/usr/src/sys/dev/usb/ehci.c

Bug Summary

File:	dev/usb/ehci.c
Warning:	line 1877, column 54 Access to field 'bDescriptorType' results in a dereference of a null pointer (loaded from variable 'buf')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name ehci.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -target-feature +retpoline-external-thunk -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/legacy-dpm -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu13 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/inc -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc/pmfw_if -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D SUSPEND -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /home/ben/Projects/scan/2024-01-11-110808-61670-1 -x c /usr/src/sys/dev/usb/ehci.c
1/*	$OpenBSD: ehci.c,v 1.219 2022/04/12 19:41:11 naddy Exp $ */
2/*	$NetBSD: ehci.c,v 1.66 2004/06/30 03:11:56 mycroft Exp $	*/

4/*
* Copyright (c) 2014-2015 Martin Pieuchot
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
19/*
* Copyright (c) 2004-2008 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This code is derived from software contributed to The NetBSD Foundation
* by Lennart Augustsson (lennart@augustsson.net), Charles M. Hannum and
* Jeremy Morse (jeremy.morse@gmail.com).
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/

49/*
* TODO:
* 1) The hub driver needs to handle and schedule the transaction translator,
*    to assign place in frame where different devices get to go. See chapter
*    on hubs in USB 2.0 for details.
*
* 2) Command failures are not recovered correctly.
*/

58#include <sys/param.h>
59#include <sys/systm.h>
60#include <sys/kernel.h>
61#include <sys/rwlock.h>
62#include <sys/malloc.h>
63#include <sys/device.h>
64#include <sys/queue.h>
65#include <sys/timeout.h>
66#include <sys/pool.h>
67#include <sys/endian.h>
68#include <sys/atomic.h>

70#include <machine/bus.h>

72#include <dev/usb/usb.h>
73#include <dev/usb/usbdi.h>
74#include <dev/usb/usbdivar.h>
75#include <dev/usb/usb_mem.h>

77#include <dev/usb/ehcireg.h>
78#include <dev/usb/ehcivar.h>

80struct cfdriver ehci_cd = {
NULL((void *)0), "ehci", DV_DULL, CD_SKIPHIBERNATE2
82};

84#ifdef EHCI_DEBUG
85#define DPRINTF(x)	do { if (ehcidebug) printf x; } while(0)
86#define DPRINTFN(n,x)	do { if (ehcidebug>(n)) printf x; } while (0)
87int ehcidebug = 0;
88#define bitmask_snprintf(q,f,b,l) snprintf((b), (l), "%b", (q), (f))
89#else
90#define DPRINTF(x)
91#define DPRINTFN(n,x)
92#endif

94struct pool *ehcixfer;

96struct ehci_pipe {
struct usbd_pipe pipe;

struct ehci_soft_qh *sqh;
union {
/* Control pipe */
struct {
	struct usb_dma reqdma;
} ctl;
/* Iso pipe */
struct {
	u_int next_frame;
	u_int cur_xfers;
} isoc;
} u;
111};

113u_int8_t		ehci_reverse_bits(u_int8_t, int);

115usbd_status	ehci_open(struct usbd_pipe *);
116int		ehci_setaddr(struct usbd_device *, int);
117void		ehci_poll(struct usbd_bus *);
118void		ehci_softintr(void *);
119int		ehci_intr1(struct ehci_softc *);
120void		ehci_check_intr(struct ehci_softc *, struct usbd_xfer *);
121void		ehci_check_qh_intr(struct ehci_softc *, struct usbd_xfer *);
122void		ehci_check_itd_intr(struct ehci_softc *, struct usbd_xfer *);
123void		ehci_idone(struct usbd_xfer *);
124void		ehci_isoc_idone(struct usbd_xfer *);
125void		ehci_timeout(void *);
126void		ehci_timeout_task(void *);
127void		ehci_intrlist_timeout(void *);

129struct usbd_xfer *ehci_allocx(struct usbd_bus *);
130void		ehci_freex(struct usbd_bus *, struct usbd_xfer *);

132usbd_status	ehci_root_ctrl_transfer(struct usbd_xfer *);
133usbd_status	ehci_root_ctrl_start(struct usbd_xfer *);
134void		ehci_root_ctrl_abort(struct usbd_xfer *);
135void		ehci_root_ctrl_close(struct usbd_pipe *);
136void		ehci_root_ctrl_done(struct usbd_xfer *);

138usbd_status	ehci_root_intr_transfer(struct usbd_xfer *);
139usbd_status	ehci_root_intr_start(struct usbd_xfer *);
140void		ehci_root_intr_abort(struct usbd_xfer *);
141void		ehci_root_intr_close(struct usbd_pipe *);
142void		ehci_root_intr_done(struct usbd_xfer *);

144usbd_status	ehci_device_ctrl_transfer(struct usbd_xfer *);
145usbd_status	ehci_device_ctrl_start(struct usbd_xfer *);
146void		ehci_device_ctrl_abort(struct usbd_xfer *);
147void		ehci_device_ctrl_close(struct usbd_pipe *);
148void		ehci_device_ctrl_done(struct usbd_xfer *);

150usbd_status	ehci_device_bulk_transfer(struct usbd_xfer *);
151usbd_status	ehci_device_bulk_start(struct usbd_xfer *);
152void		ehci_device_bulk_abort(struct usbd_xfer *);
153void		ehci_device_bulk_close(struct usbd_pipe *);
154void		ehci_device_bulk_done(struct usbd_xfer *);

156usbd_status	ehci_device_intr_transfer(struct usbd_xfer *);
157usbd_status	ehci_device_intr_start(struct usbd_xfer *);
158void		ehci_device_intr_abort(struct usbd_xfer *);
159void		ehci_device_intr_close(struct usbd_pipe *);
160void		ehci_device_intr_done(struct usbd_xfer *);

162usbd_status	ehci_device_isoc_transfer(struct usbd_xfer *);
163usbd_status	ehci_device_isoc_start(struct usbd_xfer *);
164void		ehci_device_isoc_abort(struct usbd_xfer *);
165void		ehci_device_isoc_close(struct usbd_pipe *);
166void		ehci_device_isoc_done(struct usbd_xfer *);

168void		ehci_device_clear_toggle(struct usbd_pipe *pipe);

170void		ehci_pcd(struct ehci_softc *, struct usbd_xfer *);
171void		ehci_disown(struct ehci_softc *, int, int);

173struct ehci_soft_qh *ehci_alloc_sqh(struct ehci_softc *);
174void		ehci_free_sqh(struct ehci_softc *, struct ehci_soft_qh *);

176struct ehci_soft_qtd *ehci_alloc_sqtd(struct ehci_softc *);
177void		ehci_free_sqtd(struct ehci_softc *, struct ehci_soft_qtd *);
178usbd_status	ehci_alloc_sqtd_chain(struct ehci_softc *, u_int,
    struct usbd_xfer *, struct ehci_soft_qtd **, struct ehci_soft_qtd **);
180void		ehci_free_sqtd_chain(struct ehci_softc *, struct ehci_xfer *);

182struct ehci_soft_itd *ehci_alloc_itd(struct ehci_softc *);
183void		ehci_free_itd(struct ehci_softc *, struct ehci_soft_itd *);
184void		ehci_rem_itd_chain(struct ehci_softc *, struct ehci_xfer *);
185void		ehci_free_itd_chain(struct ehci_softc *, struct ehci_xfer *);
186int		ehci_alloc_itd_chain(struct ehci_softc *, struct usbd_xfer *);
187int		ehci_alloc_sitd_chain(struct ehci_softc *, struct usbd_xfer *);
188void		ehci_abort_isoc_xfer(struct usbd_xfer *xfer,
    usbd_status status);

191usbd_status	ehci_device_setintr(struct ehci_softc *, struct ehci_soft_qh *,
	    int ival);

194void		ehci_add_qh(struct ehci_soft_qh *, struct ehci_soft_qh *);
195void		ehci_rem_qh(struct ehci_softc *, struct ehci_soft_qh *);
196void		ehci_set_qh_qtd(struct ehci_soft_qh *, struct ehci_soft_qtd *);
197void		ehci_sync_hc(struct ehci_softc *);

199void		ehci_close_pipe(struct usbd_pipe *);
200void		ehci_abort_xfer(struct usbd_xfer *, usbd_status);

202#ifdef EHCI_DEBUG
203void		ehci_dump_regs(struct ehci_softc *);
204void		ehci_dump(void);
205struct ehci_softc *theehci;
206void		ehci_dump_link(ehci_link_t, int);
207void		ehci_dump_sqtds(struct ehci_soft_qtd *);
208void		ehci_dump_sqtd(struct ehci_soft_qtd *);
209void		ehci_dump_qtd(struct ehci_qtd *);
210void		ehci_dump_sqh(struct ehci_soft_qh *);
211#if notyet
212void		ehci_dump_itd(struct ehci_soft_itd *);
213#endif
214#ifdef DIAGNOSTIC1
215void		ehci_dump_exfer(struct ehci_xfer *);
216#endif
217#endif

219#define EHCI_INTR_ENDPT1 1

221const struct usbd_bus_methods ehci_bus_methods = {
.open_pipe = ehci_open,
.dev_setaddr = ehci_setaddr,
.soft_intr = ehci_softintr,
.do_poll = ehci_poll,
.allocx = ehci_allocx,
.freex = ehci_freex,
228};

230const struct usbd_pipe_methods ehci_root_ctrl_methods = {
.transfer = ehci_root_ctrl_transfer,
.start = ehci_root_ctrl_start,
.abort = ehci_root_ctrl_abort,
.close = ehci_root_ctrl_close,
.done = ehci_root_ctrl_done,
236};

238const struct usbd_pipe_methods ehci_root_intr_methods = {
.transfer = ehci_root_intr_transfer,
.start = ehci_root_intr_start,
.abort = ehci_root_intr_abort,
.close = ehci_root_intr_close,
.done = ehci_root_intr_done,
244};

246const struct usbd_pipe_methods ehci_device_ctrl_methods = {
.transfer = ehci_device_ctrl_transfer,
.start = ehci_device_ctrl_start,
.abort = ehci_device_ctrl_abort,
.close = ehci_device_ctrl_close,
.done = ehci_device_ctrl_done,
252};

254const struct usbd_pipe_methods ehci_device_intr_methods = {
.transfer = ehci_device_intr_transfer,
.start = ehci_device_intr_start,
.abort = ehci_device_intr_abort,
.close = ehci_device_intr_close,
.cleartoggle = ehci_device_clear_toggle,
.done = ehci_device_intr_done,
261};

263const struct usbd_pipe_methods ehci_device_bulk_methods = {
.transfer = ehci_device_bulk_transfer,
.start = ehci_device_bulk_start,
.abort = ehci_device_bulk_abort,
.close = ehci_device_bulk_close,
.cleartoggle = ehci_device_clear_toggle,
.done = ehci_device_bulk_done,
270};

272const struct usbd_pipe_methods ehci_device_isoc_methods = {
.transfer = ehci_device_isoc_transfer,
.start = ehci_device_isoc_start,
.abort = ehci_device_isoc_abort,
.close = ehci_device_isoc_close,
.done = ehci_device_isoc_done,
278};

280/*
* Reverse a number with nbits bits.  Used to evenly distribute lower-level
* interrupt heads in the periodic schedule.
* Suitable for use with EHCI_IPOLLRATES <= 9.
*/
285u_int8_t
286ehci_reverse_bits(u_int8_t c, int nbits)
287{
c = ((c >> 1) & 0x55) | ((c << 1) & 0xaa);
c = ((c >> 2) & 0x33) | ((c << 2) & 0xcc);
c = ((c >> 4) & 0x0f) | ((c << 4) & 0xf0);

return c >> (8 - nbits);
293}

295usbd_status
296ehci_init(struct ehci_softc *sc)
297{
u_int32_t sparams, cparams, hcr;
u_int i, j;
usbd_status err;
struct ehci_soft_qh *sqh;

303#ifdef EHCI_DEBUG
u_int32_t vers;
theehci = sc;

DPRINTF(("ehci_init: start\n"));

vers = EREAD2(sc, EHCI_HCIVERSION)(((sc)->iot)->read_2(((sc)->ioh), ((0x02))));
DPRINTF(("%s: EHCI version %x.%x\n", sc->sc_bus.bdev.dv_xname,
   vers >> 8, vers & 0xff));
312#endif

sc->sc_offs = EREAD1(sc, EHCI_CAPLENGTH)(((sc)->iot)->read_1(((sc)->ioh), ((0x00))));

sparams = EREAD4(sc, EHCI_HCSPARAMS)(((sc)->iot)->read_4(((sc)->ioh), ((0x04))));
DPRINTF(("ehci_init: sparams=0x%x\n", sparams));
sc->sc_noport = EHCI_HCS_N_PORTS(sparams)((sparams) & 0xf);
cparams = EREAD4(sc, EHCI_HCCPARAMS)(((sc)->iot)->read_4(((sc)->ioh), ((0x08))));
DPRINTF(("ehci_init: cparams=0x%x\n", cparams));

/* MUST clear segment register if 64 bit capable. */
if (EHCI_HCC_64BIT(cparams)((cparams) & 0x1))
EWRITE4(sc, EHCI_CTRLDSSEGMENT, 0)(((sc)->iot)->write_4(((sc)->ioh), ((0x10)), ((0))));

sc->sc_bus.usbrev = USBREV_2_04;

DPRINTF(("%s: resetting\n", sc->sc_bus.bdev.dv_xname));
err = ehci_reset(sc);
if (err)
return (err);

if (ehcixfer == NULL((void *)0)) {
ehcixfer = malloc(sizeof(struct pool), M_USBHC103, M_NOWAIT0x0002);
if (ehcixfer == NULL((void *)0)) {
	printf("%s: unable to allocate pool descriptor\n",
	    sc->sc_bus.bdev.dv_xname);
	return (ENOMEM12);
}
pool_init(ehcixfer, sizeof(struct ehci_xfer), 0, IPL_SOFTUSB0x2,
    0, "ehcixfer", NULL((void *)0));
}

/* frame list size at default, read back what we got and use that */
switch (EHCI_CMD_FLS(EOREAD4(sc, EHCI_USBCMD))((((((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs
+(0x00))))) >> 2) & 3)) {
case 0:
sc->sc_flsize = 1024;
break;
case 1:
sc->sc_flsize = 512;
break;
case 2:
sc->sc_flsize = 256;
break;
case 3:
return (USBD_IOERROR);
}
err = usb_allocmem(&sc->sc_bus, sc->sc_flsize * sizeof(ehci_link_t),
   EHCI_FLALIGN_ALIGN0x1000, USB_DMA_COHERENT(1 << 0), &sc->sc_fldma);
if (err)
return (err);
DPRINTF(("%s: flsize=%d\n", sc->sc_bus.bdev.dv_xname,sc->sc_flsize));
sc->sc_flist = KERNADDR(&sc->sc_fldma, 0)((void *)((char *)((&sc->sc_fldma)->block->kaddr
 + (&sc->sc_fldma)->offs) + (0)));

for (i = 0; i < sc->sc_flsize; i++)
sc->sc_flist[i] = htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));

EOWRITE4(sc, EHCI_PERIODICLISTBASE, DMAADDR(&sc->sc_fldma, 0))(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x14)), ((((&sc->sc_fldma)->block->map->dm_segs
[0].ds_addr + (&sc->sc_fldma)->offs + (0))))));

sc->sc_softitds = mallocarray(sc->sc_flsize,
   sizeof(struct ehci_soft_itd *), M_USBHC103, M_NOWAIT0x0002 | M_ZERO0x0008);
if (sc->sc_softitds == NULL((void *)0)) {
usb_freemem(&sc->sc_bus, &sc->sc_fldma);
return (ENOMEM12);
}
LIST_INIT(&sc->sc_freeitds)do { ((&sc->sc_freeitds)->lh_first) = ((void *)0); }
 while (0);
TAILQ_INIT(&sc->sc_intrhead)do { (&sc->sc_intrhead)->tqh_first = ((void *)0); (
&sc->sc_intrhead)->tqh_last = &(&sc->sc_intrhead
)->tqh_first; } while (0);

/* Set up the bus struct. */
sc->sc_bus.methods = &ehci_bus_methods;
sc->sc_bus.pipe_size = sizeof(struct ehci_pipe);

sc->sc_eintrs = EHCI_NORMAL_INTRS(0x00000020 | 0x00000010 | 0x00000004 | 0x00000002 | 0x00000001
);

/*
* Allocate the interrupt dummy QHs. These are arranged to give poll
* intervals that are powers of 2 times 1ms.
*/
for (i = 0; i < EHCI_INTRQHS((1 << 8) - 1); i++) {
sqh = ehci_alloc_sqh(sc);
if (sqh == NULL((void *)0)) {
	err = USBD_NOMEM;
	goto bad1;
}
sc->sc_islots[i].sqh = sqh;
}
for (i = 0; i < EHCI_INTRQHS((1 << 8) - 1); i++) {
sqh = sc->sc_islots[i].sqh;
if (i == 0) {
	/* The last (1ms) QH terminates. */
	sqh->qh.qh_link = htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));
	sqh->next = NULL((void *)0);
} else {
	/* Otherwise the next QH has half the poll interval */
	sqh->next = sc->sc_islots[(i + 1) / 2 - 1].sqh;
	sqh->qh.qh_link = htole32(sqh->next->physaddr |((__uint32_t)(sqh->next->physaddr | 0x2))
	    EHCI_LINK_QH)((__uint32_t)(sqh->next->physaddr | 0x2));
}
sqh->qh.qh_endp = htole32(EHCI_QH_SET_EPS(EHCI_QH_SPEED_HIGH))((__uint32_t)(((0x2) << 12)));
sqh->qh.qh_endphub = htole32(EHCI_QH_SET_MULT(1))((__uint32_t)(((1) << 30)));
sqh->qh.qh_curqtd = htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));
sqh->qh.qh_qtd.qtd_next = htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));
sqh->qh.qh_qtd.qtd_altnext = htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));
sqh->qh.qh_qtd.qtd_status = htole32(EHCI_QTD_HALTED)((__uint32_t)(0x40));
sqh->sqtd = NULL((void *)0);
usb_syncmem(&sqh->dma, sqh->offs, sizeof(sqh->qh),
    BUS_DMASYNC_PREWRITE0x04 | BUS_DMASYNC_PREREAD0x01);
}
/* Point the frame list at the last level (128ms). */
for (i = 0; i < (1 << (EHCI_IPOLLRATES8 - 1)); i++)
for (j = i; j < sc->sc_flsize; j += 1 << (EHCI_IPOLLRATES8 - 1))
	sc->sc_flist[j] = htole32(EHCI_LINK_QH | sc->sc_islots[((__uint32_t)(0x2 | sc->sc_islots[ ((((ehci_reverse_bits( i
, 8 - 1)) & ((1 << (8 - 1)) - 1)) | (1 << (8 -
 1))) - 1)].sqh->physaddr))
	    EHCI_IQHIDX(EHCI_IPOLLRATES - 1, ehci_reverse_bits(((__uint32_t)(0x2 | sc->sc_islots[ ((((ehci_reverse_bits( i
, 8 - 1)) & ((1 << (8 - 1)) - 1)) | (1 << (8 -
 1))) - 1)].sqh->physaddr))
	    i, EHCI_IPOLLRATES - 1))].sqh->physaddr)((__uint32_t)(0x2 | sc->sc_islots[ ((((ehci_reverse_bits( i
, 8 - 1)) & ((1 << (8 - 1)) - 1)) | (1 << (8 -
 1))) - 1)].sqh->physaddr));
usb_syncmem(&sc->sc_fldma, 0, sc->sc_flsize * sizeof(ehci_link_t),
   BUS_DMASYNC_PREWRITE0x04);

/* Allocate dummy QH that starts the async list. */
sqh = ehci_alloc_sqh(sc);
if (sqh == NULL((void *)0)) {
err = USBD_NOMEM;
goto bad1;
}
/* Fill the QH */
sqh->qh.qh_endp =
   htole32(EHCI_QH_SET_EPS(EHCI_QH_SPEED_HIGH) | EHCI_QH_HRECL)((__uint32_t)(((0x2) << 12) | 0x00008000));
sqh->qh.qh_link =
   htole32(sqh->physaddr | EHCI_LINK_QH)((__uint32_t)(sqh->physaddr | 0x2));
sqh->qh.qh_curqtd = htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));
sqh->prev = sqh; /*It's a circular list.. */
sqh->next = sqh;
/* Fill the overlay qTD */
sqh->qh.qh_qtd.qtd_next = htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));
sqh->qh.qh_qtd.qtd_altnext = htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));
sqh->qh.qh_qtd.qtd_status = htole32(EHCI_QTD_HALTED)((__uint32_t)(0x40));
sqh->sqtd = NULL((void *)0);
usb_syncmem(&sqh->dma, sqh->offs, sizeof(sqh->qh),
   BUS_DMASYNC_PREWRITE0x04 | BUS_DMASYNC_PREREAD0x01);

/* Point to async list */
sc->sc_async_head = sqh;
EOWRITE4(sc, EHCI_ASYNCLISTADDR, sqh->physaddr | EHCI_LINK_QH)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x18)), ((sqh->physaddr | 0x2))));

timeout_set(&sc->sc_tmo_intrlist, ehci_intrlist_timeout, sc);

rw_init(&sc->sc_doorbell_lock, "ehcidb")_rw_init_flags(&sc->sc_doorbell_lock, "ehcidb", 0, ((void
 *)0));

/* Turn on controller */
EOWRITE4(sc, EHCI_USBCMD,(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), ((0x00020000 | ((((sc)->iot)->read_4(((sc)->
ioh), ((sc)->sc_offs+(0x00)))) & 0x0000000c) | 0x00000020
 | 0x00000010 | 0x00000001))))
   EHCI_CMD_ITC_2 | /* 2 microframes interrupt delay */(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), ((0x00020000 | ((((sc)->iot)->read_4(((sc)->
ioh), ((sc)->sc_offs+(0x00)))) & 0x0000000c) | 0x00000020
 | 0x00000010 | 0x00000001))))
   (EOREAD4(sc, EHCI_USBCMD) & EHCI_CMD_FLS_M) |(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), ((0x00020000 | ((((sc)->iot)->read_4(((sc)->
ioh), ((sc)->sc_offs+(0x00)))) & 0x0000000c) | 0x00000020
 | 0x00000010 | 0x00000001))))
   EHCI_CMD_ASE |(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), ((0x00020000 | ((((sc)->iot)->read_4(((sc)->
ioh), ((sc)->sc_offs+(0x00)))) & 0x0000000c) | 0x00000020
 | 0x00000010 | 0x00000001))))
   EHCI_CMD_PSE |(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), ((0x00020000 | ((((sc)->iot)->read_4(((sc)->
ioh), ((sc)->sc_offs+(0x00)))) & 0x0000000c) | 0x00000020
 | 0x00000010 | 0x00000001))))
   EHCI_CMD_RS)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), ((0x00020000 | ((((sc)->iot)->read_4(((sc)->
ioh), ((sc)->sc_offs+(0x00)))) & 0x0000000c) | 0x00000020
 | 0x00000010 | 0x00000001))));

/* Take over port ownership */
EOWRITE4(sc, EHCI_CONFIGFLAG, EHCI_CONF_CF)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x40)), ((0x00000001))));

for (i = 0; i < 100; i++) {
usb_delay_ms(&sc->sc_bus, 1);
hcr = EOREAD4(sc, EHCI_USBSTS)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x04)))) & EHCI_STS_HCH0x00001000;
if (!hcr)
	break;
}
if (hcr) {
printf("%s: run timeout\n", sc->sc_bus.bdev.dv_xname);
return (USBD_IOERROR);
}

/* Enable interrupts */
EOWRITE4(sc, EHCI_USBINTR, sc->sc_eintrs)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x08)), ((sc->sc_eintrs))));

return (USBD_NORMAL_COMPLETION);

485#if 0
bad2:
ehci_free_sqh(sc, sc->sc_async_head);
488#endif
bad1:
free(sc->sc_softitds, M_USBHC103,
   sc->sc_flsize * sizeof(struct ehci_soft_itd *));
usb_freemem(&sc->sc_bus, &sc->sc_fldma);
return (err);
494}

496int
497ehci_intr(void *v)
498{
struct ehci_softc *sc = v;

if (sc == NULL((void *)0) || sc->sc_bus.dying)
return (0);

/* If we get an interrupt while polling, then just ignore it. */
if (sc->sc_bus.use_polling) {
u_int32_t intrs = EHCI_STS_INTRS(EOREAD4(sc, EHCI_USBSTS))(((((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs
+(0x04))))) & 0x3f);

if (intrs)
	EOWRITE4(sc, EHCI_USBSTS, intrs)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x04)), ((intrs)))); /* Acknowledge */
return (0);
}

return (ehci_intr1(sc));
514}

516int
517ehci_intr1(struct ehci_softc *sc)
518{
u_int32_t intrs, eintrs;

/* In case the interrupt occurs before initialization has completed. */
if (sc == NULL((void *)0)) {
523#ifdef DIAGNOSTIC1
printf("ehci_intr1: sc == NULL\n");
525#endif
return (0);
}

intrs = EOREAD4(sc, EHCI_USBSTS)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x04))));
if (intrs == 0xffffffff) {
sc->sc_bus.dying = 1;
return (0);
}
intrs = EHCI_STS_INTRS(intrs)((intrs) & 0x3f);
if (!intrs)
return (0);

eintrs = intrs & sc->sc_eintrs;
if (!eintrs)
return (0);

EOWRITE4(sc, EHCI_USBSTS, intrs)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x04)), ((intrs)))); /* Acknowledge */
sc->sc_bus.no_intrs++;

if (eintrs & EHCI_STS_HSE0x00000010) {
printf("%s: unrecoverable error, controller halted\n",
       sc->sc_bus.bdev.dv_xname);
sc->sc_bus.dying = 1;
return (1);
}
if (eintrs & EHCI_STS_IAA0x00000020) {
wakeup(&sc->sc_async_head);
eintrs &= ~EHCI_STS_IAA0x00000020;
}
if (eintrs & (EHCI_STS_INT0x00000001 | EHCI_STS_ERRINT0x00000002)) {
usb_schedsoftintr(&sc->sc_bus);
eintrs &= ~(EHCI_STS_INT0x00000001 | EHCI_STS_ERRINT0x00000002);
}
if (eintrs & EHCI_STS_PCD0x00000004) {
atomic_setbits_intx86_atomic_setbits_u32(&sc->sc_flags, EHCIF_PCB_INTR0x02);
usb_schedsoftintr(&sc->sc_bus);
eintrs &= ~EHCI_STS_PCD0x00000004;
}

if (eintrs != 0) {
/* Block unprocessed interrupts. */
sc->sc_eintrs &= ~eintrs;
EOWRITE4(sc, EHCI_USBINTR, sc->sc_eintrs)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x08)), ((sc->sc_eintrs))));
printf("%s: blocking intrs 0x%x\n",
       sc->sc_bus.bdev.dv_xname, eintrs);
}

return (1);
574}

576void
577ehci_pcd(struct ehci_softc *sc, struct usbd_xfer *xfer)
578{
u_char *p;
int i, m;

if (xfer == NULL((void *)0)) {
/* Just ignore the change. */
return;
}

p = KERNADDR(&xfer->dmabuf, 0)((void *)((char *)((&xfer->dmabuf)->block->kaddr
 + (&xfer->dmabuf)->offs) + (0)));
m = min(sc->sc_noport, xfer->length * 8 - 1);
memset(p, 0, xfer->length)__builtin_memset((p), (0), (xfer->length));
for (i = 1; i <= m; i++) {
/* Pick out CHANGE bits from the status reg. */
if (EOREAD4(sc, EHCI_PORTSC(i))(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
((0x40+4*(i)))))) & EHCI_PS_CLEAR(0x00000020|0x00000008|0x00000002))
	p[i / 8] |= 1 << (i % 8);
}
xfer->actlen = xfer->length;
xfer->status = USBD_NORMAL_COMPLETION;

usb_transfer_complete(xfer);
599}

601/*
* Work around the half configured control (default) pipe when setting
* the address of a device.
*
* Because a single QH is setup per endpoint in ehci_open(), and the
* control pipe is configured before we could have set the address
* of the device or read the wMaxPacketSize of the endpoint, we have
* to re-open the pipe twice here.
*/
610int
611ehci_setaddr(struct usbd_device *dev, int addr)
612{
/* Root Hub */
if (dev->depth == 0)
return (0);

/* Re-establish the default pipe with the new max packet size. */
ehci_close_pipe(dev->default_pipe);
if (ehci_open(dev->default_pipe))
return (EINVAL22);

if (usbd_set_address(dev, addr))
return (1);

dev->address = addr;

/* Re-establish the default pipe with the new address. */
ehci_close_pipe(dev->default_pipe);
if (ehci_open(dev->default_pipe))
return (EINVAL22);

return (0);
633}

635void
636ehci_softintr(void *v)
637{
struct ehci_softc *sc = v;
struct ehci_xfer *ex, *nextex;

if (sc->sc_bus.dying)
return;

sc->sc_bus.intr_context++;

if (sc->sc_flags & EHCIF_PCB_INTR0x02) {
atomic_clearbits_intx86_atomic_clearbits_u32(&sc->sc_flags, EHCIF_PCB_INTR0x02);
ehci_pcd(sc, sc->sc_intrxfer);
}

/*
* The only explanation I can think of for why EHCI is as brain dead
* as UHCI interrupt-wise is that Intel was involved in both.
* An interrupt just tells us that something is done, we have no
* clue what, so we need to scan through all active transfers. :-(
*/
for (ex = TAILQ_FIRST(&sc->sc_intrhead)((&sc->sc_intrhead)->tqh_first); ex; ex = nextex) {
nextex = TAILQ_NEXT(ex, inext)((ex)->inext.tqe_next);
ehci_check_intr(sc, &ex->xfer);
}

/* Schedule a callout to catch any dropped transactions. */
if ((sc->sc_flags & EHCIF_DROPPED_INTR_WORKAROUND0x01) &&
   !TAILQ_EMPTY(&sc->sc_intrhead)(((&sc->sc_intrhead)->tqh_first) == ((void *)0))) {
timeout_add_sec(&sc->sc_tmo_intrlist, 1);
}

if (sc->sc_softwake) {
sc->sc_softwake = 0;
wakeup(&sc->sc_softwake);
}

sc->sc_bus.intr_context--;
674}

676void
677ehci_check_intr(struct ehci_softc *sc, struct usbd_xfer *xfer)
678{
int attr = xfer->pipe->endpoint->edesc->bmAttributes;

if (UE_GET_XFERTYPE(attr)((attr) & 0x03) == UE_ISOCHRONOUS0x01)
ehci_check_itd_intr(sc, xfer);
else
ehci_check_qh_intr(sc, xfer);
685}

687void
688ehci_check_qh_intr(struct ehci_softc *sc, struct usbd_xfer *xfer)
689{
struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
struct ehci_soft_qtd *sqtd, *lsqtd = ex->sqtdend_TD.sqtd.end;
uint32_t status;

KASSERT(ex->sqtdstart != NULL && ex->sqtdend != NULL)((ex->_TD.sqtd.start != ((void *)0) && ex->_TD.
sqtd.end != ((void *)0)) ? (void)0 : __assert("diagnostic ", "/usr/src/sys/dev/usb/ehci.c"
, 694, "ex->sqtdstart != NULL && ex->sqtdend != NULL"
));

usb_syncmem(&lsqtd->dma,
   lsqtd->offs + offsetof(struct ehci_qtd, qtd_status)__builtin_offsetof(struct ehci_qtd, qtd_status),
   sizeof(lsqtd->qtd.qtd_status),
   BUS_DMASYNC_POSTWRITE0x08 | BUS_DMASYNC_POSTREAD0x02);

/*
* If the last TD is still active we need to check whether there
* is a an error somewhere in the middle, or whether there was a
* short packet (SPD and not ACTIVE).
*/
if (letoh32(lsqtd->qtd.qtd_status)((__uint32_t)(lsqtd->qtd.qtd_status)) & EHCI_QTD_ACTIVE0x80) {
DPRINTFN(12, ("ehci_check_intr: active ex=%p\n", ex));
for (sqtd = ex->sqtdstart_TD.sqtd.start; sqtd != lsqtd; sqtd=sqtd->nextqtd) {
	usb_syncmem(&sqtd->dma,
	    sqtd->offs + offsetof(struct ehci_qtd, qtd_status)__builtin_offsetof(struct ehci_qtd, qtd_status),
	    sizeof(sqtd->qtd.qtd_status),
	    BUS_DMASYNC_POSTWRITE0x08 | BUS_DMASYNC_POSTREAD0x02);
	status = letoh32(sqtd->qtd.qtd_status)((__uint32_t)(sqtd->qtd.qtd_status));
	usb_syncmem(&sqtd->dma,
	    sqtd->offs + offsetof(struct ehci_qtd, qtd_status)__builtin_offsetof(struct ehci_qtd, qtd_status),
	    sizeof(sqtd->qtd.qtd_status), BUS_DMASYNC_PREREAD0x01);
	/* If there's an active QTD the xfer isn't done. */
	if (status & EHCI_QTD_ACTIVE0x80)
		break;
	/* Any kind of error makes the xfer done. */
	if (status & EHCI_QTD_HALTED0x40)
		goto done;
	/* We want short packets, and it is short: it's done */
	if (EHCI_QTD_GET_BYTES(status)(((status) >> 16) & 0x7fff) != 0)
		goto done;
}
DPRINTFN(12, ("ehci_check_intr: ex=%p std=%p still active\n",
	      ex, ex->sqtdstart));
usb_syncmem(&lsqtd->dma,
    lsqtd->offs + offsetof(struct ehci_qtd, qtd_status)__builtin_offsetof(struct ehci_qtd, qtd_status),
    sizeof(lsqtd->qtd.qtd_status), BUS_DMASYNC_PREREAD0x01);
return;
}
done:
TAILQ_REMOVE(&sc->sc_intrhead, ex, inext)do { if (((ex)->inext.tqe_next) != ((void *)0)) (ex)->inext
.tqe_next->inext.tqe_prev = (ex)->inext.tqe_prev; else (
&sc->sc_intrhead)->tqh_last = (ex)->inext.tqe_prev
; *(ex)->inext.tqe_prev = (ex)->inext.tqe_next; ((ex)->
inext.tqe_prev) = ((void *)-1); ((ex)->inext.tqe_next) = (
(void *)-1); } while (0);
timeout_del(&xfer->timeout_handle);
usb_rem_task(xfer->pipe->device, &xfer->abort_task);
ehci_idone(xfer);
739}

741void
742ehci_check_itd_intr(struct ehci_softc *sc, struct usbd_xfer *xfer)
743{
struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
struct ehci_soft_itd *itd = ex->itdend_TD.itd.end;
int i;

if (xfer != SIMPLEQ_FIRST(&xfer->pipe->queue)((&xfer->pipe->queue)->sqh_first))
return;

KASSERT(ex->itdstart != NULL && ex->itdend != NULL)((ex->_TD.itd.start != ((void *)0) && ex->_TD.itd
.end != ((void *)0)) ? (void)0 : __assert("diagnostic ", "/usr/src/sys/dev/usb/ehci.c"
, 751, "ex->itdstart != NULL && ex->itdend != NULL"
));

/* Check no active transfers in last itd, meaning we're finished */
if (xfer->device->speed == USB_SPEED_HIGH3) {
usb_syncmem(&itd->dma,
    itd->offs + offsetof(struct ehci_itd, itd_ctl)__builtin_offsetof(struct ehci_itd, itd_ctl),
    sizeof(itd->itd.itd_ctl),
    BUS_DMASYNC_POSTWRITE0x08 | BUS_DMASYNC_POSTREAD0x02);

for (i = 0; i < 8; i++) {
	if (letoh32(itd->itd.itd_ctl[i])((__uint32_t)(itd->itd.itd_ctl[i])) & EHCI_ITD_ACTIVE0x80000000)
		return;
}
} else {
usb_syncmem(&itd->dma,
    itd->offs + offsetof(struct ehci_sitd, sitd_trans)__builtin_offsetof(struct ehci_sitd, sitd_trans),
    sizeof(itd->sitd.sitd_trans),
    BUS_DMASYNC_POSTWRITE0x08 | BUS_DMASYNC_POSTREAD0x02);

if (le32toh(itd->sitd.sitd_trans)((__uint32_t)(itd->sitd.sitd_trans)) & EHCI_SITD_ACTIVE0x80)
	return;
}

/* All descriptor(s) inactive, it's done */
TAILQ_REMOVE(&sc->sc_intrhead, ex, inext)do { if (((ex)->inext.tqe_next) != ((void *)0)) (ex)->inext
.tqe_next->inext.tqe_prev = (ex)->inext.tqe_prev; else (
&sc->sc_intrhead)->tqh_last = (ex)->inext.tqe_prev
; *(ex)->inext.tqe_prev = (ex)->inext.tqe_next; ((ex)->
inext.tqe_prev) = ((void *)-1); ((ex)->inext.tqe_next) = (
(void *)-1); } while (0);
timeout_del(&xfer->timeout_handle);
usb_rem_task(xfer->pipe->device, &xfer->abort_task);
ehci_isoc_idone(xfer);
779}

781void
782ehci_isoc_idone(struct usbd_xfer *xfer)
783{
struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
struct ehci_soft_itd *itd;
int i, len, uframes, nframes = 0, actlen = 0;
uint32_t status = 0;

if (xfer->status == USBD_CANCELLED || xfer->status == USBD_TIMEOUT)
return;

if (xfer->device->speed == USB_SPEED_HIGH3) {
switch (xfer->pipe->endpoint->edesc->bInterval) {
case 0:
	panic("isoc xfer suddenly has 0 bInterval, invalid");
case 1:
	uframes = 1;
	break;
case 2:
	uframes = 2;
	break;
case 3:
	uframes = 4;
	break;
default:
	uframes = 8;
	break;
}

for (itd = ex->itdstart_TD.itd.start; itd != NULL((void *)0); itd = itd->xfer_next) {
	usb_syncmem(&itd->dma,
	    itd->offs + offsetof(struct ehci_itd, itd_ctl)__builtin_offsetof(struct ehci_itd, itd_ctl),
	    sizeof(itd->itd.itd_ctl), BUS_DMASYNC_POSTWRITE0x08 |
	    BUS_DMASYNC_POSTREAD0x02);

	for (i = 0; i < 8; i += uframes) {
		/* XXX - driver didn't fill in the frame full
		 *   of uframes. This leads to scheduling
		 *   inefficiencies, but working around
		 *   this doubles complexity of tracking
		 *   an xfer.
		 */
		if (nframes >= xfer->nframes)
			break;

		status = letoh32(itd->itd.itd_ctl[i])((__uint32_t)(itd->itd.itd_ctl[i]));
		len = EHCI_ITD_GET_LEN(status)(((status) >> 16) & 0xfff);
		if (EHCI_ITD_GET_STATUS(status)(((status) >> 28) & 0xf) != 0)
			len = 0; /*No valid data on error*/

		xfer->frlengths[nframes++] = len;
		actlen += len;
	}
}
} else {
for (itd = ex->itdstart_TD.itd.start; itd != NULL((void *)0); itd = itd->xfer_next) {
	usb_syncmem(&itd->dma,
	    itd->offs + offsetof(struct ehci_sitd, sitd_trans)__builtin_offsetof(struct ehci_sitd, sitd_trans),
	    sizeof(itd->sitd.sitd_trans),
	    BUS_DMASYNC_POSTWRITE0x08 | BUS_DMASYNC_POSTREAD0x02);

	status = le32toh(itd->sitd.sitd_trans)((__uint32_t)(itd->sitd.sitd_trans));
	len = EHCI_SITD_GET_LEN(status)(((status) >> 16) & 0x3ff);
	if (xfer->frlengths[nframes] >= len)
		len = xfer->frlengths[nframes] - len;
	else
		len = 0;

	xfer->frlengths[nframes++] = len;
	actlen += len;
   	}
}

854#ifdef DIAGNOSTIC1
ex->isdone = 1;
856#endif
xfer->actlen = actlen;
xfer->status = USBD_NORMAL_COMPLETION;

usb_syncmem(&xfer->dmabuf, 0, xfer->length,
   usbd_xfer_isread(xfer) ?
   BUS_DMASYNC_POSTREAD0x02 : BUS_DMASYNC_POSTWRITE0x08);
usb_transfer_complete(xfer);
864}

866void
867ehci_idone(struct usbd_xfer *xfer)
868{
struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
struct ehci_soft_qtd *sqtd;
u_int32_t status = 0, nstatus = 0;
int actlen, cerr;

874#ifdef DIAGNOSTIC1
{
int s = splhigh()splraise(0xd);
if (ex->isdone) {
	splx(s)spllower(s);
	printf("ehci_idone: ex=%p is done!\n", ex);
	return;
}
ex->isdone = 1;
splx(s)spllower(s);
}
885#endif
if (xfer->status == USBD_CANCELLED || xfer->status == USBD_TIMEOUT)
return;

actlen = 0;
for (sqtd = ex->sqtdstart_TD.sqtd.start; sqtd != NULL((void *)0); sqtd = sqtd->nextqtd) {
usb_syncmem(&sqtd->dma, sqtd->offs, sizeof(sqtd->qtd),
    BUS_DMASYNC_POSTWRITE0x08 | BUS_DMASYNC_POSTREAD0x02);
nstatus = letoh32(sqtd->qtd.qtd_status)((__uint32_t)(sqtd->qtd.qtd_status));
if (nstatus & EHCI_QTD_ACTIVE0x80)
	break;

status = nstatus;
/* halt is ok if descriptor is last, and complete */
if (sqtd->qtd.qtd_next == htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001)) &&
    EHCI_QTD_GET_BYTES(status)(((status) >> 16) & 0x7fff) == 0)
	status &= ~EHCI_QTD_HALTED0x40;
if (EHCI_QTD_GET_PID(status)(((status) >> 8) & 0x3) !=	EHCI_QTD_PID_SETUP0x2)
	actlen += sqtd->len - EHCI_QTD_GET_BYTES(status)(((status) >> 16) & 0x7fff);
}

cerr = EHCI_QTD_GET_CERR(status)(((status) >> 10) & 0x3);
DPRINTFN(/*10*/2, ("ehci_idone: len=%d, actlen=%d, cerr=%d, "
   "status=0x%x\n", xfer->length, actlen, cerr, status));
xfer->actlen = actlen;
if ((status & EHCI_QTD_HALTED0x40) != 0) {
if ((status & EHCI_QTD_BABBLE0x10) == 0 && cerr > 0)
	xfer->status = USBD_STALLED;
else
	xfer->status = USBD_IOERROR; /* more info XXX */
} else
xfer->status = USBD_NORMAL_COMPLETION;

if (xfer->actlen)
usb_syncmem(&xfer->dmabuf, 0, xfer->actlen,
    usbd_xfer_isread(xfer) ?
    BUS_DMASYNC_POSTREAD0x02 : BUS_DMASYNC_POSTWRITE0x08);
usb_transfer_complete(xfer);
DPRINTFN(/*12*/2, ("ehci_idone: ex=%p done\n", ex));
924}

926void
927ehci_poll(struct usbd_bus *bus)
928{
struct ehci_softc *sc = (struct ehci_softc *)bus;

if (EOREAD4(sc, EHCI_USBSTS)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x04)))) & sc->sc_eintrs)
ehci_intr1(sc);
933}

935int
936ehci_detach(struct device *self, int flags)
937{
struct ehci_softc *sc = (struct ehci_softc *)self;
int rv;

rv = config_detach_children(self, flags);
if (rv != 0)
return (rv);

timeout_del(&sc->sc_tmo_intrlist);

ehci_reset(sc);

usb_delay_ms(&sc->sc_bus, 300); /* XXX let stray task complete */

free(sc->sc_softitds, M_USBHC103,
   sc->sc_flsize * sizeof(struct ehci_soft_itd *));
usb_freemem(&sc->sc_bus, &sc->sc_fldma);
/* XXX free other data structures XXX */

return (rv);
957}


960int
961ehci_activate(struct device *self, int act)
962{
struct ehci_softc *sc = (struct ehci_softc *)self;
u_int32_t cmd, hcr, cparams;
int i, rv = 0;

switch (act) {
case DVACT_SUSPEND3:
rv = config_activate_children(self, act);

971#ifdef DIAGNOSTIC1
if (!TAILQ_EMPTY(&sc->sc_intrhead)(((&sc->sc_intrhead)->tqh_first) == ((void *)0))) {
	printf("%s: interrupt list not empty\n",
	    sc->sc_bus.bdev.dv_xname);
	return (-1);
}
977#endif

sc->sc_bus.use_polling++;

for (i = 1; i <= sc->sc_noport; i++) {
	cmd = EOREAD4(sc, EHCI_PORTSC(i))(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
((0x40+4*(i))))));
	if ((cmd & (EHCI_PS_PO0x00002000|EHCI_PS_PE0x00000004)) == EHCI_PS_PE0x00000004)
		EOWRITE4(sc, EHCI_PORTSC(i),(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+((0x40+4*(i)))), ((cmd | 0x00000080))))
		    cmd | EHCI_PS_SUSP)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+((0x40+4*(i)))), ((cmd | 0x00000080))));
}

/*
 * First tell the host to stop processing Asynchronous
 * and Periodic schedules.
 */
cmd = EOREAD4(sc, EHCI_USBCMD)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x00)))) & ~(EHCI_CMD_ASE0x00000020 | EHCI_CMD_PSE0x00000010);
EOWRITE4(sc, EHCI_USBCMD, cmd)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), ((cmd))));
for (i = 0; i < 100; i++) {
	usb_delay_ms(&sc->sc_bus, 1);
	hcr = EOREAD4(sc, EHCI_USBSTS)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x04)))) &
	    (EHCI_STS_ASS0x00008000 | EHCI_STS_PSS0x00004000);
	if (hcr == 0)
		break;
}
if (hcr != 0)
	printf("%s: disable schedules timeout\n",
	    sc->sc_bus.bdev.dv_xname);

/*
 * Then reset the host as if it was a shutdown.
 *
 * All USB devices are disconnected/reconnected during
 * a suspend/resume cycle so keep it simple.
 */
ehci_reset(sc);

sc->sc_bus.use_polling--;
break;
case DVACT_RESUME4:
sc->sc_bus.use_polling++;

ehci_reset(sc);

cparams = EREAD4(sc, EHCI_HCCPARAMS)(((sc)->iot)->read_4(((sc)->ioh), ((0x08))));
/* MUST clear segment register if 64 bit capable. */
if (EHCI_HCC_64BIT(cparams)((cparams) & 0x1))
	EWRITE4(sc, EHCI_CTRLDSSEGMENT, 0)(((sc)->iot)->write_4(((sc)->ioh), ((0x10)), ((0))));

EOWRITE4(sc, EHCI_PERIODICLISTBASE, DMAADDR(&sc->sc_fldma, 0))(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x14)), ((((&sc->sc_fldma)->block->map->dm_segs
[0].ds_addr + (&sc->sc_fldma)->offs + (0))))));
EOWRITE4(sc, EHCI_ASYNCLISTADDR,(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x18)), ((sc->sc_async_head->physaddr | 0x2))))
 	    sc->sc_async_head->physaddr | EHCI_LINK_QH)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x18)), ((sc->sc_async_head->physaddr | 0x2))));

hcr = 0;
for (i = 1; i <= sc->sc_noport; i++) {
	cmd = EOREAD4(sc, EHCI_PORTSC(i))(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
((0x40+4*(i))))));
	if ((cmd & (EHCI_PS_PO0x00002000|EHCI_PS_SUSP0x00000080)) == EHCI_PS_SUSP0x00000080) {
		EOWRITE4(sc, EHCI_PORTSC(i), cmd | EHCI_PS_FPR)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+((0x40+4*(i)))), ((cmd | 0x00000040))));
		hcr = 1;
	}
}

if (hcr) {
	usb_delay_ms(&sc->sc_bus, USB_RESUME_WAIT50);
	for (i = 1; i <= sc->sc_noport; i++) {
		cmd = EOREAD4(sc, EHCI_PORTSC(i))(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
((0x40+4*(i))))));
		if ((cmd & (EHCI_PS_PO0x00002000|EHCI_PS_SUSP0x00000080)) ==
		   EHCI_PS_SUSP0x00000080)
			EOWRITE4(sc, EHCI_PORTSC(i),(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+((0x40+4*(i)))), ((cmd & ~0x00000040))))
			   cmd & ~EHCI_PS_FPR)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+((0x40+4*(i)))), ((cmd & ~0x00000040))));
	}
}

/* Turn on controller */
EOWRITE4(sc, EHCI_USBCMD,(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), ((0x00020000 | ((((sc)->iot)->read_4(((sc)->
ioh), ((sc)->sc_offs+(0x00)))) & 0x0000000c) | 0x00000020
 | 0x00000010 | 0x00000001))))
    EHCI_CMD_ITC_2 | /* 2 microframes interrupt delay */(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), ((0x00020000 | ((((sc)->iot)->read_4(((sc)->
ioh), ((sc)->sc_offs+(0x00)))) & 0x0000000c) | 0x00000020
 | 0x00000010 | 0x00000001))))
    (EOREAD4(sc, EHCI_USBCMD) & EHCI_CMD_FLS_M) |(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), ((0x00020000 | ((((sc)->iot)->read_4(((sc)->
ioh), ((sc)->sc_offs+(0x00)))) & 0x0000000c) | 0x00000020
 | 0x00000010 | 0x00000001))))
    EHCI_CMD_ASE |(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), ((0x00020000 | ((((sc)->iot)->read_4(((sc)->
ioh), ((sc)->sc_offs+(0x00)))) & 0x0000000c) | 0x00000020
 | 0x00000010 | 0x00000001))))
    EHCI_CMD_PSE |(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), ((0x00020000 | ((((sc)->iot)->read_4(((sc)->
ioh), ((sc)->sc_offs+(0x00)))) & 0x0000000c) | 0x00000020
 | 0x00000010 | 0x00000001))))
    EHCI_CMD_RS)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), ((0x00020000 | ((((sc)->iot)->read_4(((sc)->
ioh), ((sc)->sc_offs+(0x00)))) & 0x0000000c) | 0x00000020
 | 0x00000010 | 0x00000001))));

/* Take over port ownership */
EOWRITE4(sc, EHCI_CONFIGFLAG, EHCI_CONF_CF)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x40)), ((0x00000001))));
for (i = 0; i < 100; i++) {
	usb_delay_ms(&sc->sc_bus, 1);
	hcr = EOREAD4(sc, EHCI_USBSTS)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x04)))) & EHCI_STS_HCH0x00001000;
	if (!hcr)
		break;
}

if (hcr) {
	printf("%s: run timeout\n", sc->sc_bus.bdev.dv_xname);
	/* XXX should we bail here? */
}

EOWRITE4(sc, EHCI_USBINTR, sc->sc_eintrs)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x08)), ((sc->sc_eintrs))));

usb_delay_ms(&sc->sc_bus, USB_RESUME_WAIT50);

sc->sc_bus.use_polling--;
rv = config_activate_children(self, act);
break;
case DVACT_POWERDOWN6:
rv = config_activate_children(self, act);
ehci_reset(sc);
break;
default:
rv = config_activate_children(self, act);
break;
}
return (rv);
1087}

1089usbd_status
1090ehci_reset(struct ehci_softc *sc)
1091{
u_int32_t hcr, usbmode;
int i;

EOWRITE4(sc, EHCI_USBCMD, 0)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), ((0))));	/* Halt controller */
for (i = 0; i < 100; i++) {
usb_delay_ms(&sc->sc_bus, 1);
hcr = EOREAD4(sc, EHCI_USBSTS)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x04)))) & EHCI_STS_HCH0x00001000;
if (hcr)
	break;
}

if (!hcr)
printf("%s: halt timeout\n", sc->sc_bus.bdev.dv_xname);

if (sc->sc_flags & EHCIF_USBMODE0x04)
usbmode = EOREAD4(sc, EHCI_USBMODE)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x68))));

EOWRITE4(sc, EHCI_USBCMD, EHCI_CMD_HCRESET)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), ((0x00000002))));
for (i = 0; i < 100; i++) {
usb_delay_ms(&sc->sc_bus, 1);
hcr = EOREAD4(sc, EHCI_USBCMD)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x00)))) & EHCI_CMD_HCRESET0x00000002;
if (!hcr)
	break;
}

if (hcr) {
printf("%s: reset timeout\n", sc->sc_bus.bdev.dv_xname);
return (USBD_IOERROR);
}

if (sc->sc_flags & EHCIF_USBMODE0x04)
EOWRITE4(sc, EHCI_USBMODE, usbmode)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x68)), ((usbmode))));

return (USBD_NORMAL_COMPLETION);
1126}

1128struct usbd_xfer *
1129ehci_allocx(struct usbd_bus *bus)
1130{
struct ehci_xfer *ex;

ex = pool_get(ehcixfer, PR_NOWAIT0x0002 | PR_ZERO0x0008);
1134#ifdef DIAGNOSTIC1
if (ex != NULL((void *)0))
ex->isdone = 1;
1137#endif
return ((struct usbd_xfer *)ex);
1139}

1141void
1142ehci_freex(struct usbd_bus *bus, struct usbd_xfer *xfer)
1143{
struct ehci_xfer *ex = (struct ehci_xfer*)xfer;

1146#ifdef DIAGNOSTIC1
if (!ex->isdone) {
printf("%s: !isdone\n", __func__);
return;
}
1151#endif
pool_put(ehcixfer, ex);
1153}

1155void
1156ehci_device_clear_toggle(struct usbd_pipe *pipe)
1157{
struct ehci_pipe *epipe = (struct ehci_pipe *)pipe;

1160#ifdef DIAGNOSTIC1
if ((epipe->sqh->qh.qh_qtd.qtd_status & htole32(EHCI_QTD_ACTIVE)((__uint32_t)(0x80))) != 0)
printf("%s: queue active\n", __func__);
1163#endif
epipe->sqh->qh.qh_qtd.qtd_status &= htole32(~EHCI_QTD_TOGGLE_MASK)((__uint32_t)(~0x80000000));
1165}

1167#ifdef EHCI_DEBUG
1168void
1169ehci_dump_regs(struct ehci_softc *sc)
1170{
int i;

printf("cmd=0x%08x, sts=0x%08x, ien=0x%08x\n",
   EOREAD4(sc, EHCI_USBCMD)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x00)))),
   EOREAD4(sc, EHCI_USBSTS)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x04)))),
   EOREAD4(sc, EHCI_USBINTR)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x08)))));
printf("frindex=0x%08x ctrdsegm=0x%08x periodic=0x%08x async=0x%08x\n",
   EOREAD4(sc, EHCI_FRINDEX)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x0c)))),
   EOREAD4(sc, EHCI_CTRLDSSEGMENT)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x10)))),
   EOREAD4(sc, EHCI_PERIODICLISTBASE)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x14)))),
   EOREAD4(sc, EHCI_ASYNCLISTADDR)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x18)))));
for (i = 1; i <= sc->sc_noport; i++)
printf("port %d status=0x%08x\n", i,
    EOREAD4(sc, EHCI_PORTSC(i))(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
((0x40+4*(i)))))));
1185}

1187/*
* Unused function - this is meant to be called from a kernel
* debugger.
*/
1191void
1192ehci_dump(void)
1193{
ehci_dump_regs(theehci);
1195}

1197void
1198ehci_dump_link(ehci_link_t link, int type)
1199{
link = letoh32(link)((__uint32_t)(link));
printf("0x%08x", link);
if (link & EHCI_LINK_TERMINATE0x00000001)
printf("<T>");
else {
printf("<");
if (type) {
	switch (EHCI_LINK_TYPE(link)((link) & 0x00000006)) {
	case EHCI_LINK_ITD0x0:
		printf("ITD");
		break;
	case EHCI_LINK_QH0x2:
		printf("QH");
		break;
	case EHCI_LINK_SITD0x4:
		printf("SITD");
		break;
	case EHCI_LINK_FSTN0x6:
		printf("FSTN");
		break;
	}
}
printf(">");
}
1224}

1226void
1227ehci_dump_sqtds(struct ehci_soft_qtd *sqtd)
1228{
int i;
u_int32_t stop;

stop = 0;
for (i = 0; sqtd && i < 20 && !stop; sqtd = sqtd->nextqtd, i++) {
ehci_dump_sqtd(sqtd);
usb_syncmem(&sqtd->dma,
    sqtd->offs + offsetof(struct ehci_qtd, qtd_next)__builtin_offsetof(struct ehci_qtd, qtd_next),
    sizeof(sqtd->qtd),
    BUS_DMASYNC_POSTWRITE0x08 | BUS_DMASYNC_POSTREAD0x02);
stop = sqtd->qtd.qtd_next & htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));
usb_syncmem(&sqtd->dma,
    sqtd->offs + offsetof(struct ehci_qtd, qtd_next)__builtin_offsetof(struct ehci_qtd, qtd_next),
    sizeof(sqtd->qtd), BUS_DMASYNC_PREREAD0x01);
}
if (!stop)
printf("dump aborted, too many TDs\n");
1246}

1248void
1249ehci_dump_sqtd(struct ehci_soft_qtd *sqtd)
1250{
usb_syncmem(&sqtd->dma, sqtd->offs, 
   sizeof(sqtd->qtd), BUS_DMASYNC_POSTWRITE0x08 | BUS_DMASYNC_POSTREAD0x02);
printf("QTD(%p) at 0x%08x:\n", sqtd, sqtd->physaddr);
ehci_dump_qtd(&sqtd->qtd);
usb_syncmem(&sqtd->dma, sqtd->offs, 
   sizeof(sqtd->qtd), BUS_DMASYNC_PREREAD0x01);
1257}

1259void
1260ehci_dump_qtd(struct ehci_qtd *qtd)
1261{
u_int32_t s;
char sbuf[128];

printf("  next="); ehci_dump_link(qtd->qtd_next, 0);
printf(" altnext="); ehci_dump_link(qtd->qtd_altnext, 0);
printf("\n");
s = letoh32(qtd->qtd_status)((__uint32_t)(qtd->qtd_status));
bitmask_snprintf(EHCI_QTD_GET_STATUS(s)(((s) >> 0) & 0xff), "\20\10ACTIVE\7HALTED"
   "\6BUFERR\5BABBLE\4XACTERR\3MISSED\2SPLIT\1PING",
   sbuf, sizeof(sbuf));
printf("  status=0x%08x: toggle=%d bytes=0x%x ioc=%d c_page=0x%x\n",
   s, EHCI_QTD_GET_TOGGLE(s)(((s) >> 31) & 0x1), EHCI_QTD_GET_BYTES(s)(((s) >> 16) & 0x7fff),
   EHCI_QTD_GET_IOC(s)(((s) >> 15) & 0x1), EHCI_QTD_GET_C_PAGE(s)(((s) >> 12) & 0x7));
printf("    cerr=%d pid=%d stat=0x%s\n", EHCI_QTD_GET_CERR(s)(((s) >> 10) & 0x3),
   EHCI_QTD_GET_PID(s)(((s) >> 8) & 0x3), sbuf);
for (s = 0; s < 5; s++)
printf("  buffer[%d]=0x%08x\n", s, letoh32(qtd->qtd_buffer[s])((__uint32_t)(qtd->qtd_buffer[s])));
1279}

1281void
1282ehci_dump_sqh(struct ehci_soft_qh *sqh)
1283{
struct ehci_qh *qh = &sqh->qh;
u_int32_t endp, endphub;

usb_syncmem(&sqh->dma, sqh->offs,
   sizeof(sqh->qh), BUS_DMASYNC_POSTWRITE0x08 | BUS_DMASYNC_POSTREAD0x02);
printf("QH(%p) at 0x%08x:\n", sqh, sqh->physaddr);
printf("  link="); ehci_dump_link(qh->qh_link, 1); printf("\n");
endp = letoh32(qh->qh_endp)((__uint32_t)(qh->qh_endp));
printf("  endp=0x%08x\n", endp);
printf("    addr=0x%02x inact=%d endpt=%d eps=%d dtc=%d hrecl=%d\n",
   EHCI_QH_GET_ADDR(endp)(((endp) >> 0) & 0x7f), EHCI_QH_GET_INACT(endp)(((endp) >> 7) & 0x01),
   EHCI_QH_GET_ENDPT(endp)(((endp) >> 8) & 0x0f),  EHCI_QH_GET_EPS(endp)(((endp) >> 12) & 0x03),
   EHCI_QH_GET_DTC(endp)(((endp) >> 14) & 0x01), EHCI_QH_GET_HRECL(endp)(((endp) >> 15) & 0x01));
printf("    mpl=0x%x ctl=%d nrl=%d\n",
   EHCI_QH_GET_MPL(endp)(((endp) >> 16) & 0x7ff), EHCI_QH_GET_CTL(endp)(((endp) >> 27) & 0x01),
   EHCI_QH_GET_NRL(endp)(((endp) >> 28) & 0x0f));
endphub = letoh32(qh->qh_endphub)((__uint32_t)(qh->qh_endphub));
printf("  endphub=0x%08x\n", endphub);
printf("    smask=0x%02x cmask=0x%02x huba=0x%02x port=%d mult=%d\n",
   EHCI_QH_GET_SMASK(endphub)(((endphub) >> 0) & 0xff), EHCI_QH_GET_CMASK(endphub)(((endphub) >> 8) & 0xff),
   EHCI_QH_GET_HUBA(endphub)(((endphub) >> 16) & 0x7f), EHCI_QH_GET_PORT(endphub)(((endphub) >> 23) & 0x7f),
   EHCI_QH_GET_MULT(endphub)(((endphub) >> 30) & 0x03));
printf("  curqtd="); ehci_dump_link(qh->qh_curqtd, 0); printf("\n");
printf("Overlay qTD:\n");
ehci_dump_qtd(&qh->qh_qtd);
usb_syncmem(&sqh->dma, sqh->offs,
   sizeof(sqh->qh), BUS_DMASYNC_PREREAD0x01);
1311}

1313#if notyet
1314void
1315ehci_dump_itd(struct ehci_soft_itd *itd)
1316{
ehci_isoc_trans_t t;
ehci_isoc_bufr_ptr_t b, b2, b3;
int i;

printf("ITD: next phys=%X\n", itd->itd.itd_next);

for (i = 0; i < 8; i++) {
t = letoh32(itd->itd.itd_ctl[i])((__uint32_t)(itd->itd.itd_ctl[i]));
printf("ITDctl %d: stat=%X len=%X ioc=%X pg=%X offs=%X\n", i,
    EHCI_ITD_GET_STATUS(t)(((t) >> 28) & 0xf), EHCI_ITD_GET_LEN(t)(((t) >> 16) & 0xfff),
    EHCI_ITD_GET_IOC(t)(((t) >> 15) & 1), EHCI_ITD_GET_PG(t)(((t) >> 12) & 0x7),
    EHCI_ITD_GET_OFFS(t)(((t) >> 0) & 0xfff));
}
printf("ITDbufr: ");
for (i = 0; i < 7; i++)
printf("%X,", EHCI_ITD_GET_BPTR(letoh32(itd->itd.itd_bufr[i])((__uint32_t)(itd->itd.itd_bufr[i]))));

b = letoh32(itd->itd.itd_bufr[0])((__uint32_t)(itd->itd.itd_bufr[0]));
b2 = letoh32(itd->itd.itd_bufr[1])((__uint32_t)(itd->itd.itd_bufr[1]));
b3 = letoh32(itd->itd.itd_bufr[2])((__uint32_t)(itd->itd.itd_bufr[2]));
printf("\nep=%X daddr=%X dir=%d maxpkt=%X multi=%X\n",
   EHCI_ITD_GET_EP(b), EHCI_ITD_GET_DADDR(b)((b) & 0x7f), EHCI_ITD_GET_DIR(b2)(((b2) >> 11) & 1),
   EHCI_ITD_GET_MAXPKT(b2)((b2) & 0x7ff), EHCI_ITD_GET_MULTI(b3)((b3) & 0x3));
1340}
1341#endif

1343#ifdef DIAGNOSTIC1
1344void
1345ehci_dump_exfer(struct ehci_xfer *ex)
1346{
printf("ehci_dump_exfer: ex=%p sqtdstart=%p end=%p itdstart=%p end=%p "
   "isdone=%d\n", ex, ex->sqtdstart_TD.sqtd.start, ex->sqtdend_TD.sqtd.end, ex->itdstart_TD.itd.start,
   ex->itdend_TD.itd.end, ex->isdone);
1350}
1351#endif

1353#endif /* EHCI_DEBUG */

1355usbd_status
1356ehci_open(struct usbd_pipe *pipe)
1357{
struct usbd_device *dev = pipe->device;
struct ehci_softc *sc = (struct ehci_softc *)dev->bus;
usb_endpoint_descriptor_t *ed = pipe->endpoint->edesc;
u_int8_t addr = dev->address;
u_int8_t xfertype = UE_GET_XFERTYPE(ed->bmAttributes)((ed->bmAttributes) & 0x03);
struct ehci_pipe *epipe = (struct ehci_pipe *)pipe;
struct ehci_soft_qh *sqh;
usbd_status err;
int s;
int ival, speed, naks;
int hshubaddr, hshubport;

DPRINTFN(1, ("ehci_open: pipe=%p, addr=%d, endpt=%d\n",
   pipe, addr, ed->bEndpointAddress));

if (sc->sc_bus.dying)
return (USBD_IOERROR);

if (dev->myhsport) {
hshubaddr = dev->myhsport->parent->address;
hshubport = dev->myhsport->portno;
} else {
hshubaddr = 0;
hshubport = 0;
}

/* Root Hub */
if (pipe->device->depth == 0) {
switch (ed->bEndpointAddress) {
case USB_CONTROL_ENDPOINT0:
	pipe->methods = &ehci_root_ctrl_methods;
	break;
case UE_DIR_IN0x80 | EHCI_INTR_ENDPT1:
	pipe->methods = &ehci_root_intr_methods;
	break;
default:
	return (USBD_INVAL);
}
return (USBD_NORMAL_COMPLETION);
}

/* XXX All this stuff is only valid for async. */
switch (dev->speed) {
case USB_SPEED_LOW1:
speed = EHCI_QH_SPEED_LOW0x1;
break;
case USB_SPEED_FULL2:
speed = EHCI_QH_SPEED_FULL0x0;
break;
case USB_SPEED_HIGH3:
speed = EHCI_QH_SPEED_HIGH0x2;
break;
default:
panic("ehci_open: bad device speed %d", dev->speed);
}

/*
* NAK reload count:
* must be zero with using periodic transfer.
* Linux 4.20's driver (ehci-q.c) sets 4, we use same value.
*/
naks = ((xfertype == UE_CONTROL0x00) || (xfertype == UE_BULK0x02)) ? 4 : 0;

/* Allocate sqh for everything, save isoc xfers */
if (xfertype != UE_ISOCHRONOUS0x01) {
sqh = ehci_alloc_sqh(sc);
if (sqh == NULL((void *)0))
	return (USBD_NOMEM);
/* qh_link filled when the QH is added */
sqh->qh.qh_endp = htole32(((__uint32_t)((addr) | ((((ed->bEndpointAddress) & 0x0f
)) << 8) | ((speed) << 12) | (xfertype == 0x00 ? 0x00004000
 : 0) | (((*(u_int16_t *)(ed->wMaxPacketSize))) << 16
) | (speed != 0x2 && xfertype == 0x00 ? 0x08000000 : 0
) | ((naks) << 28)))
    EHCI_QH_SET_ADDR(addr) |((__uint32_t)((addr) | ((((ed->bEndpointAddress) & 0x0f
)) << 8) | ((speed) << 12) | (xfertype == 0x00 ? 0x00004000
 : 0) | (((*(u_int16_t *)(ed->wMaxPacketSize))) << 16
) | (speed != 0x2 && xfertype == 0x00 ? 0x08000000 : 0
) | ((naks) << 28)))
    EHCI_QH_SET_ENDPT(UE_GET_ADDR(ed->bEndpointAddress)) |((__uint32_t)((addr) | ((((ed->bEndpointAddress) & 0x0f
)) << 8) | ((speed) << 12) | (xfertype == 0x00 ? 0x00004000
 : 0) | (((*(u_int16_t *)(ed->wMaxPacketSize))) << 16
) | (speed != 0x2 && xfertype == 0x00 ? 0x08000000 : 0
) | ((naks) << 28)))
    EHCI_QH_SET_EPS(speed) |((__uint32_t)((addr) | ((((ed->bEndpointAddress) & 0x0f
)) << 8) | ((speed) << 12) | (xfertype == 0x00 ? 0x00004000
 : 0) | (((*(u_int16_t *)(ed->wMaxPacketSize))) << 16
) | (speed != 0x2 && xfertype == 0x00 ? 0x08000000 : 0
) | ((naks) << 28)))
    (xfertype == UE_CONTROL ? EHCI_QH_DTC : 0) |((__uint32_t)((addr) | ((((ed->bEndpointAddress) & 0x0f
)) << 8) | ((speed) << 12) | (xfertype == 0x00 ? 0x00004000
 : 0) | (((*(u_int16_t *)(ed->wMaxPacketSize))) << 16
) | (speed != 0x2 && xfertype == 0x00 ? 0x08000000 : 0
) | ((naks) << 28)))
    EHCI_QH_SET_MPL(UGETW(ed->wMaxPacketSize)) |((__uint32_t)((addr) | ((((ed->bEndpointAddress) & 0x0f
)) << 8) | ((speed) << 12) | (xfertype == 0x00 ? 0x00004000
 : 0) | (((*(u_int16_t *)(ed->wMaxPacketSize))) << 16
) | (speed != 0x2 && xfertype == 0x00 ? 0x08000000 : 0
) | ((naks) << 28)))
    (speed != EHCI_QH_SPEED_HIGH && xfertype == UE_CONTROL ?((__uint32_t)((addr) | ((((ed->bEndpointAddress) & 0x0f
)) << 8) | ((speed) << 12) | (xfertype == 0x00 ? 0x00004000
 : 0) | (((*(u_int16_t *)(ed->wMaxPacketSize))) << 16
) | (speed != 0x2 && xfertype == 0x00 ? 0x08000000 : 0
) | ((naks) << 28)))
    EHCI_QH_CTL : 0) |((__uint32_t)((addr) | ((((ed->bEndpointAddress) & 0x0f
)) << 8) | ((speed) << 12) | (xfertype == 0x00 ? 0x00004000
 : 0) | (((*(u_int16_t *)(ed->wMaxPacketSize))) << 16
) | (speed != 0x2 && xfertype == 0x00 ? 0x08000000 : 0
) | ((naks) << 28)))
    EHCI_QH_SET_NRL(naks)((__uint32_t)((addr) | ((((ed->bEndpointAddress) & 0x0f
)) << 8) | ((speed) << 12) | (xfertype == 0x00 ? 0x00004000
 : 0) | (((*(u_int16_t *)(ed->wMaxPacketSize))) << 16
) | (speed != 0x2 && xfertype == 0x00 ? 0x08000000 : 0
) | ((naks) << 28)))
)((__uint32_t)((addr) | ((((ed->bEndpointAddress) & 0x0f
)) << 8) | ((speed) << 12) | (xfertype == 0x00 ? 0x00004000
 : 0) | (((*(u_int16_t *)(ed->wMaxPacketSize))) << 16
) | (speed != 0x2 && xfertype == 0x00 ? 0x08000000 : 0
) | ((naks) << 28)));
/*
 * To reduce conflict with split isochronous transfer,
 * schedule (split) interrupt transfer at latter half of
 * 1ms frame:
 *
 *         |<-------------- H-Frame -------------->|
 *         .H0  :H1   H2   H3   H4   H5   H6   H7  .H0" :H1"
 *         .    :                                  .    :
 * [HS]    .    :          SS        CS   CS'  CS" .    :
 * [FS/LS] .    :               |<== >>>> >>>|     .    :
 *         .    :                                  .    :
 *         .B7' :B0   B1   B2   B3   B4   B5   B6  .B7  :B0"
 *              |<-------------- B-Frame -------------->|
 *
 */
sqh->qh.qh_endphub = htole32(((__uint32_t)(((1) << 30) | ((xfertype == 0x03 ? 0x08 :
 0) << 0)))
    EHCI_QH_SET_MULT(1) |((__uint32_t)(((1) << 30) | ((xfertype == 0x03 ? 0x08 :
 0) << 0)))
    EHCI_QH_SET_SMASK(xfertype == UE_INTERRUPT ? 0x08 : 0)((__uint32_t)(((1) << 30) | ((xfertype == 0x03 ? 0x08 :
 0) << 0)))
)((__uint32_t)(((1) << 30) | ((xfertype == 0x03 ? 0x08 :
 0) << 0)));
if (speed != EHCI_QH_SPEED_HIGH0x2) {
	sqh->qh.qh_endphub |= htole32(((__uint32_t)(((hshubaddr) << 16) | ((hshubport) <<
 23) | ((0xe0) << 8)))
	    EHCI_QH_SET_HUBA(hshubaddr) |((__uint32_t)(((hshubaddr) << 16) | ((hshubport) <<
 23) | ((0xe0) << 8)))
	    EHCI_QH_SET_PORT(hshubport) |((__uint32_t)(((hshubaddr) << 16) | ((hshubport) <<
 23) | ((0xe0) << 8)))
	    EHCI_QH_SET_CMASK(0xe0)((__uint32_t)(((hshubaddr) << 16) | ((hshubport) <<
 23) | ((0xe0) << 8)))
	)((__uint32_t)(((hshubaddr) << 16) | ((hshubport) <<
 23) | ((0xe0) << 8)));
}
sqh->qh.qh_curqtd = htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));
/* Fill the overlay qTD */
sqh->qh.qh_qtd.qtd_next = htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));
sqh->qh.qh_qtd.qtd_altnext = htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));
sqh->qh.qh_qtd.qtd_status =
    htole32(EHCI_QTD_SET_TOGGLE(pipe->endpoint->savedtoggle))((__uint32_t)(((pipe->endpoint->savedtoggle) << 31
)));

usb_syncmem(&sqh->dma, sqh->offs, sizeof(sqh->qh),
    BUS_DMASYNC_PREWRITE0x04 | BUS_DMASYNC_PREREAD0x01);
epipe->sqh = sqh;
} /*xfertype == UE_ISOC*/

switch (xfertype) {
case UE_CONTROL0x00:
err = usb_allocmem(&sc->sc_bus, sizeof(usb_device_request_t),
    0, USB_DMA_COHERENT(1 << 0), &epipe->u.ctl.reqdma);
if (err) {
	ehci_free_sqh(sc, sqh);
	return (err);
}
pipe->methods = &ehci_device_ctrl_methods;
s = splusb()splraise(0x2);
ehci_add_qh(sqh, sc->sc_async_head);
splx(s)spllower(s);
break;
case UE_BULK0x02:
pipe->methods = &ehci_device_bulk_methods;
s = splusb()splraise(0x2);
ehci_add_qh(sqh, sc->sc_async_head);
splx(s)spllower(s);
break;
case UE_INTERRUPT0x03:
pipe->methods = &ehci_device_intr_methods;
ival = pipe->interval;
if (ival == USBD_DEFAULT_INTERVAL(-1))
	ival = ed->bInterval;
s = splusb()splraise(0x2);
err = ehci_device_setintr(sc, sqh, ival);
splx(s)spllower(s);
return (err);
case UE_ISOCHRONOUS0x01:
switch (speed) {
case EHCI_QH_SPEED_HIGH0x2:
case EHCI_QH_SPEED_FULL0x0:
	pipe->methods = &ehci_device_isoc_methods;
	break;
case EHCI_QH_SPEED_LOW0x1:
default:
	return (USBD_INVAL);
}
/* Spec page 271 says intervals > 16 are invalid */
if (ed->bInterval == 0 || ed->bInterval > 16) {
	printf("ehci: opening pipe with invalid bInterval\n");
	return (USBD_INVAL);
}
if (UGETW(ed->wMaxPacketSize)(*(u_int16_t *)(ed->wMaxPacketSize)) == 0) {
	printf("ehci: zero length endpoint open request\n");
	return (USBD_INVAL);
}
epipe->u.isoc.next_frame = 0;
epipe->u.isoc.cur_xfers = 0;
break;
default:
DPRINTF(("ehci: bad xfer type %d\n", xfertype));
return (USBD_INVAL);
}
return (USBD_NORMAL_COMPLETION);
1530}

1532/*
* Add an ED to the schedule.  Called at splusb().
* If in the async schedule, it will always have a next.
* If in the intr schedule it may not.
*/
1537void
1538ehci_add_qh(struct ehci_soft_qh *sqh, struct ehci_soft_qh *head)
1539{
splsoftassert(IPL_SOFTUSB)do { if (splassert_ctl > 0) { splassert_check(0x2, __func__
); } } while (0);

usb_syncmem(&head->dma, head->offs + offsetof(struct ehci_qh, qh_link)__builtin_offsetof(struct ehci_qh, qh_link),
   sizeof(head->qh.qh_link), BUS_DMASYNC_POSTWRITE0x08);
sqh->next = head->next;
sqh->prev = head;
sqh->qh.qh_link = head->qh.qh_link;
usb_syncmem(&sqh->dma, sqh->offs + offsetof(struct ehci_qh, qh_link)__builtin_offsetof(struct ehci_qh, qh_link),
   sizeof(sqh->qh.qh_link), BUS_DMASYNC_PREWRITE0x04);
head->next = sqh;
if (sqh->next)
sqh->next->prev = sqh;
head->qh.qh_link = htole32(sqh->physaddr | EHCI_LINK_QH)((__uint32_t)(sqh->physaddr | 0x2));
usb_syncmem(&head->dma, head->offs + offsetof(struct ehci_qh, qh_link)__builtin_offsetof(struct ehci_qh, qh_link),
   sizeof(head->qh.qh_link), BUS_DMASYNC_PREWRITE0x04);
1555}

1557/*
* Remove an ED from the schedule.  Called at splusb().
* Will always have a 'next' if it's in the async list as it's circular.
*/
1561void
1562ehci_rem_qh(struct ehci_softc *sc, struct ehci_soft_qh *sqh)
1563{
splsoftassert(IPL_SOFTUSB)do { if (splassert_ctl > 0) { splassert_check(0x2, __func__
); } } while (0);
/* XXX */
usb_syncmem(&sqh->dma, sqh->offs + offsetof(struct ehci_qh, qh_link)__builtin_offsetof(struct ehci_qh, qh_link),
   sizeof(sqh->qh.qh_link), BUS_DMASYNC_POSTWRITE0x08);
sqh->prev->qh.qh_link = sqh->qh.qh_link;
sqh->prev->next = sqh->next;
if (sqh->next)
sqh->next->prev = sqh->prev;
usb_syncmem(&sqh->prev->dma,
   sqh->prev->offs + offsetof(struct ehci_qh, qh_link)__builtin_offsetof(struct ehci_qh, qh_link),
   sizeof(sqh->prev->qh.qh_link), BUS_DMASYNC_PREWRITE0x04);

ehci_sync_hc(sc);
1577}

1579void
1580ehci_set_qh_qtd(struct ehci_soft_qh *sqh, struct ehci_soft_qtd *sqtd)
1581{
int i;
u_int32_t status;

/* Save toggle bit and ping status. */
usb_syncmem(&sqh->dma, sqh->offs, sizeof(sqh->qh),
   BUS_DMASYNC_POSTWRITE0x08 | BUS_DMASYNC_POSTREAD0x02);
status = sqh->qh.qh_qtd.qtd_status &
   htole32(EHCI_QTD_TOGGLE_MASK |((__uint32_t)(0x80000000 | ((0x01) << 0)))
EHCI_QTD_SET_STATUS(EHCI_QTD_PINGSTATE))((__uint32_t)(0x80000000 | ((0x01) << 0)));
/* Set HALTED to make hw leave it alone. */
sqh->qh.qh_qtd.qtd_status =
   htole32(EHCI_QTD_SET_STATUS(EHCI_QTD_HALTED))((__uint32_t)(((0x40) << 0)));
usb_syncmem(&sqh->dma,
   sqh->offs + offsetof(struct ehci_qh, qh_qtd.qtd_status)__builtin_offsetof(struct ehci_qh, qh_qtd.qtd_status),
   sizeof(sqh->qh.qh_qtd.qtd_status),
   BUS_DMASYNC_PREWRITE0x04 | BUS_DMASYNC_PREREAD0x01);
sqh->qh.qh_curqtd = 0;
sqh->qh.qh_qtd.qtd_next = htole32(sqtd->physaddr)((__uint32_t)(sqtd->physaddr));
sqh->qh.qh_qtd.qtd_altnext = htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));
for (i = 0; i < EHCI_QTD_NBUFFERS5; i++)
sqh->qh.qh_qtd.qtd_buffer[i] = 0;
sqh->sqtd = sqtd;
usb_syncmem(&sqh->dma, sqh->offs, sizeof(sqh->qh),
   BUS_DMASYNC_PREWRITE0x04 | BUS_DMASYNC_PREREAD0x01);
/* Set !HALTED && !ACTIVE to start execution, preserve some fields */
sqh->qh.qh_qtd.qtd_status = status;
usb_syncmem(&sqh->dma,
   sqh->offs + offsetof(struct ehci_qh, qh_qtd.qtd_status)__builtin_offsetof(struct ehci_qh, qh_qtd.qtd_status),
   sizeof(sqh->qh.qh_qtd.qtd_status),
   BUS_DMASYNC_PREWRITE0x04 | BUS_DMASYNC_PREREAD0x01);
1612}

1614/*
* Ensure that the HC has released all references to the QH.  We do this
* by asking for a Async Advance Doorbell interrupt and then we wait for
* the interrupt.
* To make this easier we first obtain exclusive use of the doorbell.
*/
1620void
1621ehci_sync_hc(struct ehci_softc *sc)
1622{
int s, error;
int tries = 0;

if (sc->sc_bus.dying) {
return;
}

/* get doorbell */
rw_enter_write(&sc->sc_doorbell_lock);
s = splhardusb()splraise(0x3);
do {
EOWRITE4(sc, EHCI_USBCMD, EOREAD4(sc, EHCI_USBCMD) |(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), (((((sc)->iot)->read_4(((sc)->ioh), ((sc)->
sc_offs+(0x00)))) | 0x00000040))))
    EHCI_CMD_IAAD)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(0x00)), (((((sc)->iot)->read_4(((sc)->ioh), ((sc)->
sc_offs+(0x00)))) | 0x00000040))));
error = tsleep_nsec(&sc->sc_async_head, PZERO22, "ehcidi",
    MSEC_TO_NSEC(500));
} while (error && ++tries < 10);
splx(s)spllower(s);
/* release doorbell */
rw_exit_write(&sc->sc_doorbell_lock);
1642#ifdef DIAGNOSTIC1
if (error)
printf("ehci_sync_hc: tsleep() = %d\n", error);
1645#endif
1646}

1648void
1649ehci_rem_itd_chain(struct ehci_softc *sc, struct ehci_xfer *ex)
1650{
struct ehci_soft_itd *itd, *prev = NULL((void *)0);

splsoftassert(IPL_SOFTUSB)do { if (splassert_ctl > 0) { splassert_check(0x2, __func__
); } } while (0);

KASSERT(ex->itdstart != NULL && ex->itdend != NULL)((ex->_TD.itd.start != ((void *)0) && ex->_TD.itd
.end != ((void *)0)) ? (void)0 : __assert("diagnostic ", "/usr/src/sys/dev/usb/ehci.c"
, 1655, "ex->itdstart != NULL && ex->itdend != NULL"
));

for (itd = ex->itdstart_TD.itd.start; itd != NULL((void *)0); itd = itd->xfer_next) {
prev = itd->u.frame_list.prev;
/* Unlink itd from hardware chain, or frame array */
if (prev == NULL((void *)0)) { /* We're at the table head */
	sc->sc_softitds[itd->slot] = itd->u.frame_list.next;
	sc->sc_flist[itd->slot] = itd->itd.itd_next;
	usb_syncmem(&sc->sc_fldma,
	    sizeof(uint32_t) * itd->slot, sizeof(uint32_t),
	    BUS_DMASYNC_PREWRITE0x04 | BUS_DMASYNC_PREREAD0x01);

	if (itd->u.frame_list.next != NULL((void *)0))
		itd->u.frame_list.next->u.frame_list.prev =
		    NULL((void *)0);
} else {
	/* XXX this part is untested... */
	prev->itd.itd_next = itd->itd.itd_next;
	usb_syncmem(&itd->dma,
	    itd->offs + offsetof(struct ehci_itd, itd_next)__builtin_offsetof(struct ehci_itd, itd_next),
	    sizeof(itd->itd.itd_next), BUS_DMASYNC_PREWRITE0x04);

	prev->u.frame_list.next = itd->u.frame_list.next;
	if (itd->u.frame_list.next != NULL((void *)0))
		itd->u.frame_list.next->u.frame_list.prev =
		    prev;
}
}
1683}

1685void
1686ehci_free_itd_chain(struct ehci_softc *sc, struct ehci_xfer *ex)
1687{
struct ehci_soft_itd *itd, *prev = NULL((void *)0);

splsoftassert(IPL_SOFTUSB)do { if (splassert_ctl > 0) { splassert_check(0x2, __func__
); } } while (0);

KASSERT(ex->itdstart != NULL && ex->itdend != NULL)((ex->_TD.itd.start != ((void *)0) && ex->_TD.itd
.end != ((void *)0)) ? (void)0 : __assert("diagnostic ", "/usr/src/sys/dev/usb/ehci.c"
, 1692, "ex->itdstart != NULL && ex->itdend != NULL"
));

for (itd = ex->itdstart_TD.itd.start; itd != NULL((void *)0); itd = itd->xfer_next) {
if (prev != NULL((void *)0))
	ehci_free_itd(sc, prev);
prev = itd;
}
if (prev)
ehci_free_itd(sc, prev);
ex->itdstart_TD.itd.start = NULL((void *)0);
ex->itdend_TD.itd.end = NULL((void *)0);
1703}

1705/*
* Data structures and routines to emulate the root hub.
*/
1708const usb_device_descriptor_t ehci_devd = {
USB_DEVICE_DESCRIPTOR_SIZE18,
UDESC_DEVICE0x01,		/* type */
{0x00, 0x02},		/* USB version */
UDCLASS_HUB0x09,		/* class */
UDSUBCLASS_HUB0x00,		/* subclass */
UDPROTO_HSHUBSTT0x01,	/* protocol */
64,			/* max packet */
{0},{0},{0x00,0x01},	/* device id */
1,2,0,			/* string indices */
1			/* # of configurations */
1719};

1721const usb_device_qualifier_t ehci_odevd = {
USB_DEVICE_DESCRIPTOR_SIZE18,
UDESC_DEVICE_QUALIFIER0x06,	/* type */
{0x00, 0x02},		/* USB version */
UDCLASS_HUB0x09,		/* class */
UDSUBCLASS_HUB0x00,		/* subclass */
UDPROTO_FSHUB0x00,		/* protocol */
64,			/* max packet */
1,			/* # of configurations */
0
1731};

1733const usb_config_descriptor_t ehci_confd = {
USB_CONFIG_DESCRIPTOR_SIZE9,
UDESC_CONFIG0x02,
{USB_CONFIG_DESCRIPTOR_SIZE9 +
USB_INTERFACE_DESCRIPTOR_SIZE9 +
USB_ENDPOINT_DESCRIPTOR_SIZE7},
1,
1,
0,
UC_BUS_POWERED0x80 | UC_SELF_POWERED0x40,
0			/* max power */
1744};

1746const usb_interface_descriptor_t ehci_ifcd = {
USB_INTERFACE_DESCRIPTOR_SIZE9,
UDESC_INTERFACE0x04,
0,
0,
1,
UICLASS_HUB0x09,
UISUBCLASS_HUB0,
UIPROTO_HSHUBSTT0,
0
1756};

1758const usb_endpoint_descriptor_t ehci_endpd = {
USB_ENDPOINT_DESCRIPTOR_SIZE7,
UDESC_ENDPOINT0x05,
UE_DIR_IN0x80 | EHCI_INTR_ENDPT1,
UE_INTERRUPT0x03,
{8, 0},			/* max packet */
12
1765};

1767const usb_hub_descriptor_t ehci_hubd = {
USB_HUB_DESCRIPTOR_SIZE8,
UDESC_HUB0x29,
0,
{0,0},
0,
0,
{0},
1775};

1777/*
* Simulate a hardware hub by handling all the necessary requests.
*/
1780usbd_status
1781ehci_root_ctrl_transfer(struct usbd_xfer *xfer)
1782{
usbd_status err;

/* Insert last in queue. */
err = usb_insert_transfer(xfer);
if (err)
return (err);

/* Pipe isn't running, start first */
return (ehci_root_ctrl_start(SIMPLEQ_FIRST(&xfer->pipe->queue)((&xfer->pipe->queue)->sqh_first)));
1792}

1794usbd_status
1795ehci_root_ctrl_start(struct usbd_xfer *xfer)
1796{
struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
usb_device_request_t *req;
void *buf = NULL((void *)0);
1
'buf' initialized to a null pointer value→
int port, i;
int s, len, value, index, l, totlen = 0;
usb_port_status_t ps;
usb_device_descriptor_t devd;
usb_hub_descriptor_t hubd;
usbd_status err;
u_int32_t v;

if (sc->sc_bus.dying)
2
←
Assuming field 'dying' is 0→
3
←
Taking false branch→
return (USBD_IOERROR);

1811#ifdef DIAGNOSTIC1
if (!(xfer->rqflags & URQ_REQUEST0x01))
4
←
Assuming the condition is false→
5
←
Taking false branch→
/* XXX panic */
return (USBD_INVAL);
1815#endif
req = &xfer->request;

DPRINTFN(4,("ehci_root_ctrl_start: type=0x%02x request=%02x\n",
    req->bmRequestType, req->bRequest));

len = UGETW(req->wLength)(*(u_int16_t *)(req->wLength));
value = UGETW(req->wValue)(*(u_int16_t *)(req->wValue));
index = UGETW(req->wIndex)(*(u_int16_t *)(req->wIndex));

if (len != 0)
6
←
Assuming 'len' is equal to 0→
7
←
Taking false branch→
buf = KERNADDR(&xfer->dmabuf, 0)((void *)((char *)((&xfer->dmabuf)->block->kaddr
 + (&xfer->dmabuf)->offs) + (0)));

1828#define C(x,y)((x) | ((y) << 8)) ((x) | ((y) << 8))
switch(C(req->bRequest, req->bmRequestType)((req->bRequest) | ((req->bmRequestType) << 8))) {
8
←
Control jumps to 'case 32774:'  at line 1844→
case C(UR_CLEAR_FEATURE, UT_WRITE_DEVICE)((0x01) | (((0x00 | 0x00 | 0x00)) << 8)):
case C(UR_CLEAR_FEATURE, UT_WRITE_INTERFACE)((0x01) | (((0x00 | 0x00 | 0x01)) << 8)):
case C(UR_CLEAR_FEATURE, UT_WRITE_ENDPOINT)((0x01) | (((0x00 | 0x00 | 0x02)) << 8)):
/*
 * DEVICE_REMOTE_WAKEUP and ENDPOINT_HALT are no-ops
 * for the integrated root hub.
 */
break;
case C(UR_GET_CONFIG, UT_READ_DEVICE)((0x08) | (((0x80 | 0x00 | 0x00)) << 8)):
if (len > 0) {
	*(u_int8_t *)buf = sc->sc_conf;
	totlen = 1;
}
break;
case C(UR_GET_DESCRIPTOR, UT_READ_DEVICE)((0x06) | (((0x80 | 0x00 | 0x00)) << 8)):
DPRINTFN(8,("ehci_root_ctrl_start: wValue=0x%04x\n", value));
switch(value >> 8) {
9
←
Control jumps to 'case 2:'  at line 1870→
case UDESC_DEVICE0x01:
	if ((value & 0xff) != 0) {
		err = USBD_IOERROR;
		goto ret;
	}
	devd = ehci_devd;
	USETW(devd.idVendor, sc->sc_id_vendor)(*(u_int16_t *)(devd.idVendor) = (sc->sc_id_vendor));
	totlen = l = min(len, USB_DEVICE_DESCRIPTOR_SIZE18);
	memcpy(buf, &devd, l)__builtin_memcpy((buf), (&devd), (l));
	break;
case UDESC_DEVICE_QUALIFIER0x06:
	if ((value & 0xff) != 0) {
		err = USBD_IOERROR;
		goto ret;
	}
	totlen = l = min(len, USB_DEVICE_DESCRIPTOR_SIZE18);
	memcpy(buf, &ehci_odevd, l)__builtin_memcpy((buf), (&ehci_odevd), (l));
	break;
/*
 * We can't really operate at another speed, but the spec says
 * we need this descriptor.
 */
case UDESC_OTHER_SPEED_CONFIGURATION0x07:
case UDESC_CONFIG0x02:
	if ((value & 0xff) != 0) {
10
←
Assuming the condition is false→
11
←
Taking false branch→
		err = USBD_IOERROR;
		goto ret;
	}
	totlen = l = min(len, USB_CONFIG_DESCRIPTOR_SIZE9);
	memcpy(buf, &ehci_confd, l)__builtin_memcpy((buf), (&ehci_confd), (l));
	((usb_config_descriptor_t *)buf)->bDescriptorType =
12
←
Access to field 'bDescriptorType' results in a dereference of a null pointer (loaded from variable 'buf')
	    value >> 8;
	buf = (char *)buf + l;
	len -= l;
	l = min(len, USB_INTERFACE_DESCRIPTOR_SIZE9);
	totlen += l;
	memcpy(buf, &ehci_ifcd, l)__builtin_memcpy((buf), (&ehci_ifcd), (l));
	buf = (char *)buf + l;
	len -= l;
	l = min(len, USB_ENDPOINT_DESCRIPTOR_SIZE7);
	totlen += l;
	memcpy(buf, &ehci_endpd, l)__builtin_memcpy((buf), (&ehci_endpd), (l));
	break;
case UDESC_STRING0x03:
	if (len == 0)
		break;
	*(u_int8_t *)buf = 0;
	totlen = 1;
	switch (value & 0xff) {
	case 0: /* Language table */
		totlen = usbd_str(buf, len, "\001");
		break;
	case 1: /* Vendor */
		totlen = usbd_str(buf, len, sc->sc_vendor);
		break;
	case 2: /* Product */
		totlen = usbd_str(buf, len, "EHCI root hub");
		break;
	}
	break;
default:
	err = USBD_IOERROR;
	goto ret;
}
break;
case C(UR_GET_INTERFACE, UT_READ_INTERFACE)((0x0a) | (((0x80 | 0x00 | 0x01)) << 8)):
if (len > 0) {
	*(u_int8_t *)buf = 0;
	totlen = 1;
}
break;
case C(UR_GET_STATUS, UT_READ_DEVICE)((0x00) | (((0x80 | 0x00 | 0x00)) << 8)):
if (len > 1) {
	USETW(((usb_status_t *)buf)->wStatus,UDS_SELF_POWERED)(*(u_int16_t *)(((usb_status_t *)buf)->wStatus) = (0x0001)
);
	totlen = 2;
}
break;
case C(UR_GET_STATUS, UT_READ_INTERFACE)((0x00) | (((0x80 | 0x00 | 0x01)) << 8)):
case C(UR_GET_STATUS, UT_READ_ENDPOINT)((0x00) | (((0x80 | 0x00 | 0x02)) << 8)):
if (len > 1) {
	USETW(((usb_status_t *)buf)->wStatus, 0)(*(u_int16_t *)(((usb_status_t *)buf)->wStatus) = (0));
	totlen = 2;
}
break;
case C(UR_SET_ADDRESS, UT_WRITE_DEVICE)((0x05) | (((0x00 | 0x00 | 0x00)) << 8)):
if (value >= USB_MAX_DEVICES128) {
	err = USBD_IOERROR;
	goto ret;
}
break;
case C(UR_SET_CONFIG, UT_WRITE_DEVICE)((0x09) | (((0x00 | 0x00 | 0x00)) << 8)):
if (value != 0 && value != 1) {
	err = USBD_IOERROR;
	goto ret;
}
sc->sc_conf = value;
break;
case C(UR_SET_DESCRIPTOR, UT_WRITE_DEVICE)((0x07) | (((0x00 | 0x00 | 0x00)) << 8)):
break;
case C(UR_SET_FEATURE, UT_WRITE_DEVICE)((0x03) | (((0x00 | 0x00 | 0x00)) << 8)):
case C(UR_SET_FEATURE, UT_WRITE_INTERFACE)((0x03) | (((0x00 | 0x00 | 0x01)) << 8)):
case C(UR_SET_FEATURE, UT_WRITE_ENDPOINT)((0x03) | (((0x00 | 0x00 | 0x02)) << 8)):
err = USBD_IOERROR;
goto ret;
case C(UR_SET_INTERFACE, UT_WRITE_INTERFACE)((0x0b) | (((0x00 | 0x00 | 0x01)) << 8)):
break;
case C(UR_SYNCH_FRAME, UT_WRITE_ENDPOINT)((0x0c) | (((0x00 | 0x00 | 0x02)) << 8)):
break;
/* Hub requests */
case C(UR_CLEAR_FEATURE, UT_WRITE_CLASS_DEVICE)((0x01) | (((0x00 | 0x20 | 0x00)) << 8)):
break;
case C(UR_CLEAR_FEATURE, UT_WRITE_CLASS_OTHER)((0x01) | (((0x00 | 0x20 | 0x03)) << 8)):
DPRINTFN(8, ("ehci_root_ctrl_start: UR_CLEAR_PORT_FEATURE "
    "port=%d feature=%d\n", index, value));
if (index < 1 || index > sc->sc_noport) {
	err = USBD_IOERROR;
	goto ret;
}
port = EHCI_PORTSC(index)(0x40+4*(index));
v = EOREAD4(sc, port)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(port)))) &~ EHCI_PS_CLEAR(0x00000020|0x00000008|0x00000002);
switch(value) {
case UHF_PORT_ENABLE1:
	EOWRITE4(sc, port, v &~ EHCI_PS_PE)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(port)), ((v &~ 0x00000004))));
	break;
case UHF_PORT_SUSPEND2:
	EOWRITE4(sc, port, v &~ EHCI_PS_SUSP)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(port)), ((v &~ 0x00000080))));
	break;
case UHF_PORT_POWER8:
	EOWRITE4(sc, port, v &~ EHCI_PS_PP)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(port)), ((v &~ 0x00001000))));
	break;
case UHF_PORT_TEST21:
	DPRINTFN(2,("ehci_root_ctrl_start: "
	    "clear port test %d\n", index));
	break;
case UHF_PORT_INDICATOR22:
	DPRINTFN(2,("ehci_root_ctrl_start: "
	    "clear port index %d\n", index));
	EOWRITE4(sc, port, v &~ EHCI_PS_PIC)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(port)), ((v &~ 0x0000c000))));
	break;
case UHF_C_PORT_CONNECTION16:
	EOWRITE4(sc, port, v | EHCI_PS_CSC)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(port)), ((v | 0x00000002))));
	break;
case UHF_C_PORT_ENABLE17:
	EOWRITE4(sc, port, v | EHCI_PS_PEC)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(port)), ((v | 0x00000008))));
	break;
case UHF_C_PORT_SUSPEND18:
	/* how? */
	break;
case UHF_C_PORT_OVER_CURRENT19:
	EOWRITE4(sc, port, v | EHCI_PS_OCC)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(port)), ((v | 0x00000020))));
	break;
case UHF_C_PORT_RESET20:
	sc->sc_isreset = 0;
	break;
default:
	err = USBD_IOERROR;
	goto ret;
}
break;
case C(UR_GET_DESCRIPTOR, UT_READ_CLASS_DEVICE)((0x06) | (((0x80 | 0x20 | 0x00)) << 8)):
if ((value & 0xff) != 0) {
	err = USBD_IOERROR;
	goto ret;
}
hubd = ehci_hubd;
hubd.bNbrPorts = sc->sc_noport;
v = EREAD4(sc, EHCI_HCSPARAMS)(((sc)->iot)->read_4(((sc)->ioh), ((0x04))));
USETW(hubd.wHubCharacteristics,(*(u_int16_t *)(hubd.wHubCharacteristics) = ((((v) & 0x10
) ? 0x0001 : 0x0002) | (((v) & 0x10000) ? 0x0080 : 0)))
    (EHCI_HCS_PPC(v) ? UHD_PWR_INDIVIDUAL : UHD_PWR_NO_SWITCH) |(*(u_int16_t *)(hubd.wHubCharacteristics) = ((((v) & 0x10
) ? 0x0001 : 0x0002) | (((v) & 0x10000) ? 0x0080 : 0)))
    (EHCI_HCS_P_INDICATOR(v) ? UHD_PORT_IND : 0))(*(u_int16_t *)(hubd.wHubCharacteristics) = ((((v) & 0x10
) ? 0x0001 : 0x0002) | (((v) & 0x10000) ? 0x0080 : 0)));
hubd.bPwrOn2PwrGood = 200; /* XXX can't find out? */
for (i = 0, l = sc->sc_noport; l > 0; i++, l -= 8, v >>= 8)
	hubd.DeviceRemovable[i++] = 0; /* XXX can't find out? */
hubd.bDescLength = USB_HUB_DESCRIPTOR_SIZE8 + i;
l = min(len, hubd.bDescLength);
totlen = l;
memcpy(buf, &hubd, l)__builtin_memcpy((buf), (&hubd), (l));
break;
case C(UR_GET_STATUS, UT_READ_CLASS_DEVICE)((0x00) | (((0x80 | 0x20 | 0x00)) << 8)):
if (len != 4) {
	err = USBD_IOERROR;
	goto ret;
}
memset(buf, 0, len)__builtin_memset((buf), (0), (len)); /* ? XXX */
totlen = len;
break;
case C(UR_GET_STATUS, UT_READ_CLASS_OTHER)((0x00) | (((0x80 | 0x20 | 0x03)) << 8)):
DPRINTFN(8,("ehci_root_ctrl_start: get port status i=%d\n",
    index));
if (index < 1 || index > sc->sc_noport) {
	err = USBD_IOERROR;
	goto ret;
}
if (len != 4) {
	err = USBD_IOERROR;
	goto ret;
}
v = EOREAD4(sc, EHCI_PORTSC(index))(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
((0x40+4*(index))))));
DPRINTFN(8,("ehci_root_ctrl_start: port status=0x%04x\n", v));
i = UPS_HIGH_SPEED0x0400;
if (v & EHCI_PS_CS0x00000001)	i |= UPS_CURRENT_CONNECT_STATUS0x0001;
if (v & EHCI_PS_PE0x00000004)	i |= UPS_PORT_ENABLED0x0002;
if (v & EHCI_PS_SUSP0x00000080)	i |= UPS_SUSPEND0x0004;
if (v & EHCI_PS_OCA0x00000010)	i |= UPS_OVERCURRENT_INDICATOR0x0008;
if (v & EHCI_PS_PR0x00000100)	i |= UPS_RESET0x0010;
if (v & EHCI_PS_PP0x00001000)	i |= UPS_PORT_POWER0x0100;
USETW(ps.wPortStatus, i)(*(u_int16_t *)(ps.wPortStatus) = (i));
i = 0;
if (v & EHCI_PS_CSC0x00000002)	i |= UPS_C_CONNECT_STATUS0x0001;
if (v & EHCI_PS_PEC0x00000008)	i |= UPS_C_PORT_ENABLED0x0002;
if (v & EHCI_PS_OCC0x00000020)	i |= UPS_C_OVERCURRENT_INDICATOR0x0008;
if (sc->sc_isreset)	i |= UPS_C_PORT_RESET0x0010;
USETW(ps.wPortChange, i)(*(u_int16_t *)(ps.wPortChange) = (i));
l = min(len, sizeof(ps));
memcpy(buf, &ps, l)__builtin_memcpy((buf), (&ps), (l));
totlen = l;
break;
case C(UR_SET_DESCRIPTOR, UT_WRITE_CLASS_DEVICE)((0x07) | (((0x00 | 0x20 | 0x00)) << 8)):
err = USBD_IOERROR;
goto ret;
case C(UR_SET_FEATURE, UT_WRITE_CLASS_DEVICE)((0x03) | (((0x00 | 0x20 | 0x00)) << 8)):
break;
case C(UR_SET_FEATURE, UT_WRITE_CLASS_OTHER)((0x03) | (((0x00 | 0x20 | 0x03)) << 8)):
if (index < 1 || index > sc->sc_noport) {
	err = USBD_IOERROR;
	goto ret;
}
port = EHCI_PORTSC(index)(0x40+4*(index));
v = EOREAD4(sc, port)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(port)))) &~ EHCI_PS_CLEAR(0x00000020|0x00000008|0x00000002);
switch(value) {
case UHF_PORT_ENABLE1:
	EOWRITE4(sc, port, v | EHCI_PS_PE)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(port)), ((v | 0x00000004))));
	break;
case UHF_PORT_SUSPEND2:
	EOWRITE4(sc, port, v | EHCI_PS_SUSP)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(port)), ((v | 0x00000080))));
	break;
case UHF_PORT_DISOWN_TO_1_130:
	/* enter to Port Reset State */
	v &= ~EHCI_PS_PE0x00000004;
	EOWRITE4(sc, port, v | EHCI_PS_PR)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(port)), ((v | 0x00000100))));
	ehci_disown(sc, index, 0);
	break;
case UHF_PORT_RESET4:
	DPRINTFN(5,("ehci_root_ctrl_start: reset port %d\n",
	    index));
	if (EHCI_PS_IS_LOWSPEED(v)(((v) & 0x00000c00) == 0x00000400)) {
		/* Low speed device, give up ownership. */
		ehci_disown(sc, index, 1);
		break;
	}
	/* Start reset sequence. */
	v &= ~ (EHCI_PS_PE0x00000004 | EHCI_PS_PR0x00000100);
	EOWRITE4(sc, port, v | EHCI_PS_PR)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(port)), ((v | 0x00000100))));
	/* Wait for reset to complete. */
	usb_delay_ms(&sc->sc_bus, USB_PORT_ROOT_RESET_DELAY100);
	if (sc->sc_bus.dying) {
		err = USBD_IOERROR;
		goto ret;
	}
	/* Terminate reset sequence. */
	v = EOREAD4(sc, port)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(port))));
	EOWRITE4(sc, port, v & ~EHCI_PS_PR)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(port)), ((v & ~0x00000100))));
	/* Wait for HC to complete reset. */
	usb_delay_ms(&sc->sc_bus, EHCI_PORT_RESET_COMPLETE2);
	if (sc->sc_bus.dying) {
		err = USBD_IOERROR;
		goto ret;
	}
	v = EOREAD4(sc, port)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(port))));
	DPRINTF(("ehci after reset, status=0x%08x\n", v));
	if (v & EHCI_PS_PR0x00000100) {
		printf("%s: port reset timeout\n",
		    sc->sc_bus.bdev.dv_xname);
		err = USBD_IOERROR;
		goto ret;
	}
	if (!(v & EHCI_PS_PE0x00000004)) {
		/* Not a high speed device, give up ownership.*/
		ehci_disown(sc, index, 0);
		break;
	}
	sc->sc_isreset = 1;
	DPRINTF(("ehci port %d reset, status = 0x%08x\n",
	    index, v));
	break;
case UHF_PORT_POWER8:
	DPRINTFN(2,("ehci_root_ctrl_start: "
	    "set port power %d\n", index));
	EOWRITE4(sc, port, v | EHCI_PS_PP)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(port)), ((v | 0x00001000))));
	break;
case UHF_PORT_TEST21:
	DPRINTFN(2,("ehci_root_ctrl_start: "
	    "set port test %d\n", index));
	break;
case UHF_PORT_INDICATOR22:
	DPRINTFN(2,("ehci_root_ctrl_start: "
	    "set port ind %d\n", index));
	EOWRITE4(sc, port, v | EHCI_PS_PIC)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(port)), ((v | 0x0000c000))));
	break;
default:
	err = USBD_IOERROR;
	goto ret;
}
break;
case C(UR_CLEAR_TT_BUFFER, UT_WRITE_CLASS_OTHER)((0x08) | (((0x00 | 0x20 | 0x03)) << 8)):
case C(UR_RESET_TT, UT_WRITE_CLASS_OTHER)((0x09) | (((0x00 | 0x20 | 0x03)) << 8)):
case C(UR_GET_TT_STATE, UT_READ_CLASS_OTHER)((0x0a) | (((0x80 | 0x20 | 0x03)) << 8)):
case C(UR_STOP_TT, UT_WRITE_CLASS_OTHER)((0x0b) | (((0x00 | 0x20 | 0x03)) << 8)):
break;
default:
err = USBD_IOERROR;
goto ret;
}
xfer->actlen = totlen;
err = USBD_NORMAL_COMPLETION;
ret:
xfer->status = err;
s = splusb()splraise(0x2);
usb_transfer_complete(xfer);
splx(s)spllower(s);
return (err);
2168}

2170void
2171ehci_disown(struct ehci_softc *sc, int index, int lowspeed)
2172{
int port;
u_int32_t v;

port = EHCI_PORTSC(index)(0x40+4*(index));
v = EOREAD4(sc, port)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(port)))) &~ EHCI_PS_CLEAR(0x00000020|0x00000008|0x00000002);
EOWRITE4(sc, port, v | EHCI_PS_PO)(((sc)->iot)->write_4(((sc)->ioh), ((sc)->sc_offs
+(port)), ((v | 0x00002000))));
2179}

2181/* Abort a root control request. */
2182void
2183ehci_root_ctrl_abort(struct usbd_xfer *xfer)
2184{
/* Nothing to do, all transfers are synchronous. */
2186}

2188/* Close the root pipe. */
2189void
2190ehci_root_ctrl_close(struct usbd_pipe *pipe)
2191{
/* Nothing to do. */
2193}

2195void
2196ehci_root_intr_done(struct usbd_xfer *xfer)
2197{
2198}

2200usbd_status
2201ehci_root_intr_transfer(struct usbd_xfer *xfer)
2202{
usbd_status err;

/* Insert last in queue. */
err = usb_insert_transfer(xfer);
if (err)
return (err);

/* Pipe isn't running, start first */
return (ehci_root_intr_start(SIMPLEQ_FIRST(&xfer->pipe->queue)((&xfer->pipe->queue)->sqh_first)));
2212}

2214usbd_status
2215ehci_root_intr_start(struct usbd_xfer *xfer)
2216{
struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;

if (sc->sc_bus.dying)
return (USBD_IOERROR);

sc->sc_intrxfer = xfer;

return (USBD_IN_PROGRESS);
2225}

2227void
2228ehci_root_intr_abort(struct usbd_xfer *xfer)
2229{
struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
int s;

sc->sc_intrxfer = NULL((void *)0);

xfer->status = USBD_CANCELLED;
s = splusb()splraise(0x2);
usb_transfer_complete(xfer);
splx(s)spllower(s);
2239}

2241void
2242ehci_root_intr_close(struct usbd_pipe *pipe)
2243{
2244}

2246void
2247ehci_root_ctrl_done(struct usbd_xfer *xfer)
2248{
2249}

2251struct ehci_soft_qh *
2252ehci_alloc_sqh(struct ehci_softc *sc)
2253{
struct ehci_soft_qh *sqh = NULL((void *)0);
usbd_status err;
int i, offs;
struct usb_dma dma;
int s;

s = splusb()splraise(0x2);
if (sc->sc_freeqhs == NULL((void *)0)) {
DPRINTFN(2, ("ehci_alloc_sqh: allocating chunk\n"));
err = usb_allocmem(&sc->sc_bus, EHCI_SQH_SIZE((sizeof (struct ehci_soft_qh) + 32 - 1) / 32 * 32) * EHCI_SQH_CHUNK(0x1000 / ((sizeof (struct ehci_soft_qh) + 32 - 1) / 32 * 32)
),
    EHCI_PAGE_SIZE0x1000, USB_DMA_COHERENT(1 << 0), &dma);
if (err)
	goto out;
for (i = 0; i < EHCI_SQH_CHUNK(0x1000 / ((sizeof (struct ehci_soft_qh) + 32 - 1) / 32 * 32)
); i++) {
	offs = i * EHCI_SQH_SIZE((sizeof (struct ehci_soft_qh) + 32 - 1) / 32 * 32);
	sqh = KERNADDR(&dma, offs)((void *)((char *)((&dma)->block->kaddr + (&dma
)->offs) + (offs)));
	sqh->physaddr = DMAADDR(&dma, offs)((&dma)->block->map->dm_segs[0].ds_addr + (&
dma)->offs + (offs));
	sqh->dma = dma;
	sqh->offs = offs;
	sqh->next = sc->sc_freeqhs;
	sc->sc_freeqhs = sqh;
}
}
sqh = sc->sc_freeqhs;
sc->sc_freeqhs = sqh->next;
memset(&sqh->qh, 0, sizeof(struct ehci_qh))__builtin_memset((&sqh->qh), (0), (sizeof(struct ehci_qh
)));
sqh->next = NULL((void *)0);
sqh->prev = NULL((void *)0);

2283out:
splx(s)spllower(s);
return (sqh);
2286}

2288void
2289ehci_free_sqh(struct ehci_softc *sc, struct ehci_soft_qh *sqh)
2290{
int s;

s = splusb()splraise(0x2);
sqh->next = sc->sc_freeqhs;
sc->sc_freeqhs = sqh;
splx(s)spllower(s);
2297}

2299struct ehci_soft_qtd *
2300ehci_alloc_sqtd(struct ehci_softc *sc)
2301{
struct ehci_soft_qtd *sqtd = NULL((void *)0);
usbd_status err;
int i, offs;
struct usb_dma dma;
int s;

s = splusb()splraise(0x2);
if (sc->sc_freeqtds == NULL((void *)0)) {
DPRINTFN(2, ("ehci_alloc_sqtd: allocating chunk\n"));
err = usb_allocmem(&sc->sc_bus, EHCI_SQTD_SIZE((sizeof (struct ehci_soft_qtd) + 32 - 1) / 32 * 32)*EHCI_SQTD_CHUNK(0x1000 / ((sizeof (struct ehci_soft_qtd) + 32 - 1) / 32 * 32
)),
    EHCI_PAGE_SIZE0x1000, USB_DMA_COHERENT(1 << 0), &dma);
if (err)
	goto out;
for(i = 0; i < EHCI_SQTD_CHUNK(0x1000 / ((sizeof (struct ehci_soft_qtd) + 32 - 1) / 32 * 32
)); i++) {
	offs = i * EHCI_SQTD_SIZE((sizeof (struct ehci_soft_qtd) + 32 - 1) / 32 * 32);
	sqtd = KERNADDR(&dma, offs)((void *)((char *)((&dma)->block->kaddr + (&dma
)->offs) + (offs)));
	sqtd->physaddr = DMAADDR(&dma, offs)((&dma)->block->map->dm_segs[0].ds_addr + (&
dma)->offs + (offs));
	sqtd->dma = dma;
	sqtd->offs = offs;
	sqtd->nextqtd = sc->sc_freeqtds;
	sc->sc_freeqtds = sqtd;
}
}

sqtd = sc->sc_freeqtds;
sc->sc_freeqtds = sqtd->nextqtd;
memset(&sqtd->qtd, 0, sizeof(struct ehci_qtd))__builtin_memset((&sqtd->qtd), (0), (sizeof(struct ehci_qtd
)));
sqtd->nextqtd = NULL((void *)0);

2331out:
splx(s)spllower(s);
return (sqtd);
2334}

2336void
2337ehci_free_sqtd(struct ehci_softc *sc, struct ehci_soft_qtd *sqtd)
2338{
int s;

s = splusb()splraise(0x2);
sqtd->nextqtd = sc->sc_freeqtds;
sc->sc_freeqtds = sqtd;
splx(s)spllower(s);
2345}

2347usbd_status
2348ehci_alloc_sqtd_chain(struct ehci_softc *sc, u_int alen, struct usbd_xfer *xfer,
  struct ehci_soft_qtd **sp, struct ehci_soft_qtd **ep)
2350{
struct ehci_soft_qtd *next, *cur;
ehci_physaddr_t dataphys, dataphyspage, dataphyslastpage, nextphys;
u_int32_t qtdstatus;
u_int len, curlen;
int mps, i, iscontrol, forceshort;
int rd = usbd_xfer_isread(xfer);
struct usb_dma *dma = &xfer->dmabuf;

DPRINTFN(alen<4*4096,("ehci_alloc_sqtd_chain: start len=%d\n", alen));

len = alen;
iscontrol = UE_GET_XFERTYPE(xfer->pipe->endpoint->edesc->bmAttributes)((xfer->pipe->endpoint->edesc->bmAttributes) &
 0x03) ==
   UE_CONTROL0x00;

dataphys = DMAADDR(dma, 0)((dma)->block->map->dm_segs[0].ds_addr + (dma)->offs
 + (0));
dataphyslastpage = EHCI_PAGE(dataphys + len - 1)((dataphys + len - 1) &~ 0xfff);
qtdstatus = EHCI_QTD_ACTIVE0x80 |
   EHCI_QTD_SET_PID(rd ? EHCI_QTD_PID_IN : EHCI_QTD_PID_OUT)((rd ? 0x1 : 0x0) << 8) |
   EHCI_QTD_SET_CERR(3)((3) << 10); /* IOC and BYTES set below */
mps = UGETW(xfer->pipe->endpoint->edesc->wMaxPacketSize)(*(u_int16_t *)(xfer->pipe->endpoint->edesc->wMaxPacketSize
));
forceshort = ((xfer->flags & USBD_FORCE_SHORT_XFER0x08) || len == 0) &&
   len % mps == 0;
/*
* The control transfer data stage always starts with a toggle of 1.
* For other transfers we let the hardware track the toggle state.
*/
if (iscontrol)
qtdstatus |= EHCI_QTD_SET_TOGGLE(1)((1) << 31);

cur = ehci_alloc_sqtd(sc);
*sp = cur;
if (cur == NULL((void *)0))
goto nomem;

usb_syncmem(dma, 0, alen,
   rd ? BUS_DMASYNC_PREREAD0x01 : BUS_DMASYNC_PREWRITE0x04);
for (;;) {
dataphyspage = EHCI_PAGE(dataphys)((dataphys) &~ 0xfff);
/* The EHCI hardware can handle at most 5 pages. */
if (dataphyslastpage - dataphyspage <
    EHCI_QTD_NBUFFERS5 * EHCI_PAGE_SIZE0x1000) {
	/* we can handle it in this QTD */
	curlen = len;
} else {
	/* must use multiple TDs, fill as much as possible. */
	curlen = EHCI_QTD_NBUFFERS5 * EHCI_PAGE_SIZE0x1000 -
		 EHCI_PAGE_OFFSET(dataphys)((dataphys) & 0xfff);

	if (curlen > len) {
		DPRINTFN(1,("ehci_alloc_sqtd_chain: curlen=%u "
		    "len=%u offs=0x%x\n", curlen, len,
		    EHCI_PAGE_OFFSET(dataphys)));
		DPRINTFN(1,("lastpage=0x%x page=0x%x phys=0x%x\n",
		    dataphyslastpage, dataphyspage, dataphys));
		curlen = len;
	}

	/* the length must be a multiple of the max size */
	curlen -= curlen % mps;
	DPRINTFN(1,("ehci_alloc_sqtd_chain: multiple QTDs, "
	    "curlen=%u\n", curlen));
}

DPRINTFN(4,("ehci_alloc_sqtd_chain: dataphys=0x%08x "
    "dataphyslastpage=0x%08x len=%u curlen=%u\n",
    dataphys, dataphyslastpage, len, curlen));
len -= curlen;

/*
 * Allocate another transfer if there's more data left,
 * or if force last short transfer flag is set and we're
 * allocating a multiple of the max packet size.
 */
if (len != 0 || forceshort) {
	next = ehci_alloc_sqtd(sc);
	if (next == NULL((void *)0))
		goto nomem;
	nextphys = htole32(next->physaddr)((__uint32_t)(next->physaddr));
} else {
	next = NULL((void *)0);
	nextphys = htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));
}

for (i = 0; i * EHCI_PAGE_SIZE0x1000 <
    curlen + EHCI_PAGE_OFFSET(dataphys)((dataphys) & 0xfff); i++) {
	ehci_physaddr_t a = dataphys + i * EHCI_PAGE_SIZE0x1000;
	if (i != 0) /* use offset only in first buffer */
		a = EHCI_PAGE(a)((a) &~ 0xfff);
2439#ifdef DIAGNOSTIC1
	if (i >= EHCI_QTD_NBUFFERS5) {
		printf("ehci_alloc_sqtd_chain: i=%d\n", i);
		goto nomem;
	}
2444#endif
	cur->qtd.qtd_buffer[i] = htole32(a)((__uint32_t)(a));
	cur->qtd.qtd_buffer_hi[i] = 0;
}
cur->nextqtd = next;
cur->qtd.qtd_next = cur->qtd.qtd_altnext = nextphys;
cur->qtd.qtd_status = htole32(qtdstatus |((__uint32_t)(qtdstatus | ((curlen) << 16)))
    EHCI_QTD_SET_BYTES(curlen))((__uint32_t)(qtdstatus | ((curlen) << 16)));
cur->len = curlen;
DPRINTFN(10,("ehci_alloc_sqtd_chain: cbp=0x%08x end=0x%08x\n",
    dataphys, dataphys + curlen));
DPRINTFN(10,("ehci_alloc_sqtd_chain: curlen=%u\n", curlen));
if (iscontrol) {
	/*
	 * adjust the toggle based on the number of packets
	 * in this qtd
	 */
	if ((((curlen + mps - 1) / mps) & 1) || curlen == 0)
		qtdstatus ^= EHCI_QTD_TOGGLE_MASK0x80000000;
}
if (len == 0) {
	if (! forceshort)
		break;
	forceshort = 0;
}
usb_syncmem(&cur->dma, cur->offs, sizeof(cur->qtd),
    BUS_DMASYNC_PREWRITE0x04 | BUS_DMASYNC_PREREAD0x01);
DPRINTFN(10,("ehci_alloc_sqtd_chain: extend chain\n"));
dataphys += curlen;
cur = next;
}
cur->qtd.qtd_status |= htole32(EHCI_QTD_IOC)((__uint32_t)(0x00008000));
usb_syncmem(&cur->dma, cur->offs, sizeof(cur->qtd),
   BUS_DMASYNC_PREWRITE0x04 | BUS_DMASYNC_PREREAD0x01);
*ep = cur;

DPRINTFN(10,("ehci_alloc_sqtd_chain: return sqtd=%p sqtdend=%p\n",
   *sp, *ep));

return (USBD_NORMAL_COMPLETION);

nomem:
/* XXX free chain */
DPRINTFN(-1,("ehci_alloc_sqtd_chain: no memory\n"));
return (USBD_NOMEM);
2489}

2491void
2492ehci_free_sqtd_chain(struct ehci_softc *sc, struct ehci_xfer *ex)
2493{
struct ehci_pipe *epipe = (struct ehci_pipe *)ex->xfer.pipe;
struct ehci_soft_qtd *sqtd, *next;

DPRINTFN(10,("ehci_free_sqtd_chain: sqtd=%p\n", ex->sqtdstart));

for (sqtd = ex->sqtdstart_TD.sqtd.start; sqtd != NULL((void *)0); sqtd = next) {
next = sqtd->nextqtd;
ehci_free_sqtd(sc, sqtd);
}
ex->sqtdstart_TD.sqtd.start = ex->sqtdend_TD.sqtd.end = NULL((void *)0);
epipe->sqh->sqtd = NULL((void *)0);
2505}

2507struct ehci_soft_itd *
2508ehci_alloc_itd(struct ehci_softc *sc)
2509{
struct ehci_soft_itd *itd, *freeitd;
usbd_status err;
int i, s, offs, frindex, previndex;
struct usb_dma dma;

s = splusb()splraise(0x2);

/* Find an itd that wasn't freed this frame or last frame. This can
* discard itds that were freed before frindex wrapped around
* XXX - can this lead to thrashing? Could fix by enabling wrap-around
*       interrupt and fiddling with list when that happens */
frindex = (EOREAD4(sc, EHCI_FRINDEX)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x0c)))) + 1) >> 3;
previndex = (frindex != 0) ? frindex - 1 : sc->sc_flsize;

freeitd = NULL((void *)0);
LIST_FOREACH(itd, &sc->sc_freeitds, u.free_list)for((itd) = ((&sc->sc_freeitds)->lh_first); (itd)!=
 ((void *)0); (itd) = ((itd)->u.free_list.le_next)) {
if (itd->slot != frindex && itd->slot != previndex) {
	freeitd = itd;
	break;
}
}

if (freeitd == NULL((void *)0)) {
err = usb_allocmem(&sc->sc_bus, EHCI_ITD_SIZE((sizeof(struct ehci_soft_itd) + 32 - 1) / 32 * 32) * EHCI_ITD_CHUNK(0x1000 / ((sizeof(struct ehci_soft_itd) + 32 - 1) / 32 * 32)
),
    EHCI_PAGE_SIZE0x1000, USB_DMA_COHERENT(1 << 0), &dma);
if (err) {
	splx(s)spllower(s);
	return (NULL((void *)0));
}

for (i = 0; i < EHCI_ITD_CHUNK(0x1000 / ((sizeof(struct ehci_soft_itd) + 32 - 1) / 32 * 32)
); i++) {
	offs = i * EHCI_ITD_SIZE((sizeof(struct ehci_soft_itd) + 32 - 1) / 32 * 32);
	itd = KERNADDR(&dma, offs)((void *)((char *)((&dma)->block->kaddr + (&dma
)->offs) + (offs)));
	itd->physaddr = DMAADDR(&dma, offs)((&dma)->block->map->dm_segs[0].ds_addr + (&
dma)->offs + (offs));
	itd->dma = dma;
	itd->offs = offs;
	LIST_INSERT_HEAD(&sc->sc_freeitds, itd, u.free_list)do { if (((itd)->u.free_list.le_next = (&sc->sc_freeitds
)->lh_first) != ((void *)0)) (&sc->sc_freeitds)->
lh_first->u.free_list.le_prev = &(itd)->u.free_list
.le_next; (&sc->sc_freeitds)->lh_first = (itd); (itd
)->u.free_list.le_prev = &(&sc->sc_freeitds)->
lh_first; } while (0);
}
freeitd = LIST_FIRST(&sc->sc_freeitds)((&sc->sc_freeitds)->lh_first);
}

itd = freeitd;
LIST_REMOVE(itd, u.free_list)do { if ((itd)->u.free_list.le_next != ((void *)0)) (itd)->
u.free_list.le_next->u.free_list.le_prev = (itd)->u.free_list
.le_prev; *(itd)->u.free_list.le_prev = (itd)->u.free_list
.le_next; ((itd)->u.free_list.le_prev) = ((void *)-1); ((itd
)->u.free_list.le_next) = ((void *)-1); } while (0);
memset(&itd->itd, 0, sizeof(struct ehci_itd))__builtin_memset((&itd->itd), (0), (sizeof(struct ehci_itd
)));
usb_syncmem(&itd->dma, itd->offs + offsetof(struct ehci_itd, itd_next)__builtin_offsetof(struct ehci_itd, itd_next),
   sizeof(itd->itd.itd_next), BUS_DMASYNC_PREWRITE0x04 |
   BUS_DMASYNC_PREREAD0x01);

itd->u.frame_list.next = NULL((void *)0);
itd->u.frame_list.prev = NULL((void *)0);
itd->xfer_next = NULL((void *)0);
itd->slot = 0;
splx(s)spllower(s);

return (itd);
2565}

2567void
2568ehci_free_itd(struct ehci_softc *sc, struct ehci_soft_itd *itd)
2569{
int s;

s = splusb()splraise(0x2);
LIST_INSERT_HEAD(&sc->sc_freeitds, itd, u.free_list)do { if (((itd)->u.free_list.le_next = (&sc->sc_freeitds
)->lh_first) != ((void *)0)) (&sc->sc_freeitds)->
lh_first->u.free_list.le_prev = &(itd)->u.free_list
.le_next; (&sc->sc_freeitds)->lh_first = (itd); (itd
)->u.free_list.le_prev = &(&sc->sc_freeitds)->
lh_first; } while (0);
splx(s)spllower(s);
2575}

2577/*
* Close a regular pipe.
* Assumes that there are no pending transactions.
*/
2581void
2582ehci_close_pipe(struct usbd_pipe *pipe)
2583{
struct ehci_pipe *epipe = (struct ehci_pipe *)pipe;
struct ehci_softc *sc = (struct ehci_softc *)pipe->device->bus;
struct ehci_soft_qh *sqh = epipe->sqh;
int s;

s = splusb()splraise(0x2);
ehci_rem_qh(sc, sqh);
splx(s)spllower(s);
pipe->endpoint->savedtoggle =
   EHCI_QTD_GET_TOGGLE(letoh32(sqh->qh.qh_qtd.qtd_status))(((((__uint32_t)(sqh->qh.qh_qtd.qtd_status))) >> 31)
 & 0x1);
ehci_free_sqh(sc, epipe->sqh);
2595}

2597/*
* Abort a device request.
* If this routine is called at splusb() it guarantees that the request
* will be removed from the hardware scheduling and that the callback
* for it will be called with USBD_CANCELLED status.
* It's impossible to guarantee that the requested transfer will not
* have happened since the hardware runs concurrently.
* If the transaction has already happened we rely on the ordinary
* interrupt processing to process it.
*/
2607void
2608ehci_abort_xfer(struct usbd_xfer *xfer, usbd_status status)
2609{
struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
struct ehci_xfer *ex = (struct ehci_xfer*)xfer;
struct ehci_soft_qh *sqh = epipe->sqh;
struct ehci_soft_qtd *sqtd;
int s;

if (sc->sc_bus.dying || xfer->status == USBD_NOT_STARTED) {
s = splusb()splraise(0x2);
if (xfer->status != USBD_NOT_STARTED)
	TAILQ_REMOVE(&sc->sc_intrhead, ex, inext)do { if (((ex)->inext.tqe_next) != ((void *)0)) (ex)->inext
.tqe_next->inext.tqe_prev = (ex)->inext.tqe_prev; else (
&sc->sc_intrhead)->tqh_last = (ex)->inext.tqe_prev
; *(ex)->inext.tqe_prev = (ex)->inext.tqe_next; ((ex)->
inext.tqe_prev) = ((void *)-1); ((ex)->inext.tqe_next) = (
(void *)-1); } while (0);
xfer->status = status;	/* make software ignore it */
timeout_del(&xfer->timeout_handle);
usb_rem_task(xfer->device, &xfer->abort_task);
2624#ifdef DIAGNOSTIC1
ex->isdone = 1;
2626#endif
usb_transfer_complete(xfer);
splx(s)spllower(s);
return;
}

if (xfer->device->bus->intr_context)
panic("ehci_abort_xfer: not in process context");

/*
* If an abort is already in progress then just wait for it to
* complete and return.
*/
if (ex->ehci_xfer_flags & EHCI_XFER_ABORTING0x0001) {
DPRINTFN(2, ("ehci_abort_xfer: already aborting\n"));
/* No need to wait if we're aborting from a timeout. */
if (status == USBD_TIMEOUT)
	return;
/* Override the status which might be USBD_TIMEOUT. */
xfer->status = status;
DPRINTFN(2, ("ehci_abort_xfer: waiting for abort to finish\n"));
ex->ehci_xfer_flags |= EHCI_XFER_ABORTWAIT0x0002;
while (ex->ehci_xfer_flags & EHCI_XFER_ABORTING0x0001)
	tsleep_nsec(&ex->ehci_xfer_flags, PZERO22, "ehciaw", INFSLP0xffffffffffffffffULL);
return;
}

/*
* Step 1: Make interrupt routine and timeouts ignore xfer.
*/
s = splusb()splraise(0x2);
ex->ehci_xfer_flags |= EHCI_XFER_ABORTING0x0001;
xfer->status = status;	/* make software ignore it */
TAILQ_REMOVE(&sc->sc_intrhead, ex, inext)do { if (((ex)->inext.tqe_next) != ((void *)0)) (ex)->inext
.tqe_next->inext.tqe_prev = (ex)->inext.tqe_prev; else (
&sc->sc_intrhead)->tqh_last = (ex)->inext.tqe_prev
; *(ex)->inext.tqe_prev = (ex)->inext.tqe_next; ((ex)->
inext.tqe_prev) = ((void *)-1); ((ex)->inext.tqe_next) = (
(void *)-1); } while (0);
timeout_del(&xfer->timeout_handle);
usb_rem_task(xfer->device, &xfer->abort_task);
splx(s)spllower(s);

/*
* Step 2: Deactivate all of the qTDs that we will be removing,
* otherwise the queue head may go active again.
*/
usb_syncmem(&sqh->dma,
   sqh->offs + offsetof(struct ehci_qh, qh_qtd.qtd_status)__builtin_offsetof(struct ehci_qh, qh_qtd.qtd_status),
   sizeof(sqh->qh.qh_qtd.qtd_status),
   BUS_DMASYNC_POSTWRITE0x08 | BUS_DMASYNC_POSTREAD0x02);
sqh->qh.qh_qtd.qtd_status = htole32(EHCI_QTD_HALTED)((__uint32_t)(0x40));
usb_syncmem(&sqh->dma,
   sqh->offs + offsetof(struct ehci_qh, qh_qtd.qtd_status)__builtin_offsetof(struct ehci_qh, qh_qtd.qtd_status),
   sizeof(sqh->qh.qh_qtd.qtd_status),
   BUS_DMASYNC_PREWRITE0x04 | BUS_DMASYNC_PREREAD0x01);

for (sqtd = ex->sqtdstart_TD.sqtd.start; sqtd != NULL((void *)0); sqtd = sqtd->nextqtd) {
usb_syncmem(&sqtd->dma,
    sqtd->offs + offsetof(struct ehci_qtd, qtd_status)__builtin_offsetof(struct ehci_qtd, qtd_status),
    sizeof(sqtd->qtd.qtd_status),
    BUS_DMASYNC_POSTWRITE0x08 | BUS_DMASYNC_POSTREAD0x02);
sqtd->qtd.qtd_status = htole32(EHCI_QTD_HALTED)((__uint32_t)(0x40));
usb_syncmem(&sqtd->dma,
    sqtd->offs + offsetof(struct ehci_qtd, qtd_status)__builtin_offsetof(struct ehci_qtd, qtd_status),
    sizeof(sqtd->qtd.qtd_status),
    BUS_DMASYNC_PREWRITE0x04 | BUS_DMASYNC_PREREAD0x01);
}
ehci_sync_hc(sc);

/*
* Step 3: Make sure the soft interrupt routine has run. This
* should remove any completed items off the queue.
* The hardware has no reference to completed items (TDs).
* It's safe to remove them at any time.
*/
s = splusb()splraise(0x2);
sc->sc_softwake = 1;
usb_schedsoftintr(&sc->sc_bus);
tsleep_nsec(&sc->sc_softwake, PZERO22, "ehciab", INFSLP0xffffffffffffffffULL);

2702#ifdef DIAGNOSTIC1
ex->isdone = 1;
2704#endif
/* Do the wakeup first to avoid touching the xfer after the callback. */
ex->ehci_xfer_flags &= ~EHCI_XFER_ABORTING0x0001;
if (ex->ehci_xfer_flags & EHCI_XFER_ABORTWAIT0x0002) {
ex->ehci_xfer_flags &= ~EHCI_XFER_ABORTWAIT0x0002;
wakeup(&ex->ehci_xfer_flags);
}
usb_transfer_complete(xfer);

splx(s)spllower(s);
2714}

2716void
2717ehci_abort_isoc_xfer(struct usbd_xfer *xfer, usbd_status status)
2718{
struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
ehci_isoc_trans_t trans_status;
struct ehci_soft_itd *itd;
int i;

splsoftassert(IPL_SOFTUSB)do { if (splassert_ctl > 0) { splassert_check(0x2, __func__
); } } while (0);

if (sc->sc_bus.dying || xfer->status == USBD_NOT_STARTED) {
if (xfer->status != USBD_NOT_STARTED)
	TAILQ_REMOVE(&sc->sc_intrhead, ex, inext)do { if (((ex)->inext.tqe_next) != ((void *)0)) (ex)->inext
.tqe_next->inext.tqe_prev = (ex)->inext.tqe_prev; else (
&sc->sc_intrhead)->tqh_last = (ex)->inext.tqe_prev
; *(ex)->inext.tqe_prev = (ex)->inext.tqe_next; ((ex)->
inext.tqe_prev) = ((void *)-1); ((ex)->inext.tqe_next) = (
(void *)-1); } while (0);
xfer->status = status;
timeout_del(&xfer->timeout_handle);
usb_rem_task(xfer->device, &xfer->abort_task);
usb_transfer_complete(xfer);
return;
}

/* Transfer is already done. */
if (xfer->status != USBD_IN_PROGRESS) {
DPRINTF(("%s: already done \n", __func__));
return;
}


2744#ifdef DIAGNOSTIC1
ex->isdone = 1;
2746#endif
xfer->status = status;
TAILQ_REMOVE(&sc->sc_intrhead, ex, inext)do { if (((ex)->inext.tqe_next) != ((void *)0)) (ex)->inext
.tqe_next->inext.tqe_prev = (ex)->inext.tqe_prev; else (
&sc->sc_intrhead)->tqh_last = (ex)->inext.tqe_prev
; *(ex)->inext.tqe_prev = (ex)->inext.tqe_next; ((ex)->
inext.tqe_prev) = ((void *)-1); ((ex)->inext.tqe_next) = (
(void *)-1); } while (0);
timeout_del(&xfer->timeout_handle);
usb_rem_task(xfer->device, &xfer->abort_task);

if (xfer->device->speed == USB_SPEED_HIGH3) {
for (itd = ex->itdstart_TD.itd.start; itd != NULL((void *)0); itd = itd->xfer_next) {
	usb_syncmem(&itd->dma,
	    itd->offs + offsetof(struct ehci_itd, itd_ctl)__builtin_offsetof(struct ehci_itd, itd_ctl),
	    sizeof(itd->itd.itd_ctl),
	    BUS_DMASYNC_POSTWRITE0x08 | BUS_DMASYNC_POSTREAD0x02);

	for (i = 0; i < 8; i++) {
		trans_status = le32toh(itd->itd.itd_ctl[i])((__uint32_t)(itd->itd.itd_ctl[i]));
		trans_status &= ~EHCI_ITD_ACTIVE0x80000000;
		itd->itd.itd_ctl[i] = htole32(trans_status)((__uint32_t)(trans_status));
	}

	usb_syncmem(&itd->dma,
	    itd->offs + offsetof(struct ehci_itd, itd_ctl)__builtin_offsetof(struct ehci_itd, itd_ctl),
	    sizeof(itd->itd.itd_ctl),
	    BUS_DMASYNC_PREWRITE0x04 | BUS_DMASYNC_PREREAD0x01);
}
} else {
for (itd = ex->itdstart_TD.itd.start; itd != NULL((void *)0); itd = itd->xfer_next) {
	usb_syncmem(&itd->dma,
	    itd->offs + offsetof(struct ehci_sitd, sitd_trans)__builtin_offsetof(struct ehci_sitd, sitd_trans),
	    sizeof(itd->sitd.sitd_trans),
	    BUS_DMASYNC_POSTWRITE0x08 | BUS_DMASYNC_POSTREAD0x02);

	trans_status = le32toh(itd->sitd.sitd_trans)((__uint32_t)(itd->sitd.sitd_trans));
	trans_status &= ~EHCI_SITD_ACTIVE0x80;
	itd->sitd.sitd_trans = htole32(trans_status)((__uint32_t)(trans_status));

	usb_syncmem(&itd->dma,
	    itd->offs + offsetof(struct ehci_sitd, sitd_trans)__builtin_offsetof(struct ehci_sitd, sitd_trans),
	    sizeof(itd->sitd.sitd_trans),
	    BUS_DMASYNC_PREWRITE0x04 | BUS_DMASYNC_PREREAD0x01);
}
}

sc->sc_softwake = 1;
usb_schedsoftintr(&sc->sc_bus);
tsleep_nsec(&sc->sc_softwake, PZERO22, "ehciab", INFSLP0xffffffffffffffffULL);

usb_transfer_complete(xfer);
2793}

2795void
2796ehci_timeout(void *addr)
2797{
struct usbd_xfer *xfer = addr;
struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;

if (sc->sc_bus.dying) {
ehci_timeout_task(addr);
return;
}

usb_init_task(&xfer->abort_task, ehci_timeout_task, addr,((&xfer->abort_task)->fun = (ehci_timeout_task), (&
xfer->abort_task)->arg = (addr), (&xfer->abort_task
)->type = (2), (&xfer->abort_task)->state = 0x0)
   USB_TASK_TYPE_ABORT)((&xfer->abort_task)->fun = (ehci_timeout_task), (&
xfer->abort_task)->arg = (addr), (&xfer->abort_task
)->type = (2), (&xfer->abort_task)->state = 0x0);
usb_add_task(xfer->device, &xfer->abort_task);
2809}

2811void
2812ehci_timeout_task(void *addr)
2813{
struct usbd_xfer *xfer = addr;
int s;

s = splusb()splraise(0x2);
ehci_abort_xfer(xfer, USBD_TIMEOUT);
splx(s)spllower(s);
2820}

2822/*
* Some EHCI chips from VIA / ATI seem to trigger interrupts before writing
* back the qTD status, or miss signalling occasionally under heavy load.
* If the host machine is too fast, we can miss transaction completion - when
* we scan the active list the transaction still seems to be active. This
* generally exhibits itself as a umass stall that never recovers.
*
* We work around this behaviour by setting up this callback after any softintr
* that completes with transactions still pending, giving us another chance to
* check for completion after the writeback has taken place.
*/
2833void
2834ehci_intrlist_timeout(void *arg)
2835{
struct ehci_softc *sc = arg;
int s;

if (sc->sc_bus.dying)
return;

s = splusb()splraise(0x2);
DPRINTFN(1, ("ehci_intrlist_timeout\n"));
usb_schedsoftintr(&sc->sc_bus);
splx(s)spllower(s);
2846}

2848usbd_status
2849ehci_device_ctrl_transfer(struct usbd_xfer *xfer)
2850{
usbd_status err;

/* Insert last in queue. */
err = usb_insert_transfer(xfer);
if (err)
return (err);

/* Pipe isn't running, start first */
return (ehci_device_ctrl_start(SIMPLEQ_FIRST(&xfer->pipe->queue)((&xfer->pipe->queue)->sqh_first)));
2860}

2862usbd_status
2863ehci_device_ctrl_start(struct usbd_xfer *xfer)
2864{
struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
usb_device_request_t *req = &xfer->request;
struct ehci_soft_qtd *setup, *stat, *next;
struct ehci_soft_qh *sqh;
u_int len = UGETW(req->wLength)(*(u_int16_t *)(req->wLength));
usbd_status err;
int s;

KASSERT(xfer->rqflags & URQ_REQUEST)((xfer->rqflags & 0x01) ? (void)0 : __assert("diagnostic "
, "/usr/src/sys/dev/usb/ehci.c", 2875, "xfer->rqflags & URQ_REQUEST"
));

if (sc->sc_bus.dying)
return (USBD_IOERROR);

setup = ehci_alloc_sqtd(sc);
if (setup == NULL((void *)0)) {
err = USBD_NOMEM;
goto bad1;
}
stat = ehci_alloc_sqtd(sc);
if (stat == NULL((void *)0)) {
err = USBD_NOMEM;
goto bad2;
}

sqh = epipe->sqh;

/* Set up data transaction */
if (len != 0) {
struct ehci_soft_qtd *end;

err = ehci_alloc_sqtd_chain(sc, len, xfer, &next, &end);
if (err)
	goto bad3;
end->qtd.qtd_status &= htole32(~EHCI_QTD_IOC)((__uint32_t)(~0x00008000));
end->nextqtd = stat;
end->qtd.qtd_next =
    end->qtd.qtd_altnext = htole32(stat->physaddr)((__uint32_t)(stat->physaddr));
usb_syncmem(&end->dma, end->offs, sizeof(end->qtd),
    BUS_DMASYNC_PREWRITE0x04 | BUS_DMASYNC_PREREAD0x01);
} else {
next = stat;
}

memcpy(KERNADDR(&epipe->u.ctl.reqdma, 0), req, sizeof(*req))__builtin_memcpy((((void *)((char *)((&epipe->u.ctl.reqdma
)->block->kaddr + (&epipe->u.ctl.reqdma)->offs
) + (0)))), (req), (sizeof(*req)));
usb_syncmem(&epipe->u.ctl.reqdma, 0, sizeof *req, BUS_DMASYNC_PREWRITE0x04);

/* Clear toggle */
setup->qtd.qtd_status = htole32(((__uint32_t)(0x80 | ((0x2) << 8) | ((3) << 10) |
 ((0) << 31) | ((sizeof(*req)) << 16)))
   EHCI_QTD_ACTIVE |((__uint32_t)(0x80 | ((0x2) << 8) | ((3) << 10) |
 ((0) << 31) | ((sizeof(*req)) << 16)))
   EHCI_QTD_SET_PID(EHCI_QTD_PID_SETUP) |((__uint32_t)(0x80 | ((0x2) << 8) | ((3) << 10) |
 ((0) << 31) | ((sizeof(*req)) << 16)))
   EHCI_QTD_SET_CERR(3) |((__uint32_t)(0x80 | ((0x2) << 8) | ((3) << 10) |
 ((0) << 31) | ((sizeof(*req)) << 16)))
   EHCI_QTD_SET_TOGGLE(0) |((__uint32_t)(0x80 | ((0x2) << 8) | ((3) << 10) |
 ((0) << 31) | ((sizeof(*req)) << 16)))
   EHCI_QTD_SET_BYTES(sizeof(*req)))((__uint32_t)(0x80 | ((0x2) << 8) | ((3) << 10) |
 ((0) << 31) | ((sizeof(*req)) << 16)));
setup->qtd.qtd_buffer[0] = htole32(DMAADDR(&epipe->u.ctl.reqdma, 0))((__uint32_t)(((&epipe->u.ctl.reqdma)->block->map
->dm_segs[0].ds_addr + (&epipe->u.ctl.reqdma)->offs
 + (0))));
setup->qtd.qtd_buffer_hi[0] = 0;
setup->nextqtd = next;
setup->qtd.qtd_next = setup->qtd.qtd_altnext = htole32(next->physaddr)((__uint32_t)(next->physaddr));
setup->len = sizeof(*req);
usb_syncmem(&setup->dma, setup->offs, sizeof(setup->qtd),
   BUS_DMASYNC_PREWRITE0x04 | BUS_DMASYNC_PREREAD0x01);

stat->qtd.qtd_status = htole32(((__uint32_t)(0x80 | ((usbd_xfer_isread(xfer) ? 0x0 : 0x1) <<
 8) | ((3) << 10) | ((1) << 31) | 0x00008000))
   EHCI_QTD_ACTIVE |((__uint32_t)(0x80 | ((usbd_xfer_isread(xfer) ? 0x0 : 0x1) <<
 8) | ((3) << 10) | ((1) << 31) | 0x00008000))
   EHCI_QTD_SET_PID(usbd_xfer_isread(xfer) ?((__uint32_t)(0x80 | ((usbd_xfer_isread(xfer) ? 0x0 : 0x1) <<
 8) | ((3) << 10) | ((1) << 31) | 0x00008000))
EHCI_QTD_PID_OUT : EHCI_QTD_PID_IN) |((__uint32_t)(0x80 | ((usbd_xfer_isread(xfer) ? 0x0 : 0x1) <<
 8) | ((3) << 10) | ((1) << 31) | 0x00008000))
   EHCI_QTD_SET_CERR(3) |((__uint32_t)(0x80 | ((usbd_xfer_isread(xfer) ? 0x0 : 0x1) <<
 8) | ((3) << 10) | ((1) << 31) | 0x00008000))
   EHCI_QTD_SET_TOGGLE(1) |((__uint32_t)(0x80 | ((usbd_xfer_isread(xfer) ? 0x0 : 0x1) <<
 8) | ((3) << 10) | ((1) << 31) | 0x00008000))
   EHCI_QTD_IOC)((__uint32_t)(0x80 | ((usbd_xfer_isread(xfer) ? 0x0 : 0x1) <<
 8) | ((3) << 10) | ((1) << 31) | 0x00008000));
stat->qtd.qtd_buffer[0] = 0; /* XXX not needed? */
stat->qtd.qtd_buffer_hi[0] = 0; /* XXX not needed? */
stat->nextqtd = NULL((void *)0);
stat->qtd.qtd_next = stat->qtd.qtd_altnext = htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));
stat->len = 0;
usb_syncmem(&stat->dma, stat->offs, sizeof(stat->qtd),
   BUS_DMASYNC_PREWRITE0x04 | BUS_DMASYNC_PREREAD0x01);

ex->sqtdstart_TD.sqtd.start = setup;
ex->sqtdend_TD.sqtd.end = stat;
2945#ifdef DIAGNOSTIC1
if (!ex->isdone) {
printf("%s: not done, ex=%p\n", __func__, ex);
}
ex->isdone = 0;
2950#endif

/* Insert qTD in QH list. */
s = splusb()splraise(0x2);
ehci_set_qh_qtd(sqh, setup);
if (xfer->timeout && !sc->sc_bus.use_polling) {
timeout_del(&xfer->timeout_handle);
timeout_set(&xfer->timeout_handle, ehci_timeout, xfer);
timeout_add_msec(&xfer->timeout_handle, xfer->timeout);
}
TAILQ_INSERT_TAIL(&sc->sc_intrhead, ex, inext)do { (ex)->inext.tqe_next = ((void *)0); (ex)->inext.tqe_prev
 = (&sc->sc_intrhead)->tqh_last; *(&sc->sc_intrhead
)->tqh_last = (ex); (&sc->sc_intrhead)->tqh_last
 = &(ex)->inext.tqe_next; } while (0);
xfer->status = USBD_IN_PROGRESS;
splx(s)spllower(s);

return (USBD_IN_PROGRESS);

bad3:
ehci_free_sqtd(sc, stat);
bad2:
ehci_free_sqtd(sc, setup);
bad1:
xfer->status = err;
usb_transfer_complete(xfer);
return (err);
2974}

2976void
2977ehci_device_ctrl_done(struct usbd_xfer *xfer)
2978{
struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
struct ehci_xfer *ex = (struct ehci_xfer *)xfer;

KASSERT(xfer->rqflags & URQ_REQUEST)((xfer->rqflags & 0x01) ? (void)0 : __assert("diagnostic "
, "/usr/src/sys/dev/usb/ehci.c", 2982, "xfer->rqflags & URQ_REQUEST"
));

if (xfer->status != USBD_NOMEM) {
ehci_free_sqtd_chain(sc, ex);
}
2987}

2989void
2990ehci_device_ctrl_abort(struct usbd_xfer *xfer)
2991{
ehci_abort_xfer(xfer, USBD_CANCELLED);
2993}

2995void
2996ehci_device_ctrl_close(struct usbd_pipe *pipe)
2997{
ehci_close_pipe(pipe);
2999}

3001usbd_status
3002ehci_device_bulk_transfer(struct usbd_xfer *xfer)
3003{
usbd_status err;

/* Insert last in queue. */
err = usb_insert_transfer(xfer);
if (err)
return (err);

/* Pipe isn't running, start first */
return (ehci_device_bulk_start(SIMPLEQ_FIRST(&xfer->pipe->queue)((&xfer->pipe->queue)->sqh_first)));
3013}

3015usbd_status
3016ehci_device_bulk_start(struct usbd_xfer *xfer)
3017{
struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
struct ehci_soft_qtd *data, *dataend;
struct ehci_soft_qh *sqh;
usbd_status err;
int s;

KASSERT(!(xfer->rqflags & URQ_REQUEST))((!(xfer->rqflags & 0x01)) ? (void)0 : __assert("diagnostic "
, "/usr/src/sys/dev/usb/ehci.c", 3026, "!(xfer->rqflags & URQ_REQUEST)"
));

if (sc->sc_bus.dying)
return (USBD_IOERROR);

sqh = epipe->sqh;

err = ehci_alloc_sqtd_chain(sc, xfer->length, xfer, &data, &dataend);
if (err) {
xfer->status = err;
usb_transfer_complete(xfer);
return (err);
}

/* Set up interrupt info. */
ex->sqtdstart_TD.sqtd.start = data;
ex->sqtdend_TD.sqtd.end = dataend;
3043#ifdef DIAGNOSTIC1
if (!ex->isdone) {
printf("ehci_device_bulk_start: not done, ex=%p\n", ex);
}
ex->isdone = 0;
3048#endif

s = splusb()splraise(0x2);
ehci_set_qh_qtd(sqh, data);
if (xfer->timeout && !sc->sc_bus.use_polling) {
timeout_del(&xfer->timeout_handle);
timeout_set(&xfer->timeout_handle, ehci_timeout, xfer);
timeout_add_msec(&xfer->timeout_handle, xfer->timeout);
}
TAILQ_INSERT_TAIL(&sc->sc_intrhead, ex, inext)do { (ex)->inext.tqe_next = ((void *)0); (ex)->inext.tqe_prev
 = (&sc->sc_intrhead)->tqh_last; *(&sc->sc_intrhead
)->tqh_last = (ex); (&sc->sc_intrhead)->tqh_last
 = &(ex)->inext.tqe_next; } while (0);
xfer->status = USBD_IN_PROGRESS;
splx(s)spllower(s);

return (USBD_IN_PROGRESS);
3062}

3064void
3065ehci_device_bulk_abort(struct usbd_xfer *xfer)
3066{
ehci_abort_xfer(xfer, USBD_CANCELLED);
3068}

3070/*
* Close a device bulk pipe.
*/
3073void
3074ehci_device_bulk_close(struct usbd_pipe *pipe)
3075{
ehci_close_pipe(pipe);
3077}

3079void
3080ehci_device_bulk_done(struct usbd_xfer *xfer)
3081{
struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
struct ehci_xfer *ex = (struct ehci_xfer *)xfer;

if (xfer->status != USBD_NOMEM) {
ehci_free_sqtd_chain(sc, ex);
}
3088}

3090usbd_status
3091ehci_device_setintr(struct ehci_softc *sc, struct ehci_soft_qh *sqh, int ival)
3092{
struct ehci_soft_islot *isp;
int islot, lev;

/* Find a poll rate that is large enough. */
for (lev = EHCI_IPOLLRATES8 - 1; lev > 0; lev--)
if (EHCI_ILEV_IVAL(lev)(1 << (lev)) <= ival)
	break;

/* Pick an interrupt slot at the right level. */
/* XXX could do better than picking at random */
islot = EHCI_IQHIDX(lev, arc4random())((((arc4random()) & ((1 << (lev)) - 1)) | (1 <<
 (lev))) - 1);

sqh->islot = islot;
isp = &sc->sc_islots[islot];
ehci_add_qh(sqh, isp->sqh);

return (USBD_NORMAL_COMPLETION);
3110}

3112usbd_status
3113ehci_device_intr_transfer(struct usbd_xfer *xfer)
3114{
usbd_status err;

/* Insert last in queue. */
err = usb_insert_transfer(xfer);
if (err)
return (err);

/*
* Pipe isn't running (otherwise err would be USBD_INPROG),
* so start it first.
*/
return (ehci_device_intr_start(SIMPLEQ_FIRST(&xfer->pipe->queue)((&xfer->pipe->queue)->sqh_first)));
3127}

3129usbd_status
3130ehci_device_intr_start(struct usbd_xfer *xfer)
3131{
struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
struct ehci_soft_qtd *data, *dataend;
struct ehci_soft_qh *sqh;
usbd_status err;
int s;

KASSERT(!(xfer->rqflags & URQ_REQUEST))((!(xfer->rqflags & 0x01)) ? (void)0 : __assert("diagnostic "
, "/usr/src/sys/dev/usb/ehci.c", 3140, "!(xfer->rqflags & URQ_REQUEST)"
));

if (sc->sc_bus.dying)
return (USBD_IOERROR);

sqh = epipe->sqh;

err = ehci_alloc_sqtd_chain(sc, xfer->length, xfer, &data, &dataend);
if (err) {
xfer->status = err;
usb_transfer_complete(xfer);
return (err);
}

/* Set up interrupt info. */
ex->sqtdstart_TD.sqtd.start = data;
ex->sqtdend_TD.sqtd.end = dataend;
3157#ifdef DIAGNOSTIC1
if (!ex->isdone)
printf("ehci_device_intr_start: not done, ex=%p\n", ex);
ex->isdone = 0;
3161#endif

s = splusb()splraise(0x2);
ehci_set_qh_qtd(sqh, data);
if (xfer->timeout && !sc->sc_bus.use_polling) {
timeout_del(&xfer->timeout_handle);
timeout_set(&xfer->timeout_handle, ehci_timeout, xfer);
timeout_add_msec(&xfer->timeout_handle, xfer->timeout);
}
TAILQ_INSERT_TAIL(&sc->sc_intrhead, ex, inext)do { (ex)->inext.tqe_next = ((void *)0); (ex)->inext.tqe_prev
 = (&sc->sc_intrhead)->tqh_last; *(&sc->sc_intrhead
)->tqh_last = (ex); (&sc->sc_intrhead)->tqh_last
 = &(ex)->inext.tqe_next; } while (0);
xfer->status = USBD_IN_PROGRESS;
splx(s)spllower(s);

return (USBD_IN_PROGRESS);
3175}

3177void
3178ehci_device_intr_abort(struct usbd_xfer *xfer)
3179{
KASSERT(!xfer->pipe->repeat || xfer->pipe->intrxfer == xfer)((!xfer->pipe->repeat || xfer->pipe->intrxfer == xfer
) ? (void)0 : __assert("diagnostic ", "/usr/src/sys/dev/usb/ehci.c"
, 3180, "!xfer->pipe->repeat || xfer->pipe->intrxfer == xfer"
));

/*
* XXX - abort_xfer uses ehci_sync_hc, which syncs via the advance
*       async doorbell. That's dependant on the async list, whereas
*       intr xfers are periodic, should not use this?
*/
ehci_abort_xfer(xfer, USBD_CANCELLED);
3188}

3190void
3191ehci_device_intr_close(struct usbd_pipe *pipe)
3192{
ehci_close_pipe(pipe);
3194}

3196void
3197ehci_device_intr_done(struct usbd_xfer *xfer)
3198{
struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
struct ehci_soft_qtd *data, *dataend;
struct ehci_soft_qh *sqh;
usbd_status err;
int s;

if (xfer->pipe->repeat) {
ehci_free_sqtd_chain(sc, ex);

sqh = epipe->sqh;

err = ehci_alloc_sqtd_chain(sc, xfer->length, xfer, &data, &dataend);
if (err) {
	xfer->status = err;
	return;
}

/* Set up interrupt info. */
ex->sqtdstart_TD.sqtd.start = data;
ex->sqtdend_TD.sqtd.end = dataend;
3221#ifdef DIAGNOSTIC1
if (!ex->isdone) {
	printf("ehci_device_intr_done: not done, ex=%p\n",
			ex);
}
ex->isdone = 0;
3227#endif

s = splusb()splraise(0x2);
ehci_set_qh_qtd(sqh, data);
if (xfer->timeout && !sc->sc_bus.use_polling) {
	timeout_del(&xfer->timeout_handle);
	timeout_set(&xfer->timeout_handle, ehci_timeout, xfer);
	timeout_add_msec(&xfer->timeout_handle, xfer->timeout);
}
TAILQ_INSERT_TAIL(&sc->sc_intrhead, ex, inext)do { (ex)->inext.tqe_next = ((void *)0); (ex)->inext.tqe_prev
 = (&sc->sc_intrhead)->tqh_last; *(&sc->sc_intrhead
)->tqh_last = (ex); (&sc->sc_intrhead)->tqh_last
 = &(ex)->inext.tqe_next; } while (0);
xfer->status = USBD_IN_PROGRESS;
splx(s)spllower(s);
} else if (xfer->status != USBD_NOMEM) {
ehci_free_sqtd_chain(sc, ex);
}
3242}

3244usbd_status
3245ehci_device_isoc_transfer(struct usbd_xfer *xfer)
3246{
usbd_status err;

err = usb_insert_transfer(xfer);
if (err && err != USBD_IN_PROGRESS)
return (err);

return (ehci_device_isoc_start(xfer));
3254}

3256usbd_status
3257ehci_device_isoc_start(struct usbd_xfer *xfer)
3258{
struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
usb_endpoint_descriptor_t *ed = xfer->pipe->endpoint->edesc;
uint8_t ival = ed->bInterval;
struct ehci_soft_itd *itd;
int s, frindex;
uint32_t link;

KASSERT(!(xfer->rqflags & URQ_REQUEST))((!(xfer->rqflags & 0x01)) ? (void)0 : __assert("diagnostic "
, "/usr/src/sys/dev/usb/ehci.c", 3268, "!(xfer->rqflags & URQ_REQUEST)"
));
KASSERT(ival > 0 && ival <= 16)((ival > 0 && ival <= 16) ? (void)0 : __assert(
"diagnostic ", "/usr/src/sys/dev/usb/ehci.c", 3269, "ival > 0 && ival <= 16"
));

/*
* To allow continuous transfers, above we start all transfers
* immediately. However, we're still going to get usbd_start_next call
* this when another xfer completes. So, check if this is already
* in progress or not
*/
if (ex->itdstart_TD.itd.start != NULL((void *)0))
return (USBD_IN_PROGRESS);

if (sc->sc_bus.dying)
return (USBD_IOERROR);

/* Why would you do that anyway? */
if (sc->sc_bus.use_polling)
return (USBD_INVAL);

/*
* To avoid complication, don't allow a request right now that'll span
* the entire frame table. To within 4 frames, to allow some leeway
* on either side of where the hc currently is.
*/
if ((1 << (ival - 1)) * xfer->nframes >= (sc->sc_flsize - 4) * 8)
return (USBD_INVAL);

/*
* Step 1: Allocate and initialize itds.
*/
if (xfer->device->speed == USB_SPEED_HIGH3) {
if (ehci_alloc_itd_chain(sc, xfer))
	return (USBD_INVAL);

link = EHCI_LINK_ITD0x0;
} else {
if (ehci_alloc_sitd_chain(sc, xfer))
	return (USBD_INVAL);

link = EHCI_LINK_SITD0x4;
}

3310#ifdef DIAGNOSTIC1
if (!ex->isdone) {
printf("%s: not done, ex=%p\n", __func__, ex);
}
ex->isdone = 0;
3315#endif

/*
* Part 2: Transfer descriptors have now been set up, now they must
* be scheduled into the period frame list. Erk. Not wanting to
* complicate matters, transfer is denied if the transfer spans
* more than the period frame list.
*/
s = splusb()splraise(0x2);

/* Start inserting frames */
if (epipe->u.isoc.cur_xfers > 0) {
frindex = epipe->u.isoc.next_frame;
} else {
frindex = EOREAD4(sc, EHCI_FRINDEX)(((sc)->iot)->read_4(((sc)->ioh), ((sc)->sc_offs+
(0x0c))));
frindex = frindex >> 3; /* Erase microframe index */
frindex += 2;
}

if (frindex >= sc->sc_flsize)
frindex &= (sc->sc_flsize - 1);

/* What's the frame interval? */
ival = (1 << (ival - 1));
if (ival / 8 == 0)
ival = 1;
else
ival /= 8;

/* Abuse the fact that itd_next == sitd_next. */
for (itd = ex->itdstart_TD.itd.start; itd != NULL((void *)0); itd = itd->xfer_next) {
itd->itd.itd_next = sc->sc_flist[frindex];
if (itd->itd.itd_next == 0)
	itd->itd.itd_next = htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));

sc->sc_flist[frindex] = htole32(link | itd->physaddr)((__uint32_t)(link | itd->physaddr));
itd->u.frame_list.next = sc->sc_softitds[frindex];
sc->sc_softitds[frindex] = itd;
if (itd->u.frame_list.next != NULL((void *)0))
	itd->u.frame_list.next->u.frame_list.prev = itd;
itd->slot = frindex;
itd->u.frame_list.prev = NULL((void *)0);

frindex += ival;
if (frindex >= sc->sc_flsize)
	frindex -= sc->sc_flsize;
}

epipe->u.isoc.cur_xfers++;
epipe->u.isoc.next_frame = frindex;

TAILQ_INSERT_TAIL(&sc->sc_intrhead, ex, inext)do { (ex)->inext.tqe_next = ((void *)0); (ex)->inext.tqe_prev
 = (&sc->sc_intrhead)->tqh_last; *(&sc->sc_intrhead
)->tqh_last = (ex); (&sc->sc_intrhead)->tqh_last
 = &(ex)->inext.tqe_next; } while (0);
xfer->status = USBD_IN_PROGRESS;
xfer->done = 0;
splx(s)spllower(s);

return (USBD_IN_PROGRESS);
3372}

3374int
3375ehci_alloc_itd_chain(struct ehci_softc *sc, struct usbd_xfer *xfer)
3376{
struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
usb_endpoint_descriptor_t *ed = xfer->pipe->endpoint->edesc;
const uint32_t mps = UGETW(ed->wMaxPacketSize)(*(u_int16_t *)(ed->wMaxPacketSize));
struct ehci_soft_itd *itd = NULL((void *)0), *pitd = NULL((void *)0);
int i, j, nframes, uframes, ufrperframe;
int offs = 0, trans_count = 0;

/*
* How many itds do we need?  One per transfer if interval >= 8
* microframes, fewer if we use multiple microframes per frame.
*/
switch (ed->bInterval) {
case 1:
ufrperframe = 8;
break;
case 2:
ufrperframe = 4;
break;
case 3:
ufrperframe = 2;
break;
default:
ufrperframe = 1;
break;
}
nframes = (xfer->nframes + (ufrperframe - 1)) / ufrperframe;
uframes = 8 / ufrperframe;
if (nframes == 0)
return (1);

usb_syncmem(&xfer->dmabuf, 0, xfer->length,
   usbd_xfer_isread(xfer) ?
   BUS_DMASYNC_PREREAD0x01 : BUS_DMASYNC_PREWRITE0x04);
for (i = 0; i < nframes; i++) {
uint32_t froffs = offs;

itd = ehci_alloc_itd(sc);
if (itd == NULL((void *)0)) {
	ehci_free_itd_chain(sc, ex);
	return (1);
}

if (pitd != NULL((void *)0))
	pitd->xfer_next = itd;
else
	ex->itdstart_TD.itd.start = itd;

/*
 * Step 1.5, initialize uframes
 */
for (j = 0; j < 8; j += uframes) {
	/* Calculate which page in the list this starts in */
	int addr = DMAADDR(&xfer->dmabuf, froffs)((&xfer->dmabuf)->block->map->dm_segs[0].ds_addr
 + (&xfer->dmabuf)->offs + (froffs));
	addr = EHCI_PAGE_OFFSET(addr)((addr) & 0xfff) + (offs - froffs);
	addr = EHCI_PAGE(addr)((addr) &~ 0xfff) / EHCI_PAGE_SIZE0x1000;

	/* This gets the initial offset into the first page,
	 * looks how far further along the current uframe
	 * offset is. Works out how many pages that is.
	 */
	itd->itd.itd_ctl[j] = htole32(((__uint32_t)(0x80000000 | (((xfer->frlengths[trans_count]
) & 0xfff) << 16) | (((addr) & 0x7) << 12
) | (((((&xfer->dmabuf)->block->map->dm_segs[
0].ds_addr + (&xfer->dmabuf)->offs + (offs))) &
 0xfff) << 0)))
	    EHCI_ITD_ACTIVE |((__uint32_t)(0x80000000 | (((xfer->frlengths[trans_count]
) & 0xfff) << 16) | (((addr) & 0x7) << 12
) | (((((&xfer->dmabuf)->block->map->dm_segs[
0].ds_addr + (&xfer->dmabuf)->offs + (offs))) &
 0xfff) << 0)))
	    EHCI_ITD_SET_LEN(xfer->frlengths[trans_count]) |((__uint32_t)(0x80000000 | (((xfer->frlengths[trans_count]
) & 0xfff) << 16) | (((addr) & 0x7) << 12
) | (((((&xfer->dmabuf)->block->map->dm_segs[
0].ds_addr + (&xfer->dmabuf)->offs + (offs))) &
 0xfff) << 0)))
	    EHCI_ITD_SET_PG(addr) |((__uint32_t)(0x80000000 | (((xfer->frlengths[trans_count]
) & 0xfff) << 16) | (((addr) & 0x7) << 12
) | (((((&xfer->dmabuf)->block->map->dm_segs[
0].ds_addr + (&xfer->dmabuf)->offs + (offs))) &
 0xfff) << 0)))
	    EHCI_ITD_SET_OFFS(DMAADDR(&xfer->dmabuf, offs))((__uint32_t)(0x80000000 | (((xfer->frlengths[trans_count]
) & 0xfff) << 16) | (((addr) & 0x7) << 12
) | (((((&xfer->dmabuf)->block->map->dm_segs[
0].ds_addr + (&xfer->dmabuf)->offs + (offs))) &
 0xfff) << 0)))
	)((__uint32_t)(0x80000000 | (((xfer->frlengths[trans_count]
) & 0xfff) << 16) | (((addr) & 0x7) << 12
) | (((((&xfer->dmabuf)->block->map->dm_segs[
0].ds_addr + (&xfer->dmabuf)->offs + (offs))) &
 0xfff) << 0)));

	offs += xfer->frlengths[trans_count];
	trans_count++;

	if (trans_count >= xfer->nframes) { /*Set IOC*/
		itd->itd.itd_ctl[j] |= htole32(EHCI_ITD_IOC)((__uint32_t)(0x8000));
		break;
	}
}

/* Step 1.75, set buffer pointers. To simplify matters, all
 * pointers are filled out for the next 7 hardware pages in
 * the dma block, so no need to worry what pages to cover
 * and what to not.
 */

for (j = 0; j < 7; j++) {
	/*
	 * Don't try to lookup a page that's past the end
	 * of buffer
	 */
	int page_offs = EHCI_PAGE(froffs +((froffs + (0x1000 * j)) &~ 0xfff)
	    (EHCI_PAGE_SIZE * j))((froffs + (0x1000 * j)) &~ 0xfff);

	if (page_offs >= xfer->dmabuf.block->size)
		break;

	long long page = DMAADDR(&xfer->dmabuf, page_offs)((&xfer->dmabuf)->block->map->dm_segs[0].ds_addr
 + (&xfer->dmabuf)->offs + (page_offs));
	page = EHCI_PAGE(page)((page) &~ 0xfff);
	itd->itd.itd_bufr[j] = htole32(page)((__uint32_t)(page));
	itd->itd.itd_bufr_hi[j] = htole32(page >> 32)((__uint32_t)(page >> 32));
}

/*
 * Other special values
 */
itd->itd.itd_bufr[0] |= htole32(((__uint32_t)((((((ed->bEndpointAddress) & 0x0f)) &
 0xf) << 8) | ((xfer->pipe->device->address) &
 0x7f)))
    EHCI_ITD_SET_ENDPT(UE_GET_ADDR(ed->bEndpointAddress)) |((__uint32_t)((((((ed->bEndpointAddress) & 0x0f)) &
 0xf) << 8) | ((xfer->pipe->device->address) &
 0x7f)))
    EHCI_ITD_SET_DADDR(xfer->pipe->device->address)((__uint32_t)((((((ed->bEndpointAddress) & 0x0f)) &
 0xf) << 8) | ((xfer->pipe->device->address) &
 0x7f)))
)((__uint32_t)((((((ed->bEndpointAddress) & 0x0f)) &
 0xf) << 8) | ((xfer->pipe->device->address) &
 0x7f)));

itd->itd.itd_bufr[1] |= htole32(((__uint32_t)((usbd_xfer_isread(xfer) ? (((1) & 1) <<
 11) : 0) | ((((mps) & 0x7ff)) & 0x7ff)))
    (usbd_xfer_isread(xfer) ? EHCI_ITD_SET_DIR(1) : 0) |((__uint32_t)((usbd_xfer_isread(xfer) ? (((1) & 1) <<
 11) : 0) | ((((mps) & 0x7ff)) & 0x7ff)))
    EHCI_ITD_SET_MAXPKT(UE_GET_SIZE(mps))((__uint32_t)((usbd_xfer_isread(xfer) ? (((1) & 1) <<
 11) : 0) | ((((mps) & 0x7ff)) & 0x7ff)))
)((__uint32_t)((usbd_xfer_isread(xfer) ? (((1) & 1) <<
 11) : 0) | ((((mps) & 0x7ff)) & 0x7ff)));
/* FIXME: handle invalid trans */
itd->itd.itd_bufr[2] |= htole32(((__uint32_t)((((((mps) >> 11) & 0x3)+1) & 0x3)
))
    EHCI_ITD_SET_MULTI(UE_GET_TRANS(mps)+1)((__uint32_t)((((((mps) >> 11) & 0x3)+1) & 0x3)
))
)((__uint32_t)((((((mps) >> 11) & 0x3)+1) & 0x3)
));

pitd = itd;
}

ex->itdend_TD.itd.end = itd;

return (0);
3499}

3501int
3502ehci_alloc_sitd_chain(struct ehci_softc *sc, struct usbd_xfer *xfer)
3503{
struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
struct usbd_device *hshub = xfer->device->myhsport->parent;
usb_endpoint_descriptor_t *ed = xfer->pipe->endpoint->edesc;
struct ehci_soft_itd *itd = NULL((void *)0), *pitd = NULL((void *)0);
uint8_t smask, cmask, tp, uf;
int i, nframes, offs = 0;
uint32_t endp;

nframes = xfer->nframes;
if (nframes == 0)
return (1);

endp = EHCI_SITD_SET_ENDPT(UE_GET_ADDR(ed->bEndpointAddress))((((ed->bEndpointAddress) & 0x0f)) << 8) |
   EHCI_SITD_SET_ADDR(xfer->device->address)(xfer->device->address) |
   EHCI_SITD_SET_PORT(xfer->device->myhsport->portno)((xfer->device->myhsport->portno) << 23) |
   EHCI_SITD_SET_HUBA(hshub->address)((hshub->address) << 16);

if (usbd_xfer_isread(xfer))
endp |= EHCI_SITD_SET_DIR(1)((1) << 31);

usb_syncmem(&xfer->dmabuf, 0, xfer->length,
   usbd_xfer_isread(xfer) ?
   BUS_DMASYNC_PREREAD0x01 : BUS_DMASYNC_PREWRITE0x04);
for (i = 0; i < nframes; i++) {
uint32_t addr = DMAADDR(&xfer->dmabuf, offs)((&xfer->dmabuf)->block->map->dm_segs[0].ds_addr
 + (&xfer->dmabuf)->offs + (offs));
uint32_t page = EHCI_PAGE(addr + xfer->frlengths[i] - 1)((addr + xfer->frlengths[i] - 1) &~ 0xfff);

itd = ehci_alloc_itd(sc);
if (itd == NULL((void *)0)) {
	ehci_free_itd_chain(sc, ex);
	return (1);
}
if (pitd)
	pitd->xfer_next = itd;
else
	ex->itdstart_TD.itd.start = itd;

itd->sitd.sitd_endp = htole32(endp)((__uint32_t)(endp));
itd->sitd.sitd_back = htole32(EHCI_LINK_TERMINATE)((__uint32_t)(0x00000001));
itd->sitd.sitd_trans = htole32(((__uint32_t)(0x80 | (((xfer->frlengths[i]) & 0x3ff) <<
 16) | ((i == nframes - 1) ? 0x80000000 : 0)))
    EHCI_SITD_ACTIVE |((__uint32_t)(0x80 | (((xfer->frlengths[i]) & 0x3ff) <<
 16) | ((i == nframes - 1) ? 0x80000000 : 0)))
    EHCI_SITD_SET_LEN(xfer->frlengths[i]) |((__uint32_t)(0x80 | (((xfer->frlengths[i]) & 0x3ff) <<
 16) | ((i == nframes - 1) ? 0x80000000 : 0)))
    ((i == nframes - 1) ? EHCI_SITD_IOC : 0)((__uint32_t)(0x80 | (((xfer->frlengths[i]) & 0x3ff) <<
 16) | ((i == nframes - 1) ? 0x80000000 : 0)))
)((__uint32_t)(0x80 | (((xfer->frlengths[i]) & 0x3ff) <<
 16) | ((i == nframes - 1) ? 0x80000000 : 0)));

uf = max(1, ((xfer->frlengths[i] + 187) / 188));

/*
 * Since we do not yet budget and schedule micro-frames
 * we assume there is no other transfer using the same
 * TT.
 */
if (usbd_xfer_isread(xfer)) {
	smask = 0x01;
	cmask = ((1 << (uf + 2)) - 1) << 2;
} else {
	/* Is the payload is greater than 188 bytes? */
	if (uf == 1)
		tp = EHCI_SITD_TP_ALL0x0;
	else
		tp = EHCI_SITD_TP_BEGIN0x1;

	page |=	EHCI_SITD_SET_TCOUNT(uf)((uf) << 0) | EHCI_SITD_SET_TP(tp)((tp) << 3);
	smask = (1 << uf) - 1;
	cmask = 0x00;
}

itd->sitd.sitd_sched = htole32(((__uint32_t)(((smask) << 0) | ((cmask) << 8)))
    EHCI_SITD_SET_SMASK(smask) | EHCI_SITD_SET_CMASK(cmask)((__uint32_t)(((smask) << 0) | ((cmask) << 8)))
)((__uint32_t)(((smask) << 0) | ((cmask) << 8)));
itd->sitd.sitd_bufr[0] = htole32(addr)((__uint32_t)(addr));
itd->sitd.sitd_bufr[1] = htole32(page)((__uint32_t)(page));

offs += xfer->frlengths[i];
pitd = itd;
}

ex->itdend_TD.itd.end = itd;

return (0);
3584}

3586void
3587ehci_device_isoc_abort(struct usbd_xfer *xfer)
3588{
int s;

s = splusb()splraise(0x2);
ehci_abort_isoc_xfer(xfer, USBD_CANCELLED);
splx(s)spllower(s);
3594}

3596void
3597ehci_device_isoc_close(struct usbd_pipe *pipe)
3598{
3599}

3601void
3602ehci_device_isoc_done(struct usbd_xfer *xfer)
3603{
struct ehci_softc *sc = (struct ehci_softc *)xfer->device->bus;
struct ehci_pipe *epipe = (struct ehci_pipe *)xfer->pipe;
struct ehci_xfer *ex = (struct ehci_xfer *)xfer;
int s;

s = splusb()splraise(0x2);
epipe->u.isoc.cur_xfers--;
if (xfer->status != USBD_NOMEM) {
ehci_rem_itd_chain(sc, ex);
ehci_free_itd_chain(sc, ex);
}
splx(s)spllower(s);
3616}