/usr/src/sys/dev/usb/ohci.c

Bug Summary

File:	dev/usb/ohci.c
Warning:	line 2759, column 20 Dereference of undefined pointer value
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name ohci.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -D CONFIG_DRM_AMD_DC_DCN3_0 -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /usr/obj/sys/arch/amd64/compile/GENERIC.MP/scan-build/2022-01-12-131800-47421-1 -x c /usr/src/sys/dev/usb/ohci.c
1/*	$OpenBSD: ohci.c,v 1.164 2022/01/09 05:43:00 jsg Exp $ */
2/*	$NetBSD: ohci.c,v 1.139 2003/02/22 05:24:16 tsutsui Exp $	*/
3/*	$FreeBSD: src/sys/dev/usb/ohci.c,v 1.22 1999/11/17 22:33:40 n_hibma Exp $	*/

5/*
* Copyright (c) 1998 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This code is derived from software contributed to The NetBSD Foundation
* by Lennart Augustsson (lennart@augustsson.net) at
* Carlstedt Research & Technology.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/

35#include <sys/param.h>
36#include <sys/systm.h>
37#include <sys/malloc.h>
38#include <sys/device.h>
39#include <sys/queue.h>
40#include <sys/timeout.h>
41#include <sys/pool.h>
42#include <sys/endian.h>

44#include <machine/bus.h>

46#include <dev/usb/usb.h>
47#include <dev/usb/usbdi.h>
48#include <dev/usb/usbdivar.h>
49#include <dev/usb/usb_mem.h>

51#include <dev/usb/ohcireg.h>
52#include <dev/usb/ohcivar.h>

54struct cfdriver ohci_cd = {
NULL((void *)0), "ohci", DV_DULL, CD_SKIPHIBERNATE2
56};

58#ifdef OHCI_DEBUG
59#define DPRINTF(x)	do { if (ohcidebug) printf x; } while (0)
60#define DPRINTFN(n,x)	do { if (ohcidebug>(n)) printf x; } while (0)
61int ohcidebug = 0;
62#define bitmask_snprintf(q,f,b,l) snprintf((b), (l), "%b", (q), (f))
63#else
64#define DPRINTF(x)
65#define DPRINTFN(n,x)
66#endif

68struct pool *ohcixfer;

70struct ohci_pipe;

72struct ohci_soft_ed *ohci_alloc_sed(struct ohci_softc *);
73void		ohci_free_sed(struct ohci_softc *, struct ohci_soft_ed *);

75struct ohci_soft_td *ohci_alloc_std(struct ohci_softc *);
76void		ohci_free_std(struct ohci_softc *, struct ohci_soft_td *);

78struct ohci_soft_itd *ohci_alloc_sitd(struct ohci_softc *);
79void		ohci_free_sitd(struct ohci_softc *, struct ohci_soft_itd *);

81#if 0
82void		ohci_free_std_chain(struct ohci_softc *, struct ohci_soft_td *,
    struct ohci_soft_td *);
84#endif
85usbd_status	ohci_alloc_std_chain(struct ohci_softc *, u_int,
    struct usbd_xfer *, struct ohci_soft_td *,
    struct ohci_soft_td **);

89usbd_status	ohci_open(struct usbd_pipe *);
90int		ohci_setaddr(struct usbd_device *, int);
91void		ohci_poll(struct usbd_bus *);
92void		ohci_softintr(void *);
93void		ohci_add_done(struct ohci_softc *, ohci_physaddr_t);
94void		ohci_rhsc(struct ohci_softc *, struct usbd_xfer *);

96usbd_status	ohci_device_request(struct usbd_xfer *xfer);
97void		ohci_add_ed(struct ohci_soft_ed *, struct ohci_soft_ed *);
98void		ohci_rem_ed(struct ohci_soft_ed *, struct ohci_soft_ed *);
99void		ohci_hash_add_td(struct ohci_softc *, struct ohci_soft_td *);
100struct ohci_soft_td *ohci_hash_find_td(struct ohci_softc *, ohci_physaddr_t);
101void		ohci_hash_add_itd(struct ohci_softc *, struct ohci_soft_itd *);
102void		ohci_hash_rem_itd(struct ohci_softc *, struct ohci_soft_itd *);
103struct ohci_soft_itd *ohci_hash_find_itd(struct ohci_softc *, ohci_physaddr_t);

105usbd_status	ohci_setup_isoc(struct usbd_pipe *pipe);
106void		ohci_device_isoc_enter(struct usbd_xfer *);

108struct usbd_xfer *ohci_allocx(struct usbd_bus *);
109void		ohci_freex(struct usbd_bus *, struct usbd_xfer *);

111usbd_status	ohci_root_ctrl_transfer(struct usbd_xfer *);
112usbd_status	ohci_root_ctrl_start(struct usbd_xfer *);
113void		ohci_root_ctrl_abort(struct usbd_xfer *);
114void		ohci_root_ctrl_close(struct usbd_pipe *);
115void		ohci_root_ctrl_done(struct usbd_xfer *);

117usbd_status	ohci_root_intr_transfer(struct usbd_xfer *);
118usbd_status	ohci_root_intr_start(struct usbd_xfer *);
119void		ohci_root_intr_abort(struct usbd_xfer *);
120void		ohci_root_intr_close(struct usbd_pipe *);
121void		ohci_root_intr_done(struct usbd_xfer *);

123usbd_status	ohci_device_ctrl_transfer(struct usbd_xfer *);
124usbd_status	ohci_device_ctrl_start(struct usbd_xfer *);
125void		ohci_device_ctrl_abort(struct usbd_xfer *);
126void		ohci_device_ctrl_close(struct usbd_pipe *);
127void		ohci_device_ctrl_done(struct usbd_xfer *);

129usbd_status	ohci_device_bulk_transfer(struct usbd_xfer *);
130usbd_status	ohci_device_bulk_start(struct usbd_xfer *);
131void		ohci_device_bulk_abort(struct usbd_xfer *);
132void		ohci_device_bulk_close(struct usbd_pipe *);
133void		ohci_device_bulk_done(struct usbd_xfer *);

135usbd_status	ohci_device_intr_transfer(struct usbd_xfer *);
136usbd_status	ohci_device_intr_start(struct usbd_xfer *);
137void		ohci_device_intr_abort(struct usbd_xfer *);
138void		ohci_device_intr_close(struct usbd_pipe *);
139void		ohci_device_intr_done(struct usbd_xfer *);

141usbd_status	ohci_device_isoc_transfer(struct usbd_xfer *);
142usbd_status	ohci_device_isoc_start(struct usbd_xfer *);
143void		ohci_device_isoc_abort(struct usbd_xfer *);
144void		ohci_device_isoc_close(struct usbd_pipe *);
145void		ohci_device_isoc_done(struct usbd_xfer *);

147usbd_status	ohci_device_setintr(struct ohci_softc *sc,
	    struct ohci_pipe *pipe, int ival);

150void		ohci_timeout(void *);
151void		ohci_timeout_task(void *);
152void		ohci_rhsc_able(struct ohci_softc *, int);
153void		ohci_rhsc_enable(void *);

155void		ohci_close_pipe(struct usbd_pipe *, struct ohci_soft_ed *);
156void		ohci_abort_xfer(struct usbd_xfer *, usbd_status);

158void		ohci_device_clear_toggle(struct usbd_pipe *pipe);

160#ifdef OHCI_DEBUG
161void		ohci_dumpregs(struct ohci_softc *);
162void		ohci_dump_tds(struct ohci_soft_td *);
163void		ohci_dump_td(struct ohci_soft_td *);
164void		ohci_dump_ed(struct ohci_soft_ed *);
165void		ohci_dump_itd(struct ohci_soft_itd *);
166void		ohci_dump_itds(struct ohci_soft_itd *);
167#endif

169#define OBARR(sc)bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->sc_size
, 0x01|0x02) bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->sc_size, \
	BUS_SPACE_BARRIER_READ0x01|BUS_SPACE_BARRIER_WRITE0x02)
171#define OWRITE1(sc, r, x)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_1(((sc)->ioh
), ((r)), ((x)))); } while (0) \
do { OBARR(sc)bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->sc_size
, 0x01|0x02); bus_space_write_1((sc)->iot, (sc)->ioh, (r), (x))(((sc)->iot)->write_1(((sc)->ioh), ((r)), ((x)))); } while (0)
173#define OWRITE2(sc, r, x)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_2(((sc)->ioh
), ((r)), ((x)))); } while (0) \
do { OBARR(sc)bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->sc_size
, 0x01|0x02); bus_space_write_2((sc)->iot, (sc)->ioh, (r), (x))(((sc)->iot)->write_2(((sc)->ioh), ((r)), ((x)))); } while (0)
175#define OWRITE4(sc, r, x)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((r)), ((x)))); } while (0) \
do { OBARR(sc)bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->sc_size
, 0x01|0x02); bus_space_write_4((sc)->iot, (sc)->ioh, (r), (x))(((sc)->iot)->write_4(((sc)->ioh), ((r)), ((x)))); } while (0)

178__unused__attribute__((__unused__)) static __inline u_int8_t
179OREAD1(struct ohci_softc *sc, bus_size_t r)
180{
OBARR(sc)bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->sc_size
, 0x01|0x02);
return bus_space_read_1(sc->iot, sc->ioh, r)((sc->iot)->read_1((sc->ioh), (r)));
183}

185__unused__attribute__((__unused__)) static __inline u_int16_t
186OREAD2(struct ohci_softc *sc, bus_size_t r)
187{
OBARR(sc)bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->sc_size
, 0x01|0x02);
return bus_space_read_2(sc->iot, sc->ioh, r)((sc->iot)->read_2((sc->ioh), (r)));
190}

192__unused__attribute__((__unused__)) static __inline u_int32_t
193OREAD4(struct ohci_softc *sc, bus_size_t r)
194{
OBARR(sc)bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->sc_size
, 0x01|0x02);
return bus_space_read_4(sc->iot, sc->ioh, r)((sc->iot)->read_4((sc->ioh), (r)));
197}

199/* Reverse the bits in a value 0 .. 31 */
200u_int8_t revbits[OHCI_NO_INTRS32] =
{ 0x00, 0x10, 0x08, 0x18, 0x04, 0x14, 0x0c, 0x1c,
  0x02, 0x12, 0x0a, 0x1a, 0x06, 0x16, 0x0e, 0x1e,
  0x01, 0x11, 0x09, 0x19, 0x05, 0x15, 0x0d, 0x1d,
  0x03, 0x13, 0x0b, 0x1b, 0x07, 0x17, 0x0f, 0x1f };

206struct ohci_pipe {
struct usbd_pipe pipe;
struct ohci_soft_ed *sed;
union {
struct ohci_soft_td *td;
struct ohci_soft_itd *itd;
} tail;
union {
/* Control pipe */
struct {
	struct usb_dma reqdma;
} ctl;
/* Interrupt pipe */
struct {
	int nslots;
	int pos;
} intr;
/* Iso pipe */
struct iso {
	int next, inuse;
} iso;
} u;
228};

230#define OHCI_INTR_ENDPT1 1

232struct usbd_bus_methods ohci_bus_methods = {
.open_pipe = ohci_open,
.dev_setaddr = ohci_setaddr,
.soft_intr = ohci_softintr,
.do_poll = ohci_poll,
.allocx = ohci_allocx,
.freex = ohci_freex,
239};

241struct usbd_pipe_methods ohci_root_ctrl_methods = {
.transfer = ohci_root_ctrl_transfer,
.start = ohci_root_ctrl_start,
.abort = ohci_root_ctrl_abort,
.close = ohci_root_ctrl_close,
.done = ohci_root_ctrl_done,
247};

249struct usbd_pipe_methods ohci_root_intr_methods = {
.transfer = ohci_root_intr_transfer,
.start = ohci_root_intr_start,
.abort = ohci_root_intr_abort,
.close = ohci_root_intr_close,
.done = ohci_root_intr_done,
255};

257struct usbd_pipe_methods ohci_device_ctrl_methods = {
.transfer = ohci_device_ctrl_transfer,
.start = ohci_device_ctrl_start,
.abort = ohci_device_ctrl_abort,
.close = ohci_device_ctrl_close,
.done = ohci_device_ctrl_done,
263};

265struct usbd_pipe_methods ohci_device_intr_methods = {
.transfer = ohci_device_intr_transfer,
.start = ohci_device_intr_start,
.abort = ohci_device_intr_abort,
.close = ohci_device_intr_close,
.cleartoggle = ohci_device_clear_toggle,
.done = ohci_device_intr_done,
272};

274struct usbd_pipe_methods ohci_device_bulk_methods = {
.transfer = ohci_device_bulk_transfer,
.start = ohci_device_bulk_start,
.abort = ohci_device_bulk_abort,
.close = ohci_device_bulk_close,
.cleartoggle = ohci_device_clear_toggle,
.done = ohci_device_bulk_done,
281};

283struct usbd_pipe_methods ohci_device_isoc_methods = {
.transfer = ohci_device_isoc_transfer,
.start = ohci_device_isoc_start,
.abort = ohci_device_isoc_abort,
.close = ohci_device_isoc_close,
.done = ohci_device_isoc_done,
289};

291int
292ohci_activate(struct device *self, int act)
293{
struct ohci_softc *sc = (struct ohci_softc *)self;
u_int32_t reg;
int rv = 0;

switch (act) {
case DVACT_SUSPEND3:
rv = config_activate_children(self, act);
sc->sc_bus.use_polling++;
reg = OREAD4(sc, OHCI_CONTROL0x04) & ~OHCI_HCFS_MASK0x000000c0;
if (sc->sc_control == 0) {
	/*
	 * Preserve register values, in case that APM BIOS
	 * does not recover them.
	 */
	sc->sc_control = reg;
	sc->sc_intre = OREAD4(sc, OHCI_INTERRUPT_ENABLE0x10);
	sc->sc_ival = OHCI_GET_IVAL(OREAD4(sc,((OREAD4(sc, 0x34)) & 0x3fff)
	    OHCI_FM_INTERVAL))((OREAD4(sc, 0x34)) & 0x3fff);
}
reg |= OHCI_HCFS_SUSPEND0x000000c0;
OWRITE4(sc, OHCI_CONTROL, reg)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x04)), ((reg)))); } while (0);
usb_delay_ms(&sc->sc_bus, USB_RESUME_WAIT50);
sc->sc_bus.use_polling--;
break;
case DVACT_RESUME4:
sc->sc_bus.use_polling++;

/* Some broken BIOSes do not recover these values */
OWRITE4(sc, OHCI_HCCA, DMAADDR(&sc->sc_hccadma, 0))do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x18)), ((((&sc->sc_hccadma)->block->map->
dm_segs[0].ds_addr + (&sc->sc_hccadma)->offs + (0))
)))); } while (0);
OWRITE4(sc, OHCI_CONTROL_HEAD_ED, sc->sc_ctrl_head->physaddr)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x20)), ((sc->sc_ctrl_head->physaddr)))); } while (
0);
OWRITE4(sc, OHCI_BULK_HEAD_ED, sc->sc_bulk_head->physaddr)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x28)), ((sc->sc_bulk_head->physaddr)))); } while (
0);
if (sc->sc_intre)
	OWRITE4(sc, OHCI_INTERRUPT_ENABLE,do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x10)), ((sc->sc_intre & ((0x00000001 | 0x00000002
 | 0x00000004 | 0x00000008 | 0x00000010 | 0x00000020 | 0x00000040
 | 0x40000000) | 0x80000000))))); } while (0)
	    sc->sc_intre & (OHCI_ALL_INTRS | OHCI_MIE))do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x10)), ((sc->sc_intre & ((0x00000001 | 0x00000002
 | 0x00000004 | 0x00000008 | 0x00000010 | 0x00000020 | 0x00000040
 | 0x40000000) | 0x80000000))))); } while (0);
if (sc->sc_control)
	reg = sc->sc_control;
else
	reg = OREAD4(sc, OHCI_CONTROL0x04);
reg |= OHCI_HCFS_RESUME0x00000040;
OWRITE4(sc, OHCI_CONTROL, reg)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x04)), ((reg)))); } while (0);
usb_delay_ms(&sc->sc_bus, USB_RESUME_DELAY(50*5));
reg = (reg & ~OHCI_HCFS_MASK0x000000c0) | OHCI_HCFS_OPERATIONAL0x00000080;
OWRITE4(sc, OHCI_CONTROL, reg)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x04)), ((reg)))); } while (0);

reg = (OREAD4(sc, OHCI_FM_REMAINING0x38) & OHCI_FIT0x80000000) ^ OHCI_FIT0x80000000;
reg |= OHCI_FSMPS(sc->sc_ival)(((sc->sc_ival-210)*6/7) << 16) | sc->sc_ival;
OWRITE4(sc, OHCI_FM_INTERVAL, reg)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x34)), ((reg)))); } while (0);
OWRITE4(sc, OHCI_PERIODIC_START, OHCI_PERIODIC(sc->sc_ival))do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x40)), ((((sc->sc_ival)*9/10))))); } while (0);

/* Fiddle the No OverCurrent Protection to avoid a chip bug */
reg = OREAD4(sc, OHCI_RH_DESCRIPTOR_A0x48);
OWRITE4(sc, OHCI_RH_DESCRIPTOR_A, reg | OHCI_NOCP)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x48)), ((reg | 0x1000)))); } while (0);
OWRITE4(sc, OHCI_RH_STATUS, OHCI_LPSC)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x50)), ((0x00010000)))); } while (0); /* Enable port power */
usb_delay_ms(&sc->sc_bus, OHCI_ENABLE_POWER_DELAY5);
OWRITE4(sc, OHCI_RH_DESCRIPTOR_A, reg)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x48)), ((reg)))); } while (0);

usb_delay_ms(&sc->sc_bus, USB_RESUME_RECOVERY50);
sc->sc_control = sc->sc_intre = sc->sc_ival = 0;
sc->sc_bus.use_polling--;
rv = config_activate_children(self, act);
break;
case DVACT_POWERDOWN6:
rv = config_activate_children(self, act);
OWRITE4(sc, OHCI_CONTROL, OHCI_HCFS_RESET)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x04)), ((0x00000000)))); } while (0);
break;
default:
rv = config_activate_children(self, act);
break;
}
return (rv);
364}

366int
367ohci_detach(struct device *self, int flags)
368{
struct ohci_softc *sc = (struct ohci_softc *)self;
int rv;

rv = config_detach_children(self, flags);
if (rv != 0)
return (rv);

timeout_del(&sc->sc_tmo_rhsc);

usb_delay_ms(&sc->sc_bus, 300); /* XXX let stray task complete */

/* free data structures XXX */

return (rv);
383}

385struct ohci_soft_ed *
386ohci_alloc_sed(struct ohci_softc *sc)
387{
struct ohci_soft_ed *sed = NULL((void *)0);
usbd_status err;
int i, offs;
struct usb_dma dma;
int s;

s = splusb()splraise(0x5);
if (sc->sc_freeeds == NULL((void *)0)) {
DPRINTFN(2, ("ohci_alloc_sed: allocating chunk\n"));
err = usb_allocmem(&sc->sc_bus, OHCI_SED_SIZE((sizeof (struct ohci_soft_ed) + 16 - 1) / 16 * 16) * OHCI_SED_CHUNK128,
	  OHCI_ED_ALIGN16, USB_DMA_COHERENT(1 << 0), &dma);
if (err)
	goto out;
for (i = 0; i < OHCI_SED_CHUNK128; i++) {
	offs = i * OHCI_SED_SIZE((sizeof (struct ohci_soft_ed) + 16 - 1) / 16 * 16);
	sed = KERNADDR(&dma, offs)((void *)((char *)((&dma)->block->kaddr + (&dma
)->offs) + (offs)));
	sed->physaddr = DMAADDR(&dma, offs)((&dma)->block->map->dm_segs[0].ds_addr + (&
dma)->offs + (offs));
	sed->next = sc->sc_freeeds;
	sc->sc_freeeds = sed;
}
}
sed = sc->sc_freeeds;
sc->sc_freeeds = sed->next;
memset(&sed->ed, 0, sizeof(struct ohci_ed))__builtin_memset((&sed->ed), (0), (sizeof(struct ohci_ed
)));
sed->next = NULL((void *)0);

414out:
splx(s)spllower(s);
return (sed);
417}

419void
420ohci_free_sed(struct ohci_softc *sc, struct ohci_soft_ed *sed)
421{
int s;

s = splusb()splraise(0x5);
sed->next = sc->sc_freeeds;
sc->sc_freeeds = sed;
splx(s)spllower(s);
428}

430struct ohci_soft_td *
431ohci_alloc_std(struct ohci_softc *sc)
432{
struct ohci_soft_td *std = NULL((void *)0);
usbd_status err;
int i, offs;
struct usb_dma dma;
int s;

s = splusb()splraise(0x5);
if (sc->sc_freetds == NULL((void *)0)) {
DPRINTFN(2, ("ohci_alloc_std: allocating chunk\n"));
err = usb_allocmem(&sc->sc_bus, OHCI_STD_SIZE((sizeof (struct ohci_soft_td) + 16 - 1) / 16 * 16) * OHCI_STD_CHUNK128,
	  OHCI_TD_ALIGN16, USB_DMA_COHERENT(1 << 0), &dma);
if (err)
	goto out;
for (i = 0; i < OHCI_STD_CHUNK128; i++) {
	offs = i * OHCI_STD_SIZE((sizeof (struct ohci_soft_td) + 16 - 1) / 16 * 16);
	std = KERNADDR(&dma, offs)((void *)((char *)((&dma)->block->kaddr + (&dma
)->offs) + (offs)));
	std->physaddr = DMAADDR(&dma, offs)((&dma)->block->map->dm_segs[0].ds_addr + (&
dma)->offs + (offs));
	std->nexttd = sc->sc_freetds;
	sc->sc_freetds = std;
}
}

std = sc->sc_freetds;
sc->sc_freetds = std->nexttd;
memset(&std->td, 0, sizeof(struct ohci_td))__builtin_memset((&std->td), (0), (sizeof(struct ohci_td
)));
std->nexttd = NULL((void *)0);
std->xfer = NULL((void *)0);
ohci_hash_add_td(sc, std);

462out:
splx(s)spllower(s);
return (std);
465}

467void
468ohci_free_std(struct ohci_softc *sc, struct ohci_soft_td *std)
469{
int s;

s = splusb()splraise(0x5);
LIST_REMOVE(std, hnext)do { if ((std)->hnext.le_next != ((void *)0)) (std)->hnext
.le_next->hnext.le_prev = (std)->hnext.le_prev; *(std)->
hnext.le_prev = (std)->hnext.le_next; ((std)->hnext.le_prev
) = ((void *)-1); ((std)->hnext.le_next) = ((void *)-1); }
 while (0);
std->nexttd = sc->sc_freetds;
sc->sc_freetds = std;
splx(s)spllower(s);
477}

479usbd_status
480ohci_alloc_std_chain(struct ohci_softc *sc, u_int alen, struct usbd_xfer *xfer,
  struct ohci_soft_td *sp, struct ohci_soft_td **ep)
482{
struct ohci_soft_td *next, *cur, *end;
ohci_physaddr_t dataphys, dataphysend;
u_int32_t tdflags;
u_int len, curlen;
int mps;
int rd = usbd_xfer_isread(xfer);
struct usb_dma *dma = &xfer->dmabuf;
u_int16_t flags = xfer->flags;

DPRINTFN(alen < 4096,("ohci_alloc_std_chain: start len=%u\n", alen));

usb_syncmem(&xfer->dmabuf, 0, xfer->length,
   usbd_xfer_isread(xfer) ?
10
←
Assuming the condition is false→
11
←
'?' condition is false→
   BUS_DMASYNC_PREREAD0x01 : BUS_DMASYNC_PREWRITE0x04);

len = alen;
cur = sp;
end = NULL((void *)0);

dataphys = DMAADDR(dma, 0)((dma)->block->map->dm_segs[0].ds_addr + (dma)->offs
 + (0));
dataphysend = OHCI_PAGE(dataphys + len - 1)((dataphys + len - 1) &~ 0xfff);
tdflags = htole32(((__uint32_t)((rd ? 0x00100000 : 0x00080000) | (flags & 0x04
 ? 0x00040000 : 0) | 0xf0000000 | 0x00000000 | 0x00e00000))
12
←
'?' condition is false→
13
←
Assuming the condition is false→
14
←
'?' condition is false→
   (rd ? OHCI_TD_IN : OHCI_TD_OUT) |((__uint32_t)((rd ? 0x00100000 : 0x00080000) | (flags & 0x04
 ? 0x00040000 : 0) | 0xf0000000 | 0x00000000 | 0x00e00000))
   (flags & USBD_SHORT_XFER_OK ? OHCI_TD_R : 0) |((__uint32_t)((rd ? 0x00100000 : 0x00080000) | (flags & 0x04
 ? 0x00040000 : 0) | 0xf0000000 | 0x00000000 | 0x00e00000))
   OHCI_TD_NOCC | OHCI_TD_TOGGLE_CARRY | OHCI_TD_NOINTR)((__uint32_t)((rd ? 0x00100000 : 0x00080000) | (flags & 0x04
 ? 0x00040000 : 0) | 0xf0000000 | 0x00000000 | 0x00e00000));
mps = UGETW(xfer->pipe->endpoint->edesc->wMaxPacketSize)(*(u_int16_t *)(xfer->pipe->endpoint->edesc->wMaxPacketSize
));

while (len > 0) {
15
←
Assuming 'len' is > 0→
16
←
Loop condition is true.  Entering loop body→
next = ohci_alloc_std(sc);
if (next == NULL((void *)0))
17
←
Assuming 'next' is equal to NULL→
18
←
Taking true branch→
	goto nomem;
19
←
Control jumps to line 577→

/* The OHCI hardware can handle at most one page crossing. */
if (OHCI_PAGE(dataphys)((dataphys) &~ 0xfff) == dataphysend ||
    OHCI_PAGE(dataphys)((dataphys) &~ 0xfff) + OHCI_PAGE_SIZE0x1000 == dataphysend) {
	/* we can handle it in this TD */
	curlen = len;
} else {
	/* must use multiple TDs, fill as much as possible. */
	curlen = 2 * OHCI_PAGE_SIZE0x1000 -
		 (dataphys & (OHCI_PAGE_SIZE0x1000-1));
	/* the length must be a multiple of the max size */
	curlen -= curlen % mps;
526#ifdef DIAGNOSTIC1
	if (curlen == 0)
		panic("ohci_alloc_std: curlen == 0");
529#endif
}
DPRINTFN(4,("ohci_alloc_std_chain: dataphys=0x%08x "
	    "dataphysend=0x%08x len=%u curlen=%u\n",
	    dataphys, dataphysend,
	    len, curlen));
len -= curlen;

cur->td.td_flags = tdflags;
cur->td.td_cbp = htole32(dataphys)((__uint32_t)(dataphys));
cur->nexttd = next;
cur->td.td_nexttd = htole32(next->physaddr)((__uint32_t)(next->physaddr));
cur->td.td_be = htole32(dataphys + curlen - 1)((__uint32_t)(dataphys + curlen - 1));
cur->len = curlen;
cur->flags = OHCI_ADD_LEN0x0002;
cur->xfer = xfer;
DPRINTFN(10,("ohci_alloc_std_chain: cbp=0x%08x be=0x%08x\n",
	    dataphys, dataphys + curlen - 1));
DPRINTFN(10,("ohci_alloc_std_chain: extend chain\n"));
dataphys += curlen;
end = cur;
cur = next;
}
if (!rd && ((flags & USBD_FORCE_SHORT_XFER0x08) || alen == 0) &&
   alen % mps == 0) {
/* Force a 0 length transfer at the end. */

next = ohci_alloc_std(sc);
if (next == NULL((void *)0))
	goto nomem;

cur->td.td_flags = tdflags;
cur->td.td_cbp = 0; /* indicate 0 length packet */
cur->nexttd = next;
cur->td.td_nexttd = htole32(next->physaddr)((__uint32_t)(next->physaddr));
cur->td.td_be = ~0;
cur->len = 0;
cur->flags = 0;
cur->xfer = xfer;
DPRINTFN(2,("ohci_alloc_std_chain: add 0 xfer\n"));
end = cur;
}
*ep = end;

return (USBD_NORMAL_COMPLETION);

nomem:
/* XXX free chain */
return (USBD_NOMEM);
20
←
Returning without writing to '*ep'→
578}

580#if 0
581void
582ohci_free_std_chain(struct ohci_softc *sc, struct ohci_soft_td *std,
  struct ohci_soft_td *stdend)
584{
struct ohci_soft_td *p;

for (; std != stdend; std = p) {
p = std->nexttd;
ohci_free_std(sc, std);
}
591}
592#endif

594struct ohci_soft_itd *
595ohci_alloc_sitd(struct ohci_softc *sc)
596{
struct ohci_soft_itd *sitd;
usbd_status err;
int i, s, offs;
struct usb_dma dma;

if (sc->sc_freeitds == NULL((void *)0)) {
DPRINTFN(2, ("ohci_alloc_sitd: allocating chunk\n"));
err = usb_allocmem(&sc->sc_bus, OHCI_SITD_SIZE((sizeof (struct ohci_soft_itd) + 32 - 1) / 32 * 32) * OHCI_SITD_CHUNK64,
	  OHCI_ITD_ALIGN32, USB_DMA_COHERENT(1 << 0), &dma);
if (err)
	return (NULL((void *)0));
s = splusb()splraise(0x5);
for(i = 0; i < OHCI_SITD_CHUNK64; i++) {
	offs = i * OHCI_SITD_SIZE((sizeof (struct ohci_soft_itd) + 32 - 1) / 32 * 32);
	sitd = KERNADDR(&dma, offs)((void *)((char *)((&dma)->block->kaddr + (&dma
)->offs) + (offs)));
	sitd->physaddr = DMAADDR(&dma, offs)((&dma)->block->map->dm_segs[0].ds_addr + (&
dma)->offs + (offs));
	sitd->nextitd = sc->sc_freeitds;
	sc->sc_freeitds = sitd;
}
splx(s)spllower(s);
}

s = splusb()splraise(0x5);
sitd = sc->sc_freeitds;
sc->sc_freeitds = sitd->nextitd;
memset(&sitd->itd, 0, sizeof(struct ohci_itd))__builtin_memset((&sitd->itd), (0), (sizeof(struct ohci_itd
)));
sitd->nextitd = NULL((void *)0);
sitd->xfer = NULL((void *)0);
ohci_hash_add_itd(sc, sitd);
splx(s)spllower(s);

628#ifdef DIAGNOSTIC1
sitd->isdone = 0;
630#endif

return (sitd);
633}

635void
636ohci_free_sitd(struct ohci_softc *sc, struct ohci_soft_itd *sitd)
637{
int s;

DPRINTFN(10,("ohci_free_sitd: sitd=%p\n", sitd));

642#ifdef DIAGNOSTIC1
if (!sitd->isdone) {
panic("ohci_free_sitd: sitd=%p not done", sitd);
return;
}
/* Warn double free */
sitd->isdone = 0;
649#endif

s = splusb()splraise(0x5);
ohci_hash_rem_itd(sc, sitd);
sitd->nextitd = sc->sc_freeitds;
sc->sc_freeitds = sitd;
splx(s)spllower(s);
656}

658usbd_status
659ohci_checkrev(struct ohci_softc *sc)
660{
u_int32_t rev;

rev = OREAD4(sc, OHCI_REVISION0x00);
printf("version %d.%d%s\n", OHCI_REV_HI(rev)(((rev)>>4)&0xf), OHCI_REV_LO(rev)((rev)&0xf),
      OHCI_REV_LEGACY(rev)((rev) & 0x100) ? ", legacy support" : "");

if (OHCI_REV_HI(rev)(((rev)>>4)&0xf) != 1 || OHCI_REV_LO(rev)((rev)&0xf) != 0) {
printf("%s: unsupported OHCI revision\n",
       sc->sc_bus.bdev.dv_xname);
sc->sc_bus.usbrev = USBREV_UNKNOWN0;
return (USBD_INVAL);
}
sc->sc_bus.usbrev = USBREV_1_02;

return (USBD_NORMAL_COMPLETION);
676}

678usbd_status
679ohci_handover(struct ohci_softc *sc)
680{
u_int32_t s, ctl;
int i;

ctl = OREAD4(sc, OHCI_CONTROL0x04);
if (ctl & OHCI_IR0x00000100) {
/* SMM active, request change */
DPRINTF(("ohci_handover: SMM active, request owner change\n"));
if ((sc->sc_intre & (OHCI_OC0x40000000 | OHCI_MIE0x80000000)) == 
    (OHCI_OC0x40000000 | OHCI_MIE0x80000000))
	OWRITE4(sc, OHCI_INTERRUPT_ENABLE, OHCI_MIE)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x10)), ((0x80000000)))); } while (0);
s = OREAD4(sc, OHCI_COMMAND_STATUS0x08);
OWRITE4(sc, OHCI_COMMAND_STATUS, s | OHCI_OCR)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x08)), ((s | 0x00000008)))); } while (0);
for (i = 0; i < 100 && (ctl & OHCI_IR0x00000100); i++) {
	usb_delay_ms(&sc->sc_bus, 1);
	ctl = OREAD4(sc, OHCI_CONTROL0x04);
}
OWRITE4(sc, OHCI_INTERRUPT_DISABLE, OHCI_MIE)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x14)), ((0x80000000)))); } while (0);
if (ctl & OHCI_IR0x00000100) {
	printf("%s: SMM does not respond, will reset\n",
	    sc->sc_bus.bdev.dv_xname);
}
}

return (USBD_NORMAL_COMPLETION);
705}

707usbd_status
708ohci_init(struct ohci_softc *sc)
709{
struct ohci_soft_ed *sed, *psed;
usbd_status err;
int i;
u_int32_t ctl, rwc, ival, hcr, fm, per, desca, descb;

DPRINTF(("ohci_init: start\n"));

for (i = 0; i < OHCI_HASH_SIZE128; i++)
LIST_INIT(&sc->sc_hash_tds[i])do { ((&sc->sc_hash_tds[i])->lh_first) = ((void *)0
); } while (0);
for (i = 0; i < OHCI_HASH_SIZE128; i++)
LIST_INIT(&sc->sc_hash_itds[i])do { ((&sc->sc_hash_itds[i])->lh_first) = ((void *)
0); } while (0);

if (ohcixfer == NULL((void *)0)) {
ohcixfer = malloc(sizeof(struct pool), M_USBHC103, M_NOWAIT0x0002);
if (ohcixfer == NULL((void *)0)) {
	printf("%s: unable to allocate pool descriptor\n",
	    sc->sc_bus.bdev.dv_xname);
	return (ENOMEM12);
}
pool_init(ohcixfer, sizeof(struct ohci_xfer), 0, IPL_SOFTUSB0x5,
    0, "ohcixfer", NULL((void *)0));
}

/* XXX determine alignment by R/W */
/* Allocate the HCCA area. */
err = usb_allocmem(&sc->sc_bus, OHCI_HCCA_SIZE256, OHCI_HCCA_ALIGN256,
   USB_DMA_COHERENT(1 << 0), &sc->sc_hccadma);
if (err)
return (err);
sc->sc_hcca = KERNADDR(&sc->sc_hccadma, 0)((void *)((char *)((&sc->sc_hccadma)->block->kaddr
 + (&sc->sc_hccadma)->offs) + (0)));
memset(sc->sc_hcca, 0, OHCI_HCCA_SIZE)__builtin_memset((sc->sc_hcca), (0), (256));

sc->sc_eintrs = OHCI_NORMAL_INTRS(0x00000001 | 0x00000002 | 0x00000008 | 0x00000010 | 0x00000040
);

/* Allocate dummy ED that starts the control list. */
sc->sc_ctrl_head = ohci_alloc_sed(sc);
if (sc->sc_ctrl_head == NULL((void *)0)) {
err = USBD_NOMEM;
goto bad1;
}
sc->sc_ctrl_head->ed.ed_flags |= htole32(OHCI_ED_SKIP)((__uint32_t)(0x00004000));

/* Allocate dummy ED that starts the bulk list. */
sc->sc_bulk_head = ohci_alloc_sed(sc);
if (sc->sc_bulk_head == NULL((void *)0)) {
err = USBD_NOMEM;
goto bad2;
}
sc->sc_bulk_head->ed.ed_flags |= htole32(OHCI_ED_SKIP)((__uint32_t)(0x00004000));

/* Allocate dummy ED that starts the isochronous list. */
sc->sc_isoc_head = ohci_alloc_sed(sc);
if (sc->sc_isoc_head == NULL((void *)0)) {
err = USBD_NOMEM;
goto bad3;
}
sc->sc_isoc_head->ed.ed_flags |= htole32(OHCI_ED_SKIP)((__uint32_t)(0x00004000));

/* Allocate all the dummy EDs that make up the interrupt tree. */
for (i = 0; i < OHCI_NO_EDS(2*32 -1); i++) {
sed = ohci_alloc_sed(sc);
if (sed == NULL((void *)0)) {
	while (--i >= 0)
		ohci_free_sed(sc, sc->sc_eds[i]);
	err = USBD_NOMEM;
	goto bad4;
}
/* All ED fields are set to 0. */
sc->sc_eds[i] = sed;
sed->ed.ed_flags |= htole32(OHCI_ED_SKIP)((__uint32_t)(0x00004000));
if (i != 0)
	psed = sc->sc_eds[(i-1) / 2];
else
	psed= sc->sc_isoc_head;
sed->next = psed;
sed->ed.ed_nexted = htole32(psed->physaddr)((__uint32_t)(psed->physaddr));
}
/*
* Fill HCCA interrupt table.  The bit reversal is to get
* the tree set up properly to spread the interrupts.
*/
for (i = 0; i < OHCI_NO_INTRS32; i++)
sc->sc_hcca->hcca_interrupt_table[revbits[i]] =
    htole32(sc->sc_eds[OHCI_NO_EDS-OHCI_NO_INTRS+i]->physaddr)((__uint32_t)(sc->sc_eds[(2*32 -1)-32 +i]->physaddr));

795#ifdef OHCI_DEBUG
if (ohcidebug > 15) {
for (i = 0; i < OHCI_NO_EDS(2*32 -1); i++) {
	printf("ed#%d ", i);
	ohci_dump_ed(sc->sc_eds[i]);
}
printf("iso ");
ohci_dump_ed(sc->sc_isoc_head);
}
804#endif
/* Preserve values programmed by SMM/BIOS but lost over reset. */
ctl = OREAD4(sc, OHCI_CONTROL0x04);
rwc = ctl & OHCI_RWC0x00000200;
fm = OREAD4(sc, OHCI_FM_INTERVAL0x34);
desca = OREAD4(sc, OHCI_RH_DESCRIPTOR_A0x48);
descb = OREAD4(sc, OHCI_RH_DESCRIPTOR_B0x4c);

/* Determine in what context we are running. */
if (ctl & OHCI_IR0x00000100) {
OWRITE4(sc, OHCI_CONTROL, OHCI_HCFS_RESET | rwc)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x04)), ((0x00000000 | rwc)))); } while (0);
goto reset;
816#if 0
817/* Don't bother trying to reuse the BIOS init, we'll reset it anyway. */
} else if ((ctl & OHCI_HCFS_MASK0x000000c0) != OHCI_HCFS_RESET0x00000000) {
/* BIOS started controller. */
DPRINTF(("ohci_init: BIOS active\n"));
if ((ctl & OHCI_HCFS_MASK0x000000c0) != OHCI_HCFS_OPERATIONAL0x00000080) {
	OWRITE4(sc, OHCI_CONTROL, OHCI_HCFS_OPERATIONAL | rwc)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x04)), ((0x00000080 | rwc)))); } while (0);
	usb_delay_ms(&sc->sc_bus, USB_RESUME_DELAY(50*5));
}
825#endif
} else {
DPRINTF(("ohci_init: cold started\n"));
reset:
/* Controller was cold started. */
usb_delay_ms(&sc->sc_bus, USB_BUS_RESET_DELAY100);
}

/*
* This reset should not be necessary according to the OHCI spec, but
* without it some controllers do not start.
*/
DPRINTF(("%s: resetting\n", sc->sc_bus.bdev.dv_xname));
OWRITE4(sc, OHCI_CONTROL, OHCI_HCFS_RESET | rwc)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x04)), ((0x00000000 | rwc)))); } while (0);
usb_delay_ms(&sc->sc_bus, USB_BUS_RESET_DELAY100);

/* We now own the host controller and the bus has been reset. */

OWRITE4(sc, OHCI_COMMAND_STATUS, OHCI_HCR)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x08)), ((0x00000001)))); } while (0); /* Reset HC */
/* Nominal time for a reset is 10 us. */
for (i = 0; i < 10; i++) {
delay(10)(*delay_func)(10);
hcr = OREAD4(sc, OHCI_COMMAND_STATUS0x08) & OHCI_HCR0x00000001;
if (!hcr)
	break;
}
if (hcr) {
printf("%s: reset timeout\n", sc->sc_bus.bdev.dv_xname);
err = USBD_IOERROR;
goto bad5;
}
856#ifdef OHCI_DEBUG
if (ohcidebug > 15)
ohci_dumpregs(sc);
859#endif

/* The controller is now in SUSPEND state, we have 2ms to finish. */

/* Set up HC registers. */
OWRITE4(sc, OHCI_HCCA, DMAADDR(&sc->sc_hccadma, 0))do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x18)), ((((&sc->sc_hccadma)->block->map->
dm_segs[0].ds_addr + (&sc->sc_hccadma)->offs + (0))
)))); } while (0);
OWRITE4(sc, OHCI_CONTROL_HEAD_ED, sc->sc_ctrl_head->physaddr)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x20)), ((sc->sc_ctrl_head->physaddr)))); } while (
0);
OWRITE4(sc, OHCI_BULK_HEAD_ED, sc->sc_bulk_head->physaddr)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x28)), ((sc->sc_bulk_head->physaddr)))); } while (
0);
/* disable all interrupts and then switch on all desired interrupts */
OWRITE4(sc, OHCI_INTERRUPT_DISABLE, OHCI_ALL_INTRS)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x14)), (((0x00000001 | 0x00000002 | 0x00000004 | 0x00000008
 | 0x00000010 | 0x00000020 | 0x00000040 | 0x40000000))))); } while
 (0);
/* switch on desired functional features */
ctl = OREAD4(sc, OHCI_CONTROL0x04);
ctl &= ~(OHCI_CBSR_MASK0x00000003 | OHCI_LES(0x00000004 | 0x00000008 | 0x00000010 | 0x00000020) | OHCI_HCFS_MASK0x000000c0 | OHCI_IR0x00000100);
ctl |= OHCI_PLE0x00000004 | OHCI_IE0x00000008 | OHCI_CLE0x00000010 | OHCI_BLE0x00000020 |
OHCI_RATIO_1_40x00000003 | OHCI_HCFS_OPERATIONAL0x00000080 | rwc;
/* And finally start it! */
OWRITE4(sc, OHCI_CONTROL, ctl)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x04)), ((ctl)))); } while (0);

/*
* The controller is now OPERATIONAL.  Set a some final
* registers that should be set earlier, but that the
* controller ignores when in the SUSPEND state.
*/
ival = OHCI_GET_IVAL(fm)((fm) & 0x3fff);
fm = (OREAD4(sc, OHCI_FM_REMAINING0x38) & OHCI_FIT0x80000000) ^ OHCI_FIT0x80000000;
fm |= OHCI_FSMPS(ival)(((ival-210)*6/7) << 16) | ival;
OWRITE4(sc, OHCI_FM_INTERVAL, fm)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x34)), ((fm)))); } while (0);
per = OHCI_PERIODIC(ival)((ival)*9/10); /* 90% periodic */
OWRITE4(sc, OHCI_PERIODIC_START, per)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x40)), ((per)))); } while (0);

/* Fiddle the No OverCurrent Protection bit to avoid chip bug. */
OWRITE4(sc, OHCI_RH_DESCRIPTOR_A, desca | OHCI_NOCP)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x48)), ((desca | 0x1000)))); } while (0);
OWRITE4(sc, OHCI_RH_STATUS, OHCI_LPSC)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x50)), ((0x00010000)))); } while (0); /* Enable port power */
usb_delay_ms(&sc->sc_bus, OHCI_ENABLE_POWER_DELAY5);
OWRITE4(sc, OHCI_RH_DESCRIPTOR_A, desca)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x48)), ((desca)))); } while (0);
OWRITE4(sc, OHCI_RH_DESCRIPTOR_B, descb)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x4c)), ((descb)))); } while (0);
usb_delay_ms(&sc->sc_bus, OHCI_GET_POTPGT(desca)((desca) >> 24) * UHD_PWRON_FACTOR2);

/*
* The AMD756 requires a delay before re-reading the register,
* otherwise it will occasionally report 0 ports.
*/
sc->sc_noport = 0;
for (i = 0; i < 10 && sc->sc_noport == 0; i++) {
usb_delay_ms(&sc->sc_bus, OHCI_READ_DESC_DELAY5);
sc->sc_noport = OHCI_GET_NDP(OREAD4(sc, OHCI_RH_DESCRIPTOR_A))((OREAD4(sc, 0x48)) & 0xff);
}

907#ifdef OHCI_DEBUG
if (ohcidebug > 5)
ohci_dumpregs(sc);
910#endif

/* Set up the bus struct. */
sc->sc_bus.methods = &ohci_bus_methods;
sc->sc_bus.pipe_size = sizeof(struct ohci_pipe);

sc->sc_control = sc->sc_intre = 0;

timeout_set(&sc->sc_tmo_rhsc, ohci_rhsc_enable, sc);

/* Finally, turn on interrupts. */
DPRINTFN(1,("ohci_init: enabling\n"));
OWRITE4(sc, OHCI_INTERRUPT_ENABLE, sc->sc_eintrs | OHCI_MIE)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x10)), ((sc->sc_eintrs | 0x80000000)))); } while (0);

return (USBD_NORMAL_COMPLETION);

bad5:
for (i = 0; i < OHCI_NO_EDS(2*32 -1); i++)
ohci_free_sed(sc, sc->sc_eds[i]);
bad4:
ohci_free_sed(sc, sc->sc_isoc_head);
bad3:
ohci_free_sed(sc, sc->sc_bulk_head);
bad2:
ohci_free_sed(sc, sc->sc_ctrl_head);
bad1:
usb_freemem(&sc->sc_bus, &sc->sc_hccadma);
return (err);
938}

940struct usbd_xfer *
941ohci_allocx(struct usbd_bus *bus)
942{
return (pool_get(ohcixfer, PR_NOWAIT0x0002 | PR_ZERO0x0008));
944}

946void
947ohci_freex(struct usbd_bus *bus, struct usbd_xfer *xfer)
948{
pool_put(ohcixfer, xfer);
950}

952#ifdef OHCI_DEBUG
953void
954ohci_dumpregs(struct ohci_softc *sc)
955{
DPRINTF(("ohci_dumpregs: rev=0x%08x control=0x%08x command=0x%08x\n",
 OREAD4(sc, OHCI_REVISION),
 OREAD4(sc, OHCI_CONTROL),
 OREAD4(sc, OHCI_COMMAND_STATUS)));
DPRINTF(("               intrstat=0x%08x intre=0x%08x intrd=0x%08x\n",
 OREAD4(sc, OHCI_INTERRUPT_STATUS),
 OREAD4(sc, OHCI_INTERRUPT_ENABLE),
 OREAD4(sc, OHCI_INTERRUPT_DISABLE)));
DPRINTF(("               hcca=0x%08x percur=0x%08x ctrlhd=0x%08x\n",
 OREAD4(sc, OHCI_HCCA),
 OREAD4(sc, OHCI_PERIOD_CURRENT_ED),
 OREAD4(sc, OHCI_CONTROL_HEAD_ED)));
DPRINTF(("               ctrlcur=0x%08x bulkhd=0x%08x bulkcur=0x%08x\n",
 OREAD4(sc, OHCI_CONTROL_CURRENT_ED),
 OREAD4(sc, OHCI_BULK_HEAD_ED),
 OREAD4(sc, OHCI_BULK_CURRENT_ED)));
DPRINTF(("               done=0x%08x fmival=0x%08x fmrem=0x%08x\n",
 OREAD4(sc, OHCI_DONE_HEAD),
 OREAD4(sc, OHCI_FM_INTERVAL),
 OREAD4(sc, OHCI_FM_REMAINING)));
DPRINTF(("               fmnum=0x%08x perst=0x%08x lsthrs=0x%08x\n",
 OREAD4(sc, OHCI_FM_NUMBER),
 OREAD4(sc, OHCI_PERIODIC_START),
 OREAD4(sc, OHCI_LS_THRESHOLD)));
DPRINTF(("               desca=0x%08x descb=0x%08x stat=0x%08x\n",
 OREAD4(sc, OHCI_RH_DESCRIPTOR_A),
 OREAD4(sc, OHCI_RH_DESCRIPTOR_B),
 OREAD4(sc, OHCI_RH_STATUS)));
DPRINTF(("               port1=0x%08x port2=0x%08x\n",
 OREAD4(sc, OHCI_RH_PORT_STATUS(1)),
 OREAD4(sc, OHCI_RH_PORT_STATUS(2))));
DPRINTF(("         HCCA: frame_number=0x%04x done_head=0x%08x\n",
 letoh32(sc->sc_hcca->hcca_frame_number),
 letoh32(sc->sc_hcca->hcca_done_head)));
990}
991#endif

993int ohci_intr1(struct ohci_softc *);

995int
996ohci_intr(void *p)
997{
struct ohci_softc *sc = p;

if (sc == NULL((void *)0) || sc->sc_bus.dying)
return (0);

/* If we get an interrupt while polling, then just ignore it. */
if (sc->sc_bus.use_polling) {
1005#ifdef DIAGNOSTIC1
static struct timeval ohci_intr_tv;
if ((OREAD4(sc, OHCI_INTERRUPT_STATUS0x0c) & sc->sc_eintrs) &&
    usbd_ratecheck(&ohci_intr_tv))
	DPRINTFN(16,
	    ("ohci_intr: ignored interrupt while polling\n"));
1011#endif
return (0);
}

return (ohci_intr1(sc));
1016}

1018int
1019ohci_intr1(struct ohci_softc *sc)
1020{
u_int32_t intrs, eintrs;
ohci_physaddr_t done;

DPRINTFN(14,("ohci_intr1: enter\n"));

/* In case the interrupt occurs before initialization has completed. */
if (sc == NULL((void *)0) || sc->sc_hcca == NULL((void *)0)) {
1028#ifdef DIAGNOSTIC1
printf("ohci_intr: sc->sc_hcca == NULL\n");
1030#endif
return (0);
}

      intrs = 0;
done = letoh32(sc->sc_hcca->hcca_done_head)((__uint32_t)(sc->sc_hcca->hcca_done_head));
if (done != 0) {
if (done & ~OHCI_DONE_INTRS1)
	intrs = OHCI_WDH0x00000002;
if (done & OHCI_DONE_INTRS1)
	intrs |= OREAD4(sc, OHCI_INTERRUPT_STATUS0x0c);
sc->sc_hcca->hcca_done_head = 0;
} else {
intrs = OREAD4(sc, OHCI_INTERRUPT_STATUS0x0c);
/* If we've flushed out a WDH then reread */
if (intrs & OHCI_WDH0x00000002) {
	done = letoh32(sc->sc_hcca->hcca_done_head)((__uint32_t)(sc->sc_hcca->hcca_done_head));
	sc->sc_hcca->hcca_done_head = 0;
}
}

if (intrs == 0xffffffff) {
sc->sc_bus.dying = 1;
return (0);
}

if (!intrs)
return (0);

intrs &= ~OHCI_MIE0x80000000;
OWRITE4(sc, OHCI_INTERRUPT_STATUS, intrs)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x0c)), ((intrs)))); } while (0); /* Acknowledge */
eintrs = intrs & sc->sc_eintrs;
if (!eintrs)
return (0);

sc->sc_bus.intr_context++;
sc->sc_bus.no_intrs++;
DPRINTFN(7, ("ohci_intr: sc=%p intrs=0x%x(0x%x) eintrs=0x%x\n",
     sc, (u_int)intrs, OREAD4(sc, OHCI_INTERRUPT_STATUS),
     (u_int)eintrs));

if (eintrs & OHCI_SO0x00000001) {
sc->sc_overrun_cnt++;
if (usbd_ratecheck(&sc->sc_overrun_ntc)) {
	printf("%s: %u scheduling overruns\n",
	    sc->sc_bus.bdev.dv_xname, sc->sc_overrun_cnt);
	sc->sc_overrun_cnt = 0;
}
/* XXX do what */
eintrs &= ~OHCI_SO0x00000001;
}
if (eintrs & OHCI_WDH0x00000002) {
ohci_add_done(sc, done &~ OHCI_DONE_INTRS1);
usb_schedsoftintr(&sc->sc_bus);
eintrs &= ~OHCI_WDH0x00000002;
}
if (eintrs & OHCI_RD0x00000008) {
printf("%s: resume detect\n", sc->sc_bus.bdev.dv_xname);
/* XXX process resume detect */
}
if (eintrs & OHCI_UE0x00000010) {
printf("%s: unrecoverable error, controller halted\n",
       sc->sc_bus.bdev.dv_xname);
OWRITE4(sc, OHCI_CONTROL, OHCI_HCFS_RESET)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x04)), ((0x00000000)))); } while (0);
/* XXX what else */
}
if (eintrs & OHCI_RHSC0x00000040) {
ohci_rhsc(sc, sc->sc_intrxfer);
/*
 * Disable RHSC interrupt for now, because it will be
 * on until the port has been reset.
 */
ohci_rhsc_able(sc, 0);
DPRINTFN(2, ("%s: rhsc interrupt disabled\n",
	     sc->sc_bus.bdev.dv_xname));

/* Do not allow RHSC interrupts > 1 per second */
              timeout_add_sec(&sc->sc_tmo_rhsc, 1);
eintrs &= ~OHCI_RHSC0x00000040;
}

sc->sc_bus.intr_context--;

if (eintrs != 0) {
/* Block unprocessed interrupts. XXX */
OWRITE4(sc, OHCI_INTERRUPT_DISABLE, eintrs)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x14)), ((eintrs)))); } while (0);
sc->sc_eintrs &= ~eintrs;
printf("%s: blocking intrs 0x%x\n",
       sc->sc_bus.bdev.dv_xname, eintrs);
}

return (1);
1122}

1124void
1125ohci_rhsc_able(struct ohci_softc *sc, int on)
1126{
DPRINTFN(4, ("ohci_rhsc_able: on=%d\n", on));
if (on) {
sc->sc_eintrs |= OHCI_RHSC0x00000040;
OWRITE4(sc, OHCI_INTERRUPT_ENABLE, OHCI_RHSC)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x10)), ((0x00000040)))); } while (0);
} else {
sc->sc_eintrs &= ~OHCI_RHSC0x00000040;
OWRITE4(sc, OHCI_INTERRUPT_DISABLE, OHCI_RHSC)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x14)), ((0x00000040)))); } while (0);
}
1135}

1137void
1138ohci_rhsc_enable(void *v_sc)
1139{
struct ohci_softc *sc = v_sc;
int s;

if (sc->sc_bus.dying)
return;

s = splhardusb()splraise(0x6);
ohci_rhsc(sc, sc->sc_intrxfer);
DPRINTFN(2, ("%s: rhsc interrupt enabled\n",
     sc->sc_bus.bdev.dv_xname));

ohci_rhsc_able(sc, 1);
splx(s)spllower(s);
1153}

1155#ifdef OHCI_DEBUG
1156char *ohci_cc_strs[] = {
"NO_ERROR",
"CRC",
"BIT_STUFFING",
"DATA_TOGGLE_MISMATCH",
"STALL",
"DEVICE_NOT_RESPONDING",
"PID_CHECK_FAILURE",
"UNEXPECTED_PID",
"DATA_OVERRUN",
"DATA_UNDERRUN",
"BUFFER_OVERRUN",
"BUFFER_UNDERRUN",
"reserved",
"reserved",
"NOT_ACCESSED",
"NOT_ACCESSED",
1173};
1174#endif

1176void
1177ohci_add_done(struct ohci_softc *sc, ohci_physaddr_t done)
1178{
struct ohci_soft_itd *sitd, *sidone, **ip;
struct ohci_soft_td *std, *sdone, **p;

/* Reverse the done list. */
for (sdone = NULL((void *)0), sidone = NULL((void *)0); done != 0; ) {
std = ohci_hash_find_td(sc, done);
if (std != NULL((void *)0)) {
	std->dnext = sdone;
	done = letoh32(std->td.td_nexttd)((__uint32_t)(std->td.td_nexttd));
	sdone = std;
	DPRINTFN(10,("add TD %p\n", std));
	continue;
}
sitd = ohci_hash_find_itd(sc, done);
if (sitd != NULL((void *)0)) {
	sitd->dnext = sidone;
	done = letoh32(sitd->itd.itd_nextitd)((__uint32_t)(sitd->itd.itd_nextitd));
	sidone = sitd;
	DPRINTFN(5,("add ITD %p\n", sitd));
	continue;
}
panic("ohci_add_done: addr 0x%08lx not found", (u_long)done);
}

/* sdone & sidone now hold the done lists. */
/* Put them on the already processed lists. */
for (p = &sc->sc_sdone; *p != NULL((void *)0); p = &(*p)->dnext)
;
*p = sdone;
for (ip = &sc->sc_sidone; *ip != NULL((void *)0); ip = &(*ip)->dnext)
;
*ip = sidone;
1211}

1213void
1214ohci_softintr(void *v)
1215{
struct ohci_softc *sc = v;
struct ohci_soft_itd *sitd, *sidone, *sitdnext;
struct ohci_soft_td *std, *sdone, *stdnext;
struct usbd_xfer *xfer;
struct ohci_pipe *opipe;
int len, cc, s;
int i, j, actlen, iframes, uedir;

DPRINTFN(10,("ohci_softintr: enter\n"));

if (sc->sc_bus.dying)
return;

sc->sc_bus.intr_context++;

s = splhardusb()splraise(0x6);
sdone = sc->sc_sdone;
sc->sc_sdone = NULL((void *)0);
sidone = sc->sc_sidone;
sc->sc_sidone = NULL((void *)0);
splx(s)spllower(s);

DPRINTFN(10,("ohci_softintr: sdone=%p sidone=%p\n", sdone, sidone));

1240#ifdef OHCI_DEBUG
if (ohcidebug > 10) {
DPRINTF(("ohci_process_done: TD done:\n"));
ohci_dump_tds(sdone);
}
1245#endif

for (std = sdone; std; std = stdnext) {
xfer = std->xfer;
stdnext = std->dnext;
DPRINTFN(10, ("ohci_process_done: std=%p xfer=%p hcpriv=%p\n",
		std, xfer, xfer ? xfer->hcpriv : 0));
if (xfer == NULL((void *)0)) {
	/*
	 * xfer == NULL: There seems to be no xfer associated
	 * with this TD. It is tailp that happened to end up on
	 * the done queue.
	 * Shouldn't happen, but some chips are broken(?).
	 */
	continue;
}
if (xfer->status == USBD_CANCELLED ||
    xfer->status == USBD_TIMEOUT) {
	DPRINTF(("ohci_process_done: cancel/timeout %p\n",
		 xfer));
	/* Handled by abort routine. */
	continue;
}
timeout_del(&xfer->timeout_handle);
usb_rem_task(xfer->device, &xfer->abort_task);

len = std->len;
if (std->td.td_cbp != 0)
	len -= letoh32(std->td.td_be)((__uint32_t)(std->td.td_be)) -
	    letoh32(std->td.td_cbp)((__uint32_t)(std->td.td_cbp)) + 1;
DPRINTFN(10, ("ohci_process_done: len=%d, flags=0x%x\n", len,
    std->flags));
if (std->flags & OHCI_ADD_LEN0x0002)
	xfer->actlen += len;

cc = OHCI_TD_GET_CC(letoh32(std->td.td_flags))((((__uint32_t)(std->td.td_flags))) >> 28);
if (cc == OHCI_CC_NO_ERROR0) {
	int done = (std->flags & OHCI_CALL_DONE0x0001);

	ohci_free_std(sc, std);
	if (done) {
		if (xfer->actlen)
			usb_syncmem(&xfer->dmabuf, 0,
			    xfer->actlen,
			    usbd_xfer_isread(xfer) ?
			    BUS_DMASYNC_POSTREAD0x02 :
			    BUS_DMASYNC_POSTWRITE0x08);
		xfer->status = USBD_NORMAL_COMPLETION;
		s = splusb()splraise(0x5);
		usb_transfer_complete(xfer);
		splx(s)spllower(s);
	}
} else {
	/*
	 * Endpoint is halted.  First unlink all the TDs
	 * belonging to the failed transfer, and then restart
	 * the endpoint.
	 */
	struct ohci_soft_td *p, *n;
	opipe = (struct ohci_pipe *)xfer->pipe;

	DPRINTFN(15,("ohci_process_done: error cc=%d (%s)\n",
	  OHCI_TD_GET_CC(letoh32(std->td.td_flags)),
	  ohci_cc_strs[OHCI_TD_GET_CC(letoh32(std->td.td_flags))]));

	/* remove TDs */
	for (p = std; p->xfer == xfer; p = n) {
		n = p->nexttd;
		ohci_free_std(sc, p);
	}

	/* clear halt */
	opipe->sed->ed.ed_headp = htole32(p->physaddr)((__uint32_t)(p->physaddr));
	OWRITE4(sc, OHCI_COMMAND_STATUS, OHCI_CLF)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x08)), ((0x00000002)))); } while (0);

	if (cc == OHCI_CC_STALL4)
		xfer->status = USBD_STALLED;
	else if (cc == OHCI_CC_DATA_UNDERRUN9) {
		if (xfer->actlen)
			usb_syncmem(&xfer->dmabuf, 0,
			    xfer->actlen,
			    usbd_xfer_isread(xfer) ?
			    BUS_DMASYNC_POSTREAD0x02 :
			    BUS_DMASYNC_POSTWRITE0x08);
		xfer->status = USBD_NORMAL_COMPLETION;
	} else
		xfer->status = USBD_IOERROR;
	s = splusb()splraise(0x5);
	usb_transfer_complete(xfer);
	splx(s)spllower(s);
}
}

1338#ifdef OHCI_DEBUG
if (ohcidebug > 10) {
DPRINTF(("ohci_softintr: ITD done:\n"));
ohci_dump_itds(sidone);
}
1343#endif

for (sitd = sidone; sitd != NULL((void *)0); sitd = sitdnext) {
xfer = sitd->xfer;
sitdnext = sitd->dnext;
DPRINTFN(1, ("ohci_process_done: sitd=%p xfer=%p hcpriv=%p\n",
	     sitd, xfer, xfer ? xfer->hcpriv : 0));
if (xfer == NULL((void *)0))
	continue;
if (xfer->status == USBD_CANCELLED ||
    xfer->status == USBD_TIMEOUT) {
	DPRINTF(("ohci_process_done: cancel/timeout %p\n",
		 xfer));
	/* Handled by abort routine. */
	continue;
}
1359#ifdef DIAGNOSTIC1
if (sitd->isdone)
	printf("ohci_softintr: sitd=%p is done\n", sitd);
sitd->isdone = 1;
1363#endif
if (sitd->flags & OHCI_CALL_DONE0x0001) {
	struct ohci_soft_itd *next;

	opipe = (struct ohci_pipe *)xfer->pipe;
	opipe->u.iso.inuse -= xfer->nframes;
	uedir = UE_GET_DIR(xfer->pipe->endpoint->edesc->((xfer->pipe->endpoint->edesc-> bEndpointAddress)
 & 0x80)
	    bEndpointAddress)((xfer->pipe->endpoint->edesc-> bEndpointAddress)
 & 0x80);
	xfer->status = USBD_NORMAL_COMPLETION;
	actlen = 0;
	for (i = 0, sitd = xfer->hcpriv; ;
	    sitd = next) {
		next = sitd->nextitd;
		if (OHCI_ITD_GET_CC(letoh32(sitd->((((__uint32_t)(sitd-> itd.itd_flags))) >> 28)
		    itd.itd_flags))((((__uint32_t)(sitd-> itd.itd_flags))) >> 28) != OHCI_CC_NO_ERROR0)
			xfer->status = USBD_IOERROR;
		/* For input, update frlengths with actual */
		/* XXX anything necessary for output? */
		if (uedir == UE_DIR_IN0x80 &&
		    xfer->status == USBD_NORMAL_COMPLETION) {
			iframes = OHCI_ITD_GET_FC(letoh32(((((((__uint32_t)(sitd->itd.itd_flags))) >> 24) &
 7)+1)
			    sitd->itd.itd_flags))((((((__uint32_t)(sitd->itd.itd_flags))) >> 24) &
 7)+1);
			for (j = 0; j < iframes; i++, j++) {
				len = letoh16(sitd->((__uint16_t)(sitd-> itd.itd_offset[j]))
				    itd.itd_offset[j])((__uint16_t)(sitd-> itd.itd_offset[j]));
				if ((OHCI_ITD_PSW_GET_CC(len)((len) >> 12) &
				    OHCI_CC_NOT_ACCESSED_MASK14)
				    == OHCI_CC_NOT_ACCESSED14)
					len = 0;
				else
					len = OHCI_ITD_PSW_LENGTH(len)((len) & 0xfff);
				xfer->frlengths[i] = len;
				actlen += len;
			}
		}
		if (sitd->flags & OHCI_CALL_DONE0x0001)
			break;
		ohci_free_sitd(sc, sitd);
	}
	ohci_free_sitd(sc, sitd);
	if (uedir == UE_DIR_IN0x80 &&
	    xfer->status == USBD_NORMAL_COMPLETION)
		xfer->actlen = actlen;
	xfer->hcpriv = NULL((void *)0);

	if (xfer->status == USBD_NORMAL_COMPLETION) {
		usb_syncmem(&xfer->dmabuf, 0, xfer->length,
		    usbd_xfer_isread(xfer) ?
		    BUS_DMASYNC_POSTREAD0x02 :
		    BUS_DMASYNC_POSTWRITE0x08);
	}

	s = splusb()splraise(0x5);
	usb_transfer_complete(xfer);
	splx(s)spllower(s);
}
}

if (sc->sc_softwake) {
sc->sc_softwake = 0;
wakeup(&sc->sc_softwake);
}

sc->sc_bus.intr_context--;
DPRINTFN(10,("ohci_softintr: done:\n"));
1428}

1430void
1431ohci_device_ctrl_done(struct usbd_xfer *xfer)
1432{
DPRINTFN(10,("ohci_device_ctrl_done: xfer=%p\n", xfer));

1435#ifdef DIAGNOSTIC1
if (!(xfer->rqflags & URQ_REQUEST0x01)) {
panic("ohci_device_ctrl_done: not a request");
}
1439#endif
1440}

1442void
1443ohci_device_intr_done(struct usbd_xfer *xfer)
1444{
struct ohci_softc *sc = (struct ohci_softc *)xfer->device->bus;
struct ohci_pipe *opipe = (struct ohci_pipe *)xfer->pipe;
struct ohci_soft_ed *sed = opipe->sed;
struct ohci_soft_td *data, *tail;


DPRINTFN(10, ("ohci_device_intr_done: xfer=%p, actlen=%d\n", xfer,
   xfer->actlen));

if (xfer->pipe->repeat) {
data = opipe->tail.td;
tail = ohci_alloc_std(sc);
if (tail == NULL((void *)0)) {
	xfer->status = USBD_NOMEM;
	return;
}
tail->xfer = NULL((void *)0);

data->td.td_flags = htole32(((__uint32_t)(0x00100000 | 0xf0000000 | ((1) << 21) | 0x00000000
))
	OHCI_TD_IN | OHCI_TD_NOCC |((__uint32_t)(0x00100000 | 0xf0000000 | ((1) << 21) | 0x00000000
))
	OHCI_TD_SET_DI(1) | OHCI_TD_TOGGLE_CARRY)((__uint32_t)(0x00100000 | 0xf0000000 | ((1) << 21) | 0x00000000
));
if (xfer->flags & USBD_SHORT_XFER_OK0x04)
	data->td.td_flags |= htole32(OHCI_TD_R)((__uint32_t)(0x00040000));
data->td.td_cbp = htole32(DMAADDR(&xfer->dmabuf, 0))((__uint32_t)(((&xfer->dmabuf)->block->map->dm_segs
[0].ds_addr + (&xfer->dmabuf)->offs + (0))));
data->nexttd = tail;
data->td.td_nexttd = htole32(tail->physaddr)((__uint32_t)(tail->physaddr));
data->td.td_be = htole32(letoh32(data->td.td_cbp) +((__uint32_t)(((__uint32_t)(data->td.td_cbp)) + xfer->length
 - 1))
	xfer->length - 1)((__uint32_t)(((__uint32_t)(data->td.td_cbp)) + xfer->length
 - 1));
data->len = xfer->length;
data->xfer = xfer;
data->flags = OHCI_CALL_DONE0x0001 | OHCI_ADD_LEN0x0002;
xfer->hcpriv = data;
xfer->actlen = 0;

sed->ed.ed_tailp = htole32(tail->physaddr)((__uint32_t)(tail->physaddr));
opipe->tail.td = tail;
}
1482}

1484void
1485ohci_device_bulk_done(struct usbd_xfer *xfer)
1486{
DPRINTFN(10, ("ohci_device_bulk_done: xfer=%p, actlen=%d\n", xfer,
   xfer->actlen));
1489}

1491void
1492ohci_rhsc(struct ohci_softc *sc, struct usbd_xfer *xfer)
1493{
u_char *p;
int i, m;
int hstatus;

hstatus = OREAD4(sc, OHCI_RH_STATUS0x50);
DPRINTF(("ohci_rhsc: sc=%p xfer=%p hstatus=0x%08x\n",
 sc, xfer, hstatus));

if (xfer == NULL((void *)0)) {
/* Just ignore the change. */
return;
}

p = KERNADDR(&xfer->dmabuf, 0)((void *)((char *)((&xfer->dmabuf)->block->kaddr
 + (&xfer->dmabuf)->offs) + (0)));
m = min(sc->sc_noport, xfer->length * 8 - 1);
memset(p, 0, xfer->length)__builtin_memset((p), (0), (xfer->length));
for (i = 1; i <= m; i++) {
/* Pick out CHANGE bits from the status reg. */
if (OREAD4(sc, OHCI_RH_PORT_STATUS(i)(0x50 + (i)*4)) >> 16)
	p[i/8] |= 1 << (i%8);
}
DPRINTF(("ohci_rhsc: change=0x%02x\n", *p));
xfer->actlen = xfer->length;
xfer->status = USBD_NORMAL_COMPLETION;

usb_transfer_complete(xfer);
1520}

1522void
1523ohci_root_intr_done(struct usbd_xfer *xfer)
1524{
1525}

1527void
1528ohci_root_ctrl_done(struct usbd_xfer *xfer)
1529{
1530}

1532void
1533ohci_poll(struct usbd_bus *bus)
1534{
struct ohci_softc *sc = (struct ohci_softc *)bus;
1536#ifdef OHCI_DEBUG
static int last;
int new;
new = OREAD4(sc, OHCI_INTERRUPT_STATUS0x0c);
if (new != last) {
DPRINTFN(10,("ohci_poll: intrs=0x%04x\n", new));
last = new;
}
1544#endif

if (OREAD4(sc, OHCI_INTERRUPT_STATUS0x0c) & sc->sc_eintrs)
ohci_intr1(sc);
1548}

1550usbd_status
1551ohci_device_request(struct usbd_xfer *xfer)
1552{
struct ohci_softc *sc = (struct ohci_softc *)xfer->device->bus;
struct ohci_pipe *opipe = (struct ohci_pipe *)xfer->pipe;
usb_device_request_t *req = &xfer->request;
struct ohci_soft_td *setup, *stat, *next, *tail;
struct ohci_soft_ed *sed;
u_int len;
usbd_status err;
int s;

len = UGETW(req->wLength)(*(u_int16_t *)(req->wLength));

DPRINTFN(3,("ohci_device_control type=0x%02x, request=0x%02x, "
    "wValue=0x%04x, wIndex=0x%04x len=%u, addr=%d, endpt=%d\n",
    req->bmRequestType, req->bRequest, UGETW(req->wValue),
    UGETW(req->wIndex), len, xfer->device->address,
    xfer->pipe->endpoint->edesc->bEndpointAddress));

setup = opipe->tail.td;
stat = ohci_alloc_std(sc);
if (stat == NULL((void *)0)) {
err = USBD_NOMEM;
goto bad1;
}
tail = ohci_alloc_std(sc);
if (tail == NULL((void *)0)) {
err = USBD_NOMEM;
goto bad2;
}
tail->xfer = NULL((void *)0);

sed = opipe->sed;

next = stat;

/* Set up data transaction */
if (len != 0) {
struct ohci_soft_td *std = stat;

err = ohci_alloc_std_chain(sc, len, xfer, std, &stat);
stat = stat->nexttd; /* point at free TD */
if (err)
	goto bad3;
/* Start toggle at 1 and then use the carried toggle. */
std->td.td_flags &= htole32(~OHCI_TD_TOGGLE_MASK)((__uint32_t)(~0x03000000));
std->td.td_flags |= htole32(OHCI_TD_TOGGLE_1)((__uint32_t)(0x03000000));
}

memcpy(KERNADDR(&opipe->u.ctl.reqdma, 0), req, sizeof *req)__builtin_memcpy((((void *)((char *)((&opipe->u.ctl.reqdma
)->block->kaddr + (&opipe->u.ctl.reqdma)->offs
) + (0)))), (req), (sizeof *req));

setup->td.td_flags = htole32(OHCI_TD_SETUP | OHCI_TD_NOCC |((__uint32_t)(0x00000000 | 0xf0000000 | 0x02000000 | 0x00e00000
))
		     OHCI_TD_TOGGLE_0 | OHCI_TD_NOINTR)((__uint32_t)(0x00000000 | 0xf0000000 | 0x02000000 | 0x00e00000
));
setup->td.td_cbp = htole32(DMAADDR(&opipe->u.ctl.reqdma, 0))((__uint32_t)(((&opipe->u.ctl.reqdma)->block->map
->dm_segs[0].ds_addr + (&opipe->u.ctl.reqdma)->offs
 + (0))));
setup->nexttd = next;
setup->td.td_nexttd = htole32(next->physaddr)((__uint32_t)(next->physaddr));
setup->td.td_be = htole32(letoh32(setup->td.td_cbp) + sizeof *req - 1)((__uint32_t)(((__uint32_t)(setup->td.td_cbp)) + sizeof *req
 - 1));
setup->len = 0;
setup->xfer = xfer;
setup->flags = 0;
xfer->hcpriv = setup;

stat->td.td_flags = htole32(((__uint32_t)((usbd_xfer_isread(xfer) ? 0x00080000 : 0x00100000
) | 0xf0000000 | 0x03000000 | ((1) << 21)))
(usbd_xfer_isread(xfer) ? OHCI_TD_OUT : OHCI_TD_IN) |((__uint32_t)((usbd_xfer_isread(xfer) ? 0x00080000 : 0x00100000
) | 0xf0000000 | 0x03000000 | ((1) << 21)))
OHCI_TD_NOCC | OHCI_TD_TOGGLE_1 | OHCI_TD_SET_DI(1))((__uint32_t)((usbd_xfer_isread(xfer) ? 0x00080000 : 0x00100000
) | 0xf0000000 | 0x03000000 | ((1) << 21)));
stat->td.td_cbp = 0;
stat->nexttd = tail;
stat->td.td_nexttd = htole32(tail->physaddr)((__uint32_t)(tail->physaddr));
stat->td.td_be = 0;
stat->flags = OHCI_CALL_DONE0x0001;
stat->len = 0;
stat->xfer = xfer;

1624#ifdef OHCI_DEBUG
if (ohcidebug > 5) {
DPRINTF(("ohci_device_request:\n"));
ohci_dump_ed(sed);
ohci_dump_tds(setup);
}
1630#endif

/* Insert ED in schedule */
s = splusb()splraise(0x5);
sed->ed.ed_tailp = htole32(tail->physaddr)((__uint32_t)(tail->physaddr));
opipe->tail.td = tail;
OWRITE4(sc, OHCI_COMMAND_STATUS, OHCI_CLF)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x08)), ((0x00000002)))); } while (0);
if (xfer->timeout && !sc->sc_bus.use_polling) {
              timeout_del(&xfer->timeout_handle);
              timeout_set(&xfer->timeout_handle, ohci_timeout, xfer);
              timeout_add_msec(&xfer->timeout_handle, xfer->timeout);
}
splx(s)spllower(s);

1644#ifdef OHCI_DEBUG
if (ohcidebug > 20) {
delay(10000)(*delay_func)(10000);
DPRINTF(("ohci_device_request: status=%x\n",
	 OREAD4(sc, OHCI_COMMAND_STATUS)));
ohci_dumpregs(sc);
printf("ctrl head:\n");
ohci_dump_ed(sc->sc_ctrl_head);
printf("sed:\n");
ohci_dump_ed(sed);
ohci_dump_tds(setup);
}
1656#endif

return (USBD_NORMAL_COMPLETION);

bad3:
ohci_free_std(sc, tail);
bad2:
ohci_free_std(sc, stat);
bad1:
return (err);
1666}

1668/*
* Add an ED to the schedule.  Called at splusb().
*/
1671void
1672ohci_add_ed(struct ohci_soft_ed *sed, struct ohci_soft_ed *head)
1673{
DPRINTFN(8,("ohci_add_ed: sed=%p head=%p\n", sed, head));

splsoftassert(IPL_SOFTUSB)do { if (splassert_ctl > 0) { splassert_check(0x5, __func__
); } } while (0);
sed->next = head->next;
sed->ed.ed_nexted = head->ed.ed_nexted;
head->next = sed;
head->ed.ed_nexted = htole32(sed->physaddr)((__uint32_t)(sed->physaddr));
1681}

1683/*
* Remove an ED from the schedule.  Called at splusb().
*/
1686void
1687ohci_rem_ed(struct ohci_soft_ed *sed, struct ohci_soft_ed *head)
1688{
struct ohci_soft_ed *p;

splsoftassert(IPL_SOFTUSB)do { if (splassert_ctl > 0) { splassert_check(0x5, __func__
); } } while (0);

/* XXX */
for (p = head; p != NULL((void *)0) && p->next != sed; p = p->next)
;
if (p == NULL((void *)0))
panic("ohci_rem_ed: ED not found");
p->next = sed->next;
p->ed.ed_nexted = sed->ed.ed_nexted;
1700}

1702/*
* When a transfer is completed the TD is added to the done queue by
* the host controller.  This queue is the processed by software.
* Unfortunately the queue contains the physical address of the TD
* and we have no simple way to translate this back to a kernel address.
* To make the translation possible (and fast) we use a hash table of
* TDs currently in the schedule.  The physical address is used as the
* hash value.
*/

1712#define HASH(a)(((a) >> 4) % 128) (((a) >> 4) % OHCI_HASH_SIZE128)
1713/* Called at splusb() */
1714void
1715ohci_hash_add_td(struct ohci_softc *sc, struct ohci_soft_td *std)
1716{
int h = HASH(std->physaddr)(((std->physaddr) >> 4) % 128);

splsoftassert(IPL_SOFTUSB)do { if (splassert_ctl > 0) { splassert_check(0x5, __func__
); } } while (0);

LIST_INSERT_HEAD(&sc->sc_hash_tds[h], std, hnext)do { if (((std)->hnext.le_next = (&sc->sc_hash_tds[
h])->lh_first) != ((void *)0)) (&sc->sc_hash_tds[h]
)->lh_first->hnext.le_prev = &(std)->hnext.le_next
; (&sc->sc_hash_tds[h])->lh_first = (std); (std)->
hnext.le_prev = &(&sc->sc_hash_tds[h])->lh_first
; } while (0);
1722}

1724struct ohci_soft_td *
1725ohci_hash_find_td(struct ohci_softc *sc, ohci_physaddr_t a)
1726{
int h = HASH(a)(((a) >> 4) % 128);
struct ohci_soft_td *std;

for (std = LIST_FIRST(&sc->sc_hash_tds[h])((&sc->sc_hash_tds[h])->lh_first);
    std != NULL((void *)0);
    std = LIST_NEXT(std, hnext)((std)->hnext.le_next))
if (std->physaddr == a)
	return (std);
return (NULL((void *)0));
1736}

1738/* Called at splusb() */
1739void
1740ohci_hash_add_itd(struct ohci_softc *sc, struct ohci_soft_itd *sitd)
1741{
int h = HASH(sitd->physaddr)(((sitd->physaddr) >> 4) % 128);

splsoftassert(IPL_SOFTUSB)do { if (splassert_ctl > 0) { splassert_check(0x5, __func__
); } } while (0);

DPRINTFN(10,("ohci_hash_add_itd: sitd=%p physaddr=0x%08lx\n",
    sitd, (u_long)sitd->physaddr));

LIST_INSERT_HEAD(&sc->sc_hash_itds[h], sitd, hnext)do { if (((sitd)->hnext.le_next = (&sc->sc_hash_itds
[h])->lh_first) != ((void *)0)) (&sc->sc_hash_itds[
h])->lh_first->hnext.le_prev = &(sitd)->hnext.le_next
; (&sc->sc_hash_itds[h])->lh_first = (sitd); (sitd)
->hnext.le_prev = &(&sc->sc_hash_itds[h])->lh_first
; } while (0);
1750}

1752/* Called at splusb() */
1753void
1754ohci_hash_rem_itd(struct ohci_softc *sc, struct ohci_soft_itd *sitd)
1755{
splsoftassert(IPL_SOFTUSB)do { if (splassert_ctl > 0) { splassert_check(0x5, __func__
); } } while (0);

DPRINTFN(10,("ohci_hash_rem_itd: sitd=%p physaddr=0x%08lx\n",
    sitd, (u_long)sitd->physaddr));

LIST_REMOVE(sitd, hnext)do { if ((sitd)->hnext.le_next != ((void *)0)) (sitd)->
hnext.le_next->hnext.le_prev = (sitd)->hnext.le_prev; *
(sitd)->hnext.le_prev = (sitd)->hnext.le_next; ((sitd)->
hnext.le_prev) = ((void *)-1); ((sitd)->hnext.le_next) = (
(void *)-1); } while (0);
1762}

1764struct ohci_soft_itd *
1765ohci_hash_find_itd(struct ohci_softc *sc, ohci_physaddr_t a)
1766{
int h = HASH(a)(((a) >> 4) % 128);
struct ohci_soft_itd *sitd;

for (sitd = LIST_FIRST(&sc->sc_hash_itds[h])((&sc->sc_hash_itds[h])->lh_first);
    sitd != NULL((void *)0);
    sitd = LIST_NEXT(sitd, hnext)((sitd)->hnext.le_next))
if (sitd->physaddr == a)
	return (sitd);
return (NULL((void *)0));
1776}

1778void
1779ohci_timeout(void *addr)
1780{
struct usbd_xfer *xfer = addr;
struct ohci_softc *sc = (struct ohci_softc *)xfer->device->bus;

if (sc->sc_bus.dying) {
ohci_timeout_task(addr);
return;
}

usb_init_task(&xfer->abort_task, ohci_timeout_task, addr,((&xfer->abort_task)->fun = (ohci_timeout_task), (&
xfer->abort_task)->arg = (addr), (&xfer->abort_task
)->type = (2), (&xfer->abort_task)->state = 0x0)
   USB_TASK_TYPE_ABORT)((&xfer->abort_task)->fun = (ohci_timeout_task), (&
xfer->abort_task)->arg = (addr), (&xfer->abort_task
)->type = (2), (&xfer->abort_task)->state = 0x0);
usb_add_task(xfer->device, &xfer->abort_task);
1792}

1794void
1795ohci_timeout_task(void *addr)
1796{
struct usbd_xfer *xfer = addr;
int s;

DPRINTF(("%s: xfer=%p\n", __func__, xfer));

s = splusb()splraise(0x5);
ohci_abort_xfer(xfer, USBD_TIMEOUT);
splx(s)spllower(s);
1805}

1807#ifdef OHCI_DEBUG
1808void
1809ohci_dump_tds(struct ohci_soft_td *std)
1810{
for (; std; std = std->nexttd)
ohci_dump_td(std);
1813}

1815void
1816ohci_dump_td(struct ohci_soft_td *std)
1817{
char sbuf[128];

bitmask_snprintf((u_int32_t)letoh32(std->td.td_flags)((__uint32_t)(std->td.td_flags)),
	 "\20\23R\24OUT\25IN\31TOG1\32SETTOGGLE",
	 sbuf, sizeof(sbuf));

printf("TD(%p) at %08lx: %s delay=%d ec=%d cc=%d\ncbp=0x%08lx "
      "nexttd=0x%08lx be=0x%08lx\n",
      std, (u_long)std->physaddr, sbuf,
      OHCI_TD_GET_DI(letoh32(std->td.td_flags))(((((__uint32_t)(std->td.td_flags))) >> 21) & 7),
      OHCI_TD_GET_EC(letoh32(std->td.td_flags))(((((__uint32_t)(std->td.td_flags))) >> 26) & 3),
      OHCI_TD_GET_CC(letoh32(std->td.td_flags))((((__uint32_t)(std->td.td_flags))) >> 28),
      (u_long)letoh32(std->td.td_cbp)((__uint32_t)(std->td.td_cbp)),
      (u_long)letoh32(std->td.td_nexttd)((__uint32_t)(std->td.td_nexttd)),
      (u_long)letoh32(std->td.td_be)((__uint32_t)(std->td.td_be)));
1833}

1835void
1836ohci_dump_itd(struct ohci_soft_itd *sitd)
1837{
int i;

printf("ITD(%p) at %08lx: sf=%d di=%d fc=%d cc=%d\n"
      "bp0=0x%08lx next=0x%08lx be=0x%08lx\n",
      sitd, (u_long)sitd->physaddr,
      OHCI_ITD_GET_SF(letoh32(sitd->itd.itd_flags))((((__uint32_t)(sitd->itd.itd_flags))) & 0x0000ffff),
      OHCI_ITD_GET_DI(letoh32(sitd->itd.itd_flags))(((((__uint32_t)(sitd->itd.itd_flags))) >> 21) &
 7),
      OHCI_ITD_GET_FC(letoh32(sitd->itd.itd_flags))((((((__uint32_t)(sitd->itd.itd_flags))) >> 24) &
 7)+1),
      OHCI_ITD_GET_CC(letoh32(sitd->itd.itd_flags))((((__uint32_t)(sitd->itd.itd_flags))) >> 28),
      (u_long)letoh32(sitd->itd.itd_bp0)((__uint32_t)(sitd->itd.itd_bp0)),
      (u_long)letoh32(sitd->itd.itd_nextitd)((__uint32_t)(sitd->itd.itd_nextitd)),
      (u_long)letoh32(sitd->itd.itd_be)((__uint32_t)(sitd->itd.itd_be)));
for (i = 0; i < OHCI_ITD_NOFFSET8; i++)
printf("offs[%d]=0x%04x ", i,
       (u_int)letoh16(sitd->itd.itd_offset[i])((__uint16_t)(sitd->itd.itd_offset[i])));
printf("\n");
1854}

1856void
1857ohci_dump_itds(struct ohci_soft_itd *sitd)
1858{
for (; sitd; sitd = sitd->nextitd)
ohci_dump_itd(sitd);
1861}

1863void
1864ohci_dump_ed(struct ohci_soft_ed *sed)
1865{
char sbuf[128], sbuf2[128];

bitmask_snprintf((u_int32_t)letoh32(sed->ed.ed_flags)((__uint32_t)(sed->ed.ed_flags)),
	 "\20\14OUT\15IN\16LOWSPEED\17SKIP\20ISO",
	 sbuf, sizeof(sbuf));
bitmask_snprintf((u_int32_t)letoh32(sed->ed.ed_headp)((__uint32_t)(sed->ed.ed_headp)),
	 "\20\1HALT\2CARRY", sbuf2, sizeof(sbuf2));

printf("ED(%p) at 0x%08lx: addr=%d endpt=%d maxp=%d flags=%s\n"
      "tailp=0x%08lx headflags=%s headp=0x%08lx nexted=0x%08lx\n",
      sed, (u_long)sed->physaddr,
      OHCI_ED_GET_FA(letoh32(sed->ed.ed_flags))((((__uint32_t)(sed->ed.ed_flags))) & 0x7f),
      OHCI_ED_GET_EN(letoh32(sed->ed.ed_flags))(((((__uint32_t)(sed->ed.ed_flags))) >> 7) & 0xf
),
      OHCI_ED_GET_MAXP(letoh32(sed->ed.ed_flags))(((((__uint32_t)(sed->ed.ed_flags))) >> 16) & 0x07ff
), sbuf,
      (u_long)letoh32(sed->ed.ed_tailp)((__uint32_t)(sed->ed.ed_tailp)), sbuf2,
      (u_long)letoh32(sed->ed.ed_headp)((__uint32_t)(sed->ed.ed_headp)),
      (u_long)letoh32(sed->ed.ed_nexted)((__uint32_t)(sed->ed.ed_nexted)));
1883}
1884#endif

1886usbd_status
1887ohci_open(struct usbd_pipe *pipe)
1888{
struct ohci_softc *sc = (struct ohci_softc *)pipe->device->bus;
usb_endpoint_descriptor_t *ed = pipe->endpoint->edesc;
struct ohci_pipe *opipe = (struct ohci_pipe *)pipe;
u_int8_t xfertype = UE_GET_XFERTYPE(ed->bmAttributes)((ed->bmAttributes) & 0x03);
struct ohci_soft_ed *sed = NULL((void *)0);
struct ohci_soft_td *std = NULL((void *)0);
struct ohci_soft_itd *sitd;
ohci_physaddr_t tdphys;
u_int32_t fmt;
usbd_status err;
int s;
int ival;

DPRINTFN(1, ("ohci_open: pipe=%p, addr=%d, endpt=%d\n",
     pipe, pipe->device->address, ed->bEndpointAddress));

if (sc->sc_bus.dying)
return (USBD_IOERROR);

/* Root Hub */
if (pipe->device->depth == 0) {
switch (ed->bEndpointAddress) {
case USB_CONTROL_ENDPOINT0:
	pipe->methods = &ohci_root_ctrl_methods;
	break;
case UE_DIR_IN0x80 | OHCI_INTR_ENDPT1:
	pipe->methods = &ohci_root_intr_methods;
	break;
default:
	return (USBD_INVAL);
}
} else {
sed = ohci_alloc_sed(sc);
if (sed == NULL((void *)0))
	goto bad0;
opipe->sed = sed;
if (xfertype == UE_ISOCHRONOUS0x01) {
	sitd = ohci_alloc_sitd(sc);
	if (sitd == NULL((void *)0))
		goto bad1;
	opipe->tail.itd = sitd;
	tdphys = sitd->physaddr;
	fmt = OHCI_ED_FORMAT_ISO0x00008000;
	if (UE_GET_DIR(ed->bEndpointAddress)((ed->bEndpointAddress) & 0x80) == UE_DIR_IN0x80)
		fmt |= OHCI_ED_DIR_IN0x00001000;
	else
		fmt |= OHCI_ED_DIR_OUT0x00000800;
} else {
	std = ohci_alloc_std(sc);
	if (std == NULL((void *)0))
		goto bad1;
	opipe->tail.td = std;
	tdphys = std->physaddr;
	fmt = OHCI_ED_FORMAT_GEN0x00000000 | OHCI_ED_DIR_TD0x00000000;
}
sed->ed.ed_flags = htole32(((__uint32_t)((pipe->device->address) | ((((ed->bEndpointAddress
) & 0x0f)) << 7) | (pipe->device->speed == 1 ?
 0x00002000 : 0) | fmt | (((*(u_int16_t *)(ed->wMaxPacketSize
))) << 16)))
	OHCI_ED_SET_FA(pipe->device->address) |((__uint32_t)((pipe->device->address) | ((((ed->bEndpointAddress
) & 0x0f)) << 7) | (pipe->device->speed == 1 ?
 0x00002000 : 0) | fmt | (((*(u_int16_t *)(ed->wMaxPacketSize
))) << 16)))
	OHCI_ED_SET_EN(UE_GET_ADDR(ed->bEndpointAddress)) |((__uint32_t)((pipe->device->address) | ((((ed->bEndpointAddress
) & 0x0f)) << 7) | (pipe->device->speed == 1 ?
 0x00002000 : 0) | fmt | (((*(u_int16_t *)(ed->wMaxPacketSize
))) << 16)))
	(pipe->device->speed == USB_SPEED_LOW ?((__uint32_t)((pipe->device->address) | ((((ed->bEndpointAddress
) & 0x0f)) << 7) | (pipe->device->speed == 1 ?
 0x00002000 : 0) | fmt | (((*(u_int16_t *)(ed->wMaxPacketSize
))) << 16)))
	     OHCI_ED_SPEED : 0) |((__uint32_t)((pipe->device->address) | ((((ed->bEndpointAddress
) & 0x0f)) << 7) | (pipe->device->speed == 1 ?
 0x00002000 : 0) | fmt | (((*(u_int16_t *)(ed->wMaxPacketSize
))) << 16)))
	fmt | OHCI_ED_SET_MAXP(UGETW(ed->wMaxPacketSize)))((__uint32_t)((pipe->device->address) | ((((ed->bEndpointAddress
) & 0x0f)) << 7) | (pipe->device->speed == 1 ?
 0x00002000 : 0) | fmt | (((*(u_int16_t *)(ed->wMaxPacketSize
))) << 16)));
sed->ed.ed_headp = htole32(tdphys |((__uint32_t)(tdphys | (pipe->endpoint->savedtoggle ? 0x00000002
 : 0)))
    (pipe->endpoint->savedtoggle ? OHCI_TOGGLECARRY : 0))((__uint32_t)(tdphys | (pipe->endpoint->savedtoggle ? 0x00000002
 : 0)));
sed->ed.ed_tailp = htole32(tdphys)((__uint32_t)(tdphys));

switch (xfertype) {
case UE_CONTROL0x00:
	pipe->methods = &ohci_device_ctrl_methods;
	err = usb_allocmem(&sc->sc_bus,
		  sizeof(usb_device_request_t),
		  0, USB_DMA_COHERENT(1 << 0),
		  &opipe->u.ctl.reqdma);
	if (err)
		goto bad;
	s = splusb()splraise(0x5);
	ohci_add_ed(sed, sc->sc_ctrl_head);
	splx(s)spllower(s);
	break;
case UE_INTERRUPT0x03:
	pipe->methods = &ohci_device_intr_methods;
	ival = pipe->interval;
	if (ival == USBD_DEFAULT_INTERVAL(-1))
		ival = ed->bInterval;
	return (ohci_device_setintr(sc, opipe, ival));
case UE_ISOCHRONOUS0x01:
	pipe->methods = &ohci_device_isoc_methods;
	return (ohci_setup_isoc(pipe));
case UE_BULK0x02:
	pipe->methods = &ohci_device_bulk_methods;
	s = splusb()splraise(0x5);
	ohci_add_ed(sed, sc->sc_bulk_head);
	splx(s)spllower(s);
	break;
}
}
return (USBD_NORMAL_COMPLETION);

bad:
if (std != NULL((void *)0))
ohci_free_std(sc, std);
bad1:
if (sed != NULL((void *)0))
ohci_free_sed(sc, sed);
bad0:
return (USBD_NOMEM);

1995}

1997/*
* Work around the half configured control (default) pipe when setting
* the address of a device.
*
* Because a single ED is setup per endpoint in ohci_open(), and the
* control pipe is configured before we could have set the address
* of the device or read the wMaxPacketSize of the endpoint, we have
* to re-open the pipe twice here.
*/
2006int
2007ohci_setaddr(struct usbd_device *dev, int addr)
2008{
/* Root Hub */
if (dev->depth == 0)
return (0);

/* Re-establish the default pipe with the new max packet size. */
ohci_device_ctrl_close(dev->default_pipe);
if (ohci_open(dev->default_pipe))
return (EINVAL22);

if (usbd_set_address(dev, addr))
return (1);

dev->address = addr;

/* Re-establish the default pipe with the new address. */
ohci_device_ctrl_close(dev->default_pipe);
if (ohci_open(dev->default_pipe))
return (EINVAL22);

return (0);
2029}

2031/*
* Close a regular pipe.
* Assumes that there are no pending transactions.
*/
2035void
2036ohci_close_pipe(struct usbd_pipe *pipe, struct ohci_soft_ed *head)
2037{
struct ohci_pipe *opipe = (struct ohci_pipe *)pipe;
struct ohci_softc *sc = (struct ohci_softc *)pipe->device->bus;
struct ohci_soft_ed *sed = opipe->sed;
int s;

s = splusb()splraise(0x5);
2044#ifdef DIAGNOSTIC1
sed->ed.ed_flags |= htole32(OHCI_ED_SKIP)((__uint32_t)(0x00004000));
if ((letoh32(sed->ed.ed_tailp)((__uint32_t)(sed->ed.ed_tailp)) & OHCI_HEADMASK0xfffffffc) !=
   (letoh32(sed->ed.ed_headp)((__uint32_t)(sed->ed.ed_headp)) & OHCI_HEADMASK0xfffffffc)) {
struct ohci_soft_td *std;
std = ohci_hash_find_td(sc, letoh32(sed->ed.ed_headp)((__uint32_t)(sed->ed.ed_headp)));
printf("ohci_close_pipe: pipe not empty sed=%p hd=0x%x "
       "tl=0x%x pipe=%p, std=%p\n", sed,
       (int)letoh32(sed->ed.ed_headp)((__uint32_t)(sed->ed.ed_headp)),
       (int)letoh32(sed->ed.ed_tailp)((__uint32_t)(sed->ed.ed_tailp)),
       pipe, std);
2055#ifdef OHCI_DEBUG
ohci_dump_ed(sed);
if (std)
	ohci_dump_td(std);
2059#endif
usb_delay_ms(&sc->sc_bus, 2);
if ((letoh32(sed->ed.ed_tailp)((__uint32_t)(sed->ed.ed_tailp)) & OHCI_HEADMASK0xfffffffc) !=
    (letoh32(sed->ed.ed_headp)((__uint32_t)(sed->ed.ed_headp)) & OHCI_HEADMASK0xfffffffc))
	printf("ohci_close_pipe: pipe still not empty\n");
}
2065#endif
ohci_rem_ed(sed, head);
/* Make sure the host controller is not touching this ED */
usb_delay_ms(&sc->sc_bus, 1);
splx(s)spllower(s);
pipe->endpoint->savedtoggle =
   (letoh32(sed->ed.ed_headp)((__uint32_t)(sed->ed.ed_headp)) & OHCI_TOGGLECARRY0x00000002) ? 1 : 0;
ohci_free_sed(sc, opipe->sed);
2073}

2075/*
* Abort a device request.
* If this routine is called at splusb() it guarantees that the request
* will be removed from the hardware scheduling and that the callback
* for it will be called with USBD_CANCELLED status.
* It's impossible to guarantee that the requested transfer will not
* have happened since the hardware runs concurrently.
* If the transaction has already happened we rely on the ordinary
* interrupt processing to process it.
*/
2085void
2086ohci_abort_xfer(struct usbd_xfer *xfer, usbd_status status)
2087{
struct ohci_pipe *opipe = (struct ohci_pipe *)xfer->pipe;
struct ohci_softc *sc = (struct ohci_softc *)xfer->device->bus;
struct ohci_soft_ed *sed = opipe->sed;
struct ohci_soft_td *p, *n;
ohci_physaddr_t headp;
int s, hit;

DPRINTF(("ohci_abort_xfer: xfer=%p pipe=%p sed=%p\n", xfer, opipe,
 sed));

if (sc->sc_bus.dying) {
/* If we're dying, just do the software part. */
s = splusb()splraise(0x5);
xfer->status = status;	/* make software ignore it */
timeout_del(&xfer->timeout_handle);
usb_rem_task(xfer->device, &xfer->abort_task);
usb_transfer_complete(xfer);
splx(s)spllower(s);
return;
}

if (xfer->device->bus->intr_context || !curproc({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
 (__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
 __ci;})->ci_curproc)
panic("ohci_abort_xfer: not in process context");

/*
* Step 1: Make interrupt routine and hardware ignore xfer.
*/
s = splusb()splraise(0x5);
xfer->status = status;	/* make software ignore it */
timeout_del(&xfer->timeout_handle);
usb_rem_task(xfer->device, &xfer->abort_task);
splx(s)spllower(s);
DPRINTFN(1,("ohci_abort_xfer: stop ed=%p\n", sed));
sed->ed.ed_flags |= htole32(OHCI_ED_SKIP)((__uint32_t)(0x00004000)); /* force hardware skip */

/*
* Step 2: Wait until we know hardware has finished any possible
* use of the xfer.  Also make sure the soft interrupt routine
* has run.
*/
usb_delay_ms(xfer->device->bus, 20); /* Hardware finishes in 1ms */
s = splusb()splraise(0x5);
sc->sc_softwake = 1;
usb_schedsoftintr(&sc->sc_bus);
tsleep_nsec(&sc->sc_softwake, PZERO22, "ohciab", INFSLP0xffffffffffffffffULL);
splx(s)spllower(s);

/*
* Step 3: Remove any vestiges of the xfer from the hardware.
* The complication here is that the hardware may have executed
* beyond the xfer we're trying to abort.  So as we're scanning
* the TDs of this xfer we check if the hardware points to
* any of them.
*/
s = splusb()splraise(0x5);		/* XXX why? */
p = xfer->hcpriv;
2144#ifdef DIAGNOSTIC1
if (p == NULL((void *)0)) {
splx(s)spllower(s);
printf("ohci_abort_xfer: hcpriv is NULL\n");
return;
}
2150#endif
2151#ifdef OHCI_DEBUG
if (ohcidebug > 1) {
DPRINTF(("ohci_abort_xfer: sed=\n"));
ohci_dump_ed(sed);
ohci_dump_tds(p);
}
2157#endif
headp = letoh32(sed->ed.ed_headp)((__uint32_t)(sed->ed.ed_headp)) & OHCI_HEADMASK0xfffffffc;
hit = 0;
for (; p->xfer == xfer; p = n) {
hit |= headp == p->physaddr;
n = p->nexttd;
if (OHCI_TD_GET_CC(letoh32(p->td.td_flags))((((__uint32_t)(p->td.td_flags))) >> 28) ==
    OHCI_CC_NOT_ACCESSED14)
	ohci_free_std(sc, p);
}
/* Zap headp register if hardware pointed inside the xfer. */
if (hit) {
DPRINTFN(1,("ohci_abort_xfer: set hd=0x%08x, tl=0x%08x\n",
	    (int)p->physaddr, (int)letoh32(sed->ed.ed_tailp)));
sed->ed.ed_headp = htole32(p->physaddr)((__uint32_t)(p->physaddr)); /* unlink TDs */
} else {
DPRINTFN(1,("ohci_abort_xfer: no hit\n"));
}

/*
* Step 4: Turn on hardware again.
*/
sed->ed.ed_flags &= htole32(~OHCI_ED_SKIP)((__uint32_t)(~0x00004000)); /* remove hardware skip */

/*
* Step 5: Execute callback.
*/
usb_transfer_complete(xfer);

splx(s)spllower(s);
2187}

2189/*
* Data structures and routines to emulate the root hub.
*/
2192usb_device_descriptor_t ohci_devd = {
USB_DEVICE_DESCRIPTOR_SIZE18,
UDESC_DEVICE0x01,		/* type */
{0x00, 0x01},		/* USB version */
UDCLASS_HUB0x09,		/* class */
UDSUBCLASS_HUB0x00,		/* subclass */
UDPROTO_FSHUB0x00,
64,			/* max packet */
{0},{0},{0x00,0x01},	/* device id */
1,2,0,			/* string indices */
1			/* # of configurations */
2203};

2205usb_config_descriptor_t ohci_confd = {
USB_CONFIG_DESCRIPTOR_SIZE9,
UDESC_CONFIG0x02,
{USB_CONFIG_DESCRIPTOR_SIZE9 +
USB_INTERFACE_DESCRIPTOR_SIZE9 +
USB_ENDPOINT_DESCRIPTOR_SIZE7},
1,
1,
0,
UC_BUS_POWERED0x80 | UC_SELF_POWERED0x40,
0			/* max power */
2216};

2218usb_interface_descriptor_t ohci_ifcd = {
USB_INTERFACE_DESCRIPTOR_SIZE9,
UDESC_INTERFACE0x04,
0,
0,
1,
UICLASS_HUB0x09,
UISUBCLASS_HUB0,
UIPROTO_FSHUB0,
0
2228};

2230usb_endpoint_descriptor_t ohci_endpd = {
USB_ENDPOINT_DESCRIPTOR_SIZE7,
UDESC_ENDPOINT0x05,
UE_DIR_IN0x80 | OHCI_INTR_ENDPT1,
UE_INTERRUPT0x03,
{8, 0},			/* max packet */
255
2237};

2239usb_hub_descriptor_t ohci_hubd = {
USB_HUB_DESCRIPTOR_SIZE8,
UDESC_HUB0x29,
0,
{0,0},
0,
0,
{0},
2247};

2249/*
* Simulate a hardware hub by handling all the necessary requests.
*/
2252usbd_status
2253ohci_root_ctrl_transfer(struct usbd_xfer *xfer)
2254{
usbd_status err;

/* Insert last in queue. */
err = usb_insert_transfer(xfer);
if (err)
return (err);

/* Pipe isn't running, start first */
return (ohci_root_ctrl_start(SIMPLEQ_FIRST(&xfer->pipe->queue)((&xfer->pipe->queue)->sqh_first)));
2264}

2266usbd_status
2267ohci_root_ctrl_start(struct usbd_xfer *xfer)
2268{
struct ohci_softc *sc = (struct ohci_softc *)xfer->device->bus;
usb_device_request_t *req;
void *buf = NULL((void *)0);
int port, i;
int s, len, value, index, l, totlen = 0;
usb_port_status_t ps;
usb_hub_descriptor_t hubd;
usbd_status err;
u_int32_t v;

if (sc->sc_bus.dying)
return (USBD_IOERROR);

2282#ifdef DIAGNOSTIC1
if (!(xfer->rqflags & URQ_REQUEST0x01))
/* XXX panic */
return (USBD_INVAL);
2286#endif
req = &xfer->request;

DPRINTFN(4,("ohci_root_ctrl_control type=0x%02x request=%02x\n",
    req->bmRequestType, req->bRequest));

len = UGETW(req->wLength)(*(u_int16_t *)(req->wLength));
value = UGETW(req->wValue)(*(u_int16_t *)(req->wValue));
index = UGETW(req->wIndex)(*(u_int16_t *)(req->wIndex));

if (len != 0)
buf = KERNADDR(&xfer->dmabuf, 0)((void *)((char *)((&xfer->dmabuf)->block->kaddr
 + (&xfer->dmabuf)->offs) + (0)));

2299#define C(x,y)((x) | ((y) << 8)) ((x) | ((y) << 8))
switch(C(req->bRequest, req->bmRequestType)((req->bRequest) | ((req->bmRequestType) << 8))) {
case C(UR_CLEAR_FEATURE, UT_WRITE_DEVICE)((0x01) | (((0x00 | 0x00 | 0x00)) << 8)):
case C(UR_CLEAR_FEATURE, UT_WRITE_INTERFACE)((0x01) | (((0x00 | 0x00 | 0x01)) << 8)):
case C(UR_CLEAR_FEATURE, UT_WRITE_ENDPOINT)((0x01) | (((0x00 | 0x00 | 0x02)) << 8)):
/*
 * DEVICE_REMOTE_WAKEUP and ENDPOINT_HALT are no-ops
 * for the integrated root hub.
 */
break;
case C(UR_GET_CONFIG, UT_READ_DEVICE)((0x08) | (((0x80 | 0x00 | 0x00)) << 8)):
if (len > 0) {
	*(u_int8_t *)buf = sc->sc_conf;
	totlen = 1;
}
break;
case C(UR_GET_DESCRIPTOR, UT_READ_DEVICE)((0x06) | (((0x80 | 0x00 | 0x00)) << 8)):
DPRINTFN(8,("ohci_root_ctrl_control wValue=0x%04x\n", value));
switch(value >> 8) {
case UDESC_DEVICE0x01:
	if ((value & 0xff) != 0) {
		err = USBD_IOERROR;
		goto ret;
	}
	totlen = l = min(len, USB_DEVICE_DESCRIPTOR_SIZE18);
	USETW(ohci_devd.idVendor, sc->sc_id_vendor)(*(u_int16_t *)(ohci_devd.idVendor) = (sc->sc_id_vendor));
	memcpy(buf, &ohci_devd, l)__builtin_memcpy((buf), (&ohci_devd), (l));
	break;
case UDESC_CONFIG0x02:
	if ((value & 0xff) != 0) {
		err = USBD_IOERROR;
		goto ret;
	}
	totlen = l = min(len, USB_CONFIG_DESCRIPTOR_SIZE9);
	memcpy(buf, &ohci_confd, l)__builtin_memcpy((buf), (&ohci_confd), (l));
	buf = (char *)buf + l;
	len -= l;
	l = min(len, USB_INTERFACE_DESCRIPTOR_SIZE9);
	totlen += l;
	memcpy(buf, &ohci_ifcd, l)__builtin_memcpy((buf), (&ohci_ifcd), (l));
	buf = (char *)buf + l;
	len -= l;
	l = min(len, USB_ENDPOINT_DESCRIPTOR_SIZE7);
	totlen += l;
	memcpy(buf, &ohci_endpd, l)__builtin_memcpy((buf), (&ohci_endpd), (l));
	break;
case UDESC_STRING0x03:
	if (len == 0)
		break;
	*(u_int8_t *)buf = 0;
	totlen = 1;
	switch (value & 0xff) {
	case 0: /* Language table */
		totlen = usbd_str(buf, len, "\001");
		break;
	case 1: /* Vendor */
		totlen = usbd_str(buf, len, sc->sc_vendor);
		break;
	case 2: /* Product */
		totlen = usbd_str(buf, len, "OHCI root hub");
		break;
	}
	break;
default:
	err = USBD_IOERROR;
	goto ret;
}
break;
case C(UR_GET_INTERFACE, UT_READ_INTERFACE)((0x0a) | (((0x80 | 0x00 | 0x01)) << 8)):
if (len > 0) {
	*(u_int8_t *)buf = 0;
	totlen = 1;
}
break;
case C(UR_GET_STATUS, UT_READ_DEVICE)((0x00) | (((0x80 | 0x00 | 0x00)) << 8)):
if (len > 1) {
	USETW(((usb_status_t *)buf)->wStatus,UDS_SELF_POWERED)(*(u_int16_t *)(((usb_status_t *)buf)->wStatus) = (0x0001)
);
	totlen = 2;
}
break;
case C(UR_GET_STATUS, UT_READ_INTERFACE)((0x00) | (((0x80 | 0x00 | 0x01)) << 8)):
case C(UR_GET_STATUS, UT_READ_ENDPOINT)((0x00) | (((0x80 | 0x00 | 0x02)) << 8)):
if (len > 1) {
	USETW(((usb_status_t *)buf)->wStatus, 0)(*(u_int16_t *)(((usb_status_t *)buf)->wStatus) = (0));
	totlen = 2;
}
break;
case C(UR_SET_ADDRESS, UT_WRITE_DEVICE)((0x05) | (((0x00 | 0x00 | 0x00)) << 8)):
if (value >= USB_MAX_DEVICES128) {
	err = USBD_IOERROR;
	goto ret;
}
break;
case C(UR_SET_CONFIG, UT_WRITE_DEVICE)((0x09) | (((0x00 | 0x00 | 0x00)) << 8)):
if (value != 0 && value != 1) {
	err = USBD_IOERROR;
	goto ret;
}
sc->sc_conf = value;
break;
case C(UR_SET_DESCRIPTOR, UT_WRITE_DEVICE)((0x07) | (((0x00 | 0x00 | 0x00)) << 8)):
break;
case C(UR_SET_FEATURE, UT_WRITE_DEVICE)((0x03) | (((0x00 | 0x00 | 0x00)) << 8)):
case C(UR_SET_FEATURE, UT_WRITE_INTERFACE)((0x03) | (((0x00 | 0x00 | 0x01)) << 8)):
case C(UR_SET_FEATURE, UT_WRITE_ENDPOINT)((0x03) | (((0x00 | 0x00 | 0x02)) << 8)):
err = USBD_IOERROR;
goto ret;
case C(UR_SET_INTERFACE, UT_WRITE_INTERFACE)((0x0b) | (((0x00 | 0x00 | 0x01)) << 8)):
break;
case C(UR_SYNCH_FRAME, UT_WRITE_ENDPOINT)((0x0c) | (((0x00 | 0x00 | 0x02)) << 8)):
break;
/* Hub requests */
case C(UR_CLEAR_FEATURE, UT_WRITE_CLASS_DEVICE)((0x01) | (((0x00 | 0x20 | 0x00)) << 8)):
break;
case C(UR_CLEAR_FEATURE, UT_WRITE_CLASS_OTHER)((0x01) | (((0x00 | 0x20 | 0x03)) << 8)):
DPRINTFN(8, ("ohci_root_ctrl_control: UR_CLEAR_PORT_FEATURE "
	     "port=%d feature=%d\n",
	     index, value));
if (index < 1 || index > sc->sc_noport) {
	err = USBD_IOERROR;
	goto ret;
}
port = OHCI_RH_PORT_STATUS(index)(0x50 + (index)*4);
switch(value) {
case UHF_PORT_ENABLE1:
	OWRITE4(sc, port, UPS_CURRENT_CONNECT_STATUS)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((port)), ((0x0001)))); } while (0);
	break;
case UHF_PORT_SUSPEND2:
	OWRITE4(sc, port, UPS_OVERCURRENT_INDICATOR)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((port)), ((0x0008)))); } while (0);
	break;
case UHF_PORT_POWER8:
	/* Yes, writing to the LOW_SPEED bit clears power. */
	OWRITE4(sc, port, UPS_LOW_SPEED)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((port)), ((0x0200)))); } while (0);
	break;
case UHF_C_PORT_CONNECTION16:
	OWRITE4(sc, port, UPS_C_CONNECT_STATUS << 16)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((port)), ((0x0001 << 16)))); } while (0);
	break;
case UHF_C_PORT_ENABLE17:
	OWRITE4(sc, port, UPS_C_PORT_ENABLED << 16)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((port)), ((0x0002 << 16)))); } while (0);
	break;
case UHF_C_PORT_SUSPEND18:
	OWRITE4(sc, port, UPS_C_SUSPEND << 16)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((port)), ((0x0004 << 16)))); } while (0);
	break;
case UHF_C_PORT_OVER_CURRENT19:
	OWRITE4(sc, port, UPS_C_OVERCURRENT_INDICATOR << 16)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((port)), ((0x0008 << 16)))); } while (0);
	break;
case UHF_C_PORT_RESET20:
	OWRITE4(sc, port, UPS_C_PORT_RESET << 16)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((port)), ((0x0010 << 16)))); } while (0);
	break;
default:
	err = USBD_IOERROR;
	goto ret;
}
switch(value) {
case UHF_C_PORT_CONNECTION16:
case UHF_C_PORT_ENABLE17:
case UHF_C_PORT_SUSPEND18:
case UHF_C_PORT_OVER_CURRENT19:
case UHF_C_PORT_RESET20:
	/* Enable RHSC interrupt if condition is cleared. */
	if ((OREAD4(sc, port) >> 16) == 0)
		ohci_rhsc_able(sc, 1);
	break;
default:
	break;
}
break;
case C(UR_GET_DESCRIPTOR, UT_READ_CLASS_DEVICE)((0x06) | (((0x80 | 0x20 | 0x00)) << 8)):
if ((value & 0xff) != 0) {
	err = USBD_IOERROR;
	goto ret;
}
v = OREAD4(sc, OHCI_RH_DESCRIPTOR_A0x48);
hubd = ohci_hubd;
hubd.bNbrPorts = sc->sc_noport;
USETW(hubd.wHubCharacteristics,(*(u_int16_t *)(hubd.wHubCharacteristics) = ((v & 0x0200 ?
 0x0002 : v & 0x0100 ? 0x0000 : 0x0001)))
      (v & OHCI_NPS ? UHD_PWR_NO_SWITCH :(*(u_int16_t *)(hubd.wHubCharacteristics) = ((v & 0x0200 ?
 0x0002 : v & 0x0100 ? 0x0000 : 0x0001)))
       v & OHCI_PSM ? UHD_PWR_GANGED : UHD_PWR_INDIVIDUAL)(*(u_int16_t *)(hubd.wHubCharacteristics) = ((v & 0x0200 ?
 0x0002 : v & 0x0100 ? 0x0000 : 0x0001)))
      /* XXX overcurrent */(*(u_int16_t *)(hubd.wHubCharacteristics) = ((v & 0x0200 ?
 0x0002 : v & 0x0100 ? 0x0000 : 0x0001)))
      )(*(u_int16_t *)(hubd.wHubCharacteristics) = ((v & 0x0200 ?
 0x0002 : v & 0x0100 ? 0x0000 : 0x0001)));
hubd.bPwrOn2PwrGood = OHCI_GET_POTPGT(v)((v) >> 24);
v = OREAD4(sc, OHCI_RH_DESCRIPTOR_B0x4c);
for (i = 0, l = sc->sc_noport; l > 0; i++, l -= 8, v >>= 8)
	hubd.DeviceRemovable[i++] = (u_int8_t)v;
hubd.bDescLength = USB_HUB_DESCRIPTOR_SIZE8 + i;
l = min(len, hubd.bDescLength);
totlen = l;
memcpy(buf, &hubd, l)__builtin_memcpy((buf), (&hubd), (l));
break;
case C(UR_GET_STATUS, UT_READ_CLASS_DEVICE)((0x00) | (((0x80 | 0x20 | 0x00)) << 8)):
if (len != 4) {
	err = USBD_IOERROR;
	goto ret;
}
memset(buf, 0, len)__builtin_memset((buf), (0), (len)); /* ? XXX */
totlen = len;
break;
case C(UR_GET_STATUS, UT_READ_CLASS_OTHER)((0x00) | (((0x80 | 0x20 | 0x03)) << 8)):
DPRINTFN(8,("ohci_root_ctrl_transfer: get port status i=%d\n",
	    index));
if (index < 1 || index > sc->sc_noport) {
	err = USBD_IOERROR;
	goto ret;
}
if (len != 4) {
	err = USBD_IOERROR;
	goto ret;
}
v = OREAD4(sc, OHCI_RH_PORT_STATUS(index)(0x50 + (index)*4));
DPRINTFN(8,("ohci_root_ctrl_transfer: port status=0x%04x\n",
	    v));
USETW(ps.wPortStatus, v)(*(u_int16_t *)(ps.wPortStatus) = (v));
USETW(ps.wPortChange, v >> 16)(*(u_int16_t *)(ps.wPortChange) = (v >> 16));
l = min(len, sizeof ps);
memcpy(buf, &ps, l)__builtin_memcpy((buf), (&ps), (l));
totlen = l;
break;
case C(UR_SET_DESCRIPTOR, UT_WRITE_CLASS_DEVICE)((0x07) | (((0x00 | 0x20 | 0x00)) << 8)):
err = USBD_IOERROR;
goto ret;
case C(UR_SET_FEATURE, UT_WRITE_CLASS_DEVICE)((0x03) | (((0x00 | 0x20 | 0x00)) << 8)):
break;
case C(UR_SET_FEATURE, UT_WRITE_CLASS_OTHER)((0x03) | (((0x00 | 0x20 | 0x03)) << 8)):
if (index < 1 || index > sc->sc_noport) {
	err = USBD_IOERROR;
	goto ret;
}
port = OHCI_RH_PORT_STATUS(index)(0x50 + (index)*4);
switch(value) {
case UHF_PORT_ENABLE1:
	OWRITE4(sc, port, UPS_PORT_ENABLED)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((port)), ((0x0002)))); } while (0);
	break;
case UHF_PORT_SUSPEND2:
	OWRITE4(sc, port, UPS_SUSPEND)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((port)), ((0x0004)))); } while (0);
	break;
case UHF_PORT_RESET4:
	DPRINTFN(5,("ohci_root_ctrl_transfer: reset port %d\n",
		    index));
	OWRITE4(sc, port, UPS_RESET)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((port)), ((0x0010)))); } while (0);
	for (i = 0; i < 5; i++) {
		usb_delay_ms(&sc->sc_bus,
			     USB_PORT_ROOT_RESET_DELAY100);
		if (sc->sc_bus.dying) {
			err = USBD_IOERROR;
			goto ret;
		}
		if ((OREAD4(sc, port) & UPS_RESET0x0010) == 0)
			break;
	}
	DPRINTFN(8,("ohci port %d reset, status = 0x%04x\n",
		    index, OREAD4(sc, port)));
	break;
case UHF_PORT_POWER8:
	DPRINTFN(2,("ohci_root_ctrl_transfer: set port power "
		    "%d\n", index));
	OWRITE4(sc, port, UPS_PORT_POWER)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((port)), ((0x0100)))); } while (0);
	break;
case UHF_PORT_DISOWN_TO_1_130:
	/* accept, but do nothing */
	break;
default:
	err = USBD_IOERROR;
	goto ret;
}
break;
default:
err = USBD_IOERROR;
goto ret;
}
xfer->actlen = totlen;
err = USBD_NORMAL_COMPLETION;
ret:
xfer->status = err;
s = splusb()splraise(0x5);
usb_transfer_complete(xfer);
splx(s)spllower(s);
return (err);
2576}

2578/* Abort a root control request. */
2579void
2580ohci_root_ctrl_abort(struct usbd_xfer *xfer)
2581{
/* Nothing to do, all transfers are synchronous. */
2583}

2585/* Close the root pipe. */
2586void
2587ohci_root_ctrl_close(struct usbd_pipe *pipe)
2588{
DPRINTF(("ohci_root_ctrl_close\n"));
/* Nothing to do. */
2591}

2593usbd_status
2594ohci_root_intr_transfer(struct usbd_xfer *xfer)
2595{
usbd_status err;

/* Insert last in queue. */
err = usb_insert_transfer(xfer);
if (err)
return (err);

/* Pipe isn't running, start first */
return (ohci_root_intr_start(SIMPLEQ_FIRST(&xfer->pipe->queue)((&xfer->pipe->queue)->sqh_first)));
2605}

2607usbd_status
2608ohci_root_intr_start(struct usbd_xfer *xfer)
2609{
struct ohci_softc *sc = (struct ohci_softc *)xfer->device->bus;

if (sc->sc_bus.dying)
return (USBD_IOERROR);

sc->sc_intrxfer = xfer;

return (USBD_IN_PROGRESS);
2618}

2620void
2621ohci_root_intr_abort(struct usbd_xfer *xfer)
2622{
struct ohci_softc *sc = (struct ohci_softc *)xfer->device->bus;
int s;

sc->sc_intrxfer = NULL((void *)0);

xfer->status = USBD_CANCELLED;
s = splusb()splraise(0x5);
usb_transfer_complete(xfer);
splx(s)spllower(s);
2632}

2634void
2635ohci_root_intr_close(struct usbd_pipe *pipe)
2636{
2637}

2639usbd_status
2640ohci_device_ctrl_transfer(struct usbd_xfer *xfer)
2641{
usbd_status err;

/* Insert last in queue. */
err = usb_insert_transfer(xfer);
if (err)
return (err);

/* Pipe isn't running, start first */
return (ohci_device_ctrl_start(SIMPLEQ_FIRST(&xfer->pipe->queue)((&xfer->pipe->queue)->sqh_first)));
2651}

2653usbd_status
2654ohci_device_ctrl_start(struct usbd_xfer *xfer)
2655{
struct ohci_softc *sc = (struct ohci_softc *)xfer->device->bus;
usbd_status err;

if (sc->sc_bus.dying)
return (USBD_IOERROR);

2662#ifdef DIAGNOSTIC1
if (!(xfer->rqflags & URQ_REQUEST0x01)) {
/* XXX panic */
printf("ohci_device_ctrl_transfer: not a request\n");
return (USBD_INVAL);
}
2668#endif

err = ohci_device_request(xfer);
if (err)
return (err);

return (USBD_IN_PROGRESS);
2675}

2677/* Abort a device control request. */
2678void
2679ohci_device_ctrl_abort(struct usbd_xfer *xfer)
2680{
DPRINTF(("ohci_device_ctrl_abort: xfer=%p\n", xfer));
ohci_abort_xfer(xfer, USBD_CANCELLED);
2683}

2685/* Close a device control pipe. */
2686void
2687ohci_device_ctrl_close(struct usbd_pipe *pipe)
2688{
struct ohci_pipe *opipe = (struct ohci_pipe *)pipe;
struct ohci_softc *sc = (struct ohci_softc *)pipe->device->bus;

DPRINTF(("ohci_device_ctrl_close: pipe=%p\n", pipe));
ohci_close_pipe(pipe, sc->sc_ctrl_head);
ohci_free_std(sc, opipe->tail.td);
2695}

2697/************************/

2699void
2700ohci_device_clear_toggle(struct usbd_pipe *pipe)
2701{
struct ohci_pipe *opipe = (struct ohci_pipe *)pipe;

opipe->sed->ed.ed_headp &= htole32(~OHCI_TOGGLECARRY)((__uint32_t)(~0x00000002));
2705}

2707usbd_status
2708ohci_device_bulk_transfer(struct usbd_xfer *xfer)
2709{
usbd_status err;

/* Insert last in queue. */
err = usb_insert_transfer(xfer);
if (err)
1
Assuming 'err' is 0→
2
←
Taking false branch→
return (err);

/* Pipe isn't running, start first */
return (ohci_device_bulk_start(SIMPLEQ_FIRST(&xfer->pipe->queue)((&xfer->pipe->queue)->sqh_first)));
3
←
Calling 'ohci_device_bulk_start'→
2719}

2721usbd_status
2722ohci_device_bulk_start(struct usbd_xfer *xfer)
2723{
struct ohci_softc *sc = (struct ohci_softc *)xfer->device->bus;
struct ohci_pipe *opipe = (struct ohci_pipe *)xfer->pipe;
struct ohci_soft_td *data, *tail, *tdp;
4
←
'tail' declared without an initial value→
struct ohci_soft_ed *sed;
u_int len;
int s, endpt;
usbd_status err;

if (sc->sc_bus.dying)
5
←
Assuming field 'dying' is 0→
6
←
Taking false branch→
return (USBD_IOERROR);

2735#ifdef DIAGNOSTIC1
if (xfer->rqflags & URQ_REQUEST0x01) {
7
←
Assuming the condition is false→
8
←
Taking false branch→
/* XXX panic */
printf("ohci_device_bulk_start: a request\n");
return (USBD_INVAL);
}
2741#endif

len = xfer->length;
endpt = xfer->pipe->endpoint->edesc->bEndpointAddress;
sed = opipe->sed;

DPRINTFN(4,("ohci_device_bulk_start: xfer=%p len=%u "
    "flags=%d endpt=%d\n", xfer, len, xfer->flags, endpt));

/* Update device address */
sed->ed.ed_flags = htole32(((__uint32_t)((((__uint32_t)(sed->ed.ed_flags)) & ~0x0000007f
) | (xfer->device->address)))
(letoh32(sed->ed.ed_flags) & ~OHCI_ED_ADDRMASK) |((__uint32_t)((((__uint32_t)(sed->ed.ed_flags)) & ~0x0000007f
) | (xfer->device->address)))
OHCI_ED_SET_FA(xfer->device->address))((__uint32_t)((((__uint32_t)(sed->ed.ed_flags)) & ~0x0000007f
) | (xfer->device->address)));

/* Allocate a chain of new TDs (including a new tail). */
data = opipe->tail.td;
err = ohci_alloc_std_chain(sc, len, xfer, data, &tail);
9
←
Calling 'ohci_alloc_std_chain'→
21
←
Returning from 'ohci_alloc_std_chain'→
/* We want interrupt at the end of the transfer. */
tail->td.td_flags &= htole32(~OHCI_TD_INTR_MASK)((__uint32_t)(~0x00e00000));
22
←
Dereference of undefined pointer value
tail->td.td_flags |= htole32(OHCI_TD_SET_DI(1))((__uint32_t)(((1) << 21)));
tail->flags |= OHCI_CALL_DONE0x0001;
tail = tail->nexttd;	/* point at sentinel */
if (err)
return (err);

tail->xfer = NULL((void *)0);
xfer->hcpriv = data;

DPRINTFN(4,("ohci_device_bulk_start: ed_flags=0x%08x td_flags=0x%08x "
    "td_cbp=0x%08x td_be=0x%08x\n",
    (int)letoh32(sed->ed.ed_flags),
    (int)letoh32(data->td.td_flags),
    (int)letoh32(data->td.td_cbp),
    (int)letoh32(data->td.td_be)));

2776#ifdef OHCI_DEBUG
if (ohcidebug > 5) {
ohci_dump_ed(sed);
ohci_dump_tds(data);
}
2781#endif

/* Insert ED in schedule */
s = splusb()splraise(0x5);
for (tdp = data; tdp != tail; tdp = tdp->nexttd) {
tdp->xfer = xfer;
}
sed->ed.ed_tailp = htole32(tail->physaddr)((__uint32_t)(tail->physaddr));
opipe->tail.td = tail;
sed->ed.ed_flags &= htole32(~OHCI_ED_SKIP)((__uint32_t)(~0x00004000));
OWRITE4(sc, OHCI_COMMAND_STATUS, OHCI_BLF)do { bus_space_barrier((sc)->iot, (sc)->ioh, 0, (sc)->
sc_size, 0x01|0x02); (((sc)->iot)->write_4(((sc)->ioh
), ((0x08)), ((0x00000004)))); } while (0);
if (xfer->timeout && !sc->sc_bus.use_polling) {
              timeout_del(&xfer->timeout_handle);
              timeout_set(&xfer->timeout_handle, ohci_timeout, xfer);
              timeout_add_msec(&xfer->timeout_handle, xfer->timeout);
}

2798#if 0
2799/* This goes wrong if we are too slow. */
if (ohcidebug > 10) {
delay(10000)(*delay_func)(10000);
DPRINTF(("ohci_device_intr_transfer: status=%x\n",
	 OREAD4(sc, OHCI_COMMAND_STATUS)));
ohci_dump_ed(sed);
ohci_dump_tds(data);
}
2807#endif

splx(s)spllower(s);

return (USBD_IN_PROGRESS);
2812}

2814void
2815ohci_device_bulk_abort(struct usbd_xfer *xfer)
2816{
DPRINTF(("ohci_device_bulk_abort: xfer=%p\n", xfer));
ohci_abort_xfer(xfer, USBD_CANCELLED);
2819}

2821/*
* Close a device bulk pipe.
*/
2824void
2825ohci_device_bulk_close(struct usbd_pipe *pipe)
2826{
struct ohci_pipe *opipe = (struct ohci_pipe *)pipe;
struct ohci_softc *sc = (struct ohci_softc *)pipe->device->bus;

DPRINTF(("ohci_device_bulk_close: pipe=%p\n", pipe));
ohci_close_pipe(pipe, sc->sc_bulk_head);
ohci_free_std(sc, opipe->tail.td);
2833}

2835/************************/

2837usbd_status
2838ohci_device_intr_transfer(struct usbd_xfer *xfer)
2839{
usbd_status err;

/* Insert last in queue. */
err = usb_insert_transfer(xfer);
if (err)
return (err);

/* Pipe isn't running, start first */
return (ohci_device_intr_start(SIMPLEQ_FIRST(&xfer->pipe->queue)((&xfer->pipe->queue)->sqh_first)));
2849}

2851usbd_status
2852ohci_device_intr_start(struct usbd_xfer *xfer)
2853{
struct ohci_softc *sc = (struct ohci_softc *)xfer->device->bus;
struct ohci_pipe *opipe = (struct ohci_pipe *)xfer->pipe;
struct ohci_soft_ed *sed = opipe->sed;
struct ohci_soft_td *data, *tail;
int s, len, endpt;

if (sc->sc_bus.dying)
return (USBD_IOERROR);

DPRINTFN(3, ("ohci_device_intr_transfer: xfer=%p len=%u "
     "flags=%d priv=%p\n",
     xfer, xfer->length, xfer->flags, xfer->priv));

2867#ifdef DIAGNOSTIC1
if (xfer->rqflags & URQ_REQUEST0x01)
panic("ohci_device_intr_transfer: a request");
2870#endif

usb_syncmem(&xfer->dmabuf, 0, xfer->length,
   usbd_xfer_isread(xfer) ?
   BUS_DMASYNC_PREREAD0x01 : BUS_DMASYNC_PREWRITE0x04);

len = xfer->length;
endpt = xfer->pipe->endpoint->edesc->bEndpointAddress;

data = opipe->tail.td;
tail = ohci_alloc_std(sc);
if (tail == NULL((void *)0))
return (USBD_NOMEM);
tail->xfer = NULL((void *)0);

data->td.td_flags = htole32(((__uint32_t)((usbd_xfer_isread(xfer) ? 0x00100000 : 0x00080000
) | 0xf0000000 | ((1) << 21) | 0x00000000))
(usbd_xfer_isread(xfer) ? OHCI_TD_IN : OHCI_TD_OUT) |((__uint32_t)((usbd_xfer_isread(xfer) ? 0x00100000 : 0x00080000
) | 0xf0000000 | ((1) << 21) | 0x00000000))
OHCI_TD_NOCC |((__uint32_t)((usbd_xfer_isread(xfer) ? 0x00100000 : 0x00080000
) | 0xf0000000 | ((1) << 21) | 0x00000000))
OHCI_TD_SET_DI(1) | OHCI_TD_TOGGLE_CARRY)((__uint32_t)((usbd_xfer_isread(xfer) ? 0x00100000 : 0x00080000
) | 0xf0000000 | ((1) << 21) | 0x00000000));
if (xfer->flags & USBD_SHORT_XFER_OK0x04)
data->td.td_flags |= htole32(OHCI_TD_R)((__uint32_t)(0x00040000));
data->td.td_cbp = htole32(DMAADDR(&xfer->dmabuf, 0))((__uint32_t)(((&xfer->dmabuf)->block->map->dm_segs
[0].ds_addr + (&xfer->dmabuf)->offs + (0))));
data->nexttd = tail;
data->td.td_nexttd = htole32(tail->physaddr)((__uint32_t)(tail->physaddr));
data->td.td_be = htole32(letoh32(data->td.td_cbp) + len - 1)((__uint32_t)(((__uint32_t)(data->td.td_cbp)) + len - 1));
data->len = len;
data->xfer = xfer;
data->flags = OHCI_CALL_DONE0x0001 | OHCI_ADD_LEN0x0002;
xfer->hcpriv = data;

2900#ifdef OHCI_DEBUG
if (ohcidebug > 5) {
DPRINTF(("ohci_device_intr_transfer:\n"));
ohci_dump_ed(sed);
ohci_dump_tds(data);
}
2906#endif

/* Insert ED in schedule */
s = splusb()splraise(0x5);
sed->ed.ed_tailp = htole32(tail->physaddr)((__uint32_t)(tail->physaddr));
opipe->tail.td = tail;
sed->ed.ed_flags &= htole32(~OHCI_ED_SKIP)((__uint32_t)(~0x00004000));

2914#if 0
2915/*
* This goes horribly wrong, printing thousands of descriptors,
* because false references are followed due to the fact that the
* TD is gone.
*/
if (ohcidebug > 5) {
usb_delay_ms(&sc->sc_bus, 5);
DPRINTF(("ohci_device_intr_transfer: status=%x\n",
	 OREAD4(sc, OHCI_COMMAND_STATUS)));
ohci_dump_ed(sed);
ohci_dump_tds(data);
}
2927#endif
splx(s)spllower(s);

return (USBD_IN_PROGRESS);
2931}

2933void
2934ohci_device_intr_abort(struct usbd_xfer *xfer)
2935{
KASSERT(!xfer->pipe->repeat || xfer->pipe->intrxfer == xfer)((!xfer->pipe->repeat || xfer->pipe->intrxfer == xfer
) ? (void)0 : __assert("diagnostic ", "/usr/src/sys/dev/usb/ohci.c"
, 2936, "!xfer->pipe->repeat || xfer->pipe->intrxfer == xfer"
));

ohci_abort_xfer(xfer, USBD_CANCELLED);
2939}

2941/* Close a device interrupt pipe. */
2942void
2943ohci_device_intr_close(struct usbd_pipe *pipe)
2944{
struct ohci_pipe *opipe = (struct ohci_pipe *)pipe;
struct ohci_softc *sc = (struct ohci_softc *)pipe->device->bus;
int nslots = opipe->u.intr.nslots;
int pos = opipe->u.intr.pos;
int j;
struct ohci_soft_ed *p, *sed = opipe->sed;
int s;

DPRINTFN(1,("ohci_device_intr_close: pipe=%p nslots=%d pos=%d\n",
    pipe, nslots, pos));
s = splusb()splraise(0x5);
sed->ed.ed_flags |= htole32(OHCI_ED_SKIP)((__uint32_t)(0x00004000));
if ((letoh32(sed->ed.ed_tailp)((__uint32_t)(sed->ed.ed_tailp)) & OHCI_HEADMASK0xfffffffc) !=
   (letoh32(sed->ed.ed_headp)((__uint32_t)(sed->ed.ed_headp)) & OHCI_HEADMASK0xfffffffc))
usb_delay_ms(&sc->sc_bus, 2);

for (p = sc->sc_eds[pos]; p && p->next != sed; p = p->next)
;
2963#ifdef DIAGNOSTIC1
if (p == NULL((void *)0))
panic("ohci_device_intr_close: ED not found");
2966#endif
p->next = sed->next;
p->ed.ed_nexted = sed->ed.ed_nexted;
splx(s)spllower(s);

for (j = 0; j < nslots; j++)
--sc->sc_bws[(pos * nslots + j) % OHCI_NO_INTRS32];

ohci_free_std(sc, opipe->tail.td);
ohci_free_sed(sc, opipe->sed);
2976}

2978usbd_status
2979ohci_device_setintr(struct ohci_softc *sc, struct ohci_pipe *opipe, int ival)
2980{
int i, j, s, best;
u_int npoll, slow, shigh, nslots;
u_int bestbw, bw;
struct ohci_soft_ed *hsed, *sed = opipe->sed;

DPRINTFN(2, ("ohci_setintr: pipe=%p\n", opipe));
if (ival == 0) {
printf("ohci_setintr: 0 interval\n");
return (USBD_INVAL);
}

npoll = OHCI_NO_INTRS32;
while (npoll > ival)
npoll /= 2;
DPRINTFN(2, ("ohci_setintr: ival=%d npoll=%d\n", ival, npoll));

/*
* We now know which level in the tree the ED must go into.
* Figure out which slot has most bandwidth left over.
* Slots to examine:
* npoll
* 1	0
* 2	1 2
* 4	3 4 5 6
* 8	7 8 9 10 11 12 13 14
* N    (N-1) .. (N-1+N-1)
*/
slow = npoll-1;
shigh = slow + npoll;
nslots = OHCI_NO_INTRS32 / npoll;
for (best = i = slow, bestbw = ~0; i < shigh; i++) {
bw = 0;
for (j = 0; j < nslots; j++)
	bw += sc->sc_bws[(i * nslots + j) % OHCI_NO_INTRS32];
if (bw < bestbw) {
	best = i;
	bestbw = bw;
}
}
DPRINTFN(2, ("ohci_setintr: best=%d(%d..%d) bestbw=%d\n",
     best, slow, shigh, bestbw));

s = splusb()splraise(0x5);
hsed = sc->sc_eds[best];
sed->next = hsed->next;
sed->ed.ed_nexted = hsed->ed.ed_nexted;
hsed->next = sed;
hsed->ed.ed_nexted = htole32(sed->physaddr)((__uint32_t)(sed->physaddr));
splx(s)spllower(s);

for (j = 0; j < nslots; j++)
++sc->sc_bws[(best * nslots + j) % OHCI_NO_INTRS32];
opipe->u.intr.nslots = nslots;
opipe->u.intr.pos = best;

DPRINTFN(5, ("ohci_setintr: returns %p\n", opipe));
return (USBD_NORMAL_COMPLETION);
3038}

3040/***********************/

3042usbd_status
3043ohci_device_isoc_transfer(struct usbd_xfer *xfer)
3044{
usbd_status err;

DPRINTFN(5,("ohci_device_isoc_transfer: xfer=%p\n", xfer));

/* Put it on our queue, */
err = usb_insert_transfer(xfer);

/* bail out on error, */
if (err && err != USBD_IN_PROGRESS)
return (err);

/* XXX should check inuse here */

/* insert into schedule, */
ohci_device_isoc_enter(xfer);

/* and start if the pipe wasn't running */
if (!err)
ohci_device_isoc_start(SIMPLEQ_FIRST(&xfer->pipe->queue)((&xfer->pipe->queue)->sqh_first));

return (err);
3066}

3068void
3069ohci_device_isoc_enter(struct usbd_xfer *xfer)
3070{
struct ohci_softc *sc = (struct ohci_softc *)xfer->device->bus;
struct ohci_pipe *opipe = (struct ohci_pipe *)xfer->pipe;
struct ohci_soft_ed *sed = opipe->sed;
struct iso *iso = &opipe->u.iso;
struct ohci_soft_itd *sitd, *nsitd;
ohci_physaddr_t buf, offs, noffs, bp0;
int i, ncur, nframes;
int s;

DPRINTFN(1,("ohci_device_isoc_enter: used=%d next=%d xfer=%p "
    "nframes=%d\n",
    iso->inuse, iso->next, xfer, xfer->nframes));

if (sc->sc_bus.dying)
return;

usb_syncmem(&xfer->dmabuf, 0, xfer->length,
   usbd_xfer_isread(xfer) ?
   BUS_DMASYNC_PREREAD0x01 : BUS_DMASYNC_PREWRITE0x04);

if (iso->next == -1) {
/* Not in use yet, schedule it a few frames ahead. */
iso->next = letoh32(sc->sc_hcca->hcca_frame_number)((__uint32_t)(sc->sc_hcca->hcca_frame_number)) + 5;
DPRINTFN(2,("ohci_device_isoc_enter: start next=%d\n",
	    iso->next));
}

sitd = opipe->tail.itd;
buf = DMAADDR(&xfer->dmabuf, 0)((&xfer->dmabuf)->block->map->dm_segs[0].ds_addr
 + (&xfer->dmabuf)->offs + (0));
bp0 = OHCI_PAGE(buf)((buf) &~ 0xfff);
offs = OHCI_PAGE_OFFSET(buf)((buf) & 0xfff);
nframes = xfer->nframes;
xfer->hcpriv = sitd;
for (i = ncur = 0; i < nframes; i++, ncur++) {
noffs = offs + xfer->frlengths[i];
if (ncur == OHCI_ITD_NOFFSET8 ||	/* all offsets used */
    OHCI_PAGE(buf + noffs)((buf + noffs) &~ 0xfff) > bp0 + OHCI_PAGE_SIZE0x1000) { /* too many page crossings */

	/* Allocate next ITD */
	nsitd = ohci_alloc_sitd(sc);
	if (nsitd == NULL((void *)0)) {
		/* XXX what now? */
		printf("%s: isoc TD alloc failed\n",
		       sc->sc_bus.bdev.dv_xname);
		return;
	}

	/* Fill current ITD */
	sitd->itd.itd_flags = htole32(((__uint32_t)(0xf0000000 | ((iso->next) & 0xffff) | ((
6) << 21) | (((ncur)-1) << 24)))
		OHCI_ITD_NOCC |((__uint32_t)(0xf0000000 | ((iso->next) & 0xffff) | ((
6) << 21) | (((ncur)-1) << 24)))
		OHCI_ITD_SET_SF(iso->next) |((__uint32_t)(0xf0000000 | ((iso->next) & 0xffff) | ((
6) << 21) | (((ncur)-1) << 24)))
		OHCI_ITD_SET_DI(6) | /* delay intr a little */((__uint32_t)(0xf0000000 | ((iso->next) & 0xffff) | ((
6) << 21) | (((ncur)-1) << 24)))
		OHCI_ITD_SET_FC(ncur))((__uint32_t)(0xf0000000 | ((iso->next) & 0xffff) | ((
6) << 21) | (((ncur)-1) << 24)));
	sitd->itd.itd_bp0 = htole32(bp0)((__uint32_t)(bp0));
	sitd->nextitd = nsitd;
	sitd->itd.itd_nextitd = htole32(nsitd->physaddr)((__uint32_t)(nsitd->physaddr));
	sitd->itd.itd_be = htole32(bp0 + offs - 1)((__uint32_t)(bp0 + offs - 1));
	sitd->xfer = xfer;
	sitd->flags = 0;

	sitd = nsitd;
	iso->next = iso->next + ncur;
	bp0 = OHCI_PAGE(buf + offs)((buf + offs) &~ 0xfff);
	ncur = 0;
}
sitd->itd.itd_offset[ncur] = htole16(OHCI_ITD_MK_OFFS(offs))((__uint16_t)((0xe000 | ((offs) & 0x1fff))));
offs = noffs;
}
nsitd = ohci_alloc_sitd(sc);
if (nsitd == NULL((void *)0)) {
/* XXX what now? */
printf("%s: isoc TD alloc failed\n",
       sc->sc_bus.bdev.dv_xname);
return;
}
/* Fixup last used ITD */
sitd->itd.itd_flags = htole32(((__uint32_t)(0xf0000000 | ((iso->next) & 0xffff) | ((
0) << 21) | (((ncur)-1) << 24)))
OHCI_ITD_NOCC |((__uint32_t)(0xf0000000 | ((iso->next) & 0xffff) | ((
0) << 21) | (((ncur)-1) << 24)))
OHCI_ITD_SET_SF(iso->next) |((__uint32_t)(0xf0000000 | ((iso->next) & 0xffff) | ((
0) << 21) | (((ncur)-1) << 24)))
OHCI_ITD_SET_DI(0) |((__uint32_t)(0xf0000000 | ((iso->next) & 0xffff) | ((
0) << 21) | (((ncur)-1) << 24)))
OHCI_ITD_SET_FC(ncur))((__uint32_t)(0xf0000000 | ((iso->next) & 0xffff) | ((
0) << 21) | (((ncur)-1) << 24)));
sitd->itd.itd_bp0 = htole32(bp0)((__uint32_t)(bp0));
sitd->nextitd = nsitd;
sitd->itd.itd_nextitd = htole32(nsitd->physaddr)((__uint32_t)(nsitd->physaddr));
sitd->itd.itd_be = htole32(bp0 + offs - 1)((__uint32_t)(bp0 + offs - 1));
sitd->xfer = xfer;
sitd->flags = OHCI_CALL_DONE0x0001;

iso->next = iso->next + ncur;
iso->inuse += nframes;

xfer->actlen = offs;	/* XXX pretend we did it all */

xfer->status = USBD_IN_PROGRESS;

3166#ifdef OHCI_DEBUG
if (ohcidebug > 5) {
DPRINTF(("ohci_device_isoc_enter: frame=%d\n",
	 letoh32(sc->sc_hcca->hcca_frame_number)));
ohci_dump_itds(xfer->hcpriv);
ohci_dump_ed(sed);
}
3173#endif

s = splusb()splraise(0x5);
sed->ed.ed_tailp = htole32(nsitd->physaddr)((__uint32_t)(nsitd->physaddr));
opipe->tail.itd = nsitd;
sed->ed.ed_flags &= htole32(~OHCI_ED_SKIP)((__uint32_t)(~0x00004000));
splx(s)spllower(s);

3181#ifdef OHCI_DEBUG
if (ohcidebug > 5) {
delay(150000)(*delay_func)(150000);
DPRINTF(("ohci_device_isoc_enter: after frame=%d\n",
	 letoh32(sc->sc_hcca->hcca_frame_number)));
ohci_dump_itds(xfer->hcpriv);
ohci_dump_ed(sed);
}
3189#endif
3190}

3192usbd_status
3193ohci_device_isoc_start(struct usbd_xfer *xfer)
3194{
struct ohci_softc *sc = (struct ohci_softc *)xfer->device->bus;

DPRINTFN(5,("ohci_device_isoc_start: xfer=%p\n", xfer));

if (sc->sc_bus.dying)
return (USBD_IOERROR);

3202#ifdef DIAGNOSTIC1
if (xfer->status != USBD_IN_PROGRESS)
printf("ohci_device_isoc_start: not in progress %p\n", xfer);
3205#endif

return (USBD_IN_PROGRESS);
3208}

3210void
3211ohci_device_isoc_abort(struct usbd_xfer *xfer)
3212{
struct ohci_softc *sc = (struct ohci_softc *)xfer->device->bus;
struct ohci_pipe *opipe = (struct ohci_pipe *)xfer->pipe;
struct ohci_soft_ed *sed;
struct ohci_soft_itd *sitd;
int s;

s = splusb()splraise(0x5);

DPRINTFN(1,("ohci_device_isoc_abort: xfer=%p\n", xfer));

/* Transfer is already done. */
if (xfer->status != USBD_NOT_STARTED &&
   xfer->status != USBD_IN_PROGRESS) {
splx(s)spllower(s);
printf("ohci_device_isoc_abort: early return\n");
return;
}

/* Give xfer the requested abort code. */
xfer->status = USBD_CANCELLED;

sed = opipe->sed;
sed->ed.ed_flags |= htole32(OHCI_ED_SKIP)((__uint32_t)(0x00004000)); /* force hardware skip */

sitd = xfer->hcpriv;
3238#ifdef DIAGNOSTIC1
if (sitd == NULL((void *)0)) {
splx(s)spllower(s);
printf("ohci_device_isoc_abort: hcpriv==0\n");
return;
}
3244#endif
for (; sitd->xfer == xfer; sitd = sitd->nextitd) {
3246#ifdef DIAGNOSTIC1
DPRINTFN(1,("abort sets done sitd=%p\n", sitd));
sitd->isdone = 1;
3249#endif
}

splx(s)spllower(s);

usb_delay_ms(&sc->sc_bus, OHCI_ITD_NOFFSET8);

s = splusb()splraise(0x5);

/* Run callback. */
usb_transfer_complete(xfer);

sed->ed.ed_headp = htole32(sitd->physaddr)((__uint32_t)(sitd->physaddr)); /* unlink TDs */
sed->ed.ed_flags &= htole32(~OHCI_ED_SKIP)((__uint32_t)(~0x00004000)); /* remove hardware skip */

splx(s)spllower(s);
3265}

3267void
3268ohci_device_isoc_done(struct usbd_xfer *xfer)
3269{
DPRINTFN(1,("ohci_device_isoc_done: xfer=%p\n", xfer));
3271}

3273usbd_status
3274ohci_setup_isoc(struct usbd_pipe *pipe)
3275{
struct ohci_pipe *opipe = (struct ohci_pipe *)pipe;
struct ohci_softc *sc = (struct ohci_softc *)pipe->device->bus;
struct iso *iso = &opipe->u.iso;
int s;

iso->next = -1;
iso->inuse = 0;

s = splusb()splraise(0x5);
ohci_add_ed(opipe->sed, sc->sc_isoc_head);
splx(s)spllower(s);

return (USBD_NORMAL_COMPLETION);
3289}

3291void
3292ohci_device_isoc_close(struct usbd_pipe *pipe)
3293{
struct ohci_pipe *opipe = (struct ohci_pipe *)pipe;
struct ohci_softc *sc = (struct ohci_softc *)pipe->device->bus;

DPRINTF(("ohci_device_isoc_close: pipe=%p\n", pipe));
ohci_close_pipe(pipe, sc->sc_isoc_head);
3299#ifdef DIAGNOSTIC1
opipe->tail.itd->isdone = 1;
3301#endif
ohci_free_sitd(sc, opipe->tail.itd);
3303}