	callout_stop(&xfer->timeout_handle);
3208 
3209 	usb_syncmem(&sqh->dma,
3210 	    sqh->offs + offsetof(ehci_qh_t, qh_qtd.qtd_status),
3211 	    sizeof(sqh->qh.qh_qtd.qtd_status),
3212 	    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
3213 	qhstatus = sqh->qh.qh_qtd.qtd_status;
3214 	sqh->qh.qh_qtd.qtd_status = qhstatus | htole32(EHCI_QTD_HALTED);
3215 	usb_syncmem(&sqh->dma,
3216 	    sqh->offs + offsetof(ehci_qh_t, qh_qtd.qtd_status),
3217 	    sizeof(sqh->qh.qh_qtd.qtd_status),
3218 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
3219 	for (sqtd = exfer->sqtdstart; ; sqtd = sqtd->nextqtd) {
3220 		usb_syncmem(&sqtd->dma,
3221 		    sqtd->offs + offsetof(ehci_qtd_t, qtd_status),
3222 		    sizeof(sqtd->qtd.qtd_status),
3223 		    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
3224 		sqtd->qtd.qtd_status |= htole32(EHCI_QTD_HALTED);
3225 		usb_syncmem(&sqtd->dma,
3226 		    sqtd->offs + offsetof(ehci_qtd_t, qtd_status),
3227 		    sizeof(sqtd->qtd.qtd_status),
3228 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
3229 		if (sqtd == exfer->sqtdend)
3230 			break;
3231 	}
3232 
3233 	/*
3234 	 * Step 2: Wait until we know hardware has finished any possible
3235 	 * use of the xfer.  Also make sure the soft interrupt routine
3236 	 * has run.
3237 	 */
3238 	ehci_sync_hc(sc);
3239 	sc->sc_softwake = 1;
3240 	usb_schedsoftintr(&sc->sc_bus);
3241 	cv_wait(&sc->sc_softwake_cv, &sc->sc_lock);
3242 
3243 	/*
3244 	 * Step 3: Remove any vestiges of the xfer from the hardware.
3245 	 * The complication here is that the hardware may have executed
3246 	 * beyond the xfer we're trying to abort.  So as we're scanning
3247 	 * the TDs of this xfer we check if the hardware points to
3248 	 * any of them.
3249 	 */
3250 
3251 	usb_syncmem(&sqh->dma,
3252 	    sqh->offs + offsetof(ehci_qh_t, qh_curqtd),
3253 	    sizeof(sqh->qh.qh_curqtd),
3254 	    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
3255 	cur = EHCI_LINK_ADDR(le32toh(sqh->qh.qh_curqtd));
3256 	hit = 0;
3257 	for (sqtd = exfer->sqtdstart; ; sqtd = sqtd->nextqtd) {
3258 		hit |= cur == sqtd->physaddr;
3259 		if (sqtd == exfer->sqtdend)
3260 			break;
3261 	}
3262 	sqtd = sqtd->nextqtd;
3263 	/* Zap curqtd register if hardware pointed inside the xfer. */
3264 	if (hit && sqtd != NULL) {
3265 		USBHIST_LOG(ehcidebug, "cur=0x%08x", sqtd->physaddr, 0, 0, 0);
3266 		sqh->qh.qh_curqtd = htole32(sqtd->physaddr); /* unlink qTDs */
3267 		usb_syncmem(&sqh->dma,
3268 		    sqh->offs + offsetof(ehci_qh_t, qh_curqtd),
3269 		    sizeof(sqh->qh.qh_curqtd),
3270 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
3271 		sqh->qh.qh_qtd.qtd_status = qhstatus;
3272 		usb_syncmem(&sqh->dma,
3273 		    sqh->offs + offsetof(ehci_qh_t, qh_qtd.qtd_status),
3274 		    sizeof(sqh->qh.qh_qtd.qtd_status),
3275 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
3276 	} else {
3277 		USBHIST_LOG(ehcidebug, "no hit", 0, 0, 0, 0);
3278 	}
3279 
3280 	/*
3281 	 * Step 4: Execute callback.
3282 	 */
3283 #ifdef DIAGNOSTIC
3284 	exfer->isdone = 1;
3285 #endif
3286 	wake = xfer->hcflags & UXFER_ABORTWAIT;
3287 	xfer->hcflags &= ~(UXFER_ABORTING | UXFER_ABORTWAIT);
3288 	usb_transfer_complete(xfer);
3289 	if (wake) {
3290 		cv_broadcast(&xfer->hccv);
3291 	}
3292 
3293 	KASSERT(mutex_owned(&sc->sc_lock));
3294 #undef exfer
3295 }
3296 
3297 Static void
3298 ehci_abort_isoc_xfer(usbd_xfer_handle xfer, usbd_status status)
3299 {
3300 	ehci_isoc_trans_t trans_status;
3301 	struct ehci_pipe *epipe;
3302 	struct ehci_xfer *exfer;
3303 	ehci_softc_t *sc;
3304 	struct ehci_soft_itd *itd;
3305 	int i, wake;
3306 
3307 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
3308 
3309 	epipe = (struct ehci_pipe *) xfer->pipe;
3310 	exfer = EXFER(xfer);
3311 	sc = epipe->pipe.device->bus->hci_private;
3312 
3313 	USBHIST_LOG(ehcidebug, "xfer %p pipe %p", xfer, epipe, 0, 0);
3314 
3315 	KASSERT(mutex_owned(&sc->sc_lock));
3316 
3317 	if (sc->sc_dying) {
3318 		xfer->status = status;
3319 		callout_stop(&xfer->timeout_handle);
3320 		usb_transfer_complete(xfer);
3321 		return;
3322 	}
3323 
3324 	if (xfer->hcflags & UXFER_ABORTING) {
3325 		USBHIST_LOG(ehcidebug, "already aborting", 0, 0, 0, 0);
3326 
3327 #ifdef DIAGNOSTIC
3328 		if (status == USBD_TIMEOUT)
3329 			printf("ehci_abort_isoc_xfer: TIMEOUT while aborting\n");
3330 #endif
3331 
3332 		xfer->status = status;
3333 		USBHIST_LOG(ehcidebug,
3334 		    "waiting for abort to finish", 0, 0, 0, 0);
3335 		xfer->hcflags |= UXFER_ABORTWAIT;
3336 		while (xfer->hcflags & UXFER_ABORTING)
3337 			cv_wait(&xfer->hccv, &sc->sc_lock);
3338 		goto done;
3339 	}
3340 	xfer->hcflags |= UXFER_ABORTING;
3341 
3342 	xfer->status = status;
3343 	callout_stop(&xfer->timeout_handle);
3344 
3345 	for (itd = exfer->itdstart; itd != NULL; itd = itd->xfer_next) {
3346 		usb_syncmem(&itd->dma,
3347 		    itd->offs + offsetof(ehci_itd_t, itd_ctl),
3348 		    sizeof(itd->itd.itd_ctl),
3349 		    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
3350 
3351 		for (i = 0; i < 8; i++) {
3352 			trans_status = le32toh(itd->itd.itd_ctl[i]);
3353 			trans_status &= ~EHCI_ITD_ACTIVE;
3354 			itd->itd.itd_ctl[i] = htole32(trans_status);
3355 		}
3356 
3357 		usb_syncmem(&itd->dma,
3358 		    itd->offs + offsetof(ehci_itd_t, itd_ctl),
3359 		    sizeof(itd->itd.itd_ctl),
3360 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
3361 	}
3362 
3363         sc->sc_softwake = 1;
3364         usb_schedsoftintr(&sc->sc_bus);
3365 	cv_wait(&sc->sc_softwake_cv, &sc->sc_lock);
3366 
3367 #ifdef DIAGNOSTIC
3368 	exfer->isdone = 1;
3369 #endif
3370 	wake = xfer->hcflags & UXFER_ABORTWAIT;
3371 	xfer->hcflags &= ~(UXFER_ABORTING | UXFER_ABORTWAIT);
3372 	usb_transfer_complete(xfer);
3373 	if (wake) {
3374 		cv_broadcast(&xfer->hccv);
3375 	}
3376 
3377 done:
3378 	KASSERT(mutex_owned(&sc->sc_lock));
3379 	return;
3380 }
3381 
3382 Static void
3383 ehci_timeout(void *addr)
3384 {
3385 	struct ehci_xfer *exfer = addr;
3386 	struct ehci_pipe *epipe = (struct ehci_pipe *)exfer->xfer.pipe;
3387 	ehci_softc_t *sc = epipe->pipe.device->bus->hci_private;
3388 
3389 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
3390 
3391 	USBHIST_LOG(ehcidebug, "exfer %p", exfer, 0, 0, 0);
3392 #ifdef EHCI_DEBUG
3393 	if (ehcidebug > 1)
3394 		usbd_dump_pipe(exfer->xfer.pipe);
3395 #endif
3396 
3397 	if (sc->sc_dying) {
3398 		mutex_enter(&sc->sc_lock);
3399 		ehci_abort_xfer(&exfer->xfer, USBD_TIMEOUT);
3400 		mutex_exit(&sc->sc_lock);
3401 		return;
3402 	}
3403 
3404 	/* Execute the abort in a process context. */
3405 	usb_init_task(&exfer->abort_task, ehci_timeout_task, addr,
3406 	    USB_TASKQ_MPSAFE);
3407 	usb_add_task(exfer->xfer.pipe->device, &exfer->abort_task,
3408 	    USB_TASKQ_HC);
3409 }
3410 
3411 Static void
3412 ehci_timeout_task(void *addr)
3413 {
3414 	usbd_xfer_handle xfer = addr;
3415 	ehci_softc_t *sc = xfer->pipe->device->bus->hci_private;
3416 
3417 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
3418 
3419 	USBHIST_LOG(ehcidebug, "xfer=%p", xfer, 0, 0, 0);
3420 
3421 	mutex_enter(&sc->sc_lock);
3422 	ehci_abort_xfer(xfer, USBD_TIMEOUT);
3423 	mutex_exit(&sc->sc_lock);
3424 }
3425 
3426 /************************/
3427 
3428 Static usbd_status
3429 ehci_device_ctrl_transfer(usbd_xfer_handle xfer)
3430 {
3431 	ehci_softc_t *sc = xfer->pipe->device->bus->hci_private;
3432 	usbd_status err;
3433 
3434 	/* Insert last in queue. */
3435 	mutex_enter(&sc->sc_lock);
3436 	err = usb_insert_transfer(xfer);
3437 	mutex_exit(&sc->sc_lock);
3438 	if (err)
3439 		return (err);
3440 
3441 	/* Pipe isn't running, start first */
3442 	return (ehci_device_ctrl_start(SIMPLEQ_FIRST(&xfer->pipe->queue)));
3443 }
3444 
3445 Static usbd_status
3446 ehci_device_ctrl_start(usbd_xfer_handle xfer)
3447 {
3448 	ehci_softc_t *sc = xfer->pipe->device->bus->hci_private;
3449 	usbd_status err;
3450 
3451 	if (sc->sc_dying)
3452 		return (USBD_IOERROR);
3453 
3454 #ifdef DIAGNOSTIC
3455 	if (!(xfer->rqflags & URQ_REQUEST)) {
3456 		/* XXX panic */
3457 		printf("ehci_device_ctrl_transfer: not a request\n");
3458 		return (USBD_INVAL);
3459 	}
3460 #endif
3461 
3462 	err = ehci_device_request(xfer);
3463 	if (err) {
3464 		return (err);
3465 	}
3466 
3467 	if (sc->sc_bus.use_polling)
3468 		ehci_waitintr(sc, xfer);
3469 
3470 	return (USBD_IN_PROGRESS);
3471 }
3472 
3473 Static void
3474 ehci_device_ctrl_done(usbd_xfer_handle xfer)
3475 {
3476 	struct ehci_xfer *ex = EXFER(xfer);
3477 	ehci_softc_t *sc = xfer->pipe->device->bus->hci_private;
3478 	struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
3479 	usb_device_request_t *req = &xfer->request;
3480 	int len = UGETW(req->wLength);
3481 	int rd = req->bmRequestType & UT_READ;
3482 
3483 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
3484 
3485 	USBHIST_LOG(ehcidebug, "xfer=%p", xfer, 0, 0, 0);
3486 
3487 	KASSERT(sc->sc_bus.use_polling || mutex_owned(&sc->sc_lock));
3488 
3489 #ifdef DIAGNOSTIC
3490 	if (!(xfer->rqflags & URQ_REQUEST)) {
3491 		panic("ehci_ctrl_done: not a request");
3492 	}
3493 #endif
3494 
3495 	if (xfer->status != USBD_NOMEM && ehci_active_intr_list(ex)) {
3496 		ehci_del_intr_list(sc, ex);	/* remove from active list */
3497 		ehci_free_sqtd_chain(sc, ex->sqtdstart, NULL);
3498 		usb_syncmem(&epipe->u.ctl.reqdma, 0, sizeof *req,
3499 		    BUS_DMASYNC_POSTWRITE);
3500 		if (len)
3501 			usb_syncmem(&xfer->dmabuf, 0, len,
3502 			    rd ? BUS_DMASYNC_POSTREAD : BUS_DMASYNC_POSTWRITE);
3503 	}
3504 
3505 	USBHIST_LOG(ehcidebug, "length=%d", xfer->actlen, 0, 0, 0);
3506 }
3507 
3508 /* Abort a device control request. */
3509 Static void
3510 ehci_device_ctrl_abort(usbd_xfer_handle xfer)
3511 {
3512 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
3513 
3514 	USBHIST_LOG(ehcidebug, "xfer=%p", xfer, 0, 0, 0);
3515 	ehci_abort_xfer(xfer, USBD_CANCELLED);
3516 }
3517 
3518 /* Close a device control pipe. */
3519 Static void
3520 ehci_device_ctrl_close(usbd_pipe_handle pipe)
3521 {
3522 	ehci_softc_t *sc = pipe->device->bus->hci_private;
3523 	/*struct ehci_pipe *epipe = (struct ehci_pipe *)pipe;*/
3524 
3525 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
3526 
3527 	KASSERT(mutex_owned(&sc->sc_lock));
3528 
3529 	USBHIST_LOG(ehcidebug, "pipe=%p", pipe, 0, 0, 0);
3530 
3531 	ehci_close_pipe(pipe, sc->sc_async_head);
3532 }
3533 
3534 Static usbd_status
3535 ehci_device_request(usbd_xfer_handle xfer)
3536 {
3537 #define exfer EXFER(xfer)
3538 	struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
3539 	usb_device_request_t *req = &xfer->request;
3540 	usbd_device_handle dev = epipe->pipe.device;
3541 	ehci_softc_t *sc = dev->bus->hci_private;
3542 	ehci_soft_qtd_t *setup, *stat, *next;
3543 	ehci_soft_qh_t *sqh;
3544 	int isread;
3545 	int len;
3546 	usbd_status err;
3547 
3548 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
3549 
3550 	isread = req->bmRequestType & UT_READ;
3551 	len = UGETW(req->wLength);
3552 
3553 	USBHIST_LOG(ehcidebug, "type=0x%02x, request=0x%02x, "
3554 	    "wValue=0x%04x, wIndex=0x%04x",
3555 	    req->bmRequestType, req->bRequest, UGETW(req->wValue),
3556 	    UGETW(req->wIndex));
3557 	USBHIST_LOG(ehcidebug, "len=%d, addr=%d, endpt=%d",
3558 	    len, dev->address,
3559 	    epipe->pipe.endpoint->edesc->bEndpointAddress, 0);
3560 
3561 	setup = ehci_alloc_sqtd(sc);
3562 	if (setup == NULL) {
3563 		err = USBD_NOMEM;
3564 		goto bad1;
3565 	}
3566 	stat = ehci_alloc_sqtd(sc);
3567 	if (stat == NULL) {
3568 		err = USBD_NOMEM;
3569 		goto bad2;
3570 	}
3571 
3572 	mutex_enter(&sc->sc_lock);
3573 
3574 	sqh = epipe->sqh;
3575 
3576 	KASSERTMSG(EHCI_QH_GET_ADDR(le32toh(sqh->qh.qh_endp)) == dev->address,
3577 	    "address QH %d pipe %d\n",
3578 	    EHCI_QH_GET_ADDR(le32toh(sqh->qh.qh_endp)), dev->address);
3579 	KASSERTMSG(EHCI_QH_GET_MPL(le32toh(sqh->qh.qh_endp)) ==
3580 	    UGETW(epipe->pipe.endpoint->edesc->wMaxPacketSize),
3581 	    "MPS QH %d pipe %d\n",
3582 	    EHCI_QH_GET_MPL(le32toh(sqh->qh.qh_endp)),
3583 	    UGETW(epipe->pipe.endpoint->edesc->wMaxPacketSize));
3584 
3585 	/* Set up data transaction */
3586 	if (len != 0) {
3587 		ehci_soft_qtd_t *end;
3588 
3589 		/* Start toggle at 1. */
3590 		epipe->nexttoggle = 1;
3591 		err = ehci_alloc_sqtd_chain(epipe, sc, len, isread, xfer,
3592 			  &next, &end);
3593 		if (err)
3594 			goto bad3;
3595 		end->qtd.qtd_status &= htole32(~EHCI_QTD_IOC);
3596 		end->nextqtd = stat;
3597 		end->qtd.qtd_next = end->qtd.qtd_altnext =
3598 		    htole32(stat->physaddr);
3599 		usb_syncmem(&end->dma, end->offs, sizeof(end->qtd),
3600 		   BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
3601 	} else {
3602 		next = stat;
3603 	}
3604 
3605 	memcpy(KERNADDR(&epipe->u.ctl.reqdma, 0), req, sizeof *req);
3606 	usb_syncmem(&epipe->u.ctl.reqdma, 0, sizeof *req, BUS_DMASYNC_PREWRITE);
3607 
3608 	/* Clear toggle */
3609 	setup->qtd.qtd_status = htole32(
3610 	    EHCI_QTD_ACTIVE |
3611 	    EHCI_QTD_SET_PID(EHCI_QTD_PID_SETUP) |
3612 	    EHCI_QTD_SET_CERR(3) |
3613 	    EHCI_QTD_SET_TOGGLE(0) |
3614 	    EHCI_QTD_SET_BYTES(sizeof *req)
3615 	    );
3616 	setup->qtd.qtd_buffer[0] = htole32(DMAADDR(&epipe->u.ctl.reqdma, 0));
3617 	setup->qtd.qtd_buffer_hi[0] = 0;
3618 	setup->nextqtd = next;
3619 	setup->qtd.qtd_next = setup->qtd.qtd_altnext = htole32(next->physaddr);
3620 	setup->xfer = xfer;
3621 	setup->len = sizeof *req;
3622 	usb_syncmem(&setup->dma, setup->offs, sizeof(setup->qtd),
3623 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
3624 
3625 	stat->qtd.qtd_status = htole32(
3626 	    EHCI_QTD_ACTIVE |
3627 	    EHCI_QTD_SET_PID(isread ? EHCI_QTD_PID_OUT : EHCI_QTD_PID_IN) |
3628 	    EHCI_QTD_SET_CERR(3) |
3629 	    EHCI_QTD_SET_TOGGLE(1) |
3630 	    EHCI_QTD_IOC
3631 	    );
3632 	stat->qtd.qtd_buffer[0] = 0; /* XXX not needed? */
3633 	stat->qtd.qtd_buffer_hi[0] = 0; /* XXX not needed? */
3634 	stat->nextqtd = NULL;
3635 	stat->qtd.qtd_next = stat->qtd.qtd_altnext = EHCI_NULL;
3636 	stat->xfer = xfer;
3637 	stat->len = 0;
3638 	usb_syncmem(&stat->dma, stat->offs, sizeof(stat->qtd),
3639 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
3640 
3641 #ifdef EHCI_DEBUG
3642 	USBHIST_LOGN(ehcidebug, 5, "dump:", 0, 0, 0, 0);
3643 	ehci_dump_sqh(sqh);
3644 	ehci_dump_sqtds(setup);
3645 #endif
3646 
3647 	exfer->sqtdstart = setup;
3648 	exfer->sqtdend = stat;
3649 #ifdef DIAGNOSTIC
3650 	if (!exfer->isdone) {
3651 		printf("ehci_device_request: not done, exfer=%p\n", exfer);
3652 	}
3653 	exfer->isdone = 0;
3654 #endif
3655 
3656 	/* Insert qTD in QH list. */
3657 	ehci_set_qh_qtd(sqh, setup); /* also does usb_syncmem(sqh) */
3658 	if (xfer->timeout && !sc->sc_bus.use_polling) {
3659 		callout_reset(&xfer->timeout_handle, mstohz(xfer->timeout),
3660 		    ehci_timeout, xfer);
3661 	}
3662 	ehci_add_intr_list(sc, exfer);
3663 	xfer->status = USBD_IN_PROGRESS;
3664 	mutex_exit(&sc->sc_lock);
3665 
3666 #ifdef EHCI_DEBUG
3667 	USBHIST_LOGN(ehcidebug, 10, "status=%x, dump:",
3668 	    EOREAD4(sc, EHCI_USBSTS), 0, 0, 0);
3669 //	delay(10000);
3670 	ehci_dump_regs(sc);
3671 	ehci_dump_sqh(sc->sc_async_head);
3672 	ehci_dump_sqh(sqh);
3673 	ehci_dump_sqtds(setup);
3674 #endif
3675 
3676 	return (USBD_NORMAL_COMPLETION);
3677 
3678  bad3:
3679 	mutex_exit(&sc->sc_lock);
3680 	ehci_free_sqtd(sc, stat);
3681  bad2:
3682 	ehci_free_sqtd(sc, setup);
3683  bad1:
3684 	USBHIST_LOG(ehcidebug, "no memory", 0, 0, 0, 0);
3685 	mutex_enter(&sc->sc_lock);
3686 	xfer->status = err;
3687 	usb_transfer_complete(xfer);
3688 	mutex_exit(&sc->sc_lock);
3689 	return (err);
3690 #undef exfer
3691 }
3692 
3693 /*
3694  * Some EHCI chips from VIA seem to trigger interrupts before writing back the
3695  * qTD status, or miss signalling occasionally under heavy load.  If the host
3696  * machine is too fast, we we can miss transaction completion - when we scan
3697  * the active list the transaction still seems to be active.  This generally
3698  * exhibits itself as a umass stall that never recovers.
3699  *
3700  * We work around this behaviour by setting up this callback after any softintr
3701  * that completes with transactions still pending, giving us another chance to
3702  * check for completion after the writeback has taken place.
3703  */
3704 Static void
3705 ehci_intrlist_timeout(void *arg)
3706 {
3707 	ehci_softc_t *sc = arg;
3708 
3709 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
3710 
3711 	usb_schedsoftintr(&sc->sc_bus);
3712 }
3713 
3714 /************************/
3715 
3716 Static usbd_status
3717 ehci_device_bulk_transfer(usbd_xfer_handle xfer)
3718 {
3719 	ehci_softc_t *sc = xfer->pipe->device->bus->hci_private;
3720 	usbd_status err;
3721 
3722 	/* Insert last in queue. */
3723 	mutex_enter(&sc->sc_lock);
3724 	err = usb_insert_transfer(xfer);
3725 	mutex_exit(&sc->sc_lock);
3726 	if (err)
3727 		return (err);
3728 
3729 	/* Pipe isn't running, start first */
3730 	return (ehci_device_bulk_start(SIMPLEQ_FIRST(&xfer->pipe->queue)));
3731 }
3732 
3733 Static usbd_status
3734 ehci_device_bulk_start(usbd_xfer_handle xfer)
3735 {
3736 #define exfer EXFER(xfer)
3737 	struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
3738 	usbd_device_handle dev = epipe->pipe.device;
3739 	ehci_softc_t *sc = dev->bus->hci_private;
3740 	ehci_soft_qtd_t *data, *dataend;
3741 	ehci_soft_qh_t *sqh;
3742 	usbd_status err;
3743 	int len, isread, endpt;
3744 
3745 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
3746 
3747 	USBHIST_LOG(ehcidebug, "xfer=%p len=%d flags=%d",
3748 	    xfer, xfer->length, xfer->flags, 0);
3749 
3750 	if (sc->sc_dying)
3751 		return (USBD_IOERROR);
3752 
3753 #ifdef DIAGNOSTIC
3754 	if (xfer->rqflags & URQ_REQUEST)
3755 		panic("ehci_device_bulk_start: a request");
3756 #endif
3757 
3758 	mutex_enter(&sc->sc_lock);
3759 
3760 	len = xfer->length;
3761 	endpt = epipe->pipe.endpoint->edesc->bEndpointAddress;
3762 	isread = UE_GET_DIR(endpt) == UE_DIR_IN;
3763 	sqh = epipe->sqh;
3764 
3765 	epipe->u.bulk.length = len;
3766 
3767 	err = ehci_alloc_sqtd_chain(epipe, sc, len, isread, xfer, &data,
3768 				   &dataend);
3769 	if (err) {
3770 		USBHIST_LOG(ehcidebug, "no memory", 0, 0, 0, 0);
3771 		xfer->status = err;
3772 		usb_transfer_complete(xfer);
3773 		mutex_exit(&sc->sc_lock);
3774 		return (err);
3775 	}
3776 
3777 #ifdef EHCI_DEBUG
3778 	USBHIST_LOGN(ehcidebug, 5, "data(1):", 0, 0, 0, 0);
3779 	ehci_dump_sqh(sqh);
3780 	ehci_dump_sqtds(data);
3781 #endif
3782 
3783 	/* Set up interrupt info. */
3784 	exfer->sqtdstart = data;
3785 	exfer->sqtdend = dataend;
3786 #ifdef DIAGNOSTIC
3787 	if (!exfer->isdone) {
3788 		printf("ehci_device_bulk_start: not done, ex=%p\n", exfer);
3789 	}
3790 	exfer->isdone = 0;
3791 #endif
3792 
3793 	ehci_set_qh_qtd(sqh, data); /* also does usb_syncmem(sqh) */
3794 	if (xfer->timeout && !sc->sc_bus.use_polling) {
3795 		callout_reset(&xfer->timeout_handle, mstohz(xfer->timeout),
3796 		    ehci_timeout, xfer);
3797 	}
3798 	ehci_add_intr_list(sc, exfer);
3799 	xfer->status = USBD_IN_PROGRESS;
3800 	mutex_exit(&sc->sc_lock);
3801 
3802 #ifdef EHCI_DEBUG
3803 	USBHIST_LOGN(ehcidebug, 5, "data(2)", 0, 0, 0, 0);
3804 //	delay(10000);
3805 	USBHIST_LOGN(ehcidebug, 5, "data(3)", 0, 0, 0, 0);
3806 	ehci_dump_regs(sc);
3807 #if 0
3808 	printf("async_head:\n");
3809 	ehci_dump_sqh(sc->sc_async_head);
3810 #endif
3811 	USBHIST_LOG(ehcidebug, "sqh:", 0, 0, 0, 0);
3812 	ehci_dump_sqh(sqh);
3813 	ehci_dump_sqtds(data);
3814 #endif
3815 
3816 	if (sc->sc_bus.use_polling)
3817 		ehci_waitintr(sc, xfer);
3818 
3819 	return (USBD_IN_PROGRESS);
3820 #undef exfer
3821 }
3822 
3823 Static void
3824 ehci_device_bulk_abort(usbd_xfer_handle xfer)
3825 {
3826 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
3827 
3828 	USBHIST_LOG(ehcidebug, "xfer %p", xfer, 0, 0, 0);
3829 	ehci_abort_xfer(xfer, USBD_CANCELLED);
3830 }
3831 
3832 /*
3833  * Close a device bulk pipe.
3834  */
3835 Static void
3836 ehci_device_bulk_close(usbd_pipe_handle pipe)
3837 {
3838 	ehci_softc_t *sc = pipe->device->bus->hci_private;
3839 	struct ehci_pipe *epipe = (struct ehci_pipe *)pipe;
3840 
3841 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
3842 
3843 	KASSERT(mutex_owned(&sc->sc_lock));
3844 
3845 	USBHIST_LOG(ehcidebug, "pipe=%p", pipe, 0, 0, 0);
3846 	pipe->endpoint->datatoggle = epipe->nexttoggle;
3847 	ehci_close_pipe(pipe, sc->sc_async_head);
3848 }
3849 
3850 Static void
3851 ehci_device_bulk_done(usbd_xfer_handle xfer)
3852 {
3853 	struct ehci_xfer *ex = EXFER(xfer);
3854 	ehci_softc_t *sc = xfer->pipe->device->bus->hci_private;
3855 	struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
3856 	int endpt = epipe->pipe.endpoint->edesc->bEndpointAddress;
3857 	int rd = UE_GET_DIR(endpt) == UE_DIR_IN;
3858 
3859 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
3860 
3861 	USBHIST_LOG(ehcidebug, "xfer=%p, actlen=%d",
3862 	    xfer, xfer->actlen, 0, 0);
3863 
3864 	KASSERT(mutex_owned(&sc->sc_lock));
3865 
3866 	if (xfer->status != USBD_NOMEM && ehci_active_intr_list(ex)) {
3867 		ehci_del_intr_list(sc, ex);	/* remove from active list */
3868 		ehci_free_sqtd_chain(sc, ex->sqtdstart, NULL);
3869 		usb_syncmem(&xfer->dmabuf, 0, xfer->length,
3870 		    rd ? BUS_DMASYNC_POSTREAD : BUS_DMASYNC_POSTWRITE);
3871 	}
3872 
3873 	USBHIST_LOG(ehcidebug, "length=%d", xfer->actlen, 0, 0, 0);
3874 }
3875 
3876 /************************/
3877 
3878 Static usbd_status
3879 ehci_device_setintr(ehci_softc_t *sc, ehci_soft_qh_t *sqh, int ival)
3880 {
3881 	struct ehci_soft_islot *isp;
3882 	int islot, lev;
3883 
3884 	/* Find a poll rate that is large enough. */
3885 	for (lev = EHCI_IPOLLRATES - 1; lev > 0; lev--)
3886 		if (EHCI_ILEV_IVAL(lev) <= ival)
3887 			break;
3888 
3889 	/* Pick an interrupt slot at the right level. */
3890 	/* XXX could do better than picking at random */
3891 	sc->sc_rand = (sc->sc_rand + 191) % sc->sc_flsize;
3892 	islot = EHCI_IQHIDX(lev, sc->sc_rand);
3893 
3894 	sqh->islot = islot;
3895 	isp = &sc->sc_islots[islot];
3896 	mutex_enter(&sc->sc_lock);
3897 	ehci_add_qh(sc, sqh, isp->sqh);
3898 	mutex_exit(&sc->sc_lock);
3899 
3900 	return (USBD_NORMAL_COMPLETION);
3901 }
3902 
3903 Static usbd_status
3904 ehci_device_intr_transfer(usbd_xfer_handle xfer)
3905 {
3906 	ehci_softc_t *sc = xfer->pipe->device->bus->hci_private;
3907 	usbd_status err;
3908 
3909 	/* Insert last in queue. */
3910 	mutex_enter(&sc->sc_lock);
3911 	err = usb_insert_transfer(xfer);
3912 	mutex_exit(&sc->sc_lock);
3913 	if (err)
3914 		return (err);
3915 
3916 	/*
3917 	 * Pipe isn't running (otherwise err would be USBD_INPROG),
3918 	 * so start it first.
3919 	 */
3920 	return (ehci_device_intr_start(SIMPLEQ_FIRST(&xfer->pipe->queue)));
3921 }
3922 
3923 Static usbd_status
3924 ehci_device_intr_start(usbd_xfer_handle xfer)
3925 {
3926 #define exfer EXFER(xfer)
3927 	struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
3928 	usbd_device_handle dev = xfer->pipe->device;
3929 	ehci_softc_t *sc = dev->bus->hci_private;
3930 	ehci_soft_qtd_t *data, *dataend;
3931 	ehci_soft_qh_t *sqh;
3932 	usbd_status err;
3933 	int len, isread, endpt;
3934 
3935 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
3936 
3937 	USBHIST_LOG(ehcidebug, "xfer=%p len=%d flags=%d",
3938 	    xfer, xfer->length, xfer->flags, 0);
3939 
3940 	if (sc->sc_dying)
3941 		return (USBD_IOERROR);
3942 
3943 #ifdef DIAGNOSTIC
3944 	if (xfer->rqflags & URQ_REQUEST)
3945 		panic("ehci_device_intr_start: a request");
3946 #endif
3947 
3948 	mutex_enter(&sc->sc_lock);
3949 
3950 	len = xfer->length;
3951 	endpt = epipe->pipe.endpoint->edesc->bEndpointAddress;
3952 	isread = UE_GET_DIR(endpt) == UE_DIR_IN;
3953 	sqh = epipe->sqh;
3954 
3955 	epipe->u.intr.length = len;
3956 
3957 	err = ehci_alloc_sqtd_chain(epipe, sc, len, isread, xfer, &data,
3958 	    &dataend);
3959 	if (err) {
3960 		USBHIST_LOG(ehcidebug, "no memory", 0, 0, 0, 0);
3961 		xfer->status = err;
3962 		usb_transfer_complete(xfer);
3963 		mutex_exit(&sc->sc_lock);
3964 		return (err);
3965 	}
3966 
3967 #ifdef EHCI_DEBUG
3968 	USBHIST_LOGN(ehcidebug, 5, "data(1)", 0, 0, 0, 0);
3969 	ehci_dump_sqh(sqh);
3970 	ehci_dump_sqtds(data);
3971 #endif
3972 
3973 	/* Set up interrupt info. */
3974 	exfer->sqtdstart = data;
3975 	exfer->sqtdend = dataend;
3976 #ifdef DIAGNOSTIC
3977 	if (!exfer->isdone) {
3978 		printf("ehci_device_intr_start: not done, ex=%p\n", exfer);
3979 	}
3980 	exfer->isdone = 0;
3981 #endif
3982 
3983 	ehci_set_qh_qtd(sqh, data); /* also does usb_syncmem(sqh) */
3984 	if (xfer->timeout && !sc->sc_bus.use_polling) {
3985 		callout_reset(&xfer->timeout_handle, mstohz(xfer->timeout),
3986 		    ehci_timeout, xfer);
3987 	}
3988 	ehci_add_intr_list(sc, exfer);
3989 	xfer->status = USBD_IN_PROGRESS;
3990 	mutex_exit(&sc->sc_lock);
3991 
3992 #ifdef EHCI_DEBUG
3993 	USBHIST_LOGN(ehcidebug, 5, "data(2)", 0, 0, 0, 0);
3994 //	delay(10000);
3995 	USBHIST_LOGN(ehcidebug, 5, "data(3)", 0, 0, 0, 0);
3996 	ehci_dump_regs(sc);
3997 	USBHIST_LOGN(ehcidebug, 5, "sqh:", 0, 0, 0, 0);
3998 	ehci_dump_sqh(sqh);
3999 	ehci_dump_sqtds(data);
4000 #endif
4001 
4002 	if (sc->sc_bus.use_polling)
4003 		ehci_waitintr(sc, xfer);
4004 
4005 	return (USBD_IN_PROGRESS);
4006 #undef exfer
4007 }
4008 
4009 Static void
4010 ehci_device_intr_abort(usbd_xfer_handle xfer)
4011 {
4012 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
4013 
4014 	USBHIST_LOG(ehcidebug, "xfer=%p", xfer, 0, 0, 0);
4015 	KASSERT(xfer->pipe->intrxfer == xfer);
4016 
4017 	/*
4018 	 * XXX - abort_xfer uses ehci_sync_hc, which syncs via the advance
4019 	 *       async doorbell. That's dependent on the async list, wheras
4020 	 *       intr xfers are periodic, should not use this?
4021 	 */
4022 	ehci_abort_xfer(xfer, USBD_CANCELLED);
4023 }
4024 
4025 Static void
4026 ehci_device_intr_close(usbd_pipe_handle pipe)
4027 {
4028 	ehci_softc_t *sc = pipe->device->bus->hci_private;
4029 	struct ehci_pipe *epipe = (struct ehci_pipe *)pipe;
4030 	struct ehci_soft_islot *isp;
4031 
4032 	KASSERT(mutex_owned(&sc->sc_lock));
4033 
4034 	isp = &sc->sc_islots[epipe->sqh->islot];
4035 	ehci_close_pipe(pipe, isp->sqh);
4036 }
4037 
4038 Static void
4039 ehci_device_intr_done(usbd_xfer_handle xfer)
4040 {
4041 #define exfer EXFER(xfer)
4042 	struct ehci_xfer *ex = EXFER(xfer);
4043 	ehci_softc_t *sc = xfer->pipe->device->bus->hci_private;
4044 	struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
4045 	ehci_soft_qtd_t *data, *dataend;
4046 	ehci_soft_qh_t *sqh;
4047 	usbd_status err;
4048 	int len, isread, endpt;
4049 
4050 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
4051 
4052 	USBHIST_LOG(ehcidebug, "xfer=%p, actlen=%d",
4053 	    xfer, xfer->actlen, 0, 0);
4054 
4055 	KASSERT(sc->sc_bus.use_polling || mutex_owned(&sc->sc_lock));
4056 
4057 	if (xfer->pipe->repeat) {
4058 		ehci_free_sqtd_chain(sc, ex->sqtdstart, NULL);
4059 
4060 		len = epipe->u.intr.length;
4061 		xfer->length = len;
4062 		endpt = epipe->pipe.endpoint->edesc->bEndpointAddress;
4063 		isread = UE_GET_DIR(endpt) == UE_DIR_IN;
4064 		usb_syncmem(&xfer->dmabuf, 0, len,
4065 		    isread ? BUS_DMASYNC_POSTREAD : BUS_DMASYNC_POSTWRITE);
4066 		sqh = epipe->sqh;
4067 
4068 		err = ehci_alloc_sqtd_chain(epipe, sc, len, isread, xfer,
4069 		    &data, &dataend);
4070 		if (err) {
4071 			USBHIST_LOG(ehcidebug, "no memory", 0, 0, 0, 0);
4072 			xfer->status = err;
4073 			return;
4074 		}
4075 
4076 		/* Set up interrupt info. */
4077 		exfer->sqtdstart = data;
4078 		exfer->sqtdend = dataend;
4079 #ifdef DIAGNOSTIC
4080 		if (!exfer->isdone) {
4081 			USBHIST_LOG(ehcidebug, "marked not done, ex = %p",
4082 				exfer, 0, 0, 0);
4083 			printf("ehci_device_intr_done: not done, ex=%p\n",
4084 			    exfer);
4085 		}
4086 		exfer->isdone = 0;
4087 #endif
4088 
4089 		ehci_set_qh_qtd(sqh, data); /* also does usb_syncmem(sqh) */
4090 		if (xfer->timeout && !sc->sc_bus.use_polling) {
4091 			callout_reset(&xfer->timeout_handle,
4092 			    mstohz(xfer->timeout), ehci_timeout, xfer);
4093 		}
4094 
4095 		xfer->status = USBD_IN_PROGRESS;
4096 	} else if (xfer->status != USBD_NOMEM && ehci_active_intr_list(ex)) {
4097 		ehci_del_intr_list(sc, ex); /* remove from active list */
4098 		ehci_free_sqtd_chain(sc, ex->sqtdstart, NULL);
4099 		endpt = epipe->pipe.endpoint->edesc->bEndpointAddress;
4100 		isread = UE_GET_DIR(endpt) == UE_DIR_IN;
4101 		usb_syncmem(&xfer->dmabuf, 0, xfer->length,
4102 		    isread ? BUS_DMASYNC_POSTREAD : BUS_DMASYNC_POSTWRITE);
4103 	}
4104 #undef exfer
4105 }
4106 
4107 /************************/
4108 
4109 Static usbd_status
4110 ehci_device_isoc_transfer(usbd_xfer_handle xfer)
4111 {
4112 	ehci_softc_t *sc = xfer->pipe->device->bus->hci_private;
4113 	usbd_status err;
4114 
4115 	mutex_enter(&sc->sc_lock);
4116 	err = usb_insert_transfer(xfer);
4117 	mutex_exit(&sc->sc_lock);
4118 	if (err && err != USBD_IN_PROGRESS)
4119 		return err;
4120 
4121 	return ehci_device_isoc_start(xfer);
4122 }
4123 
4124 Static usbd_status
4125 ehci_device_isoc_start(usbd_xfer_handle xfer)
4126 {
4127 	struct ehci_pipe *epipe;
4128 	ehci_softc_t *sc;
4129 	struct ehci_xfer *exfer;
4130 	ehci_soft_itd_t *itd, *prev, *start, *stop;
4131 	usb_dma_t *dma_buf;
4132 	int i, j, k, frames, uframes, ufrperframe;
4133 	int trans_count, offs, total_length;
4134 	int frindex;
4135 
4136 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
4137 
4138 	start = NULL;
4139 	prev = NULL;
4140 	itd = NULL;
4141 	trans_count = 0;
4142 	total_length = 0;
4143 	exfer = (struct ehci_xfer *) xfer;
4144 	sc = xfer->pipe->device->bus->hci_private;
4145 	epipe = (struct ehci_pipe *)xfer->pipe;
4146 
4147 	/*
4148 	 * To allow continuous transfers, above we start all transfers
4149 	 * immediately. However, we're still going to get usbd_start_next call
4150 	 * this when another xfer completes. So, check if this is already
4151 	 * in progress or not
4152 	 */
4153 
4154 	if (exfer->itdstart != NULL)
4155 		return USBD_IN_PROGRESS;
4156 
4157 	USBHIST_LOG(ehcidebug, "xfer %p len %d flags %d",
4158 	    xfer, xfer->length, xfer->flags, 0);
4159 
4160 	if (sc->sc_dying)
4161 		return USBD_IOERROR;
4162 
4163 	/*
4164 	 * To avoid complication, don't allow a request right now that'll span
4165 	 * the entire frame table. To within 4 frames, to allow some leeway
4166 	 * on either side of where the hc currently is.
4167 	 */
4168 	if ((1 << (epipe->pipe.endpoint->edesc->bInterval)) *
4169 			xfer->nframes >= (sc->sc_flsize - 4) * 8) {
4170 		USBHIST_LOG(ehcidebug,
4171 		    "isoc descriptor spans entire frametable", 0, 0, 0, 0);
4172 		printf("ehci: isoc descriptor requested that spans the entire frametable, too many frames\n");
4173 		return USBD_INVAL;
4174 	}
4175 
4176 #ifdef DIAGNOSTIC
4177 	if (xfer->rqflags & URQ_REQUEST)
4178 		panic("ehci_device_isoc_start: request");
4179 
4180 	if (!exfer->isdone) {
4181 		USBHIST_LOG(ehcidebug, "marked not done, ex = %p", exfer,
4182 			0, 0, 0);
4183 		printf("ehci_device_isoc_start: not done, ex = %p\n", exfer);
4184 	}
4185 	exfer->isdone = 0;
4186 #endif
4187 
4188 	/*
4189 	 * Step 1: Allocate and initialize itds, how many do we need?
4190 	 * One per transfer if interval >= 8 microframes, fewer if we use
4191 	 * multiple microframes per frame.
4192 	 */
4193 
4194 	i = epipe->pipe.endpoint->edesc->bInterval;
4195 	if (i > 16 || i == 0) {
4196 		/* Spec page 271 says intervals > 16 are invalid */
4197 		USBHIST_LOG(ehcidebug, "bInterval %d invalid", i, 0, 0, 0);
4198 		return USBD_INVAL;
4199 	}
4200 
4201 	ufrperframe = max(1, USB_UFRAMES_PER_FRAME / (1 << (i - 1)));
4202 	frames = (xfer->nframes + (ufrperframe - 1)) / ufrperframe;
4203 	uframes = USB_UFRAMES_PER_FRAME / ufrperframe;
4204 
4205 	if (frames == 0) {
4206 		USBHIST_LOG(ehcidebug, "frames == 0", 0, 0, 0, 0);
4207 		return USBD_INVAL;
4208 	}
4209 
4210 	dma_buf = &xfer->dmabuf;
4211 	offs = 0;
4212 
4213 	for (i = 0; i < frames; i++) {
4214 		int froffs = offs;
4215 		itd = ehci_alloc_itd(sc);
4216 
4217 		if (prev != NULL) {
4218 			prev->itd.itd_next =
4219 			    htole32(itd->physaddr | EHCI_LINK_ITD);
4220 			usb_syncmem(&itd->dma,
4221 			    itd->offs + offsetof(ehci_itd_t, itd_next),
4222                 	    sizeof(itd->itd.itd_next), BUS_DMASYNC_POSTWRITE);
4223 
4224 			prev->xfer_next = itd;
4225 	    	} else {
4226 			start = itd;
4227 		}
4228 
4229 		/*
4230 		 * Step 1.5, initialize uframes
4231 		 */
4232 		for (j = 0; j < EHCI_ITD_NUFRAMES; j += uframes) {
4233 			/* Calculate which page in the list this starts in */
4234 			int addr = DMAADDR(dma_buf, froffs);
4235 			addr = EHCI_PAGE_OFFSET(addr);
4236 			addr += (offs - froffs);
4237 			addr = EHCI_PAGE(addr);
4238 			addr /= EHCI_PAGE_SIZE;
4239 
4240 			/* This gets the initial offset into the first page,
4241 			 * looks how far further along the current uframe
4242 			 * offset is. Works out how many pages that is.
4243 			 */
4244 
4245 			itd->itd.itd_ctl[j] = htole32 ( EHCI_ITD_ACTIVE |
4246 			    EHCI_ITD_SET_LEN(xfer->frlengths[trans_count]) |
4247 			    EHCI_ITD_SET_PG(addr) |
4248 			    EHCI_ITD_SET_OFFS(EHCI_PAGE_OFFSET(DMAADDR(dma_buf,offs))));
4249 
4250 			total_length += xfer->frlengths[trans_count];
4251 			offs += xfer->frlengths[trans_count];
4252 			trans_count++;
4253 
4254 			if (trans_count >= xfer->nframes) { /*Set IOC*/
4255 				itd->itd.itd_ctl[j] |= htole32(EHCI_ITD_IOC);
4256 				break;
4257 			}
4258 		}
4259 
4260 		/* Step 1.75, set buffer pointers. To simplify matters, all
4261 		 * pointers are filled out for the next 7 hardware pages in
4262 		 * the dma block, so no need to worry what pages to cover
4263 		 * and what to not.
4264 		 */
4265 
4266 		for (j = 0; j < EHCI_ITD_NBUFFERS; j++) {
4267 			/*
4268 			 * Don't try to lookup a page that's past the end
4269 			 * of buffer
4270 			 */
4271 			int page_offs = EHCI_PAGE(froffs + (EHCI_PAGE_SIZE * j));
4272 			if (page_offs >= dma_buf->block->size)
4273 				break;
4274 
4275 			unsigned long long page = DMAADDR(dma_buf, page_offs);
4276 			page = EHCI_PAGE(page);
4277 			itd->itd.itd_bufr[j] =
4278 			    htole32(EHCI_ITD_SET_BPTR(page));
4279 			itd->itd.itd_bufr_hi[j] =
4280 			    htole32(page >> 32);
4281 		}
4282 
4283 		/*
4284 		 * Other special values
4285 		 */
4286 
4287 		k = epipe->pipe.endpoint->edesc->bEndpointAddress;
4288 		itd->itd.itd_bufr[0] |= htole32(EHCI_ITD_SET_EP(UE_GET_ADDR(k)) |
4289 		    EHCI_ITD_SET_DADDR(epipe->pipe.device->address));
4290 
4291 		k = (UE_GET_DIR(epipe->pipe.endpoint->edesc->bEndpointAddress))
4292 		    ? 1 : 0;
4293 		j = UGETW(epipe->pipe.endpoint->edesc->wMaxPacketSize);
4294 		itd->itd.itd_bufr[1] |= htole32(EHCI_ITD_SET_DIR(k) |
4295 		    EHCI_ITD_SET_MAXPKT(UE_GET_SIZE(j)));
4296 
4297 		/* FIXME: handle invalid trans */
4298 		itd->itd.itd_bufr[2] |=
4299 		    htole32(EHCI_ITD_SET_MULTI(UE_GET_TRANS(j)+1));
4300 
4301 		usb_syncmem(&itd->dma,
4302 		    itd->offs + offsetof(ehci_itd_t, itd_next),
4303                     sizeof(ehci_itd_t),
4304 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
4305 
4306 		prev = itd;
4307 	} /* End of frame */
4308 
4309 	stop = itd;
4310 	stop->xfer_next = NULL;
4311 	exfer->isoc_len = total_length;
4312 
4313 	usb_syncmem(&exfer->xfer.dmabuf, 0, total_length,
4314 		BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
4315 
4316 	/*
4317 	 * Part 2: Transfer descriptors have now been set up, now they must
4318 	 * be scheduled into the period frame list. Erk. Not wanting to
4319 	 * complicate matters, transfer is denied if the transfer spans
4320 	 * more than the period frame list.
4321 	 */
4322 
4323 	mutex_enter(&sc->sc_lock);
4324 
4325 	/* Start inserting frames */
4326 	if (epipe->u.isoc.cur_xfers > 0) {
4327 		frindex = epipe->u.isoc.next_frame;
4328 	} else {
4329 		frindex = EOREAD4(sc, EHCI_FRINDEX);
4330 		frindex = frindex >> 3; /* Erase microframe index */
4331 		frindex += 2;
4332 	}
4333 
4334 	if (frindex >= sc->sc_flsize)
4335 		frindex &= (sc->sc_flsize - 1);
4336 
4337 	/* What's the frame interval? */
4338 	i = (1 << (epipe->pipe.endpoint->edesc->bInterval - 1));
4339 	if (i / USB_UFRAMES_PER_FRAME == 0)
4340 		i = 1;
4341 	else
4342 		i /= USB_UFRAMES_PER_FRAME;
4343 
4344 	itd = start;
4345 	for (j = 0; j < frames; j++) {
4346 		if (itd == NULL)
4347 			panic("ehci: unexpectedly ran out of isoc itds, isoc_start");
4348 
4349 		itd->itd.itd_next = sc->sc_flist[frindex];
4350 		if (itd->itd.itd_next == 0)
4351 			/* FIXME: frindex table gets initialized to NULL
4352 			 * or EHCI_NULL? */
4353 			itd->itd.itd_next = EHCI_NULL;
4354 
4355 		usb_syncmem(&itd->dma,
4356 		    itd->offs + offsetof(ehci_itd_t, itd_next),
4357                     sizeof(itd->itd.itd_next),
4358 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
4359 
4360 		sc->sc_flist[frindex] = htole32(EHCI_LINK_ITD | itd->physaddr);
4361 
4362 		usb_syncmem(&sc->sc_fldma,
4363 		    sizeof(ehci_link_t) * frindex,
4364                     sizeof(ehci_link_t),
4365 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
4366 
4367 		itd->u.frame_list.next = sc->sc_softitds[frindex];
4368 		sc->sc_softitds[frindex] = itd;
4369 		if (itd->u.frame_list.next != NULL)
4370 			itd->u.frame_list.next->u.frame_list.prev = itd;
4371 		itd->slot = frindex;
4372 		itd->u.frame_list.prev = NULL;
4373 
4374 		frindex += i;
4375 		if (frindex >= sc->sc_flsize)
4376 			frindex -= sc->sc_flsize;
4377 
4378 		itd = itd->xfer_next;
4379 	}
4380 
4381 	epipe->u.isoc.cur_xfers++;
4382 	epipe->u.isoc.next_frame = frindex;
4383 
4384 	exfer->itdstart = start;
4385 	exfer->itdend = stop;
4386 	exfer->sqtdstart = NULL;
4387 	exfer->sqtdend = NULL;
4388 
4389 	ehci_add_intr_list(sc, exfer);
4390 	xfer->status = USBD_IN_PROGRESS;
4391 	xfer->done = 0;
4392 	mutex_exit(&sc->sc_lock);
4393 
4394 	if (sc->sc_bus.use_polling) {
4395 		printf("Starting ehci isoc xfer with polling. Bad idea?\n");
4396 		ehci_waitintr(sc, xfer);
4397 	}
4398 
4399 	return USBD_IN_PROGRESS;
4400 }
4401 
4402 Static void
4403 ehci_device_isoc_abort(usbd_xfer_handle xfer)
4404 {
4405 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
4406 
4407 	USBHIST_LOG(ehcidebug, "xfer = %p", xfer, 0, 0, 0);
4408 	ehci_abort_isoc_xfer(xfer, USBD_CANCELLED);
4409 }
4410 
4411 Static void
4412 ehci_device_isoc_close(usbd_pipe_handle pipe)
4413 {
4414 	USBHIST_FUNC(); USBHIST_CALLED(ehcidebug);
4415 
4416 	USBHIST_LOG(ehcidebug, "nothing in the pipe to free?", 0, 0, 0, 0);
4417 }
4418 
4419 Static void
4420 ehci_device_isoc_done(usbd_xfer_handle xfer)
4421 {
4422 	struct ehci_xfer *exfer;
4423 	ehci_softc_t *sc;
4424 	struct ehci_pipe *epipe;
4425 
4426 	exfer = EXFER(xfer);
4427 	sc = xfer->pipe->device->bus->hci_private;
4428 	epipe = (struct ehci_pipe *) xfer->pipe;
4429 
4430 	KASSERT(mutex_owned(&sc->sc_lock));
4431 
4432 	epipe->u.isoc.cur_xfers--;
4433 	if (xfer->status != USBD_NOMEM && ehci_active_intr_list(exfer)) {
4434 		ehci_del_intr_list(sc, exfer);
4435 		ehci_rem_free_itd_chain(sc, exfer);
4436 	}
4437 
4438 	usb_syncmem(&xfer->dmabuf, 0, xfer->length, BUS_DMASYNC_POSTWRITE |
4439                     BUS_DMASYNC_POSTREAD);
4440 
4441 }
4442