xref: /netbsd-src/sys/dev/usb/xhci.c (revision 6d322f2f4598f0d8a138f10ea648ec4fabe41f8b)
1 /*	$NetBSD: xhci.c,v 1.12 2013/12/14 16:03:04 jakllsch Exp $	*/
2 
3 /*
4  * Copyright (c) 2013 Jonathan A. Kollasch
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
17  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
20  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
21  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
22  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
23  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
24  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
25  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
26  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 __KERNEL_RCSID(0, "$NetBSD: xhci.c,v 1.12 2013/12/14 16:03:04 jakllsch Exp $");
31 
32 #include <sys/param.h>
33 #include <sys/systm.h>
34 #include <sys/kernel.h>
35 #include <sys/kmem.h>
36 #include <sys/malloc.h>
37 #include <sys/device.h>
38 #include <sys/select.h>
39 #include <sys/proc.h>
40 #include <sys/queue.h>
41 #include <sys/mutex.h>
42 #include <sys/condvar.h>
43 #include <sys/bus.h>
44 #include <sys/cpu.h>
45 
46 #include <machine/endian.h>
47 
48 #include <dev/usb/usb.h>
49 #include <dev/usb/usbdi.h>
50 #include <dev/usb/usbdivar.h>
51 #include <dev/usb/usb_mem.h>
52 #include <dev/usb/usb_quirks.h>
53 
54 #include <dev/usb/xhcireg.h>
55 #include <dev/usb/xhcivar.h>
56 #include <dev/usb/usbroothub_subr.h>
57 
58 #ifdef XHCI_DEBUG
59 int xhcidebug = 0;
60 #define DPRINTF(x)	do { if (xhcidebug) printf x; } while(0)
61 #define DPRINTFN(n,x)	do { if (xhcidebug>(n)) printf x; } while (0)
62 #else
63 #define DPRINTF(x)
64 #define DPRINTFN(n,x)
65 #endif
66 
67 #define XHCI_DCI_SLOT 0
68 #define XHCI_DCI_EP_CONTROL 1
69 
70 #define XHCI_ICI_INPUT_CONTROL 0
71 
72 struct xhci_pipe {
73 	struct usbd_pipe xp_pipe;
74 };
75 
76 #define XHCI_INTR_ENDPT 1
77 #define XHCI_COMMAND_RING_TRBS 256
78 #define XHCI_EVENT_RING_TRBS 256
79 #define XHCI_EVENT_RING_SEGMENTS 1
80 #define XHCI_TRB_3_ED_BIT XHCI_TRB_3_ISP_BIT
81 
82 static usbd_status xhci_open(usbd_pipe_handle);
83 static int xhci_intr1(struct xhci_softc * const);
84 static void xhci_softintr(void *);
85 static void xhci_poll(struct usbd_bus *);
86 static usbd_status xhci_allocm(struct usbd_bus *, usb_dma_t *, uint32_t);
87 static void xhci_freem(struct usbd_bus *, usb_dma_t *);
88 static usbd_xfer_handle xhci_allocx(struct usbd_bus *);
89 static void xhci_freex(struct usbd_bus *, usbd_xfer_handle);
90 static void xhci_get_lock(struct usbd_bus *, kmutex_t **);
91 static usbd_status xhci_new_device(device_t, usbd_bus_handle, int, int, int,
92     struct usbd_port *);
93 
94 static usbd_status xhci_configure_endpoint(usbd_pipe_handle);
95 static usbd_status xhci_unconfigure_endpoint(usbd_pipe_handle);
96 static usbd_status xhci_reset_endpoint(usbd_pipe_handle);
97 //static usbd_status xhci_stop_endpoint(usbd_pipe_handle);
98 
99 static usbd_status xhci_set_dequeue(usbd_pipe_handle);
100 
101 static usbd_status xhci_do_command(struct xhci_softc * const,
102     struct xhci_trb * const, int);
103 static usbd_status xhci_init_slot(struct xhci_softc * const, uint32_t,
104     int, int, int, int);
105 static usbd_status xhci_enable_slot(struct xhci_softc * const,
106     uint8_t * const);
107 static usbd_status xhci_address_device(struct xhci_softc * const,
108     uint64_t, uint8_t, bool);
109 static usbd_status xhci_update_ep0_mps(struct xhci_softc * const,
110     struct xhci_slot * const, u_int);
111 static usbd_status xhci_ring_init(struct xhci_softc * const,
112     struct xhci_ring * const, size_t, size_t);
113 static void xhci_ring_free(struct xhci_softc * const, struct xhci_ring * const);
114 
115 static void xhci_noop(usbd_pipe_handle);
116 
117 static usbd_status xhci_root_ctrl_transfer(usbd_xfer_handle);
118 static usbd_status xhci_root_ctrl_start(usbd_xfer_handle);
119 static void xhci_root_ctrl_abort(usbd_xfer_handle);
120 static void xhci_root_ctrl_close(usbd_pipe_handle);
121 static void xhci_root_ctrl_done(usbd_xfer_handle);
122 
123 static usbd_status xhci_root_intr_transfer(usbd_xfer_handle);
124 static usbd_status xhci_root_intr_start(usbd_xfer_handle);
125 static void xhci_root_intr_abort(usbd_xfer_handle);
126 static void xhci_root_intr_close(usbd_pipe_handle);
127 static void xhci_root_intr_done(usbd_xfer_handle);
128 
129 static usbd_status xhci_device_ctrl_transfer(usbd_xfer_handle);
130 static usbd_status xhci_device_ctrl_start(usbd_xfer_handle);
131 static void xhci_device_ctrl_abort(usbd_xfer_handle);
132 static void xhci_device_ctrl_close(usbd_pipe_handle);
133 static void xhci_device_ctrl_done(usbd_xfer_handle);
134 
135 static usbd_status xhci_device_intr_transfer(usbd_xfer_handle);
136 static usbd_status xhci_device_intr_start(usbd_xfer_handle);
137 static void xhci_device_intr_abort(usbd_xfer_handle);
138 static void xhci_device_intr_close(usbd_pipe_handle);
139 static void xhci_device_intr_done(usbd_xfer_handle);
140 
141 static usbd_status xhci_device_bulk_transfer(usbd_xfer_handle);
142 static usbd_status xhci_device_bulk_start(usbd_xfer_handle);
143 static void xhci_device_bulk_abort(usbd_xfer_handle);
144 static void xhci_device_bulk_close(usbd_pipe_handle);
145 static void xhci_device_bulk_done(usbd_xfer_handle);
146 
147 static void xhci_timeout(void *);
148 static void xhci_timeout_task(void *);
149 
150 static const struct usbd_bus_methods xhci_bus_methods = {
151 	.open_pipe = xhci_open,
152 	.soft_intr = xhci_softintr,
153 	.do_poll = xhci_poll,
154 	.allocm = xhci_allocm,
155 	.freem = xhci_freem,
156 	.allocx = xhci_allocx,
157 	.freex = xhci_freex,
158 	.get_lock = xhci_get_lock,
159 	.new_device = xhci_new_device,
160 };
161 
162 static const struct usbd_pipe_methods xhci_root_ctrl_methods = {
163 	.transfer = xhci_root_ctrl_transfer,
164 	.start = xhci_root_ctrl_start,
165 	.abort = xhci_root_ctrl_abort,
166 	.close = xhci_root_ctrl_close,
167 	.cleartoggle = xhci_noop,
168 	.done = xhci_root_ctrl_done,
169 };
170 
171 static const struct usbd_pipe_methods xhci_root_intr_methods = {
172 	.transfer = xhci_root_intr_transfer,
173 	.start = xhci_root_intr_start,
174 	.abort = xhci_root_intr_abort,
175 	.close = xhci_root_intr_close,
176 	.cleartoggle = xhci_noop,
177 	.done = xhci_root_intr_done,
178 };
179 
180 
181 static const struct usbd_pipe_methods xhci_device_ctrl_methods = {
182 	.transfer = xhci_device_ctrl_transfer,
183 	.start = xhci_device_ctrl_start,
184 	.abort = xhci_device_ctrl_abort,
185 	.close = xhci_device_ctrl_close,
186 	.cleartoggle = xhci_noop,
187 	.done = xhci_device_ctrl_done,
188 };
189 
190 static const struct usbd_pipe_methods xhci_device_isoc_methods = {
191 	.cleartoggle = xhci_noop,
192 };
193 
194 static const struct usbd_pipe_methods xhci_device_bulk_methods = {
195 	.transfer = xhci_device_bulk_transfer,
196 	.start = xhci_device_bulk_start,
197 	.abort = xhci_device_bulk_abort,
198 	.close = xhci_device_bulk_close,
199 	.cleartoggle = xhci_noop,
200 	.done = xhci_device_bulk_done,
201 };
202 
203 static const struct usbd_pipe_methods xhci_device_intr_methods = {
204 	.transfer = xhci_device_intr_transfer,
205 	.start = xhci_device_intr_start,
206 	.abort = xhci_device_intr_abort,
207 	.close = xhci_device_intr_close,
208 	.cleartoggle = xhci_noop,
209 	.done = xhci_device_intr_done,
210 };
211 
212 static inline uint32_t
213 xhci_read_4(const struct xhci_softc * const sc, bus_size_t offset)
214 {
215 	return bus_space_read_4(sc->sc_iot, sc->sc_ioh, offset);
216 }
217 
218 #if 0 /* unused */
219 static inline void
220 xhci_write_4(const struct xhci_softc * const sc, bus_size_t offset,
221     uint32_t value)
222 {
223 	bus_space_write_4(sc->sc_iot, sc->sc_ioh, offset, value);
224 }
225 #endif /* unused */
226 
227 static inline uint32_t
228 xhci_cap_read_4(const struct xhci_softc * const sc, bus_size_t offset)
229 {
230 	return bus_space_read_4(sc->sc_iot, sc->sc_cbh, offset);
231 }
232 
233 static inline uint32_t
234 xhci_op_read_4(const struct xhci_softc * const sc, bus_size_t offset)
235 {
236 	return bus_space_read_4(sc->sc_iot, sc->sc_obh, offset);
237 }
238 
239 static inline void
240 xhci_op_write_4(const struct xhci_softc * const sc, bus_size_t offset,
241     uint32_t value)
242 {
243 	bus_space_write_4(sc->sc_iot, sc->sc_obh, offset, value);
244 }
245 
246 #if 0 /* unused */
247 static inline uint64_t
248 xhci_op_read_8(const struct xhci_softc * const sc, bus_size_t offset)
249 {
250 	uint64_t value;
251 
252 	if (sc->sc_ac64) {
253 #ifdef XHCI_USE_BUS_SPACE_8
254 		value = bus_space_read_8(sc->sc_iot, sc->sc_obh, offset);
255 #else
256 		value = bus_space_read_4(sc->sc_iot, sc->sc_obh, offset);
257 		value |= (uint64_t)bus_space_read_4(sc->sc_iot, sc->sc_obh,
258 		    offset + 4) << 32;
259 #endif
260 	} else {
261 		value = bus_space_read_4(sc->sc_iot, sc->sc_obh, offset);
262 	}
263 
264 	return value;
265 }
266 #endif /* unused */
267 
268 static inline void
269 xhci_op_write_8(const struct xhci_softc * const sc, bus_size_t offset,
270     uint64_t value)
271 {
272 	if (sc->sc_ac64) {
273 #ifdef XHCI_USE_BUS_SPACE_8
274 		bus_space_write_8(sc->sc_iot, sc->sc_obh, offset, value);
275 #else
276 		bus_space_write_4(sc->sc_iot, sc->sc_obh, offset + 0,
277 		    (value >> 0) & 0xffffffff);
278 		bus_space_write_4(sc->sc_iot, sc->sc_obh, offset + 4,
279 		    (value >> 32) & 0xffffffff);
280 #endif
281 	} else {
282 		bus_space_write_4(sc->sc_iot, sc->sc_obh, offset, value);
283 	}
284 }
285 
286 static inline uint32_t
287 xhci_rt_read_4(const struct xhci_softc * const sc, bus_size_t offset)
288 {
289 	return bus_space_read_4(sc->sc_iot, sc->sc_rbh, offset);
290 }
291 
292 static inline void
293 xhci_rt_write_4(const struct xhci_softc * const sc, bus_size_t offset,
294     uint32_t value)
295 {
296 	bus_space_write_4(sc->sc_iot, sc->sc_rbh, offset, value);
297 }
298 
299 #if 0 /* unused */
300 static inline uint64_t
301 xhci_rt_read_8(const struct xhci_softc * const sc, bus_size_t offset)
302 {
303 	uint64_t value;
304 
305 	if (sc->sc_ac64) {
306 #ifdef XHCI_USE_BUS_SPACE_8
307 		value = bus_space_read_8(sc->sc_iot, sc->sc_rbh, offset);
308 #else
309 		value = bus_space_read_4(sc->sc_iot, sc->sc_rbh, offset);
310 		value |= (uint64_t)bus_space_read_4(sc->sc_iot, sc->sc_rbh,
311 		    offset + 4) << 32;
312 #endif
313 	} else {
314 		value = bus_space_read_4(sc->sc_iot, sc->sc_rbh, offset);
315 	}
316 
317 	return value;
318 }
319 #endif /* unused */
320 
321 static inline void
322 xhci_rt_write_8(const struct xhci_softc * const sc, bus_size_t offset,
323     uint64_t value)
324 {
325 	if (sc->sc_ac64) {
326 #ifdef XHCI_USE_BUS_SPACE_8
327 		bus_space_write_8(sc->sc_iot, sc->sc_rbh, offset, value);
328 #else
329 		bus_space_write_4(sc->sc_iot, sc->sc_rbh, offset + 0,
330 		    (value >> 0) & 0xffffffff);
331 		bus_space_write_4(sc->sc_iot, sc->sc_rbh, offset + 4,
332 		    (value >> 32) & 0xffffffff);
333 #endif
334 	} else {
335 		bus_space_write_4(sc->sc_iot, sc->sc_rbh, offset, value);
336 	}
337 }
338 
339 #if 0 /* unused */
340 static inline uint32_t
341 xhci_db_read_4(const struct xhci_softc * const sc, bus_size_t offset)
342 {
343 	return bus_space_read_4(sc->sc_iot, sc->sc_dbh, offset);
344 }
345 #endif /* unused */
346 
347 static inline void
348 xhci_db_write_4(const struct xhci_softc * const sc, bus_size_t offset,
349     uint32_t value)
350 {
351 	bus_space_write_4(sc->sc_iot, sc->sc_dbh, offset, value);
352 }
353 
354 /* --- */
355 
356 static inline uint8_t
357 xhci_ep_get_type(usb_endpoint_descriptor_t * const ed)
358 {
359 	u_int eptype;
360 
361 	switch (UE_GET_XFERTYPE(ed->bmAttributes)) {
362 	case UE_CONTROL:
363 		eptype = 0x0;
364 		break;
365 	case UE_ISOCHRONOUS:
366 		eptype = 0x1;
367 		break;
368 	case UE_BULK:
369 		eptype = 0x2;
370 		break;
371 	case UE_INTERRUPT:
372 		eptype = 0x3;
373 		break;
374 	}
375 
376 	if ((UE_GET_XFERTYPE(ed->bmAttributes) == UE_CONTROL) ||
377 	    (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN))
378 		return eptype | 0x4;
379 	else
380 		return eptype;
381 }
382 
383 static u_int
384 xhci_ep_get_dci(usb_endpoint_descriptor_t * const ed)
385 {
386 	/* xHCI 1.0 section 4.5.1 */
387 	u_int epaddr = UE_GET_ADDR(ed->bEndpointAddress);
388 	u_int in = 0;
389 
390 	if ((UE_GET_XFERTYPE(ed->bmAttributes) == UE_CONTROL) ||
391 	    (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN))
392 		in = 1;
393 
394 	return epaddr * 2 + in;
395 }
396 
397 static inline u_int
398 xhci_dci_to_ici(const u_int i)
399 {
400 	return i + 1;
401 }
402 
403 static inline void *
404 xhci_slot_get_dcv(struct xhci_softc * const sc, struct xhci_slot * const xs,
405     const u_int dci)
406 {
407 	return KERNADDR(&xs->xs_dc_dma, sc->sc_ctxsz * dci);
408 }
409 
410 #if 0 /* unused */
411 static inline bus_addr_t
412 xhci_slot_get_dcp(struct xhci_softc * const sc, struct xhci_slot * const xs,
413     const u_int dci)
414 {
415 	return DMAADDR(&xs->xs_dc_dma, sc->sc_ctxsz * dci);
416 }
417 #endif /* unused */
418 
419 static inline void *
420 xhci_slot_get_icv(struct xhci_softc * const sc, struct xhci_slot * const xs,
421     const u_int ici)
422 {
423 	return KERNADDR(&xs->xs_ic_dma, sc->sc_ctxsz * ici);
424 }
425 
426 static inline bus_addr_t
427 xhci_slot_get_icp(struct xhci_softc * const sc, struct xhci_slot * const xs,
428     const u_int ici)
429 {
430 	return DMAADDR(&xs->xs_ic_dma, sc->sc_ctxsz * ici);
431 }
432 
433 static inline struct xhci_trb *
434 xhci_ring_trbv(struct xhci_ring * const xr, u_int idx)
435 {
436 	return KERNADDR(&xr->xr_dma, XHCI_TRB_SIZE * idx);
437 }
438 
439 static inline bus_addr_t
440 xhci_ring_trbp(struct xhci_ring * const xr, u_int idx)
441 {
442 	return DMAADDR(&xr->xr_dma, XHCI_TRB_SIZE * idx);
443 }
444 
445 static inline void
446 xhci_trb_put(struct xhci_trb * const trb, uint64_t parameter, uint32_t status,
447     uint32_t control)
448 {
449 	trb->trb_0 = parameter;
450 	trb->trb_2 = status;
451 	trb->trb_3 = control;
452 }
453 
454 /* --- */
455 
456 void
457 xhci_childdet(device_t self, device_t child)
458 {
459 	struct xhci_softc * const sc = device_private(self);
460 
461 	KASSERT(sc->sc_child == child);
462 	if (child == sc->sc_child)
463 		sc->sc_child = NULL;
464 }
465 
466 int
467 xhci_detach(struct xhci_softc *sc, int flags)
468 {
469 	int rv = 0;
470 
471 	if (sc->sc_child != NULL)
472 		rv = config_detach(sc->sc_child, flags);
473 
474 	if (rv != 0)
475 		return (rv);
476 
477 	/* XXX unconfigure/free slots */
478 
479 	/* verify: */
480 	xhci_rt_write_4(sc, XHCI_IMAN(0), 0);
481 	xhci_op_write_4(sc, XHCI_USBCMD, 0);
482 	/* do we need to wait for stop? */
483 
484 	xhci_op_write_8(sc, XHCI_CRCR, 0);
485 	xhci_ring_free(sc, &sc->sc_cr);
486 	cv_destroy(&sc->sc_command_cv);
487 
488 	xhci_rt_write_4(sc, XHCI_ERSTSZ(0), 0);
489 	xhci_rt_write_8(sc, XHCI_ERSTBA(0), 0);
490 	xhci_rt_write_8(sc, XHCI_ERDP(0), 0|XHCI_ERDP_LO_BUSY);
491 	xhci_ring_free(sc, &sc->sc_er);
492 
493 	usb_freemem(&sc->sc_bus, &sc->sc_eventst_dma);
494 
495 	xhci_op_write_8(sc, XHCI_DCBAAP, 0);
496 	usb_freemem(&sc->sc_bus, &sc->sc_dcbaa_dma);
497 
498 	kmem_free(sc->sc_slots, sizeof(*sc->sc_slots) * sc->sc_maxslots);
499 
500 	mutex_destroy(&sc->sc_lock);
501 	mutex_destroy(&sc->sc_intr_lock);
502 
503 	pool_cache_destroy(sc->sc_xferpool);
504 
505 	return rv;
506 }
507 
508 int
509 xhci_activate(device_t self, enum devact act)
510 {
511 	struct xhci_softc * const sc = device_private(self);
512 
513 	switch (act) {
514 	case DVACT_DEACTIVATE:
515 		sc->sc_dying = true;
516 		return 0;
517 	default:
518 		return EOPNOTSUPP;
519 	}
520 }
521 
522 bool
523 xhci_suspend(device_t dv, const pmf_qual_t *qual)
524 {
525 	return false;
526 }
527 
528 bool
529 xhci_resume(device_t dv, const pmf_qual_t *qual)
530 {
531 	return false;
532 }
533 
534 bool
535 xhci_shutdown(device_t self, int flags)
536 {
537 	return false;
538 }
539 
540 
541 static void
542 hexdump(const char *msg, const void *base, size_t len)
543 {
544 #if 0
545 	size_t cnt;
546 	const uint32_t *p;
547 	extern paddr_t vtophys(vaddr_t);
548 
549 	p = base;
550 	cnt = 0;
551 
552 	printf("*** %s (%zu bytes @ %p %p)\n", msg, len, base,
553 	    (void *)vtophys((vaddr_t)base));
554 
555 	while (cnt < len) {
556 		if (cnt % 16 == 0)
557 			printf("%p: ", p);
558 		else if (cnt % 8 == 0)
559 			printf(" |");
560 		printf(" %08x", *p++);
561 		cnt += 4;
562 		if (cnt % 16 == 0)
563 			printf("\n");
564 	}
565 #endif
566 }
567 
568 
569 usbd_status
570 xhci_init(struct xhci_softc *sc)
571 {
572 	bus_size_t bsz;
573 	uint32_t cap, hcs1, hcs2, hcc, dboff, rtsoff;
574 	uint32_t ecp, ecr;
575 	uint32_t usbcmd, usbsts, pagesize, config;
576 	int i;
577 	uint16_t hciversion;
578 	uint8_t caplength;
579 
580 	DPRINTF(("%s\n", __func__));
581 
582 	sc->sc_bus.usbrev = USBREV_2_0; /* XXX Low/Full/High speeds for now */
583 
584 	cap = xhci_read_4(sc, XHCI_CAPLENGTH);
585 	caplength = XHCI_CAP_CAPLENGTH(cap);
586 	hciversion = XHCI_CAP_HCIVERSION(cap);
587 
588 	if ((hciversion < 0x0096) || (hciversion > 0x0100)) {
589 		aprint_normal_dev(sc->sc_dev,
590 		    "xHCI version %x.%x not known to be supported\n",
591 		    (hciversion >> 8) & 0xff, (hciversion >> 0) & 0xff);
592 	} else {
593 		aprint_verbose_dev(sc->sc_dev, "xHCI version %x.%x\n",
594 		    (hciversion >> 8) & 0xff, (hciversion >> 0) & 0xff);
595 	}
596 
597 	if (bus_space_subregion(sc->sc_iot, sc->sc_ioh, 0, caplength,
598 	    &sc->sc_cbh) != 0) {
599 		aprint_error_dev(sc->sc_dev, "capability subregion failure\n");
600 		return USBD_NOMEM;
601 	}
602 
603 	hcs1 = xhci_cap_read_4(sc, XHCI_HCSPARAMS1);
604 	sc->sc_maxslots = XHCI_HCS1_MAXSLOTS(hcs1);
605 	sc->sc_maxintrs = XHCI_HCS1_MAXINTRS(hcs1);
606 	sc->sc_maxports = XHCI_HCS1_MAXPORTS(hcs1);
607 	hcs2 = xhci_cap_read_4(sc, XHCI_HCSPARAMS2);
608 	(void)xhci_cap_read_4(sc, XHCI_HCSPARAMS3);
609 	hcc = xhci_cap_read_4(sc, XHCI_HCCPARAMS);
610 
611 	sc->sc_ac64 = XHCI_HCC_AC64(hcc);
612 	sc->sc_ctxsz = XHCI_HCC_CSZ(hcc) ? 64 : 32;
613 	aprint_debug_dev(sc->sc_dev, "ac64 %d ctxsz %d\n", sc->sc_ac64,
614 	    sc->sc_ctxsz);
615 
616 	aprint_debug_dev(sc->sc_dev, "xECP %x\n", XHCI_HCC_XECP(hcc) * 4);
617 	ecp = XHCI_HCC_XECP(hcc) * 4;
618 	while (ecp != 0) {
619 		ecr = xhci_read_4(sc, ecp);
620 		aprint_debug_dev(sc->sc_dev, "ECR %x: %08x\n", ecp, ecr);
621 		switch (XHCI_XECP_ID(ecr)) {
622 		case XHCI_ID_PROTOCOLS: {
623 			uint32_t w0, w4, w8;
624 			uint16_t w2;
625 			w0 = xhci_read_4(sc, ecp + 0);
626 			w2 = (w0 >> 16) & 0xffff;
627 			w4 = xhci_read_4(sc, ecp + 4);
628 			w8 = xhci_read_4(sc, ecp + 8);
629 			aprint_debug_dev(sc->sc_dev, "SP: %08x %08x %08x\n",
630 			    w0, w4, w8);
631 			if (w4 == 0x20425355 && w2 == 0x0300) {
632 				sc->sc_ss_port_start = (w8 >> 0) & 0xff;;
633 				sc->sc_ss_port_count = (w8 >> 8) & 0xff;;
634 			}
635 			if (w4 == 0x20425355 && w2 == 0x0200) {
636 				sc->sc_hs_port_start = (w8 >> 0) & 0xff;
637 				sc->sc_hs_port_count = (w8 >> 8) & 0xff;
638 			}
639 			break;
640 		}
641 		default:
642 			break;
643 		}
644 		ecr = xhci_read_4(sc, ecp);
645 		if (XHCI_XECP_NEXT(ecr) == 0) {
646 			ecp = 0;
647 		} else {
648 			ecp += XHCI_XECP_NEXT(ecr) * 4;
649 		}
650 	}
651 
652 	bsz = XHCI_PORTSC(sc->sc_maxports + 1);
653 	if (bus_space_subregion(sc->sc_iot, sc->sc_ioh, caplength, bsz,
654 	    &sc->sc_obh) != 0) {
655 		aprint_error_dev(sc->sc_dev, "operational subregion failure\n");
656 		return USBD_NOMEM;
657 	}
658 
659 	dboff = xhci_cap_read_4(sc, XHCI_DBOFF);
660 	if (bus_space_subregion(sc->sc_iot, sc->sc_ioh, dboff,
661 	    sc->sc_maxslots * 4, &sc->sc_dbh) != 0) {
662 		aprint_error_dev(sc->sc_dev, "doorbell subregion failure\n");
663 		return USBD_NOMEM;
664 	}
665 
666 	rtsoff = xhci_cap_read_4(sc, XHCI_RTSOFF);
667 	if (bus_space_subregion(sc->sc_iot, sc->sc_ioh, rtsoff,
668 	    sc->sc_maxintrs * 0x20, &sc->sc_rbh) != 0) {
669 		aprint_error_dev(sc->sc_dev, "runtime subregion failure\n");
670 		return USBD_NOMEM;
671 	}
672 
673 	for (i = 0; i < 100; i++) {
674 		usbsts = xhci_op_read_4(sc, XHCI_USBSTS);
675 		if ((usbsts & XHCI_STS_CNR) == 0)
676 			break;
677 		usb_delay_ms(&sc->sc_bus, 1);
678 	}
679 	if (i >= 100)
680 		return USBD_IOERROR;
681 
682 	usbcmd = 0;
683 	xhci_op_write_4(sc, XHCI_USBCMD, usbcmd);
684 	usb_delay_ms(&sc->sc_bus, 1);
685 
686 	usbcmd = XHCI_CMD_HCRST;
687 	xhci_op_write_4(sc, XHCI_USBCMD, usbcmd);
688 	for (i = 0; i < 100; i++) {
689 		usbcmd = xhci_op_read_4(sc, XHCI_USBCMD);
690 		if ((usbcmd & XHCI_CMD_HCRST) == 0)
691 			break;
692 		usb_delay_ms(&sc->sc_bus, 1);
693 	}
694 	if (i >= 100)
695 		return USBD_IOERROR;
696 
697 	for (i = 0; i < 100; i++) {
698 		usbsts = xhci_op_read_4(sc, XHCI_USBSTS);
699 		if ((usbsts & XHCI_STS_CNR) == 0)
700 			break;
701 		usb_delay_ms(&sc->sc_bus, 1);
702 	}
703 	if (i >= 100)
704 		return USBD_IOERROR;
705 
706 	pagesize = xhci_op_read_4(sc, XHCI_PAGESIZE);
707 	aprint_debug_dev(sc->sc_dev, "PAGESIZE 0x%08x\n", pagesize);
708 	pagesize = ffs(pagesize);
709 	if (pagesize == 0)
710 		return USBD_IOERROR;
711 	sc->sc_pgsz = 1 << (12 + (pagesize - 1));
712 	aprint_debug_dev(sc->sc_dev, "sc_pgsz 0x%08x\n", (uint32_t)sc->sc_pgsz);
713 	aprint_debug_dev(sc->sc_dev, "sc_maxslots 0x%08x\n",
714 	    (uint32_t)sc->sc_maxslots);
715 
716 	usbd_status err;
717 
718 	sc->sc_maxspbuf = XHCI_HCS2_MAXSPBUF(hcs2);
719 	aprint_debug_dev(sc->sc_dev, "sc_maxspbuf %d\n", sc->sc_maxspbuf);
720 	if (sc->sc_maxspbuf != 0) {
721 		err = usb_allocmem(&sc->sc_bus,
722 		    sizeof(uint64_t) * sc->sc_maxspbuf, sizeof(uint64_t),
723 		    &sc->sc_spbufarray_dma);
724 		if (err)
725 			return err;
726 
727 		sc->sc_spbuf_dma = kmem_zalloc(sizeof(*sc->sc_spbuf_dma) * sc->sc_maxspbuf, KM_SLEEP);
728 		uint64_t *spbufarray = KERNADDR(&sc->sc_spbufarray_dma, 0);
729 		for (i = 0; i < sc->sc_maxspbuf; i++) {
730 			usb_dma_t * const dma = &sc->sc_spbuf_dma[i];
731 			/* allocate contexts */
732 			err = usb_allocmem(&sc->sc_bus, sc->sc_pgsz,
733 			    sc->sc_pgsz, dma);
734 			if (err)
735 				return err;
736 			spbufarray[i] = htole64(DMAADDR(dma, 0));
737 			usb_syncmem(dma, 0, sc->sc_pgsz,
738 			    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
739 		}
740 
741 		usb_syncmem(&sc->sc_spbufarray_dma, 0,
742 		    sizeof(uint64_t) * sc->sc_maxspbuf, BUS_DMASYNC_PREWRITE);
743 	}
744 
745 	config = xhci_op_read_4(sc, XHCI_CONFIG);
746 	config &= ~0xFF;
747 	config |= sc->sc_maxslots & 0xFF;
748 	xhci_op_write_4(sc, XHCI_CONFIG, config);
749 
750 	err = xhci_ring_init(sc, &sc->sc_cr, XHCI_COMMAND_RING_TRBS,
751 	    XHCI_COMMAND_RING_SEGMENTS_ALIGN);
752 	if (err) {
753 		aprint_error_dev(sc->sc_dev, "command ring init fail\n");
754 		return err;
755 	}
756 
757 	err = xhci_ring_init(sc, &sc->sc_er, XHCI_EVENT_RING_TRBS,
758 	    XHCI_EVENT_RING_SEGMENTS_ALIGN);
759 	if (err) {
760 		aprint_error_dev(sc->sc_dev, "event ring init fail\n");
761 		return err;
762 	}
763 
764 	{
765 		usb_dma_t *dma;
766 		size_t size;
767 		size_t align;
768 
769 		dma = &sc->sc_eventst_dma;
770 		size = roundup2(XHCI_EVENT_RING_SEGMENTS * XHCI_ERSTE_SIZE,
771 		    XHCI_EVENT_RING_SEGMENT_TABLE_ALIGN);
772 		KASSERT(size <= (512 * 1024));
773 		align = XHCI_EVENT_RING_SEGMENT_TABLE_ALIGN;
774 		err = usb_allocmem(&sc->sc_bus, size, align, dma);
775 		memset(KERNADDR(dma, 0), 0, size);
776 		usb_syncmem(dma, 0, size, BUS_DMASYNC_PREWRITE);
777 		aprint_debug_dev(sc->sc_dev, "eventst: %s %016jx %p %zx\n",
778 		    usbd_errstr(err),
779 		    (uintmax_t)DMAADDR(&sc->sc_eventst_dma, 0),
780 		    KERNADDR(&sc->sc_eventst_dma, 0),
781 		    sc->sc_eventst_dma.block->size);
782 
783 		dma = &sc->sc_dcbaa_dma;
784 		size = (1 + sc->sc_maxslots) * sizeof(uint64_t);
785 		KASSERT(size <= 2048);
786 		align = XHCI_DEVICE_CONTEXT_BASE_ADDRESS_ARRAY_ALIGN;
787 		err = usb_allocmem(&sc->sc_bus, size, align, dma);
788 		memset(KERNADDR(dma, 0), 0, size);
789 		if (sc->sc_maxspbuf != 0) {
790 			/*
791 			 * DCBA entry 0 hold the scratchbuf array pointer.
792 			 */
793 			*(uint64_t *)KERNADDR(dma, 0) =
794 			    htole64(DMAADDR(&sc->sc_spbufarray_dma, 0));
795 		}
796 		usb_syncmem(dma, 0, size, BUS_DMASYNC_PREWRITE);
797 		aprint_debug_dev(sc->sc_dev, "dcbaa: %s %016jx %p %zx\n",
798 		    usbd_errstr(err),
799 		    (uintmax_t)DMAADDR(&sc->sc_dcbaa_dma, 0),
800 		    KERNADDR(&sc->sc_dcbaa_dma, 0),
801 		    sc->sc_dcbaa_dma.block->size);
802 	}
803 
804 	sc->sc_slots = kmem_zalloc(sizeof(*sc->sc_slots) * sc->sc_maxslots,
805 	    KM_SLEEP);
806 
807 	cv_init(&sc->sc_command_cv, "xhcicmd");
808 
809 	struct xhci_erste *erst;
810 	erst = KERNADDR(&sc->sc_eventst_dma, 0);
811 	erst[0].erste_0 = htole64(xhci_ring_trbp(&sc->sc_er, 0));
812 	erst[0].erste_2 = htole32(XHCI_EVENT_RING_TRBS);
813 	erst[0].erste_3 = htole32(0);
814 	usb_syncmem(&sc->sc_eventst_dma, 0,
815 	    XHCI_ERSTE_SIZE * XHCI_EVENT_RING_SEGMENTS, BUS_DMASYNC_PREWRITE);
816 
817 	xhci_rt_write_4(sc, XHCI_ERSTSZ(0), XHCI_EVENT_RING_SEGMENTS);
818 	xhci_rt_write_8(sc, XHCI_ERSTBA(0), DMAADDR(&sc->sc_eventst_dma, 0));
819 	xhci_rt_write_8(sc, XHCI_ERDP(0), xhci_ring_trbp(&sc->sc_er, 0) |
820 	    XHCI_ERDP_LO_BUSY);
821 	xhci_op_write_8(sc, XHCI_DCBAAP, DMAADDR(&sc->sc_dcbaa_dma, 0));
822 	xhci_op_write_8(sc, XHCI_CRCR, xhci_ring_trbp(&sc->sc_cr, 0) |
823 	    sc->sc_cr.xr_cs);
824 
825 #if 0
826 	hexdump("eventst", KERNADDR(&sc->sc_eventst_dma, 0),
827 	    XHCI_ERSTE_SIZE * XHCI_EVENT_RING_SEGMENTS);
828 #endif
829 
830 	xhci_rt_write_4(sc, XHCI_IMAN(0), XHCI_IMAN_INTR_ENA);
831 	xhci_rt_write_4(sc, XHCI_IMOD(0), 0);
832 
833 	xhci_op_write_4(sc, XHCI_USBCMD, XHCI_CMD_INTE|XHCI_CMD_RS); /* Go! */
834 	aprint_debug_dev(sc->sc_dev, "USBCMD %08"PRIx32"\n",
835 	    xhci_op_read_4(sc, XHCI_USBCMD));
836 
837 	mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_SOFTUSB);
838 	mutex_init(&sc->sc_intr_lock, MUTEX_DEFAULT, IPL_SCHED);
839 	cv_init(&sc->sc_softwake_cv, "xhciab");
840 
841 	sc->sc_xferpool = pool_cache_init(sizeof(struct xhci_xfer), 0, 0, 0,
842 	    "xhcixfer", NULL, IPL_USB, NULL, NULL, NULL);
843 
844 	/* Set up the bus struct. */
845 	sc->sc_bus.methods = &xhci_bus_methods;
846 	sc->sc_bus.pipe_size = sizeof(struct xhci_pipe);
847 
848 	return USBD_NORMAL_COMPLETION;
849 }
850 
851 int
852 xhci_intr(void *v)
853 {
854 	struct xhci_softc * const sc = v;
855 
856 	if (sc == NULL || sc->sc_dying || !device_has_power(sc->sc_dev))
857 		return 0;
858 
859 	DPRINTF(("%s: %s\n", __func__, device_xname(sc->sc_dev)));
860 
861 	/* If we get an interrupt while polling, then just ignore it. */
862 	if (sc->sc_bus.use_polling) {
863 #ifdef DIAGNOSTIC
864 		DPRINTFN(16, ("xhci_intr: ignored interrupt while polling\n"));
865 #endif
866 		return 0;
867 	}
868 
869 	return xhci_intr1(sc);
870 }
871 
872 int
873 xhci_intr1(struct xhci_softc * const sc)
874 {
875 	uint32_t usbsts;
876 	uint32_t iman;
877 
878 	usbsts = xhci_op_read_4(sc, XHCI_USBSTS);
879 	//device_printf(sc->sc_dev, "%s USBSTS %08x\n", __func__, usbsts);
880 #if 0
881 	if ((usbsts & (XHCI_STS_EINT|XHCI_STS_PCD)) == 0) {
882 		return 0;
883 	}
884 #endif
885 	xhci_op_write_4(sc, XHCI_USBSTS,
886 	    usbsts & (2|XHCI_STS_EINT|XHCI_STS_PCD)); /* XXX */
887 	usbsts = xhci_op_read_4(sc, XHCI_USBSTS);
888 	//device_printf(sc->sc_dev, "%s USBSTS %08x\n", __func__, usbsts);
889 
890 	iman = xhci_rt_read_4(sc, XHCI_IMAN(0));
891 	//device_printf(sc->sc_dev, "%s IMAN0 %08x\n", __func__, iman);
892 	if ((iman & XHCI_IMAN_INTR_PEND) == 0) {
893 		return 0;
894 	}
895 	xhci_rt_write_4(sc, XHCI_IMAN(0), iman);
896 	iman = xhci_rt_read_4(sc, XHCI_IMAN(0));
897 	//device_printf(sc->sc_dev, "%s IMAN0 %08x\n", __func__, iman);
898 	usbsts = xhci_op_read_4(sc, XHCI_USBSTS);
899 	//device_printf(sc->sc_dev, "%s USBSTS %08x\n", __func__, usbsts);
900 
901 	sc->sc_bus.no_intrs++;
902 	usb_schedsoftintr(&sc->sc_bus);
903 
904 	return 1;
905 }
906 
907 static usbd_status
908 xhci_configure_endpoint(usbd_pipe_handle pipe)
909 {
910 	struct xhci_softc * const sc = pipe->device->bus->hci_private;
911 	struct xhci_slot * const xs = pipe->device->hci_private;
912 	const u_int dci = xhci_ep_get_dci(pipe->endpoint->edesc);
913 	usb_endpoint_descriptor_t * const ed = pipe->endpoint->edesc;
914 	const uint8_t xfertype = UE_GET_XFERTYPE(ed->bmAttributes);
915 	struct xhci_trb trb;
916 	usbd_status err;
917 	uint32_t *cp;
918 
919 	device_printf(sc->sc_dev, "%s dci %u (0x%x)\n", __func__, dci,
920 	    pipe->endpoint->edesc->bEndpointAddress);
921 
922 	/* XXX ensure input context is available? */
923 
924 	memset(xhci_slot_get_icv(sc, xs, 0), 0, sc->sc_pgsz);
925 
926 	cp = xhci_slot_get_icv(sc, xs, XHCI_ICI_INPUT_CONTROL);
927 	cp[0] = htole32(0);
928 	cp[1] = htole32(XHCI_INCTX_1_ADD_MASK(dci));
929 
930 	/* set up input slot context */
931 	cp = xhci_slot_get_icv(sc, xs, xhci_dci_to_ici(XHCI_DCI_SLOT));
932 	cp[0] = htole32(XHCI_SCTX_0_CTX_NUM_SET(dci));
933 	cp[1] = htole32(0);
934 	cp[2] = htole32(0);
935 	cp[3] = htole32(0);
936 
937 	cp = xhci_slot_get_icv(sc, xs, xhci_dci_to_ici(dci));
938 	if (xfertype == UE_INTERRUPT) {
939 	cp[0] = htole32(
940 	    XHCI_EPCTX_0_IVAL_SET(3) /* XXX */
941 	    );
942 	cp[1] = htole32(
943 	    XHCI_EPCTX_1_CERR_SET(3) |
944 	    XHCI_EPCTX_1_EPTYPE_SET(xhci_ep_get_type(pipe->endpoint->edesc)) |
945 	    XHCI_EPCTX_1_MAXB_SET(0) |
946 	    XHCI_EPCTX_1_MAXP_SIZE_SET(8) /* XXX */
947 	    );
948 	cp[4] = htole32(
949 		XHCI_EPCTX_4_AVG_TRB_LEN_SET(8)
950 		);
951 	} else {
952 	cp[0] = htole32(0);
953 	cp[1] = htole32(
954 	    XHCI_EPCTX_1_CERR_SET(3) |
955 	    XHCI_EPCTX_1_EPTYPE_SET(xhci_ep_get_type(pipe->endpoint->edesc)) |
956 	    XHCI_EPCTX_1_MAXB_SET(0) |
957 	    XHCI_EPCTX_1_MAXP_SIZE_SET(512) /* XXX */
958 	    );
959 	}
960 	*(uint64_t *)(&cp[2]) = htole64(
961 	    xhci_ring_trbp(&xs->xs_ep[dci].xe_tr, 0) |
962 	    XHCI_EPCTX_2_DCS_SET(1));
963 
964 	/* sync input contexts before they are read from memory */
965 	usb_syncmem(&xs->xs_ic_dma, 0, sc->sc_pgsz, BUS_DMASYNC_PREWRITE);
966 	hexdump("input control context", xhci_slot_get_icv(sc, xs, 0),
967 	    sc->sc_ctxsz * 1);
968 	hexdump("input endpoint context", xhci_slot_get_icv(sc, xs,
969 	    xhci_dci_to_ici(dci)), sc->sc_ctxsz * 1);
970 
971 	trb.trb_0 = xhci_slot_get_icp(sc, xs, 0);
972 	trb.trb_2 = 0;
973 	trb.trb_3 = XHCI_TRB_3_SLOT_SET(xs->xs_idx) |
974 	    XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_CONFIGURE_EP);
975 
976 	err = xhci_do_command(sc, &trb, USBD_DEFAULT_TIMEOUT);
977 
978 	usb_syncmem(&xs->xs_dc_dma, 0, sc->sc_pgsz, BUS_DMASYNC_POSTREAD);
979 	hexdump("output context", xhci_slot_get_dcv(sc, xs, dci),
980 	    sc->sc_ctxsz * 1);
981 
982 	return err;
983 }
984 
985 static usbd_status
986 xhci_unconfigure_endpoint(usbd_pipe_handle pipe)
987 {
988 	return USBD_NORMAL_COMPLETION;
989 }
990 
991 static usbd_status
992 xhci_reset_endpoint(usbd_pipe_handle pipe)
993 {
994 	struct xhci_softc * const sc = pipe->device->bus->hci_private;
995 	struct xhci_slot * const xs = pipe->device->hci_private;
996 	const u_int dci = xhci_ep_get_dci(pipe->endpoint->edesc);
997 	struct xhci_trb trb;
998 	usbd_status err;
999 
1000 	device_printf(sc->sc_dev, "%s\n", __func__);
1001 
1002 	trb.trb_0 = 0;
1003 	trb.trb_2 = 0;
1004 	trb.trb_3 = XHCI_TRB_3_SLOT_SET(xs->xs_idx) |
1005 	    XHCI_TRB_3_EP_SET(dci) |
1006 	    XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_RESET_EP);
1007 
1008 	err = xhci_do_command(sc, &trb, USBD_DEFAULT_TIMEOUT);
1009 
1010 	return err;
1011 }
1012 
1013 #if 0
1014 static usbd_status
1015 xhci_stop_endpoint(usbd_pipe_handle pipe)
1016 {
1017 	struct xhci_softc * const sc = pipe->device->bus->hci_private;
1018 	struct xhci_slot * const xs = pipe->device->hci_private;
1019 	struct xhci_trb trb;
1020 	usbd_status err;
1021 	const u_int dci = xhci_ep_get_dci(pipe->endpoint->edesc);
1022 
1023 	device_printf(sc->sc_dev, "%s\n", __func__);
1024 
1025 	trb.trb_0 = 0;
1026 	trb.trb_2 = 0;
1027 	trb.trb_3 = XHCI_TRB_3_SLOT_SET(xs->xs_idx) |
1028 	    XHCI_TRB_3_EP_SET(dci) |
1029 	    XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_STOP_EP);
1030 
1031 	err = xhci_do_command(sc, &trb, USBD_DEFAULT_TIMEOUT);
1032 
1033 	return err;
1034 }
1035 #endif
1036 
1037 static usbd_status
1038 xhci_set_dequeue(usbd_pipe_handle pipe)
1039 {
1040 	struct xhci_softc * const sc = pipe->device->bus->hci_private;
1041 	struct xhci_slot * const xs = pipe->device->hci_private;
1042 	const u_int dci = xhci_ep_get_dci(pipe->endpoint->edesc);
1043 	struct xhci_ring * const xr = &xs->xs_ep[dci].xe_tr;
1044 	struct xhci_trb trb;
1045 	usbd_status err;
1046 
1047 	device_printf(sc->sc_dev, "%s\n", __func__);
1048 
1049 	memset(xr->xr_trb, 0, xr->xr_ntrb * XHCI_TRB_SIZE);
1050 	usb_syncmem(&xr->xr_dma, 0, xr->xr_ntrb * XHCI_TRB_SIZE,
1051 	    BUS_DMASYNC_PREWRITE);
1052 
1053 	xr->xr_ep = 0;
1054 	xr->xr_cs = 1;
1055 
1056 	trb.trb_0 = xhci_ring_trbp(xr, 0) | 1; /* XXX */
1057 	trb.trb_2 = 0;
1058 	trb.trb_3 = XHCI_TRB_3_SLOT_SET(xs->xs_idx) |
1059 	    XHCI_TRB_3_EP_SET(dci) |
1060 	    XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_SET_TR_DEQUEUE);
1061 
1062 	err = xhci_do_command(sc, &trb, USBD_DEFAULT_TIMEOUT);
1063 
1064 	return err;
1065 }
1066 
1067 static usbd_status
1068 xhci_open(usbd_pipe_handle pipe)
1069 {
1070 	usbd_device_handle const dev = pipe->device;
1071 	struct xhci_softc * const sc = dev->bus->hci_private;
1072 	usb_endpoint_descriptor_t * const ed = pipe->endpoint->edesc;
1073 	const int8_t addr = dev->address;
1074 	const uint8_t xfertype = UE_GET_XFERTYPE(ed->bmAttributes);
1075 
1076 	DPRINTF(("%s\n", __func__));
1077 	DPRINTF(("addr %d\n", addr));
1078 	device_printf(sc->sc_dev, "%s addr %d depth %d port %d speed %d\n",
1079 	    __func__, addr, dev->depth, dev->powersrc->portno, dev->speed);
1080 
1081 	if (sc->sc_dying)
1082 		return USBD_IOERROR;
1083 
1084 	/* Root Hub */
1085 	if (dev->depth == 0 && dev->powersrc->portno == 0 &&
1086 	    dev->speed != USB_SPEED_SUPER) {
1087 		switch (ed->bEndpointAddress) {
1088 		case USB_CONTROL_ENDPOINT:
1089 			pipe->methods = &xhci_root_ctrl_methods;
1090 			break;
1091 		case UE_DIR_IN | XHCI_INTR_ENDPT:
1092 			pipe->methods = &xhci_root_intr_methods;
1093 			break;
1094 		default:
1095 			pipe->methods = NULL;
1096 			DPRINTF(("xhci_open: bad bEndpointAddress 0x%02x\n",
1097 			    ed->bEndpointAddress));
1098 			return USBD_INVAL;
1099 		}
1100 		return USBD_NORMAL_COMPLETION;
1101 	}
1102 
1103 	switch (xfertype) {
1104 	case UE_CONTROL:
1105 		pipe->methods = &xhci_device_ctrl_methods;
1106 		break;
1107 	case UE_ISOCHRONOUS:
1108 		pipe->methods = &xhci_device_isoc_methods;
1109 		return USBD_INVAL;
1110 		break;
1111 	case UE_BULK:
1112 		pipe->methods = &xhci_device_bulk_methods;
1113 		break;
1114 	case UE_INTERRUPT:
1115 		pipe->methods = &xhci_device_intr_methods;
1116 		break;
1117 	default:
1118 		return USBD_IOERROR;
1119 		break;
1120 	}
1121 
1122 	if (ed->bEndpointAddress != USB_CONTROL_ENDPOINT)
1123 		xhci_configure_endpoint(pipe);
1124 
1125 	return USBD_NORMAL_COMPLETION;
1126 }
1127 
1128 static void
1129 xhci_rhpsc(struct xhci_softc * const sc, u_int port)
1130 {
1131 	usbd_xfer_handle const xfer = sc->sc_intrxfer;
1132 	uint8_t *p;
1133 
1134 	device_printf(sc->sc_dev, "port %u status change\n", port);
1135 
1136 	if (xfer == NULL)
1137 		return;
1138 
1139 	if (!(port >= sc->sc_hs_port_start &&
1140 	    port < sc->sc_hs_port_start + sc->sc_hs_port_count))
1141 		return;
1142 
1143 	port -= sc->sc_hs_port_start;
1144 	port += 1;
1145 	device_printf(sc->sc_dev, "hs port %u status change\n", port);
1146 
1147 	p = KERNADDR(&xfer->dmabuf, 0);
1148 	memset(p, 0, xfer->length);
1149 	p[port/NBBY] |= 1 << (port%NBBY);
1150 	xfer->actlen = xfer->length;
1151 	xfer->status = USBD_NORMAL_COMPLETION;
1152 	usb_transfer_complete(xfer);
1153 }
1154 
1155 static void
1156 xhci_handle_event(struct xhci_softc * const sc, const struct xhci_trb * const trb)
1157 {
1158 	uint64_t trb_0;
1159 	uint32_t trb_2, trb_3;
1160 
1161 	DPRINTF(("%s: %s\n", __func__, device_xname(sc->sc_dev)));
1162 
1163 	trb_0 = le64toh(trb->trb_0);
1164 	trb_2 = le32toh(trb->trb_2);
1165 	trb_3 = le32toh(trb->trb_3);
1166 
1167 #if 0
1168 	device_printf(sc->sc_dev,
1169 	    "event: %p 0x%016"PRIx64" 0x%08"PRIx32" 0x%08"PRIx32"\n", trb,
1170 	    trb_0, trb_2, trb_3);
1171 #endif
1172 
1173 	switch (XHCI_TRB_3_TYPE_GET(trb_3)){
1174 	case XHCI_TRB_EVENT_TRANSFER: {
1175 		u_int slot, dci;
1176 		struct xhci_slot *xs;
1177 		struct xhci_ring *xr;
1178 		struct xhci_xfer *xx;
1179 		usbd_xfer_handle xfer;
1180 		usbd_status err;
1181 
1182 		slot = XHCI_TRB_3_SLOT_GET(trb_3);
1183 		dci = XHCI_TRB_3_EP_GET(trb_3);
1184 
1185 		xs = &sc->sc_slots[slot];
1186 		xr = &xs->xs_ep[dci].xe_tr;
1187 
1188 		if ((trb_3 & XHCI_TRB_3_ED_BIT) == 0) {
1189 			xx = xr->xr_cookies[(trb_0 - xhci_ring_trbp(xr, 0))/
1190 			    sizeof(struct xhci_trb)];
1191 		} else {
1192 			xx = (void *)(uintptr_t)(trb_0 & ~0x3);
1193 		}
1194 		xfer = &xx->xx_xfer;
1195 #if 0
1196 		device_printf(sc->sc_dev, "%s xfer %p\n", __func__, xfer);
1197 #endif
1198 
1199 		if ((trb_3 & XHCI_TRB_3_ED_BIT) != 0) {
1200 #if 0
1201 			device_printf(sc->sc_dev, "transfer event data: "
1202 			    "0x%016"PRIx64" 0x%08"PRIx32" %02x\n",
1203 			    trb_0, XHCI_TRB_2_REM_GET(trb_2),
1204 			    XHCI_TRB_2_ERROR_GET(trb_2));
1205 #endif
1206 			if ((trb_0 & 0x3) == 0x3) {
1207 				xfer->actlen = XHCI_TRB_2_REM_GET(trb_2);
1208 			}
1209 		}
1210 
1211 		if (XHCI_TRB_2_ERROR_GET(trb_2) ==
1212 		    XHCI_TRB_ERROR_SUCCESS) {
1213 			xfer->actlen = xfer->length - XHCI_TRB_2_REM_GET(trb_2);
1214 			err = USBD_NORMAL_COMPLETION;
1215 		} else if (XHCI_TRB_2_ERROR_GET(trb_2) ==
1216 		    XHCI_TRB_ERROR_SHORT_PKT) {
1217 			xfer->actlen = xfer->length - XHCI_TRB_2_REM_GET(trb_2);
1218 			err = USBD_NORMAL_COMPLETION;
1219 		} else if (XHCI_TRB_2_ERROR_GET(trb_2) ==
1220 		    XHCI_TRB_ERROR_STALL) {
1221 			err = USBD_STALLED;
1222 			xr->is_halted = true;
1223 		} else {
1224 			err = USBD_IOERROR;
1225 		}
1226 		xfer->status = err;
1227 
1228 		//mutex_enter(&sc->sc_lock); /* XXX ??? */
1229 		if ((trb_3 & XHCI_TRB_3_ED_BIT) != 0) {
1230 			if ((trb_0 & 0x3) == 0x0) {
1231 				usb_transfer_complete(xfer);
1232 			}
1233 		} else {
1234 			usb_transfer_complete(xfer);
1235 		}
1236 		//mutex_exit(&sc->sc_lock); /* XXX ??? */
1237 
1238 		}
1239 		break;
1240 	case XHCI_TRB_EVENT_CMD_COMPLETE:
1241 		if (trb_0 == sc->sc_command_addr) {
1242 			sc->sc_result_trb.trb_0 = trb_0;
1243 			sc->sc_result_trb.trb_2 = trb_2;
1244 			sc->sc_result_trb.trb_3 = trb_3;
1245 			if (XHCI_TRB_2_ERROR_GET(trb_2) !=
1246 			    XHCI_TRB_ERROR_SUCCESS) {
1247 				device_printf(sc->sc_dev, "command completion "
1248 				    "failure: 0x%016"PRIx64" 0x%08"PRIx32" "
1249 				    "0x%08"PRIx32"\n", trb_0, trb_2, trb_3);
1250 			}
1251 			cv_signal(&sc->sc_command_cv);
1252 		} else {
1253 			device_printf(sc->sc_dev, "event: %p 0x%016"PRIx64" "
1254 			    "0x%08"PRIx32" 0x%08"PRIx32"\n", trb, trb_0,
1255 			    trb_2, trb_3);
1256 		}
1257 		break;
1258 	case XHCI_TRB_EVENT_PORT_STS_CHANGE:
1259 		xhci_rhpsc(sc, (uint32_t)((trb_0 >> 24) & 0xff));
1260 		break;
1261 	default:
1262 		break;
1263 	}
1264 }
1265 
1266 static void
1267 xhci_softintr(void *v)
1268 {
1269 	struct usbd_bus * const bus = v;
1270 	struct xhci_softc * const sc = bus->hci_private;
1271 	struct xhci_ring * const er = &sc->sc_er;
1272 	struct xhci_trb *trb;
1273 	int i, j, k;
1274 
1275 	DPRINTF(("%s: %s\n", __func__, device_xname(sc->sc_dev)));
1276 
1277 	i = er->xr_ep;
1278 	j = er->xr_cs;
1279 
1280 	while (1) {
1281 		usb_syncmem(&er->xr_dma, XHCI_TRB_SIZE * i, XHCI_TRB_SIZE,
1282 		    BUS_DMASYNC_POSTREAD);
1283 		trb = &er->xr_trb[i];
1284 		k = (le32toh(trb->trb_3) & XHCI_TRB_3_CYCLE_BIT) ? 1 : 0;
1285 
1286 		if (j != k)
1287 			break;
1288 
1289 		xhci_handle_event(sc, trb);
1290 
1291 		i++;
1292 		if (i == XHCI_EVENT_RING_TRBS) {
1293 			i = 0;
1294 			j ^= 1;
1295 		}
1296 	}
1297 
1298 	er->xr_ep = i;
1299 	er->xr_cs = j;
1300 
1301 	xhci_rt_write_8(sc, XHCI_ERDP(0), xhci_ring_trbp(er, er->xr_ep) |
1302 	    XHCI_ERDP_LO_BUSY);
1303 
1304 	DPRINTF(("%s: %s ends\n", __func__, device_xname(sc->sc_dev)));
1305 
1306 	return;
1307 }
1308 
1309 static void
1310 xhci_poll(struct usbd_bus *bus)
1311 {
1312 	struct xhci_softc * const sc = bus->hci_private;
1313 
1314 	DPRINTF(("%s: %s\n", __func__, device_xname(sc->sc_dev)));
1315 
1316 	xhci_intr1(sc);
1317 
1318 	return;
1319 }
1320 
1321 static usbd_status
1322 xhci_allocm(struct usbd_bus *bus, usb_dma_t *dma, uint32_t size)
1323 {
1324 	struct xhci_softc * const sc = bus->hci_private;
1325 	usbd_status err;
1326 
1327 	DPRINTF(("%s\n", __func__));
1328 
1329 	err = usb_allocmem_flags(&sc->sc_bus, size, 0, dma, 0);
1330 #if 0
1331 	if (err == USBD_NOMEM)
1332 		err = usb_reserve_allocm(&sc->sc_dma_reserve, dma, size);
1333 #endif
1334 #ifdef XHCI_DEBUG
1335 	if (err)
1336 		device_printf(sc->sc_dev, "xhci_allocm: usb_allocmem()=%d\n",
1337 		    err);
1338 #endif
1339 
1340 	return err;
1341 }
1342 
1343 static void
1344 xhci_freem(struct usbd_bus *bus, usb_dma_t *dma)
1345 {
1346 	struct xhci_softc * const sc = bus->hci_private;
1347 
1348 //	DPRINTF(("%s\n", __func__));
1349 
1350 #if 0
1351 	if (dma->block->flags & USB_DMA_RESERVE) {
1352 		usb_reserve_freem(&sc->sc_dma_reserve, dma);
1353 		return;
1354 	}
1355 #endif
1356 	usb_freemem(&sc->sc_bus, dma);
1357 }
1358 
1359 static usbd_xfer_handle
1360 xhci_allocx(struct usbd_bus *bus)
1361 {
1362 	struct xhci_softc * const sc = bus->hci_private;
1363 	usbd_xfer_handle xfer;
1364 
1365 //	DPRINTF(("%s\n", __func__));
1366 
1367 	xfer = pool_cache_get(sc->sc_xferpool, PR_NOWAIT);
1368 	if (xfer != NULL) {
1369 		memset(xfer, 0, sizeof(struct xhci_xfer));
1370 #ifdef DIAGNOSTIC
1371 		xfer->busy_free = XFER_BUSY;
1372 #endif
1373 	}
1374 
1375 	return xfer;
1376 }
1377 
1378 static void
1379 xhci_freex(struct usbd_bus *bus, usbd_xfer_handle xfer)
1380 {
1381 	struct xhci_softc * const sc = bus->hci_private;
1382 
1383 //	DPRINTF(("%s\n", __func__));
1384 
1385 #ifdef DIAGNOSTIC
1386 	if (xfer->busy_free != XFER_BUSY) {
1387 		device_printf(sc->sc_dev, "xhci_freex: xfer=%p "
1388 		    "not busy, 0x%08x\n", xfer, xfer->busy_free);
1389 	}
1390 	xfer->busy_free = XFER_FREE;
1391 #endif
1392 	pool_cache_put(sc->sc_xferpool, xfer);
1393 }
1394 
1395 static void
1396 xhci_get_lock(struct usbd_bus *bus, kmutex_t **lock)
1397 {
1398 	struct xhci_softc * const sc = bus->hci_private;
1399 
1400 	*lock = &sc->sc_lock;
1401 }
1402 
1403 extern u_int32_t usb_cookie_no;
1404 
1405 static usbd_status
1406 xhci_new_device(device_t parent, usbd_bus_handle bus, int depth,
1407     int speed, int port, struct usbd_port *up)
1408 {
1409 	struct xhci_softc * const sc = bus->hci_private;
1410 	usbd_device_handle dev;
1411 	usbd_status err;
1412 	usb_device_descriptor_t *dd;
1413 	struct usbd_device *hub;
1414 	struct usbd_device *adev;
1415 	int rhport = 0;
1416 	struct xhci_slot *xs;
1417 	uint32_t *cp;
1418 	uint8_t slot;
1419 	uint8_t addr;
1420 
1421 	dev = malloc(sizeof *dev, M_USB, M_NOWAIT|M_ZERO);
1422 	if (dev == NULL)
1423 		return USBD_NOMEM;
1424 
1425 	dev->bus = bus;
1426 
1427 	/* Set up default endpoint handle. */
1428 	dev->def_ep.edesc = &dev->def_ep_desc;
1429 
1430 	/* Set up default endpoint descriptor. */
1431 	dev->def_ep_desc.bLength = USB_ENDPOINT_DESCRIPTOR_SIZE;
1432 	dev->def_ep_desc.bDescriptorType = UDESC_ENDPOINT;
1433 	dev->def_ep_desc.bEndpointAddress = USB_CONTROL_ENDPOINT;
1434 	dev->def_ep_desc.bmAttributes = UE_CONTROL;
1435 	/* XXX */
1436 	USETW(dev->def_ep_desc.wMaxPacketSize, 64);
1437 	dev->def_ep_desc.bInterval = 0;
1438 
1439 	/* doesn't matter, just don't let it uninitialized */
1440 	dev->def_ep.datatoggle = 0;
1441 
1442 	device_printf(sc->sc_dev, "%s up %p portno %d\n", __func__, up,
1443 	    up->portno);
1444 
1445 	dev->quirks = &usbd_no_quirk;
1446 	dev->address = 0;
1447 	dev->ddesc.bMaxPacketSize = 0;
1448 	dev->depth = depth;
1449 	dev->powersrc = up;
1450 	dev->myhub = up->parent;
1451 
1452 	up->device = dev;
1453 
1454 	/* Locate root hub port */
1455 	for (adev = dev, hub = dev;
1456 	    hub != NULL;
1457 	    adev = hub, hub = hub->myhub) {
1458 		device_printf(sc->sc_dev, "%s hub %p\n", __func__, hub);
1459 	}
1460 	device_printf(sc->sc_dev, "%s hub %p\n", __func__, hub);
1461 
1462 	if (hub != NULL) {
1463 		for (int p = 0; p < hub->hub->hubdesc.bNbrPorts; p++) {
1464 			if (hub->hub->ports[p].device == adev) {
1465 				rhport = p;
1466 			}
1467 		}
1468 	} else {
1469 		rhport = port;
1470 	}
1471 	if (speed == USB_SPEED_SUPER) {
1472 		rhport += sc->sc_ss_port_start - 1;
1473 	} else {
1474 		rhport += sc->sc_hs_port_start - 1;
1475 	}
1476 	device_printf(sc->sc_dev, "%s rhport %d\n", __func__, rhport);
1477 
1478 	dev->speed = speed;
1479 	dev->langid = USBD_NOLANG;
1480 	dev->cookie.cookie = ++usb_cookie_no;
1481 
1482 	/* Establish the default pipe. */
1483 	err = usbd_setup_pipe(dev, 0, &dev->def_ep, USBD_DEFAULT_INTERVAL,
1484 	    &dev->default_pipe);
1485 	if (err) {
1486 		usbd_remove_device(dev, up);
1487 		return (err);
1488 	}
1489 
1490 	dd = &dev->ddesc;
1491 
1492 	if ((depth == 0) && (port == 0)) {
1493 		KASSERT(bus->devices[dev->address] == NULL);
1494 		bus->devices[dev->address] = dev;
1495 		err = usbd_get_initial_ddesc(dev, dd);
1496 		if (err)
1497 			return err;
1498 		err = usbd_reload_device_desc(dev);
1499 		if (err)
1500 			return err;
1501 	} else {
1502 		err = xhci_enable_slot(sc, &slot);
1503 		if (err)
1504 			return err;
1505 		err = xhci_init_slot(sc, slot, depth, speed, port, rhport);
1506 		if (err)
1507 			return err;
1508 		xs = &sc->sc_slots[slot];
1509 		dev->hci_private = xs;
1510 		cp = xhci_slot_get_dcv(sc, xs, XHCI_DCI_SLOT);
1511 		//hexdump("slot context", cp, sc->sc_ctxsz);
1512 		addr = XHCI_SCTX_3_DEV_ADDR_GET(cp[3]);
1513 		device_printf(sc->sc_dev, "%s device address %u\n",
1514 		    __func__, addr);
1515 		/* XXX ensure we know when the hardware does something
1516 		   we can't yet cope with */
1517 		KASSERT(addr >= 1 && addr <= 127);
1518 		dev->address = addr;
1519 		/* XXX dev->address not necessarily unique on bus */
1520 		KASSERT(bus->devices[dev->address] == NULL);
1521 		bus->devices[dev->address] = dev;
1522 
1523 		err = usbd_get_initial_ddesc(dev, dd);
1524 		if (err)
1525 			return err;
1526 		USETW(dev->def_ep_desc.wMaxPacketSize, dd->bMaxPacketSize);
1527 		device_printf(sc->sc_dev, "%s bMaxPacketSize %u\n", __func__,
1528 		    dd->bMaxPacketSize);
1529 		xhci_update_ep0_mps(sc, xs, dd->bMaxPacketSize);
1530 		err = usbd_reload_device_desc(dev);
1531 		if (err)
1532 			return err;
1533 
1534 		usbd_kill_pipe(dev->default_pipe);
1535 		err = usbd_setup_pipe(dev, 0, &dev->def_ep,
1536 		    USBD_DEFAULT_INTERVAL, &dev->default_pipe);
1537 	}
1538 
1539 	DPRINTF(("usbd_new_device: adding unit addr=%d, rev=%02x, class=%d, "
1540 		 "subclass=%d, protocol=%d, maxpacket=%d, len=%d, noconf=%d, "
1541 		 "speed=%d\n", dev->address,UGETW(dd->bcdUSB),
1542 		 dd->bDeviceClass, dd->bDeviceSubClass, dd->bDeviceProtocol,
1543 		 dd->bMaxPacketSize, dd->bLength, dd->bNumConfigurations,
1544 		 dev->speed));
1545 
1546 	usbd_add_dev_event(USB_EVENT_DEVICE_ATTACH, dev);
1547 
1548 	if ((depth == 0) && (port == 0)) {
1549 		usbd_attach_roothub(parent, dev);
1550 		device_printf(sc->sc_dev, "root_hub %p\n", bus->root_hub);
1551 		return USBD_NORMAL_COMPLETION;
1552 	}
1553 
1554 
1555 	err = usbd_probe_and_attach(parent, dev, port, dev->address);
1556 	if (err) {
1557 		usbd_remove_device(dev, up);
1558 		return (err);
1559 	}
1560 
1561 	return USBD_NORMAL_COMPLETION;
1562 }
1563 
1564 static usbd_status
1565 xhci_ring_init(struct xhci_softc * const sc, struct xhci_ring * const xr,
1566     size_t ntrb, size_t align)
1567 {
1568 	usbd_status err;
1569 	size_t size = ntrb * XHCI_TRB_SIZE;
1570 
1571 	err = usb_allocmem(&sc->sc_bus, size, align, &xr->xr_dma);
1572 	if (err)
1573 		return err;
1574 	mutex_init(&xr->xr_lock, MUTEX_DEFAULT, IPL_SOFTUSB);
1575 	xr->xr_cookies = kmem_zalloc(sizeof(*xr->xr_cookies) * ntrb, KM_SLEEP);
1576 	xr->xr_trb = xhci_ring_trbv(xr, 0);
1577 	xr->xr_ntrb = ntrb;
1578 	xr->xr_ep = 0;
1579 	xr->xr_cs = 1;
1580 	memset(xr->xr_trb, 0, size);
1581 	usb_syncmem(&xr->xr_dma, 0, size, BUS_DMASYNC_PREWRITE);
1582 	xr->is_halted = false;
1583 
1584 	return USBD_NORMAL_COMPLETION;
1585 }
1586 
1587 static void
1588 xhci_ring_free(struct xhci_softc * const sc, struct xhci_ring * const xr)
1589 {
1590 	usb_freemem(&sc->sc_bus, &xr->xr_dma);
1591 	mutex_destroy(&xr->xr_lock);
1592 	kmem_free(xr->xr_cookies, sizeof(*xr->xr_cookies) * xr->xr_ntrb);
1593 }
1594 
1595 static void
1596 xhci_ring_put(struct xhci_softc * const sc, struct xhci_ring * const xr,
1597     void *cookie, struct xhci_trb * const trbs, size_t ntrbs)
1598 {
1599 	size_t i;
1600 	u_int ri;
1601 	u_int cs;
1602 	uint64_t parameter;
1603 	uint32_t status;
1604 	uint32_t control;
1605 
1606 	for (i = 0; i < ntrbs; i++) {
1607 #if 0
1608 		device_printf(sc->sc_dev, "%s %p %p %zu "
1609 		    "%016"PRIx64" %08"PRIx32" %08"PRIx32"\n", __func__, xr,
1610 		    trbs, i, trbs[i].trb_0, trbs[i].trb_2, trbs[i].trb_3);
1611 #endif
1612 		KASSERT(XHCI_TRB_3_TYPE_GET(trbs[i].trb_3) !=
1613 		    XHCI_TRB_TYPE_LINK);
1614 	}
1615 
1616 #if 0
1617 	device_printf(sc->sc_dev, "%s %p xr_ep 0x%x xr_cs %u\n", __func__,
1618 	    xr, xr->xr_ep, xr->xr_cs);
1619 #endif
1620 
1621 	ri = xr->xr_ep;
1622 	cs = xr->xr_cs;
1623 
1624 	/*
1625 	 * Although the xhci hardware can do scatter/gather dma from
1626 	 * arbitrary sized buffers, there is a non-obvious restriction
1627 	 * that a LINK trb is only allowed at the end of a burst of
1628 	 * transfers - which might be 16kB.
1629 	 * Arbitrary aligned LINK trb definitely fail on Ivy bridge.
1630 	 * The simple solution is not to allow a LINK trb in the middle
1631 	 * of anything - as here.
1632 	 */
1633 	if (ri + ntrbs >= (xr->xr_ntrb - 1)) {
1634 		parameter = xhci_ring_trbp(xr, 0);
1635 		status = 0;
1636 		control = XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_LINK) |
1637 		    XHCI_TRB_3_TC_BIT | (cs ? XHCI_TRB_3_CYCLE_BIT : 0);
1638 		xhci_trb_put(&xr->xr_trb[ri], htole64(parameter),
1639 		    htole32(status), htole32(control));
1640 		usb_syncmem(&xr->xr_dma, XHCI_TRB_SIZE * ri, XHCI_TRB_SIZE * 1,
1641 		    BUS_DMASYNC_PREWRITE);
1642 		xr->xr_cookies[ri] = NULL;
1643 		xr->xr_ep = 0;
1644 		xr->xr_cs ^= 1;
1645 		ri = xr->xr_ep;
1646 		cs = xr->xr_cs;
1647 	}
1648 
1649 	ri++;
1650 
1651 	/* Write any subsequent TRB first */
1652 	for (i = 1; i < ntrbs; i++) {
1653 		parameter = trbs[i].trb_0;
1654 		status = trbs[i].trb_2;
1655 		control = trbs[i].trb_3;
1656 
1657 		if (cs) {
1658 			control |= XHCI_TRB_3_CYCLE_BIT;
1659 		} else {
1660 			control &= ~XHCI_TRB_3_CYCLE_BIT;
1661 		}
1662 
1663 		xhci_trb_put(&xr->xr_trb[ri], htole64(parameter),
1664 		    htole32(status), htole32(control));
1665 		usb_syncmem(&xr->xr_dma, XHCI_TRB_SIZE * ri, XHCI_TRB_SIZE * 1,
1666 		    BUS_DMASYNC_PREWRITE);
1667 		xr->xr_cookies[ri] = cookie;
1668 		ri++;
1669 	}
1670 
1671 	/* Write the first TRB last */
1672 	i = 0;
1673 	{
1674 		parameter = trbs[i].trb_0;
1675 		status = trbs[i].trb_2;
1676 		control = trbs[i].trb_3;
1677 
1678 		if (xr->xr_cs) {
1679 			control |= XHCI_TRB_3_CYCLE_BIT;
1680 		} else {
1681 			control &= ~XHCI_TRB_3_CYCLE_BIT;
1682 		}
1683 
1684 		xhci_trb_put(&xr->xr_trb[xr->xr_ep], htole64(parameter),
1685 		    htole32(status), htole32(control));
1686 		usb_syncmem(&xr->xr_dma, XHCI_TRB_SIZE * ri, XHCI_TRB_SIZE * 1,
1687 		    BUS_DMASYNC_PREWRITE);
1688 		xr->xr_cookies[xr->xr_ep] = cookie;
1689 	}
1690 
1691 	xr->xr_ep = ri;
1692 	xr->xr_cs = cs;
1693 
1694 #if 0
1695 	device_printf(sc->sc_dev, "%s %p xr_ep 0x%x xr_cs %u\n", __func__,
1696 	    xr, xr->xr_ep, xr->xr_cs);
1697 #endif
1698 }
1699 
1700 static usbd_status
1701 xhci_do_command(struct xhci_softc * const sc, struct xhci_trb * const trb,
1702     int timeout)
1703 {
1704 	struct xhci_ring * const cr = &sc->sc_cr;
1705 	usbd_status err;
1706 
1707 	device_printf(sc->sc_dev, "%s input: "
1708 	    "0x%016"PRIx64" 0x%08"PRIx32" 0x%08"PRIx32"\n", __func__,
1709 	    trb->trb_0, trb->trb_2, trb->trb_3);
1710 
1711 	mutex_enter(&sc->sc_lock);
1712 
1713 	KASSERT(sc->sc_command_addr == 0);
1714 	sc->sc_command_addr = xhci_ring_trbp(cr, cr->xr_ep);
1715 
1716 	mutex_enter(&cr->xr_lock);
1717 	xhci_ring_put(sc, cr, NULL, trb, 1);
1718 	mutex_exit(&cr->xr_lock);
1719 
1720 	xhci_db_write_4(sc, XHCI_DOORBELL(0), 0);
1721 
1722 	if (cv_timedwait(&sc->sc_command_cv, &sc->sc_lock,
1723 	    MAX(1, mstohz(timeout))) == EWOULDBLOCK) {
1724 		err = USBD_TIMEOUT;
1725 		goto timedout;
1726 	}
1727 
1728 	trb->trb_0 = sc->sc_result_trb.trb_0;
1729 	trb->trb_2 = sc->sc_result_trb.trb_2;
1730 	trb->trb_3 = sc->sc_result_trb.trb_3;
1731 
1732 	device_printf(sc->sc_dev, "%s output: "
1733 	    "0x%016"PRIx64" 0x%08"PRIx32" 0x%08"PRIx32"\n", __func__,
1734 	    trb->trb_0, trb->trb_2, trb->trb_3);
1735 
1736 	switch (XHCI_TRB_2_ERROR_GET(trb->trb_2)) {
1737 	case XHCI_TRB_ERROR_SUCCESS:
1738 		err = USBD_NORMAL_COMPLETION;
1739 		break;
1740 	default:
1741 	case 192 ... 223:
1742 		err = USBD_IOERROR;
1743 		break;
1744 	case 224 ... 255:
1745 		err = USBD_NORMAL_COMPLETION;
1746 		break;
1747 	}
1748 
1749 timedout:
1750 	sc->sc_command_addr = 0;
1751 	mutex_exit(&sc->sc_lock);
1752 	return err;
1753 }
1754 
1755 static usbd_status
1756 xhci_enable_slot(struct xhci_softc * const sc, uint8_t * const slotp)
1757 {
1758 	struct xhci_trb trb;
1759 	usbd_status err;
1760 
1761 	trb.trb_0 = 0;
1762 	trb.trb_2 = 0;
1763 	trb.trb_3 = XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_ENABLE_SLOT);
1764 
1765 	err = xhci_do_command(sc, &trb, USBD_DEFAULT_TIMEOUT);
1766 	if (err != USBD_NORMAL_COMPLETION) {
1767 		return err;
1768 	}
1769 
1770 	*slotp = XHCI_TRB_3_SLOT_GET(trb.trb_3);
1771 
1772 	return err;
1773 }
1774 
1775 static usbd_status
1776 xhci_address_device(struct xhci_softc * const sc,
1777     uint64_t icp, uint8_t slot_id, bool bsr)
1778 {
1779 	struct xhci_trb trb;
1780 	usbd_status err;
1781 
1782 	trb.trb_0 = icp;
1783 	trb.trb_2 = 0;
1784 	trb.trb_3 = XHCI_TRB_3_SLOT_SET(slot_id) |
1785 	    XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_ADDRESS_DEVICE) |
1786 	    (bsr ? XHCI_TRB_3_BSR_BIT : 0);
1787 
1788 	err = xhci_do_command(sc, &trb, USBD_DEFAULT_TIMEOUT);
1789 	return err;
1790 }
1791 
1792 static usbd_status
1793 xhci_update_ep0_mps(struct xhci_softc * const sc,
1794     struct xhci_slot * const xs, u_int mps)
1795 {
1796 	struct xhci_trb trb;
1797 	usbd_status err;
1798 	uint32_t * cp;
1799 
1800 	device_printf(sc->sc_dev, "%s\n", __func__);
1801 
1802 	cp = xhci_slot_get_icv(sc, xs, XHCI_ICI_INPUT_CONTROL);
1803 	cp[0] = htole32(0);
1804 	cp[1] = htole32(XHCI_INCTX_1_ADD_MASK(XHCI_DCI_EP_CONTROL));
1805 
1806 	cp = xhci_slot_get_icv(sc, xs, xhci_dci_to_ici(XHCI_DCI_EP_CONTROL));
1807 	cp[1] = htole32(XHCI_EPCTX_1_MAXP_SIZE_SET(mps));
1808 
1809 	/* sync input contexts before they are read from memory */
1810 	usb_syncmem(&xs->xs_ic_dma, 0, sc->sc_pgsz, BUS_DMASYNC_PREWRITE);
1811 	hexdump("input context", xhci_slot_get_icv(sc, xs, 0),
1812 	    sc->sc_ctxsz * 4);
1813 
1814 	trb.trb_0 = xhci_slot_get_icp(sc, xs, 0);
1815 	trb.trb_2 = 0;
1816 	trb.trb_3 = XHCI_TRB_3_SLOT_SET(xs->xs_idx) |
1817 	    XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_EVALUATE_CTX);
1818 
1819 	err = xhci_do_command(sc, &trb, USBD_DEFAULT_TIMEOUT);
1820 	KASSERT(err == USBD_NORMAL_COMPLETION); /* XXX */
1821 	return err;
1822 }
1823 
1824 static void
1825 xhci_set_dcba(struct xhci_softc * const sc, uint64_t dcba, int si)
1826 {
1827 	uint64_t * const dcbaa = KERNADDR(&sc->sc_dcbaa_dma, 0);
1828 
1829 	device_printf(sc->sc_dev, "dcbaa %p dc %016"PRIx64" slot %d\n",
1830 	    &dcbaa[si], dcba, si);
1831 
1832 	dcbaa[si] = htole64(dcba);
1833 	usb_syncmem(&sc->sc_dcbaa_dma, si * sizeof(uint64_t), sizeof(uint64_t),
1834 	    BUS_DMASYNC_PREWRITE);
1835 }
1836 
1837 static usbd_status
1838 xhci_init_slot(struct xhci_softc * const sc, uint32_t slot, int depth,
1839     int speed, int port, int rhport)
1840 {
1841 	struct xhci_slot *xs;
1842 	usbd_status err;
1843 	u_int dci;
1844 	uint32_t *cp;
1845 	uint32_t mps;
1846 	uint32_t xspeed;
1847 
1848 	switch (speed) {
1849 	case USB_SPEED_LOW:
1850 		xspeed = 2;
1851 		mps = USB_MAX_IPACKET;
1852 		break;
1853 	case USB_SPEED_FULL:
1854 		xspeed = 1;
1855 		mps = 64;
1856 		break;
1857 	case USB_SPEED_HIGH:
1858 		xspeed = 3;
1859 		mps = USB_2_MAX_CTRL_PACKET;
1860 		break;
1861 	case USB_SPEED_SUPER:
1862 		xspeed = 4;
1863 		mps = USB_3_MAX_CTRL_PACKET;
1864 		break;
1865 	default:
1866 		device_printf(sc->sc_dev, "%s: impossible speed: %x",
1867 		    __func__, speed);
1868 		return USBD_INVAL;
1869 	}
1870 
1871 	xs = &sc->sc_slots[slot];
1872 	xs->xs_idx = slot;
1873 
1874 	/* allocate contexts */
1875 	err = usb_allocmem(&sc->sc_bus, sc->sc_pgsz, sc->sc_pgsz,
1876 	    &xs->xs_dc_dma);
1877 	if (err)
1878 		return err;
1879 	memset(KERNADDR(&xs->xs_dc_dma, 0), 0, sc->sc_pgsz);
1880 
1881 	err = usb_allocmem(&sc->sc_bus, sc->sc_pgsz, sc->sc_pgsz,
1882 	    &xs->xs_ic_dma);
1883 	if (err)
1884 		return err;
1885 	memset(KERNADDR(&xs->xs_ic_dma, 0), 0, sc->sc_pgsz);
1886 
1887 	for (dci = 0; dci < 32; dci++) {
1888 		//CTASSERT(sizeof(xs->xs_ep[dci]) == sizeof(struct xhci_endpoint));
1889 		memset(&xs->xs_ep[dci], 0, sizeof(xs->xs_ep[dci]));
1890 		if (dci == XHCI_DCI_SLOT)
1891 			continue;
1892 		err = xhci_ring_init(sc, &xs->xs_ep[dci].xe_tr,
1893 		    XHCI_TRANSFER_RING_TRBS, XHCI_TRB_ALIGN);
1894 		if (err) {
1895 			device_printf(sc->sc_dev, "ring init failure\n");
1896 			return err;
1897 		}
1898 	}
1899 
1900 	/* set up initial input control context */
1901 	cp = xhci_slot_get_icv(sc, xs, XHCI_ICI_INPUT_CONTROL);
1902 	cp[0] = htole32(0);
1903 	cp[1] = htole32(XHCI_INCTX_1_ADD_MASK(XHCI_DCI_EP_CONTROL)|
1904 	    XHCI_INCTX_1_ADD_MASK(XHCI_DCI_SLOT));
1905 
1906 	/* set up input slot context */
1907 	cp = xhci_slot_get_icv(sc, xs, xhci_dci_to_ici(XHCI_DCI_SLOT));
1908 	cp[0] = htole32(
1909 		XHCI_SCTX_0_CTX_NUM_SET(1) |
1910 		XHCI_SCTX_0_SPEED_SET(xspeed)
1911 		);
1912 	cp[1] = htole32(
1913 		XHCI_SCTX_1_RH_PORT_SET(rhport)
1914 		);
1915 	cp[2] = htole32(
1916 		XHCI_SCTX_2_IRQ_TARGET_SET(0)
1917 		);
1918 	cp[3] = htole32(0);
1919 
1920 	/* set up input EP0 context */
1921 	cp = xhci_slot_get_icv(sc, xs, xhci_dci_to_ici(XHCI_DCI_EP_CONTROL));
1922 	cp[0] = htole32(0);
1923 	cp[1] = htole32(
1924 		XHCI_EPCTX_1_MAXP_SIZE_SET(mps) |
1925 		XHCI_EPCTX_1_EPTYPE_SET(4) |
1926 		XHCI_EPCTX_1_CERR_SET(3)
1927 		);
1928 	/* can't use xhci_ep_get_dci() yet? */
1929 	*(uint64_t *)(&cp[2]) = htole64(
1930 	    xhci_ring_trbp(&xs->xs_ep[XHCI_DCI_EP_CONTROL].xe_tr, 0) |
1931 	    XHCI_EPCTX_2_DCS_SET(1));
1932 	cp[4] = htole32(
1933 		XHCI_EPCTX_4_AVG_TRB_LEN_SET(8)
1934 		);
1935 
1936 	/* sync input contexts before they are read from memory */
1937 	usb_syncmem(&xs->xs_ic_dma, 0, sc->sc_pgsz, BUS_DMASYNC_PREWRITE);
1938 	hexdump("input context", xhci_slot_get_icv(sc, xs, 0),
1939 	    sc->sc_ctxsz * 3);
1940 
1941 	xhci_set_dcba(sc, DMAADDR(&xs->xs_dc_dma, 0), slot);
1942 
1943 	err = xhci_address_device(sc, xhci_slot_get_icp(sc, xs, 0), slot,
1944 	    false);
1945 
1946 	usb_syncmem(&xs->xs_dc_dma, 0, sc->sc_pgsz, BUS_DMASYNC_POSTREAD);
1947 	hexdump("output context", xhci_slot_get_dcv(sc, xs, 0),
1948 	    sc->sc_ctxsz * 2);
1949 
1950 	return err;
1951 }
1952 
1953 /* ----- */
1954 
1955 static void
1956 xhci_noop(usbd_pipe_handle pipe)
1957 {
1958 	DPRINTF(("%s\n", __func__));
1959 }
1960 
1961 /* root hub descriptors */
1962 
1963 static const usb_device_descriptor_t xhci_devd = {
1964 	USB_DEVICE_DESCRIPTOR_SIZE,
1965 	UDESC_DEVICE,		/* type */
1966 	{0x00, 0x02},		/* USB version */
1967 	UDCLASS_HUB,		/* class */
1968 	UDSUBCLASS_HUB,		/* subclass */
1969 	UDPROTO_HSHUBSTT,	/* protocol */
1970 	64,			/* max packet */
1971 	{0},{0},{0x00,0x01},	/* device id */
1972 	1,2,0,			/* string indexes */
1973 	1			/* # of configurations */
1974 };
1975 
1976 static const usb_device_qualifier_t xhci_odevd = {
1977 	USB_DEVICE_DESCRIPTOR_SIZE,
1978 	UDESC_DEVICE_QUALIFIER,	/* type */
1979 	{0x00, 0x02},		/* USB version */
1980 	UDCLASS_HUB,		/* class */
1981 	UDSUBCLASS_HUB,		/* subclass */
1982 	UDPROTO_FSHUB,		/* protocol */
1983 	64,                     /* max packet */
1984 	1,                      /* # of configurations */
1985 	0
1986 };
1987 
1988 static const usb_config_descriptor_t xhci_confd = {
1989 	USB_CONFIG_DESCRIPTOR_SIZE,
1990 	UDESC_CONFIG,
1991 	{USB_CONFIG_DESCRIPTOR_SIZE +
1992 	 USB_INTERFACE_DESCRIPTOR_SIZE +
1993 	 USB_ENDPOINT_DESCRIPTOR_SIZE},
1994 	1,
1995 	1,
1996 	0,
1997 	UC_ATTR_MBO | UC_SELF_POWERED,
1998 	0                      /* max power */
1999 };
2000 
2001 static const usb_interface_descriptor_t xhci_ifcd = {
2002 	USB_INTERFACE_DESCRIPTOR_SIZE,
2003 	UDESC_INTERFACE,
2004 	0,
2005 	0,
2006 	1,
2007 	UICLASS_HUB,
2008 	UISUBCLASS_HUB,
2009 	UIPROTO_HSHUBSTT,
2010 	0
2011 };
2012 
2013 static const usb_endpoint_descriptor_t xhci_endpd = {
2014 	USB_ENDPOINT_DESCRIPTOR_SIZE,
2015 	UDESC_ENDPOINT,
2016 	UE_DIR_IN | XHCI_INTR_ENDPT,
2017 	UE_INTERRUPT,
2018 	{8, 0},                 /* max packet */
2019 	12
2020 };
2021 
2022 static const usb_hub_descriptor_t xhci_hubd = {
2023 	USB_HUB_DESCRIPTOR_SIZE,
2024 	UDESC_HUB,
2025 	0,
2026 	{0,0},
2027 	0,
2028 	0,
2029 	{""},
2030 	{""},
2031 };
2032 
2033 /* root hub control */
2034 
2035 static usbd_status
2036 xhci_root_ctrl_transfer(usbd_xfer_handle xfer)
2037 {
2038 	struct xhci_softc * const sc = xfer->pipe->device->bus->hci_private;
2039 	usbd_status err;
2040 
2041 	DPRINTF(("%s\n", __func__));
2042 
2043 	/* Insert last in queue. */
2044 	mutex_enter(&sc->sc_lock);
2045 	err = usb_insert_transfer(xfer);
2046 	mutex_exit(&sc->sc_lock);
2047 	if (err)
2048 		return err;
2049 
2050 	/* Pipe isn't running, start first */
2051 	return (xhci_root_ctrl_start(SIMPLEQ_FIRST(&xfer->pipe->queue)));
2052 }
2053 
2054 static usbd_status
2055 xhci_root_ctrl_start(usbd_xfer_handle xfer)
2056 {
2057 	struct xhci_softc * const sc = xfer->pipe->device->bus->hci_private;
2058 	usb_port_status_t ps;
2059 	usb_device_request_t *req;
2060 	void *buf = NULL;
2061 	usb_hub_descriptor_t hubd;
2062 	usbd_status err;
2063 	int len, value, index;
2064 	int l, totlen = 0;
2065 	int port, i;
2066 	uint32_t v;
2067 
2068 	DPRINTF(("%s\n", __func__));
2069 
2070 	if (sc->sc_dying)
2071 		return USBD_IOERROR;
2072 
2073 	req = &xfer->request;
2074 
2075 	value = UGETW(req->wValue);
2076 	index = UGETW(req->wIndex);
2077 	len = UGETW(req->wLength);
2078 
2079 	if (len != 0)
2080 		buf = KERNADDR(&xfer->dmabuf, 0);
2081 
2082 	DPRINTF(("root req: %02x %02x %04x %04x %04x\n", req->bmRequestType,
2083 	    req->bRequest, value, index, len));
2084 
2085 #define C(x,y) ((x) | ((y) << 8))
2086 	switch(C(req->bRequest, req->bmRequestType)) {
2087 	case C(UR_CLEAR_FEATURE, UT_WRITE_DEVICE):
2088 	case C(UR_CLEAR_FEATURE, UT_WRITE_INTERFACE):
2089 	case C(UR_CLEAR_FEATURE, UT_WRITE_ENDPOINT):
2090 		/*
2091 		 * DEVICE_REMOTE_WAKEUP and ENDPOINT_HALT are no-ops
2092 		 * for the integrated root hub.
2093 		 */
2094 		break;
2095 	case C(UR_GET_CONFIG, UT_READ_DEVICE):
2096 		if (len > 0) {
2097 			*(uint8_t *)buf = sc->sc_conf;
2098 			totlen = 1;
2099 		}
2100 		break;
2101 	case C(UR_GET_DESCRIPTOR, UT_READ_DEVICE):
2102 		DPRINTFN(8,("xhci_root_ctrl_start: wValue=0x%04x\n", value));
2103 		if (len == 0)
2104 			break;
2105 		switch(value >> 8) {
2106 		case UDESC_DEVICE:
2107 			if ((value & 0xff) != 0) {
2108 				err = USBD_IOERROR;
2109 				goto ret;
2110 			}
2111 			totlen = l = min(len, USB_DEVICE_DESCRIPTOR_SIZE);
2112 			memcpy(buf, &xhci_devd, min(l, sizeof(xhci_devd)));
2113 			break;
2114 		case UDESC_DEVICE_QUALIFIER:
2115 			if ((value & 0xff) != 0) {
2116 			}
2117 			totlen = l = min(len, USB_DEVICE_DESCRIPTOR_SIZE);
2118 			memcpy(buf, &xhci_odevd, min(l, sizeof(xhci_odevd)));
2119 			break;
2120 		case UDESC_OTHER_SPEED_CONFIGURATION:
2121 		case UDESC_CONFIG:
2122 			if ((value & 0xff) != 0) {
2123 				err = USBD_IOERROR;
2124 				goto ret;
2125 			}
2126 			totlen = l = min(len, USB_CONFIG_DESCRIPTOR_SIZE);
2127 			memcpy(buf, &xhci_confd, min(l, sizeof(xhci_confd)));
2128 			((usb_config_descriptor_t *)buf)->bDescriptorType =
2129 			    value >> 8;
2130 			buf = (char *)buf + l;
2131 			len -= l;
2132 			l = min(len, USB_INTERFACE_DESCRIPTOR_SIZE);
2133 			totlen += l;
2134 			memcpy(buf, &xhci_ifcd, min(l, sizeof(xhci_ifcd)));
2135 			buf = (char *)buf + l;
2136 			len -= l;
2137 			l = min(len, USB_ENDPOINT_DESCRIPTOR_SIZE);
2138 			totlen += l;
2139 			memcpy(buf, &xhci_endpd, min(l, sizeof(xhci_endpd)));
2140 			break;
2141 		case UDESC_STRING:
2142 #define sd ((usb_string_descriptor_t *)buf)
2143 			switch (value & 0xff) {
2144 			case 0: /* Language table */
2145 				totlen = usb_makelangtbl(sd, len);
2146 				break;
2147 			case 1: /* Vendor */
2148 				totlen = usb_makestrdesc(sd, len, "NetBSD");
2149 				break;
2150 			case 2: /* Product */
2151 				totlen = usb_makestrdesc(sd, len,
2152 				    "xHCI Root Hub");
2153 				break;
2154 			}
2155 #undef sd
2156 			break;
2157 		default:
2158 			err = USBD_IOERROR;
2159 			goto ret;
2160 		}
2161 		break;
2162 	case C(UR_GET_INTERFACE, UT_READ_INTERFACE):
2163 		if (len > 0) {
2164 			*(uint8_t *)buf = 0;
2165 			totlen = 1;
2166 		}
2167 		break;
2168 	case C(UR_GET_STATUS, UT_READ_DEVICE):
2169 		if (len > 1) {
2170 			USETW(((usb_status_t *)buf)->wStatus,UDS_SELF_POWERED);
2171 			totlen = 2;
2172 		}
2173 		break;
2174 	case C(UR_GET_STATUS, UT_READ_INTERFACE):
2175 	case C(UR_GET_STATUS, UT_READ_ENDPOINT):
2176 		if (len > 1) {
2177 			USETW(((usb_status_t *)buf)->wStatus, 0);
2178 			totlen = 2;
2179 		}
2180 		break;
2181 	case C(UR_SET_ADDRESS, UT_WRITE_DEVICE):
2182 		if (value >= USB_MAX_DEVICES) {
2183 			err = USBD_IOERROR;
2184 			goto ret;
2185 		}
2186 		//sc->sc_addr = value;
2187 		break;
2188 	case C(UR_SET_CONFIG, UT_WRITE_DEVICE):
2189 		if (value != 0 && value != 1) {
2190 			err = USBD_IOERROR;
2191 			goto ret;
2192 		}
2193 		sc->sc_conf = value;
2194 		break;
2195 	case C(UR_SET_DESCRIPTOR, UT_WRITE_DEVICE):
2196 		break;
2197 	case C(UR_SET_FEATURE, UT_WRITE_DEVICE):
2198 	case C(UR_SET_FEATURE, UT_WRITE_INTERFACE):
2199 	case C(UR_SET_FEATURE, UT_WRITE_ENDPOINT):
2200 		err = USBD_IOERROR;
2201 		goto ret;
2202 	case C(UR_SET_INTERFACE, UT_WRITE_INTERFACE):
2203 		break;
2204 	case C(UR_SYNCH_FRAME, UT_WRITE_ENDPOINT):
2205 		break;
2206 	/* Hub requests */
2207 	case C(UR_CLEAR_FEATURE, UT_WRITE_CLASS_DEVICE):
2208 		break;
2209 	case C(UR_CLEAR_FEATURE, UT_WRITE_CLASS_OTHER):
2210 		DPRINTFN(4, ("xhci_root_ctrl_start: UR_CLEAR_PORT_FEATURE "
2211 			     "port=%d feature=%d\n",
2212 			     index, value));
2213 		if (index < 1 || index > sc->sc_hs_port_count) {
2214 			err = USBD_IOERROR;
2215 			goto ret;
2216 		}
2217 		port = XHCI_PORTSC(sc->sc_hs_port_start - 1 + index);
2218 		v = xhci_op_read_4(sc, port);
2219 		DPRINTFN(4, ("xhci_root_ctrl_start: portsc=0x%08x\n", v));
2220 		v &= ~XHCI_PS_CLEAR;
2221 		switch (value) {
2222 		case UHF_PORT_ENABLE:
2223 			xhci_op_write_4(sc, port, v &~ XHCI_PS_PED);
2224 			break;
2225 		case UHF_PORT_SUSPEND:
2226 			err = USBD_IOERROR;
2227 			goto ret;
2228 		case UHF_PORT_POWER:
2229 			break;
2230 		case UHF_PORT_TEST:
2231 		case UHF_PORT_INDICATOR:
2232 			err = USBD_IOERROR;
2233 			goto ret;
2234 		case UHF_C_PORT_CONNECTION:
2235 			xhci_op_write_4(sc, port, v | XHCI_PS_CSC);
2236 			break;
2237 		case UHF_C_PORT_ENABLE:
2238 		case UHF_C_PORT_SUSPEND:
2239 		case UHF_C_PORT_OVER_CURRENT:
2240 			err = USBD_IOERROR;
2241 			goto ret;
2242 		case UHF_C_PORT_RESET:
2243 			xhci_op_write_4(sc, port, v | XHCI_PS_PRC);
2244 			break;
2245 		default:
2246 			err = USBD_IOERROR;
2247 			goto ret;
2248 		}
2249 
2250 		break;
2251 	case C(UR_GET_DESCRIPTOR, UT_READ_CLASS_DEVICE):
2252 		if (len == 0)
2253 			break;
2254 		if ((value & 0xff) != 0) {
2255 			err = USBD_IOERROR;
2256 			goto ret;
2257 		}
2258 		hubd = xhci_hubd;
2259 		hubd.bNbrPorts = sc->sc_hs_port_count;
2260 		USETW(hubd.wHubCharacteristics, UHD_PWR_NO_SWITCH);
2261 		hubd.bPwrOn2PwrGood = 200;
2262 		for (i = 0, l = sc->sc_maxports; l > 0; i++, l -= 8)
2263 			hubd.DeviceRemovable[i++] = 0; /* XXX can't find out? */
2264 		hubd.bDescLength = USB_HUB_DESCRIPTOR_SIZE + i;
2265 		l = min(len, hubd.bDescLength);
2266 		totlen = l;
2267 		memcpy(buf, &hubd, l);
2268 		break;
2269 	case C(UR_GET_STATUS, UT_READ_CLASS_DEVICE):
2270 		if (len != 4) {
2271 			err = USBD_IOERROR;
2272 			goto ret;
2273 		}
2274 		memset(buf, 0, len); /* ? XXX */
2275 		totlen = len;
2276 		break;
2277 	case C(UR_GET_STATUS, UT_READ_CLASS_OTHER):
2278 		DPRINTFN(8,("xhci_root_ctrl_start: get port status i=%d\n",
2279 			    index));
2280 		if (index < 1 || index > sc->sc_maxports) {
2281 			err = USBD_IOERROR;
2282 			goto ret;
2283 		}
2284 		if (len != 4) {
2285 			err = USBD_IOERROR;
2286 			goto ret;
2287 		}
2288 		v = xhci_op_read_4(sc, XHCI_PORTSC(sc->sc_hs_port_start - 1 +
2289 		    index));
2290 		DPRINTF(("%s READ_CLASS_OTHER GET_STATUS PORTSC %d (%d) %08x\n",
2291 		    __func__, index, sc->sc_hs_port_start - 1 + index, v));
2292 		switch (XHCI_PS_SPEED_GET(v)) {
2293 		case 1:
2294 			i = UPS_FULL_SPEED;
2295 			break;
2296 		case 2:
2297 			i = UPS_LOW_SPEED;
2298 			break;
2299 		case 3:
2300 			i = UPS_HIGH_SPEED;
2301 			break;
2302 		default:
2303 			i = 0;
2304 			break;
2305 		}
2306 		if (v & XHCI_PS_CCS)	i |= UPS_CURRENT_CONNECT_STATUS;
2307 		if (v & XHCI_PS_PED)	i |= UPS_PORT_ENABLED;
2308 		if (v & XHCI_PS_OCA)	i |= UPS_OVERCURRENT_INDICATOR;
2309 		//if (v & XHCI_PS_SUSP)	i |= UPS_SUSPEND;
2310 		if (v & XHCI_PS_PR)	i |= UPS_RESET;
2311 		if (v & XHCI_PS_PP)	i |= UPS_PORT_POWER;
2312 		USETW(ps.wPortStatus, i);
2313 		i = 0;
2314 		if (v & XHCI_PS_CSC)    i |= UPS_C_CONNECT_STATUS;
2315 		if (v & XHCI_PS_PEC)    i |= UPS_C_PORT_ENABLED;
2316 		if (v & XHCI_PS_OCC)    i |= UPS_C_OVERCURRENT_INDICATOR;
2317 		if (v & XHCI_PS_PRC)	i |= UPS_C_PORT_RESET;
2318 		USETW(ps.wPortChange, i);
2319 		l = min(len, sizeof ps);
2320 		memcpy(buf, &ps, l);
2321 		totlen = l;
2322 		break;
2323 	case C(UR_SET_DESCRIPTOR, UT_WRITE_CLASS_DEVICE):
2324 		err = USBD_IOERROR;
2325 		goto ret;
2326 	case C(UR_SET_FEATURE, UT_WRITE_CLASS_DEVICE):
2327 		break;
2328 	case C(UR_SET_FEATURE, UT_WRITE_CLASS_OTHER):
2329 		if (index < 1 || index > sc->sc_hs_port_count) {
2330 			err = USBD_IOERROR;
2331 			goto ret;
2332 		}
2333 		port = XHCI_PORTSC(sc->sc_hs_port_start - 1 + index);
2334 		v = xhci_op_read_4(sc, port);
2335 		DPRINTFN(4, ("xhci_root_ctrl_start: portsc=0x%08x\n", v));
2336 		v &= ~XHCI_PS_CLEAR;
2337 		switch (value) {
2338 		case UHF_PORT_ENABLE:
2339 			xhci_op_write_4(sc, port, v | XHCI_PS_PED);
2340 			break;
2341 		case UHF_PORT_SUSPEND:
2342 			/* XXX suspend */
2343 			break;
2344 		case UHF_PORT_RESET:
2345 			v &= ~ (XHCI_PS_PED | XHCI_PS_PR);
2346 			xhci_op_write_4(sc, port, v | XHCI_PS_PR);
2347 			/* Wait for reset to complete. */
2348 			usb_delay_ms(&sc->sc_bus, USB_PORT_ROOT_RESET_DELAY);
2349 			if (sc->sc_dying) {
2350 				err = USBD_IOERROR;
2351 				goto ret;
2352 			}
2353 			v = xhci_op_read_4(sc, port);
2354 			if (v & XHCI_PS_PR) {
2355 				xhci_op_write_4(sc, port, v & ~XHCI_PS_PR);
2356 				usb_delay_ms(&sc->sc_bus, 10);
2357 				/* XXX */
2358 			}
2359 			break;
2360 		case UHF_PORT_POWER:
2361 			/* XXX power control */
2362 			break;
2363 		/* XXX more */
2364 		case UHF_C_PORT_RESET:
2365 			xhci_op_write_4(sc, port, v | XHCI_PS_PRC);
2366 			break;
2367 		default:
2368 			err = USBD_IOERROR;
2369 			goto ret;
2370 		}
2371 		break;
2372 	case C(UR_CLEAR_TT_BUFFER, UT_WRITE_CLASS_OTHER):
2373 	case C(UR_RESET_TT, UT_WRITE_CLASS_OTHER):
2374 	case C(UR_GET_TT_STATE, UT_READ_CLASS_OTHER):
2375 	case C(UR_STOP_TT, UT_WRITE_CLASS_OTHER):
2376 		break;
2377 	default:
2378 		err = USBD_IOERROR;
2379 		goto ret;
2380 	}
2381 	xfer->actlen = totlen;
2382 	err = USBD_NORMAL_COMPLETION;
2383 ret:
2384 	xfer->status = err;
2385 	mutex_enter(&sc->sc_lock);
2386 	usb_transfer_complete(xfer);
2387 	mutex_exit(&sc->sc_lock);
2388 	return USBD_IN_PROGRESS;
2389 }
2390 
2391 
2392 static void
2393 xhci_root_ctrl_abort(usbd_xfer_handle xfer)
2394 {
2395 	/* Nothing to do, all transfers are synchronous. */
2396 }
2397 
2398 
2399 static void
2400 xhci_root_ctrl_close(usbd_pipe_handle pipe)
2401 {
2402 	DPRINTF(("%s\n", __func__));
2403 	/* Nothing to do. */
2404 }
2405 
2406 static void
2407 xhci_root_ctrl_done(usbd_xfer_handle xfer)
2408 {
2409 	xfer->hcpriv = NULL;
2410 }
2411 
2412 /* root hub intrerrupt */
2413 
2414 static usbd_status
2415 xhci_root_intr_transfer(usbd_xfer_handle xfer)
2416 {
2417 	struct xhci_softc * const sc = xfer->pipe->device->bus->hci_private;
2418 	usbd_status err;
2419 
2420 	/* Insert last in queue. */
2421 	mutex_enter(&sc->sc_lock);
2422 	err = usb_insert_transfer(xfer);
2423 	mutex_exit(&sc->sc_lock);
2424 	if (err)
2425 		return err;
2426 
2427 	/* Pipe isn't running, start first */
2428 	return (xhci_root_intr_start(SIMPLEQ_FIRST(&xfer->pipe->queue)));
2429 }
2430 
2431 static usbd_status
2432 xhci_root_intr_start(usbd_xfer_handle xfer)
2433 {
2434 	struct xhci_softc * const sc = xfer->pipe->device->bus->hci_private;
2435 
2436 	if (sc->sc_dying)
2437 		return USBD_IOERROR;
2438 
2439 	mutex_enter(&sc->sc_lock);
2440 	sc->sc_intrxfer = xfer;
2441 	mutex_exit(&sc->sc_lock);
2442 
2443 	return USBD_IN_PROGRESS;
2444 }
2445 
2446 static void
2447 xhci_root_intr_abort(usbd_xfer_handle xfer)
2448 {
2449 #ifdef DIAGNOSTIC
2450 	struct xhci_softc * const sc = xfer->pipe->device->bus->hci_private;
2451 #endif
2452 
2453 	KASSERT(mutex_owned(&sc->sc_lock));
2454 	if (xfer->pipe->intrxfer == xfer) {
2455 		DPRINTF(("%s: remove\n", __func__));
2456 		xfer->pipe->intrxfer = NULL;
2457 	}
2458 	xfer->status = USBD_CANCELLED;
2459 	usb_transfer_complete(xfer);
2460 }
2461 
2462 static void
2463 xhci_root_intr_close(usbd_pipe_handle pipe)
2464 {
2465 	struct xhci_softc * const sc = pipe->device->bus->hci_private;
2466 
2467 	KASSERT(mutex_owned(&sc->sc_lock));
2468 
2469 	DPRINTF(("%s\n", __func__));
2470 
2471 	sc->sc_intrxfer = NULL;
2472 }
2473 
2474 static void
2475 xhci_root_intr_done(usbd_xfer_handle xfer)
2476 {
2477 	xfer->hcpriv = NULL;
2478 }
2479 
2480 /* -------------- */
2481 /* device control */
2482 
2483 static usbd_status
2484 xhci_device_ctrl_transfer(usbd_xfer_handle xfer)
2485 {
2486 	struct xhci_softc * const sc = xfer->pipe->device->bus->hci_private;
2487 	usbd_status err;
2488 
2489 	/* Insert last in queue. */
2490 	mutex_enter(&sc->sc_lock);
2491 	err = usb_insert_transfer(xfer);
2492 	mutex_exit(&sc->sc_lock);
2493 	if (err)
2494 		return (err);
2495 
2496 	/* Pipe isn't running, start first */
2497 	return (xhci_device_ctrl_start(SIMPLEQ_FIRST(&xfer->pipe->queue)));
2498 }
2499 
2500 static usbd_status
2501 xhci_device_ctrl_start(usbd_xfer_handle xfer)
2502 {
2503 	struct xhci_softc * const sc = xfer->pipe->device->bus->hci_private;
2504 	struct xhci_slot * const xs = xfer->pipe->device->hci_private;
2505 	const u_int dci = xhci_ep_get_dci(xfer->pipe->endpoint->edesc);
2506 	struct xhci_ring * const tr = &xs->xs_ep[dci].xe_tr;
2507 	struct xhci_xfer * const xx = (void *)xfer;
2508 	usb_device_request_t * const req = &xfer->request;
2509 	const bool isread = UT_GET_DIR(req->bmRequestType) == UT_READ;
2510 	const uint32_t len = UGETW(req->wLength);
2511 	usb_dma_t * const dma = &xfer->dmabuf;
2512 	uint64_t parameter;
2513 	uint32_t status;
2514 	uint32_t control;
2515 	u_int i;
2516 
2517 	DPRINTF(("%s\n", __func__));
2518 	DPRINTF(("req: %02x %02x %04x %04x %04x\n", req->bmRequestType,
2519 	    req->bRequest, UGETW(req->wValue), UGETW(req->wIndex),
2520 	    UGETW(req->wLength)));
2521 
2522 	/* XXX */
2523 	if (tr->is_halted) {
2524 		xhci_reset_endpoint(xfer->pipe);
2525 		tr->is_halted = false;
2526 		xhci_set_dequeue(xfer->pipe);
2527 	}
2528 
2529 	/* we rely on the bottom bits for extra info */
2530 	KASSERT(((uintptr_t)xfer & 0x3) == 0x0);
2531 
2532 	KASSERT((xfer->rqflags & URQ_REQUEST) != 0);
2533 
2534 	i = 0;
2535 
2536 	/* setup phase */
2537 	memcpy(&parameter, req, sizeof(*req));
2538 	parameter = le64toh(parameter);
2539 	status = XHCI_TRB_2_IRQ_SET(0) | XHCI_TRB_2_BYTES_SET(sizeof(*req));
2540 	control = ((len == 0) ? XHCI_TRB_3_TRT_NONE :
2541 	     (isread ? XHCI_TRB_3_TRT_IN : XHCI_TRB_3_TRT_OUT)) |
2542 	    XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_SETUP_STAGE) |
2543 	    XHCI_TRB_3_IDT_BIT;
2544 	xhci_trb_put(&xx->xx_trb[i++], parameter, status, control);
2545 
2546 	if (len == 0)
2547 		goto no_data;
2548 
2549 	/* data phase */
2550 	parameter = DMAADDR(dma, 0);
2551 	KASSERT(len <= 0x10000);
2552 	status = XHCI_TRB_2_IRQ_SET(0) |
2553 	    XHCI_TRB_2_TDSZ_SET(1) |
2554 	    XHCI_TRB_2_BYTES_SET(len);
2555 	control = (isread ? XHCI_TRB_3_DIR_IN : 0) |
2556 	    XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_DATA_STAGE) |
2557 	    XHCI_TRB_3_CHAIN_BIT | XHCI_TRB_3_ENT_BIT;
2558 	xhci_trb_put(&xx->xx_trb[i++], parameter, status, control);
2559 
2560 	parameter = (uintptr_t)xfer | 0x3;
2561 	status = XHCI_TRB_2_IRQ_SET(0);
2562 	control = XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_EVENT_DATA) |
2563 	    XHCI_TRB_3_IOC_BIT;
2564 	xhci_trb_put(&xx->xx_trb[i++], parameter, status, control);
2565 
2566 no_data:
2567 	parameter = 0;
2568 	status = XHCI_TRB_2_IRQ_SET(0) | XHCI_TRB_2_TDSZ_SET(1);
2569 	/* the status stage has inverted direction */
2570 	control = (isread ? 0 : XHCI_TRB_3_DIR_IN) |
2571 	    XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_STATUS_STAGE) |
2572 	    XHCI_TRB_3_CHAIN_BIT | XHCI_TRB_3_ENT_BIT;
2573 	xhci_trb_put(&xx->xx_trb[i++], parameter, status, control);
2574 
2575 	parameter = (uintptr_t)xfer | 0x0;
2576 	status = XHCI_TRB_2_IRQ_SET(0);
2577 	control = XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_EVENT_DATA) |
2578 	    XHCI_TRB_3_IOC_BIT;
2579 	xhci_trb_put(&xx->xx_trb[i++], parameter, status, control);
2580 
2581 	mutex_enter(&tr->xr_lock);
2582 	xhci_ring_put(sc, tr, xfer, xx->xx_trb, i);
2583 	mutex_exit(&tr->xr_lock);
2584 
2585 	xhci_db_write_4(sc, XHCI_DOORBELL(xs->xs_idx), dci);
2586 
2587 	if (xfer->timeout && !sc->sc_bus.use_polling) {
2588 		callout_reset(&xfer->timeout_handle, mstohz(xfer->timeout),
2589 		    xhci_timeout, xfer);
2590 	}
2591 
2592 	if (sc->sc_bus.use_polling) {
2593 		device_printf(sc->sc_dev, "%s polling\n", __func__);
2594 		//xhci_waitintr(sc, xfer);
2595 	}
2596 
2597 	return USBD_IN_PROGRESS;
2598 }
2599 
2600 static void
2601 xhci_device_ctrl_done(usbd_xfer_handle xfer)
2602 {
2603 	DPRINTF(("%s\n", __func__));
2604 
2605 	callout_stop(&xfer->timeout_handle); /* XXX wrong place */
2606 
2607 }
2608 
2609 static void
2610 xhci_device_ctrl_abort(usbd_xfer_handle xfer)
2611 {
2612 	DPRINTF(("%s\n", __func__));
2613 }
2614 
2615 static void
2616 xhci_device_ctrl_close(usbd_pipe_handle pipe)
2617 {
2618 	DPRINTF(("%s\n", __func__));
2619 }
2620 
2621 /* ----------------- */
2622 /* device isochronus */
2623 
2624 /* ----------- */
2625 /* device bulk */
2626 
2627 static usbd_status
2628 xhci_device_bulk_transfer(usbd_xfer_handle xfer)
2629 {
2630 	struct xhci_softc * const sc = xfer->pipe->device->bus->hci_private;
2631 	usbd_status err;
2632 
2633 	/* Insert last in queue. */
2634 	mutex_enter(&sc->sc_lock);
2635 	err = usb_insert_transfer(xfer);
2636 	mutex_exit(&sc->sc_lock);
2637 	if (err)
2638 		return err;
2639 
2640 	/*
2641 	 * Pipe isn't running (otherwise err would be USBD_INPROG),
2642 	 * so start it first.
2643 	 */
2644 	return (xhci_device_bulk_start(SIMPLEQ_FIRST(&xfer->pipe->queue)));
2645 }
2646 
2647 static usbd_status
2648 xhci_device_bulk_start(usbd_xfer_handle xfer)
2649 {
2650 	struct xhci_softc * const sc = xfer->pipe->device->bus->hci_private;
2651 	struct xhci_slot * const xs = xfer->pipe->device->hci_private;
2652 	const u_int dci = xhci_ep_get_dci(xfer->pipe->endpoint->edesc);
2653 	struct xhci_ring * const tr = &xs->xs_ep[dci].xe_tr;
2654 	struct xhci_xfer * const xx = (void *)xfer;
2655 	const uint32_t len = xfer->length;
2656 	usb_dma_t * const dma = &xfer->dmabuf;
2657 	uint64_t parameter;
2658 	uint32_t status;
2659 	uint32_t control;
2660 	u_int i = 0;
2661 
2662 #if 0
2663 	device_printf(sc->sc_dev, "%s %p slot %u dci %u\n", __func__, xfer,
2664 	    xs->xs_idx, dci);
2665 #endif
2666 
2667 	if (sc->sc_dying)
2668 		return USBD_IOERROR;
2669 
2670 	KASSERT((xfer->rqflags & URQ_REQUEST) == 0);
2671 
2672 	parameter = DMAADDR(dma, 0);
2673 	/*
2674 	 * XXX: The physical buffer must not cross a 64k boundary.
2675 	 * If the user supplied buffer crosses such a boundary then 2
2676 	 * (or more) TRB should be used.
2677 	 * If multiple TRB are used the td_size field must be set correctly.
2678 	 * For v1.0 devices (like ivy bridge) this is the number of usb data
2679 	 * blocks needed to complete the transfer.
2680 	 * Setting it to 1 in the last TRB causes an extra zero-length
2681 	 * data block be sent.
2682 	 * The earlier documentation differs, I don't know how it behaves.
2683 	 */
2684 	KASSERT(len <= 0x10000);
2685 	status = XHCI_TRB_2_IRQ_SET(0) |
2686 	    XHCI_TRB_2_TDSZ_SET(1) |
2687 	    XHCI_TRB_2_BYTES_SET(len);
2688 	control = XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_NORMAL) |
2689 	    XHCI_TRB_3_ISP_BIT | XHCI_TRB_3_IOC_BIT;
2690 	xhci_trb_put(&xx->xx_trb[i++], parameter, status, control);
2691 
2692 	mutex_enter(&tr->xr_lock);
2693 	xhci_ring_put(sc, tr, xfer, xx->xx_trb, i);
2694 	mutex_exit(&tr->xr_lock);
2695 
2696 	xhci_db_write_4(sc, XHCI_DOORBELL(xs->xs_idx), dci);
2697 
2698 	if (sc->sc_bus.use_polling) {
2699 		device_printf(sc->sc_dev, "%s polling\n", __func__);
2700 		//xhci_waitintr(sc, xfer);
2701 	}
2702 
2703 	return USBD_IN_PROGRESS;
2704 }
2705 
2706 static void
2707 xhci_device_bulk_done(usbd_xfer_handle xfer)
2708 {
2709 	//struct xhci_softc * const sc = xfer->pipe->device->bus->hci_private;
2710 	//struct xhci_slot * const xs = xfer->pipe->device->hci_private;
2711 	//const u_int dci = xhci_ep_get_dci(xfer->pipe->endpoint->edesc);
2712 	const u_int endpt = xfer->pipe->endpoint->edesc->bEndpointAddress;
2713 	const bool isread = UE_GET_DIR(endpt) == UE_DIR_IN;
2714 
2715 	DPRINTF(("%s\n", __func__));
2716 
2717 #if 0
2718 	device_printf(sc->sc_dev, "%s %p slot %u dci %u\n", __func__, xfer,
2719 	    xs->xs_idx, dci);
2720 #endif
2721 
2722 	callout_stop(&xfer->timeout_handle); /* XXX wrong place */
2723 
2724 	usb_syncmem(&xfer->dmabuf, 0, xfer->length,
2725 	    isread ? BUS_DMASYNC_POSTREAD : BUS_DMASYNC_POSTWRITE);
2726 
2727 
2728 }
2729 
2730 static void
2731 xhci_device_bulk_abort(usbd_xfer_handle xfer)
2732 {
2733 	DPRINTF(("%s\n", __func__));
2734 }
2735 
2736 static void
2737 xhci_device_bulk_close(usbd_pipe_handle pipe)
2738 {
2739 	DPRINTF(("%s\n", __func__));
2740 }
2741 
2742 /* --------------- */
2743 /* device intrrupt */
2744 
2745 static usbd_status
2746 xhci_device_intr_transfer(usbd_xfer_handle xfer)
2747 {
2748 	struct xhci_softc * const sc = xfer->pipe->device->bus->hci_private;
2749 	usbd_status err;
2750 
2751 	/* Insert last in queue. */
2752 	mutex_enter(&sc->sc_lock);
2753 	err = usb_insert_transfer(xfer);
2754 	mutex_exit(&sc->sc_lock);
2755 	if (err)
2756 		return err;
2757 
2758 	/*
2759 	 * Pipe isn't running (otherwise err would be USBD_INPROG),
2760 	 * so start it first.
2761 	 */
2762 	return (xhci_device_intr_start(SIMPLEQ_FIRST(&xfer->pipe->queue)));
2763 }
2764 
2765 static usbd_status
2766 xhci_device_intr_start(usbd_xfer_handle xfer)
2767 {
2768 	struct xhci_softc * const sc = xfer->pipe->device->bus->hci_private;
2769 	struct xhci_slot * const xs = xfer->pipe->device->hci_private;
2770 	const u_int dci = xhci_ep_get_dci(xfer->pipe->endpoint->edesc);
2771 	struct xhci_ring * const tr = &xs->xs_ep[dci].xe_tr;
2772 	struct xhci_xfer * const xx = (void *)xfer;
2773 	const uint32_t len = xfer->length;
2774 	usb_dma_t * const dma = &xfer->dmabuf;
2775 	uint64_t parameter;
2776 	uint32_t status;
2777 	uint32_t control;
2778 	u_int i = 0;
2779 
2780 #if 0
2781 	device_printf(sc->sc_dev, "%s %p slot %u dci %u\n", __func__, xfer,
2782 	    xs->xs_idx, dci);
2783 #endif
2784 
2785 	if (sc->sc_dying)
2786 		return USBD_IOERROR;
2787 
2788 	KASSERT((xfer->rqflags & URQ_REQUEST) == 0);
2789 
2790 	parameter = DMAADDR(dma, 0);
2791 	KASSERT(len <= 0x10000);
2792 	status = XHCI_TRB_2_IRQ_SET(0) |
2793 	    XHCI_TRB_2_TDSZ_SET(1) |
2794 	    XHCI_TRB_2_BYTES_SET(len);
2795 	control = XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_NORMAL) |
2796 	    XHCI_TRB_3_ISP_BIT | XHCI_TRB_3_IOC_BIT;
2797 	xhci_trb_put(&xx->xx_trb[i++], parameter, status, control);
2798 
2799 	mutex_enter(&tr->xr_lock);
2800 	xhci_ring_put(sc, tr, xfer, xx->xx_trb, i);
2801 	mutex_exit(&tr->xr_lock);
2802 
2803 	xhci_db_write_4(sc, XHCI_DOORBELL(xs->xs_idx), dci);
2804 
2805 	if (sc->sc_bus.use_polling) {
2806 		device_printf(sc->sc_dev, "%s polling\n", __func__);
2807 		//xhci_waitintr(sc, xfer);
2808 	}
2809 
2810 	return USBD_IN_PROGRESS;
2811 }
2812 
2813 static void
2814 xhci_device_intr_done(usbd_xfer_handle xfer)
2815 {
2816 	struct xhci_softc * const sc = xfer->pipe->device->bus->hci_private;
2817 	struct xhci_slot * const xs = xfer->pipe->device->hci_private;
2818 	const u_int dci = xhci_ep_get_dci(xfer->pipe->endpoint->edesc);
2819 	const u_int endpt = xfer->pipe->endpoint->edesc->bEndpointAddress;
2820 	const bool isread = UE_GET_DIR(endpt) == UE_DIR_IN;
2821 	DPRINTF(("%s\n", __func__));
2822 
2823 	device_printf(sc->sc_dev, "%s %p slot %u dci %u\n", __func__, xfer,
2824 	    xs->xs_idx, dci);
2825 
2826 	KASSERT(sc->sc_bus.use_polling || mutex_owned(&sc->sc_lock));
2827 
2828 	usb_syncmem(&xfer->dmabuf, 0, xfer->length,
2829 	    isread ? BUS_DMASYNC_POSTREAD : BUS_DMASYNC_POSTWRITE);
2830 
2831 #if 0
2832 	device_printf(sc->sc_dev, "");
2833 	for (size_t i = 0; i < xfer->length; i++) {
2834 		printf(" %02x", ((uint8_t const *)xfer->buffer)[i]);
2835 	}
2836 	printf("\n");
2837 #endif
2838 
2839 	if (xfer->pipe->repeat) {
2840 		xfer->status = xhci_device_intr_start(xfer);
2841 	} else {
2842 		callout_stop(&xfer->timeout_handle); /* XXX */
2843 	}
2844 
2845 }
2846 
2847 static void
2848 xhci_device_intr_abort(usbd_xfer_handle xfer)
2849 {
2850 	struct xhci_softc * const sc = xfer->pipe->device->bus->hci_private;
2851 	DPRINTF(("%s\n", __func__));
2852 
2853 	KASSERT(mutex_owned(&sc->sc_lock));
2854 	device_printf(sc->sc_dev, "%s %p\n", __func__, xfer);
2855 	/* XXX */
2856 	if (xfer->pipe->intrxfer == xfer) {
2857 		xfer->pipe->intrxfer = NULL;
2858 	}
2859 	xfer->status = USBD_CANCELLED;
2860 	usb_transfer_complete(xfer);
2861 }
2862 
2863 static void
2864 xhci_device_intr_close(usbd_pipe_handle pipe)
2865 {
2866 	struct xhci_softc * const sc = pipe->device->bus->hci_private;
2867 	DPRINTF(("%s\n", __func__));
2868 	device_printf(sc->sc_dev, "%s %p\n", __func__, pipe);
2869 	xhci_unconfigure_endpoint(pipe);
2870 }
2871 
2872 /* ------------ */
2873 
2874 static void
2875 xhci_timeout(void *addr)
2876 {
2877 	struct xhci_xfer * const xx = addr;
2878 	usbd_xfer_handle const xfer = &xx->xx_xfer;
2879 	struct xhci_softc * const sc = xfer->pipe->device->bus->hci_private;
2880 
2881 	if (sc->sc_dying) {
2882 		return;
2883 	}
2884 
2885 	usb_init_task(&xx->xx_abort_task, xhci_timeout_task, addr,
2886 	    USB_TASKQ_MPSAFE);
2887 	usb_add_task(xx->xx_xfer.pipe->device, &xx->xx_abort_task,
2888 	    USB_TASKQ_HC);
2889 }
2890 
2891 static void
2892 xhci_timeout_task(void *addr)
2893 {
2894 	usbd_xfer_handle const xfer = addr;
2895 	struct xhci_softc * const sc = xfer->pipe->device->bus->hci_private;
2896 
2897 	mutex_enter(&sc->sc_lock);
2898 #if 0
2899 	xhci_abort_xfer(xfer, USBD_TIMEOUT);
2900 #else
2901 	xfer->status = USBD_TIMEOUT;
2902 	usb_transfer_complete(xfer);
2903 #endif
2904 	mutex_exit(&sc->sc_lock);
2905 }
2906