xref: /netbsd-src/sys/dev/usb/usbdi.c (revision e6c7e151de239c49d2e38720a061ed9d1fa99309)
1 /*	$NetBSD: usbdi.c,v 1.199 2020/04/03 06:05:00 skrll Exp $	*/
2 
3 /*
4  * Copyright (c) 1998, 2012, 2015 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Lennart Augustsson (lennart@augustsson.net) at
9  * Carlstedt Research & Technology, Matthew R. Green (mrg@eterna.com.au),
10  * and Nick Hudson.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
23  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
24  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
25  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #include <sys/cdefs.h>
35 __KERNEL_RCSID(0, "$NetBSD: usbdi.c,v 1.199 2020/04/03 06:05:00 skrll Exp $");
36 
37 #ifdef _KERNEL_OPT
38 #include "opt_usb.h"
39 #include "opt_compat_netbsd.h"
40 #include "usb_dma.h"
41 #endif
42 
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/kernel.h>
46 #include <sys/device.h>
47 #include <sys/kmem.h>
48 #include <sys/proc.h>
49 #include <sys/bus.h>
50 #include <sys/cpu.h>
51 
52 #include <dev/usb/usb.h>
53 #include <dev/usb/usbdi.h>
54 #include <dev/usb/usbdi_util.h>
55 #include <dev/usb/usbdivar.h>
56 #include <dev/usb/usb_mem.h>
57 #include <dev/usb/usb_quirks.h>
58 #include <dev/usb/usb_sdt.h>
59 #include <dev/usb/usbhist.h>
60 
61 /* UTF-8 encoding stuff */
62 #include <fs/unicode.h>
63 
64 extern int usbdebug;
65 
66 SDT_PROBE_DEFINE5(usb, device, pipe, open,
67     "struct usbd_interface *"/*iface*/,
68     "uint8_t"/*address*/,
69     "uint8_t"/*flags*/,
70     "int"/*ival*/,
71     "struct usbd_pipe *"/*pipe*/);
72 
73 SDT_PROBE_DEFINE7(usb, device, pipe, open__intr,
74     "struct usbd_interface *"/*iface*/,
75     "uint8_t"/*address*/,
76     "uint8_t"/*flags*/,
77     "int"/*ival*/,
78     "usbd_callback"/*cb*/,
79     "void *"/*cookie*/,
80     "struct usbd_pipe *"/*pipe*/);
81 
82 SDT_PROBE_DEFINE2(usb, device, pipe, transfer__start,
83     "struct usbd_pipe *"/*pipe*/,
84     "struct usbd_xfer *"/*xfer*/);
85 SDT_PROBE_DEFINE3(usb, device, pipe, transfer__done,
86     "struct usbd_pipe *"/*pipe*/,
87     "struct usbd_xfer *"/*xfer*/,
88     "usbd_status"/*err*/);
89 SDT_PROBE_DEFINE2(usb, device, pipe, start,
90     "struct usbd_pipe *"/*pipe*/,
91     "struct usbd_xfer *"/*xfer*/);
92 
93 SDT_PROBE_DEFINE1(usb, device, pipe, close,  "struct usbd_pipe *"/*pipe*/);
94 SDT_PROBE_DEFINE1(usb, device, pipe, abort__start,
95     "struct usbd_pipe *"/*pipe*/);
96 SDT_PROBE_DEFINE1(usb, device, pipe, abort__done,
97     "struct usbd_pipe *"/*pipe*/);
98 SDT_PROBE_DEFINE1(usb, device, pipe, clear__endpoint__stall,
99     "struct usbd_pipe *"/*pipe*/);
100 SDT_PROBE_DEFINE1(usb, device, pipe, clear__endpoint__toggle,
101     "struct usbd_pipe *"/*pipe*/);
102 
103 SDT_PROBE_DEFINE5(usb, device, xfer, create,
104     "struct usbd_xfer *"/*xfer*/,
105     "struct usbd_pipe *"/*pipe*/,
106     "size_t"/*len*/,
107     "unsigned int"/*flags*/,
108     "unsigned int"/*nframes*/);
109 SDT_PROBE_DEFINE1(usb, device, xfer, start,  "struct usbd_xfer *"/*xfer*/);
110 SDT_PROBE_DEFINE1(usb, device, xfer, preabort,  "struct usbd_xfer *"/*xfer*/);
111 SDT_PROBE_DEFINE1(usb, device, xfer, abort,  "struct usbd_xfer *"/*xfer*/);
112 SDT_PROBE_DEFINE1(usb, device, xfer, timeout,  "struct usbd_xfer *"/*xfer*/);
113 SDT_PROBE_DEFINE2(usb, device, xfer, done,
114     "struct usbd_xfer *"/*xfer*/,
115     "usbd_status"/*status*/);
116 SDT_PROBE_DEFINE1(usb, device, xfer, destroy,  "struct usbd_xfer *"/*xfer*/);
117 
118 Static usbd_status usbd_ar_pipe(struct usbd_pipe *);
119 Static void usbd_start_next(struct usbd_pipe *);
120 Static usbd_status usbd_open_pipe_ival
121 	(struct usbd_interface *, uint8_t, uint8_t, struct usbd_pipe **, int);
122 static void *usbd_alloc_buffer(struct usbd_xfer *, uint32_t);
123 static void usbd_free_buffer(struct usbd_xfer *);
124 static struct usbd_xfer *usbd_alloc_xfer(struct usbd_device *, unsigned int);
125 static usbd_status usbd_free_xfer(struct usbd_xfer *);
126 static void usbd_request_async_cb(struct usbd_xfer *, void *, usbd_status);
127 static void usbd_xfer_timeout(void *);
128 static void usbd_xfer_timeout_task(void *);
129 static bool usbd_xfer_probe_timeout(struct usbd_xfer *);
130 static void usbd_xfer_cancel_timeout_async(struct usbd_xfer *);
131 
132 #if defined(USB_DEBUG)
133 void
134 usbd_dump_iface(struct usbd_interface *iface)
135 {
136 	USBHIST_FUNC();
137 	USBHIST_CALLARGS(usbdebug, "iface %#jx", (uintptr_t)iface, 0, 0, 0);
138 
139 	if (iface == NULL)
140 		return;
141 	USBHIST_LOG(usbdebug, "     device = %#jx idesc = %#jx index = %jd",
142 	    (uintptr_t)iface->ui_dev, (uintptr_t)iface->ui_idesc,
143 	    iface->ui_index, 0);
144 	USBHIST_LOG(usbdebug, "     altindex=%jd priv=%#jx",
145 	    iface->ui_altindex, (uintptr_t)iface->ui_priv, 0, 0);
146 }
147 
148 void
149 usbd_dump_device(struct usbd_device *dev)
150 {
151 	USBHIST_FUNC();
152 	USBHIST_CALLARGS(usbdebug, "dev = %#jx", (uintptr_t)dev, 0, 0, 0);
153 
154 	if (dev == NULL)
155 		return;
156 	USBHIST_LOG(usbdebug, "     bus = %#jx default_pipe = %#jx",
157 	    (uintptr_t)dev->ud_bus, (uintptr_t)dev->ud_pipe0, 0, 0);
158 	USBHIST_LOG(usbdebug, "     address = %jd config = %jd depth = %jd ",
159 	    dev->ud_addr, dev->ud_config, dev->ud_depth, 0);
160 	USBHIST_LOG(usbdebug, "     speed = %jd self_powered = %jd "
161 	    "power = %jd langid = %jd",
162 	    dev->ud_speed, dev->ud_selfpowered, dev->ud_power, dev->ud_langid);
163 }
164 
165 void
166 usbd_dump_endpoint(struct usbd_endpoint *endp)
167 {
168 	USBHIST_FUNC();
169 	USBHIST_CALLARGS(usbdebug, "endp = %#jx", (uintptr_t)endp, 0, 0, 0);
170 
171 	if (endp == NULL)
172 		return;
173 	USBHIST_LOG(usbdebug, "    edesc = %#jx refcnt = %jd",
174 	    (uintptr_t)endp->ue_edesc, endp->ue_refcnt, 0, 0);
175 	if (endp->ue_edesc)
176 		USBHIST_LOG(usbdebug, "     bEndpointAddress=0x%02jx",
177 		    endp->ue_edesc->bEndpointAddress, 0, 0, 0);
178 }
179 
180 void
181 usbd_dump_queue(struct usbd_pipe *pipe)
182 {
183 	struct usbd_xfer *xfer;
184 
185 	USBHIST_FUNC();
186 	USBHIST_CALLARGS(usbdebug, "pipe = %#jx", (uintptr_t)pipe, 0, 0, 0);
187 
188 	SIMPLEQ_FOREACH(xfer, &pipe->up_queue, ux_next) {
189 		USBHIST_LOG(usbdebug, "     xfer = %#jx", (uintptr_t)xfer,
190 		    0, 0, 0);
191 	}
192 }
193 
194 void
195 usbd_dump_pipe(struct usbd_pipe *pipe)
196 {
197 	USBHIST_FUNC();
198 	USBHIST_CALLARGS(usbdebug, "pipe = %#jx", (uintptr_t)pipe, 0, 0, 0);
199 
200 	if (pipe == NULL)
201 		return;
202 	usbd_dump_iface(pipe->up_iface);
203 	usbd_dump_device(pipe->up_dev);
204 	usbd_dump_endpoint(pipe->up_endpoint);
205 	USBHIST_LOG(usbdebug, "(usbd_dump_pipe)", 0, 0, 0, 0);
206 	USBHIST_LOG(usbdebug, "     running = %jd aborting = %jd",
207 	    pipe->up_running, pipe->up_aborting, 0, 0);
208 	USBHIST_LOG(usbdebug, "     intrxfer = %#jx, repeat = %jd, "
209 	    "interval = %jd", (uintptr_t)pipe->up_intrxfer, pipe->up_repeat,
210 	    pipe->up_interval, 0);
211 }
212 #endif
213 
214 usbd_status
215 usbd_open_pipe(struct usbd_interface *iface, uint8_t address,
216 	       uint8_t flags, struct usbd_pipe **pipe)
217 {
218 	return (usbd_open_pipe_ival(iface, address, flags, pipe,
219 				    USBD_DEFAULT_INTERVAL));
220 }
221 
222 usbd_status
223 usbd_open_pipe_ival(struct usbd_interface *iface, uint8_t address,
224 		    uint8_t flags, struct usbd_pipe **pipe, int ival)
225 {
226 	struct usbd_pipe *p;
227 	struct usbd_endpoint *ep;
228 	usbd_status err;
229 	int i;
230 
231 	USBHIST_FUNC();
232 	USBHIST_CALLARGS(usbdebug, "iface = %#jx address = %#jx flags = %#jx",
233 	    (uintptr_t)iface, address, flags, 0);
234 
235 	for (i = 0; i < iface->ui_idesc->bNumEndpoints; i++) {
236 		ep = &iface->ui_endpoints[i];
237 		if (ep->ue_edesc == NULL)
238 			return USBD_IOERROR;
239 		if (ep->ue_edesc->bEndpointAddress == address)
240 			goto found;
241 	}
242 	return USBD_BAD_ADDRESS;
243  found:
244 	if ((flags & USBD_EXCLUSIVE_USE) && ep->ue_refcnt != 0)
245 		return USBD_IN_USE;
246 	err = usbd_setup_pipe_flags(iface->ui_dev, iface, ep, ival, &p, flags);
247 	if (err)
248 		return err;
249 	LIST_INSERT_HEAD(&iface->ui_pipes, p, up_next);
250 	*pipe = p;
251 	SDT_PROBE5(usb, device, pipe, open,
252 	    iface, address, flags, ival, p);
253 	return USBD_NORMAL_COMPLETION;
254 }
255 
256 usbd_status
257 usbd_open_pipe_intr(struct usbd_interface *iface, uint8_t address,
258 		    uint8_t flags, struct usbd_pipe **pipe,
259 		    void *priv, void *buffer, uint32_t len,
260 		    usbd_callback cb, int ival)
261 {
262 	usbd_status err;
263 	struct usbd_xfer *xfer;
264 	struct usbd_pipe *ipipe;
265 
266 	USBHIST_FUNC();
267 	USBHIST_CALLARGS(usbdebug, "address = %#jx flags = %#jx len = %jd",
268 	    address, flags, len, 0);
269 
270 	err = usbd_open_pipe_ival(iface, address,
271 				  USBD_EXCLUSIVE_USE | (flags & USBD_MPSAFE),
272 				  &ipipe, ival);
273 	if (err)
274 		return err;
275 	err = usbd_create_xfer(ipipe, len, flags, 0, &xfer);
276 	if (err)
277 		goto bad1;
278 
279 	usbd_setup_xfer(xfer, priv, buffer, len, flags, USBD_NO_TIMEOUT, cb);
280 	ipipe->up_intrxfer = xfer;
281 	ipipe->up_repeat = 1;
282 	err = usbd_transfer(xfer);
283 	*pipe = ipipe;
284 	if (err != USBD_IN_PROGRESS)
285 		goto bad3;
286 	SDT_PROBE7(usb, device, pipe, open__intr,
287 	    iface, address, flags, ival, cb, priv, ipipe);
288 	return USBD_NORMAL_COMPLETION;
289 
290  bad3:
291 	ipipe->up_intrxfer = NULL;
292 	ipipe->up_repeat = 0;
293 
294 	usbd_destroy_xfer(xfer);
295  bad1:
296 	usbd_close_pipe(ipipe);
297 	return err;
298 }
299 
300 usbd_status
301 usbd_close_pipe(struct usbd_pipe *pipe)
302 {
303 	USBHIST_FUNC(); USBHIST_CALLED(usbdebug);
304 
305 	KASSERT(pipe != NULL);
306 
307 	usbd_lock_pipe(pipe);
308 	SDT_PROBE1(usb, device, pipe, close,  pipe);
309 
310 	if (!SIMPLEQ_EMPTY(&pipe->up_queue)) {
311 		printf("WARNING: pipe closed with active xfers on addr %d\n",
312 		    pipe->up_dev->ud_addr);
313 		usbd_ar_pipe(pipe);
314 	}
315 
316 	KASSERT(SIMPLEQ_EMPTY(&pipe->up_queue));
317 
318 	LIST_REMOVE(pipe, up_next);
319 	pipe->up_endpoint->ue_refcnt--;
320 
321 	pipe->up_methods->upm_close(pipe);
322 
323 	if (pipe->up_intrxfer != NULL) {
324 	    	usbd_unlock_pipe(pipe);
325 		usbd_destroy_xfer(pipe->up_intrxfer);
326 		usbd_lock_pipe(pipe);
327 	}
328 
329 	usbd_unlock_pipe(pipe);
330 	kmem_free(pipe, pipe->up_dev->ud_bus->ub_pipesize);
331 
332 	return USBD_NORMAL_COMPLETION;
333 }
334 
335 usbd_status
336 usbd_transfer(struct usbd_xfer *xfer)
337 {
338 	struct usbd_pipe *pipe = xfer->ux_pipe;
339 	usbd_status err;
340 	unsigned int size, flags;
341 
342 	USBHIST_FUNC(); USBHIST_CALLARGS(usbdebug,
343 	    "xfer = %#jx, flags = %#jx, pipe = %#jx, running = %jd",
344 	    (uintptr_t)xfer, xfer->ux_flags, (uintptr_t)pipe, pipe->up_running);
345 	KASSERT(xfer->ux_status == USBD_NOT_STARTED);
346 	SDT_PROBE1(usb, device, xfer, start,  xfer);
347 
348 #ifdef USB_DEBUG
349 	if (usbdebug > 5)
350 		usbd_dump_queue(pipe);
351 #endif
352 	xfer->ux_done = 0;
353 
354 	if (pipe->up_aborting) {
355 		USBHIST_LOG(usbdebug, "<- done xfer %#jx, aborting",
356 		    (uintptr_t)xfer, 0, 0, 0);
357 		SDT_PROBE2(usb, device, xfer, done,  xfer, USBD_CANCELLED);
358 		return USBD_CANCELLED;
359 	}
360 
361 	KASSERT(xfer->ux_length == 0 || xfer->ux_buf != NULL);
362 
363 	size = xfer->ux_length;
364 	flags = xfer->ux_flags;
365 
366 	if (size != 0) {
367 		/*
368 		 * Use the xfer buffer if none specified in transfer setup.
369 		 * isoc transfers always use the xfer buffer, i.e.
370 		 * ux_buffer is always NULL for isoc.
371 		 */
372 		if (xfer->ux_buffer == NULL) {
373 			xfer->ux_buffer = xfer->ux_buf;
374 		}
375 
376 		/*
377 		 * If not using the xfer buffer copy data to the
378 		 * xfer buffer for OUT transfers of >0 length
379 		 */
380 		if (xfer->ux_buffer != xfer->ux_buf) {
381 			KASSERT(xfer->ux_buf);
382 			if (!usbd_xfer_isread(xfer)) {
383 				memcpy(xfer->ux_buf, xfer->ux_buffer, size);
384 			}
385 		}
386 	}
387 
388 	/* xfer is not valid after the transfer method unless synchronous */
389 	SDT_PROBE2(usb, device, pipe, transfer__start,  pipe, xfer);
390 	err = pipe->up_methods->upm_transfer(xfer);
391 	SDT_PROBE3(usb, device, pipe, transfer__done,  pipe, xfer, err);
392 
393 	if (err != USBD_IN_PROGRESS && err) {
394 		/*
395 		 * The transfer made it onto the pipe queue, but didn't get
396 		 * accepted by the HCD for some reason.  It needs removing
397 		 * from the pipe queue.
398 		 */
399 		USBHIST_LOG(usbdebug, "xfer failed: %jd, reinserting",
400 		    err, 0, 0, 0);
401 		usbd_lock_pipe(pipe);
402 		SDT_PROBE1(usb, device, xfer, preabort,  xfer);
403 		SIMPLEQ_REMOVE_HEAD(&pipe->up_queue, ux_next);
404 		if (pipe->up_serialise)
405 			usbd_start_next(pipe);
406 		usbd_unlock_pipe(pipe);
407 	}
408 
409 	if (!(flags & USBD_SYNCHRONOUS)) {
410 		USBHIST_LOG(usbdebug, "<- done xfer %#jx, not sync (err %jd)",
411 		    (uintptr_t)xfer, err, 0, 0);
412 		if (err != USBD_IN_PROGRESS) /* XXX Possible?  */
413 			SDT_PROBE2(usb, device, xfer, done,  xfer, err);
414 		return err;
415 	}
416 
417 	if (err != USBD_IN_PROGRESS) {
418 		USBHIST_LOG(usbdebug, "<- done xfer %#jx, sync (err %jd)",
419 		    (uintptr_t)xfer, err, 0, 0);
420 		SDT_PROBE2(usb, device, xfer, done,  xfer, err);
421 		return err;
422 	}
423 
424 	/* Sync transfer, wait for completion. */
425 	usbd_lock_pipe(pipe);
426 	while (!xfer->ux_done) {
427 		if (pipe->up_dev->ud_bus->ub_usepolling)
428 			panic("usbd_transfer: not done");
429 		USBHIST_LOG(usbdebug, "<- sleeping on xfer %#jx",
430 		    (uintptr_t)xfer, 0, 0, 0);
431 
432 		err = 0;
433 		if ((flags & USBD_SYNCHRONOUS_SIG) != 0) {
434 			err = cv_wait_sig(&xfer->ux_cv, pipe->up_dev->ud_bus->ub_lock);
435 		} else {
436 			cv_wait(&xfer->ux_cv, pipe->up_dev->ud_bus->ub_lock);
437 		}
438 		if (err) {
439 			if (!xfer->ux_done) {
440 				SDT_PROBE1(usb, device, xfer, abort,  xfer);
441 				pipe->up_methods->upm_abort(xfer);
442 			}
443 			break;
444 		}
445 	}
446 	SDT_PROBE2(usb, device, xfer, done,  xfer, xfer->ux_status);
447 	/* XXX Race to read xfer->ux_status?  */
448 	usbd_unlock_pipe(pipe);
449 	return xfer->ux_status;
450 }
451 
452 /* Like usbd_transfer(), but waits for completion. */
453 usbd_status
454 usbd_sync_transfer(struct usbd_xfer *xfer)
455 {
456 	xfer->ux_flags |= USBD_SYNCHRONOUS;
457 	return usbd_transfer(xfer);
458 }
459 
460 /* Like usbd_transfer(), but waits for completion and listens for signals. */
461 usbd_status
462 usbd_sync_transfer_sig(struct usbd_xfer *xfer)
463 {
464 	xfer->ux_flags |= USBD_SYNCHRONOUS | USBD_SYNCHRONOUS_SIG;
465 	return usbd_transfer(xfer);
466 }
467 
468 static void *
469 usbd_alloc_buffer(struct usbd_xfer *xfer, uint32_t size)
470 {
471 	KASSERT(xfer->ux_buf == NULL);
472 	KASSERT(size != 0);
473 
474 	xfer->ux_bufsize = 0;
475 #if NUSB_DMA > 0
476 	struct usbd_bus *bus = xfer->ux_bus;
477 
478 	if (bus->ub_usedma) {
479 		usb_dma_t *dmap = &xfer->ux_dmabuf;
480 
481 		int err = usb_allocmem_flags(bus, size, 0, dmap, bus->ub_dmaflags);
482 		if (err) {
483 			return NULL;
484 		}
485 		xfer->ux_buf = KERNADDR(&xfer->ux_dmabuf, 0);
486 		xfer->ux_bufsize = size;
487 
488 		return xfer->ux_buf;
489 	}
490 #endif
491 	KASSERT(xfer->ux_bus->ub_usedma == false);
492 	xfer->ux_buf = kmem_alloc(size, KM_SLEEP);
493 	xfer->ux_bufsize = size;
494 	return xfer->ux_buf;
495 }
496 
497 static void
498 usbd_free_buffer(struct usbd_xfer *xfer)
499 {
500 	KASSERT(xfer->ux_buf != NULL);
501 	KASSERT(xfer->ux_bufsize != 0);
502 
503 	void *buf = xfer->ux_buf;
504 	uint32_t size = xfer->ux_bufsize;
505 
506 	xfer->ux_buf = NULL;
507 	xfer->ux_bufsize = 0;
508 
509 #if NUSB_DMA > 0
510 	struct usbd_bus *bus = xfer->ux_bus;
511 
512 	if (bus->ub_usedma) {
513 		usb_dma_t *dmap = &xfer->ux_dmabuf;
514 
515 		usb_freemem(bus, dmap);
516 		return;
517 	}
518 #endif
519 	KASSERT(xfer->ux_bus->ub_usedma == false);
520 
521 	kmem_free(buf, size);
522 }
523 
524 void *
525 usbd_get_buffer(struct usbd_xfer *xfer)
526 {
527 	return xfer->ux_buf;
528 }
529 
530 struct usbd_pipe *
531 usbd_get_pipe0(struct usbd_device *dev)
532 {
533 
534 	return dev->ud_pipe0;
535 }
536 
537 static struct usbd_xfer *
538 usbd_alloc_xfer(struct usbd_device *dev, unsigned int nframes)
539 {
540 	struct usbd_xfer *xfer;
541 
542 	USBHIST_FUNC();
543 
544 	ASSERT_SLEEPABLE();
545 
546 	xfer = dev->ud_bus->ub_methods->ubm_allocx(dev->ud_bus, nframes);
547 	if (xfer == NULL)
548 		goto out;
549 	xfer->ux_bus = dev->ud_bus;
550 	callout_init(&xfer->ux_callout, CALLOUT_MPSAFE);
551 	callout_setfunc(&xfer->ux_callout, usbd_xfer_timeout, xfer);
552 	cv_init(&xfer->ux_cv, "usbxfer");
553 	usb_init_task(&xfer->ux_aborttask, usbd_xfer_timeout_task, xfer,
554 	    USB_TASKQ_MPSAFE);
555 
556 out:
557 	USBHIST_CALLARGS(usbdebug, "returns %#jx", (uintptr_t)xfer, 0, 0, 0);
558 
559 	return xfer;
560 }
561 
562 static usbd_status
563 usbd_free_xfer(struct usbd_xfer *xfer)
564 {
565 	USBHIST_FUNC();
566 	USBHIST_CALLARGS(usbdebug, "%#jx", (uintptr_t)xfer, 0, 0, 0);
567 
568 	if (xfer->ux_buf) {
569 		usbd_free_buffer(xfer);
570 	}
571 
572 	/* Wait for any straggling timeout to complete. */
573 	mutex_enter(xfer->ux_bus->ub_lock);
574 	xfer->ux_timeout_reset = false; /* do not resuscitate */
575 	callout_halt(&xfer->ux_callout, xfer->ux_bus->ub_lock);
576 	usb_rem_task_wait(xfer->ux_pipe->up_dev, &xfer->ux_aborttask,
577 	    USB_TASKQ_HC, xfer->ux_bus->ub_lock);
578 	mutex_exit(xfer->ux_bus->ub_lock);
579 
580 	cv_destroy(&xfer->ux_cv);
581 	xfer->ux_bus->ub_methods->ubm_freex(xfer->ux_bus, xfer);
582 	return USBD_NORMAL_COMPLETION;
583 }
584 
585 int
586 usbd_create_xfer(struct usbd_pipe *pipe, size_t len, unsigned int flags,
587     unsigned int nframes, struct usbd_xfer **xp)
588 {
589 	KASSERT(xp != NULL);
590 	void *buf = NULL;
591 
592 	struct usbd_xfer *xfer = usbd_alloc_xfer(pipe->up_dev, nframes);
593 	if (xfer == NULL)
594 		return ENOMEM;
595 
596 	xfer->ux_pipe = pipe;
597 	xfer->ux_flags = flags;
598 	xfer->ux_nframes = nframes;
599 	xfer->ux_methods = pipe->up_methods;
600 
601 	if (len) {
602 		buf = usbd_alloc_buffer(xfer, len);
603 		if (!buf) {
604 			usbd_free_xfer(xfer);
605 			return ENOMEM;
606 		}
607 	}
608 
609 	if (xfer->ux_methods->upm_init) {
610 		int err = xfer->ux_methods->upm_init(xfer);
611 		if (err) {
612 			usbd_free_xfer(xfer);
613 			return err;
614 		}
615 	}
616 
617 	*xp = xfer;
618 	SDT_PROBE5(usb, device, xfer, create,
619 	    xfer, pipe, len, flags, nframes);
620 	return 0;
621 }
622 
623 void
624 usbd_destroy_xfer(struct usbd_xfer *xfer)
625 {
626 
627 	SDT_PROBE1(usb, device, xfer, destroy,  xfer);
628 	if (xfer->ux_methods->upm_fini)
629 		xfer->ux_methods->upm_fini(xfer);
630 
631 	usbd_free_xfer(xfer);
632 }
633 
634 void
635 usbd_setup_xfer(struct usbd_xfer *xfer, void *priv, void *buffer,
636     uint32_t length, uint16_t flags, uint32_t timeout, usbd_callback callback)
637 {
638 	KASSERT(xfer->ux_pipe);
639 
640 	xfer->ux_priv = priv;
641 	xfer->ux_buffer = buffer;
642 	xfer->ux_length = length;
643 	xfer->ux_actlen = 0;
644 	xfer->ux_flags = flags;
645 	xfer->ux_timeout = timeout;
646 	xfer->ux_status = USBD_NOT_STARTED;
647 	xfer->ux_callback = callback;
648 	xfer->ux_rqflags &= ~URQ_REQUEST;
649 	xfer->ux_nframes = 0;
650 }
651 
652 void
653 usbd_setup_default_xfer(struct usbd_xfer *xfer, struct usbd_device *dev,
654     void *priv, uint32_t timeout, usb_device_request_t *req, void *buffer,
655     uint32_t length, uint16_t flags, usbd_callback callback)
656 {
657 	KASSERT(xfer->ux_pipe == dev->ud_pipe0);
658 
659 	xfer->ux_priv = priv;
660 	xfer->ux_buffer = buffer;
661 	xfer->ux_length = length;
662 	xfer->ux_actlen = 0;
663 	xfer->ux_flags = flags;
664 	xfer->ux_timeout = timeout;
665 	xfer->ux_status = USBD_NOT_STARTED;
666 	xfer->ux_callback = callback;
667 	xfer->ux_request = *req;
668 	xfer->ux_rqflags |= URQ_REQUEST;
669 	xfer->ux_nframes = 0;
670 }
671 
672 void
673 usbd_setup_isoc_xfer(struct usbd_xfer *xfer, void *priv, uint16_t *frlengths,
674     uint32_t nframes, uint16_t flags, usbd_callback callback)
675 {
676 	xfer->ux_priv = priv;
677 	xfer->ux_buffer = NULL;
678 	xfer->ux_length = 0;
679 	xfer->ux_actlen = 0;
680 	xfer->ux_flags = flags;
681 	xfer->ux_timeout = USBD_NO_TIMEOUT;
682 	xfer->ux_status = USBD_NOT_STARTED;
683 	xfer->ux_callback = callback;
684 	xfer->ux_rqflags &= ~URQ_REQUEST;
685 	xfer->ux_frlengths = frlengths;
686 	xfer->ux_nframes = nframes;
687 }
688 
689 void
690 usbd_get_xfer_status(struct usbd_xfer *xfer, void **priv,
691 		     void **buffer, uint32_t *count, usbd_status *status)
692 {
693 	if (priv != NULL)
694 		*priv = xfer->ux_priv;
695 	if (buffer != NULL)
696 		*buffer = xfer->ux_buffer;
697 	if (count != NULL)
698 		*count = xfer->ux_actlen;
699 	if (status != NULL)
700 		*status = xfer->ux_status;
701 }
702 
703 usb_config_descriptor_t *
704 usbd_get_config_descriptor(struct usbd_device *dev)
705 {
706 	KASSERT(dev != NULL);
707 
708 	return dev->ud_cdesc;
709 }
710 
711 usb_interface_descriptor_t *
712 usbd_get_interface_descriptor(struct usbd_interface *iface)
713 {
714 	KASSERT(iface != NULL);
715 
716 	return iface->ui_idesc;
717 }
718 
719 usb_device_descriptor_t *
720 usbd_get_device_descriptor(struct usbd_device *dev)
721 {
722 	KASSERT(dev != NULL);
723 
724 	return &dev->ud_ddesc;
725 }
726 
727 usb_endpoint_descriptor_t *
728 usbd_interface2endpoint_descriptor(struct usbd_interface *iface, uint8_t index)
729 {
730 
731 	if (index >= iface->ui_idesc->bNumEndpoints)
732 		return NULL;
733 	return iface->ui_endpoints[index].ue_edesc;
734 }
735 
736 /* Some drivers may wish to abort requests on the default pipe, *
737  * but there is no mechanism for getting a handle on it.        */
738 usbd_status
739 usbd_abort_default_pipe(struct usbd_device *device)
740 {
741 	return usbd_abort_pipe(device->ud_pipe0);
742 }
743 
744 usbd_status
745 usbd_abort_pipe(struct usbd_pipe *pipe)
746 {
747 	usbd_status err;
748 
749 	KASSERT(pipe != NULL);
750 
751 	usbd_lock_pipe(pipe);
752 	err = usbd_ar_pipe(pipe);
753 	usbd_unlock_pipe(pipe);
754 	return err;
755 }
756 
757 usbd_status
758 usbd_clear_endpoint_stall(struct usbd_pipe *pipe)
759 {
760 	struct usbd_device *dev = pipe->up_dev;
761 	usbd_status err;
762 
763 	USBHIST_FUNC(); USBHIST_CALLED(usbdebug);
764 	SDT_PROBE1(usb, device, pipe, clear__endpoint__stall,  pipe);
765 
766 	/*
767 	 * Clearing en endpoint stall resets the endpoint toggle, so
768 	 * do the same to the HC toggle.
769 	 */
770 	SDT_PROBE1(usb, device, pipe, clear__endpoint__toggle,  pipe);
771 	pipe->up_methods->upm_cleartoggle(pipe);
772 
773 	err = usbd_clear_endpoint_feature(dev,
774 	    pipe->up_endpoint->ue_edesc->bEndpointAddress, UF_ENDPOINT_HALT);
775 #if 0
776 XXX should we do this?
777 	if (!err) {
778 		pipe->state = USBD_PIPE_ACTIVE;
779 		/* XXX activate pipe */
780 	}
781 #endif
782 	return err;
783 }
784 
785 void
786 usbd_clear_endpoint_stall_task(void *arg)
787 {
788 	struct usbd_pipe *pipe = arg;
789 	struct usbd_device *dev = pipe->up_dev;
790 
791 	SDT_PROBE1(usb, device, pipe, clear__endpoint__stall,  pipe);
792 	SDT_PROBE1(usb, device, pipe, clear__endpoint__toggle,  pipe);
793 	pipe->up_methods->upm_cleartoggle(pipe);
794 
795 	(void)usbd_clear_endpoint_feature(dev,
796 	    pipe->up_endpoint->ue_edesc->bEndpointAddress, UF_ENDPOINT_HALT);
797 }
798 
799 void
800 usbd_clear_endpoint_stall_async(struct usbd_pipe *pipe)
801 {
802 	usb_add_task(pipe->up_dev, &pipe->up_async_task, USB_TASKQ_DRIVER);
803 }
804 
805 void
806 usbd_clear_endpoint_toggle(struct usbd_pipe *pipe)
807 {
808 
809 	SDT_PROBE1(usb, device, pipe, clear__endpoint__toggle,  pipe);
810 	pipe->up_methods->upm_cleartoggle(pipe);
811 }
812 
813 usbd_status
814 usbd_endpoint_count(struct usbd_interface *iface, uint8_t *count)
815 {
816 	KASSERT(iface != NULL);
817 	KASSERT(iface->ui_idesc != NULL);
818 
819 	*count = iface->ui_idesc->bNumEndpoints;
820 	return USBD_NORMAL_COMPLETION;
821 }
822 
823 usbd_status
824 usbd_interface_count(struct usbd_device *dev, uint8_t *count)
825 {
826 
827 	if (dev->ud_cdesc == NULL)
828 		return USBD_NOT_CONFIGURED;
829 	*count = dev->ud_cdesc->bNumInterface;
830 	return USBD_NORMAL_COMPLETION;
831 }
832 
833 void
834 usbd_interface2device_handle(struct usbd_interface *iface,
835 			     struct usbd_device **dev)
836 {
837 
838 	*dev = iface->ui_dev;
839 }
840 
841 usbd_status
842 usbd_device2interface_handle(struct usbd_device *dev,
843 			     uint8_t ifaceno, struct usbd_interface **iface)
844 {
845 
846 	if (dev->ud_cdesc == NULL)
847 		return USBD_NOT_CONFIGURED;
848 	if (ifaceno >= dev->ud_cdesc->bNumInterface)
849 		return USBD_INVAL;
850 	*iface = &dev->ud_ifaces[ifaceno];
851 	return USBD_NORMAL_COMPLETION;
852 }
853 
854 struct usbd_device *
855 usbd_pipe2device_handle(struct usbd_pipe *pipe)
856 {
857 	KASSERT(pipe != NULL);
858 
859 	return pipe->up_dev;
860 }
861 
862 /* XXXX use altno */
863 usbd_status
864 usbd_set_interface(struct usbd_interface *iface, int altidx)
865 {
866 	usb_device_request_t req;
867 	usbd_status err;
868 	void *endpoints;
869 
870 	USBHIST_FUNC();
871 
872 	if (LIST_FIRST(&iface->ui_pipes) != NULL)
873 		return USBD_IN_USE;
874 
875 	endpoints = iface->ui_endpoints;
876 	int nendpt = iface->ui_idesc->bNumEndpoints;
877 	USBHIST_CALLARGS(usbdebug, "iface %#jx endpoints = %#jx nendpt %jd",
878 	    (uintptr_t)iface, (uintptr_t)endpoints,
879 	    iface->ui_idesc->bNumEndpoints, 0);
880 	err = usbd_fill_iface_data(iface->ui_dev, iface->ui_index, altidx);
881 	if (err)
882 		return err;
883 
884 	/* new setting works, we can free old endpoints */
885 	if (endpoints != NULL) {
886 		USBHIST_LOG(usbdebug, "iface %#jx endpoints = %#jx nendpt %jd",
887 		    (uintptr_t)iface, (uintptr_t)endpoints, nendpt, 0);
888 		kmem_free(endpoints, nendpt * sizeof(struct usbd_endpoint));
889 	}
890 	KASSERT(iface->ui_idesc != NULL);
891 
892 	req.bmRequestType = UT_WRITE_INTERFACE;
893 	req.bRequest = UR_SET_INTERFACE;
894 	USETW(req.wValue, iface->ui_idesc->bAlternateSetting);
895 	USETW(req.wIndex, iface->ui_idesc->bInterfaceNumber);
896 	USETW(req.wLength, 0);
897 	return usbd_do_request(iface->ui_dev, &req, 0);
898 }
899 
900 int
901 usbd_get_no_alts(usb_config_descriptor_t *cdesc, int ifaceno)
902 {
903 	char *p = (char *)cdesc;
904 	char *end = p + UGETW(cdesc->wTotalLength);
905 	usb_interface_descriptor_t *d;
906 	int n;
907 
908 	for (n = 0; p < end; p += d->bLength) {
909 		d = (usb_interface_descriptor_t *)p;
910 		if (p + d->bLength <= end &&
911 		    d->bDescriptorType == UDESC_INTERFACE &&
912 		    d->bInterfaceNumber == ifaceno)
913 			n++;
914 	}
915 	return n;
916 }
917 
918 int
919 usbd_get_interface_altindex(struct usbd_interface *iface)
920 {
921 	return iface->ui_altindex;
922 }
923 
924 usbd_status
925 usbd_get_interface(struct usbd_interface *iface, uint8_t *aiface)
926 {
927 	usb_device_request_t req;
928 
929 	req.bmRequestType = UT_READ_INTERFACE;
930 	req.bRequest = UR_GET_INTERFACE;
931 	USETW(req.wValue, 0);
932 	USETW(req.wIndex, iface->ui_idesc->bInterfaceNumber);
933 	USETW(req.wLength, 1);
934 	return usbd_do_request(iface->ui_dev, &req, aiface);
935 }
936 
937 /*** Internal routines ***/
938 
939 /* Dequeue all pipe operations, called with bus lock held. */
940 Static usbd_status
941 usbd_ar_pipe(struct usbd_pipe *pipe)
942 {
943 	struct usbd_xfer *xfer;
944 
945 	USBHIST_FUNC();
946 	USBHIST_CALLARGS(usbdebug, "pipe = %#jx", (uintptr_t)pipe, 0, 0, 0);
947 	SDT_PROBE1(usb, device, pipe, abort__start,  pipe);
948 
949 	KASSERT(mutex_owned(pipe->up_dev->ud_bus->ub_lock));
950 
951 #ifdef USB_DEBUG
952 	if (usbdebug > 5)
953 		usbd_dump_queue(pipe);
954 #endif
955 	pipe->up_repeat = 0;
956 	pipe->up_running = 0;
957 	pipe->up_aborting = 1;
958 	while ((xfer = SIMPLEQ_FIRST(&pipe->up_queue)) != NULL) {
959 		USBHIST_LOG(usbdebug, "pipe = %#jx xfer = %#jx "
960 		    "(methods = %#jx)", (uintptr_t)pipe, (uintptr_t)xfer,
961 		    (uintptr_t)pipe->up_methods, 0);
962 		if (xfer->ux_status == USBD_NOT_STARTED) {
963 			SDT_PROBE1(usb, device, xfer, preabort,  xfer);
964 			SIMPLEQ_REMOVE_HEAD(&pipe->up_queue, ux_next);
965 		} else {
966 			/* Make the HC abort it (and invoke the callback). */
967 			SDT_PROBE1(usb, device, xfer, abort,  xfer);
968 			pipe->up_methods->upm_abort(xfer);
969 			/* XXX only for non-0 usbd_clear_endpoint_stall(pipe); */
970 		}
971 	}
972 	pipe->up_aborting = 0;
973 	SDT_PROBE1(usb, device, pipe, abort__done,  pipe);
974 	return USBD_NORMAL_COMPLETION;
975 }
976 
977 /* Called with USB lock held. */
978 void
979 usb_transfer_complete(struct usbd_xfer *xfer)
980 {
981 	struct usbd_pipe *pipe = xfer->ux_pipe;
982 	struct usbd_bus *bus = pipe->up_dev->ud_bus;
983 	int sync = xfer->ux_flags & USBD_SYNCHRONOUS;
984 	int erred;
985 	int polling = bus->ub_usepolling;
986 	int repeat = pipe->up_repeat;
987 
988 	USBHIST_FUNC();
989 	USBHIST_CALLARGS(usbdebug, "pipe = %#jx xfer = %#jx status = %jd "
990 	    "actlen = %jd", (uintptr_t)pipe, (uintptr_t)xfer, xfer->ux_status,
991 	    xfer->ux_actlen);
992 
993 	KASSERT(polling || mutex_owned(pipe->up_dev->ud_bus->ub_lock));
994 	KASSERTMSG(xfer->ux_state == XFER_ONQU, "xfer %p state is %x", xfer,
995 	    xfer->ux_state);
996 	KASSERT(pipe != NULL);
997 
998 	/*
999 	 * If device is known to miss out ack, then pretend that
1000 	 * output timeout is a success. Userland should handle
1001 	 * the logic to verify that the operation succeeded.
1002 	 */
1003 	if (pipe->up_dev->ud_quirks &&
1004 	    pipe->up_dev->ud_quirks->uq_flags & UQ_MISS_OUT_ACK &&
1005 	    xfer->ux_status == USBD_TIMEOUT &&
1006 	    !usbd_xfer_isread(xfer)) {
1007 		USBHIST_LOG(usbdebug, "Possible output ack miss for xfer %#jx: "
1008 		    "hiding write timeout to %jd.%jd for %ju bytes written",
1009 		    (uintptr_t)xfer, curlwp->l_proc->p_pid, curlwp->l_lid,
1010 		    xfer->ux_length);
1011 
1012 		xfer->ux_status = USBD_NORMAL_COMPLETION;
1013 		xfer->ux_actlen = xfer->ux_length;
1014 	}
1015 
1016 	erred = xfer->ux_status == USBD_CANCELLED ||
1017 	        xfer->ux_status == USBD_TIMEOUT;
1018 
1019 	if (!repeat) {
1020 		/* Remove request from queue. */
1021 
1022 		KASSERTMSG(!SIMPLEQ_EMPTY(&pipe->up_queue),
1023 		    "pipe %p is empty, but xfer %p wants to complete", pipe,
1024 		     xfer);
1025 		KASSERTMSG(xfer == SIMPLEQ_FIRST(&pipe->up_queue),
1026 		    "xfer %p is not start of queue (%p is at start)", xfer,
1027 		   SIMPLEQ_FIRST(&pipe->up_queue));
1028 
1029 #ifdef DIAGNOSTIC
1030 		xfer->ux_state = XFER_BUSY;
1031 #endif
1032 		SIMPLEQ_REMOVE_HEAD(&pipe->up_queue, ux_next);
1033 	}
1034 	USBHIST_LOG(usbdebug, "xfer %#jx: repeat %jd new head = %#jx",
1035 	    (uintptr_t)xfer, repeat, (uintptr_t)SIMPLEQ_FIRST(&pipe->up_queue),
1036 	    0);
1037 
1038 	/* Count completed transfers. */
1039 	++pipe->up_dev->ud_bus->ub_stats.uds_requests
1040 		[pipe->up_endpoint->ue_edesc->bmAttributes & UE_XFERTYPE];
1041 
1042 	xfer->ux_done = 1;
1043 	if (!xfer->ux_status && xfer->ux_actlen < xfer->ux_length &&
1044 	    !(xfer->ux_flags & USBD_SHORT_XFER_OK)) {
1045 		USBHIST_LOG(usbdebug, "short transfer %jd < %jd",
1046 		    xfer->ux_actlen, xfer->ux_length, 0, 0);
1047 		xfer->ux_status = USBD_SHORT_XFER;
1048 	}
1049 
1050 	USBHIST_LOG(usbdebug, "xfer %#jx doing done %#jx", (uintptr_t)xfer,
1051 	    (uintptr_t)pipe->up_methods->upm_done, 0, 0);
1052 	SDT_PROBE2(usb, device, xfer, done,  xfer, xfer->ux_status);
1053 	pipe->up_methods->upm_done(xfer);
1054 
1055 	if (xfer->ux_length != 0 && xfer->ux_buffer != xfer->ux_buf) {
1056 		KDASSERTMSG(xfer->ux_actlen <= xfer->ux_length,
1057 		    "actlen %d length %d",xfer->ux_actlen, xfer->ux_length);
1058 
1059 		/* Only if IN transfer */
1060 		if (usbd_xfer_isread(xfer)) {
1061 			memcpy(xfer->ux_buffer, xfer->ux_buf, xfer->ux_actlen);
1062 		}
1063 	}
1064 
1065 	USBHIST_LOG(usbdebug, "xfer %#jx doing callback %#jx status %jd",
1066 	    (uintptr_t)xfer, (uintptr_t)xfer->ux_callback, xfer->ux_status, 0);
1067 
1068 	if (xfer->ux_callback) {
1069 		if (!polling) {
1070 			mutex_exit(pipe->up_dev->ud_bus->ub_lock);
1071 			if (!(pipe->up_flags & USBD_MPSAFE))
1072 				KERNEL_LOCK(1, curlwp);
1073 		}
1074 
1075 		xfer->ux_callback(xfer, xfer->ux_priv, xfer->ux_status);
1076 
1077 		if (!polling) {
1078 			if (!(pipe->up_flags & USBD_MPSAFE))
1079 				KERNEL_UNLOCK_ONE(curlwp);
1080 			mutex_enter(pipe->up_dev->ud_bus->ub_lock);
1081 		}
1082 	}
1083 
1084 	if (sync && !polling) {
1085 		USBHIST_LOG(usbdebug, "<- done xfer %#jx, wakeup",
1086 		    (uintptr_t)xfer, 0, 0, 0);
1087 		cv_broadcast(&xfer->ux_cv);
1088 	}
1089 
1090 	if (repeat) {
1091 		xfer->ux_actlen = 0;
1092 		xfer->ux_status = USBD_NOT_STARTED;
1093 	} else {
1094 		/* XXX should we stop the queue on all errors? */
1095 		if (erred && pipe->up_iface != NULL)	/* not control pipe */
1096 			pipe->up_running = 0;
1097 	}
1098 	if (pipe->up_running && pipe->up_serialise)
1099 		usbd_start_next(pipe);
1100 }
1101 
1102 /* Called with USB lock held. */
1103 usbd_status
1104 usb_insert_transfer(struct usbd_xfer *xfer)
1105 {
1106 	struct usbd_pipe *pipe = xfer->ux_pipe;
1107 	usbd_status err;
1108 
1109 	USBHIST_FUNC(); USBHIST_CALLARGS(usbdebug,
1110 	    "xfer = %#jx pipe = %#jx running = %jd timeout = %jd",
1111 	    (uintptr_t)xfer, (uintptr_t)pipe,
1112 	    pipe->up_running, xfer->ux_timeout);
1113 
1114 	KASSERT(mutex_owned(pipe->up_dev->ud_bus->ub_lock));
1115 	KASSERTMSG(xfer->ux_state == XFER_BUSY, "xfer %p state is %x", xfer,
1116 	    xfer->ux_state);
1117 
1118 #ifdef DIAGNOSTIC
1119 	xfer->ux_state = XFER_ONQU;
1120 #endif
1121 	SIMPLEQ_INSERT_TAIL(&pipe->up_queue, xfer, ux_next);
1122 	if (pipe->up_running && pipe->up_serialise)
1123 		err = USBD_IN_PROGRESS;
1124 	else {
1125 		pipe->up_running = 1;
1126 		err = USBD_NORMAL_COMPLETION;
1127 	}
1128 	USBHIST_LOG(usbdebug, "<- done xfer %#jx, err %jd", (uintptr_t)xfer,
1129 	    err, 0, 0);
1130 	return err;
1131 }
1132 
1133 /* Called with USB lock held. */
1134 void
1135 usbd_start_next(struct usbd_pipe *pipe)
1136 {
1137 	struct usbd_xfer *xfer;
1138 	usbd_status err;
1139 
1140 	USBHIST_FUNC();
1141 
1142 	KASSERT(pipe != NULL);
1143 	KASSERT(pipe->up_methods != NULL);
1144 	KASSERT(pipe->up_methods->upm_start != NULL);
1145 	KASSERT(pipe->up_serialise == true);
1146 
1147 	int polling = pipe->up_dev->ud_bus->ub_usepolling;
1148 	KASSERT(polling || mutex_owned(pipe->up_dev->ud_bus->ub_lock));
1149 
1150 	/* Get next request in queue. */
1151 	xfer = SIMPLEQ_FIRST(&pipe->up_queue);
1152 	USBHIST_CALLARGS(usbdebug, "pipe = %#jx, xfer = %#jx", (uintptr_t)pipe,
1153 	    (uintptr_t)xfer, 0, 0);
1154 	if (xfer == NULL) {
1155 		pipe->up_running = 0;
1156 	} else {
1157 		if (!polling)
1158 			mutex_exit(pipe->up_dev->ud_bus->ub_lock);
1159 		SDT_PROBE2(usb, device, pipe, start,  pipe, xfer);
1160 		err = pipe->up_methods->upm_start(xfer);
1161 		if (!polling)
1162 			mutex_enter(pipe->up_dev->ud_bus->ub_lock);
1163 
1164 		if (err != USBD_IN_PROGRESS) {
1165 			USBHIST_LOG(usbdebug, "error = %jd", err, 0, 0, 0);
1166 			pipe->up_running = 0;
1167 			/* XXX do what? */
1168 		}
1169 	}
1170 
1171 	KASSERT(polling || mutex_owned(pipe->up_dev->ud_bus->ub_lock));
1172 }
1173 
1174 usbd_status
1175 usbd_do_request(struct usbd_device *dev, usb_device_request_t *req, void *data)
1176 {
1177 
1178 	return usbd_do_request_flags(dev, req, data, 0, 0,
1179 	    USBD_DEFAULT_TIMEOUT);
1180 }
1181 
1182 usbd_status
1183 usbd_do_request_flags(struct usbd_device *dev, usb_device_request_t *req,
1184     void *data, uint16_t flags, int *actlen, uint32_t timeout)
1185 {
1186 	size_t len = UGETW(req->wLength);
1187 
1188 	return usbd_do_request_len(dev, req, len, data, flags, actlen, timeout);
1189 }
1190 
1191 usbd_status
1192 usbd_do_request_len(struct usbd_device *dev, usb_device_request_t *req,
1193     size_t len, void *data, uint16_t flags, int *actlen, uint32_t timeout)
1194 {
1195 	struct usbd_xfer *xfer;
1196 	usbd_status err;
1197 
1198 	KASSERT(len >= UGETW(req->wLength));
1199 
1200 	USBHIST_FUNC();
1201 	USBHIST_CALLARGS(usbdebug, "dev=%#jx req=%jx flags=%jx len=%jx",
1202 	    (uintptr_t)dev, (uintptr_t)req, flags, len);
1203 
1204 	ASSERT_SLEEPABLE();
1205 
1206 	int error = usbd_create_xfer(dev->ud_pipe0, len, 0, 0, &xfer);
1207 	if (error)
1208 		return error;
1209 
1210 	usbd_setup_default_xfer(xfer, dev, 0, timeout, req, data,
1211 	    UGETW(req->wLength), flags, NULL);
1212 	KASSERT(xfer->ux_pipe == dev->ud_pipe0);
1213 	err = usbd_sync_transfer(xfer);
1214 #if defined(USB_DEBUG) || defined(DIAGNOSTIC)
1215 	if (xfer->ux_actlen > xfer->ux_length) {
1216 		USBHIST_LOG(usbdebug, "overrun addr = %jd type = 0x%02jx",
1217 		    dev->ud_addr, xfer->ux_request.bmRequestType, 0, 0);
1218 		USBHIST_LOG(usbdebug, "     req = 0x%02jx val = %jd "
1219 		    "index = %jd",
1220 		    xfer->ux_request.bRequest, UGETW(xfer->ux_request.wValue),
1221 		    UGETW(xfer->ux_request.wIndex), 0);
1222 		USBHIST_LOG(usbdebug, "     rlen = %jd length = %jd "
1223 		    "actlen = %jd",
1224 		    UGETW(xfer->ux_request.wLength),
1225 		    xfer->ux_length, xfer->ux_actlen, 0);
1226 	}
1227 #endif
1228 	if (actlen != NULL)
1229 		*actlen = xfer->ux_actlen;
1230 
1231 	usbd_destroy_xfer(xfer);
1232 
1233 	if (err) {
1234 		USBHIST_LOG(usbdebug, "returning err = %jd", err, 0, 0, 0);
1235 	}
1236 	return err;
1237 }
1238 
1239 static void
1240 usbd_request_async_cb(struct usbd_xfer *xfer, void *priv, usbd_status status)
1241 {
1242 	usbd_free_xfer(xfer);
1243 }
1244 
1245 /*
1246  * Execute a request without waiting for completion.
1247  * Can be used from interrupt context.
1248  */
1249 usbd_status
1250 usbd_request_async(struct usbd_device *dev, struct usbd_xfer *xfer,
1251     usb_device_request_t *req, void *priv, usbd_callback callback)
1252 {
1253 	usbd_status err;
1254 
1255 	if (callback == NULL)
1256 		callback = usbd_request_async_cb;
1257 
1258 	usbd_setup_default_xfer(xfer, dev, priv,
1259 	    USBD_DEFAULT_TIMEOUT, req, NULL, UGETW(req->wLength), 0,
1260 	    callback);
1261 	err = usbd_transfer(xfer);
1262 	if (err != USBD_IN_PROGRESS) {
1263 		usbd_free_xfer(xfer);
1264 		return (err);
1265 	}
1266 	return (USBD_NORMAL_COMPLETION);
1267 }
1268 
1269 const struct usbd_quirks *
1270 usbd_get_quirks(struct usbd_device *dev)
1271 {
1272 #ifdef DIAGNOSTIC
1273 	if (dev == NULL) {
1274 		printf("usbd_get_quirks: dev == NULL\n");
1275 		return 0;
1276 	}
1277 #endif
1278 	return dev->ud_quirks;
1279 }
1280 
1281 /* XXX do periodic free() of free list */
1282 
1283 /*
1284  * Called from keyboard driver when in polling mode.
1285  */
1286 void
1287 usbd_dopoll(struct usbd_interface *iface)
1288 {
1289 	iface->ui_dev->ud_bus->ub_methods->ubm_dopoll(iface->ui_dev->ud_bus);
1290 }
1291 
1292 /*
1293  * This is for keyboard driver as well, which only operates in polling
1294  * mode from the ask root, etc., prompt and from DDB.
1295  */
1296 void
1297 usbd_set_polling(struct usbd_device *dev, int on)
1298 {
1299 	if (on)
1300 		dev->ud_bus->ub_usepolling++;
1301 	else
1302 		dev->ud_bus->ub_usepolling--;
1303 
1304 	/* Kick the host controller when switching modes */
1305 	mutex_enter(dev->ud_bus->ub_lock);
1306 	dev->ud_bus->ub_methods->ubm_softint(dev->ud_bus);
1307 	mutex_exit(dev->ud_bus->ub_lock);
1308 }
1309 
1310 
1311 usb_endpoint_descriptor_t *
1312 usbd_get_endpoint_descriptor(struct usbd_interface *iface, uint8_t address)
1313 {
1314 	struct usbd_endpoint *ep;
1315 	int i;
1316 
1317 	for (i = 0; i < iface->ui_idesc->bNumEndpoints; i++) {
1318 		ep = &iface->ui_endpoints[i];
1319 		if (ep->ue_edesc->bEndpointAddress == address)
1320 			return iface->ui_endpoints[i].ue_edesc;
1321 	}
1322 	return NULL;
1323 }
1324 
1325 /*
1326  * usbd_ratecheck() can limit the number of error messages that occurs.
1327  * When a device is unplugged it may take up to 0.25s for the hub driver
1328  * to notice it.  If the driver continuously tries to do I/O operations
1329  * this can generate a large number of messages.
1330  */
1331 int
1332 usbd_ratecheck(struct timeval *last)
1333 {
1334 	static struct timeval errinterval = { 0, 250000 }; /* 0.25 s*/
1335 
1336 	return ratecheck(last, &errinterval);
1337 }
1338 
1339 /*
1340  * Search for a vendor/product pair in an array.  The item size is
1341  * given as an argument.
1342  */
1343 const struct usb_devno *
1344 usb_match_device(const struct usb_devno *tbl, u_int nentries, u_int sz,
1345 		 uint16_t vendor, uint16_t product)
1346 {
1347 	while (nentries-- > 0) {
1348 		uint16_t tproduct = tbl->ud_product;
1349 		if (tbl->ud_vendor == vendor &&
1350 		    (tproduct == product || tproduct == USB_PRODUCT_ANY))
1351 			return tbl;
1352 		tbl = (const struct usb_devno *)((const char *)tbl + sz);
1353 	}
1354 	return NULL;
1355 }
1356 
1357 usbd_status
1358 usbd_get_string(struct usbd_device *dev, int si, char *buf)
1359 {
1360 	return usbd_get_string0(dev, si, buf, 1);
1361 }
1362 
1363 usbd_status
1364 usbd_get_string0(struct usbd_device *dev, int si, char *buf, int unicode)
1365 {
1366 	int swap = dev->ud_quirks->uq_flags & UQ_SWAP_UNICODE;
1367 	usb_string_descriptor_t us;
1368 	char *s;
1369 	int i, n;
1370 	uint16_t c;
1371 	usbd_status err;
1372 	int size;
1373 
1374 	USBHIST_FUNC(); USBHIST_CALLED(usbdebug);
1375 
1376 	buf[0] = '\0';
1377 	if (si == 0)
1378 		return USBD_INVAL;
1379 	if (dev->ud_quirks->uq_flags & UQ_NO_STRINGS)
1380 		return USBD_STALLED;
1381 	if (dev->ud_langid == USBD_NOLANG) {
1382 		/* Set up default language */
1383 		err = usbd_get_string_desc(dev, USB_LANGUAGE_TABLE, 0, &us,
1384 		    &size);
1385 		if (err || size < 4) {
1386 			USBHIST_LOG(usbdebug, "getting lang failed, using 0",
1387 			    0, 0, 0, 0);
1388 			dev->ud_langid = 0; /* Well, just pick something then */
1389 		} else {
1390 			/* Pick the first language as the default. */
1391 			dev->ud_langid = UGETW(us.bString[0]);
1392 		}
1393 	}
1394 	err = usbd_get_string_desc(dev, si, dev->ud_langid, &us, &size);
1395 	if (err)
1396 		return err;
1397 	s = buf;
1398 	n = size / 2 - 1;
1399 	if (unicode) {
1400 		for (i = 0; i < n; i++) {
1401 			c = UGETW(us.bString[i]);
1402 			if (swap)
1403 				c = (c >> 8) | (c << 8);
1404 			s += wput_utf8(s, 3, c);
1405 		}
1406 		*s++ = 0;
1407 	}
1408 #ifdef COMPAT_30
1409 	else {
1410 		for (i = 0; i < n; i++) {
1411 			c = UGETW(us.bString[i]);
1412 			if (swap)
1413 				c = (c >> 8) | (c << 8);
1414 			*s++ = (c < 0x80) ? c : '?';
1415 		}
1416 		*s++ = 0;
1417 	}
1418 #endif
1419 	return USBD_NORMAL_COMPLETION;
1420 }
1421 
1422 /*
1423  * usbd_xfer_trycomplete(xfer)
1424  *
1425  *	Try to claim xfer for completion.  Return true if successful,
1426  *	false if the xfer has been synchronously aborted or has timed
1427  *	out.
1428  *
1429  *	If this returns true, caller is responsible for setting
1430  *	xfer->ux_status and calling usb_transfer_complete.  To be used
1431  *	in a host controller interrupt handler.
1432  *
1433  *	Caller must either hold the bus lock or have the bus in polling
1434  *	mode.
1435  */
1436 bool
1437 usbd_xfer_trycomplete(struct usbd_xfer *xfer)
1438 {
1439 	struct usbd_bus *bus __diagused = xfer->ux_bus;
1440 
1441 	KASSERT(bus->ub_usepolling || mutex_owned(bus->ub_lock));
1442 
1443 	/*
1444 	 * If software has completed it, either by synchronous abort or
1445 	 * by timeout, too late.
1446 	 */
1447 	if (xfer->ux_status != USBD_IN_PROGRESS)
1448 		return false;
1449 
1450 	/*
1451 	 * We are completing the xfer.  Cancel the timeout if we can,
1452 	 * but only asynchronously.  See usbd_xfer_cancel_timeout_async
1453 	 * for why we need not wait for the callout or task here.
1454 	 */
1455 	usbd_xfer_cancel_timeout_async(xfer);
1456 
1457 	/* Success!  Note: Caller must set xfer->ux_status afterwar.  */
1458 	return true;
1459 }
1460 
1461 /*
1462  * usbd_xfer_abort(xfer)
1463  *
1464  *	Try to claim xfer to abort.  If successful, mark it completed
1465  *	with USBD_CANCELLED and call the bus-specific method to abort
1466  *	at the hardware level.
1467  *
1468  *	To be called in thread context from struct
1469  *	usbd_pipe_methods::upm_abort.
1470  *
1471  *	Caller must hold the bus lock.
1472  */
1473 void
1474 usbd_xfer_abort(struct usbd_xfer *xfer)
1475 {
1476 	struct usbd_bus *bus = xfer->ux_bus;
1477 
1478 	KASSERT(mutex_owned(bus->ub_lock));
1479 
1480 	/*
1481 	 * If host controller interrupt or timer interrupt has
1482 	 * completed it, too late.  But the xfer cannot be
1483 	 * cancelled already -- only one caller can synchronously
1484 	 * abort.
1485 	 */
1486 	KASSERT(xfer->ux_status != USBD_CANCELLED);
1487 	if (xfer->ux_status != USBD_IN_PROGRESS)
1488 		return;
1489 
1490 	/*
1491 	 * Cancel the timeout if we can, but only asynchronously; see
1492 	 * usbd_xfer_cancel_timeout_async for why we need not wait for
1493 	 * the callout or task here.
1494 	 */
1495 	usbd_xfer_cancel_timeout_async(xfer);
1496 
1497 	/*
1498 	 * We beat everyone else.  Claim the status as cancelled and do
1499 	 * the bus-specific dance to abort the hardware.
1500 	 */
1501 	xfer->ux_status = USBD_CANCELLED;
1502 	bus->ub_methods->ubm_abortx(xfer);
1503 }
1504 
1505 /*
1506  * usbd_xfer_timeout(xfer)
1507  *
1508  *	Called at IPL_SOFTCLOCK when too much time has elapsed waiting
1509  *	for xfer to complete.  Since we can't abort the xfer at
1510  *	IPL_SOFTCLOCK, defer to a usb_task to run it in thread context,
1511  *	unless the xfer has completed or aborted concurrently -- and if
1512  *	the xfer has also been resubmitted, take care of rescheduling
1513  *	the callout.
1514  */
1515 static void
1516 usbd_xfer_timeout(void *cookie)
1517 {
1518 	struct usbd_xfer *xfer = cookie;
1519 	struct usbd_bus *bus = xfer->ux_bus;
1520 	struct usbd_device *dev = xfer->ux_pipe->up_dev;
1521 
1522 	/* Acquire the lock so we can transition the timeout state.  */
1523 	mutex_enter(bus->ub_lock);
1524 
1525 	/*
1526 	 * Use usbd_xfer_probe_timeout to check whether the timeout is
1527 	 * still valid, or to reschedule the callout if necessary.  If
1528 	 * it is still valid, schedule the task.
1529 	 */
1530 	if (usbd_xfer_probe_timeout(xfer))
1531 		usb_add_task(dev, &xfer->ux_aborttask, USB_TASKQ_HC);
1532 
1533 	/*
1534 	 * Notify usbd_xfer_cancel_timeout_async that we may have
1535 	 * scheduled the task.  This causes callout_invoking to return
1536 	 * false in usbd_xfer_cancel_timeout_async so that it can tell
1537 	 * which stage in the callout->task->abort process we're at.
1538 	 */
1539 	callout_ack(&xfer->ux_callout);
1540 
1541 	/* All done -- release the lock.  */
1542 	mutex_exit(bus->ub_lock);
1543 }
1544 
1545 /*
1546  * usbd_xfer_timeout_task(xfer)
1547  *
1548  *	Called in thread context when too much time has elapsed waiting
1549  *	for xfer to complete.  Abort the xfer with USBD_TIMEOUT, unless
1550  *	it has completed or aborted concurrently -- and if the xfer has
1551  *	also been resubmitted, take care of rescheduling the callout.
1552  */
1553 static void
1554 usbd_xfer_timeout_task(void *cookie)
1555 {
1556 	struct usbd_xfer *xfer = cookie;
1557 	struct usbd_bus *bus = xfer->ux_bus;
1558 
1559 	/* Acquire the lock so we can transition the timeout state.  */
1560 	mutex_enter(bus->ub_lock);
1561 
1562 	/*
1563 	 * Use usbd_xfer_probe_timeout to check whether the timeout is
1564 	 * still valid, or to reschedule the callout if necessary.  If
1565 	 * it is not valid -- the timeout has been asynchronously
1566 	 * cancelled, or the xfer has already been resubmitted -- then
1567 	 * we're done here.
1568 	 */
1569 	if (!usbd_xfer_probe_timeout(xfer))
1570 		goto out;
1571 
1572 	/*
1573 	 * May have completed or been aborted, but we're the only one
1574 	 * who can time it out.  If it has completed or been aborted,
1575 	 * no need to timeout.
1576 	 */
1577 	KASSERT(xfer->ux_status != USBD_TIMEOUT);
1578 	if (xfer->ux_status != USBD_IN_PROGRESS)
1579 		goto out;
1580 
1581 	/*
1582 	 * We beat everyone else.  Claim the status as timed out and do
1583 	 * the bus-specific dance to abort the hardware.
1584 	 */
1585 	xfer->ux_status = USBD_TIMEOUT;
1586 	bus->ub_methods->ubm_abortx(xfer);
1587 
1588 out:	/* All done -- release the lock.  */
1589 	mutex_exit(bus->ub_lock);
1590 }
1591 
1592 /*
1593  * usbd_xfer_probe_timeout(xfer)
1594  *
1595  *	Probe the status of xfer's timeout.  Acknowledge and process a
1596  *	request to reschedule.  Return true if the timeout is still
1597  *	valid and the caller should take further action (queueing a
1598  *	task or aborting the xfer), false if it must stop here.
1599  */
1600 static bool
1601 usbd_xfer_probe_timeout(struct usbd_xfer *xfer)
1602 {
1603 	struct usbd_bus *bus = xfer->ux_bus;
1604 	bool valid;
1605 
1606 	KASSERT(bus->ub_usepolling || mutex_owned(bus->ub_lock));
1607 
1608 	/* The timeout must be set.  */
1609 	KASSERT(xfer->ux_timeout_set);
1610 
1611 	/*
1612 	 * Neither callout nor task may be pending; they execute
1613 	 * alternately in lock step.
1614 	 */
1615 	KASSERT(!callout_pending(&xfer->ux_callout));
1616 	KASSERT(!usb_task_pending(xfer->ux_pipe->up_dev, &xfer->ux_aborttask));
1617 
1618 	/* There are a few cases... */
1619 	if (bus->ub_methods->ubm_dying(bus)) {
1620 		/* Host controller dying.  Drop it all on the floor.  */
1621 		xfer->ux_timeout_set = false;
1622 		xfer->ux_timeout_reset = false;
1623 		valid = false;
1624 	} else if (xfer->ux_timeout_reset) {
1625 		/*
1626 		 * The xfer completed _and_ got resubmitted while we
1627 		 * waited for the lock.  Acknowledge the request to
1628 		 * reschedule, and reschedule it if there is a timeout
1629 		 * and the bus is not polling.
1630 		 */
1631 		xfer->ux_timeout_reset = false;
1632 		if (xfer->ux_timeout && !bus->ub_usepolling) {
1633 			KASSERT(xfer->ux_timeout_set);
1634 			callout_schedule(&xfer->ux_callout,
1635 			    mstohz(xfer->ux_timeout));
1636 		} else {
1637 			/* No more callout or task scheduled.  */
1638 			xfer->ux_timeout_set = false;
1639 		}
1640 		valid = false;
1641 	} else if (xfer->ux_status != USBD_IN_PROGRESS) {
1642 		/*
1643 		 * The xfer has completed by hardware completion or by
1644 		 * software abort, and has not been resubmitted, so the
1645 		 * timeout must be unset, and is no longer valid for
1646 		 * the caller.
1647 		 */
1648 		xfer->ux_timeout_set = false;
1649 		valid = false;
1650 	} else {
1651 		/*
1652 		 * The xfer has not yet completed, so the timeout is
1653 		 * valid.
1654 		 */
1655 		valid = true;
1656 	}
1657 
1658 	/* Any reset must have been processed.  */
1659 	KASSERT(!xfer->ux_timeout_reset);
1660 
1661 	/*
1662 	 * Either we claim the timeout is set, or the callout is idle.
1663 	 * If the timeout is still set, we may be handing off to the
1664 	 * task instead, so this is an if but not an iff.
1665 	 */
1666 	KASSERT(xfer->ux_timeout_set || !callout_pending(&xfer->ux_callout));
1667 
1668 	/*
1669 	 * The task must be idle now.
1670 	 *
1671 	 * - If the caller is the callout, _and_ the timeout is still
1672 	 *   valid, the caller will schedule it, but it hasn't been
1673 	 *   scheduled yet.  (If the timeout is not valid, the task
1674 	 *   should not be scheduled.)
1675 	 *
1676 	 * - If the caller is the task, it cannot be scheduled again
1677 	 *   until the callout runs again, which won't happen until we
1678 	 *   next release the lock.
1679 	 */
1680 	KASSERT(!usb_task_pending(xfer->ux_pipe->up_dev, &xfer->ux_aborttask));
1681 
1682 	KASSERT(bus->ub_usepolling || mutex_owned(bus->ub_lock));
1683 
1684 	return valid;
1685 }
1686 
1687 /*
1688  * usbd_xfer_schedule_timeout(xfer)
1689  *
1690  *	Ensure that xfer has a timeout.  If the callout is already
1691  *	queued or the task is already running, request that they
1692  *	reschedule the callout.  If not, and if we're not polling,
1693  *	schedule the callout anew.
1694  *
1695  *	To be called in thread context from struct
1696  *	usbd_pipe_methods::upm_start.
1697  */
1698 void
1699 usbd_xfer_schedule_timeout(struct usbd_xfer *xfer)
1700 {
1701 	struct usbd_bus *bus = xfer->ux_bus;
1702 
1703 	KASSERT(bus->ub_usepolling || mutex_owned(bus->ub_lock));
1704 
1705 	if (xfer->ux_timeout_set) {
1706 		/*
1707 		 * Callout or task has fired from a prior completed
1708 		 * xfer but has not yet noticed that the xfer is done.
1709 		 * Ask it to reschedule itself to ux_timeout.
1710 		 */
1711 		xfer->ux_timeout_reset = true;
1712 	} else if (xfer->ux_timeout && !bus->ub_usepolling) {
1713 		/* Callout is not scheduled.  Schedule it.  */
1714 		KASSERT(!callout_pending(&xfer->ux_callout));
1715 		callout_schedule(&xfer->ux_callout, mstohz(xfer->ux_timeout));
1716 		xfer->ux_timeout_set = true;
1717 	}
1718 
1719 	KASSERT(bus->ub_usepolling || mutex_owned(bus->ub_lock));
1720 }
1721 
1722 /*
1723  * usbd_xfer_cancel_timeout_async(xfer)
1724  *
1725  *	Cancel the callout and the task of xfer, which have not yet run
1726  *	to completion, but don't wait for the callout or task to finish
1727  *	running.
1728  *
1729  *	If they have already fired, at worst they are waiting for the
1730  *	bus lock.  They will see that the xfer is no longer in progress
1731  *	and give up, or they will see that the xfer has been
1732  *	resubmitted with a new timeout and reschedule the callout.
1733  *
1734  *	If a resubmitted request completed so fast that the callout
1735  *	didn't have time to process a timer reset, just cancel the
1736  *	timer reset.
1737  */
1738 static void
1739 usbd_xfer_cancel_timeout_async(struct usbd_xfer *xfer)
1740 {
1741 	struct usbd_bus *bus __diagused = xfer->ux_bus;
1742 
1743 	KASSERT(bus->ub_usepolling || mutex_owned(bus->ub_lock));
1744 
1745 	/*
1746 	 * If the timer wasn't running anyway, forget about it.  This
1747 	 * can happen if we are completing an isochronous transfer
1748 	 * which doesn't use the same timeout logic.
1749 	 */
1750 	if (!xfer->ux_timeout_set)
1751 		return;
1752 
1753 	xfer->ux_timeout_reset = false;
1754 	if (!callout_stop(&xfer->ux_callout)) {
1755 		/*
1756 		 * We stopped the callout before it ran.  The timeout
1757 		 * is no longer set.
1758 		 */
1759 		xfer->ux_timeout_set = false;
1760 	} else if (callout_invoking(&xfer->ux_callout)) {
1761 		/*
1762 		 * The callout has begun to run but it has not yet
1763 		 * acquired the lock and called callout_ack.  The task
1764 		 * cannot be queued yet, and the callout cannot have
1765 		 * been rescheduled yet.
1766 		 *
1767 		 * By the time the callout acquires the lock, we will
1768 		 * have transitioned from USBD_IN_PROGRESS to a
1769 		 * completed status, and possibly also resubmitted the
1770 		 * xfer and set xfer->ux_timeout_reset = true.  In both
1771 		 * cases, the callout will DTRT, so no further action
1772 		 * is needed here.
1773 		 */
1774 	} else if (usb_rem_task(xfer->ux_pipe->up_dev, &xfer->ux_aborttask)) {
1775 		/*
1776 		 * The callout had fired and scheduled the task, but we
1777 		 * stopped the task before it could run.  The timeout
1778 		 * is therefore no longer set -- the next resubmission
1779 		 * of the xfer must schedule a new timeout.
1780 		 *
1781 		 * The callout should not be be pending at this point:
1782 		 * it is scheduled only under the lock, and only when
1783 		 * xfer->ux_timeout_set is false, or by the callout or
1784 		 * task itself when xfer->ux_timeout_reset is true.
1785 		 */
1786 		xfer->ux_timeout_set = false;
1787 	}
1788 
1789 	/*
1790 	 * The callout cannot be scheduled and the task cannot be
1791 	 * queued at this point.  Either we cancelled them, or they are
1792 	 * already running and waiting for the bus lock.
1793 	 */
1794 	KASSERT(!callout_pending(&xfer->ux_callout));
1795 	KASSERT(!usb_task_pending(xfer->ux_pipe->up_dev, &xfer->ux_aborttask));
1796 
1797 	KASSERT(bus->ub_usepolling || mutex_owned(bus->ub_lock));
1798 }
1799