xref: /netbsd-src/sys/dev/usb/usbdi.c (revision 181254a7b1bdde6873432bffef2d2decc4b5c22f)
1 /*	$NetBSD: usbdi.c,v 1.204 2020/08/19 02:19:07 msaitoh Exp $	*/
2 
3 /*
4  * Copyright (c) 1998, 2012, 2015 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Lennart Augustsson (lennart@augustsson.net) at
9  * Carlstedt Research & Technology, Matthew R. Green (mrg@eterna.com.au),
10  * and Nick Hudson.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
23  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
24  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
25  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #include <sys/cdefs.h>
35 __KERNEL_RCSID(0, "$NetBSD: usbdi.c,v 1.204 2020/08/19 02:19:07 msaitoh Exp $");
36 
37 #ifdef _KERNEL_OPT
38 #include "opt_usb.h"
39 #include "opt_compat_netbsd.h"
40 #include "usb_dma.h"
41 #endif
42 
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/kernel.h>
46 #include <sys/device.h>
47 #include <sys/kmem.h>
48 #include <sys/proc.h>
49 #include <sys/bus.h>
50 #include <sys/cpu.h>
51 
52 #include <dev/usb/usb.h>
53 #include <dev/usb/usbdi.h>
54 #include <dev/usb/usbdi_util.h>
55 #include <dev/usb/usbdivar.h>
56 #include <dev/usb/usb_mem.h>
57 #include <dev/usb/usb_quirks.h>
58 #include <dev/usb/usb_sdt.h>
59 #include <dev/usb/usbhist.h>
60 
61 /* UTF-8 encoding stuff */
62 #include <fs/unicode.h>
63 
64 extern int usbdebug;
65 
66 SDT_PROBE_DEFINE5(usb, device, pipe, open,
67     "struct usbd_interface *"/*iface*/,
68     "uint8_t"/*address*/,
69     "uint8_t"/*flags*/,
70     "int"/*ival*/,
71     "struct usbd_pipe *"/*pipe*/);
72 
73 SDT_PROBE_DEFINE7(usb, device, pipe, open__intr,
74     "struct usbd_interface *"/*iface*/,
75     "uint8_t"/*address*/,
76     "uint8_t"/*flags*/,
77     "int"/*ival*/,
78     "usbd_callback"/*cb*/,
79     "void *"/*cookie*/,
80     "struct usbd_pipe *"/*pipe*/);
81 
82 SDT_PROBE_DEFINE2(usb, device, pipe, transfer__start,
83     "struct usbd_pipe *"/*pipe*/,
84     "struct usbd_xfer *"/*xfer*/);
85 SDT_PROBE_DEFINE3(usb, device, pipe, transfer__done,
86     "struct usbd_pipe *"/*pipe*/,
87     "struct usbd_xfer *"/*xfer*/,
88     "usbd_status"/*err*/);
89 SDT_PROBE_DEFINE2(usb, device, pipe, start,
90     "struct usbd_pipe *"/*pipe*/,
91     "struct usbd_xfer *"/*xfer*/);
92 
93 SDT_PROBE_DEFINE1(usb, device, pipe, close,  "struct usbd_pipe *"/*pipe*/);
94 SDT_PROBE_DEFINE1(usb, device, pipe, abort__start,
95     "struct usbd_pipe *"/*pipe*/);
96 SDT_PROBE_DEFINE1(usb, device, pipe, abort__done,
97     "struct usbd_pipe *"/*pipe*/);
98 SDT_PROBE_DEFINE1(usb, device, pipe, clear__endpoint__stall,
99     "struct usbd_pipe *"/*pipe*/);
100 SDT_PROBE_DEFINE1(usb, device, pipe, clear__endpoint__toggle,
101     "struct usbd_pipe *"/*pipe*/);
102 
103 SDT_PROBE_DEFINE5(usb, device, xfer, create,
104     "struct usbd_xfer *"/*xfer*/,
105     "struct usbd_pipe *"/*pipe*/,
106     "size_t"/*len*/,
107     "unsigned int"/*flags*/,
108     "unsigned int"/*nframes*/);
109 SDT_PROBE_DEFINE1(usb, device, xfer, start,  "struct usbd_xfer *"/*xfer*/);
110 SDT_PROBE_DEFINE1(usb, device, xfer, preabort,  "struct usbd_xfer *"/*xfer*/);
111 SDT_PROBE_DEFINE1(usb, device, xfer, abort,  "struct usbd_xfer *"/*xfer*/);
112 SDT_PROBE_DEFINE1(usb, device, xfer, timeout,  "struct usbd_xfer *"/*xfer*/);
113 SDT_PROBE_DEFINE2(usb, device, xfer, done,
114     "struct usbd_xfer *"/*xfer*/,
115     "usbd_status"/*status*/);
116 SDT_PROBE_DEFINE1(usb, device, xfer, destroy,  "struct usbd_xfer *"/*xfer*/);
117 
118 Static usbd_status usbd_ar_pipe(struct usbd_pipe *);
119 Static void usbd_start_next(struct usbd_pipe *);
120 Static usbd_status usbd_open_pipe_ival
121 	(struct usbd_interface *, uint8_t, uint8_t, struct usbd_pipe **, int);
122 static void *usbd_alloc_buffer(struct usbd_xfer *, uint32_t);
123 static void usbd_free_buffer(struct usbd_xfer *);
124 static struct usbd_xfer *usbd_alloc_xfer(struct usbd_device *, unsigned int);
125 static usbd_status usbd_free_xfer(struct usbd_xfer *);
126 static void usbd_request_async_cb(struct usbd_xfer *, void *, usbd_status);
127 static void usbd_xfer_timeout(void *);
128 static void usbd_xfer_timeout_task(void *);
129 static bool usbd_xfer_probe_timeout(struct usbd_xfer *);
130 static void usbd_xfer_cancel_timeout_async(struct usbd_xfer *);
131 
132 #if defined(USB_DEBUG)
133 void
134 usbd_dump_iface(struct usbd_interface *iface)
135 {
136 	USBHIST_FUNC();
137 	USBHIST_CALLARGS(usbdebug, "iface %#jx", (uintptr_t)iface, 0, 0, 0);
138 
139 	if (iface == NULL)
140 		return;
141 	USBHIST_LOG(usbdebug, "     device = %#jx idesc = %#jx index = %jd",
142 	    (uintptr_t)iface->ui_dev, (uintptr_t)iface->ui_idesc,
143 	    iface->ui_index, 0);
144 	USBHIST_LOG(usbdebug, "     altindex=%jd priv=%#jx",
145 	    iface->ui_altindex, (uintptr_t)iface->ui_priv, 0, 0);
146 }
147 
148 void
149 usbd_dump_device(struct usbd_device *dev)
150 {
151 	USBHIST_FUNC();
152 	USBHIST_CALLARGS(usbdebug, "dev = %#jx", (uintptr_t)dev, 0, 0, 0);
153 
154 	if (dev == NULL)
155 		return;
156 	USBHIST_LOG(usbdebug, "     bus = %#jx default_pipe = %#jx",
157 	    (uintptr_t)dev->ud_bus, (uintptr_t)dev->ud_pipe0, 0, 0);
158 	USBHIST_LOG(usbdebug, "     address = %jd config = %jd depth = %jd ",
159 	    dev->ud_addr, dev->ud_config, dev->ud_depth, 0);
160 	USBHIST_LOG(usbdebug, "     speed = %jd self_powered = %jd "
161 	    "power = %jd langid = %jd",
162 	    dev->ud_speed, dev->ud_selfpowered, dev->ud_power, dev->ud_langid);
163 }
164 
165 void
166 usbd_dump_endpoint(struct usbd_endpoint *endp)
167 {
168 	USBHIST_FUNC();
169 	USBHIST_CALLARGS(usbdebug, "endp = %#jx", (uintptr_t)endp, 0, 0, 0);
170 
171 	if (endp == NULL)
172 		return;
173 	USBHIST_LOG(usbdebug, "    edesc = %#jx refcnt = %jd",
174 	    (uintptr_t)endp->ue_edesc, endp->ue_refcnt, 0, 0);
175 	if (endp->ue_edesc)
176 		USBHIST_LOG(usbdebug, "     bEndpointAddress=0x%02jx",
177 		    endp->ue_edesc->bEndpointAddress, 0, 0, 0);
178 }
179 
180 void
181 usbd_dump_queue(struct usbd_pipe *pipe)
182 {
183 	struct usbd_xfer *xfer;
184 
185 	USBHIST_FUNC();
186 	USBHIST_CALLARGS(usbdebug, "pipe = %#jx", (uintptr_t)pipe, 0, 0, 0);
187 
188 	SIMPLEQ_FOREACH(xfer, &pipe->up_queue, ux_next) {
189 		USBHIST_LOG(usbdebug, "     xfer = %#jx", (uintptr_t)xfer,
190 		    0, 0, 0);
191 	}
192 }
193 
194 void
195 usbd_dump_pipe(struct usbd_pipe *pipe)
196 {
197 	USBHIST_FUNC();
198 	USBHIST_CALLARGS(usbdebug, "pipe = %#jx", (uintptr_t)pipe, 0, 0, 0);
199 
200 	if (pipe == NULL)
201 		return;
202 	usbd_dump_iface(pipe->up_iface);
203 	usbd_dump_device(pipe->up_dev);
204 	usbd_dump_endpoint(pipe->up_endpoint);
205 	USBHIST_LOG(usbdebug, "(usbd_dump_pipe)", 0, 0, 0, 0);
206 	USBHIST_LOG(usbdebug, "     running = %jd aborting = %jd",
207 	    pipe->up_running, pipe->up_aborting, 0, 0);
208 	USBHIST_LOG(usbdebug, "     intrxfer = %#jx, repeat = %jd, "
209 	    "interval = %jd", (uintptr_t)pipe->up_intrxfer, pipe->up_repeat,
210 	    pipe->up_interval, 0);
211 }
212 #endif
213 
214 usbd_status
215 usbd_open_pipe(struct usbd_interface *iface, uint8_t address,
216 	       uint8_t flags, struct usbd_pipe **pipe)
217 {
218 	return (usbd_open_pipe_ival(iface, address, flags, pipe,
219 				    USBD_DEFAULT_INTERVAL));
220 }
221 
222 usbd_status
223 usbd_open_pipe_ival(struct usbd_interface *iface, uint8_t address,
224 		    uint8_t flags, struct usbd_pipe **pipe, int ival)
225 {
226 	struct usbd_pipe *p;
227 	struct usbd_endpoint *ep;
228 	usbd_status err;
229 	int i;
230 
231 	USBHIST_FUNC();
232 	USBHIST_CALLARGS(usbdebug, "iface = %#jx address = %#jx flags = %#jx",
233 	    (uintptr_t)iface, address, flags, 0);
234 
235 	for (i = 0; i < iface->ui_idesc->bNumEndpoints; i++) {
236 		ep = &iface->ui_endpoints[i];
237 		if (ep->ue_edesc == NULL)
238 			return USBD_IOERROR;
239 		if (ep->ue_edesc->bEndpointAddress == address)
240 			goto found;
241 	}
242 	return USBD_BAD_ADDRESS;
243  found:
244 	if ((flags & USBD_EXCLUSIVE_USE) && ep->ue_refcnt != 0)
245 		return USBD_IN_USE;
246 	err = usbd_setup_pipe_flags(iface->ui_dev, iface, ep, ival, &p, flags);
247 	if (err)
248 		return err;
249 	LIST_INSERT_HEAD(&iface->ui_pipes, p, up_next);
250 	*pipe = p;
251 	SDT_PROBE5(usb, device, pipe, open,
252 	    iface, address, flags, ival, p);
253 	return USBD_NORMAL_COMPLETION;
254 }
255 
256 usbd_status
257 usbd_open_pipe_intr(struct usbd_interface *iface, uint8_t address,
258 		    uint8_t flags, struct usbd_pipe **pipe,
259 		    void *priv, void *buffer, uint32_t len,
260 		    usbd_callback cb, int ival)
261 {
262 	usbd_status err;
263 	struct usbd_xfer *xfer;
264 	struct usbd_pipe *ipipe;
265 
266 	USBHIST_FUNC();
267 	USBHIST_CALLARGS(usbdebug, "address = %#jx flags = %#jx len = %jd",
268 	    address, flags, len, 0);
269 
270 	err = usbd_open_pipe_ival(iface, address,
271 				  USBD_EXCLUSIVE_USE | (flags & USBD_MPSAFE),
272 				  &ipipe, ival);
273 	if (err)
274 		return err;
275 	err = usbd_create_xfer(ipipe, len, flags, 0, &xfer);
276 	if (err)
277 		goto bad1;
278 
279 	usbd_setup_xfer(xfer, priv, buffer, len, flags, USBD_NO_TIMEOUT, cb);
280 	ipipe->up_intrxfer = xfer;
281 	ipipe->up_repeat = 1;
282 	err = usbd_transfer(xfer);
283 	*pipe = ipipe;
284 	if (err != USBD_IN_PROGRESS)
285 		goto bad3;
286 	SDT_PROBE7(usb, device, pipe, open__intr,
287 	    iface, address, flags, ival, cb, priv, ipipe);
288 	return USBD_NORMAL_COMPLETION;
289 
290  bad3:
291 	ipipe->up_intrxfer = NULL;
292 	ipipe->up_repeat = 0;
293 
294 	usbd_destroy_xfer(xfer);
295  bad1:
296 	usbd_close_pipe(ipipe);
297 	return err;
298 }
299 
300 usbd_status
301 usbd_close_pipe(struct usbd_pipe *pipe)
302 {
303 	USBHIST_FUNC(); USBHIST_CALLED(usbdebug);
304 
305 	KASSERT(pipe != NULL);
306 
307 	usbd_lock_pipe(pipe);
308 	SDT_PROBE1(usb, device, pipe, close,  pipe);
309 
310 	if (!SIMPLEQ_EMPTY(&pipe->up_queue)) {
311 		printf("WARNING: pipe closed with active xfers on addr %d\n",
312 		    pipe->up_dev->ud_addr);
313 		usbd_ar_pipe(pipe);
314 	}
315 
316 	KASSERT(SIMPLEQ_EMPTY(&pipe->up_queue));
317 
318 	LIST_REMOVE(pipe, up_next);
319 	pipe->up_endpoint->ue_refcnt--;
320 
321 	pipe->up_methods->upm_close(pipe);
322 
323 	if (pipe->up_intrxfer != NULL) {
324 	    	usbd_unlock_pipe(pipe);
325 		usbd_destroy_xfer(pipe->up_intrxfer);
326 		usbd_lock_pipe(pipe);
327 	}
328 
329 	usbd_unlock_pipe(pipe);
330 	kmem_free(pipe, pipe->up_dev->ud_bus->ub_pipesize);
331 
332 	return USBD_NORMAL_COMPLETION;
333 }
334 
335 usbd_status
336 usbd_transfer(struct usbd_xfer *xfer)
337 {
338 	struct usbd_pipe *pipe = xfer->ux_pipe;
339 	usbd_status err;
340 	unsigned int size, flags;
341 
342 	USBHIST_FUNC(); USBHIST_CALLARGS(usbdebug,
343 	    "xfer = %#jx, flags = %#jx, pipe = %#jx, running = %jd",
344 	    (uintptr_t)xfer, xfer->ux_flags, (uintptr_t)pipe, pipe->up_running);
345 	KASSERT(xfer->ux_status == USBD_NOT_STARTED);
346 	SDT_PROBE1(usb, device, xfer, start,  xfer);
347 
348 #ifdef USB_DEBUG
349 	if (usbdebug > 5)
350 		usbd_dump_queue(pipe);
351 #endif
352 	xfer->ux_done = 0;
353 
354 	if (pipe->up_aborting) {
355 		USBHIST_LOG(usbdebug, "<- done xfer %#jx, aborting",
356 		    (uintptr_t)xfer, 0, 0, 0);
357 		SDT_PROBE2(usb, device, xfer, done,  xfer, USBD_CANCELLED);
358 		return USBD_CANCELLED;
359 	}
360 
361 	KASSERT(xfer->ux_length == 0 || xfer->ux_buf != NULL);
362 
363 	size = xfer->ux_length;
364 	flags = xfer->ux_flags;
365 
366 	if (size != 0) {
367 		/*
368 		 * Use the xfer buffer if none specified in transfer setup.
369 		 * isoc transfers always use the xfer buffer, i.e.
370 		 * ux_buffer is always NULL for isoc.
371 		 */
372 		if (xfer->ux_buffer == NULL) {
373 			xfer->ux_buffer = xfer->ux_buf;
374 		}
375 
376 		/*
377 		 * If not using the xfer buffer copy data to the
378 		 * xfer buffer for OUT transfers of >0 length
379 		 */
380 		if (xfer->ux_buffer != xfer->ux_buf) {
381 			KASSERT(xfer->ux_buf);
382 			if (!usbd_xfer_isread(xfer)) {
383 				memcpy(xfer->ux_buf, xfer->ux_buffer, size);
384 			}
385 		}
386 	}
387 
388 	/* xfer is not valid after the transfer method unless synchronous */
389 	SDT_PROBE2(usb, device, pipe, transfer__start,  pipe, xfer);
390 	err = pipe->up_methods->upm_transfer(xfer);
391 	SDT_PROBE3(usb, device, pipe, transfer__done,  pipe, xfer, err);
392 
393 	if (err != USBD_IN_PROGRESS && err) {
394 		/*
395 		 * The transfer made it onto the pipe queue, but didn't get
396 		 * accepted by the HCD for some reason.  It needs removing
397 		 * from the pipe queue.
398 		 */
399 		USBHIST_LOG(usbdebug, "xfer failed: %jd, reinserting",
400 		    err, 0, 0, 0);
401 		usbd_lock_pipe(pipe);
402 		SDT_PROBE1(usb, device, xfer, preabort,  xfer);
403 #ifdef DIAGNOSTIC
404 		xfer->ux_state = XFER_BUSY;
405 #endif
406 		SIMPLEQ_REMOVE_HEAD(&pipe->up_queue, ux_next);
407 		if (pipe->up_serialise)
408 			usbd_start_next(pipe);
409 		usbd_unlock_pipe(pipe);
410 	}
411 
412 	if (!(flags & USBD_SYNCHRONOUS)) {
413 		USBHIST_LOG(usbdebug, "<- done xfer %#jx, not sync (err %jd)",
414 		    (uintptr_t)xfer, err, 0, 0);
415 		if (err != USBD_IN_PROGRESS) /* XXX Possible?  */
416 			SDT_PROBE2(usb, device, xfer, done,  xfer, err);
417 		return err;
418 	}
419 
420 	if (err != USBD_IN_PROGRESS) {
421 		USBHIST_LOG(usbdebug, "<- done xfer %#jx, sync (err %jd)",
422 		    (uintptr_t)xfer, err, 0, 0);
423 		SDT_PROBE2(usb, device, xfer, done,  xfer, err);
424 		return err;
425 	}
426 
427 	/* Sync transfer, wait for completion. */
428 	usbd_lock_pipe(pipe);
429 	while (!xfer->ux_done) {
430 		if (pipe->up_dev->ud_bus->ub_usepolling)
431 			panic("usbd_transfer: not done");
432 		USBHIST_LOG(usbdebug, "<- sleeping on xfer %#jx",
433 		    (uintptr_t)xfer, 0, 0, 0);
434 
435 		err = 0;
436 		if ((flags & USBD_SYNCHRONOUS_SIG) != 0) {
437 			err = cv_wait_sig(&xfer->ux_cv, pipe->up_dev->ud_bus->ub_lock);
438 		} else {
439 			cv_wait(&xfer->ux_cv, pipe->up_dev->ud_bus->ub_lock);
440 		}
441 		if (err) {
442 			if (!xfer->ux_done) {
443 				SDT_PROBE1(usb, device, xfer, abort,  xfer);
444 				pipe->up_methods->upm_abort(xfer);
445 			}
446 			break;
447 		}
448 	}
449 	SDT_PROBE2(usb, device, xfer, done,  xfer, xfer->ux_status);
450 	/* XXX Race to read xfer->ux_status?  */
451 	usbd_unlock_pipe(pipe);
452 	return xfer->ux_status;
453 }
454 
455 /* Like usbd_transfer(), but waits for completion. */
456 usbd_status
457 usbd_sync_transfer(struct usbd_xfer *xfer)
458 {
459 	xfer->ux_flags |= USBD_SYNCHRONOUS;
460 	return usbd_transfer(xfer);
461 }
462 
463 /* Like usbd_transfer(), but waits for completion and listens for signals. */
464 usbd_status
465 usbd_sync_transfer_sig(struct usbd_xfer *xfer)
466 {
467 	xfer->ux_flags |= USBD_SYNCHRONOUS | USBD_SYNCHRONOUS_SIG;
468 	return usbd_transfer(xfer);
469 }
470 
471 static void *
472 usbd_alloc_buffer(struct usbd_xfer *xfer, uint32_t size)
473 {
474 	KASSERT(xfer->ux_buf == NULL);
475 	KASSERT(size != 0);
476 
477 	xfer->ux_bufsize = 0;
478 #if NUSB_DMA > 0
479 	struct usbd_bus *bus = xfer->ux_bus;
480 
481 	if (bus->ub_usedma) {
482 		usb_dma_t *dmap = &xfer->ux_dmabuf;
483 
484 		KASSERT((bus->ub_dmaflags & USBMALLOC_COHERENT) == 0);
485 		int err = usb_allocmem(bus, size, 0, bus->ub_dmaflags, dmap);
486 		if (err) {
487 			return NULL;
488 		}
489 		xfer->ux_buf = KERNADDR(&xfer->ux_dmabuf, 0);
490 		xfer->ux_bufsize = size;
491 
492 		return xfer->ux_buf;
493 	}
494 #endif
495 	KASSERT(xfer->ux_bus->ub_usedma == false);
496 	xfer->ux_buf = kmem_alloc(size, KM_SLEEP);
497 	xfer->ux_bufsize = size;
498 	return xfer->ux_buf;
499 }
500 
501 static void
502 usbd_free_buffer(struct usbd_xfer *xfer)
503 {
504 	KASSERT(xfer->ux_buf != NULL);
505 	KASSERT(xfer->ux_bufsize != 0);
506 
507 	void *buf = xfer->ux_buf;
508 	uint32_t size = xfer->ux_bufsize;
509 
510 	xfer->ux_buf = NULL;
511 	xfer->ux_bufsize = 0;
512 
513 #if NUSB_DMA > 0
514 	struct usbd_bus *bus = xfer->ux_bus;
515 
516 	if (bus->ub_usedma) {
517 		usb_dma_t *dmap = &xfer->ux_dmabuf;
518 
519 		usb_freemem(bus, dmap);
520 		return;
521 	}
522 #endif
523 	KASSERT(xfer->ux_bus->ub_usedma == false);
524 
525 	kmem_free(buf, size);
526 }
527 
528 void *
529 usbd_get_buffer(struct usbd_xfer *xfer)
530 {
531 	return xfer->ux_buf;
532 }
533 
534 struct usbd_pipe *
535 usbd_get_pipe0(struct usbd_device *dev)
536 {
537 
538 	return dev->ud_pipe0;
539 }
540 
541 static struct usbd_xfer *
542 usbd_alloc_xfer(struct usbd_device *dev, unsigned int nframes)
543 {
544 	struct usbd_xfer *xfer;
545 
546 	USBHIST_FUNC();
547 
548 	ASSERT_SLEEPABLE();
549 
550 	xfer = dev->ud_bus->ub_methods->ubm_allocx(dev->ud_bus, nframes);
551 	if (xfer == NULL)
552 		goto out;
553 	xfer->ux_bus = dev->ud_bus;
554 	callout_init(&xfer->ux_callout, CALLOUT_MPSAFE);
555 	callout_setfunc(&xfer->ux_callout, usbd_xfer_timeout, xfer);
556 	cv_init(&xfer->ux_cv, "usbxfer");
557 	usb_init_task(&xfer->ux_aborttask, usbd_xfer_timeout_task, xfer,
558 	    USB_TASKQ_MPSAFE);
559 
560 out:
561 	USBHIST_CALLARGS(usbdebug, "returns %#jx", (uintptr_t)xfer, 0, 0, 0);
562 
563 	return xfer;
564 }
565 
566 static usbd_status
567 usbd_free_xfer(struct usbd_xfer *xfer)
568 {
569 	USBHIST_FUNC();
570 	USBHIST_CALLARGS(usbdebug, "%#jx", (uintptr_t)xfer, 0, 0, 0);
571 
572 	if (xfer->ux_buf) {
573 		usbd_free_buffer(xfer);
574 	}
575 
576 	/* Wait for any straggling timeout to complete. */
577 	mutex_enter(xfer->ux_bus->ub_lock);
578 	xfer->ux_timeout_reset = false; /* do not resuscitate */
579 	callout_halt(&xfer->ux_callout, xfer->ux_bus->ub_lock);
580 	usb_rem_task_wait(xfer->ux_pipe->up_dev, &xfer->ux_aborttask,
581 	    USB_TASKQ_HC, xfer->ux_bus->ub_lock);
582 	mutex_exit(xfer->ux_bus->ub_lock);
583 
584 	cv_destroy(&xfer->ux_cv);
585 	xfer->ux_bus->ub_methods->ubm_freex(xfer->ux_bus, xfer);
586 	return USBD_NORMAL_COMPLETION;
587 }
588 
589 int
590 usbd_create_xfer(struct usbd_pipe *pipe, size_t len, unsigned int flags,
591     unsigned int nframes, struct usbd_xfer **xp)
592 {
593 	KASSERT(xp != NULL);
594 	void *buf = NULL;
595 
596 	struct usbd_xfer *xfer = usbd_alloc_xfer(pipe->up_dev, nframes);
597 	if (xfer == NULL)
598 		return ENOMEM;
599 
600 	xfer->ux_pipe = pipe;
601 	xfer->ux_flags = flags;
602 	xfer->ux_nframes = nframes;
603 	xfer->ux_methods = pipe->up_methods;
604 
605 	if (len) {
606 		buf = usbd_alloc_buffer(xfer, len);
607 		if (!buf) {
608 			usbd_free_xfer(xfer);
609 			return ENOMEM;
610 		}
611 	}
612 
613 	if (xfer->ux_methods->upm_init) {
614 		int err = xfer->ux_methods->upm_init(xfer);
615 		if (err) {
616 			usbd_free_xfer(xfer);
617 			return err;
618 		}
619 	}
620 
621 	*xp = xfer;
622 	SDT_PROBE5(usb, device, xfer, create,
623 	    xfer, pipe, len, flags, nframes);
624 	return 0;
625 }
626 
627 void
628 usbd_destroy_xfer(struct usbd_xfer *xfer)
629 {
630 
631 	SDT_PROBE1(usb, device, xfer, destroy,  xfer);
632 	if (xfer->ux_methods->upm_fini)
633 		xfer->ux_methods->upm_fini(xfer);
634 
635 	usbd_free_xfer(xfer);
636 }
637 
638 void
639 usbd_setup_xfer(struct usbd_xfer *xfer, void *priv, void *buffer,
640     uint32_t length, uint16_t flags, uint32_t timeout, usbd_callback callback)
641 {
642 	KASSERT(xfer->ux_pipe);
643 
644 	xfer->ux_priv = priv;
645 	xfer->ux_buffer = buffer;
646 	xfer->ux_length = length;
647 	xfer->ux_actlen = 0;
648 	xfer->ux_flags = flags;
649 	xfer->ux_timeout = timeout;
650 	xfer->ux_status = USBD_NOT_STARTED;
651 	xfer->ux_callback = callback;
652 	xfer->ux_rqflags &= ~URQ_REQUEST;
653 	xfer->ux_nframes = 0;
654 }
655 
656 void
657 usbd_setup_default_xfer(struct usbd_xfer *xfer, struct usbd_device *dev,
658     void *priv, uint32_t timeout, usb_device_request_t *req, void *buffer,
659     uint32_t length, uint16_t flags, usbd_callback callback)
660 {
661 	KASSERT(xfer->ux_pipe == dev->ud_pipe0);
662 
663 	xfer->ux_priv = priv;
664 	xfer->ux_buffer = buffer;
665 	xfer->ux_length = length;
666 	xfer->ux_actlen = 0;
667 	xfer->ux_flags = flags;
668 	xfer->ux_timeout = timeout;
669 	xfer->ux_status = USBD_NOT_STARTED;
670 	xfer->ux_callback = callback;
671 	xfer->ux_request = *req;
672 	xfer->ux_rqflags |= URQ_REQUEST;
673 	xfer->ux_nframes = 0;
674 }
675 
676 void
677 usbd_setup_isoc_xfer(struct usbd_xfer *xfer, void *priv, uint16_t *frlengths,
678     uint32_t nframes, uint16_t flags, usbd_callback callback)
679 {
680 	xfer->ux_priv = priv;
681 	xfer->ux_buffer = NULL;
682 	xfer->ux_length = 0;
683 	xfer->ux_actlen = 0;
684 	xfer->ux_flags = flags;
685 	xfer->ux_timeout = USBD_NO_TIMEOUT;
686 	xfer->ux_status = USBD_NOT_STARTED;
687 	xfer->ux_callback = callback;
688 	xfer->ux_rqflags &= ~URQ_REQUEST;
689 	xfer->ux_frlengths = frlengths;
690 	xfer->ux_nframes = nframes;
691 
692 	for (size_t i = 0; i < xfer->ux_nframes; i++)
693 		xfer->ux_length += xfer->ux_frlengths[i];
694 }
695 
696 void
697 usbd_get_xfer_status(struct usbd_xfer *xfer, void **priv,
698 		     void **buffer, uint32_t *count, usbd_status *status)
699 {
700 	if (priv != NULL)
701 		*priv = xfer->ux_priv;
702 	if (buffer != NULL)
703 		*buffer = xfer->ux_buffer;
704 	if (count != NULL)
705 		*count = xfer->ux_actlen;
706 	if (status != NULL)
707 		*status = xfer->ux_status;
708 }
709 
710 usb_config_descriptor_t *
711 usbd_get_config_descriptor(struct usbd_device *dev)
712 {
713 	KASSERT(dev != NULL);
714 
715 	return dev->ud_cdesc;
716 }
717 
718 usb_interface_descriptor_t *
719 usbd_get_interface_descriptor(struct usbd_interface *iface)
720 {
721 	KASSERT(iface != NULL);
722 
723 	return iface->ui_idesc;
724 }
725 
726 usb_device_descriptor_t *
727 usbd_get_device_descriptor(struct usbd_device *dev)
728 {
729 	KASSERT(dev != NULL);
730 
731 	return &dev->ud_ddesc;
732 }
733 
734 usb_endpoint_descriptor_t *
735 usbd_interface2endpoint_descriptor(struct usbd_interface *iface, uint8_t index)
736 {
737 
738 	if (index >= iface->ui_idesc->bNumEndpoints)
739 		return NULL;
740 	return iface->ui_endpoints[index].ue_edesc;
741 }
742 
743 /* Some drivers may wish to abort requests on the default pipe, *
744  * but there is no mechanism for getting a handle on it.        */
745 usbd_status
746 usbd_abort_default_pipe(struct usbd_device *device)
747 {
748 	return usbd_abort_pipe(device->ud_pipe0);
749 }
750 
751 usbd_status
752 usbd_abort_pipe(struct usbd_pipe *pipe)
753 {
754 	usbd_status err;
755 
756 	KASSERT(pipe != NULL);
757 
758 	usbd_lock_pipe(pipe);
759 	err = usbd_ar_pipe(pipe);
760 	usbd_unlock_pipe(pipe);
761 	return err;
762 }
763 
764 usbd_status
765 usbd_clear_endpoint_stall(struct usbd_pipe *pipe)
766 {
767 	struct usbd_device *dev = pipe->up_dev;
768 	usbd_status err;
769 
770 	USBHIST_FUNC(); USBHIST_CALLED(usbdebug);
771 	SDT_PROBE1(usb, device, pipe, clear__endpoint__stall,  pipe);
772 
773 	/*
774 	 * Clearing en endpoint stall resets the endpoint toggle, so
775 	 * do the same to the HC toggle.
776 	 */
777 	SDT_PROBE1(usb, device, pipe, clear__endpoint__toggle,  pipe);
778 	pipe->up_methods->upm_cleartoggle(pipe);
779 
780 	err = usbd_clear_endpoint_feature(dev,
781 	    pipe->up_endpoint->ue_edesc->bEndpointAddress, UF_ENDPOINT_HALT);
782 #if 0
783 XXX should we do this?
784 	if (!err) {
785 		pipe->state = USBD_PIPE_ACTIVE;
786 		/* XXX activate pipe */
787 	}
788 #endif
789 	return err;
790 }
791 
792 void
793 usbd_clear_endpoint_stall_task(void *arg)
794 {
795 	struct usbd_pipe *pipe = arg;
796 	struct usbd_device *dev = pipe->up_dev;
797 
798 	SDT_PROBE1(usb, device, pipe, clear__endpoint__stall,  pipe);
799 	SDT_PROBE1(usb, device, pipe, clear__endpoint__toggle,  pipe);
800 	pipe->up_methods->upm_cleartoggle(pipe);
801 
802 	(void)usbd_clear_endpoint_feature(dev,
803 	    pipe->up_endpoint->ue_edesc->bEndpointAddress, UF_ENDPOINT_HALT);
804 }
805 
806 void
807 usbd_clear_endpoint_stall_async(struct usbd_pipe *pipe)
808 {
809 	usb_add_task(pipe->up_dev, &pipe->up_async_task, USB_TASKQ_DRIVER);
810 }
811 
812 void
813 usbd_clear_endpoint_toggle(struct usbd_pipe *pipe)
814 {
815 
816 	SDT_PROBE1(usb, device, pipe, clear__endpoint__toggle,  pipe);
817 	pipe->up_methods->upm_cleartoggle(pipe);
818 }
819 
820 usbd_status
821 usbd_endpoint_count(struct usbd_interface *iface, uint8_t *count)
822 {
823 	KASSERT(iface != NULL);
824 	KASSERT(iface->ui_idesc != NULL);
825 
826 	*count = iface->ui_idesc->bNumEndpoints;
827 	return USBD_NORMAL_COMPLETION;
828 }
829 
830 usbd_status
831 usbd_interface_count(struct usbd_device *dev, uint8_t *count)
832 {
833 
834 	if (dev->ud_cdesc == NULL)
835 		return USBD_NOT_CONFIGURED;
836 	*count = dev->ud_cdesc->bNumInterface;
837 	return USBD_NORMAL_COMPLETION;
838 }
839 
840 void
841 usbd_interface2device_handle(struct usbd_interface *iface,
842 			     struct usbd_device **dev)
843 {
844 
845 	*dev = iface->ui_dev;
846 }
847 
848 usbd_status
849 usbd_device2interface_handle(struct usbd_device *dev,
850 			     uint8_t ifaceno, struct usbd_interface **iface)
851 {
852 
853 	if (dev->ud_cdesc == NULL)
854 		return USBD_NOT_CONFIGURED;
855 	if (ifaceno >= dev->ud_cdesc->bNumInterface)
856 		return USBD_INVAL;
857 	*iface = &dev->ud_ifaces[ifaceno];
858 	return USBD_NORMAL_COMPLETION;
859 }
860 
861 struct usbd_device *
862 usbd_pipe2device_handle(struct usbd_pipe *pipe)
863 {
864 	KASSERT(pipe != NULL);
865 
866 	return pipe->up_dev;
867 }
868 
869 /* XXXX use altno */
870 usbd_status
871 usbd_set_interface(struct usbd_interface *iface, int altidx)
872 {
873 	usb_device_request_t req;
874 	usbd_status err;
875 	void *endpoints;
876 
877 	USBHIST_FUNC();
878 
879 	if (LIST_FIRST(&iface->ui_pipes) != NULL)
880 		return USBD_IN_USE;
881 
882 	endpoints = iface->ui_endpoints;
883 	int nendpt = iface->ui_idesc->bNumEndpoints;
884 	USBHIST_CALLARGS(usbdebug, "iface %#jx endpoints = %#jx nendpt %jd",
885 	    (uintptr_t)iface, (uintptr_t)endpoints,
886 	    iface->ui_idesc->bNumEndpoints, 0);
887 	err = usbd_fill_iface_data(iface->ui_dev, iface->ui_index, altidx);
888 	if (err)
889 		return err;
890 
891 	/* new setting works, we can free old endpoints */
892 	if (endpoints != NULL) {
893 		USBHIST_LOG(usbdebug, "iface %#jx endpoints = %#jx nendpt %jd",
894 		    (uintptr_t)iface, (uintptr_t)endpoints, nendpt, 0);
895 		kmem_free(endpoints, nendpt * sizeof(struct usbd_endpoint));
896 	}
897 	KASSERT(iface->ui_idesc != NULL);
898 
899 	req.bmRequestType = UT_WRITE_INTERFACE;
900 	req.bRequest = UR_SET_INTERFACE;
901 	USETW(req.wValue, iface->ui_idesc->bAlternateSetting);
902 	USETW(req.wIndex, iface->ui_idesc->bInterfaceNumber);
903 	USETW(req.wLength, 0);
904 	return usbd_do_request(iface->ui_dev, &req, 0);
905 }
906 
907 int
908 usbd_get_no_alts(usb_config_descriptor_t *cdesc, int ifaceno)
909 {
910 	char *p = (char *)cdesc;
911 	char *end = p + UGETW(cdesc->wTotalLength);
912 	usb_interface_descriptor_t *d;
913 	int n;
914 
915 	for (n = 0; p < end; p += d->bLength) {
916 		d = (usb_interface_descriptor_t *)p;
917 		if (p + d->bLength <= end &&
918 		    d->bDescriptorType == UDESC_INTERFACE &&
919 		    d->bInterfaceNumber == ifaceno)
920 			n++;
921 	}
922 	return n;
923 }
924 
925 int
926 usbd_get_interface_altindex(struct usbd_interface *iface)
927 {
928 	return iface->ui_altindex;
929 }
930 
931 usbd_status
932 usbd_get_interface(struct usbd_interface *iface, uint8_t *aiface)
933 {
934 	usb_device_request_t req;
935 
936 	req.bmRequestType = UT_READ_INTERFACE;
937 	req.bRequest = UR_GET_INTERFACE;
938 	USETW(req.wValue, 0);
939 	USETW(req.wIndex, iface->ui_idesc->bInterfaceNumber);
940 	USETW(req.wLength, 1);
941 	return usbd_do_request(iface->ui_dev, &req, aiface);
942 }
943 
944 /*** Internal routines ***/
945 
946 /* Dequeue all pipe operations, called with bus lock held. */
947 Static usbd_status
948 usbd_ar_pipe(struct usbd_pipe *pipe)
949 {
950 	struct usbd_xfer *xfer;
951 
952 	USBHIST_FUNC();
953 	USBHIST_CALLARGS(usbdebug, "pipe = %#jx", (uintptr_t)pipe, 0, 0, 0);
954 	SDT_PROBE1(usb, device, pipe, abort__start,  pipe);
955 
956 	KASSERT(mutex_owned(pipe->up_dev->ud_bus->ub_lock));
957 
958 #ifdef USB_DEBUG
959 	if (usbdebug > 5)
960 		usbd_dump_queue(pipe);
961 #endif
962 	pipe->up_repeat = 0;
963 	pipe->up_running = 0;
964 	pipe->up_aborting = 1;
965 	while ((xfer = SIMPLEQ_FIRST(&pipe->up_queue)) != NULL) {
966 		USBHIST_LOG(usbdebug, "pipe = %#jx xfer = %#jx "
967 		    "(methods = %#jx)", (uintptr_t)pipe, (uintptr_t)xfer,
968 		    (uintptr_t)pipe->up_methods, 0);
969 		if (xfer->ux_status == USBD_NOT_STARTED) {
970 			SDT_PROBE1(usb, device, xfer, preabort,  xfer);
971 #ifdef DIAGNOSTIC
972 			xfer->ux_state = XFER_BUSY;
973 #endif
974 			SIMPLEQ_REMOVE_HEAD(&pipe->up_queue, ux_next);
975 		} else {
976 			/* Make the HC abort it (and invoke the callback). */
977 			SDT_PROBE1(usb, device, xfer, abort,  xfer);
978 			pipe->up_methods->upm_abort(xfer);
979 			/* XXX only for non-0 usbd_clear_endpoint_stall(pipe); */
980 		}
981 	}
982 	pipe->up_aborting = 0;
983 	SDT_PROBE1(usb, device, pipe, abort__done,  pipe);
984 	return USBD_NORMAL_COMPLETION;
985 }
986 
987 /* Called with USB lock held. */
988 void
989 usb_transfer_complete(struct usbd_xfer *xfer)
990 {
991 	struct usbd_pipe *pipe = xfer->ux_pipe;
992 	struct usbd_bus *bus = pipe->up_dev->ud_bus;
993 	int sync = xfer->ux_flags & USBD_SYNCHRONOUS;
994 	int erred;
995 	int polling = bus->ub_usepolling;
996 	int repeat = pipe->up_repeat;
997 
998 	USBHIST_FUNC();
999 	USBHIST_CALLARGS(usbdebug, "pipe = %#jx xfer = %#jx status = %jd "
1000 	    "actlen = %jd", (uintptr_t)pipe, (uintptr_t)xfer, xfer->ux_status,
1001 	    xfer->ux_actlen);
1002 
1003 	KASSERT(polling || mutex_owned(pipe->up_dev->ud_bus->ub_lock));
1004 	KASSERTMSG(xfer->ux_state == XFER_ONQU, "xfer %p state is %x", xfer,
1005 	    xfer->ux_state);
1006 	KASSERT(pipe != NULL);
1007 
1008 	/*
1009 	 * If device is known to miss out ack, then pretend that
1010 	 * output timeout is a success. Userland should handle
1011 	 * the logic to verify that the operation succeeded.
1012 	 */
1013 	if (pipe->up_dev->ud_quirks &&
1014 	    pipe->up_dev->ud_quirks->uq_flags & UQ_MISS_OUT_ACK &&
1015 	    xfer->ux_status == USBD_TIMEOUT &&
1016 	    !usbd_xfer_isread(xfer)) {
1017 		USBHIST_LOG(usbdebug, "Possible output ack miss for xfer %#jx: "
1018 		    "hiding write timeout to %jd.%jd for %ju bytes written",
1019 		    (uintptr_t)xfer, curlwp->l_proc->p_pid, curlwp->l_lid,
1020 		    xfer->ux_length);
1021 
1022 		xfer->ux_status = USBD_NORMAL_COMPLETION;
1023 		xfer->ux_actlen = xfer->ux_length;
1024 	}
1025 
1026 	erred = xfer->ux_status == USBD_CANCELLED ||
1027 	        xfer->ux_status == USBD_TIMEOUT;
1028 
1029 	if (!repeat) {
1030 		/* Remove request from queue. */
1031 
1032 		KASSERTMSG(!SIMPLEQ_EMPTY(&pipe->up_queue),
1033 		    "pipe %p is empty, but xfer %p wants to complete", pipe,
1034 		     xfer);
1035 		KASSERTMSG(xfer == SIMPLEQ_FIRST(&pipe->up_queue),
1036 		    "xfer %p is not start of queue (%p is at start)", xfer,
1037 		   SIMPLEQ_FIRST(&pipe->up_queue));
1038 
1039 #ifdef DIAGNOSTIC
1040 		xfer->ux_state = XFER_BUSY;
1041 #endif
1042 		SIMPLEQ_REMOVE_HEAD(&pipe->up_queue, ux_next);
1043 	}
1044 	USBHIST_LOG(usbdebug, "xfer %#jx: repeat %jd new head = %#jx",
1045 	    (uintptr_t)xfer, repeat, (uintptr_t)SIMPLEQ_FIRST(&pipe->up_queue),
1046 	    0);
1047 
1048 	/* Count completed transfers. */
1049 	++pipe->up_dev->ud_bus->ub_stats.uds_requests
1050 		[pipe->up_endpoint->ue_edesc->bmAttributes & UE_XFERTYPE];
1051 
1052 	xfer->ux_done = 1;
1053 	if (!xfer->ux_status && xfer->ux_actlen < xfer->ux_length &&
1054 	    !(xfer->ux_flags & USBD_SHORT_XFER_OK)) {
1055 		USBHIST_LOG(usbdebug, "short transfer %jd < %jd",
1056 		    xfer->ux_actlen, xfer->ux_length, 0, 0);
1057 		xfer->ux_status = USBD_SHORT_XFER;
1058 	}
1059 
1060 	USBHIST_LOG(usbdebug, "xfer %#jx doing done %#jx", (uintptr_t)xfer,
1061 	    (uintptr_t)pipe->up_methods->upm_done, 0, 0);
1062 	SDT_PROBE2(usb, device, xfer, done,  xfer, xfer->ux_status);
1063 	pipe->up_methods->upm_done(xfer);
1064 
1065 	if (xfer->ux_length != 0 && xfer->ux_buffer != xfer->ux_buf) {
1066 		KDASSERTMSG(xfer->ux_actlen <= xfer->ux_length,
1067 		    "actlen %d length %d",xfer->ux_actlen, xfer->ux_length);
1068 
1069 		/* Only if IN transfer */
1070 		if (usbd_xfer_isread(xfer)) {
1071 			memcpy(xfer->ux_buffer, xfer->ux_buf, xfer->ux_actlen);
1072 		}
1073 	}
1074 
1075 	USBHIST_LOG(usbdebug, "xfer %#jx doing callback %#jx status %jd",
1076 	    (uintptr_t)xfer, (uintptr_t)xfer->ux_callback, xfer->ux_status, 0);
1077 
1078 	if (xfer->ux_callback) {
1079 		if (!polling) {
1080 			mutex_exit(pipe->up_dev->ud_bus->ub_lock);
1081 			if (!(pipe->up_flags & USBD_MPSAFE))
1082 				KERNEL_LOCK(1, curlwp);
1083 		}
1084 
1085 		xfer->ux_callback(xfer, xfer->ux_priv, xfer->ux_status);
1086 
1087 		if (!polling) {
1088 			if (!(pipe->up_flags & USBD_MPSAFE))
1089 				KERNEL_UNLOCK_ONE(curlwp);
1090 			mutex_enter(pipe->up_dev->ud_bus->ub_lock);
1091 		}
1092 	}
1093 
1094 	if (sync && !polling) {
1095 		USBHIST_LOG(usbdebug, "<- done xfer %#jx, wakeup",
1096 		    (uintptr_t)xfer, 0, 0, 0);
1097 		cv_broadcast(&xfer->ux_cv);
1098 	}
1099 
1100 	if (repeat) {
1101 		xfer->ux_actlen = 0;
1102 		xfer->ux_status = USBD_NOT_STARTED;
1103 	} else {
1104 		/* XXX should we stop the queue on all errors? */
1105 		if (erred && pipe->up_iface != NULL)	/* not control pipe */
1106 			pipe->up_running = 0;
1107 	}
1108 	if (pipe->up_running && pipe->up_serialise)
1109 		usbd_start_next(pipe);
1110 }
1111 
1112 /* Called with USB lock held. */
1113 usbd_status
1114 usb_insert_transfer(struct usbd_xfer *xfer)
1115 {
1116 	struct usbd_pipe *pipe = xfer->ux_pipe;
1117 	usbd_status err;
1118 
1119 	USBHIST_FUNC(); USBHIST_CALLARGS(usbdebug,
1120 	    "xfer = %#jx pipe = %#jx running = %jd timeout = %jd",
1121 	    (uintptr_t)xfer, (uintptr_t)pipe,
1122 	    pipe->up_running, xfer->ux_timeout);
1123 
1124 	KASSERT(mutex_owned(pipe->up_dev->ud_bus->ub_lock));
1125 	KASSERTMSG(xfer->ux_state == XFER_BUSY, "xfer %p state is %x", xfer,
1126 	    xfer->ux_state);
1127 
1128 #ifdef DIAGNOSTIC
1129 	xfer->ux_state = XFER_ONQU;
1130 #endif
1131 	SIMPLEQ_INSERT_TAIL(&pipe->up_queue, xfer, ux_next);
1132 	if (pipe->up_running && pipe->up_serialise)
1133 		err = USBD_IN_PROGRESS;
1134 	else {
1135 		pipe->up_running = 1;
1136 		err = USBD_NORMAL_COMPLETION;
1137 	}
1138 	USBHIST_LOG(usbdebug, "<- done xfer %#jx, err %jd", (uintptr_t)xfer,
1139 	    err, 0, 0);
1140 	return err;
1141 }
1142 
1143 /* Called with USB lock held. */
1144 void
1145 usbd_start_next(struct usbd_pipe *pipe)
1146 {
1147 	struct usbd_xfer *xfer;
1148 	usbd_status err;
1149 
1150 	USBHIST_FUNC();
1151 
1152 	KASSERT(pipe != NULL);
1153 	KASSERT(pipe->up_methods != NULL);
1154 	KASSERT(pipe->up_methods->upm_start != NULL);
1155 	KASSERT(pipe->up_serialise == true);
1156 
1157 	int polling = pipe->up_dev->ud_bus->ub_usepolling;
1158 	KASSERT(polling || mutex_owned(pipe->up_dev->ud_bus->ub_lock));
1159 
1160 	/* Get next request in queue. */
1161 	xfer = SIMPLEQ_FIRST(&pipe->up_queue);
1162 	USBHIST_CALLARGS(usbdebug, "pipe = %#jx, xfer = %#jx", (uintptr_t)pipe,
1163 	    (uintptr_t)xfer, 0, 0);
1164 	if (xfer == NULL) {
1165 		pipe->up_running = 0;
1166 	} else {
1167 		if (!polling)
1168 			mutex_exit(pipe->up_dev->ud_bus->ub_lock);
1169 		SDT_PROBE2(usb, device, pipe, start,  pipe, xfer);
1170 		err = pipe->up_methods->upm_start(xfer);
1171 		if (!polling)
1172 			mutex_enter(pipe->up_dev->ud_bus->ub_lock);
1173 
1174 		if (err != USBD_IN_PROGRESS) {
1175 			USBHIST_LOG(usbdebug, "error = %jd", err, 0, 0, 0);
1176 			pipe->up_running = 0;
1177 			/* XXX do what? */
1178 		}
1179 	}
1180 
1181 	KASSERT(polling || mutex_owned(pipe->up_dev->ud_bus->ub_lock));
1182 }
1183 
1184 usbd_status
1185 usbd_do_request(struct usbd_device *dev, usb_device_request_t *req, void *data)
1186 {
1187 
1188 	return usbd_do_request_flags(dev, req, data, 0, 0,
1189 	    USBD_DEFAULT_TIMEOUT);
1190 }
1191 
1192 usbd_status
1193 usbd_do_request_flags(struct usbd_device *dev, usb_device_request_t *req,
1194     void *data, uint16_t flags, int *actlen, uint32_t timeout)
1195 {
1196 	size_t len = UGETW(req->wLength);
1197 
1198 	return usbd_do_request_len(dev, req, len, data, flags, actlen, timeout);
1199 }
1200 
1201 usbd_status
1202 usbd_do_request_len(struct usbd_device *dev, usb_device_request_t *req,
1203     size_t len, void *data, uint16_t flags, int *actlen, uint32_t timeout)
1204 {
1205 	struct usbd_xfer *xfer;
1206 	usbd_status err;
1207 
1208 	KASSERT(len >= UGETW(req->wLength));
1209 
1210 	USBHIST_FUNC();
1211 	USBHIST_CALLARGS(usbdebug, "dev=%#jx req=%jx flags=%jx len=%jx",
1212 	    (uintptr_t)dev, (uintptr_t)req, flags, len);
1213 
1214 	ASSERT_SLEEPABLE();
1215 
1216 	int error = usbd_create_xfer(dev->ud_pipe0, len, 0, 0, &xfer);
1217 	if (error)
1218 		return error;
1219 
1220 	usbd_setup_default_xfer(xfer, dev, 0, timeout, req, data,
1221 	    UGETW(req->wLength), flags, NULL);
1222 	KASSERT(xfer->ux_pipe == dev->ud_pipe0);
1223 	err = usbd_sync_transfer(xfer);
1224 #if defined(USB_DEBUG) || defined(DIAGNOSTIC)
1225 	if (xfer->ux_actlen > xfer->ux_length) {
1226 		USBHIST_LOG(usbdebug, "overrun addr = %jd type = 0x%02jx",
1227 		    dev->ud_addr, xfer->ux_request.bmRequestType, 0, 0);
1228 		USBHIST_LOG(usbdebug, "     req = 0x%02jx val = %jd "
1229 		    "index = %jd",
1230 		    xfer->ux_request.bRequest, UGETW(xfer->ux_request.wValue),
1231 		    UGETW(xfer->ux_request.wIndex), 0);
1232 		USBHIST_LOG(usbdebug, "     rlen = %jd length = %jd "
1233 		    "actlen = %jd",
1234 		    UGETW(xfer->ux_request.wLength),
1235 		    xfer->ux_length, xfer->ux_actlen, 0);
1236 	}
1237 #endif
1238 	if (actlen != NULL)
1239 		*actlen = xfer->ux_actlen;
1240 
1241 	usbd_destroy_xfer(xfer);
1242 
1243 	if (err) {
1244 		USBHIST_LOG(usbdebug, "returning err = %jd", err, 0, 0, 0);
1245 	}
1246 	return err;
1247 }
1248 
1249 static void
1250 usbd_request_async_cb(struct usbd_xfer *xfer, void *priv, usbd_status status)
1251 {
1252 	usbd_destroy_xfer(xfer);
1253 }
1254 
1255 /*
1256  * Execute a request without waiting for completion.
1257  * Can be used from interrupt context.
1258  */
1259 usbd_status
1260 usbd_request_async(struct usbd_device *dev, struct usbd_xfer *xfer,
1261     usb_device_request_t *req, void *priv, usbd_callback callback)
1262 {
1263 	usbd_status err;
1264 
1265 	if (callback == NULL)
1266 		callback = usbd_request_async_cb;
1267 
1268 	usbd_setup_default_xfer(xfer, dev, priv,
1269 	    USBD_DEFAULT_TIMEOUT, req, NULL, UGETW(req->wLength), 0,
1270 	    callback);
1271 	err = usbd_transfer(xfer);
1272 	if (err != USBD_IN_PROGRESS) {
1273 		usbd_destroy_xfer(xfer);
1274 		return (err);
1275 	}
1276 	return (USBD_NORMAL_COMPLETION);
1277 }
1278 
1279 const struct usbd_quirks *
1280 usbd_get_quirks(struct usbd_device *dev)
1281 {
1282 #ifdef DIAGNOSTIC
1283 	if (dev == NULL) {
1284 		printf("usbd_get_quirks: dev == NULL\n");
1285 		return 0;
1286 	}
1287 #endif
1288 	return dev->ud_quirks;
1289 }
1290 
1291 /* XXX do periodic free() of free list */
1292 
1293 /*
1294  * Called from keyboard driver when in polling mode.
1295  */
1296 void
1297 usbd_dopoll(struct usbd_interface *iface)
1298 {
1299 	iface->ui_dev->ud_bus->ub_methods->ubm_dopoll(iface->ui_dev->ud_bus);
1300 }
1301 
1302 /*
1303  * This is for keyboard driver as well, which only operates in polling
1304  * mode from the ask root, etc., prompt and from DDB.
1305  */
1306 void
1307 usbd_set_polling(struct usbd_device *dev, int on)
1308 {
1309 	if (on)
1310 		dev->ud_bus->ub_usepolling++;
1311 	else
1312 		dev->ud_bus->ub_usepolling--;
1313 
1314 	/* Kick the host controller when switching modes */
1315 	mutex_enter(dev->ud_bus->ub_lock);
1316 	dev->ud_bus->ub_methods->ubm_softint(dev->ud_bus);
1317 	mutex_exit(dev->ud_bus->ub_lock);
1318 }
1319 
1320 
1321 usb_endpoint_descriptor_t *
1322 usbd_get_endpoint_descriptor(struct usbd_interface *iface, uint8_t address)
1323 {
1324 	struct usbd_endpoint *ep;
1325 	int i;
1326 
1327 	for (i = 0; i < iface->ui_idesc->bNumEndpoints; i++) {
1328 		ep = &iface->ui_endpoints[i];
1329 		if (ep->ue_edesc->bEndpointAddress == address)
1330 			return iface->ui_endpoints[i].ue_edesc;
1331 	}
1332 	return NULL;
1333 }
1334 
1335 /*
1336  * usbd_ratecheck() can limit the number of error messages that occurs.
1337  * When a device is unplugged it may take up to 0.25s for the hub driver
1338  * to notice it.  If the driver continuously tries to do I/O operations
1339  * this can generate a large number of messages.
1340  */
1341 int
1342 usbd_ratecheck(struct timeval *last)
1343 {
1344 	static struct timeval errinterval = { 0, 250000 }; /* 0.25 s*/
1345 
1346 	return ratecheck(last, &errinterval);
1347 }
1348 
1349 /*
1350  * Search for a vendor/product pair in an array.  The item size is
1351  * given as an argument.
1352  */
1353 const struct usb_devno *
1354 usb_match_device(const struct usb_devno *tbl, u_int nentries, u_int sz,
1355 		 uint16_t vendor, uint16_t product)
1356 {
1357 	while (nentries-- > 0) {
1358 		uint16_t tproduct = tbl->ud_product;
1359 		if (tbl->ud_vendor == vendor &&
1360 		    (tproduct == product || tproduct == USB_PRODUCT_ANY))
1361 			return tbl;
1362 		tbl = (const struct usb_devno *)((const char *)tbl + sz);
1363 	}
1364 	return NULL;
1365 }
1366 
1367 usbd_status
1368 usbd_get_string(struct usbd_device *dev, int si, char *buf)
1369 {
1370 	return usbd_get_string0(dev, si, buf, 1);
1371 }
1372 
1373 usbd_status
1374 usbd_get_string0(struct usbd_device *dev, int si, char *buf, int unicode)
1375 {
1376 	int swap = dev->ud_quirks->uq_flags & UQ_SWAP_UNICODE;
1377 	usb_string_descriptor_t us;
1378 	char *s;
1379 	int i, n;
1380 	uint16_t c;
1381 	usbd_status err;
1382 	int size;
1383 
1384 	USBHIST_FUNC(); USBHIST_CALLED(usbdebug);
1385 
1386 	buf[0] = '\0';
1387 	if (si == 0)
1388 		return USBD_INVAL;
1389 	if (dev->ud_quirks->uq_flags & UQ_NO_STRINGS)
1390 		return USBD_STALLED;
1391 	if (dev->ud_langid == USBD_NOLANG) {
1392 		/* Set up default language */
1393 		err = usbd_get_string_desc(dev, USB_LANGUAGE_TABLE, 0, &us,
1394 		    &size);
1395 		if (err || size < 4) {
1396 			USBHIST_LOG(usbdebug, "getting lang failed, using 0",
1397 			    0, 0, 0, 0);
1398 			dev->ud_langid = 0; /* Well, just pick something then */
1399 		} else {
1400 			/* Pick the first language as the default. */
1401 			dev->ud_langid = UGETW(us.bString[0]);
1402 		}
1403 	}
1404 	err = usbd_get_string_desc(dev, si, dev->ud_langid, &us, &size);
1405 	if (err)
1406 		return err;
1407 	s = buf;
1408 	n = size / 2 - 1;
1409 	if (unicode) {
1410 		for (i = 0; i < n; i++) {
1411 			c = UGETW(us.bString[i]);
1412 			if (swap)
1413 				c = (c >> 8) | (c << 8);
1414 			s += wput_utf8(s, 3, c);
1415 		}
1416 		*s++ = 0;
1417 	}
1418 #ifdef COMPAT_30
1419 	else {
1420 		for (i = 0; i < n; i++) {
1421 			c = UGETW(us.bString[i]);
1422 			if (swap)
1423 				c = (c >> 8) | (c << 8);
1424 			*s++ = (c < 0x80) ? c : '?';
1425 		}
1426 		*s++ = 0;
1427 	}
1428 #endif
1429 	return USBD_NORMAL_COMPLETION;
1430 }
1431 
1432 /*
1433  * usbd_xfer_trycomplete(xfer)
1434  *
1435  *	Try to claim xfer for completion.  Return true if successful,
1436  *	false if the xfer has been synchronously aborted or has timed
1437  *	out.
1438  *
1439  *	If this returns true, caller is responsible for setting
1440  *	xfer->ux_status and calling usb_transfer_complete.  To be used
1441  *	in a host controller interrupt handler.
1442  *
1443  *	Caller must either hold the bus lock or have the bus in polling
1444  *	mode.
1445  */
1446 bool
1447 usbd_xfer_trycomplete(struct usbd_xfer *xfer)
1448 {
1449 	struct usbd_bus *bus __diagused = xfer->ux_bus;
1450 
1451 	KASSERT(bus->ub_usepolling || mutex_owned(bus->ub_lock));
1452 
1453 	/*
1454 	 * If software has completed it, either by synchronous abort or
1455 	 * by timeout, too late.
1456 	 */
1457 	if (xfer->ux_status != USBD_IN_PROGRESS)
1458 		return false;
1459 
1460 	/*
1461 	 * We are completing the xfer.  Cancel the timeout if we can,
1462 	 * but only asynchronously.  See usbd_xfer_cancel_timeout_async
1463 	 * for why we need not wait for the callout or task here.
1464 	 */
1465 	usbd_xfer_cancel_timeout_async(xfer);
1466 
1467 	/* Success!  Note: Caller must set xfer->ux_status afterwar.  */
1468 	return true;
1469 }
1470 
1471 /*
1472  * usbd_xfer_abort(xfer)
1473  *
1474  *	Try to claim xfer to abort.  If successful, mark it completed
1475  *	with USBD_CANCELLED and call the bus-specific method to abort
1476  *	at the hardware level.
1477  *
1478  *	To be called in thread context from struct
1479  *	usbd_pipe_methods::upm_abort.
1480  *
1481  *	Caller must hold the bus lock.
1482  */
1483 void
1484 usbd_xfer_abort(struct usbd_xfer *xfer)
1485 {
1486 	struct usbd_bus *bus = xfer->ux_bus;
1487 
1488 	KASSERT(mutex_owned(bus->ub_lock));
1489 
1490 	/*
1491 	 * If host controller interrupt or timer interrupt has
1492 	 * completed it, too late.  But the xfer cannot be
1493 	 * cancelled already -- only one caller can synchronously
1494 	 * abort.
1495 	 */
1496 	KASSERT(xfer->ux_status != USBD_CANCELLED);
1497 	if (xfer->ux_status != USBD_IN_PROGRESS)
1498 		return;
1499 
1500 	/*
1501 	 * Cancel the timeout if we can, but only asynchronously; see
1502 	 * usbd_xfer_cancel_timeout_async for why we need not wait for
1503 	 * the callout or task here.
1504 	 */
1505 	usbd_xfer_cancel_timeout_async(xfer);
1506 
1507 	/*
1508 	 * We beat everyone else.  Claim the status as cancelled and do
1509 	 * the bus-specific dance to abort the hardware.
1510 	 */
1511 	xfer->ux_status = USBD_CANCELLED;
1512 	bus->ub_methods->ubm_abortx(xfer);
1513 }
1514 
1515 /*
1516  * usbd_xfer_timeout(xfer)
1517  *
1518  *	Called at IPL_SOFTCLOCK when too much time has elapsed waiting
1519  *	for xfer to complete.  Since we can't abort the xfer at
1520  *	IPL_SOFTCLOCK, defer to a usb_task to run it in thread context,
1521  *	unless the xfer has completed or aborted concurrently -- and if
1522  *	the xfer has also been resubmitted, take care of rescheduling
1523  *	the callout.
1524  */
1525 static void
1526 usbd_xfer_timeout(void *cookie)
1527 {
1528 	struct usbd_xfer *xfer = cookie;
1529 	struct usbd_bus *bus = xfer->ux_bus;
1530 	struct usbd_device *dev = xfer->ux_pipe->up_dev;
1531 
1532 	/* Acquire the lock so we can transition the timeout state.  */
1533 	mutex_enter(bus->ub_lock);
1534 
1535 	/*
1536 	 * Use usbd_xfer_probe_timeout to check whether the timeout is
1537 	 * still valid, or to reschedule the callout if necessary.  If
1538 	 * it is still valid, schedule the task.
1539 	 */
1540 	if (usbd_xfer_probe_timeout(xfer))
1541 		usb_add_task(dev, &xfer->ux_aborttask, USB_TASKQ_HC);
1542 
1543 	/*
1544 	 * Notify usbd_xfer_cancel_timeout_async that we may have
1545 	 * scheduled the task.  This causes callout_invoking to return
1546 	 * false in usbd_xfer_cancel_timeout_async so that it can tell
1547 	 * which stage in the callout->task->abort process we're at.
1548 	 */
1549 	callout_ack(&xfer->ux_callout);
1550 
1551 	/* All done -- release the lock.  */
1552 	mutex_exit(bus->ub_lock);
1553 }
1554 
1555 /*
1556  * usbd_xfer_timeout_task(xfer)
1557  *
1558  *	Called in thread context when too much time has elapsed waiting
1559  *	for xfer to complete.  Abort the xfer with USBD_TIMEOUT, unless
1560  *	it has completed or aborted concurrently -- and if the xfer has
1561  *	also been resubmitted, take care of rescheduling the callout.
1562  */
1563 static void
1564 usbd_xfer_timeout_task(void *cookie)
1565 {
1566 	struct usbd_xfer *xfer = cookie;
1567 	struct usbd_bus *bus = xfer->ux_bus;
1568 
1569 	/* Acquire the lock so we can transition the timeout state.  */
1570 	mutex_enter(bus->ub_lock);
1571 
1572 	/*
1573 	 * Use usbd_xfer_probe_timeout to check whether the timeout is
1574 	 * still valid, or to reschedule the callout if necessary.  If
1575 	 * it is not valid -- the timeout has been asynchronously
1576 	 * cancelled, or the xfer has already been resubmitted -- then
1577 	 * we're done here.
1578 	 */
1579 	if (!usbd_xfer_probe_timeout(xfer))
1580 		goto out;
1581 
1582 	/*
1583 	 * May have completed or been aborted, but we're the only one
1584 	 * who can time it out.  If it has completed or been aborted,
1585 	 * no need to timeout.
1586 	 */
1587 	KASSERT(xfer->ux_status != USBD_TIMEOUT);
1588 	if (xfer->ux_status != USBD_IN_PROGRESS)
1589 		goto out;
1590 
1591 	/*
1592 	 * We beat everyone else.  Claim the status as timed out and do
1593 	 * the bus-specific dance to abort the hardware.
1594 	 */
1595 	xfer->ux_status = USBD_TIMEOUT;
1596 	bus->ub_methods->ubm_abortx(xfer);
1597 
1598 out:	/* All done -- release the lock.  */
1599 	mutex_exit(bus->ub_lock);
1600 }
1601 
1602 /*
1603  * usbd_xfer_probe_timeout(xfer)
1604  *
1605  *	Probe the status of xfer's timeout.  Acknowledge and process a
1606  *	request to reschedule.  Return true if the timeout is still
1607  *	valid and the caller should take further action (queueing a
1608  *	task or aborting the xfer), false if it must stop here.
1609  */
1610 static bool
1611 usbd_xfer_probe_timeout(struct usbd_xfer *xfer)
1612 {
1613 	struct usbd_bus *bus = xfer->ux_bus;
1614 	bool valid;
1615 
1616 	KASSERT(bus->ub_usepolling || mutex_owned(bus->ub_lock));
1617 
1618 	/* The timeout must be set.  */
1619 	KASSERT(xfer->ux_timeout_set);
1620 
1621 	/*
1622 	 * Neither callout nor task may be pending; they execute
1623 	 * alternately in lock step.
1624 	 */
1625 	KASSERT(!callout_pending(&xfer->ux_callout));
1626 	KASSERT(!usb_task_pending(xfer->ux_pipe->up_dev, &xfer->ux_aborttask));
1627 
1628 	/* There are a few cases... */
1629 	if (bus->ub_methods->ubm_dying(bus)) {
1630 		/* Host controller dying.  Drop it all on the floor.  */
1631 		xfer->ux_timeout_set = false;
1632 		xfer->ux_timeout_reset = false;
1633 		valid = false;
1634 	} else if (xfer->ux_timeout_reset) {
1635 		/*
1636 		 * The xfer completed _and_ got resubmitted while we
1637 		 * waited for the lock.  Acknowledge the request to
1638 		 * reschedule, and reschedule it if there is a timeout
1639 		 * and the bus is not polling.
1640 		 */
1641 		xfer->ux_timeout_reset = false;
1642 		if (xfer->ux_timeout && !bus->ub_usepolling) {
1643 			KASSERT(xfer->ux_timeout_set);
1644 			callout_schedule(&xfer->ux_callout,
1645 			    mstohz(xfer->ux_timeout));
1646 		} else {
1647 			/* No more callout or task scheduled.  */
1648 			xfer->ux_timeout_set = false;
1649 		}
1650 		valid = false;
1651 	} else if (xfer->ux_status != USBD_IN_PROGRESS) {
1652 		/*
1653 		 * The xfer has completed by hardware completion or by
1654 		 * software abort, and has not been resubmitted, so the
1655 		 * timeout must be unset, and is no longer valid for
1656 		 * the caller.
1657 		 */
1658 		xfer->ux_timeout_set = false;
1659 		valid = false;
1660 	} else {
1661 		/*
1662 		 * The xfer has not yet completed, so the timeout is
1663 		 * valid.
1664 		 */
1665 		valid = true;
1666 	}
1667 
1668 	/* Any reset must have been processed.  */
1669 	KASSERT(!xfer->ux_timeout_reset);
1670 
1671 	/*
1672 	 * Either we claim the timeout is set, or the callout is idle.
1673 	 * If the timeout is still set, we may be handing off to the
1674 	 * task instead, so this is an if but not an iff.
1675 	 */
1676 	KASSERT(xfer->ux_timeout_set || !callout_pending(&xfer->ux_callout));
1677 
1678 	/*
1679 	 * The task must be idle now.
1680 	 *
1681 	 * - If the caller is the callout, _and_ the timeout is still
1682 	 *   valid, the caller will schedule it, but it hasn't been
1683 	 *   scheduled yet.  (If the timeout is not valid, the task
1684 	 *   should not be scheduled.)
1685 	 *
1686 	 * - If the caller is the task, it cannot be scheduled again
1687 	 *   until the callout runs again, which won't happen until we
1688 	 *   next release the lock.
1689 	 */
1690 	KASSERT(!usb_task_pending(xfer->ux_pipe->up_dev, &xfer->ux_aborttask));
1691 
1692 	KASSERT(bus->ub_usepolling || mutex_owned(bus->ub_lock));
1693 
1694 	return valid;
1695 }
1696 
1697 /*
1698  * usbd_xfer_schedule_timeout(xfer)
1699  *
1700  *	Ensure that xfer has a timeout.  If the callout is already
1701  *	queued or the task is already running, request that they
1702  *	reschedule the callout.  If not, and if we're not polling,
1703  *	schedule the callout anew.
1704  *
1705  *	To be called in thread context from struct
1706  *	usbd_pipe_methods::upm_start.
1707  */
1708 void
1709 usbd_xfer_schedule_timeout(struct usbd_xfer *xfer)
1710 {
1711 	struct usbd_bus *bus = xfer->ux_bus;
1712 
1713 	KASSERT(bus->ub_usepolling || mutex_owned(bus->ub_lock));
1714 
1715 	if (xfer->ux_timeout_set) {
1716 		/*
1717 		 * Callout or task has fired from a prior completed
1718 		 * xfer but has not yet noticed that the xfer is done.
1719 		 * Ask it to reschedule itself to ux_timeout.
1720 		 */
1721 		xfer->ux_timeout_reset = true;
1722 	} else if (xfer->ux_timeout && !bus->ub_usepolling) {
1723 		/* Callout is not scheduled.  Schedule it.  */
1724 		KASSERT(!callout_pending(&xfer->ux_callout));
1725 		callout_schedule(&xfer->ux_callout, mstohz(xfer->ux_timeout));
1726 		xfer->ux_timeout_set = true;
1727 	}
1728 
1729 	KASSERT(bus->ub_usepolling || mutex_owned(bus->ub_lock));
1730 }
1731 
1732 /*
1733  * usbd_xfer_cancel_timeout_async(xfer)
1734  *
1735  *	Cancel the callout and the task of xfer, which have not yet run
1736  *	to completion, but don't wait for the callout or task to finish
1737  *	running.
1738  *
1739  *	If they have already fired, at worst they are waiting for the
1740  *	bus lock.  They will see that the xfer is no longer in progress
1741  *	and give up, or they will see that the xfer has been
1742  *	resubmitted with a new timeout and reschedule the callout.
1743  *
1744  *	If a resubmitted request completed so fast that the callout
1745  *	didn't have time to process a timer reset, just cancel the
1746  *	timer reset.
1747  */
1748 static void
1749 usbd_xfer_cancel_timeout_async(struct usbd_xfer *xfer)
1750 {
1751 	struct usbd_bus *bus __diagused = xfer->ux_bus;
1752 
1753 	KASSERT(bus->ub_usepolling || mutex_owned(bus->ub_lock));
1754 
1755 	/*
1756 	 * If the timer wasn't running anyway, forget about it.  This
1757 	 * can happen if we are completing an isochronous transfer
1758 	 * which doesn't use the same timeout logic.
1759 	 */
1760 	if (!xfer->ux_timeout_set)
1761 		return;
1762 
1763 	xfer->ux_timeout_reset = false;
1764 	if (!callout_stop(&xfer->ux_callout)) {
1765 		/*
1766 		 * We stopped the callout before it ran.  The timeout
1767 		 * is no longer set.
1768 		 */
1769 		xfer->ux_timeout_set = false;
1770 	} else if (callout_invoking(&xfer->ux_callout)) {
1771 		/*
1772 		 * The callout has begun to run but it has not yet
1773 		 * acquired the lock and called callout_ack.  The task
1774 		 * cannot be queued yet, and the callout cannot have
1775 		 * been rescheduled yet.
1776 		 *
1777 		 * By the time the callout acquires the lock, we will
1778 		 * have transitioned from USBD_IN_PROGRESS to a
1779 		 * completed status, and possibly also resubmitted the
1780 		 * xfer and set xfer->ux_timeout_reset = true.  In both
1781 		 * cases, the callout will DTRT, so no further action
1782 		 * is needed here.
1783 		 */
1784 	} else if (usb_rem_task(xfer->ux_pipe->up_dev, &xfer->ux_aborttask)) {
1785 		/*
1786 		 * The callout had fired and scheduled the task, but we
1787 		 * stopped the task before it could run.  The timeout
1788 		 * is therefore no longer set -- the next resubmission
1789 		 * of the xfer must schedule a new timeout.
1790 		 *
1791 		 * The callout should not be pending at this point:
1792 		 * it is scheduled only under the lock, and only when
1793 		 * xfer->ux_timeout_set is false, or by the callout or
1794 		 * task itself when xfer->ux_timeout_reset is true.
1795 		 */
1796 		xfer->ux_timeout_set = false;
1797 	}
1798 
1799 	/*
1800 	 * The callout cannot be scheduled and the task cannot be
1801 	 * queued at this point.  Either we cancelled them, or they are
1802 	 * already running and waiting for the bus lock.
1803 	 */
1804 	KASSERT(!callout_pending(&xfer->ux_callout));
1805 	KASSERT(!usb_task_pending(xfer->ux_pipe->up_dev, &xfer->ux_aborttask));
1806 
1807 	KASSERT(bus->ub_usepolling || mutex_owned(bus->ub_lock));
1808 }
1809