1 /*
2  * This file and its contents are supplied under the terms of the
3  * Common Development and Distribution License ("CDDL"), version 1.0.
4  * You may only use this file in accordance with the terms of version
5  * 1.0 of the CDDL.
6  *
7  * A full copy of the text of the CDDL should have accompanied this
8  * source.  A copy of the CDDL is also available via the Internet at
9  * http://www.illumos.org/license/CDDL.
10  */
11 
12 /*
13  * Copyright 2016 Joyent, Inc.
14  */
15 
16 /*
17  * -----------------------
18  * Command Ring Management
19  * -----------------------
20  *
21  * The command ring is the primary means by which the xHCI controller is
22  * managed. Events may be placed on the ring, at which point they will be
23  * processed in order. When commands are finished they generate event
24  * completions and we are notified via an interrupt.
25  *
26  * Every command is formatted in a transfer request block (TRB). These TRBs are
27  * queued on the command ring. To start the command ring, a doorbell register is
28  * written to. The current state of the command ring is maintained in the
29  * command ring control register (XHCI_CRCR).
30  *
31  * Every command has a condition variable. When the driver submits a command, it
32  * blocks on the command's CV waiting for a change in the commands status. This
33  * CV will be signaled after the command completes or is aborted, allowing the
34  * caller to treat this as a synchronous, blocking operation.
35  *
36  * The command ring itself consists of three primary states:
37  *
38  * 	XHCI_COMMAND_RING_IDLE		The command ring is not currently
39  * 					processing any events. No timeout events
40  * 					are active.
41  *
42  * 	XHCI_COMMAND_RING_RUNNING	The command ring currently has one or
43  * 					more events enqueued and the hardware
44  * 					has been signalled to process commands.
45  *
46  * 	XHCI_COMMAND_RING_ABORTING	A command has timed out and we are
47  * 					attempting to abort the current command,
48  * 					which will stop the ring.
49  *
50  * 	XHCI_COMMAND_RING_ABORT_DONE	We have successfully received a
51  * 					notification that the abort worked and
52  * 					that the command ring has stopped. This
53  * 					allows us to clean up state and
54  * 					transition back to either idle or
55  * 					running, depending on if we have queued
56  * 					commands.
57  *
58  * The state transition can be summarized as:
59  *
60  *    +------+                        +---------+
61  *    | Idle |--------*-------------->| Running |<----------------------+
62  *    +------+        . Command       +---------+                       |
63  *       ^              TRB queued      |    |                          |
64  *       |              on ring         |    |                          |
65  *       |                              |    * . . Command not          |
66  *       +-------*----------------------+    |     acknowledged         |
67  *       |       . . No more                 |     within timeout       |
68  *       |           commands                |     xhci_command_wait    |
69  *       |           queued                  |                          |
70  *       |                                   v       . abort request    |
71  *       * . No commands              +----------+   . times out        |
72  *       |   queued after             | Aborting |---*--+               |
73  *       |   successful               +----------+      v               |
74  *       |   abort                         |      +----------+          |
75  *       |                       abort . . *      | HW Reset |          |
76  *       |                acknowledged     |      +----------+          |
77  *       |                                 v                            |
78  *       |                           +------------+                     |
79  *       +---------------------------| Abort Done |----*----------------+
80  *                                   +------------+    . Commands queued
81  *                                                       after successful
82  *                                                       abort
83  *
84  * ---------------------------
85  * Timeouts and Command Aborts
86  * ---------------------------
87  *
88  * Commands may time out either due to issues with the host controller or with
89  * the devices connected to it. For example, the ADDRESS DEVICE command may
90  * issue commands to the device. As such, we need to be prepared for commands to
91  * time out.
92  *
93  * To deal with a stalled command, we write to the XHCI_CRCR register to abort
94  * the currently running command. This is discussed in xHCI 1.1 / 4.6.1.2. When
95  * a command is aborted, we should eventually receive a TRB completion for that
96  * command. However, this is no guarantee that an abort will be successful. The
97  * specification recommends waiting about 5 seconds for that to finish. After
98  * which we terminate the device.
99  *
100  * For an abort to be successful, we expect two different notifications. First
101  * we should receive a TRB for the actual command itself indicating that it's
102  * terminated. Next, we should receive a TRB indicating that the command ring
103  * has stopped. Only when we receive this second one, do we consider re-enabling
104  * the command ring.
105  *
106  * -------
107  * Locking
108  * -------
109  *
110  * The command ring's lock, xhci_command_ring_t`xcr_lock, should not be accessed
111  * outside of this file. If a caller needs to take the xhci_t`xhci_lock, it must
112  * be taken before the xcr_lock is taken. It is illegal for to hold
113  * xhci_t`xhci_lock across any command functions. Doing so would lead to
114  * deadlock.
115  */
116 
117 #include <sys/usb/hcd/xhci/xhci.h>
118 #include <sys/sysmacros.h>
119 
120 /*
121  * Recommended time to wait for an abort in from the Implementation Note
122  * in XHCI 1.1 / 4.6.1.2. The time is kept in microseconds.
123  */
124 clock_t xhci_command_abort_wait = 5 * MICROSEC;
125 
126 /*
127  * Default to waiting for one second for a command to time out. Time stored in
128  * microseconds.
129  */
130 clock_t xhci_command_wait = MICROSEC;
131 
132 /*
133  * Required forwards.
134  */
135 static void xhci_command_settimeout(xhci_t *, clock_t);
136 
137 void
xhci_command_ring_fini(xhci_t * xhcip)138 xhci_command_ring_fini(xhci_t *xhcip)
139 {
140 	xhci_command_ring_t *xcr = &xhcip->xhci_command;
141 
142 	/*
143 	 * If the ring is not allocated, then nothing else is here.
144 	 */
145 	if (xcr->xcr_ring.xr_trb == NULL)
146 		return;
147 	VERIFY(xcr->xcr_timeout == 0);
148 	xhci_ring_free(&xcr->xcr_ring);
149 	mutex_destroy(&xcr->xcr_lock);
150 	cv_destroy(&xcr->xcr_cv);
151 	list_destroy(&xcr->xcr_commands);
152 }
153 
154 /*
155  * Initialize or re-initialize the command ring. This will be called whenever we
156  * reset the xHCI commandler, so we may actually have already allocated DMA
157  * memory for the ring.
158  */
159 int
xhci_command_ring_init(xhci_t * xhcip)160 xhci_command_ring_init(xhci_t *xhcip)
161 {
162 	int ret;
163 	uint64_t addr;
164 	xhci_command_ring_t *xcr = &xhcip->xhci_command;
165 
166 	if (xcr->xcr_ring.xr_trb == NULL) {
167 		if ((ret = xhci_ring_alloc(xhcip, &xcr->xcr_ring)) != 0)
168 			return (ret);
169 	}
170 
171 	if ((ret = xhci_ring_reset(xhcip, &xcr->xcr_ring)) != 0)
172 		return (ret);
173 
174 #ifdef	DEBUG
175 	addr = xhci_get64(xhcip, XHCI_R_OPER, XHCI_CRCR);
176 	VERIFY0(addr & XHCI_CRCR_CRR);
177 #endif
178 	addr = LE_64(xhci_dma_pa(&xcr->xcr_ring.xr_dma) | XHCI_CRCR_RCS);
179 	xhci_put64(xhcip, XHCI_R_OPER, XHCI_CRCR, addr);
180 	if (xhci_check_regs_acc(xhcip) != DDI_FM_OK)
181 		return (EIO);
182 
183 	mutex_init(&xcr->xcr_lock, NULL, MUTEX_DRIVER,
184 	    DDI_INTR_PRI(xhcip->xhci_intr_pri));
185 	cv_init(&xcr->xcr_cv, NULL, CV_DRIVER, NULL);
186 	list_create(&xcr->xcr_commands, sizeof (xhci_command_t),
187 	    offsetof(xhci_command_t, xco_link));
188 	return (0);
189 }
190 
191 static void
xhci_command_timeout(void * arg)192 xhci_command_timeout(void *arg)
193 {
194 	uint64_t reg;
195 	clock_t delay;
196 	xhci_t *xhcip = arg;
197 	xhci_command_ring_t *xcr = &xhcip->xhci_command;
198 	xhci_command_t *xco;
199 
200 	mutex_enter(&xcr->xcr_lock);
201 
202 	xco = list_head(&xcr->xcr_commands);
203 	if (xco == NULL || xco->xco_state != XHCI_COMMAND_S_QUEUED) {
204 		xcr->xcr_timeout = 0;
205 		mutex_exit(&xcr->xcr_lock);
206 		return;
207 	}
208 
209 	xcr->xcr_state = XHCI_COMMAND_RING_ABORTING;
210 	reg = xhci_get64(xhcip, XHCI_R_OPER, XHCI_CRCR);
211 	if (xhci_check_regs_acc(xhcip) != DDI_FM_OK) {
212 		xcr->xcr_timeout = 0;
213 		mutex_exit(&xcr->xcr_lock);
214 		xhci_error(xhcip, "encountered fatal FM error reading command "
215 		    "ring control register: resetting device");
216 		xhci_fm_runtime_reset(xhcip);
217 		return;
218 	}
219 
220 	/*
221 	 * While all the other bits should be ignored because we're running, if
222 	 * for some reason we're not running, then this will make sure that we
223 	 * don't screw things up.
224 	 */
225 	reg |= XHCI_CRCR_CA;
226 	xhci_put64(xhcip, XHCI_R_OPER, XHCI_CRCR, reg);
227 	if (xhci_check_regs_acc(xhcip) != DDI_FM_OK) {
228 		xcr->xcr_timeout = 0;
229 		mutex_exit(&xcr->xcr_lock);
230 		xhci_error(xhcip, "encountered fatal FM error writing command "
231 		    "ring control register: resetting device");
232 		xhci_fm_runtime_reset(xhcip);
233 		return;
234 	}
235 
236 	delay = drv_usectohz(xhci_command_abort_wait);
237 	while (xcr->xcr_state != XHCI_COMMAND_RING_ABORT_DONE) {
238 		int ret;
239 
240 		ret = cv_reltimedwait(&xcr->xcr_cv, &xcr->xcr_lock, delay,
241 		    TR_CLOCK_TICK);
242 		if (ret == -1) {
243 			/* Time out waiting for the abort */
244 			xcr->xcr_timeout = 0;
245 			mutex_exit(&xcr->xcr_lock);
246 			xhci_error(xhcip, "abort command timed out: resetting "
247 			    "device");
248 			xhci_fm_runtime_reset(xhcip);
249 			return;
250 		}
251 	}
252 
253 	/*
254 	 * Successful abort, transition the ring as needed.
255 	 */
256 	if (list_is_empty(&xcr->xcr_commands) != 0) {
257 		xcr->xcr_state = XHCI_COMMAND_RING_IDLE;
258 		xcr->xcr_timeout = 0;
259 	} else {
260 		xhci_put32(xhcip, XHCI_R_DOOR, XHCI_DOORBELL(0), 0);
261 		if (xhci_check_regs_acc(xhcip) != DDI_FM_OK) {
262 			xcr->xcr_timeout = 0;
263 			mutex_exit(&xcr->xcr_lock);
264 			xhci_error(xhcip, "encountered fatal FM error writing "
265 			    "command ring control register: resetting device");
266 			xhci_fm_runtime_reset(xhcip);
267 			return;
268 		}
269 
270 		/*
271 		 * Reset our timeout id before we create a new timeout
272 		 */
273 		xcr->xcr_timeout = 0;
274 		xhci_command_settimeout(xhcip, xhci_command_wait);
275 		xcr->xcr_state = XHCI_COMMAND_RING_RUNNING;
276 	}
277 	mutex_exit(&xcr->xcr_lock);
278 }
279 
280 static void
xhci_command_settimeout(xhci_t * xhcip,clock_t microsecs)281 xhci_command_settimeout(xhci_t *xhcip, clock_t microsecs)
282 {
283 	clock_t delay;
284 	xhci_command_ring_t *xcr = &xhcip->xhci_command;
285 
286 	ASSERT(MUTEX_HELD(&xcr->xcr_lock));
287 	ASSERT(xcr->xcr_timeout == 0);
288 
289 	delay = drv_usectohz(microsecs);
290 	xcr->xcr_timeout = timeout(xhci_command_timeout, xhcip, delay);
291 }
292 
293 void
xhci_command_init(xhci_command_t * xcp)294 xhci_command_init(xhci_command_t *xcp)
295 {
296 	bzero(xcp, sizeof (xhci_command_t));
297 	cv_init(&xcp->xco_cv, NULL, CV_DRIVER, NULL);
298 }
299 
300 void
xhci_command_fini(xhci_command_t * xcp)301 xhci_command_fini(xhci_command_t *xcp)
302 {
303 	cv_destroy(&xcp->xco_cv);
304 }
305 
306 boolean_t
xhci_command_event_callback(xhci_t * xhcip,xhci_trb_t * trb)307 xhci_command_event_callback(xhci_t *xhcip, xhci_trb_t *trb)
308 {
309 	int cstat;
310 	timeout_id_t to;
311 	xhci_command_t *xco, *rem;
312 	xhci_command_ring_t *xcr = &xhcip->xhci_command;
313 	xhci_ring_t *xrp = &xcr->xcr_ring;
314 
315 	mutex_enter(&xcr->xcr_lock);
316 
317 	/*
318 	 * If we got an event that indicates that the command ring was stopped,
319 	 * then we have successfully finished an abort. While a command ring
320 	 * stop can also be done by writing to the XHCI_CRCR register, the
321 	 * driver does not do so at this time; however, we guard the state
322 	 * transition just in case.
323 	 */
324 	cstat = XHCI_TRB_GET_CODE(LE_32(trb->trb_status));
325 	if (cstat == XHCI_CODE_CMD_RING_STOP) {
326 		if (xcr->xcr_state == XHCI_COMMAND_RING_ABORTING)
327 			xcr->xcr_state = XHCI_COMMAND_RING_ABORT_DONE;
328 		cv_broadcast(&xcr->xcr_cv);
329 		mutex_exit(&xcr->xcr_lock);
330 		return (B_TRUE);
331 	}
332 
333 	xco = list_head(&xcr->xcr_commands);
334 	VERIFY(xco != NULL);
335 
336 	/*
337 	 * The current event should be pointed to by the ring's tail pointer.
338 	 * We need to check if this DMA address that we've been given matches
339 	 * the address that we'd expect for the tail.
340 	 */
341 	if (xhci_ring_trb_tail_valid(xrp, LE_64(trb->trb_addr)) == B_FALSE) {
342 		mutex_exit(&xcr->xcr_lock);
343 		return (B_TRUE);
344 	}
345 
346 	xco->xco_state = XHCI_COMMAND_S_RECEIVED;
347 	to = xcr->xcr_timeout;
348 	xcr->xcr_timeout = 0;
349 	if (xcr->xcr_state != XHCI_COMMAND_RING_ABORTING) {
350 		mutex_exit(&xcr->xcr_lock);
351 		(void) untimeout(to);
352 		mutex_enter(&xcr->xcr_lock);
353 	}
354 	rem = list_remove_head(&xcr->xcr_commands);
355 
356 	VERIFY3P(rem, ==, xco);
357 
358 	xco->xco_res.trb_addr = LE_64(trb->trb_addr);
359 	xco->xco_res.trb_status = LE_32(trb->trb_status);
360 	xco->xco_res.trb_flags = LE_32(trb->trb_flags);
361 	xco->xco_state = XHCI_COMMAND_S_DONE;
362 
363 	/*
364 	 * Advance the ring and wake up anyone who was waiting for a slot.
365 	 */
366 	if (xhci_ring_trb_consumed(xrp, LE_64(trb->trb_addr)) == B_FALSE) {
367 		/*
368 		 * Indicate that we need to do a runtime reset to the interrupt
369 		 * handler.
370 		 */
371 		mutex_exit(&xcr->xcr_lock);
372 		xhci_error(xhcip, "encountered invalid TRB head while "
373 		    "processing command ring: TRB with addr 0x%"PRIx64 " could "
374 		    "not be consumed", LE_64(trb->trb_addr));
375 		xhci_fm_runtime_reset(xhcip);
376 		return (B_FALSE);
377 	}
378 	cv_broadcast(&xcr->xcr_cv);
379 
380 	if (xcr->xcr_state < XHCI_COMMAND_RING_ABORTING) {
381 		if (list_is_empty(&xcr->xcr_commands) != 0) {
382 			xcr->xcr_state = XHCI_COMMAND_RING_IDLE;
383 		} else {
384 			xhci_command_settimeout(xhcip, xhci_command_wait);
385 		}
386 	}
387 	mutex_exit(&xcr->xcr_lock);
388 
389 	/*
390 	 * Now, let anyone waiting for this command to finish know it's done.
391 	 */
392 	cv_signal(&xco->xco_cv);
393 
394 	return (B_TRUE);
395 }
396 
397 static int
xhci_command_submit(xhci_t * xhcip,xhci_command_t * xco)398 xhci_command_submit(xhci_t *xhcip, xhci_command_t *xco)
399 {
400 	int ret;
401 	xhci_command_ring_t *xcr = &xhcip->xhci_command;
402 	xhci_ring_t *xrp = &xcr->xcr_ring;
403 
404 	mutex_enter(&xcr->xcr_lock);
405 
406 	while (xhci_ring_trb_space(xrp, 1U) == B_FALSE ||
407 	    xcr->xcr_state >= XHCI_COMMAND_RING_ABORTING) {
408 		cv_wait(&xcr->xcr_cv, &xcr->xcr_lock);
409 	}
410 
411 	xhci_ring_trb_put(xrp, &xco->xco_req);
412 	xco->xco_state = XHCI_COMMAND_S_QUEUED;
413 	list_insert_tail(&xcr->xcr_commands, xco);
414 
415 	/*
416 	 * Now, make sure the ring is synched up before we might ring the door
417 	 * bell and wake up the processor, if they're not currently doing so.
418 	 */
419 	XHCI_DMA_SYNC(xrp->xr_dma, DDI_DMA_SYNC_FORDEV);
420 	if (xhci_check_dma_handle(xhcip, &xrp->xr_dma) != DDI_FM_OK) {
421 		mutex_exit(&xcr->xcr_lock);
422 		xhci_error(xhcip, "encountered fatal FM error syncing command "
423 		    "ring DMA contents: resetting device");
424 		xhci_fm_runtime_reset(xhcip);
425 		return (USB_HC_HARDWARE_ERROR);
426 	}
427 
428 	/*
429 	 * Always ring the door bell. You never know what state the ring will be
430 	 * in, but we do know that we won't be waiting for an abort as we're
431 	 * protecting that state currently with the xcr_lock.
432 	 */
433 	xhci_put32(xhcip, XHCI_R_DOOR, XHCI_DOORBELL(0), 0);
434 	if (xhci_check_regs_acc(xhcip) != DDI_FM_OK) {
435 		mutex_exit(&xcr->xcr_lock);
436 		xhci_error(xhcip, "encountered fatal FM error ringing command "
437 		    "ring doorbell: resetting device");
438 		xhci_fm_runtime_reset(xhcip);
439 		return (USB_HC_HARDWARE_ERROR);
440 	}
441 
442 	/*
443 	 * If the command ring is currently considered idle, make sure to start
444 	 * up the timeout.
445 	 */
446 	if (xcr->xcr_state == XHCI_COMMAND_RING_IDLE) {
447 		VERIFY(xcr->xcr_timeout == 0);
448 
449 		xhci_command_settimeout(xhcip, xhci_command_wait);
450 		xcr->xcr_state = XHCI_COMMAND_RING_RUNNING;
451 	}
452 
453 	while (xco->xco_state < XHCI_COMMAND_S_DONE)
454 		cv_wait(&xco->xco_cv, &xcr->xcr_lock);
455 
456 	/*
457 	 * When we return USB_SUCCESS, the actual error is returned in the
458 	 * command's structure.
459 	 */
460 	if (xco->xco_state == XHCI_COMMAND_S_DONE)
461 		ret = USB_SUCCESS;
462 	else
463 		ret = USB_HC_HARDWARE_ERROR;
464 	mutex_exit(&xcr->xcr_lock);
465 
466 	return (ret);
467 }
468 
469 int
xhci_command_enable_slot(xhci_t * xhcip,uint8_t * slotp)470 xhci_command_enable_slot(xhci_t *xhcip, uint8_t *slotp)
471 {
472 	int ret;
473 	uint8_t slot, code;
474 	xhci_command_t co;
475 
476 	VERIFY(xhcip != NULL);
477 	VERIFY(slotp != NULL);
478 
479 	xhci_command_init(&co);
480 
481 	/*
482 	 * Note, the slot type is supposed to vary depending on the protocol
483 	 * type. However, XHCI 1.1/7.2.2.1.4 explicitly says that this will
484 	 * always be set to zero for both USB 2 and USB 3, hence why we hardcode
485 	 * this to zero and thus only have the command to enable the slot set
486 	 * below.
487 	 */
488 	co.xco_req.trb_flags = LE_32(XHCI_CMD_ENABLE_SLOT) |
489 	    XHCI_TRB_SET_STYPE(0);
490 	ret = xhci_command_submit(xhcip, &co);
491 	if (ret != 0)
492 		goto done;
493 
494 	code = XHCI_TRB_GET_CODE(co.xco_res.trb_status);
495 	slot = XHCI_TRB_GET_SLOT(co.xco_res.trb_flags);
496 
497 	if (code == XHCI_CODE_SUCCESS) {
498 		*slotp = slot;
499 		ret = USB_SUCCESS;
500 	} else if (code == XHCI_CODE_NO_SLOTS) {
501 		ret = USB_NO_RESOURCES;
502 	} else if (code == XHCI_CODE_CMD_ABORTED) {
503 		ret = USB_CR_TIMEOUT;
504 	} else {
505 		ret = USB_HC_HARDWARE_ERROR;
506 		xhci_log(xhcip, "!unexpected error when enabling slot: "
507 		    "%d", code);
508 	}
509 
510 done:
511 	xhci_command_fini(&co);
512 	return (ret);
513 }
514 
515 int
xhci_command_disable_slot(xhci_t * xhcip,uint8_t slot)516 xhci_command_disable_slot(xhci_t *xhcip, uint8_t slot)
517 {
518 	int ret, code;
519 	xhci_command_t co;
520 
521 	VERIFY(xhcip != NULL);
522 
523 	xhci_command_init(&co);
524 	co.xco_req.trb_flags = LE_32(XHCI_CMD_DISABLE_SLOT |
525 	    XHCI_TRB_SET_SLOT(slot));
526 	ret = xhci_command_submit(xhcip, &co);
527 	if (ret != 0)
528 		goto done;
529 
530 	code = XHCI_TRB_GET_CODE(co.xco_res.trb_status);
531 	if (code == XHCI_CODE_SUCCESS) {
532 		ret = USB_SUCCESS;
533 	} else if (code == XHCI_CODE_CMD_ABORTED) {
534 		ret = USB_CR_TIMEOUT;
535 	} else {
536 		ret = USB_HC_HARDWARE_ERROR;
537 		xhci_log(xhcip, "!unexpected error when disabling slot: "
538 		    "%d", code);
539 	}
540 
541 done:
542 	xhci_command_fini(&co);
543 	return (ret);
544 }
545 
546 int
xhci_command_set_address(xhci_t * xhcip,xhci_device_t * xd,boolean_t bsr)547 xhci_command_set_address(xhci_t *xhcip, xhci_device_t *xd, boolean_t bsr)
548 {
549 	int ret, code;
550 	xhci_command_t co;
551 
552 	VERIFY(xhcip != NULL);
553 	VERIFY(xd != NULL);
554 
555 	xhci_command_init(&co);
556 	co.xco_req.trb_addr = LE_64(xhci_dma_pa(&xd->xd_ictx));
557 	co.xco_req.trb_status = 0;
558 	co.xco_req.trb_flags = LE_32(XHCI_CMD_ADDRESS_DEVICE |
559 	    XHCI_TRB_SET_SLOT(xd->xd_slot));
560 	if (bsr == B_TRUE)
561 		co.xco_req.trb_flags |= LE_32(XHCI_TRB_BSR);
562 
563 	ret = xhci_command_submit(xhcip, &co);
564 	if (ret != 0)
565 		goto done;
566 
567 	code = XHCI_TRB_GET_CODE(co.xco_res.trb_status);
568 	if (code == XHCI_CODE_SUCCESS) {
569 		ret = USB_SUCCESS;
570 	} else if (code == XHCI_CODE_CMD_ABORTED) {
571 		ret = USB_CR_TIMEOUT;
572 	} else {
573 		ret = USB_HC_HARDWARE_ERROR;
574 		xhci_log(xhcip, "!unexpected error when setting address: "
575 		    "%d", code);
576 	}
577 done:
578 	xhci_command_fini(&co);
579 	return (ret);
580 }
581 
582 int
xhci_command_configure_endpoint(xhci_t * xhcip,xhci_device_t * xd)583 xhci_command_configure_endpoint(xhci_t *xhcip, xhci_device_t *xd)
584 {
585 	int ret, code;
586 	xhci_command_t co;
587 
588 	VERIFY(xhcip != NULL);
589 	VERIFY(xd != NULL);
590 
591 	xhci_command_init(&co);
592 	co.xco_req.trb_addr = LE_64(xhci_dma_pa(&xd->xd_ictx));
593 	co.xco_req.trb_status = LE_32(0);
594 	co.xco_req.trb_flags = LE_32(XHCI_CMD_CONFIG_EP |
595 	    XHCI_TRB_SET_SLOT(xd->xd_slot));
596 
597 	ret = xhci_command_submit(xhcip, &co);
598 	if (ret != 0)
599 		goto done;
600 	code = XHCI_TRB_GET_CODE(co.xco_res.trb_status);
601 	switch (code) {
602 	case XHCI_CODE_SUCCESS:
603 		ret = USB_SUCCESS;
604 		break;
605 	case XHCI_CODE_CMD_ABORTED:
606 		ret = USB_CR_TIMEOUT;
607 		break;
608 	case XHCI_CODE_SLOT_NOT_ON:
609 		xhci_log(xhcip, "!failed to configure endpoints for slot %d, "
610 		    "slot not on, likely driver bug!", xd->xd_slot);
611 		ret = USB_FAILURE;
612 		break;
613 	case XHCI_CODE_BANDWIDTH:
614 		ret = USB_NO_BANDWIDTH;
615 		break;
616 	case XHCI_CODE_RESOURCE:
617 		ret = USB_NO_RESOURCES;
618 		break;
619 	default:
620 		ret = USB_HC_HARDWARE_ERROR;
621 		xhci_log(xhcip, "!unexpected error when configuring enpoints: "
622 		    "%d", code);
623 		break;
624 	}
625 done:
626 	xhci_command_fini(&co);
627 	return (ret);
628 }
629 
630 int
xhci_command_evaluate_context(xhci_t * xhcip,xhci_device_t * xd)631 xhci_command_evaluate_context(xhci_t *xhcip, xhci_device_t *xd)
632 {
633 	int ret, code;
634 	xhci_command_t co;
635 
636 	VERIFY(xhcip != NULL);
637 	VERIFY(xd != NULL);
638 
639 	xhci_command_init(&co);
640 	co.xco_req.trb_addr = LE_64(xhci_dma_pa(&xd->xd_ictx));
641 	co.xco_req.trb_status = LE_32(0);
642 	co.xco_req.trb_flags = LE_32(XHCI_CMD_EVAL_CTX |
643 	    XHCI_TRB_SET_SLOT(xd->xd_slot));
644 
645 	ret = xhci_command_submit(xhcip, &co);
646 	if (ret != 0)
647 		goto done;
648 	code = XHCI_TRB_GET_CODE(co.xco_res.trb_status);
649 	switch (code) {
650 	case XHCI_CODE_SUCCESS:
651 		ret = USB_SUCCESS;
652 		break;
653 	case XHCI_CODE_CMD_ABORTED:
654 		ret = USB_CR_TIMEOUT;
655 		break;
656 	case XHCI_CODE_SLOT_NOT_ON:
657 		xhci_log(xhcip, "!failed to evaluate endpoints for slot %d, "
658 		    "slot not on, likely driver bug!", xd->xd_slot);
659 		ret = USB_FAILURE;
660 		break;
661 	default:
662 		ret = USB_HC_HARDWARE_ERROR;
663 		xhci_log(xhcip, "!unexpected error when evaluating enpoints: "
664 		    "%d", code);
665 		break;
666 	}
667 done:
668 	xhci_command_fini(&co);
669 	return (ret);
670 
671 }
672 
673 int
xhci_command_reset_endpoint(xhci_t * xhcip,xhci_device_t * xd,xhci_endpoint_t * xep)674 xhci_command_reset_endpoint(xhci_t *xhcip, xhci_device_t *xd,
675     xhci_endpoint_t *xep)
676 {
677 	int ret, code;
678 	xhci_command_t co;
679 
680 	VERIFY(xhcip != NULL);
681 	VERIFY(xd != NULL);
682 	VERIFY(xep != NULL);
683 
684 	xhci_command_init(&co);
685 
686 	co.xco_req.trb_addr = LE_64(0);
687 	co.xco_req.trb_status = LE_32(0);
688 	co.xco_req.trb_flags = LE_32(XHCI_CMD_RESET_EP |
689 	    XHCI_TRB_SET_SLOT(xd->xd_slot) |
690 	    XHCI_TRB_SET_EP(xep->xep_num + 1));
691 
692 	ret = xhci_command_submit(xhcip, &co);
693 	if (ret != 0)
694 		goto done;
695 
696 	code = XHCI_TRB_GET_CODE(co.xco_res.trb_status);
697 	switch (code) {
698 	case XHCI_CODE_SUCCESS:
699 		ret = USB_SUCCESS;
700 		break;
701 	case XHCI_CODE_CMD_ABORTED:
702 		ret = USB_CR_TIMEOUT;
703 		break;
704 	case XHCI_CODE_CONTEXT_STATE:
705 	case XHCI_CODE_SLOT_NOT_ON:
706 		xhci_log(xhcip, "!xhci reset endpoint command: asked to modify "
707 		    "endpoint (%u)/slot (%d) in wrong state: %d", xep->xep_num,
708 		    xd->xd_slot, code);
709 		if (code == XHCI_CODE_CONTEXT_STATE) {
710 			xhci_endpoint_context_t *epctx;
711 
712 			epctx = xd->xd_endout[xep->xep_num];
713 			xhci_log(xhcip, "!endpoint is in state %d",
714 			    XHCI_EPCTX_STATE(epctx->xec_info));
715 		}
716 		ret = USB_INVALID_CONTEXT;
717 		break;
718 	default:
719 		ret = USB_HC_HARDWARE_ERROR;
720 		xhci_log(xhcip, "!unexpected error when resetting enpoint: %d",
721 		    code);
722 		break;
723 	}
724 
725 done:
726 	xhci_command_fini(&co);
727 	return (ret);
728 }
729 
730 int
xhci_command_set_tr_dequeue(xhci_t * xhcip,xhci_device_t * xd,xhci_endpoint_t * xep)731 xhci_command_set_tr_dequeue(xhci_t *xhcip, xhci_device_t *xd,
732     xhci_endpoint_t *xep)
733 {
734 	uint64_t pa;
735 	int ret, code;
736 	xhci_command_t co;
737 	xhci_ring_t *xrp;
738 
739 	VERIFY(xhcip != NULL);
740 	VERIFY(xd != NULL);
741 	VERIFY(xep != NULL);
742 
743 	xhci_command_init(&co);
744 
745 	xrp = &xep->xep_ring;
746 	pa = xhci_dma_pa(&xrp->xr_dma) + sizeof (xhci_trb_t) * xrp->xr_tail;
747 	pa |= xrp->xr_cycle;
748 	co.xco_req.trb_addr = LE_64(pa);
749 	co.xco_req.trb_status = LE_32(0);
750 	co.xco_req.trb_flags = LE_32(XHCI_CMD_SET_TR_DEQ |
751 	    XHCI_TRB_SET_SLOT(xd->xd_slot) |
752 	    XHCI_TRB_SET_EP(xep->xep_num + 1));
753 
754 	ret = xhci_command_submit(xhcip, &co);
755 	if (ret != 0)
756 		goto done;
757 
758 	code = XHCI_TRB_GET_CODE(co.xco_res.trb_status);
759 	switch (code) {
760 	case XHCI_CODE_SUCCESS:
761 		ret = USB_SUCCESS;
762 		break;
763 	case XHCI_CODE_CMD_ABORTED:
764 		ret = USB_CR_TIMEOUT;
765 		break;
766 	case XHCI_CODE_CONTEXT_STATE:
767 	case XHCI_CODE_SLOT_NOT_ON:
768 		xhci_log(xhcip, "!xhci set tr dequeue command: asked to modify "
769 		    "endpoint (%u)/slot (%d) in wrong state: %d", xep->xep_num,
770 		    xd->xd_slot, code);
771 		if (code == XHCI_CODE_CONTEXT_STATE) {
772 			xhci_endpoint_context_t *epctx;
773 
774 			epctx = xd->xd_endout[xep->xep_num];
775 			xhci_log(xhcip, "!endpoint is in state %d",
776 			    XHCI_EPCTX_STATE(epctx->xec_info));
777 		}
778 		ret = USB_INVALID_CONTEXT;
779 		break;
780 	default:
781 		ret = USB_HC_HARDWARE_ERROR;
782 		xhci_log(xhcip, "!unexpected error when resetting enpoint: %d",
783 		    code);
784 		break;
785 	}
786 
787 done:
788 	xhci_command_fini(&co);
789 	return (ret);
790 
791 }
792 
793 int
xhci_command_stop_endpoint(xhci_t * xhcip,xhci_device_t * xd,xhci_endpoint_t * xep)794 xhci_command_stop_endpoint(xhci_t *xhcip, xhci_device_t *xd,
795     xhci_endpoint_t *xep)
796 {
797 	int ret, code;
798 	xhci_command_t co;
799 
800 	VERIFY(xhcip != NULL);
801 	VERIFY(xd != NULL);
802 	VERIFY(xep != NULL);
803 
804 	xhci_command_init(&co);
805 
806 	co.xco_req.trb_addr = LE_64(0);
807 	co.xco_req.trb_status = LE_32(0);
808 	co.xco_req.trb_flags = LE_32(XHCI_CMD_STOP_EP |
809 	    XHCI_TRB_SET_SLOT(xd->xd_slot) |
810 	    XHCI_TRB_SET_EP(xep->xep_num + 1));
811 
812 	ret = xhci_command_submit(xhcip, &co);
813 	if (ret != 0)
814 		goto done;
815 
816 	code = XHCI_TRB_GET_CODE(co.xco_res.trb_status);
817 	switch (code) {
818 	case XHCI_CODE_SUCCESS:
819 		ret = USB_SUCCESS;
820 		break;
821 	case XHCI_CODE_CMD_ABORTED:
822 		ret = USB_CR_TIMEOUT;
823 		break;
824 	case XHCI_CODE_CONTEXT_STATE:
825 	case XHCI_CODE_SLOT_NOT_ON:
826 		xhci_log(xhcip, "!xhci stop endpoint command (%d)/slot "
827 		    "(%u) in wrong state: %d", xep->xep_num, xd->xd_slot,
828 		    code);
829 		if (code == XHCI_CODE_CONTEXT_STATE) {
830 			xhci_endpoint_context_t *epctx;
831 
832 			epctx = xd->xd_endout[xep->xep_num];
833 			xhci_log(xhcip, "!endpoint is in state %d",
834 			    XHCI_EPCTX_STATE(epctx->xec_info));
835 		}
836 		ret = USB_INVALID_CONTEXT;
837 		break;
838 	default:
839 		ret = USB_HC_HARDWARE_ERROR;
840 		xhci_log(xhcip, "!unexpected error when resetting enpoint: %d",
841 		    code);
842 		break;
843 	}
844 
845 done:
846 	xhci_command_fini(&co);
847 	return (ret);
848 }
849