xref: /openbsd-src/sys/dev/usb/ehci.c (revision 50b7afb2c2c0993b0894d4e34bf857cb13ed9c80)
1 /*	$OpenBSD: ehci.c,v 1.162 2014/07/12 20:13:48 mpi Exp $ */
2 /*	$NetBSD: ehci.c,v 1.66 2004/06/30 03:11:56 mycroft Exp $	*/
3 
4 /*
5  * Copyright (c) 2004-2008 The NetBSD Foundation, Inc.
6  * All rights reserved.
7  *
8  * This code is derived from software contributed to The NetBSD Foundation
9  * by Lennart Augustsson (lennart@augustsson.net), Charles M. Hannum and
10  * Jeremy Morse (jeremy.morse@gmail.com).
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
23  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
24  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
25  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 /*
35  * TODO:
36  * 1) The hub driver needs to handle and schedule the transaction translator,
37  *    to assign place in frame where different devices get to go. See chapter
38  *    on hubs in USB 2.0 for details.
39  *
40  * 2) Command failures are not recovered correctly.
41  */
42 
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/kernel.h>
46 #include <sys/rwlock.h>
47 #include <sys/malloc.h>
48 #include <sys/device.h>
49 #include <sys/queue.h>
50 #include <sys/timeout.h>
51 #include <sys/pool.h>
52 
53 #include <machine/bus.h>
54 #include <machine/endian.h>
55 
56 #include <dev/usb/usb.h>
57 #include <dev/usb/usbdi.h>
58 #include <dev/usb/usbdivar.h>
59 #include <dev/usb/usb_mem.h>
60 
61 #include <dev/usb/ehcireg.h>
62 #include <dev/usb/ehcivar.h>
63 
64 #include <dev/rndvar.h>
65 
66 struct cfdriver ehci_cd = {
67 	NULL, "ehci", DV_DULL
68 };
69 
70 #ifdef EHCI_DEBUG
71 #define DPRINTF(x)	do { if (ehcidebug) printf x; } while(0)
72 #define DPRINTFN(n,x)	do { if (ehcidebug>(n)) printf x; } while (0)
73 int ehcidebug = 0;
74 #define bitmask_snprintf(q,f,b,l) snprintf((b), (l), "%b", (q), (f))
75 #else
76 #define DPRINTF(x)
77 #define DPRINTFN(n,x)
78 #endif
79 
80 struct pool *ehcixfer;
81 
82 struct ehci_pipe {
83 	struct usbd_pipe pipe;
84 
85 	struct ehci_soft_qh *sqh;
86 	union {
87 		/* Control pipe */
88 		struct {
89 			struct usb_dma reqdma;
90 		} ctl;
91 		/* Iso pipe */
92 		struct {
93 			u_int next_frame;
94 			u_int cur_xfers;
95 		} isoc;
96 	} u;
97 };
98 
99 u_int8_t		ehci_reverse_bits(u_int8_t, int);
100 
101 usbd_status	ehci_open(struct usbd_pipe *);
102 void		ehci_poll(struct usbd_bus *);
103 void		ehci_softintr(void *);
104 int		ehci_intr1(struct ehci_softc *);
105 void		ehci_waitintr(struct ehci_softc *, struct usbd_xfer *);
106 void		ehci_check_intr(struct ehci_softc *, struct usbd_xfer *);
107 void		ehci_check_qh_intr(struct ehci_softc *, struct usbd_xfer *);
108 void		ehci_check_itd_intr(struct ehci_softc *, struct usbd_xfer *);
109 void		ehci_idone(struct usbd_xfer *);
110 void		ehci_timeout(void *);
111 void		ehci_timeout_task(void *);
112 void		ehci_intrlist_timeout(void *);
113 
114 struct usbd_xfer *ehci_allocx(struct usbd_bus *);
115 void		ehci_freex(struct usbd_bus *, struct usbd_xfer *);
116 
117 usbd_status	ehci_root_ctrl_transfer(struct usbd_xfer *);
118 usbd_status	ehci_root_ctrl_start(struct usbd_xfer *);
119 void		ehci_root_ctrl_abort(struct usbd_xfer *);
120 void		ehci_root_ctrl_close(struct usbd_pipe *);
121 void		ehci_root_ctrl_done(struct usbd_xfer *);
122 
123 usbd_status	ehci_root_intr_transfer(struct usbd_xfer *);
124 usbd_status	ehci_root_intr_start(struct usbd_xfer *);
125 void		ehci_root_intr_abort(struct usbd_xfer *);
126 void		ehci_root_intr_close(struct usbd_pipe *);
127 void		ehci_root_intr_done(struct usbd_xfer *);
128 
129 usbd_status	ehci_device_ctrl_transfer(struct usbd_xfer *);
130 usbd_status	ehci_device_ctrl_start(struct usbd_xfer *);
131 void		ehci_device_ctrl_abort(struct usbd_xfer *);
132 void		ehci_device_ctrl_close(struct usbd_pipe *);
133 void		ehci_device_ctrl_done(struct usbd_xfer *);
134 
135 usbd_status	ehci_device_bulk_transfer(struct usbd_xfer *);
136 usbd_status	ehci_device_bulk_start(struct usbd_xfer *);
137 void		ehci_device_bulk_abort(struct usbd_xfer *);
138 void		ehci_device_bulk_close(struct usbd_pipe *);
139 void		ehci_device_bulk_done(struct usbd_xfer *);
140 
141 usbd_status	ehci_device_intr_transfer(struct usbd_xfer *);
142 usbd_status	ehci_device_intr_start(struct usbd_xfer *);
143 void		ehci_device_intr_abort(struct usbd_xfer *);
144 void		ehci_device_intr_close(struct usbd_pipe *);
145 void		ehci_device_intr_done(struct usbd_xfer *);
146 
147 usbd_status	ehci_device_isoc_transfer(struct usbd_xfer *);
148 usbd_status	ehci_device_isoc_start(struct usbd_xfer *);
149 void		ehci_device_isoc_abort(struct usbd_xfer *);
150 void		ehci_device_isoc_close(struct usbd_pipe *);
151 void		ehci_device_isoc_done(struct usbd_xfer *);
152 
153 void		ehci_device_clear_toggle(struct usbd_pipe *pipe);
154 
155 void		ehci_pcd(struct ehci_softc *, struct usbd_xfer *);
156 void		ehci_disown(struct ehci_softc *, int, int);
157 
158 struct ehci_soft_qh *ehci_alloc_sqh(struct ehci_softc *);
159 void		ehci_free_sqh(struct ehci_softc *, struct ehci_soft_qh *);
160 
161 struct ehci_soft_qtd *ehci_alloc_sqtd(struct ehci_softc *);
162 void		ehci_free_sqtd(struct ehci_softc *, struct ehci_soft_qtd *);
163 usbd_status	ehci_alloc_sqtd_chain(struct ehci_softc *, u_int,
164 		    struct usbd_xfer *, struct ehci_soft_qtd **, struct ehci_soft_qtd **);
165 void		ehci_free_sqtd_chain(struct ehci_softc *, struct ehci_xfer *);
166 
167 struct ehci_soft_itd *ehci_alloc_itd(struct ehci_softc *sc);
168 void		ehci_free_itd(struct ehci_softc *sc, struct ehci_soft_itd *itd);
169 void		ehci_rem_free_itd_chain(struct ehci_softc *sc,
170 		    struct ehci_xfer *);
171 void		ehci_abort_isoc_xfer(struct usbd_xfer *xfer,
172 		    usbd_status status);
173 
174 usbd_status	ehci_device_request(struct usbd_xfer *xfer);
175 
176 usbd_status	ehci_device_setintr(struct ehci_softc *, struct ehci_soft_qh *,
177 			    int ival);
178 
179 void		ehci_add_qh(struct ehci_soft_qh *, struct ehci_soft_qh *);
180 void		ehci_rem_qh(struct ehci_softc *, struct ehci_soft_qh *);
181 void		ehci_set_qh_qtd(struct ehci_soft_qh *, struct ehci_soft_qtd *);
182 void		ehci_sync_hc(struct ehci_softc *);
183 
184 void		ehci_close_pipe(struct usbd_pipe *);
185 void		ehci_abort_xfer(struct usbd_xfer *, usbd_status);
186 
187 #ifdef EHCI_DEBUG
188 void		ehci_dump_regs(struct ehci_softc *);
189 void		ehci_dump(void);
190 struct ehci_softc *theehci;
191 void		ehci_dump_link(ehci_link_t, int);
192 void		ehci_dump_sqtds(struct ehci_soft_qtd *);
193 void		ehci_dump_sqtd(struct ehci_soft_qtd *);
194 void		ehci_dump_qtd(struct ehci_qtd *);
195 void		ehci_dump_sqh(struct ehci_soft_qh *);
196 #if notyet
197 void		ehci_dump_sitd(struct ehci_soft_itd *itd);
198 void		ehci_dump_itd(struct ehci_soft_itd *);
199 #endif
200 #ifdef DIAGNOSTIC
201 void		ehci_dump_exfer(struct ehci_xfer *);
202 #endif
203 #endif
204 
205 #define EHCI_INTR_ENDPT 1
206 
207 #define ehci_add_intr_list(sc, ex) \
208 	TAILQ_INSERT_TAIL(&(sc)->sc_intrhead, (ex), inext);
209 #define ehci_del_intr_list(sc, ex) \
210 	do { \
211 		TAILQ_REMOVE(&sc->sc_intrhead, (ex), inext); \
212 		(ex)->inext.tqe_prev = NULL; \
213 	} while (0)
214 #define ehci_active_intr_list(ex) ((ex)->inext.tqe_prev != NULL)
215 
216 struct usbd_bus_methods ehci_bus_methods = {
217 	.open_pipe = ehci_open,
218 	.dev_setaddr = usbd_set_address,
219 	.soft_intr = ehci_softintr,
220 	.do_poll = ehci_poll,
221 	.allocx = ehci_allocx,
222 	.freex = ehci_freex,
223 };
224 
225 struct usbd_pipe_methods ehci_root_ctrl_methods = {
226 	.transfer = ehci_root_ctrl_transfer,
227 	.start = ehci_root_ctrl_start,
228 	.abort = ehci_root_ctrl_abort,
229 	.close = ehci_root_ctrl_close,
230 	.done = ehci_root_ctrl_done,
231 };
232 
233 struct usbd_pipe_methods ehci_root_intr_methods = {
234 	.transfer = ehci_root_intr_transfer,
235 	.start = ehci_root_intr_start,
236 	.abort = ehci_root_intr_abort,
237 	.close = ehci_root_intr_close,
238 	.done = ehci_root_intr_done,
239 };
240 
241 struct usbd_pipe_methods ehci_device_ctrl_methods = {
242 	.transfer = ehci_device_ctrl_transfer,
243 	.start = ehci_device_ctrl_start,
244 	.abort = ehci_device_ctrl_abort,
245 	.close = ehci_device_ctrl_close,
246 	.done = ehci_device_ctrl_done,
247 };
248 
249 struct usbd_pipe_methods ehci_device_intr_methods = {
250 	.transfer = ehci_device_intr_transfer,
251 	.start = ehci_device_intr_start,
252 	.abort = ehci_device_intr_abort,
253 	.close = ehci_device_intr_close,
254 	.cleartoggle = ehci_device_clear_toggle,
255 	.done = ehci_device_intr_done,
256 };
257 
258 struct usbd_pipe_methods ehci_device_bulk_methods = {
259 	.transfer = ehci_device_bulk_transfer,
260 	.start = ehci_device_bulk_start,
261 	.abort = ehci_device_bulk_abort,
262 	.close = ehci_device_bulk_close,
263 	.cleartoggle = ehci_device_clear_toggle,
264 	.done = ehci_device_bulk_done,
265 };
266 
267 struct usbd_pipe_methods ehci_device_isoc_methods = {
268 	.transfer = ehci_device_isoc_transfer,
269 	.start = ehci_device_isoc_start,
270 	.abort = ehci_device_isoc_abort,
271 	.close = ehci_device_isoc_close,
272 	.done = ehci_device_isoc_done,
273 };
274 
275 /*
276  * Reverse a number with nbits bits.  Used to evenly distribute lower-level
277  * interrupt heads in the periodic schedule.
278  * Suitable for use with EHCI_IPOLLRATES <= 9.
279  */
280 u_int8_t
281 ehci_reverse_bits(u_int8_t c, int nbits)
282 {
283 	c = ((c >> 1) & 0x55) | ((c << 1) & 0xaa);
284 	c = ((c >> 2) & 0x33) | ((c << 2) & 0xcc);
285 	c = ((c >> 4) & 0x0f) | ((c << 4) & 0xf0);
286 
287 	return c >> (8 - nbits);
288 }
289 
290 usbd_status
291 ehci_init(struct ehci_softc *sc)
292 {
293 	u_int32_t sparams, cparams, hcr;
294 	u_int i, j;
295 	usbd_status err;
296 	struct ehci_soft_qh *sqh;
297 
298 #ifdef EHCI_DEBUG
299 	u_int32_t vers;
300 	theehci = sc;
301 
302 	DPRINTF(("ehci_init: start\n"));
303 
304 	vers = EREAD2(sc, EHCI_HCIVERSION);
305 	DPRINTF(("%s: EHCI version %x.%x\n", sc->sc_bus.bdev.dv_xname,
306 	    vers >> 8, vers & 0xff));
307 #endif
308 
309 	sc->sc_offs = EREAD1(sc, EHCI_CAPLENGTH);
310 
311 	sparams = EREAD4(sc, EHCI_HCSPARAMS);
312 	DPRINTF(("ehci_init: sparams=0x%x\n", sparams));
313 	sc->sc_noport = EHCI_HCS_N_PORTS(sparams);
314 	cparams = EREAD4(sc, EHCI_HCCPARAMS);
315 	DPRINTF(("ehci_init: cparams=0x%x\n", cparams));
316 
317 	/* MUST clear segment register if 64 bit capable. */
318 	if (EHCI_HCC_64BIT(cparams))
319 		EWRITE4(sc, EHCI_CTRLDSSEGMENT, 0);
320 
321 	sc->sc_bus.usbrev = USBREV_2_0;
322 
323 	DPRINTF(("%s: resetting\n", sc->sc_bus.bdev.dv_xname));
324 	err = ehci_reset(sc);
325 	if (err)
326 		return (err);
327 
328 	if (ehcixfer == NULL) {
329 		ehcixfer = malloc(sizeof(struct pool), M_DEVBUF, M_NOWAIT);
330 		if (ehcixfer == NULL) {
331 			printf("%s: unable to allocate pool descriptor\n",
332 			    sc->sc_bus.bdev.dv_xname);
333 			return (ENOMEM);
334 		}
335 		pool_init(ehcixfer, sizeof(struct ehci_xfer), 0, 0, 0,
336 		    "ehcixfer", NULL);
337 	}
338 
339 	/* frame list size at default, read back what we got and use that */
340 	switch (EHCI_CMD_FLS(EOREAD4(sc, EHCI_USBCMD))) {
341 	case 0:
342 		sc->sc_flsize = 1024;
343 		break;
344 	case 1:
345 		sc->sc_flsize = 512;
346 		break;
347 	case 2:
348 		sc->sc_flsize = 256;
349 		break;
350 	case 3:
351 		return (USBD_IOERROR);
352 	}
353 	err = usb_allocmem(&sc->sc_bus, sc->sc_flsize * sizeof(ehci_link_t),
354 	    EHCI_FLALIGN_ALIGN, &sc->sc_fldma);
355 	if (err)
356 		return (err);
357 	DPRINTF(("%s: flsize=%d\n", sc->sc_bus.bdev.dv_xname,sc->sc_flsize));
358 	sc->sc_flist = KERNADDR(&sc->sc_fldma, 0);
359 
360 	for (i = 0; i < sc->sc_flsize; i++)
361 		sc->sc_flist[i] = htole32(EHCI_LINK_TERMINATE);
362 
363 	EOWRITE4(sc, EHCI_PERIODICLISTBASE, DMAADDR(&sc->sc_fldma, 0));
364 
365 	sc->sc_softitds = malloc(sc->sc_flsize * sizeof(struct ehci_soft_itd *),
366 	    M_USB, M_NOWAIT | M_ZERO);
367 	if (sc->sc_softitds == NULL)
368 		return (ENOMEM);
369 	LIST_INIT(&sc->sc_freeitds);
370 	TAILQ_INIT(&sc->sc_intrhead);
371 
372 	/* Set up the bus struct. */
373 	sc->sc_bus.methods = &ehci_bus_methods;
374 	sc->sc_bus.pipe_size = sizeof(struct ehci_pipe);
375 
376 	sc->sc_eintrs = EHCI_NORMAL_INTRS;
377 
378 	/*
379 	 * Allocate the interrupt dummy QHs. These are arranged to give poll
380 	 * intervals that are powers of 2 times 1ms.
381 	 */
382 	for (i = 0; i < EHCI_INTRQHS; i++) {
383 		sqh = ehci_alloc_sqh(sc);
384 		if (sqh == NULL) {
385 			err = USBD_NOMEM;
386 			goto bad1;
387 		}
388 		sc->sc_islots[i].sqh = sqh;
389 	}
390 	for (i = 0; i < EHCI_INTRQHS; i++) {
391 		sqh = sc->sc_islots[i].sqh;
392 		if (i == 0) {
393 			/* The last (1ms) QH terminates. */
394 			sqh->qh.qh_link = htole32(EHCI_LINK_TERMINATE);
395 			sqh->next = NULL;
396 		} else {
397 			/* Otherwise the next QH has half the poll interval */
398 			sqh->next = sc->sc_islots[(i + 1) / 2 - 1].sqh;
399 			sqh->qh.qh_link = htole32(sqh->next->physaddr |
400 			    EHCI_LINK_QH);
401 		}
402 		sqh->qh.qh_endp = htole32(EHCI_QH_SET_EPS(EHCI_QH_SPEED_HIGH));
403 		sqh->qh.qh_endphub = htole32(EHCI_QH_SET_MULT(1));
404 		sqh->qh.qh_curqtd = htole32(EHCI_LINK_TERMINATE);
405 		sqh->qh.qh_qtd.qtd_next = htole32(EHCI_LINK_TERMINATE);
406 		sqh->qh.qh_qtd.qtd_altnext = htole32(EHCI_LINK_TERMINATE);
407 		sqh->qh.qh_qtd.qtd_status = htole32(EHCI_QTD_HALTED);
408 		sqh->sqtd = NULL;
409 		usb_syncmem(&sqh->dma, sqh->offs, sizeof(sqh->qh),
410 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
411 	}
412 	/* Point the frame list at the last level (128ms). */
413 	for (i = 0; i < (1 << (EHCI_IPOLLRATES - 1)); i++)
414 		for (j = i; j < sc->sc_flsize; j += 1 << (EHCI_IPOLLRATES - 1))
415 			sc->sc_flist[j] = htole32(EHCI_LINK_QH | sc->sc_islots[
416 			    EHCI_IQHIDX(EHCI_IPOLLRATES - 1, ehci_reverse_bits(
417 			    i, EHCI_IPOLLRATES - 1))].sqh->physaddr);
418 	usb_syncmem(&sc->sc_fldma, 0, sc->sc_flsize * sizeof(ehci_link_t),
419 	    BUS_DMASYNC_PREWRITE);
420 
421 	/* Allocate dummy QH that starts the async list. */
422 	sqh = ehci_alloc_sqh(sc);
423 	if (sqh == NULL) {
424 		err = USBD_NOMEM;
425 		goto bad1;
426 	}
427 	/* Fill the QH */
428 	sqh->qh.qh_endp =
429 	    htole32(EHCI_QH_SET_EPS(EHCI_QH_SPEED_HIGH) | EHCI_QH_HRECL);
430 	sqh->qh.qh_link =
431 	    htole32(sqh->physaddr | EHCI_LINK_QH);
432 	sqh->qh.qh_curqtd = htole32(EHCI_LINK_TERMINATE);
433 	sqh->prev = sqh; /*It's a circular list.. */
434 	sqh->next = sqh;
435 	/* Fill the overlay qTD */
436 	sqh->qh.qh_qtd.qtd_next = htole32(EHCI_LINK_TERMINATE);
437 	sqh->qh.qh_qtd.qtd_altnext = htole32(EHCI_LINK_TERMINATE);
438 	sqh->qh.qh_qtd.qtd_status = htole32(EHCI_QTD_HALTED);
439 	sqh->sqtd = NULL;
440 	usb_syncmem(&sqh->dma, sqh->offs, sizeof(sqh->qh),
441 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
442 #ifdef EHCI_DEBUG
443 	if (ehcidebug)
444 		ehci_dump_sqh(sqh);
445 #endif
446 
447 	/* Point to async list */
448 	sc->sc_async_head = sqh;
449 	EOWRITE4(sc, EHCI_ASYNCLISTADDR, sqh->physaddr | EHCI_LINK_QH);
450 
451 	timeout_set(&sc->sc_tmo_intrlist, ehci_intrlist_timeout, sc);
452 
453 	rw_init(&sc->sc_doorbell_lock, "ehcidb");
454 
455 	/* Turn on controller */
456 	EOWRITE4(sc, EHCI_USBCMD,
457 	    EHCI_CMD_ITC_2 | /* 2 microframes interrupt delay */
458 	    (EOREAD4(sc, EHCI_USBCMD) & EHCI_CMD_FLS_M) |
459 	    EHCI_CMD_ASE |
460 	    EHCI_CMD_PSE |
461 	    EHCI_CMD_RS);
462 
463 	/* Take over port ownership */
464 	EOWRITE4(sc, EHCI_CONFIGFLAG, EHCI_CONF_CF);
465 
466 	for (i = 0; i < 100; i++) {
467 		usb_delay_ms(&sc->sc_bus, 1);
468 		hcr = EOREAD4(sc, EHCI_USBSTS) & EHCI_STS_HCH;
469 		if (!hcr)
470 			break;
471 	}
472 	if (hcr) {
473 		printf("%s: run timeout\n", sc->sc_bus.bdev.dv_xname);
474 		return (USBD_IOERROR);
475 	}
476 
477 	/* Enable interrupts */
478 	DPRINTFN(1,("ehci_init: enabling\n"));
479 	EOWRITE4(sc, EHCI_USBINTR, sc->sc_eintrs);
480 
481 	return (USBD_NORMAL_COMPLETION);
482 
483 #if 0
484  bad2:
485 	ehci_free_sqh(sc, sc->sc_async_head);
486 #endif
487  bad1:
488 	usb_freemem(&sc->sc_bus, &sc->sc_fldma);
489 	return (err);
490 }
491 
492 int
493 ehci_intr(void *v)
494 {
495 	struct ehci_softc *sc = v;
496 
497 	if (sc == NULL || sc->sc_bus.dying)
498 		return (0);
499 
500 	/* If we get an interrupt while polling, then just ignore it. */
501 	if (sc->sc_bus.use_polling) {
502 		u_int32_t intrs = EHCI_STS_INTRS(EOREAD4(sc, EHCI_USBSTS));
503 
504 		if (intrs)
505 			EOWRITE4(sc, EHCI_USBSTS, intrs); /* Acknowledge */
506 		return (0);
507 	}
508 
509 	return (ehci_intr1(sc));
510 }
511 
512 int
513 ehci_intr1(struct ehci_softc *sc)
514 {
515 	u_int32_t intrs, eintrs;
516 
517 	DPRINTFN(20,("ehci_intr1: enter\n"));
518 
519 	/* In case the interrupt occurs before initialization has completed. */
520 	if (sc == NULL) {
521 #ifdef DIAGNOSTIC
522 		printf("ehci_intr1: sc == NULL\n");
523 #endif
524 		return (0);
525 	}
526 
527 	intrs = EHCI_STS_INTRS(EOREAD4(sc, EHCI_USBSTS));
528 	if (intrs == 0xffffffff) {
529 		sc->sc_bus.dying = 1;
530 		return (0);
531 	}
532 	if (!intrs)
533 		return (0);
534 
535 	eintrs = intrs & sc->sc_eintrs;
536 	DPRINTFN(7, ("ehci_intr1: sc=%p intrs=0x%x(0x%x) eintrs=0x%x\n",
537 	     sc, (u_int)intrs, EOREAD4(sc, EHCI_USBSTS), (u_int)eintrs));
538 	if (!eintrs)
539 		return (0);
540 
541 	EOWRITE4(sc, EHCI_USBSTS, intrs); /* Acknowledge */
542 	sc->sc_bus.intr_context++;
543 	sc->sc_bus.no_intrs++;
544 	if (eintrs & EHCI_STS_HSE) {
545 		printf("%s: unrecoverable error, controller halted\n",
546 		       sc->sc_bus.bdev.dv_xname);
547 		sc->sc_bus.dying = 1;
548 		sc->sc_bus.intr_context--;
549 		return (1);
550 	}
551 	if (eintrs & EHCI_STS_IAA) {
552 		DPRINTF(("ehci_intr1: door bell\n"));
553 		wakeup(&sc->sc_async_head);
554 		eintrs &= ~EHCI_STS_IAA;
555 	}
556 	if (eintrs & (EHCI_STS_INT | EHCI_STS_ERRINT)) {
557 		DPRINTFN(5,("ehci_intr1: %s %s\n",
558 			    eintrs & EHCI_STS_INT ? "INT" : "",
559 			    eintrs & EHCI_STS_ERRINT ? "ERRINT" : ""));
560 		usb_schedsoftintr(&sc->sc_bus);
561 		eintrs &= ~(EHCI_STS_INT | EHCI_STS_ERRINT);
562 	}
563 	if (eintrs & EHCI_STS_PCD) {
564 		ehci_pcd(sc, sc->sc_intrxfer);
565 		eintrs &= ~EHCI_STS_PCD;
566 	}
567 
568 	sc->sc_bus.intr_context--;
569 
570 	if (eintrs != 0) {
571 		/* Block unprocessed interrupts. */
572 		sc->sc_eintrs &= ~eintrs;
573 		EOWRITE4(sc, EHCI_USBINTR, sc->sc_eintrs);
574 		printf("%s: blocking intrs 0x%x\n",
575 		       sc->sc_bus.bdev.dv_xname, eintrs);
576 	}
577 
578 	return (1);
579 }
580 
581 void
582 ehci_pcd(struct ehci_softc *sc, struct usbd_xfer *xfer)
583 {
584 	u_char *p;
585 	int i, m;
586 
587 	if (xfer == NULL) {
588 		/* Just ignore the change. */
589 		return;
590 	}
591 
592 	p = KERNADDR(&xfer->dmabuf, 0);
593 	m = min(sc->sc_noport, xfer->length * 8 - 1);
594 	memset(p, 0, xfer->length);
595 	for (i = 1; i <= m; i++) {
596 		/* Pick out CHANGE bits from the status reg. */
597 		if (EOREAD4(sc, EHCI_PORTSC(i)) & EHCI_PS_CLEAR)
598 			p[i/8] |= 1 << (i%8);
599 	}
600 	DPRINTF(("ehci_pcd: change=0x%02x\n", *p));
601 	xfer->actlen = xfer->length;
602 	xfer->status = USBD_NORMAL_COMPLETION;
603 
604 	usb_transfer_complete(xfer);
605 }
606 
607 void
608 ehci_softintr(void *v)
609 {
610 	struct ehci_softc *sc = v;
611 	struct ehci_xfer *ex, *nextex;
612 
613 	DPRINTFN(10,("%s: ehci_softintr (%d)\n", sc->sc_bus.bdev.dv_xname,
614 		     sc->sc_bus.intr_context));
615 
616 	if (sc->sc_bus.dying)
617 		return;
618 
619 	sc->sc_bus.intr_context++;
620 
621 	/*
622 	 * The only explanation I can think of for why EHCI is as brain dead
623 	 * as UHCI interrupt-wise is that Intel was involved in both.
624 	 * An interrupt just tells us that something is done, we have no
625 	 * clue what, so we need to scan through all active transfers. :-(
626 	 */
627 	for (ex = TAILQ_FIRST(&sc->sc_intrhead); ex; ex = nextex) {
628 		nextex = TAILQ_NEXT(ex, inext);
629 		ehci_check_intr(sc, &ex->xfer);
630 	}
631 
632 	/* Schedule a callout to catch any dropped transactions. */
633 	if ((sc->sc_flags & EHCIF_DROPPED_INTR_WORKAROUND) &&
634 	    !TAILQ_EMPTY(&sc->sc_intrhead)) {
635 		timeout_add_sec(&sc->sc_tmo_intrlist, 1);
636 	}
637 
638 	if (sc->sc_softwake) {
639 		sc->sc_softwake = 0;
640 		wakeup(&sc->sc_softwake);
641 	}
642 
643 	sc->sc_bus.intr_context--;
644 }
645 
646 /* Check for an interrupt. */
647 void
648 ehci_check_intr(struct ehci_softc *sc, struct usbd_xfer *xfer)
649 {
650 	int attr;
651 
652 	DPRINTFN(2, ("%s: xfer=%p\n", __func__, xfer));
653 
654 	attr = xfer->pipe->endpoint->edesc->bmAttributes;
655 	if (UE_GET_XFERTYPE(attr) == UE_ISOCHRONOUS)
656 		ehci_check_itd_intr(sc, xfer);
657 	else
658 		ehci_check_qh_intr(sc, xfer);
659 
660 	return;
661 }
662 
663 void
664 ehci_check_qh_intr(struct ehci_softc *sc, struct usbd_xfer *xfer)
665 {
666 	struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
667 	struct ehci_soft_qtd *sqtd, *lsqtd;
668 	uint32_t status;
669 
670 	if (ex->sqtdstart == NULL) {
671 		printf("ehci_check_qh_intr: not valid sqtd\n");
672 		return;
673 	}
674 
675 	lsqtd = ex->sqtdend;
676 #ifdef DIAGNOSTIC
677 	if (lsqtd == NULL) {
678 		printf("ehci_check_qh_intr: lsqtd==0\n");
679 		return;
680 	}
681 #endif
682 	/*
683 	 * If the last TD is still active we need to check whether there
684 	 * is a an error somewhere in the middle, or whether there was a
685 	 * short packet (SPD and not ACTIVE).
686 	 */
687 	usb_syncmem(&lsqtd->dma,
688 	    lsqtd->offs + offsetof(struct ehci_qtd, qtd_status),
689 	    sizeof(lsqtd->qtd.qtd_status),
690 	    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
691 	if (letoh32(lsqtd->qtd.qtd_status) & EHCI_QTD_ACTIVE) {
692 		DPRINTFN(12, ("ehci_check_intr: active ex=%p\n", ex));
693 		for (sqtd = ex->sqtdstart; sqtd != lsqtd; sqtd=sqtd->nextqtd) {
694 			usb_syncmem(&sqtd->dma,
695 			    sqtd->offs + offsetof(struct ehci_qtd, qtd_status),
696 			    sizeof(sqtd->qtd.qtd_status),
697 			    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
698 			status = letoh32(sqtd->qtd.qtd_status);
699 			usb_syncmem(&sqtd->dma,
700 			    sqtd->offs + offsetof(struct ehci_qtd, qtd_status),
701 			    sizeof(sqtd->qtd.qtd_status), BUS_DMASYNC_PREREAD);
702 			/* If there's an active QTD the xfer isn't done. */
703 			if (status & EHCI_QTD_ACTIVE)
704 				break;
705 			/* Any kind of error makes the xfer done. */
706 			if (status & EHCI_QTD_HALTED)
707 				goto done;
708 			/* We want short packets, and it is short: it's done */
709 			if (EHCI_QTD_GET_BYTES(status) != 0)
710 				goto done;
711 		}
712 		DPRINTFN(12, ("ehci_check_intr: ex=%p std=%p still active\n",
713 			      ex, ex->sqtdstart));
714 		usb_syncmem(&lsqtd->dma,
715 		    lsqtd->offs + offsetof(struct ehci_qtd, qtd_status),
716 		    sizeof(lsqtd->qtd.qtd_status), BUS_DMASYNC_PREREAD);
717 		return;
718 	}
719  done:
720 	DPRINTFN(12, ("ehci_check_intr: ex=%p done\n", ex));
721 	timeout_del(&xfer->timeout_handle);
722 	usb_rem_task(xfer->pipe->device, &xfer->abort_task);
723 	ehci_idone(xfer);
724 }
725 
726 void
727 ehci_check_itd_intr(struct ehci_softc *sc, struct usbd_xfer *xfer)
728 {
729 	struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
730 	struct ehci_soft_itd *itd;
731 	int i;
732 
733 	if (xfer != SIMPLEQ_FIRST(&xfer->pipe->queue))
734 		return;
735 
736 	if (ex->itdstart == NULL) {
737 		printf("ehci_check_itd_intr: not valid itd\n");
738 		return;
739 	}
740 
741 	itd = ex->itdend;
742 #ifdef DIAGNOSTIC
743 	if (itd == NULL) {
744 		printf("ehci_check_itd_intr: itdend == 0\n");
745 		return;
746 	}
747 #endif
748 
749 	/*
750 	 * check no active transfers in last itd, meaning we're finished
751 	 */
752 
753 	usb_syncmem(&itd->dma, itd->offs + offsetof(struct ehci_itd, itd_ctl),
754 	    sizeof(itd->itd.itd_ctl), BUS_DMASYNC_POSTWRITE |
755 	    BUS_DMASYNC_POSTREAD);
756 
757 	for (i = 0; i < 8; i++) {
758 		if (letoh32(itd->itd.itd_ctl[i]) & EHCI_ITD_ACTIVE)
759 			break;
760 	}
761 
762 	if (i == 8) {
763 		goto done; /* All 8 descriptors inactive, it's done */
764 	}
765 
766 	DPRINTFN(12, ("ehci_check_itd_intr: ex %p itd %p still active\n", ex,
767 	    ex->itdstart));
768 	return;
769 done:
770 	DPRINTFN(12, ("ehci_check_itd_intr: ex=%p done\n", ex));
771 	timeout_del(&xfer->timeout_handle);
772 	usb_rem_task(xfer->pipe->device, &xfer->abort_task);
773 	ehci_idone(xfer);
774 }
775 
776 void
777 ehci_idone(struct usbd_xfer *xfer)
778 {
779 	struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
780 #ifdef EHCI_DEBUG
781 	struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
782 #endif
783 	struct ehci_soft_qtd *sqtd;
784 	u_int32_t status = 0, nstatus = 0;
785 	int actlen, cerr;
786 
787 	DPRINTFN(/*12*/2, ("ehci_idone: ex=%p\n", ex));
788 #ifdef DIAGNOSTIC
789 	{
790 		int s = splhigh();
791 		if (ex->isdone) {
792 			splx(s);
793 #ifdef EHCI_DEBUG
794 			printf("ehci_idone: ex is done!\n   ");
795 			ehci_dump_exfer(ex);
796 #else
797 			printf("ehci_idone: ex=%p is done!\n", ex);
798 #endif
799 			return;
800 		}
801 		ex->isdone = 1;
802 		splx(s);
803 	}
804 #endif
805 	if (xfer->status == USBD_CANCELLED ||
806 	    xfer->status == USBD_TIMEOUT) {
807 		DPRINTF(("ehci_idone: aborted xfer=%p\n", xfer));
808 		return;
809 	}
810 
811 #ifdef EHCI_DEBUG
812 	DPRINTFN(/*10*/2, ("ehci_idone: xfer=%p, pipe=%p ready\n", xfer, epipe));
813 	if (ehcidebug > 10)
814 		ehci_dump_sqtds(ex->sqtdstart);
815 #endif
816 
817 	/* The transfer is done, compute actual length and status. */
818 
819 	if (UE_GET_XFERTYPE(xfer->pipe->endpoint->edesc->bmAttributes)
820 	    == UE_ISOCHRONOUS) {
821 		/* Isoc transfer */
822 		struct ehci_soft_itd *itd;
823 		int i, nframes, len, uframes;
824 
825 		nframes = 0;
826 		actlen = 0;
827 
828 		switch (xfer->pipe->endpoint->edesc->bInterval) {
829 		case 0:
830 			panic("ehci: isoc xfer suddenly has 0 bInterval, "
831 			    "invalid");
832 		case 1:
833 			uframes = 1;
834 			break;
835 		case 2:
836 			uframes = 2;
837 			break;
838 		case 3:
839 			uframes = 4;
840 			break;
841 		default:
842 			uframes = 8;
843 			break;
844 		}
845 
846 		for (itd = ex->itdstart; itd != NULL; itd = itd->xfer_next) {
847 			usb_syncmem(&itd->dma,
848 			    itd->offs + offsetof(struct ehci_itd, itd_ctl),
849 			    sizeof(itd->itd.itd_ctl), BUS_DMASYNC_POSTWRITE |
850 			    BUS_DMASYNC_POSTREAD);
851 
852 			for (i = 0; i < 8; i += uframes) {
853 				/* XXX - driver didn't fill in the frame full
854 				 *   of uframes. This leads to scheduling
855 				 *   inefficiencies, but working around
856 				 *   this doubles complexity of tracking
857 				 *   an xfer.
858 				 */
859 				if (nframes >= xfer->nframes)
860 					break;
861 
862 				status = letoh32(itd->itd.itd_ctl[i]);
863 				len = EHCI_ITD_GET_LEN(status);
864 				if (EHCI_ITD_GET_STATUS(status) != 0)
865 					len = 0; /*No valid data on error*/
866 
867 				xfer->frlengths[nframes++] = len;
868 				actlen += len;
869 			}
870 
871 			if (nframes >= xfer->nframes)
872 				break;
873 		}
874 
875 		xfer->actlen = actlen;
876 		xfer->status = USBD_NORMAL_COMPLETION;
877 
878 		goto end;
879 	}
880 
881 	/* Continue processing xfers using queue heads */
882 
883 	actlen = 0;
884 	for (sqtd = ex->sqtdstart; sqtd != NULL; sqtd = sqtd->nextqtd) {
885 		usb_syncmem(&sqtd->dma, sqtd->offs, sizeof(sqtd->qtd),
886 		    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
887 		nstatus = letoh32(sqtd->qtd.qtd_status);
888 		if (nstatus & EHCI_QTD_ACTIVE)
889 			break;
890 
891 		status = nstatus;
892 		/* halt is ok if descriptor is last, and complete */
893 		if (sqtd->qtd.qtd_next == htole32(EHCI_LINK_TERMINATE) &&
894 		    EHCI_QTD_GET_BYTES(status) == 0)
895 			status &= ~EHCI_QTD_HALTED;
896 		if (EHCI_QTD_GET_PID(status) !=	EHCI_QTD_PID_SETUP)
897 			actlen += sqtd->len - EHCI_QTD_GET_BYTES(status);
898 	}
899 
900 	cerr = EHCI_QTD_GET_CERR(status);
901 	DPRINTFN(/*10*/2, ("ehci_idone: len=%d, actlen=%d, cerr=%d, "
902 	    "status=0x%x\n", xfer->length, actlen, cerr, status));
903 	xfer->actlen = actlen;
904 	if ((status & EHCI_QTD_HALTED) != 0) {
905 #ifdef EHCI_DEBUG
906 		char sbuf[128];
907 
908 		bitmask_snprintf((u_int32_t)status,
909 		    "\20\7HALTED\6BUFERR\5BABBLE\4XACTERR"
910 		    "\3MISSED\2SPLIT\1PING", sbuf, sizeof(sbuf));
911 
912 		DPRINTFN(2,
913 			 ("ehci_idone: error, addr=%d, endpt=0x%02x, "
914 			  "status 0x%s\n",
915 			  xfer->device->address,
916 			  xfer->pipe->endpoint->edesc->bEndpointAddress,
917 			  sbuf));
918 		if (ehcidebug > 2) {
919 			ehci_dump_sqh(epipe->sqh);
920 			ehci_dump_sqtds(ex->sqtdstart);
921 		}
922 #endif
923 		if ((status & EHCI_QTD_BABBLE) == 0 && cerr > 0)
924 			xfer->status = USBD_STALLED;
925 		else
926 			xfer->status = USBD_IOERROR; /* more info XXX */
927 	} else
928 		xfer->status = USBD_NORMAL_COMPLETION;
929 	end:
930 	/* XXX transfer_complete memcpys out transfer data (for in endpoints)
931 	 * during this call, before methods->done is called: dma sync required
932 	 * beforehand? */
933 	usb_transfer_complete(xfer);
934 	DPRINTFN(/*12*/2, ("ehci_idone: ex=%p done\n", ex));
935 }
936 
937 /*
938  * Wait here until controller claims to have an interrupt.
939  * Then call ehci_intr and return.  Use timeout to avoid waiting
940  * too long.
941  */
942 void
943 ehci_waitintr(struct ehci_softc *sc, struct usbd_xfer *xfer)
944 {
945 	int timo;
946 	u_int32_t intrs;
947 
948 	xfer->status = USBD_IN_PROGRESS;
949 	for (timo = xfer->timeout; timo >= 0; timo--) {
950 		usb_delay_ms(&sc->sc_bus, 1);
951 		if (sc->sc_bus.dying)
952 			break;
953 		intrs = EHCI_STS_INTRS(EOREAD4(sc, EHCI_USBSTS)) &
954 			sc->sc_eintrs;
955 		DPRINTFN(15,("ehci_waitintr: 0x%04x\n", intrs));
956 #ifdef EHCI_DEBUG
957 		if (ehcidebug > 15)
958 			ehci_dump_regs(sc);
959 #endif
960 		if (intrs) {
961 			ehci_intr1(sc);
962 			if (xfer->status != USBD_IN_PROGRESS)
963 				return;
964 		}
965 	}
966 
967 	/* Timeout */
968 	DPRINTF(("ehci_waitintr: timeout\n"));
969 	xfer->status = USBD_TIMEOUT;
970 	usb_transfer_complete(xfer);
971 	/* XXX should free TD */
972 }
973 
974 void
975 ehci_poll(struct usbd_bus *bus)
976 {
977 	struct ehci_softc *sc = (struct ehci_softc *)bus;
978 #ifdef EHCI_DEBUG
979 	static int last;
980 	int new;
981 	new = EHCI_STS_INTRS(EOREAD4(sc, EHCI_USBSTS));
982 	if (new != last) {
983 		DPRINTFN(10,("ehci_poll: intrs=0x%04x\n", new));
984 		last = new;
985 	}
986 #endif
987 
988 	if (EOREAD4(sc, EHCI_USBSTS) & sc->sc_eintrs)
989 		ehci_intr1(sc);
990 }
991 
992 int
993 ehci_detach(struct device *self, int flags)
994 {
995 	struct ehci_softc *sc = (struct ehci_softc *)self;
996 	int rv;
997 
998 	rv = config_detach_children(self, flags);
999 	if (rv != 0)
1000 		return (rv);
1001 
1002 	timeout_del(&sc->sc_tmo_intrlist);
1003 
1004 	ehci_reset(sc);
1005 
1006 	usb_delay_ms(&sc->sc_bus, 300); /* XXX let stray task complete */
1007 
1008 	/* XXX free other data structures XXX */
1009 
1010 	return (rv);
1011 }
1012 
1013 
1014 int
1015 ehci_activate(struct device *self, int act)
1016 {
1017 	struct ehci_softc *sc = (struct ehci_softc *)self;
1018 	u_int32_t cmd, hcr, cparams;
1019 	int i, rv = 0;
1020 
1021 	switch (act) {
1022 	case DVACT_SUSPEND:
1023 		rv = config_activate_children(self, act);
1024 		sc->sc_bus.use_polling++;
1025 
1026 		for (i = 1; i <= sc->sc_noport; i++) {
1027 			cmd = EOREAD4(sc, EHCI_PORTSC(i));
1028 			if ((cmd & (EHCI_PS_PO|EHCI_PS_PE)) == EHCI_PS_PE)
1029 				EOWRITE4(sc, EHCI_PORTSC(i),
1030 				    cmd | EHCI_PS_SUSP);
1031 		}
1032 
1033 		/*
1034 		 * First tell the host to stop processing Asynchronous
1035 		 * and Periodic schedules.
1036 		 */
1037 		cmd = EOREAD4(sc, EHCI_USBCMD) & ~(EHCI_CMD_ASE | EHCI_CMD_PSE);
1038 		EOWRITE4(sc, EHCI_USBCMD, cmd);
1039 		for (i = 0; i < 100; i++) {
1040 			usb_delay_ms(&sc->sc_bus, 1);
1041 			hcr = EOREAD4(sc, EHCI_USBSTS) &
1042 			    (EHCI_STS_ASS | EHCI_STS_PSS);
1043 			if (hcr == 0)
1044 				break;
1045 		}
1046 		if (hcr != 0)
1047 			printf("%s: disable schedules timeout\n",
1048 			    sc->sc_bus.bdev.dv_xname);
1049 
1050 		/*
1051 		 * Then reset the host as if it was a shutdown.
1052 		 *
1053 		 * All USB devices are disconnected/reconnected during
1054 		 * a suspend/resume cycle so keep it simple.
1055 		 */
1056 		ehci_reset(sc);
1057 
1058 		sc->sc_bus.use_polling--;
1059 		break;
1060 	case DVACT_RESUME:
1061 		sc->sc_bus.use_polling++;
1062 
1063 		ehci_reset(sc);
1064 
1065 		cparams = EREAD4(sc, EHCI_HCCPARAMS);
1066 		/* MUST clear segment register if 64 bit capable. */
1067 		if (EHCI_HCC_64BIT(cparams))
1068 			EWRITE4(sc, EHCI_CTRLDSSEGMENT, 0);
1069 
1070 		EOWRITE4(sc, EHCI_PERIODICLISTBASE, DMAADDR(&sc->sc_fldma, 0));
1071 		EOWRITE4(sc, EHCI_ASYNCLISTADDR,
1072 	  	    sc->sc_async_head->physaddr | EHCI_LINK_QH);
1073 
1074 		hcr = 0;
1075 		for (i = 1; i <= sc->sc_noport; i++) {
1076 			cmd = EOREAD4(sc, EHCI_PORTSC(i));
1077 			if ((cmd & (EHCI_PS_PO|EHCI_PS_SUSP)) == EHCI_PS_SUSP) {
1078 				EOWRITE4(sc, EHCI_PORTSC(i), cmd | EHCI_PS_FPR);
1079 				hcr = 1;
1080 			}
1081 		}
1082 
1083 		if (hcr) {
1084 			usb_delay_ms(&sc->sc_bus, USB_RESUME_WAIT);
1085 			for (i = 1; i <= sc->sc_noport; i++) {
1086 				cmd = EOREAD4(sc, EHCI_PORTSC(i));
1087 				if ((cmd & (EHCI_PS_PO|EHCI_PS_SUSP)) ==
1088 				   EHCI_PS_SUSP)
1089 					EOWRITE4(sc, EHCI_PORTSC(i),
1090 					   cmd & ~EHCI_PS_FPR);
1091 			}
1092 		}
1093 
1094 		/* Turn on controller */
1095 		EOWRITE4(sc, EHCI_USBCMD,
1096 		    EHCI_CMD_ITC_2 | /* 2 microframes interrupt delay */
1097 		    (EOREAD4(sc, EHCI_USBCMD) & EHCI_CMD_FLS_M) |
1098 		    EHCI_CMD_ASE |
1099 		    EHCI_CMD_PSE |
1100 		    EHCI_CMD_RS);
1101 
1102 		/* Take over port ownership */
1103 		EOWRITE4(sc, EHCI_CONFIGFLAG, EHCI_CONF_CF);
1104 		for (i = 0; i < 100; i++) {
1105 			usb_delay_ms(&sc->sc_bus, 1);
1106 			hcr = EOREAD4(sc, EHCI_USBSTS) & EHCI_STS_HCH;
1107 			if (!hcr)
1108 				break;
1109 		}
1110 
1111 		if (hcr) {
1112 			printf("%s: run timeout\n", sc->sc_bus.bdev.dv_xname);
1113 			/* XXX should we bail here? */
1114 		}
1115 
1116 		EOWRITE4(sc, EHCI_USBINTR, sc->sc_eintrs);
1117 
1118 		usb_delay_ms(&sc->sc_bus, USB_RESUME_WAIT);
1119 
1120 		sc->sc_bus.use_polling--;
1121 		rv = config_activate_children(self, act);
1122 		break;
1123 	case DVACT_POWERDOWN:
1124 		rv = config_activate_children(self, act);
1125 		ehci_reset(sc);
1126 		break;
1127 	default:
1128 		rv = config_activate_children(self, act);
1129 		break;
1130 	}
1131 	return (rv);
1132 }
1133 
1134 usbd_status
1135 ehci_reset(struct ehci_softc *sc)
1136 {
1137 	u_int32_t hcr;
1138 	int i;
1139 
1140 	DPRINTF(("%s: stopping the HC\n", __func__));
1141 	EOWRITE4(sc, EHCI_USBCMD, 0);	/* Halt controller */
1142 	for (i = 0; i < 100; i++) {
1143 		usb_delay_ms(&sc->sc_bus, 1);
1144 		hcr = EOREAD4(sc, EHCI_USBSTS) & EHCI_STS_HCH;
1145 		if (hcr)
1146 			break;
1147 	}
1148 
1149 	if (!hcr)
1150 		printf("%s: halt timeout\n", sc->sc_bus.bdev.dv_xname);
1151 
1152 	EOWRITE4(sc, EHCI_USBCMD, EHCI_CMD_HCRESET);
1153 	for (i = 0; i < 100; i++) {
1154 		usb_delay_ms(&sc->sc_bus, 1);
1155 		hcr = EOREAD4(sc, EHCI_USBCMD) & EHCI_CMD_HCRESET;
1156 		if (!hcr)
1157 			break;
1158 	}
1159 
1160 	if (hcr) {
1161 		printf("%s: reset timeout\n", sc->sc_bus.bdev.dv_xname);
1162 		return (USBD_IOERROR);
1163 	}
1164 
1165 	return (USBD_NORMAL_COMPLETION);
1166 }
1167 
1168 struct usbd_xfer *
1169 ehci_allocx(struct usbd_bus *bus)
1170 {
1171 	struct ehci_xfer *ex;
1172 
1173 	ex = pool_get(ehcixfer, PR_NOWAIT | PR_ZERO);
1174 #ifdef DIAGNOSTIC
1175 	if (ex != NULL) {
1176 		ex->isdone = 1;
1177 		ex->xfer.busy_free = XFER_BUSY;
1178 	}
1179 #endif
1180 	return ((struct usbd_xfer *)ex);
1181 }
1182 
1183 void
1184 ehci_freex(struct usbd_bus *bus, struct usbd_xfer *xfer)
1185 {
1186 	struct ehci_xfer *ex = (struct ehci_xfer*)xfer;
1187 
1188 #ifdef DIAGNOSTIC
1189 	if (xfer->busy_free != XFER_BUSY) {
1190 		printf("%s: xfer=%p not busy, 0x%08x\n", __func__, xfer,
1191 		    xfer->busy_free);
1192 		return;
1193 	}
1194 	if (!ex->isdone) {
1195 		printf("%s: !isdone\n", __func__);
1196 		return;
1197 	}
1198 #endif
1199 	pool_put(ehcixfer, ex);
1200 }
1201 
1202 void
1203 ehci_device_clear_toggle(struct usbd_pipe *pipe)
1204 {
1205 	struct ehci_pipe *epipe = (struct ehci_pipe *)pipe;
1206 
1207 	DPRINTF(("ehci_device_clear_toggle: epipe=%p status=0x%x\n",
1208 	    epipe, epipe->sqh->qh.qh_qtd.qtd_status));
1209 #if defined(EHCI_DEBUG) && defined(USB_DEBUG)
1210 	if (ehcidebug)
1211 		usbd_dump_pipe(pipe);
1212 #endif
1213 #ifdef DIAGNOSTIC
1214 	if ((epipe->sqh->qh.qh_qtd.qtd_status & htole32(EHCI_QTD_ACTIVE)) != 0)
1215 		panic("ehci_device_clear_toggle: queue active");
1216 #endif
1217 	epipe->sqh->qh.qh_qtd.qtd_status &= htole32(~EHCI_QTD_TOGGLE_MASK);
1218 }
1219 
1220 #ifdef EHCI_DEBUG
1221 void
1222 ehci_dump_regs(struct ehci_softc *sc)
1223 {
1224 	int i;
1225 
1226 	printf("cmd=0x%08x, sts=0x%08x, ien=0x%08x\n",
1227 	    EOREAD4(sc, EHCI_USBCMD),
1228 	    EOREAD4(sc, EHCI_USBSTS),
1229 	    EOREAD4(sc, EHCI_USBINTR));
1230 	printf("frindex=0x%08x ctrdsegm=0x%08x periodic=0x%08x async=0x%08x\n",
1231 	    EOREAD4(sc, EHCI_FRINDEX),
1232 	    EOREAD4(sc, EHCI_CTRLDSSEGMENT),
1233 	    EOREAD4(sc, EHCI_PERIODICLISTBASE),
1234 	    EOREAD4(sc, EHCI_ASYNCLISTADDR));
1235 	for (i = 1; i <= sc->sc_noport; i++)
1236 		printf("port %d status=0x%08x\n", i,
1237 		    EOREAD4(sc, EHCI_PORTSC(i)));
1238 }
1239 
1240 /*
1241  * Unused function - this is meant to be called from a kernel
1242  * debugger.
1243  */
1244 void
1245 ehci_dump(void)
1246 {
1247 	ehci_dump_regs(theehci);
1248 }
1249 
1250 void
1251 ehci_dump_link(ehci_link_t link, int type)
1252 {
1253 	link = letoh32(link);
1254 	printf("0x%08x", link);
1255 	if (link & EHCI_LINK_TERMINATE)
1256 		printf("<T>");
1257 	else {
1258 		printf("<");
1259 		if (type) {
1260 			switch (EHCI_LINK_TYPE(link)) {
1261 			case EHCI_LINK_ITD:
1262 				printf("ITD");
1263 				break;
1264 			case EHCI_LINK_QH:
1265 				printf("QH");
1266 				break;
1267 			case EHCI_LINK_SITD:
1268 				printf("SITD");
1269 				break;
1270 			case EHCI_LINK_FSTN:
1271 				printf("FSTN");
1272 				break;
1273 			}
1274 		}
1275 		printf(">");
1276 	}
1277 }
1278 
1279 void
1280 ehci_dump_sqtds(struct ehci_soft_qtd *sqtd)
1281 {
1282 	int i;
1283 	u_int32_t stop;
1284 
1285 	stop = 0;
1286 	for (i = 0; sqtd && i < 20 && !stop; sqtd = sqtd->nextqtd, i++) {
1287 		ehci_dump_sqtd(sqtd);
1288 		usb_syncmem(&sqtd->dma,
1289 		    sqtd->offs + offsetof(struct ehci_qtd, qtd_next),
1290 		    sizeof(sqtd->qtd),
1291 		    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
1292 		stop = sqtd->qtd.qtd_next & htole32(EHCI_LINK_TERMINATE);
1293 		usb_syncmem(&sqtd->dma,
1294 		    sqtd->offs + offsetof(struct ehci_qtd, qtd_next),
1295 		    sizeof(sqtd->qtd), BUS_DMASYNC_PREREAD);
1296 	}
1297 	if (!stop)
1298 		printf("dump aborted, too many TDs\n");
1299 }
1300 
1301 void
1302 ehci_dump_sqtd(struct ehci_soft_qtd *sqtd)
1303 {
1304 	usb_syncmem(&sqtd->dma, sqtd->offs,
1305 	    sizeof(sqtd->qtd), BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
1306 	printf("QTD(%p) at 0x%08x:\n", sqtd, sqtd->physaddr);
1307 	ehci_dump_qtd(&sqtd->qtd);
1308 	usb_syncmem(&sqtd->dma, sqtd->offs,
1309 	    sizeof(sqtd->qtd), BUS_DMASYNC_PREREAD);
1310 }
1311 
1312 void
1313 ehci_dump_qtd(struct ehci_qtd *qtd)
1314 {
1315 	u_int32_t s;
1316 	char sbuf[128];
1317 
1318 	printf("  next="); ehci_dump_link(qtd->qtd_next, 0);
1319 	printf(" altnext="); ehci_dump_link(qtd->qtd_altnext, 0);
1320 	printf("\n");
1321 	s = letoh32(qtd->qtd_status);
1322 	bitmask_snprintf(EHCI_QTD_GET_STATUS(s), "\20\10ACTIVE\7HALTED"
1323 	    "\6BUFERR\5BABBLE\4XACTERR\3MISSED\2SPLIT\1PING",
1324 	    sbuf, sizeof(sbuf));
1325 	printf("  status=0x%08x: toggle=%d bytes=0x%x ioc=%d c_page=0x%x\n",
1326 	    s, EHCI_QTD_GET_TOGGLE(s), EHCI_QTD_GET_BYTES(s),
1327 	    EHCI_QTD_GET_IOC(s), EHCI_QTD_GET_C_PAGE(s));
1328 	printf("    cerr=%d pid=%d stat=0x%s\n", EHCI_QTD_GET_CERR(s),
1329 	    EHCI_QTD_GET_PID(s), sbuf);
1330 	for (s = 0; s < 5; s++)
1331 		printf("  buffer[%d]=0x%08x\n", s, letoh32(qtd->qtd_buffer[s]));
1332 }
1333 
1334 void
1335 ehci_dump_sqh(struct ehci_soft_qh *sqh)
1336 {
1337 	struct ehci_qh *qh = &sqh->qh;
1338 	u_int32_t endp, endphub;
1339 
1340 	usb_syncmem(&sqh->dma, sqh->offs,
1341 	    sizeof(sqh->qh), BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
1342 	printf("QH(%p) at 0x%08x:\n", sqh, sqh->physaddr);
1343 	printf("  link="); ehci_dump_link(qh->qh_link, 1); printf("\n");
1344 	endp = letoh32(qh->qh_endp);
1345 	printf("  endp=0x%08x\n", endp);
1346 	printf("    addr=0x%02x inact=%d endpt=%d eps=%d dtc=%d hrecl=%d\n",
1347 	    EHCI_QH_GET_ADDR(endp), EHCI_QH_GET_INACT(endp),
1348 	    EHCI_QH_GET_ENDPT(endp),  EHCI_QH_GET_EPS(endp),
1349 	    EHCI_QH_GET_DTC(endp), EHCI_QH_GET_HRECL(endp));
1350 	printf("    mpl=0x%x ctl=%d nrl=%d\n",
1351 	    EHCI_QH_GET_MPL(endp), EHCI_QH_GET_CTL(endp),
1352 	    EHCI_QH_GET_NRL(endp));
1353 	endphub = letoh32(qh->qh_endphub);
1354 	printf("  endphub=0x%08x\n", endphub);
1355 	printf("    smask=0x%02x cmask=0x%02x huba=0x%02x port=%d mult=%d\n",
1356 	    EHCI_QH_GET_SMASK(endphub), EHCI_QH_GET_CMASK(endphub),
1357 	    EHCI_QH_GET_HUBA(endphub), EHCI_QH_GET_PORT(endphub),
1358 	    EHCI_QH_GET_MULT(endphub));
1359 	printf("  curqtd="); ehci_dump_link(qh->qh_curqtd, 0); printf("\n");
1360 	printf("Overlay qTD:\n");
1361 	ehci_dump_qtd(&qh->qh_qtd);
1362 	usb_syncmem(&sqh->dma, sqh->offs,
1363 	    sizeof(sqh->qh), BUS_DMASYNC_PREREAD);
1364 }
1365 
1366 #if notyet
1367 void
1368 ehci_dump_itd(struct ehci_soft_itd *itd)
1369 {
1370 	ehci_isoc_trans_t t;
1371 	ehci_isoc_bufr_ptr_t b, b2, b3;
1372 	int i;
1373 
1374 	printf("ITD: next phys=%X\n", itd->itd.itd_next);
1375 
1376 	for (i = 0; i < 8;i++) {
1377 		t = letoh32(itd->itd.itd_ctl[i]);
1378 		printf("ITDctl %d: stat=%X len=%X ioc=%X pg=%X offs=%X\n", i,
1379 		    EHCI_ITD_GET_STATUS(t), EHCI_ITD_GET_LEN(t),
1380 		    EHCI_ITD_GET_IOC(t), EHCI_ITD_GET_PG(t),
1381 		    EHCI_ITD_GET_OFFS(t));
1382 	}
1383 	printf("ITDbufr: ");
1384 	for (i = 0; i < 7; i++)
1385 		printf("%X,", EHCI_ITD_GET_BPTR(letoh32(itd->itd.itd_bufr[i])));
1386 
1387 	b = letoh32(itd->itd.itd_bufr[0]);
1388 	b2 = letoh32(itd->itd.itd_bufr[1]);
1389 	b3 = letoh32(itd->itd.itd_bufr[2]);
1390 	printf("\nep=%X daddr=%X dir=%d maxpkt=%X multi=%X\n",
1391 	    EHCI_ITD_GET_EP(b), EHCI_ITD_GET_DADDR(b), EHCI_ITD_GET_DIR(b2),
1392 	    EHCI_ITD_GET_MAXPKT(b2), EHCI_ITD_GET_MULTI(b3));
1393 }
1394 
1395 void
1396 ehci_dump_sitd(struct ehci_soft_itd *itd)
1397 {
1398 	printf("SITD %p next=%p prev=%p xfernext=%p physaddr=%X slot=%d\n",
1399 	    itd, itd->u.frame_list.next, itd->u.frame_list.prev,
1400 	    itd->xfer_next, itd->physaddr, itd->slot);
1401 }
1402 #endif
1403 
1404 #ifdef DIAGNOSTIC
1405 void
1406 ehci_dump_exfer(struct ehci_xfer *ex)
1407 {
1408 	printf("ehci_dump_exfer: ex=%p sqtdstart=%p end=%p itdstart=%p end=%p "
1409 	    "isdone=%d\n", ex, ex->sqtdstart, ex->sqtdend, ex->itdstart,
1410 	    ex->itdend, ex->isdone);
1411 }
1412 #endif
1413 
1414 #endif /* EHCI_DEBUG */
1415 
1416 usbd_status
1417 ehci_open(struct usbd_pipe *pipe)
1418 {
1419 	struct usbd_device *dev = pipe->device;
1420 	struct ehci_softc *sc = (struct ehci_softc *)dev->bus;
1421 	usb_endpoint_descriptor_t *ed = pipe->endpoint->edesc;
1422 	u_int8_t addr = dev->address;
1423 	u_int8_t xfertype = ed->bmAttributes & UE_XFERTYPE;
1424 	struct ehci_pipe *epipe = (struct ehci_pipe *)pipe;
1425 	struct ehci_soft_qh *sqh;
1426 	usbd_status err;
1427 	int s;
1428 	int ival, speed, naks;
1429 	int hshubaddr, hshubport;
1430 
1431 	DPRINTFN(1, ("ehci_open: pipe=%p, addr=%d, endpt=%d\n",
1432 	    pipe, addr, ed->bEndpointAddress));
1433 
1434 	if (sc->sc_bus.dying)
1435 		return (USBD_IOERROR);
1436 
1437 	if (dev->myhsport) {
1438 		hshubaddr = dev->myhsport->parent->address;
1439 		hshubport = dev->myhsport->portno;
1440 	} else {
1441 		hshubaddr = 0;
1442 		hshubport = 0;
1443 	}
1444 
1445 	/* Root Hub */
1446 	if (pipe->device->depth == 0) {
1447 		switch (ed->bEndpointAddress) {
1448 		case USB_CONTROL_ENDPOINT:
1449 			pipe->methods = &ehci_root_ctrl_methods;
1450 			break;
1451 		case UE_DIR_IN | EHCI_INTR_ENDPT:
1452 			pipe->methods = &ehci_root_intr_methods;
1453 			break;
1454 		default:
1455 			return (USBD_INVAL);
1456 		}
1457 		return (USBD_NORMAL_COMPLETION);
1458 	}
1459 
1460 	/* XXX All this stuff is only valid for async. */
1461 	switch (dev->speed) {
1462 	case USB_SPEED_LOW:
1463 		speed = EHCI_QH_SPEED_LOW;
1464 		break;
1465 	case USB_SPEED_FULL:
1466 		speed = EHCI_QH_SPEED_FULL;
1467 		break;
1468 	case USB_SPEED_HIGH:
1469 		speed = EHCI_QH_SPEED_HIGH;
1470 		break;
1471 	default:
1472 		panic("ehci_open: bad device speed %d", dev->speed);
1473 	}
1474 	if (speed != EHCI_QH_SPEED_HIGH && xfertype == UE_ISOCHRONOUS) {
1475 		printf("%s: Error opening low/full speed isoc endpoint.\n"
1476 		    "A low/full speed device is attached to a USB2 hub, and "
1477 		    "transaction translations are not yet supported.\n"
1478 		    "Reattach the device to the root hub instead.\n",
1479 		    sc->sc_bus.bdev.dv_xname);
1480 		DPRINTFN(1,("ehci_open: hshubaddr=%d hshubport=%d\n",
1481 		    hshubaddr, hshubport));
1482 		return (USBD_INVAL);
1483 	}
1484 
1485 	naks = 8;		/* XXX */
1486 
1487 	/* Allocate sqh for everything, save isoc xfers */
1488 	if (xfertype != UE_ISOCHRONOUS) {
1489 		sqh = ehci_alloc_sqh(sc);
1490 		if (sqh == NULL)
1491 			return (USBD_NOMEM);
1492 		/* qh_link filled when the QH is added */
1493 		sqh->qh.qh_endp = htole32(
1494 		    EHCI_QH_SET_ADDR(addr) |
1495 		    EHCI_QH_SET_ENDPT(UE_GET_ADDR(ed->bEndpointAddress)) |
1496 		    EHCI_QH_SET_EPS(speed) |
1497 		    (xfertype == UE_CONTROL ? EHCI_QH_DTC : 0) |
1498 		    EHCI_QH_SET_MPL(UGETW(ed->wMaxPacketSize)) |
1499 		    (speed != EHCI_QH_SPEED_HIGH && xfertype == UE_CONTROL ?
1500 		    EHCI_QH_CTL : 0) |
1501 		    EHCI_QH_SET_NRL(naks)
1502 		    );
1503 		sqh->qh.qh_endphub = htole32(
1504 		    EHCI_QH_SET_MULT(1) |
1505 		    EHCI_QH_SET_HUBA(hshubaddr) |
1506 		    EHCI_QH_SET_PORT(hshubport) |
1507 		    EHCI_QH_SET_CMASK(0x1c) | /* XXX */
1508 		    EHCI_QH_SET_SMASK(xfertype == UE_INTERRUPT ? 0x01 : 0)
1509 		    );
1510 		sqh->qh.qh_curqtd = htole32(EHCI_LINK_TERMINATE);
1511 		/* Fill the overlay qTD */
1512 		sqh->qh.qh_qtd.qtd_next = htole32(EHCI_LINK_TERMINATE);
1513 		sqh->qh.qh_qtd.qtd_altnext = htole32(EHCI_LINK_TERMINATE);
1514 		sqh->qh.qh_qtd.qtd_status =
1515 		    htole32(EHCI_QTD_SET_TOGGLE(pipe->endpoint->savedtoggle));
1516 
1517 		usb_syncmem(&sqh->dma, sqh->offs, sizeof(sqh->qh),
1518 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
1519 		epipe->sqh = sqh;
1520 	} else {
1521 		sqh = NULL;
1522 	} /*xfertype == UE_ISOC*/
1523 
1524 	switch (xfertype) {
1525 	case UE_CONTROL:
1526 		err = usb_allocmem(&sc->sc_bus, sizeof(usb_device_request_t),
1527 		    0, &epipe->u.ctl.reqdma);
1528 #ifdef EHCI_DEBUG
1529 		if (err)
1530 			printf("ehci_open: usb_allocmem()=%d\n", err);
1531 #endif
1532 		if (err)
1533 			goto bad;
1534 		pipe->methods = &ehci_device_ctrl_methods;
1535 		s = splusb();
1536 		ehci_add_qh(sqh, sc->sc_async_head);
1537 		splx(s);
1538 		break;
1539 	case UE_BULK:
1540 		pipe->methods = &ehci_device_bulk_methods;
1541 		s = splusb();
1542 		ehci_add_qh(sqh, sc->sc_async_head);
1543 		splx(s);
1544 		break;
1545 	case UE_INTERRUPT:
1546 		pipe->methods = &ehci_device_intr_methods;
1547 		ival = pipe->interval;
1548 		if (ival == USBD_DEFAULT_INTERVAL)
1549 			ival = ed->bInterval;
1550 		s = splusb();
1551 		err = ehci_device_setintr(sc, sqh, ival);
1552 		splx(s);
1553 		return (err);
1554 	case UE_ISOCHRONOUS:
1555 		pipe->methods = &ehci_device_isoc_methods;
1556 		if (ed->bInterval == 0 || ed->bInterval > 16) {
1557 			printf("ehci: opening pipe with invalid bInterval\n");
1558 			err = USBD_INVAL;
1559 			goto bad;
1560 		}
1561 		if (UGETW(ed->wMaxPacketSize) == 0) {
1562 			printf("ehci: zero length endpoint open request\n");
1563 			err = USBD_INVAL;
1564 			goto bad;
1565 		}
1566 		epipe->u.isoc.next_frame = 0;
1567 		epipe->u.isoc.cur_xfers = 0;
1568 		break;
1569 	default:
1570 		DPRINTF(("ehci: bad xfer type %d\n", xfertype));
1571 		return (USBD_INVAL);
1572 	}
1573 	return (USBD_NORMAL_COMPLETION);
1574 
1575 bad:
1576 	if (sqh != NULL)
1577 		ehci_free_sqh(sc, sqh);
1578 	return (err);
1579 }
1580 
1581 /*
1582  * Add an ED to the schedule.  Called at splusb().
1583  * If in the async schedule, it will always have a next.
1584  * If in the intr schedule it may not.
1585  */
1586 void
1587 ehci_add_qh(struct ehci_soft_qh *sqh, struct ehci_soft_qh *head)
1588 {
1589 	SPLUSBCHECK;
1590 
1591 	usb_syncmem(&head->dma, head->offs + offsetof(struct ehci_qh, qh_link),
1592 	    sizeof(head->qh.qh_link), BUS_DMASYNC_POSTWRITE);
1593 	sqh->next = head->next;
1594 	sqh->prev = head;
1595 	sqh->qh.qh_link = head->qh.qh_link;
1596 	usb_syncmem(&sqh->dma, sqh->offs + offsetof(struct ehci_qh, qh_link),
1597 	    sizeof(sqh->qh.qh_link), BUS_DMASYNC_PREWRITE);
1598 	head->next = sqh;
1599 	if (sqh->next)
1600 		sqh->next->prev = sqh;
1601 	head->qh.qh_link = htole32(sqh->physaddr | EHCI_LINK_QH);
1602 	usb_syncmem(&head->dma, head->offs + offsetof(struct ehci_qh, qh_link),
1603 	    sizeof(head->qh.qh_link), BUS_DMASYNC_PREWRITE);
1604 
1605 #ifdef EHCI_DEBUG
1606 	if (ehcidebug > 5) {
1607 		printf("ehci_add_qh:\n");
1608 		ehci_dump_sqh(sqh);
1609 	}
1610 #endif
1611 }
1612 
1613 /*
1614  * Remove an ED from the schedule.  Called at splusb().
1615  * Will always have a 'next' if it's in the async list as it's circular.
1616  */
1617 void
1618 ehci_rem_qh(struct ehci_softc *sc, struct ehci_soft_qh *sqh)
1619 {
1620 	SPLUSBCHECK;
1621 	/* XXX */
1622 	usb_syncmem(&sqh->dma, sqh->offs + offsetof(struct ehci_qh, qh_link),
1623 	    sizeof(sqh->qh.qh_link), BUS_DMASYNC_POSTWRITE);
1624 	sqh->prev->qh.qh_link = sqh->qh.qh_link;
1625 	sqh->prev->next = sqh->next;
1626 	if (sqh->next)
1627 		sqh->next->prev = sqh->prev;
1628 	usb_syncmem(&sqh->prev->dma,
1629 	    sqh->prev->offs + offsetof(struct ehci_qh, qh_link),
1630 	    sizeof(sqh->prev->qh.qh_link), BUS_DMASYNC_PREWRITE);
1631 
1632 	ehci_sync_hc(sc);
1633 }
1634 
1635 void
1636 ehci_set_qh_qtd(struct ehci_soft_qh *sqh, struct ehci_soft_qtd *sqtd)
1637 {
1638 	int i;
1639 	u_int32_t status;
1640 
1641 	/* Save toggle bit and ping status. */
1642 	usb_syncmem(&sqh->dma, sqh->offs, sizeof(sqh->qh),
1643 	    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
1644 	status = sqh->qh.qh_qtd.qtd_status &
1645 	    htole32(EHCI_QTD_TOGGLE_MASK |
1646 		EHCI_QTD_SET_STATUS(EHCI_QTD_PINGSTATE));
1647 	/* Set HALTED to make hw leave it alone. */
1648 	sqh->qh.qh_qtd.qtd_status =
1649 	    htole32(EHCI_QTD_SET_STATUS(EHCI_QTD_HALTED));
1650 	usb_syncmem(&sqh->dma,
1651 	    sqh->offs + offsetof(struct ehci_qh, qh_qtd.qtd_status),
1652 	    sizeof(sqh->qh.qh_qtd.qtd_status),
1653 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
1654 	sqh->qh.qh_curqtd = 0;
1655 	sqh->qh.qh_qtd.qtd_next = htole32(sqtd->physaddr);
1656 	sqh->qh.qh_qtd.qtd_altnext = htole32(EHCI_LINK_TERMINATE);
1657 	for (i = 0; i < EHCI_QTD_NBUFFERS; i++)
1658 		sqh->qh.qh_qtd.qtd_buffer[i] = 0;
1659 	sqh->sqtd = sqtd;
1660 	usb_syncmem(&sqh->dma, sqh->offs, sizeof(sqh->qh),
1661 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
1662 	/* Set !HALTED && !ACTIVE to start execution, preserve some fields */
1663 	sqh->qh.qh_qtd.qtd_status = status;
1664 	usb_syncmem(&sqh->dma,
1665 	    sqh->offs + offsetof(struct ehci_qh, qh_qtd.qtd_status),
1666 	    sizeof(sqh->qh.qh_qtd.qtd_status),
1667 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
1668 }
1669 
1670 /*
1671  * Ensure that the HC has released all references to the QH.  We do this
1672  * by asking for a Async Advance Doorbell interrupt and then we wait for
1673  * the interrupt.
1674  * To make this easier we first obtain exclusive use of the doorbell.
1675  */
1676 void
1677 ehci_sync_hc(struct ehci_softc *sc)
1678 {
1679 	int s, error;
1680 	int tries = 0;
1681 
1682 	if (sc->sc_bus.dying) {
1683 		DPRINTFN(2,("ehci_sync_hc: dying\n"));
1684 		return;
1685 	}
1686 	DPRINTFN(2,("ehci_sync_hc: enter\n"));
1687 	/* get doorbell */
1688 	rw_enter_write(&sc->sc_doorbell_lock);
1689 	s = splhardusb();
1690 	do {
1691 		/* ask for doorbell */
1692 		EOWRITE4(sc, EHCI_USBCMD, EOREAD4(sc, EHCI_USBCMD) |
1693 		    EHCI_CMD_IAAD);
1694 		DPRINTFN(1,("ehci_sync_hc: cmd=0x%08x sts=0x%08x\n",
1695 		    EOREAD4(sc, EHCI_USBCMD), EOREAD4(sc, EHCI_USBSTS)));
1696 		/* bell wait */
1697 		error = tsleep(&sc->sc_async_head, PZERO, "ehcidi", hz / 2);
1698 		DPRINTFN(1,("ehci_sync_hc: cmd=0x%08x sts=0x%08x\n",
1699 		    EOREAD4(sc, EHCI_USBCMD), EOREAD4(sc, EHCI_USBSTS)));
1700 	} while (error && ++tries < 10);
1701 	splx(s);
1702 	/* release doorbell */
1703 	rw_exit_write(&sc->sc_doorbell_lock);
1704 #ifdef DIAGNOSTIC
1705 	if (error)
1706 		printf("ehci_sync_hc: tsleep() = %d\n", error);
1707 #endif
1708 	DPRINTFN(2,("ehci_sync_hc: exit\n"));
1709 }
1710 
1711 /*Call at splusb*/
1712 void
1713 ehci_rem_free_itd_chain(struct ehci_softc *sc, struct ehci_xfer *ex)
1714 {
1715 	struct ehci_soft_itd *itd, *prev;
1716 
1717 	prev = NULL;
1718 
1719 	if (ex->itdstart == NULL || ex->itdend == NULL)
1720 		panic("ehci isoc xfer being freed, but with no itd chain");
1721 
1722 	for (itd = ex->itdstart; itd != NULL; itd = itd->xfer_next) {
1723 		prev = itd->u.frame_list.prev;
1724 		/* Unlink itd from hardware chain, or frame array */
1725 		if (prev == NULL) { /* We're at the table head */
1726 			sc->sc_softitds[itd->slot] = itd->u.frame_list.next;
1727 			sc->sc_flist[itd->slot] = itd->itd.itd_next;
1728 			usb_syncmem(&sc->sc_fldma,
1729 			    sizeof(ehci_link_t) * itd->slot,
1730 			    sizeof(ehci_link_t),
1731 			    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
1732 
1733 			if (itd->u.frame_list.next != NULL)
1734 				itd->u.frame_list.next->u.frame_list.prev =
1735 				    NULL;
1736 		} else {
1737 			/* XXX this part is untested... */
1738 			prev->itd.itd_next = itd->itd.itd_next;
1739 			usb_syncmem(&itd->dma,
1740 			    itd->offs + offsetof(struct ehci_itd, itd_next),
1741 			    sizeof(itd->itd.itd_next), BUS_DMASYNC_PREWRITE);
1742 
1743 			prev->u.frame_list.next = itd->u.frame_list.next;
1744 			if (itd->u.frame_list.next != NULL)
1745 				itd->u.frame_list.next->u.frame_list.prev =
1746 				    prev;
1747 		}
1748 	}
1749 
1750 	prev = NULL;
1751 	for (itd = ex->itdstart; itd != NULL; itd = itd->xfer_next) {
1752 		if (prev != NULL)
1753 			ehci_free_itd(sc, prev);
1754 		prev = itd;
1755 	}
1756 	if (prev)
1757 		ehci_free_itd(sc, prev);
1758 	ex->itdstart = NULL;
1759 	ex->itdend = NULL;
1760 }
1761 
1762 /***********/
1763 
1764 /*
1765  * Data structures and routines to emulate the root hub.
1766  */
1767 usb_device_descriptor_t ehci_devd = {
1768 	USB_DEVICE_DESCRIPTOR_SIZE,
1769 	UDESC_DEVICE,		/* type */
1770 	{0x00, 0x02},		/* USB version */
1771 	UDCLASS_HUB,		/* class */
1772 	UDSUBCLASS_HUB,		/* subclass */
1773 	UDPROTO_HSHUBSTT,	/* protocol */
1774 	64,			/* max packet */
1775 	{0},{0},{0x00,0x01},	/* device id */
1776 	1,2,0,			/* string indicies */
1777 	1			/* # of configurations */
1778 };
1779 
1780 usb_device_qualifier_t ehci_odevd = {
1781 	USB_DEVICE_DESCRIPTOR_SIZE,
1782 	UDESC_DEVICE_QUALIFIER,	/* type */
1783 	{0x00, 0x02},		/* USB version */
1784 	UDCLASS_HUB,		/* class */
1785 	UDSUBCLASS_HUB,		/* subclass */
1786 	UDPROTO_FSHUB,		/* protocol */
1787 	64,			/* max packet */
1788 	1,			/* # of configurations */
1789 	0
1790 };
1791 
1792 usb_config_descriptor_t ehci_confd = {
1793 	USB_CONFIG_DESCRIPTOR_SIZE,
1794 	UDESC_CONFIG,
1795 	{USB_CONFIG_DESCRIPTOR_SIZE +
1796 	 USB_INTERFACE_DESCRIPTOR_SIZE +
1797 	 USB_ENDPOINT_DESCRIPTOR_SIZE},
1798 	1,
1799 	1,
1800 	0,
1801 	UC_SELF_POWERED,
1802 	0			/* max power */
1803 };
1804 
1805 usb_interface_descriptor_t ehci_ifcd = {
1806 	USB_INTERFACE_DESCRIPTOR_SIZE,
1807 	UDESC_INTERFACE,
1808 	0,
1809 	0,
1810 	1,
1811 	UICLASS_HUB,
1812 	UISUBCLASS_HUB,
1813 	UIPROTO_HSHUBSTT,
1814 	0
1815 };
1816 
1817 usb_endpoint_descriptor_t ehci_endpd = {
1818 	USB_ENDPOINT_DESCRIPTOR_SIZE,
1819 	UDESC_ENDPOINT,
1820 	UE_DIR_IN | EHCI_INTR_ENDPT,
1821 	UE_INTERRUPT,
1822 	{8, 0},			/* max packet */
1823 	12
1824 };
1825 
1826 usb_hub_descriptor_t ehci_hubd = {
1827 	USB_HUB_DESCRIPTOR_SIZE,
1828 	UDESC_HUB,
1829 	0,
1830 	{0,0},
1831 	0,
1832 	0,
1833 	{0},
1834 };
1835 
1836 /*
1837  * Simulate a hardware hub by handling all the necessary requests.
1838  */
1839 usbd_status
1840 ehci_root_ctrl_transfer(struct usbd_xfer *xfer)
1841 {
1842 	usbd_status err;
1843 
1844 	/* Insert last in queue. */
1845 	err = usb_insert_transfer(xfer);
1846 	if (err)
1847 		return (err);
1848 
1849 	/* Pipe isn't running, start first */
1850 	return (ehci_root_ctrl_start(SIMPLEQ_FIRST(&xfer->pipe->queue)));
1851 }
1852 
1853 usbd_status
1854 ehci_root_ctrl_start(struct usbd_xfer *xfer)
1855 {
1856 	struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
1857 	usb_device_request_t *req;
1858 	void *buf = NULL;
1859 	int port, i;
1860 	int s, len, value, index, l, totlen = 0;
1861 	usb_port_status_t ps;
1862 	usb_hub_descriptor_t hubd;
1863 	usbd_status err;
1864 	u_int32_t v;
1865 
1866 	if (sc->sc_bus.dying)
1867 		return (USBD_IOERROR);
1868 
1869 #ifdef DIAGNOSTIC
1870 	if (!(xfer->rqflags & URQ_REQUEST))
1871 		/* XXX panic */
1872 		return (USBD_INVAL);
1873 #endif
1874 	req = &xfer->request;
1875 
1876 	DPRINTFN(4,("ehci_root_ctrl_start: type=0x%02x request=%02x\n",
1877 		    req->bmRequestType, req->bRequest));
1878 
1879 	len = UGETW(req->wLength);
1880 	value = UGETW(req->wValue);
1881 	index = UGETW(req->wIndex);
1882 
1883 	if (len != 0)
1884 		buf = KERNADDR(&xfer->dmabuf, 0);
1885 
1886 #define C(x,y) ((x) | ((y) << 8))
1887 	switch(C(req->bRequest, req->bmRequestType)) {
1888 	case C(UR_CLEAR_FEATURE, UT_WRITE_DEVICE):
1889 	case C(UR_CLEAR_FEATURE, UT_WRITE_INTERFACE):
1890 	case C(UR_CLEAR_FEATURE, UT_WRITE_ENDPOINT):
1891 		/*
1892 		 * DEVICE_REMOTE_WAKEUP and ENDPOINT_HALT are no-ops
1893 		 * for the integrated root hub.
1894 		 */
1895 		break;
1896 	case C(UR_GET_CONFIG, UT_READ_DEVICE):
1897 		if (len > 0) {
1898 			*(u_int8_t *)buf = sc->sc_conf;
1899 			totlen = 1;
1900 		}
1901 		break;
1902 	case C(UR_GET_DESCRIPTOR, UT_READ_DEVICE):
1903 		DPRINTFN(8,("ehci_root_ctrl_start: wValue=0x%04x\n", value));
1904 		switch(value >> 8) {
1905 		case UDESC_DEVICE:
1906 			if ((value & 0xff) != 0) {
1907 				err = USBD_IOERROR;
1908 				goto ret;
1909 			}
1910 			totlen = l = min(len, USB_DEVICE_DESCRIPTOR_SIZE);
1911 			USETW(ehci_devd.idVendor, sc->sc_id_vendor);
1912 			memcpy(buf, &ehci_devd, l);
1913 			break;
1914 		/*
1915 		 * We can't really operate at another speed, but the spec says
1916 		 * we need this descriptor.
1917 		 */
1918 		case UDESC_DEVICE_QUALIFIER:
1919 			if ((value & 0xff) != 0) {
1920 				err = USBD_IOERROR;
1921 				goto ret;
1922 			}
1923 			totlen = l = min(len, USB_DEVICE_DESCRIPTOR_SIZE);
1924 			memcpy(buf, &ehci_odevd, l);
1925 			break;
1926 		/*
1927 		 * We can't really operate at another speed, but the spec says
1928 		 * we need this descriptor.
1929 		 */
1930 		case UDESC_OTHER_SPEED_CONFIGURATION:
1931 		case UDESC_CONFIG:
1932 			if ((value & 0xff) != 0) {
1933 				err = USBD_IOERROR;
1934 				goto ret;
1935 			}
1936 			totlen = l = min(len, USB_CONFIG_DESCRIPTOR_SIZE);
1937 			memcpy(buf, &ehci_confd, l);
1938 			((usb_config_descriptor_t *)buf)->bDescriptorType =
1939 			    value >> 8;
1940 			buf = (char *)buf + l;
1941 			len -= l;
1942 			l = min(len, USB_INTERFACE_DESCRIPTOR_SIZE);
1943 			totlen += l;
1944 			memcpy(buf, &ehci_ifcd, l);
1945 			buf = (char *)buf + l;
1946 			len -= l;
1947 			l = min(len, USB_ENDPOINT_DESCRIPTOR_SIZE);
1948 			totlen += l;
1949 			memcpy(buf, &ehci_endpd, l);
1950 			break;
1951 		case UDESC_STRING:
1952 			if (len == 0)
1953 				break;
1954 			*(u_int8_t *)buf = 0;
1955 			totlen = 1;
1956 			switch (value & 0xff) {
1957 			case 0: /* Language table */
1958 				totlen = usbd_str(buf, len, "\001");
1959 				break;
1960 			case 1: /* Vendor */
1961 				totlen = usbd_str(buf, len, sc->sc_vendor);
1962 				break;
1963 			case 2: /* Product */
1964 				totlen = usbd_str(buf, len, "EHCI root hub");
1965 				break;
1966 			}
1967 			break;
1968 		default:
1969 			err = USBD_IOERROR;
1970 			goto ret;
1971 		}
1972 		break;
1973 	case C(UR_GET_INTERFACE, UT_READ_INTERFACE):
1974 		if (len > 0) {
1975 			*(u_int8_t *)buf = 0;
1976 			totlen = 1;
1977 		}
1978 		break;
1979 	case C(UR_GET_STATUS, UT_READ_DEVICE):
1980 		if (len > 1) {
1981 			USETW(((usb_status_t *)buf)->wStatus,UDS_SELF_POWERED);
1982 			totlen = 2;
1983 		}
1984 		break;
1985 	case C(UR_GET_STATUS, UT_READ_INTERFACE):
1986 	case C(UR_GET_STATUS, UT_READ_ENDPOINT):
1987 		if (len > 1) {
1988 			USETW(((usb_status_t *)buf)->wStatus, 0);
1989 			totlen = 2;
1990 		}
1991 		break;
1992 	case C(UR_SET_ADDRESS, UT_WRITE_DEVICE):
1993 		if (value >= USB_MAX_DEVICES) {
1994 			err = USBD_IOERROR;
1995 			goto ret;
1996 		}
1997 		break;
1998 	case C(UR_SET_CONFIG, UT_WRITE_DEVICE):
1999 		if (value != 0 && value != 1) {
2000 			err = USBD_IOERROR;
2001 			goto ret;
2002 		}
2003 		sc->sc_conf = value;
2004 		break;
2005 	case C(UR_SET_DESCRIPTOR, UT_WRITE_DEVICE):
2006 		break;
2007 	case C(UR_SET_FEATURE, UT_WRITE_DEVICE):
2008 	case C(UR_SET_FEATURE, UT_WRITE_INTERFACE):
2009 	case C(UR_SET_FEATURE, UT_WRITE_ENDPOINT):
2010 		err = USBD_IOERROR;
2011 		goto ret;
2012 	case C(UR_SET_INTERFACE, UT_WRITE_INTERFACE):
2013 		break;
2014 	case C(UR_SYNCH_FRAME, UT_WRITE_ENDPOINT):
2015 		break;
2016 	/* Hub requests */
2017 	case C(UR_CLEAR_FEATURE, UT_WRITE_CLASS_DEVICE):
2018 		break;
2019 	case C(UR_CLEAR_FEATURE, UT_WRITE_CLASS_OTHER):
2020 		DPRINTFN(8, ("ehci_root_ctrl_start: UR_CLEAR_PORT_FEATURE "
2021 		    "port=%d feature=%d\n", index, value));
2022 		if (index < 1 || index > sc->sc_noport) {
2023 			err = USBD_IOERROR;
2024 			goto ret;
2025 		}
2026 		port = EHCI_PORTSC(index);
2027 		v = EOREAD4(sc, port) &~ EHCI_PS_CLEAR;
2028 		switch(value) {
2029 		case UHF_PORT_ENABLE:
2030 			EOWRITE4(sc, port, v &~ EHCI_PS_PE);
2031 			break;
2032 		case UHF_PORT_SUSPEND:
2033 			EOWRITE4(sc, port, v &~ EHCI_PS_SUSP);
2034 			break;
2035 		case UHF_PORT_POWER:
2036 			EOWRITE4(sc, port, v &~ EHCI_PS_PP);
2037 			break;
2038 		case UHF_PORT_TEST:
2039 			DPRINTFN(2,("ehci_root_ctrl_start: "
2040 			    "clear port test %d\n", index));
2041 			break;
2042 		case UHF_PORT_INDICATOR:
2043 			DPRINTFN(2,("ehci_root_ctrl_start: "
2044 			    "clear port index %d\n", index));
2045 			EOWRITE4(sc, port, v &~ EHCI_PS_PIC);
2046 			break;
2047 		case UHF_C_PORT_CONNECTION:
2048 			EOWRITE4(sc, port, v | EHCI_PS_CSC);
2049 			break;
2050 		case UHF_C_PORT_ENABLE:
2051 			EOWRITE4(sc, port, v | EHCI_PS_PEC);
2052 			break;
2053 		case UHF_C_PORT_SUSPEND:
2054 			/* how? */
2055 			break;
2056 		case UHF_C_PORT_OVER_CURRENT:
2057 			EOWRITE4(sc, port, v | EHCI_PS_OCC);
2058 			break;
2059 		case UHF_C_PORT_RESET:
2060 			sc->sc_isreset = 0;
2061 			break;
2062 		default:
2063 			err = USBD_IOERROR;
2064 			goto ret;
2065 		}
2066 		break;
2067 	case C(UR_GET_DESCRIPTOR, UT_READ_CLASS_DEVICE):
2068 		if ((value & 0xff) != 0) {
2069 			err = USBD_IOERROR;
2070 			goto ret;
2071 		}
2072 		hubd = ehci_hubd;
2073 		hubd.bNbrPorts = sc->sc_noport;
2074 		v = EREAD4(sc, EHCI_HCSPARAMS);
2075 		USETW(hubd.wHubCharacteristics,
2076 		    (EHCI_HCS_PPC(v) ? UHD_PWR_INDIVIDUAL : UHD_PWR_NO_SWITCH) |
2077 		    (EHCI_HCS_P_INDICATOR(v) ? UHD_PORT_IND : 0));
2078 		hubd.bPwrOn2PwrGood = 200; /* XXX can't find out? */
2079 		for (i = 0, l = sc->sc_noport; l > 0; i++, l -= 8, v >>= 8)
2080 			hubd.DeviceRemovable[i++] = 0; /* XXX can't find out? */
2081 		hubd.bDescLength = USB_HUB_DESCRIPTOR_SIZE + i;
2082 		l = min(len, hubd.bDescLength);
2083 		totlen = l;
2084 		memcpy(buf, &hubd, l);
2085 		break;
2086 	case C(UR_GET_STATUS, UT_READ_CLASS_DEVICE):
2087 		if (len != 4) {
2088 			err = USBD_IOERROR;
2089 			goto ret;
2090 		}
2091 		memset(buf, 0, len); /* ? XXX */
2092 		totlen = len;
2093 		break;
2094 	case C(UR_GET_STATUS, UT_READ_CLASS_OTHER):
2095 		DPRINTFN(8,("ehci_root_ctrl_start: get port status i=%d\n",
2096 		    index));
2097 		if (index < 1 || index > sc->sc_noport) {
2098 			err = USBD_IOERROR;
2099 			goto ret;
2100 		}
2101 		if (len != 4) {
2102 			err = USBD_IOERROR;
2103 			goto ret;
2104 		}
2105 		v = EOREAD4(sc, EHCI_PORTSC(index));
2106 		DPRINTFN(8,("ehci_root_ctrl_start: port status=0x%04x\n", v));
2107 		i = UPS_HIGH_SPEED;
2108 		if (v & EHCI_PS_CS)	i |= UPS_CURRENT_CONNECT_STATUS;
2109 		if (v & EHCI_PS_PE)	i |= UPS_PORT_ENABLED;
2110 		if (v & EHCI_PS_SUSP)	i |= UPS_SUSPEND;
2111 		if (v & EHCI_PS_OCA)	i |= UPS_OVERCURRENT_INDICATOR;
2112 		if (v & EHCI_PS_PR)	i |= UPS_RESET;
2113 		if (v & EHCI_PS_PP)	i |= UPS_PORT_POWER;
2114 		USETW(ps.wPortStatus, i);
2115 		i = 0;
2116 		if (v & EHCI_PS_CSC)	i |= UPS_C_CONNECT_STATUS;
2117 		if (v & EHCI_PS_PEC)	i |= UPS_C_PORT_ENABLED;
2118 		if (v & EHCI_PS_OCC)	i |= UPS_C_OVERCURRENT_INDICATOR;
2119 		if (sc->sc_isreset)	i |= UPS_C_PORT_RESET;
2120 		USETW(ps.wPortChange, i);
2121 		l = min(len, sizeof(ps));
2122 		memcpy(buf, &ps, l);
2123 		totlen = l;
2124 		break;
2125 	case C(UR_SET_DESCRIPTOR, UT_WRITE_CLASS_DEVICE):
2126 		err = USBD_IOERROR;
2127 		goto ret;
2128 	case C(UR_SET_FEATURE, UT_WRITE_CLASS_DEVICE):
2129 		break;
2130 	case C(UR_SET_FEATURE, UT_WRITE_CLASS_OTHER):
2131 		if (index < 1 || index > sc->sc_noport) {
2132 			err = USBD_IOERROR;
2133 			goto ret;
2134 		}
2135 		port = EHCI_PORTSC(index);
2136 		v = EOREAD4(sc, port) &~ EHCI_PS_CLEAR;
2137 		switch(value) {
2138 		case UHF_PORT_ENABLE:
2139 			EOWRITE4(sc, port, v | EHCI_PS_PE);
2140 			break;
2141 		case UHF_PORT_SUSPEND:
2142 			EOWRITE4(sc, port, v | EHCI_PS_SUSP);
2143 			break;
2144 		case UHF_PORT_DISOWN_TO_1_1:
2145 			/* enter to Port Reset State */
2146 			v &= ~EHCI_PS_PE;
2147 			EOWRITE4(sc, port, v | EHCI_PS_PR);
2148 			ehci_disown(sc, index, 0);
2149 			break;
2150 		case UHF_PORT_RESET:
2151 			DPRINTFN(5,("ehci_root_ctrl_start: reset port %d\n",
2152 			    index));
2153 			if (EHCI_PS_IS_LOWSPEED(v)) {
2154 				/* Low speed device, give up ownership. */
2155 				ehci_disown(sc, index, 1);
2156 				break;
2157 			}
2158 			/* Start reset sequence. */
2159 			v &= ~ (EHCI_PS_PE | EHCI_PS_PR);
2160 			EOWRITE4(sc, port, v | EHCI_PS_PR);
2161 			/* Wait for reset to complete. */
2162 			usb_delay_ms(&sc->sc_bus, USB_PORT_ROOT_RESET_DELAY);
2163 			if (sc->sc_bus.dying) {
2164 				err = USBD_IOERROR;
2165 				goto ret;
2166 			}
2167 			/* Terminate reset sequence. */
2168 			v = EOREAD4(sc, port);
2169 			EOWRITE4(sc, port, v & ~EHCI_PS_PR);
2170 			/* Wait for HC to complete reset. */
2171 			usb_delay_ms(&sc->sc_bus, EHCI_PORT_RESET_COMPLETE);
2172 			if (sc->sc_bus.dying) {
2173 				err = USBD_IOERROR;
2174 				goto ret;
2175 			}
2176 			v = EOREAD4(sc, port);
2177 			DPRINTF(("ehci after reset, status=0x%08x\n", v));
2178 			if (v & EHCI_PS_PR) {
2179 				printf("%s: port reset timeout\n",
2180 				    sc->sc_bus.bdev.dv_xname);
2181 				err = USBD_IOERROR;
2182 				goto ret;
2183 			}
2184 			if (!(v & EHCI_PS_PE)) {
2185 				/* Not a high speed device, give up ownership.*/
2186 				ehci_disown(sc, index, 0);
2187 				break;
2188 			}
2189 			sc->sc_isreset = 1;
2190 			DPRINTF(("ehci port %d reset, status = 0x%08x\n",
2191 			    index, v));
2192 			break;
2193 		case UHF_PORT_POWER:
2194 			DPRINTFN(2,("ehci_root_ctrl_start: "
2195 			    "set port power %d\n", index));
2196 			EOWRITE4(sc, port, v | EHCI_PS_PP);
2197 			break;
2198 		case UHF_PORT_TEST:
2199 			DPRINTFN(2,("ehci_root_ctrl_start: "
2200 			    "set port test %d\n", index));
2201 			break;
2202 		case UHF_PORT_INDICATOR:
2203 			DPRINTFN(2,("ehci_root_ctrl_start: "
2204 			    "set port ind %d\n", index));
2205 			EOWRITE4(sc, port, v | EHCI_PS_PIC);
2206 			break;
2207 		default:
2208 			err = USBD_IOERROR;
2209 			goto ret;
2210 		}
2211 		break;
2212 	case C(UR_CLEAR_TT_BUFFER, UT_WRITE_CLASS_OTHER):
2213 	case C(UR_RESET_TT, UT_WRITE_CLASS_OTHER):
2214 	case C(UR_GET_TT_STATE, UT_READ_CLASS_OTHER):
2215 	case C(UR_STOP_TT, UT_WRITE_CLASS_OTHER):
2216 		break;
2217 	default:
2218 		err = USBD_IOERROR;
2219 		goto ret;
2220 	}
2221 	xfer->actlen = totlen;
2222 	err = USBD_NORMAL_COMPLETION;
2223  ret:
2224 	xfer->status = err;
2225 	s = splusb();
2226 	usb_transfer_complete(xfer);
2227 	splx(s);
2228 	return (USBD_IN_PROGRESS);
2229 }
2230 
2231 void
2232 ehci_disown(struct ehci_softc *sc, int index, int lowspeed)
2233 {
2234 	int port;
2235 	u_int32_t v;
2236 
2237 	DPRINTF(("ehci_disown: index=%d lowspeed=%d\n", index, lowspeed));
2238 
2239 	port = EHCI_PORTSC(index);
2240 	v = EOREAD4(sc, port) &~ EHCI_PS_CLEAR;
2241 	EOWRITE4(sc, port, v | EHCI_PS_PO);
2242 }
2243 
2244 /* Abort a root control request. */
2245 void
2246 ehci_root_ctrl_abort(struct usbd_xfer *xfer)
2247 {
2248 	/* Nothing to do, all transfers are synchronous. */
2249 }
2250 
2251 /* Close the root pipe. */
2252 void
2253 ehci_root_ctrl_close(struct usbd_pipe *pipe)
2254 {
2255 	DPRINTF(("ehci_root_ctrl_close\n"));
2256 	/* Nothing to do. */
2257 }
2258 
2259 void
2260 ehci_root_intr_done(struct usbd_xfer *xfer)
2261 {
2262 }
2263 
2264 usbd_status
2265 ehci_root_intr_transfer(struct usbd_xfer *xfer)
2266 {
2267 	usbd_status err;
2268 
2269 	/* Insert last in queue. */
2270 	err = usb_insert_transfer(xfer);
2271 	if (err)
2272 		return (err);
2273 
2274 	/* Pipe isn't running, start first */
2275 	return (ehci_root_intr_start(SIMPLEQ_FIRST(&xfer->pipe->queue)));
2276 }
2277 
2278 usbd_status
2279 ehci_root_intr_start(struct usbd_xfer *xfer)
2280 {
2281 	struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
2282 
2283 	if (sc->sc_bus.dying)
2284 		return (USBD_IOERROR);
2285 
2286 	sc->sc_intrxfer = xfer;
2287 
2288 	return (USBD_IN_PROGRESS);
2289 }
2290 
2291 void
2292 ehci_root_intr_abort(struct usbd_xfer *xfer)
2293 {
2294 	struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
2295 	int s;
2296 
2297 	sc->sc_intrxfer = NULL;
2298 
2299 	xfer->status = USBD_CANCELLED;
2300 	s = splusb();
2301 	usb_transfer_complete(xfer);
2302 	splx(s);
2303 }
2304 
2305 void
2306 ehci_root_intr_close(struct usbd_pipe *pipe)
2307 {
2308 }
2309 
2310 void
2311 ehci_root_ctrl_done(struct usbd_xfer *xfer)
2312 {
2313 }
2314 
2315 struct ehci_soft_qh *
2316 ehci_alloc_sqh(struct ehci_softc *sc)
2317 {
2318 	struct ehci_soft_qh *sqh = NULL;
2319 	usbd_status err;
2320 	int i, offs;
2321 	struct usb_dma dma;
2322 	int s;
2323 
2324 	s = splusb();
2325 	if (sc->sc_freeqhs == NULL) {
2326 		DPRINTFN(2, ("ehci_alloc_sqh: allocating chunk\n"));
2327 		err = usb_allocmem(&sc->sc_bus, EHCI_SQH_SIZE * EHCI_SQH_CHUNK,
2328 		    EHCI_PAGE_SIZE, &dma);
2329 		if (err)
2330 			goto out;
2331 		for (i = 0; i < EHCI_SQH_CHUNK; i++) {
2332 			offs = i * EHCI_SQH_SIZE;
2333 			sqh = KERNADDR(&dma, offs);
2334 			sqh->physaddr = DMAADDR(&dma, offs);
2335 			sqh->dma = dma;
2336 			sqh->offs = offs;
2337 			sqh->next = sc->sc_freeqhs;
2338 			sc->sc_freeqhs = sqh;
2339 		}
2340 	}
2341 	sqh = sc->sc_freeqhs;
2342 	sc->sc_freeqhs = sqh->next;
2343 	memset(&sqh->qh, 0, sizeof(struct ehci_qh));
2344 	sqh->next = NULL;
2345 	sqh->prev = NULL;
2346 
2347 out:
2348 	splx(s);
2349 	return (sqh);
2350 }
2351 
2352 void
2353 ehci_free_sqh(struct ehci_softc *sc, struct ehci_soft_qh *sqh)
2354 {
2355 	int s;
2356 
2357 	s = splusb();
2358 	sqh->next = sc->sc_freeqhs;
2359 	sc->sc_freeqhs = sqh;
2360 	splx(s);
2361 }
2362 
2363 struct ehci_soft_qtd *
2364 ehci_alloc_sqtd(struct ehci_softc *sc)
2365 {
2366 	struct ehci_soft_qtd *sqtd;
2367 	usbd_status err;
2368 	int i, offs;
2369 	struct usb_dma dma;
2370 	int s;
2371 
2372 	s = splusb();
2373 	if (sc->sc_freeqtds == NULL) {
2374 		DPRINTFN(2, ("ehci_alloc_sqtd: allocating chunk\n"));
2375 		err = usb_allocmem(&sc->sc_bus, EHCI_SQTD_SIZE*EHCI_SQTD_CHUNK,
2376 		    EHCI_PAGE_SIZE, &dma);
2377 		if (err)
2378 			goto out;
2379 		for(i = 0; i < EHCI_SQTD_CHUNK; i++) {
2380 			offs = i * EHCI_SQTD_SIZE;
2381 			sqtd = KERNADDR(&dma, offs);
2382 			sqtd->physaddr = DMAADDR(&dma, offs);
2383 			sqtd->dma = dma;
2384 			sqtd->offs = offs;
2385 			sqtd->nextqtd = sc->sc_freeqtds;
2386 			sc->sc_freeqtds = sqtd;
2387 		}
2388 	}
2389 
2390 	sqtd = sc->sc_freeqtds;
2391 	sc->sc_freeqtds = sqtd->nextqtd;
2392 	memset(&sqtd->qtd, 0, sizeof(struct ehci_qtd));
2393 	sqtd->nextqtd = NULL;
2394 
2395 out:
2396 	splx(s);
2397 	return (sqtd);
2398 }
2399 
2400 void
2401 ehci_free_sqtd(struct ehci_softc *sc, struct ehci_soft_qtd *sqtd)
2402 {
2403 	int s;
2404 
2405 	s = splusb();
2406 	sqtd->nextqtd = sc->sc_freeqtds;
2407 	sc->sc_freeqtds = sqtd;
2408 	splx(s);
2409 }
2410 
2411 usbd_status
2412 ehci_alloc_sqtd_chain(struct ehci_softc *sc, u_int alen, struct usbd_xfer *xfer,
2413     struct ehci_soft_qtd **sp, struct ehci_soft_qtd **ep)
2414 {
2415 	struct ehci_soft_qtd *next, *cur;
2416 	ehci_physaddr_t dataphys, dataphyspage, dataphyslastpage, nextphys;
2417 	u_int32_t qtdstatus;
2418 	u_int len, curlen;
2419 	int mps, i, iscontrol, forceshort;
2420 	int rd = usbd_xfer_isread(xfer);
2421 	struct usb_dma *dma = &xfer->dmabuf;
2422 
2423 	DPRINTFN(alen<4*4096,("ehci_alloc_sqtd_chain: start len=%d\n", alen));
2424 
2425 	len = alen;
2426 	iscontrol = (xfer->pipe->endpoint->edesc->bmAttributes & UE_XFERTYPE) ==
2427 	    UE_CONTROL;
2428 
2429 	dataphys = DMAADDR(dma, 0);
2430 	dataphyslastpage = EHCI_PAGE(dataphys + len - 1);
2431 	qtdstatus = EHCI_QTD_ACTIVE |
2432 	    EHCI_QTD_SET_PID(rd ? EHCI_QTD_PID_IN : EHCI_QTD_PID_OUT) |
2433 	    EHCI_QTD_SET_CERR(3); /* IOC and BYTES set below */
2434 	mps = UGETW(xfer->pipe->endpoint->edesc->wMaxPacketSize);
2435 	forceshort = ((xfer->flags & USBD_FORCE_SHORT_XFER) || len == 0) &&
2436 	    len % mps == 0;
2437 	/*
2438 	 * The control transfer data stage always starts with a toggle of 1.
2439 	 * For other transfers we let the hardware track the toggle state.
2440 	 */
2441 	if (iscontrol)
2442 		qtdstatus |= EHCI_QTD_SET_TOGGLE(1);
2443 
2444 	cur = ehci_alloc_sqtd(sc);
2445 	*sp = cur;
2446 	if (cur == NULL)
2447 		goto nomem;
2448 
2449 	usb_syncmem(dma, 0, alen,
2450 	    rd ? BUS_DMASYNC_PREREAD : BUS_DMASYNC_PREWRITE);
2451 	for (;;) {
2452 		dataphyspage = EHCI_PAGE(dataphys);
2453 		/* The EHCI hardware can handle at most 5 pages. */
2454 		if (dataphyslastpage - dataphyspage <
2455 		    EHCI_QTD_NBUFFERS * EHCI_PAGE_SIZE) {
2456 			/* we can handle it in this QTD */
2457 			curlen = len;
2458 		} else {
2459 			/* must use multiple TDs, fill as much as possible. */
2460 			curlen = EHCI_QTD_NBUFFERS * EHCI_PAGE_SIZE -
2461 				 EHCI_PAGE_OFFSET(dataphys);
2462 #ifdef DIAGNOSTIC
2463 			if (curlen > len) {
2464 				printf("ehci_alloc_sqtd_chain: curlen=%u "
2465 				    "len=%u offs=0x%x\n", curlen, len,
2466 				    EHCI_PAGE_OFFSET(dataphys));
2467 				printf("lastpage=0x%x page=0x%x phys=0x%x\n",
2468 				    dataphyslastpage, dataphyspage, dataphys);
2469 				curlen = len;
2470 			}
2471 #endif
2472 			/* the length must be a multiple of the max size */
2473 			curlen -= curlen % mps;
2474 			DPRINTFN(1,("ehci_alloc_sqtd_chain: multiple QTDs, "
2475 			    "curlen=%u\n", curlen));
2476 #ifdef DIAGNOSTIC
2477 			if (curlen == 0)
2478 				panic("ehci_alloc_std: curlen == 0");
2479 #endif
2480 		}
2481 
2482 		DPRINTFN(4,("ehci_alloc_sqtd_chain: dataphys=0x%08x "
2483 		    "dataphyslastpage=0x%08x len=%u curlen=%u\n",
2484 		    dataphys, dataphyslastpage, len, curlen));
2485 		len -= curlen;
2486 
2487 		/*
2488 		 * Allocate another transfer if there's more data left,
2489 		 * or if force last short transfer flag is set and we're
2490 		 * allocating a multiple of the max packet size.
2491 		 */
2492 		if (len != 0 || forceshort) {
2493 			next = ehci_alloc_sqtd(sc);
2494 			if (next == NULL)
2495 				goto nomem;
2496 			nextphys = htole32(next->physaddr);
2497 		} else {
2498 			next = NULL;
2499 			nextphys = htole32(EHCI_LINK_TERMINATE);
2500 		}
2501 
2502 		for (i = 0; i * EHCI_PAGE_SIZE <
2503 		    curlen + EHCI_PAGE_OFFSET(dataphys); i++) {
2504 			ehci_physaddr_t a = dataphys + i * EHCI_PAGE_SIZE;
2505 			if (i != 0) /* use offset only in first buffer */
2506 				a = EHCI_PAGE(a);
2507 #ifdef DIAGNOSTIC
2508 			if (i >= EHCI_QTD_NBUFFERS) {
2509 				printf("ehci_alloc_sqtd_chain: i=%d\n", i);
2510 				goto nomem;
2511 			}
2512 #endif
2513 			cur->qtd.qtd_buffer[i] = htole32(a);
2514 			cur->qtd.qtd_buffer_hi[i] = 0;
2515 		}
2516 		cur->nextqtd = next;
2517 		cur->qtd.qtd_next = cur->qtd.qtd_altnext = nextphys;
2518 		cur->qtd.qtd_status = htole32(qtdstatus |
2519 		    EHCI_QTD_SET_BYTES(curlen));
2520 		cur->len = curlen;
2521 		DPRINTFN(10,("ehci_alloc_sqtd_chain: cbp=0x%08x end=0x%08x\n",
2522 		    dataphys, dataphys + curlen));
2523 		DPRINTFN(10,("ehci_alloc_sqtd_chain: curlen=%u\n", curlen));
2524 		if (iscontrol) {
2525 			/*
2526 			 * adjust the toggle based on the number of packets
2527 			 * in this qtd
2528 			 */
2529 			if ((((curlen + mps - 1) / mps) & 1) || curlen == 0)
2530 				qtdstatus ^= EHCI_QTD_TOGGLE_MASK;
2531 		}
2532 		if (len == 0) {
2533 			if (! forceshort)
2534 				break;
2535 			forceshort = 0;
2536 		}
2537 		usb_syncmem(&cur->dma, cur->offs, sizeof(cur->qtd),
2538 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
2539 		DPRINTFN(10,("ehci_alloc_sqtd_chain: extend chain\n"));
2540 		dataphys += curlen;
2541 		cur = next;
2542 	}
2543 	cur->qtd.qtd_status |= htole32(EHCI_QTD_IOC);
2544 	usb_syncmem(&cur->dma, cur->offs, sizeof(cur->qtd),
2545 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
2546 	*ep = cur;
2547 
2548 	DPRINTFN(10,("ehci_alloc_sqtd_chain: return sqtd=%p sqtdend=%p\n",
2549 	    *sp, *ep));
2550 
2551 	return (USBD_NORMAL_COMPLETION);
2552 
2553  nomem:
2554 	/* XXX free chain */
2555 	DPRINTFN(-1,("ehci_alloc_sqtd_chain: no memory\n"));
2556 	return (USBD_NOMEM);
2557 }
2558 
2559 void
2560 ehci_free_sqtd_chain(struct ehci_softc *sc, struct ehci_xfer *ex)
2561 {
2562 	struct ehci_pipe *epipe = (struct ehci_pipe *)ex->xfer.pipe;
2563 	struct ehci_soft_qtd *sqtd, *next;
2564 
2565 	DPRINTFN(10,("ehci_free_sqtd_chain: sqtd=%p\n", ex->sqtdstart));
2566 
2567 	for (sqtd = ex->sqtdstart; sqtd != NULL; sqtd = next) {
2568 		next = sqtd->nextqtd;
2569 		ehci_free_sqtd(sc, sqtd);
2570 	}
2571 	ex->sqtdstart = ex->sqtdend = NULL;
2572 	epipe->sqh->sqtd = NULL;
2573 }
2574 
2575 struct ehci_soft_itd *
2576 ehci_alloc_itd(struct ehci_softc *sc)
2577 {
2578 	struct ehci_soft_itd *itd, *freeitd;
2579 	usbd_status err;
2580 	int i, s, offs, frindex, previndex;
2581 	struct usb_dma dma;
2582 
2583 	s = splusb();
2584 
2585 	/* Find an itd that wasn't freed this frame or last frame. This can
2586 	 * discard itds that were freed before frindex wrapped around
2587 	 * XXX - can this lead to thrashing? Could fix by enabling wrap-around
2588 	 *       interrupt and fiddling with list when that happens */
2589 	frindex = (EOREAD4(sc, EHCI_FRINDEX) + 1) >> 3;
2590 	previndex = (frindex != 0) ? frindex - 1 : sc->sc_flsize;
2591 
2592 	freeitd = NULL;
2593 	LIST_FOREACH(itd, &sc->sc_freeitds, u.free_list) {
2594 		if (itd == NULL)
2595 			break;
2596 		if (itd->slot != frindex && itd->slot != previndex) {
2597 			freeitd = itd;
2598 			break;
2599 		}
2600 	}
2601 
2602 	if (freeitd == NULL) {
2603 		DPRINTFN(2, ("ehci_alloc_itd allocating chunk\n"));
2604 		err = usb_allocmem(&sc->sc_bus, EHCI_ITD_SIZE * EHCI_ITD_CHUNK,
2605 		    EHCI_PAGE_SIZE, &dma);
2606 
2607 		if (err) {
2608 			DPRINTF(("ehci_alloc_itd, alloc returned %d\n", err));
2609 			return (NULL);
2610 		}
2611 
2612 		for (i = 0; i < EHCI_ITD_CHUNK; i++) {
2613 			offs = i * EHCI_ITD_SIZE;
2614 			itd = KERNADDR(&dma, offs);
2615 			itd->physaddr = DMAADDR(&dma, offs);
2616 			itd->dma = dma;
2617 			itd->offs = offs;
2618 			LIST_INSERT_HEAD(&sc->sc_freeitds, itd, u.free_list);
2619 		}
2620 		freeitd = LIST_FIRST(&sc->sc_freeitds);
2621 	}
2622 
2623 	itd = freeitd;
2624 	LIST_REMOVE(itd, u.free_list);
2625 	memset(&itd->itd, 0, sizeof(struct ehci_itd));
2626 	usb_syncmem(&itd->dma, itd->offs + offsetof(struct ehci_itd, itd_next),
2627 	    sizeof(itd->itd.itd_next), BUS_DMASYNC_PREWRITE |
2628 	    BUS_DMASYNC_PREREAD);
2629 
2630 	itd->u.frame_list.next = NULL;
2631 	itd->u.frame_list.prev = NULL;
2632 	itd->xfer_next = NULL;
2633 	itd->slot = 0;
2634 	splx(s);
2635 
2636 	return (itd);
2637 }
2638 
2639 void
2640 ehci_free_itd(struct ehci_softc *sc, struct ehci_soft_itd *itd)
2641 {
2642 	int s;
2643 
2644 	s = splusb();
2645 	LIST_INSERT_HEAD(&sc->sc_freeitds, itd, u.free_list);
2646 	splx(s);
2647 }
2648 
2649 /****************/
2650 
2651 /*
2652  * Close a reqular pipe.
2653  * Assumes that there are no pending transactions.
2654  */
2655 void
2656 ehci_close_pipe(struct usbd_pipe *pipe)
2657 {
2658 	struct ehci_pipe *epipe = (struct ehci_pipe *)pipe;
2659 	struct ehci_softc *sc = (struct ehci_softc *)pipe->device->bus;
2660 	struct ehci_soft_qh *sqh = epipe->sqh;
2661 	int s;
2662 
2663 	s = splusb();
2664 	ehci_rem_qh(sc, sqh);
2665 	splx(s);
2666 	pipe->endpoint->savedtoggle =
2667 	    EHCI_QTD_GET_TOGGLE(letoh32(sqh->qh.qh_qtd.qtd_status));
2668 	ehci_free_sqh(sc, epipe->sqh);
2669 }
2670 
2671 /*
2672  * Abort a device request.
2673  * If this routine is called at splusb() it guarantees that the request
2674  * will be removed from the hardware scheduling and that the callback
2675  * for it will be called with USBD_CANCELLED status.
2676  * It's impossible to guarantee that the requested transfer will not
2677  * have happened since the hardware runs concurrently.
2678  * If the transaction has already happened we rely on the ordinary
2679  * interrupt processing to process it.
2680  */
2681 void
2682 ehci_abort_xfer(struct usbd_xfer *xfer, usbd_status status)
2683 {
2684 	struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
2685 	struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
2686 	struct ehci_xfer *ex = (struct ehci_xfer*)xfer;
2687 	struct ehci_soft_qh *sqh = epipe->sqh;
2688 	struct ehci_soft_qtd *sqtd;
2689 	int s;
2690 
2691 	DPRINTF(("ehci_abort_xfer: xfer=%p pipe=%p\n", xfer, epipe));
2692 
2693 	if (sc->sc_bus.dying) {
2694 		/* If we're dying, just do the software part. */
2695 		s = splusb();
2696 		xfer->status = status;	/* make software ignore it */
2697 		timeout_del(&xfer->timeout_handle);
2698 		usb_rem_task(xfer->device, &xfer->abort_task);
2699 #ifdef DIAGNOSTIC
2700 		ex->isdone = 1;
2701 #endif
2702 		usb_transfer_complete(xfer);
2703 		splx(s);
2704 		return;
2705 	}
2706 
2707 	if (xfer->device->bus->intr_context)
2708 		panic("ehci_abort_xfer: not in process context");
2709 
2710 	/*
2711 	 * If an abort is already in progress then just wait for it to
2712 	 * complete and return.
2713 	 */
2714 	if (ex->ehci_xfer_flags & EHCI_XFER_ABORTING) {
2715 		DPRINTFN(2, ("ehci_abort_xfer: already aborting\n"));
2716 		/* No need to wait if we're aborting from a timeout. */
2717 		if (status == USBD_TIMEOUT)
2718 			return;
2719 		/* Override the status which might be USBD_TIMEOUT. */
2720 		xfer->status = status;
2721 		DPRINTFN(2, ("ehci_abort_xfer: waiting for abort to finish\n"));
2722 		ex->ehci_xfer_flags |= EHCI_XFER_ABORTWAIT;
2723 		while (ex->ehci_xfer_flags & EHCI_XFER_ABORTING)
2724 			tsleep(&ex->ehci_xfer_flags, PZERO, "ehciaw", 0);
2725 		return;
2726 	}
2727 
2728 	/*
2729 	 * Step 1: Make interrupt routine and timeouts ignore xfer.
2730 	 */
2731 	s = splusb();
2732 	ex->ehci_xfer_flags |= EHCI_XFER_ABORTING;
2733 	xfer->status = status;	/* make software ignore it */
2734 	timeout_del(&xfer->timeout_handle);
2735 	usb_rem_task(xfer->device, &xfer->abort_task);
2736 	splx(s);
2737 
2738 	/*
2739 	 * Step 2: Deactivate all of the qTDs that we will be removing,
2740 	 * otherwise the queue head may go active again.
2741 	 */
2742 	usb_syncmem(&sqh->dma,
2743 	    sqh->offs + offsetof(struct ehci_qh, qh_qtd.qtd_status),
2744 	    sizeof(sqh->qh.qh_qtd.qtd_status),
2745 	    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
2746 	sqh->qh.qh_qtd.qtd_status = htole32(EHCI_QTD_HALTED);
2747 	usb_syncmem(&sqh->dma,
2748 	    sqh->offs + offsetof(struct ehci_qh, qh_qtd.qtd_status),
2749 	    sizeof(sqh->qh.qh_qtd.qtd_status),
2750 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
2751 
2752 	for (sqtd = ex->sqtdstart; sqtd != NULL; sqtd = sqtd->nextqtd) {
2753 		usb_syncmem(&sqtd->dma,
2754 		    sqtd->offs + offsetof(struct ehci_qtd, qtd_status),
2755 		    sizeof(sqtd->qtd.qtd_status),
2756 		    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
2757 		sqtd->qtd.qtd_status = htole32(EHCI_QTD_HALTED);
2758 		usb_syncmem(&sqtd->dma,
2759 		    sqtd->offs + offsetof(struct ehci_qtd, qtd_status),
2760 		    sizeof(sqtd->qtd.qtd_status),
2761 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
2762 	}
2763 	ehci_sync_hc(sc);
2764 
2765 	/*
2766 	 * Step 3: Make sure the soft interrupt routine has run. This
2767 	 * should remove any completed items off the queue.
2768 	 * The hardware has no reference to completed items (TDs).
2769 	 * It's safe to remove them at any time.
2770 	 */
2771 	s = splusb();
2772 	sc->sc_softwake = 1;
2773 	usb_schedsoftintr(&sc->sc_bus);
2774 	tsleep(&sc->sc_softwake, PZERO, "ehciab", 0);
2775 
2776 #ifdef DIAGNOSTIC
2777 	ex->isdone = 1;
2778 #endif
2779 	/* Do the wakeup first to avoid touching the xfer after the callback. */
2780 	ex->ehci_xfer_flags &= ~EHCI_XFER_ABORTING;
2781 	if (ex->ehci_xfer_flags & EHCI_XFER_ABORTWAIT) {
2782 		ex->ehci_xfer_flags &= ~EHCI_XFER_ABORTWAIT;
2783 		wakeup(&ex->ehci_xfer_flags);
2784 	}
2785 	usb_transfer_complete(xfer);
2786 
2787 	splx(s);
2788 }
2789 
2790  void
2791 ehci_abort_isoc_xfer(struct usbd_xfer *xfer, usbd_status status)
2792 {
2793 	struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
2794 	struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
2795 	ehci_isoc_trans_t trans_status;
2796 	struct ehci_soft_itd *itd;
2797 	int s, i, wake;
2798 
2799 
2800 	DPRINTF(("ehci_abort_isoc_xfer: xfer %p pipe %p\n", xfer, xfer->pipe));
2801 
2802 	if (sc->sc_bus.dying) {
2803 		s = splusb();
2804 		xfer->status = status;
2805 		timeout_del(&xfer->timeout_handle);
2806 		usb_rem_task(xfer->device, &xfer->abort_task);
2807 		usb_transfer_complete(xfer);
2808 		splx(s);
2809 		return;
2810 	}
2811 
2812 	if (ex->ehci_xfer_flags & EHCI_XFER_ABORTING) {
2813 		DPRINTFN(2, ("ehci_abort_isoc_xfer: already aborting\n"));
2814 
2815 #ifdef DIAGNOSTIC
2816 		if (status == USBD_TIMEOUT)
2817 		printf("ehci_abort_xfer: TIMEOUT while aborting\n");
2818 #endif
2819 
2820 		xfer->status = status;
2821 		DPRINTFN(2, ("ehci_abort_xfer: waiting for abort to finish\n"));
2822 		ex->ehci_xfer_flags |= EHCI_XFER_ABORTING;
2823 		while (ex->ehci_xfer_flags & EHCI_XFER_ABORTING)
2824 			tsleep(&ex->ehci_xfer_flags, PZERO, "ehciiaw", 0);
2825 		return;
2826 	}
2827 	ex->ehci_xfer_flags |= EHCI_XFER_ABORTING;
2828 
2829 	xfer->status = status;
2830 	timeout_del(&xfer->timeout_handle);
2831 	usb_rem_task(xfer->device, &xfer->abort_task);
2832 
2833 	s = splusb();
2834 	for (itd = ex->itdstart; itd != NULL; itd = itd->xfer_next) {
2835 		for (i = 0; i < 8; i++) {
2836 			trans_status = letoh32(itd->itd.itd_ctl[i]);
2837 			trans_status &= ~EHCI_ITD_ACTIVE;
2838 			itd->itd.itd_ctl[i] = htole32(trans_status);
2839 		}
2840 	}
2841 	splx(s);
2842 
2843 	s = splusb();
2844 	sc->sc_softwake = 1;
2845 	usb_schedsoftintr(&sc->sc_bus);
2846 	tsleep(&sc->sc_softwake, PZERO, "ehciab", 0);
2847 	splx(s);
2848 
2849 #ifdef DIAGNOSTIC
2850 	ex->isdone = 1;
2851 #endif
2852 	wake = ex->ehci_xfer_flags & EHCI_XFER_ABORTING;
2853 	ex->ehci_xfer_flags &= ~(EHCI_XFER_ABORTING | EHCI_XFER_ABORTWAIT);
2854 	usb_transfer_complete(xfer);
2855 	if (wake)
2856 		wakeup(&ex->ehci_xfer_flags);
2857 
2858 	return;
2859 }
2860 
2861 void
2862 ehci_timeout(void *addr)
2863 {
2864 	struct usbd_xfer *xfer = addr;
2865 	struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
2866 
2867 	if (sc->sc_bus.dying) {
2868 		ehci_timeout_task(addr);
2869 		return;
2870 	}
2871 
2872 	usb_init_task(&xfer->abort_task, ehci_timeout_task, addr,
2873 	    USB_TASK_TYPE_ABORT);
2874 	usb_add_task(xfer->device, &xfer->abort_task);
2875 }
2876 
2877 void
2878 ehci_timeout_task(void *addr)
2879 {
2880 	struct usbd_xfer *xfer = addr;
2881 	int s;
2882 
2883 	DPRINTF(("%s: xfer=%p\n", __func__, xfer));
2884 
2885 	s = splusb();
2886 	ehci_abort_xfer(xfer, USBD_TIMEOUT);
2887 	splx(s);
2888 }
2889 
2890 /*
2891  * Some EHCI chips from VIA seem to trigger interrupts before writing back the
2892  * qTD status, or miss signalling occasionally under heavy load.  If the host
2893  * machine is too fast, we we can miss transaction completion - when we scan
2894  * the active list the transaction still seems to be active.  This generally
2895  * exhibits itself as a umass stall that never recovers.
2896  *
2897  * We work around this behaviour by setting up this callback after any softintr
2898  * that completes with transactions still pending, giving us another chance to
2899  * check for completion after the writeback has taken place.
2900  */
2901 void
2902 ehci_intrlist_timeout(void *arg)
2903 {
2904 	struct ehci_softc *sc = arg;
2905 	int s;
2906 
2907 	if (sc->sc_bus.dying)
2908 		return;
2909 
2910 	s = splusb();
2911 	DPRINTFN(1, ("ehci_intrlist_timeout\n"));
2912 	usb_schedsoftintr(&sc->sc_bus);
2913 	splx(s);
2914 }
2915 
2916 /************************/
2917 
2918 usbd_status
2919 ehci_device_ctrl_transfer(struct usbd_xfer *xfer)
2920 {
2921 	usbd_status err;
2922 
2923 	/* Insert last in queue. */
2924 	err = usb_insert_transfer(xfer);
2925 	if (err)
2926 		return (err);
2927 
2928 	/* Pipe isn't running, start first */
2929 	return (ehci_device_ctrl_start(SIMPLEQ_FIRST(&xfer->pipe->queue)));
2930 }
2931 
2932 usbd_status
2933 ehci_device_ctrl_start(struct usbd_xfer *xfer)
2934 {
2935 	struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
2936 	usbd_status err;
2937 
2938 	if (sc->sc_bus.dying)
2939 		return (USBD_IOERROR);
2940 
2941 #ifdef DIAGNOSTIC
2942 	if (!(xfer->rqflags & URQ_REQUEST)) {
2943 		/* XXX panic */
2944 		printf("ehci_device_ctrl_transfer: not a request\n");
2945 		return (USBD_INVAL);
2946 	}
2947 #endif
2948 
2949 	err = ehci_device_request(xfer);
2950 	if (err)
2951 		return (err);
2952 
2953 	if (sc->sc_bus.use_polling)
2954 		ehci_waitintr(sc, xfer);
2955 
2956 	return (USBD_IN_PROGRESS);
2957 }
2958 
2959 void
2960 ehci_device_ctrl_done(struct usbd_xfer *xfer)
2961 {
2962 	struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
2963 	struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
2964 
2965 	DPRINTFN(10,("ehci_ctrl_done: xfer=%p\n", xfer));
2966 
2967 #ifdef DIAGNOSTIC
2968 	if (!(xfer->rqflags & URQ_REQUEST)) {
2969 		panic("ehci_ctrl_done: not a request");
2970 	}
2971 #endif
2972 
2973 	if (xfer->status != USBD_NOMEM && ehci_active_intr_list(ex)) {
2974 		ehci_del_intr_list(sc, ex);	/* remove from active list */
2975 		ehci_free_sqtd_chain(sc, ex);
2976 	}
2977 
2978 	DPRINTFN(5, ("ehci_ctrl_done: length=%u\n", xfer->actlen));
2979 }
2980 
2981 /* Abort a device control request. */
2982 void
2983 ehci_device_ctrl_abort(struct usbd_xfer *xfer)
2984 {
2985 	DPRINTF(("ehci_device_ctrl_abort: xfer=%p\n", xfer));
2986 	ehci_abort_xfer(xfer, USBD_CANCELLED);
2987 }
2988 
2989 /* Close a device control pipe. */
2990 void
2991 ehci_device_ctrl_close(struct usbd_pipe *pipe)
2992 {
2993 	DPRINTF(("ehci_device_ctrl_close: pipe=%p\n", pipe));
2994 	ehci_close_pipe(pipe);
2995 }
2996 
2997 usbd_status
2998 ehci_device_request(struct usbd_xfer *xfer)
2999 {
3000 	struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
3001 	struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
3002 	struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
3003 	usb_device_request_t *req = &xfer->request;
3004 	struct ehci_soft_qtd *setup, *stat, *next;
3005 	struct ehci_soft_qh *sqh;
3006 	u_int len = UGETW(req->wLength);
3007 	usbd_status err;
3008 	int s;
3009 
3010 	DPRINTFN(3,("ehci_device_request: type=0x%02x, request=0x%02x, "
3011 	    "wValue=0x%04x, wIndex=0x%04x len=%u, addr=%d, endpt=%d\n",
3012 	    req->bmRequestType, req->bRequest, UGETW(req->wValue),
3013 	    UGETW(req->wIndex), UGETW(req->wLength), xfer->device->address,
3014 	    xfer->pipe->endpoint->edesc->bEndpointAddress));
3015 
3016 	setup = ehci_alloc_sqtd(sc);
3017 	if (setup == NULL) {
3018 		err = USBD_NOMEM;
3019 		goto bad1;
3020 	}
3021 	stat = ehci_alloc_sqtd(sc);
3022 	if (stat == NULL) {
3023 		err = USBD_NOMEM;
3024 		goto bad2;
3025 	}
3026 
3027 	sqh = epipe->sqh;
3028 
3029 	/* Set up data transaction */
3030 	if (len != 0) {
3031 		struct ehci_soft_qtd *end;
3032 
3033 		err = ehci_alloc_sqtd_chain(sc, len, xfer, &next, &end);
3034 		if (err)
3035 			goto bad3;
3036 		end->qtd.qtd_status &= htole32(~EHCI_QTD_IOC);
3037 		end->nextqtd = stat;
3038 		end->qtd.qtd_next =
3039 		    end->qtd.qtd_altnext = htole32(stat->physaddr);
3040 		usb_syncmem(&end->dma, end->offs, sizeof(end->qtd),
3041 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
3042 	} else {
3043 		next = stat;
3044 	}
3045 
3046 	memcpy(KERNADDR(&epipe->u.ctl.reqdma, 0), req, sizeof(*req));
3047 	usb_syncmem(&epipe->u.ctl.reqdma, 0, sizeof *req, BUS_DMASYNC_PREWRITE);
3048 
3049 	/* Clear toggle */
3050 	setup->qtd.qtd_status = htole32(
3051 	    EHCI_QTD_ACTIVE |
3052 	    EHCI_QTD_SET_PID(EHCI_QTD_PID_SETUP) |
3053 	    EHCI_QTD_SET_CERR(3) |
3054 	    EHCI_QTD_SET_TOGGLE(0) |
3055 	    EHCI_QTD_SET_BYTES(sizeof(*req)));
3056 	setup->qtd.qtd_buffer[0] = htole32(DMAADDR(&epipe->u.ctl.reqdma, 0));
3057 	setup->qtd.qtd_buffer_hi[0] = 0;
3058 	setup->nextqtd = next;
3059 	setup->qtd.qtd_next = setup->qtd.qtd_altnext = htole32(next->physaddr);
3060 	setup->len = sizeof(*req);
3061 	usb_syncmem(&setup->dma, setup->offs, sizeof(setup->qtd),
3062 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
3063 
3064 	stat->qtd.qtd_status = htole32(
3065 	    EHCI_QTD_ACTIVE |
3066 	    EHCI_QTD_SET_PID(usbd_xfer_isread(xfer) ?
3067 		EHCI_QTD_PID_OUT : EHCI_QTD_PID_IN) |
3068 	    EHCI_QTD_SET_CERR(3) |
3069 	    EHCI_QTD_SET_TOGGLE(1) |
3070 	    EHCI_QTD_IOC);
3071 	stat->qtd.qtd_buffer[0] = 0; /* XXX not needed? */
3072 	stat->qtd.qtd_buffer_hi[0] = 0; /* XXX not needed? */
3073 	stat->nextqtd = NULL;
3074 	stat->qtd.qtd_next = stat->qtd.qtd_altnext = htole32(EHCI_LINK_TERMINATE);
3075 	stat->len = 0;
3076 	usb_syncmem(&stat->dma, stat->offs, sizeof(stat->qtd),
3077 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
3078 
3079 #ifdef EHCI_DEBUG
3080 	if (ehcidebug > 5) {
3081 		DPRINTF(("ehci_device_request:\n"));
3082 		ehci_dump_sqh(sqh);
3083 		ehci_dump_sqtds(setup);
3084 	}
3085 #endif
3086 
3087 	ex->sqtdstart = setup;
3088 	ex->sqtdend = stat;
3089 #ifdef DIAGNOSTIC
3090 	if (!ex->isdone) {
3091 		printf("ehci_device_request: not done, ex=%p\n", ex);
3092 	}
3093 	ex->isdone = 0;
3094 #endif
3095 
3096 	/* Insert qTD in QH list. */
3097 	s = splusb();
3098 	ehci_set_qh_qtd(sqh, setup);
3099 	if (xfer->timeout && !sc->sc_bus.use_polling) {
3100 		timeout_del(&xfer->timeout_handle);
3101 		timeout_set(&xfer->timeout_handle, ehci_timeout, xfer);
3102 		timeout_add_msec(&xfer->timeout_handle, xfer->timeout);
3103 	}
3104 	ehci_add_intr_list(sc, ex);
3105 	xfer->status = USBD_IN_PROGRESS;
3106 	splx(s);
3107 
3108 #ifdef EHCI_DEBUG
3109 	if (ehcidebug > 10) {
3110 		DPRINTF(("ehci_device_request: status=%x\n",
3111 		    EOREAD4(sc, EHCI_USBSTS)));
3112 		delay(10000);
3113 		ehci_dump_regs(sc);
3114 		ehci_dump_sqh(sc->sc_async_head);
3115 		ehci_dump_sqh(sqh);
3116 		ehci_dump_sqtds(setup);
3117 	}
3118 #endif
3119 
3120 	return (USBD_NORMAL_COMPLETION);
3121 
3122  bad3:
3123 	ehci_free_sqtd(sc, stat);
3124  bad2:
3125 	ehci_free_sqtd(sc, setup);
3126  bad1:
3127 	DPRINTFN(-1,("ehci_device_request: no memory\n"));
3128 	xfer->status = err;
3129 	usb_transfer_complete(xfer);
3130 	return (err);
3131 }
3132 
3133 /************************/
3134 
3135 usbd_status
3136 ehci_device_bulk_transfer(struct usbd_xfer *xfer)
3137 {
3138 	usbd_status err;
3139 
3140 	/* Insert last in queue. */
3141 	err = usb_insert_transfer(xfer);
3142 	if (err)
3143 		return (err);
3144 
3145 	/* Pipe isn't running, start first */
3146 	return (ehci_device_bulk_start(SIMPLEQ_FIRST(&xfer->pipe->queue)));
3147 }
3148 
3149 usbd_status
3150 ehci_device_bulk_start(struct usbd_xfer *xfer)
3151 {
3152 	struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
3153 	struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
3154 	struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
3155 	struct ehci_soft_qtd *data, *dataend;
3156 	struct ehci_soft_qh *sqh;
3157 	usbd_status err;
3158 	int s;
3159 
3160 	DPRINTFN(2, ("ehci_device_bulk_start: xfer=%p len=%u flags=%d\n",
3161 	    xfer, xfer->length, xfer->flags));
3162 
3163 	if (sc->sc_bus.dying)
3164 		return (USBD_IOERROR);
3165 
3166 #ifdef DIAGNOSTIC
3167 	if (xfer->rqflags & URQ_REQUEST)
3168 		panic("ehci_device_bulk_start: a request");
3169 #endif
3170 
3171 	sqh = epipe->sqh;
3172 
3173 	err = ehci_alloc_sqtd_chain(sc, xfer->length, xfer, &data, &dataend);
3174 	if (err) {
3175 		DPRINTFN(-1,("ehci_device_bulk_start: no memory\n"));
3176 		xfer->status = err;
3177 		usb_transfer_complete(xfer);
3178 		return (err);
3179 	}
3180 
3181 #ifdef EHCI_DEBUG
3182 	if (ehcidebug > 5) {
3183 		DPRINTF(("ehci_device_bulk_start: data(1)\n"));
3184 		ehci_dump_sqh(sqh);
3185 		ehci_dump_sqtds(data);
3186 	}
3187 #endif
3188 
3189 	/* Set up interrupt info. */
3190 	ex->sqtdstart = data;
3191 	ex->sqtdend = dataend;
3192 #ifdef DIAGNOSTIC
3193 	if (!ex->isdone) {
3194 		printf("ehci_device_bulk_start: not done, ex=%p\n", ex);
3195 	}
3196 	ex->isdone = 0;
3197 #endif
3198 
3199 	s = splusb();
3200 	ehci_set_qh_qtd(sqh, data);
3201 	if (xfer->timeout && !sc->sc_bus.use_polling) {
3202 		timeout_del(&xfer->timeout_handle);
3203 		timeout_set(&xfer->timeout_handle, ehci_timeout, xfer);
3204 		timeout_add_msec(&xfer->timeout_handle, xfer->timeout);
3205 	}
3206 	ehci_add_intr_list(sc, ex);
3207 	xfer->status = USBD_IN_PROGRESS;
3208 	splx(s);
3209 
3210 #ifdef EHCI_DEBUG
3211 	if (ehcidebug > 10) {
3212 		DPRINTF(("ehci_device_bulk_start: data(2)\n"));
3213 		delay(10000);
3214 		DPRINTF(("ehci_device_bulk_start: data(3)\n"));
3215 		ehci_dump_regs(sc);
3216 #if 0
3217 		printf("async_head:\n");
3218 		ehci_dump_sqh(sc->sc_async_head);
3219 #endif
3220 		printf("sqh:\n");
3221 		ehci_dump_sqh(sqh);
3222 		ehci_dump_sqtds(data);
3223 	}
3224 #endif
3225 
3226 	if (sc->sc_bus.use_polling)
3227 		ehci_waitintr(sc, xfer);
3228 
3229 	return (USBD_IN_PROGRESS);
3230 }
3231 
3232 void
3233 ehci_device_bulk_abort(struct usbd_xfer *xfer)
3234 {
3235 	DPRINTF(("ehci_device_bulk_abort: xfer=%p\n", xfer));
3236 	ehci_abort_xfer(xfer, USBD_CANCELLED);
3237 }
3238 
3239 /*
3240  * Close a device bulk pipe.
3241  */
3242 void
3243 ehci_device_bulk_close(struct usbd_pipe *pipe)
3244 {
3245 	DPRINTF(("ehci_device_bulk_close: pipe=%p\n", pipe));
3246 	ehci_close_pipe(pipe);
3247 }
3248 
3249 void
3250 ehci_device_bulk_done(struct usbd_xfer *xfer)
3251 {
3252 	struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
3253 	struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
3254 
3255 	DPRINTFN(10,("ehci_bulk_done: xfer=%p, actlen=%d\n",
3256 	    xfer, xfer->actlen));
3257 
3258 	if (xfer->status != USBD_NOMEM && ehci_active_intr_list(ex)) {
3259 		ehci_del_intr_list(sc, ex);	/* remove from active list */
3260 		ehci_free_sqtd_chain(sc, ex);
3261 		usb_syncmem(&xfer->dmabuf, 0, xfer->length,
3262 		    usbd_xfer_isread(xfer) ?
3263 		    BUS_DMASYNC_POSTREAD : BUS_DMASYNC_POSTWRITE);
3264 	}
3265 
3266 	DPRINTFN(5, ("ehci_bulk_done: length=%d\n", xfer->actlen));
3267 }
3268 
3269 /************************/
3270 
3271 usbd_status
3272 ehci_device_setintr(struct ehci_softc *sc, struct ehci_soft_qh *sqh, int ival)
3273 {
3274 	struct ehci_soft_islot *isp;
3275 	int islot, lev;
3276 
3277 	/* Find a poll rate that is large enough. */
3278 	for (lev = EHCI_IPOLLRATES - 1; lev > 0; lev--)
3279 		if (EHCI_ILEV_IVAL(lev) <= ival)
3280 			break;
3281 
3282 	/* Pick an interrupt slot at the right level. */
3283 	/* XXX could do better than picking at random */
3284 	islot = EHCI_IQHIDX(lev, arc4random());
3285 
3286 	sqh->islot = islot;
3287 	isp = &sc->sc_islots[islot];
3288 	ehci_add_qh(sqh, isp->sqh);
3289 
3290 	return (USBD_NORMAL_COMPLETION);
3291 }
3292 
3293 usbd_status
3294 ehci_device_intr_transfer(struct usbd_xfer *xfer)
3295 {
3296 	usbd_status err;
3297 
3298 	/* Insert last in queue. */
3299 	err = usb_insert_transfer(xfer);
3300 	if (err)
3301 		return (err);
3302 
3303 	/*
3304 	 * Pipe isn't running (otherwise err would be USBD_INPROG),
3305 	 * so start it first.
3306 	 */
3307 	return (ehci_device_intr_start(SIMPLEQ_FIRST(&xfer->pipe->queue)));
3308 }
3309 
3310 usbd_status
3311 ehci_device_intr_start(struct usbd_xfer *xfer)
3312 {
3313 	struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
3314 	struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
3315 	struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
3316 	struct ehci_soft_qtd *data, *dataend;
3317 	struct ehci_soft_qh *sqh;
3318 	usbd_status err;
3319 	int s;
3320 
3321 	DPRINTFN(2, ("ehci_device_intr_start: xfer=%p len=%u flags=%d\n",
3322 	    xfer, xfer->length, xfer->flags));
3323 
3324 	if (sc->sc_bus.dying)
3325 		return (USBD_IOERROR);
3326 
3327 #ifdef DIAGNOSTIC
3328 	if (xfer->rqflags & URQ_REQUEST)
3329 		panic("ehci_device_intr_start: a request");
3330 #endif
3331 
3332 	sqh = epipe->sqh;
3333 
3334 	err = ehci_alloc_sqtd_chain(sc, xfer->length, xfer, &data, &dataend);
3335 	if (err) {
3336 		DPRINTFN(-1, ("ehci_device_intr_start: no memory\n"));
3337 		xfer->status = err;
3338 		usb_transfer_complete(xfer);
3339 		return (err);
3340 	}
3341 
3342 #ifdef EHCI_DEBUG
3343 	if (ehcidebug > 5) {
3344 		DPRINTF(("ehci_device_intr_start: data(1)\n"));
3345 		ehci_dump_sqh(sqh);
3346 		ehci_dump_sqtds(data);
3347 	}
3348 #endif
3349 
3350 	/* Set up interrupt info. */
3351 	ex->sqtdstart = data;
3352 	ex->sqtdend = dataend;
3353 #ifdef DIAGNOSTIC
3354 	if (!ex->isdone)
3355 		printf("ehci_device_intr_start: not done, ex=%p\n", ex);
3356 	ex->isdone = 0;
3357 #endif
3358 
3359 	s = splusb();
3360 	ehci_set_qh_qtd(sqh, data);
3361 	if (xfer->timeout && !sc->sc_bus.use_polling) {
3362 		timeout_del(&xfer->timeout_handle);
3363 		timeout_set(&xfer->timeout_handle, ehci_timeout, xfer);
3364 		timeout_add_msec(&xfer->timeout_handle, xfer->timeout);
3365 	}
3366 	ehci_add_intr_list(sc, ex);
3367 	xfer->status = USBD_IN_PROGRESS;
3368 	splx(s);
3369 
3370 #ifdef EHCI_DEBUG
3371 	if (ehcidebug > 10) {
3372 		DPRINTF(("ehci_device_intr_start: data(2)\n"));
3373 		delay(10000);
3374 		DPRINTF(("ehci_device_intr_start: data(3)\n"));
3375 		ehci_dump_regs(sc);
3376 		printf("sqh:\n");
3377 		ehci_dump_sqh(sqh);
3378 		ehci_dump_sqtds(data);
3379 	}
3380 #endif
3381 
3382 	if (sc->sc_bus.use_polling)
3383 		ehci_waitintr(sc, xfer);
3384 
3385 	return (USBD_IN_PROGRESS);
3386 }
3387 
3388 void
3389 ehci_device_intr_abort(struct usbd_xfer *xfer)
3390 {
3391 	KASSERT(xfer->pipe->intrxfer == xfer);
3392 
3393 	/*
3394 	 * XXX - abort_xfer uses ehci_sync_hc, which syncs via the advance
3395 	 *       async doorbell. That's dependant on the async list, wheras
3396 	 *       intr xfers are periodic, should not use this?
3397 	 */
3398 	ehci_abort_xfer(xfer, USBD_CANCELLED);
3399 }
3400 
3401 void
3402 ehci_device_intr_close(struct usbd_pipe *pipe)
3403 {
3404 	DPRINTF(("ehci_device_intr_close: pipe=%p\n", pipe));
3405 	ehci_close_pipe(pipe);
3406 }
3407 
3408 void
3409 ehci_device_intr_done(struct usbd_xfer *xfer)
3410 {
3411 	struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
3412 	struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
3413 	struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
3414 	struct ehci_soft_qtd *data, *dataend;
3415 	struct ehci_soft_qh *sqh;
3416 	usbd_status err;
3417 	int s;
3418 
3419 	DPRINTFN(10, ("ehci_device_intr_done: xfer=%p, actlen=%d\n",
3420 	    xfer, xfer->actlen));
3421 
3422 	if (xfer->pipe->repeat) {
3423 		ehci_free_sqtd_chain(sc, ex);
3424 
3425 		usb_syncmem(&xfer->dmabuf, 0, xfer->length,
3426 		    usbd_xfer_isread(xfer) ?
3427 		    BUS_DMASYNC_POSTREAD : BUS_DMASYNC_POSTWRITE);
3428 		sqh = epipe->sqh;
3429 
3430 		err = ehci_alloc_sqtd_chain(sc, xfer->length, xfer, &data, &dataend);
3431 		if (err) {
3432 			DPRINTFN(-1, ("ehci_device_intr_done: no memory\n"));
3433 			xfer->status = err;
3434 			return;
3435 		}
3436 
3437 		/* Set up interrupt info. */
3438 		ex->sqtdstart = data;
3439 		ex->sqtdend = dataend;
3440 #ifdef DIAGNOSTIC
3441 		if (!ex->isdone) {
3442 			printf("ehci_device_intr_done: not done, ex=%p\n",
3443 			    ex);
3444 		}
3445 		ex->isdone = 0;
3446 #endif
3447 
3448 		s = splusb();
3449 		ehci_set_qh_qtd(sqh, data);
3450 		if (xfer->timeout && !sc->sc_bus.use_polling) {
3451 			timeout_del(&xfer->timeout_handle);
3452 			timeout_set(&xfer->timeout_handle, ehci_timeout, xfer);
3453 			timeout_add_msec(&xfer->timeout_handle, xfer->timeout);
3454 		}
3455 		splx(s);
3456 
3457 		xfer->status = USBD_IN_PROGRESS;
3458 	} else if (xfer->status != USBD_NOMEM && ehci_active_intr_list(ex)) {
3459 		ehci_del_intr_list(sc, ex); /* remove from active list */
3460 		ehci_free_sqtd_chain(sc, ex);
3461 		usb_syncmem(&xfer->dmabuf, 0, xfer->length,
3462 		    usbd_xfer_isread(xfer) ?
3463 		    BUS_DMASYNC_POSTREAD : BUS_DMASYNC_POSTWRITE);
3464 	}
3465 }
3466 
3467 /************************/
3468 
3469 usbd_status
3470 ehci_device_isoc_transfer(struct usbd_xfer *xfer)
3471 {
3472 	usbd_status err;
3473 
3474 	err = usb_insert_transfer(xfer);
3475 	if (err && err != USBD_IN_PROGRESS)
3476 		return (err);
3477 
3478 	return (ehci_device_isoc_start(xfer));
3479 }
3480 
3481 usbd_status
3482 ehci_device_isoc_start(struct usbd_xfer *xfer)
3483 {
3484 	struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
3485 	struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
3486 	struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
3487 	struct ehci_soft_itd *itd, *prev, *start, *stop;
3488 	struct usb_dma *dma_buf;
3489 	int i, j, k, frames, uframes, ufrperframe;
3490 	int s, trans_count, offs;
3491 	int frindex;
3492 
3493 	start = NULL;
3494 	prev = NULL;
3495 	itd = NULL;
3496 	trans_count = 0;
3497 
3498 	/*
3499 	 * To allow continuous transfers, above we start all transfers
3500 	 * immediately. However, we're still going to get usbd_start_next call
3501 	 * this when another xfer completes. So, check if this is already
3502 	 * in progress or not
3503 	 */
3504 
3505 	if (ex->itdstart != NULL)
3506 		return (USBD_IN_PROGRESS);
3507 
3508 	DPRINTFN(2, ("ehci_device_isoc_start: xfer %p len %u flags %d\n",
3509 	    xfer, xfer->length, xfer->flags));
3510 
3511 	if (sc->sc_bus.dying)
3512 		return (USBD_IOERROR);
3513 
3514 	/*
3515 	 * To avoid complication, don't allow a request right now that'll span
3516 	 * the entire frame table. To within 4 frames, to allow some leeway
3517 	 * on either side of where the hc currently is.
3518 	 */
3519 	if ((1 << (xfer->pipe->endpoint->edesc->bInterval - 1)) *
3520 	    xfer->nframes >= (sc->sc_flsize - 4) * 8) {
3521 		printf("ehci: isoc descriptor requested that spans the entire "
3522 		    "frametable, too many frames\n");
3523 		return (USBD_INVAL);
3524 	}
3525 
3526 #ifdef DIAGNOSTIC
3527 	if (xfer->rqflags & URQ_REQUEST)
3528 		panic("ehci_device_isoc_start: request");
3529 
3530 	if (!ex->isdone)
3531 		printf("ehci_device_isoc_start: not done, ex = %p\n", ex);
3532 	ex->isdone = 0;
3533 #endif
3534 
3535 	/*
3536 	 * Step 1: Allocate and initialize itds, how many do we need?
3537 	 * One per transfer if interval >= 8 microframes, fewer if we use
3538 	 * multiple microframes per frame.
3539 	 */
3540 
3541 	i = xfer->pipe->endpoint->edesc->bInterval;
3542 	if (i > 16 || i == 0) {
3543 		/* Spec page 271 says intervals > 16 are invalid */
3544 		DPRINTF(("ehci_device_isoc_start: bInvertal %d invalid\n", i));
3545 		return (USBD_INVAL);
3546 	}
3547 
3548 	switch (i) {
3549 	case 1:
3550 		ufrperframe = 8;
3551 		break;
3552 	case 2:
3553 		ufrperframe = 4;
3554 		break;
3555 	case 3:
3556 		ufrperframe = 2;
3557 		break;
3558 	default:
3559 		ufrperframe = 1;
3560 		break;
3561 	}
3562 	frames = (xfer->nframes + (ufrperframe - 1)) / ufrperframe;
3563 	uframes = 8 / ufrperframe;
3564 
3565 	if (frames == 0) {
3566 		DPRINTF(("ehci_device_isoc_start: frames == 0\n"));
3567 		return (USBD_INVAL);
3568 	}
3569 
3570 	dma_buf = &xfer->dmabuf;
3571 	offs = 0;
3572 
3573 	for (i = 0; i < frames; i++) {
3574 		int froffs = offs;
3575 		itd = ehci_alloc_itd(sc);
3576 
3577 		if (prev != NULL) {
3578 			prev->itd.itd_next =
3579 			    htole32(itd->physaddr | EHCI_LINK_ITD);
3580 			prev->xfer_next = itd;
3581 		} else {
3582 			start = itd;
3583 		}
3584 
3585 		/*
3586 		 * Step 1.5, initialize uframes
3587 		 */
3588 		for (j = 0; j < 8; j += uframes) {
3589 			/* Calculate which page in the list this starts in */
3590 			int addr = DMAADDR(dma_buf, froffs);
3591 			addr = EHCI_PAGE_OFFSET(addr);
3592 			addr += (offs - froffs);
3593 			addr = EHCI_PAGE(addr);
3594 			addr /= EHCI_PAGE_SIZE;
3595 
3596 			/* This gets the initial offset into the first page,
3597 			 * looks how far further along the current uframe
3598 			 * offset is. Works out how many pages that is.
3599 			 */
3600 
3601 			itd->itd.itd_ctl[j] = htole32 ( EHCI_ITD_ACTIVE |
3602 			    EHCI_ITD_SET_LEN(xfer->frlengths[trans_count]) |
3603 			    EHCI_ITD_SET_PG(addr) |
3604 			    EHCI_ITD_SET_OFFS(EHCI_PAGE_OFFSET(DMAADDR(dma_buf,
3605 			    offs))));
3606 
3607 			offs += xfer->frlengths[trans_count];
3608 			trans_count++;
3609 
3610 			if (trans_count >= xfer->nframes) { /*Set IOC*/
3611 				itd->itd.itd_ctl[j] |= htole32(EHCI_ITD_IOC);
3612 				break;
3613 			}
3614 		}
3615 
3616 		/* Step 1.75, set buffer pointers. To simplify matters, all
3617 		 * pointers are filled out for the next 7 hardware pages in
3618 		 * the dma block, so no need to worry what pages to cover
3619 		 * and what to not.
3620 		 */
3621 
3622 		for (j=0; j < 7; j++) {
3623 			/*
3624 			 * Don't try to lookup a page that's past the end
3625 			 * of buffer
3626 			 */
3627 			int page_offs = EHCI_PAGE(froffs +
3628 			    (EHCI_PAGE_SIZE * j));
3629 
3630 			if (page_offs >= dma_buf->block->size)
3631 				break;
3632 
3633 			long long page = DMAADDR(dma_buf, page_offs);
3634 			page = EHCI_PAGE(page);
3635 			itd->itd.itd_bufr[j] =
3636 			    htole32(EHCI_ITD_SET_BPTR(page));
3637 			itd->itd.itd_bufr_hi[j] =
3638 			    htole32(page >> 32);
3639 		}
3640 
3641 		/*
3642 		 * Other special values
3643 		 */
3644 
3645 		k = xfer->pipe->endpoint->edesc->bEndpointAddress;
3646 		itd->itd.itd_bufr[0] |=
3647 		    htole32(EHCI_ITD_SET_EP(UE_GET_ADDR(k)) |
3648 		    EHCI_ITD_SET_DADDR(xfer->pipe->device->address));
3649 
3650 		k = (UE_GET_DIR(xfer->pipe->endpoint->edesc->bEndpointAddress))
3651 		    ? 1 : 0;
3652 		j = UGETW(xfer->pipe->endpoint->edesc->wMaxPacketSize);
3653 		itd->itd.itd_bufr[1] |= htole32(EHCI_ITD_SET_DIR(k) |
3654 		    EHCI_ITD_SET_MAXPKT(UE_GET_SIZE(j)));
3655 
3656 		/* FIXME: handle invalid trans */
3657 		itd->itd.itd_bufr[2] |=
3658 		    htole32(EHCI_ITD_SET_MULTI(UE_GET_TRANS(j)+1));
3659 		prev = itd;
3660 	} /* End of frame */
3661 
3662 	stop = itd;
3663 	stop->xfer_next = NULL;
3664 
3665 	/*
3666 	 * Part 2: Transfer descriptors have now been set up, now they must
3667 	 * be scheduled into the period frame list. Erk. Not wanting to
3668 	 * complicate matters, transfer is denied if the transfer spans
3669 	 * more than the period frame list.
3670 	 */
3671 
3672 	s = splusb();
3673 
3674 	/* Start inserting frames */
3675 	if (epipe->u.isoc.cur_xfers > 0) {
3676 		frindex = epipe->u.isoc.next_frame;
3677 	} else {
3678 		frindex = EOREAD4(sc, EHCI_FRINDEX);
3679 		frindex = frindex >> 3; /* Erase microframe index */
3680 		frindex += 2;
3681 	}
3682 
3683 	if (frindex >= sc->sc_flsize)
3684 		frindex &= (sc->sc_flsize - 1);
3685 
3686 	/* Whats the frame interval? */
3687 	i = (1 << (xfer->pipe->endpoint->edesc->bInterval - 1));
3688 	if (i / 8 == 0)
3689 		i = 1;
3690 	else
3691 		i /= 8;
3692 
3693 	itd = start;
3694 	for (j = 0; j < frames; j++) {
3695 		if (itd == NULL)
3696 			panic("ehci: unexpectedly ran out of isoc itds, "
3697 			    "isoc_start");
3698 
3699 		itd->itd.itd_next = sc->sc_flist[frindex];
3700 		if (itd->itd.itd_next == 0)
3701 			/* FIXME: frindex table gets initialized to NULL
3702 			 * or htole32(EHCI_LINK_TERMINATE)? */
3703 			itd->itd.itd_next = htole32(htole32(EHCI_LINK_TERMINATE));
3704 
3705 		sc->sc_flist[frindex] = htole32(EHCI_LINK_ITD | itd->physaddr);
3706 		itd->u.frame_list.next = sc->sc_softitds[frindex];
3707 		sc->sc_softitds[frindex] = itd;
3708 		if (itd->u.frame_list.next != NULL)
3709 			itd->u.frame_list.next->u.frame_list.prev = itd;
3710 		itd->slot = frindex;
3711 		itd->u.frame_list.prev = NULL;
3712 
3713 		frindex += i;
3714 		if (frindex >= sc->sc_flsize)
3715 			frindex -= sc->sc_flsize;
3716 
3717 		itd = itd->xfer_next;
3718 	}
3719 
3720 	epipe->u.isoc.cur_xfers++;
3721 	epipe->u.isoc.next_frame = frindex;
3722 
3723 	ex->itdstart = start;
3724 	ex->itdend = stop;
3725 	ex->sqtdstart = NULL;
3726 	ex->sqtdend = NULL;
3727 
3728 	ehci_add_intr_list(sc, ex);
3729 	xfer->status = USBD_IN_PROGRESS;
3730 	xfer->done = 0;
3731 	splx(s);
3732 
3733 	if (sc->sc_bus.use_polling) {
3734 		DPRINTF(("Starting ehci isoc xfer with polling. Bad idea?\n"));
3735 		ehci_waitintr(sc, xfer);
3736 	}
3737 
3738 	return (USBD_IN_PROGRESS);
3739 }
3740 
3741 void
3742 ehci_device_isoc_abort(struct usbd_xfer *xfer)
3743 {
3744 	DPRINTFN(1, ("ehci_device_isoc_abort: xfer = %p\n", xfer));
3745 	ehci_abort_isoc_xfer(xfer, USBD_CANCELLED);
3746 }
3747 
3748 void
3749 ehci_device_isoc_close(struct usbd_pipe *pipe)
3750 {
3751 	DPRINTFN(1, ("ehci_device_isoc_close: nothing in the pipe to free?\n"));
3752 }
3753 
3754 void
3755 ehci_device_isoc_done(struct usbd_xfer *xfer)
3756 {
3757 	struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
3758 	struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
3759 	struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
3760 	int s;
3761 
3762 	s = splusb();
3763 	epipe->u.isoc.cur_xfers--;
3764 	if (xfer->status != USBD_NOMEM && ehci_active_intr_list(ex)) {
3765 		ehci_del_intr_list(sc, ex);
3766 		ehci_rem_free_itd_chain(sc, ex);
3767 	}
3768 	splx(s);
3769 }
3770