xref: /haiku/src/add-ons/kernel/busses/usb/xhci.cpp (revision d02879c1859162b97165f6380bb6d0b82263bd72)
1 /*
2  * Copyright 2006-2014, Haiku Inc. All rights reserved.
3  * Distributed under the terms of the MIT License.
4  *
5  * Some code borrowed from the Haiku EHCI driver
6  *
7  * Authors:
8  *		Michael Lotz <mmlr@mlotz.ch>
9  * 		Jian Chiang <j.jian.chiang@gmail.com>
10  *		Jérôme Duval <jerome.duval@gmail.com>
11  *		Akshay Jaggi <akshay1994.leo@gmail.com>
12  */
13 
14 
15 #include <module.h>
16 #include <PCI.h>
17 #include <PCI_x86.h>
18 #include <USB3.h>
19 #include <KernelExport.h>
20 
21 #include <util/AutoLock.h>
22 
23 #include "xhci.h"
24 
25 #define USB_MODULE_NAME	"xhci"
26 
27 pci_module_info *XHCI::sPCIModule = NULL;
28 pci_x86_module_info *XHCI::sPCIx86Module = NULL;
29 
30 
31 static int32
32 xhci_std_ops(int32 op, ...)
33 {
34 	switch (op) {
35 		case B_MODULE_INIT:
36 			TRACE_MODULE("xhci init module\n");
37 			return B_OK;
38 		case B_MODULE_UNINIT:
39 			TRACE_MODULE("xhci uninit module\n");
40 			return B_OK;
41 	}
42 
43 	return EINVAL;
44 }
45 
46 
47 static const char*
48 xhci_error_string(uint32 error)
49 {
50 	switch (error) {
51 		case COMP_INVALID: return "Invalid";
52 		case COMP_SUCCESS: return "Success";
53 		case COMP_DATA_BUFFER: return "Data buffer";
54 		case COMP_BABBLE: return "Babble detected";
55 		case COMP_USB_TRANSACTION: return "USB transaction";
56 		case COMP_TRB: return "TRB";
57 		case COMP_STALL: return "Stall";
58 		case COMP_RESOURCE: return "Resource";
59 		case COMP_BANDWIDTH: return "Bandwidth";
60 		case COMP_NO_SLOTS: return "No slots";
61 		case COMP_INVALID_STREAM: return "Invalid stream";
62 		case COMP_SLOT_NOT_ENABLED: return "Slot not enabled";
63 		case COMP_ENDPOINT_NOT_ENABLED: return "Endpoint not enabled";
64 		case COMP_SHORT_PACKET: return "Short packet";
65 		case COMP_RING_UNDERRUN: return "Ring underrun";
66 		case COMP_RING_OVERRUN: return "Ring overrun";
67 		case COMP_VF_RING_FULL: return "VF Event Ring Full";
68 		case COMP_PARAMETER: return "Parameter";
69 		case COMP_BANDWIDTH_OVERRUN: return "Bandwidth overrun";
70 		case COMP_CONTEXT_STATE: return "Context state";
71 		case COMP_NO_PING_RESPONSE: return "No ping response";
72 		case COMP_EVENT_RING_FULL: return "Event ring full";
73 		case COMP_INCOMPATIBLE_DEVICE: return "Incompatible device";
74 		case COMP_MISSED_SERVICE: return "Missed service";
75 		case COMP_COMMAND_RING_STOPPED: return "Command ring stopped";
76 		case COMP_COMMAND_ABORTED: return "Command aborted";
77 		case COMP_STOPPED: return "Stopped";
78 		case COMP_LENGTH_INVALID: return "Length invalid";
79 		case COMP_MAX_EXIT_LATENCY: return "Max exit latency too large";
80 		case COMP_ISOC_OVERRUN: return "Isoch buffer overrun";
81 		case COMP_EVENT_LOST: return "Event lost";
82 		case COMP_UNDEFINED: return "Undefined";
83 		case COMP_INVALID_STREAM_ID: return "Invalid stream ID";
84 		case COMP_SECONDARY_BANDWIDTH: return "Secondary bandwidth";
85 		case COMP_SPLIT_TRANSACTION: return "Split transaction";
86 
87 		default: return "Undefined";
88 	}
89 }
90 
91 
92 usb_host_controller_info xhci_module = {
93 	{
94 		"busses/usb/xhci",
95 		0,
96 		xhci_std_ops
97 	},
98 	NULL,
99 	XHCI::AddTo
100 };
101 
102 
103 module_info *modules[] = {
104 	(module_info *)&xhci_module,
105 	NULL
106 };
107 
108 
109 XHCI::XHCI(pci_info *info, Stack *stack)
110 	:	BusManager(stack),
111 		fCapabilityRegisters(NULL),
112 		fOperationalRegisters(NULL),
113 		fRegisterArea(-1),
114 		fPCIInfo(info),
115 		fStack(stack),
116 		fIRQ(0),
117 		fUseMSI(false),
118 		fErstArea(-1),
119 		fDcbaArea(-1),
120 		fCmdCompSem(-1),
121 		fFinishTransfersSem(-1),
122 		fFinishThread(-1),
123 		fStopThreads(false),
124 		fFinishedHead(NULL),
125 		fRootHub(NULL),
126 		fRootHubAddress(0),
127 		fPortCount(0),
128 		fSlotCount(0),
129 		fScratchpadCount(0),
130 		fContextSizeShift(0),
131 		fEventSem(-1),
132 		fEventThread(-1),
133 		fEventIdx(0),
134 		fCmdIdx(0),
135 		fEventCcs(1),
136 		fCmdCcs(1)
137 {
138 	B_INITIALIZE_SPINLOCK(&fSpinlock);
139 
140 	if (BusManager::InitCheck() < B_OK) {
141 		TRACE_ERROR("bus manager failed to init\n");
142 		return;
143 	}
144 
145 	TRACE("constructing new XHCI host controller driver\n");
146 	fInitOK = false;
147 
148 	// enable busmaster and memory mapped access
149 	uint16 command = sPCIModule->read_pci_config(fPCIInfo->bus,
150 		fPCIInfo->device, fPCIInfo->function, PCI_command, 2);
151 	command &= ~(PCI_command_io | PCI_command_int_disable);
152 	command |= PCI_command_master | PCI_command_memory;
153 
154 	sPCIModule->write_pci_config(fPCIInfo->bus, fPCIInfo->device,
155 		fPCIInfo->function, PCI_command, 2, command);
156 
157 	// map the registers (low + high for 64-bit when requested)
158 	phys_addr_t physicalAddress = fPCIInfo->u.h0.base_registers[0];
159 	physicalAddress &= PCI_address_memory_32_mask;
160 	if ((fPCIInfo->u.h0.base_register_flags[0] & 0xC) == PCI_address_type_64)
161 		physicalAddress += (phys_addr_t)fPCIInfo->u.h0.base_registers[1] << 32;
162 
163 	uint32 offset = physicalAddress & (B_PAGE_SIZE - 1);
164 	phys_addr_t physicalAddressAligned = physicalAddress - offset;
165 	size_t mapSize = (fPCIInfo->u.h0.base_register_sizes[0]
166 		+ offset + B_PAGE_SIZE - 1) & ~(B_PAGE_SIZE - 1);
167 
168 	TRACE("map physical memory 0x%08" B_PRIx32 " : 0x%08" B_PRIx32 " "
169 		"(base: 0x%08" B_PRIxPHYSADDR "; offset: 0x%" B_PRIx32 ");"
170 		"size: %" B_PRId32 "\n", fPCIInfo->u.h0.base_registers[0],
171 		fPCIInfo->u.h0.base_registers[1], physicalAddress, offset,
172 		fPCIInfo->u.h0.base_register_sizes[0]);
173 
174 	fRegisterArea = map_physical_memory("XHCI memory mapped registers",
175 		physicalAddressAligned, mapSize, B_ANY_KERNEL_BLOCK_ADDRESS,
176 		B_KERNEL_READ_AREA | B_KERNEL_WRITE_AREA,
177 		(void **)&fCapabilityRegisters);
178 	if (fRegisterArea < B_OK) {
179 		TRACE("failed to map register memory\n");
180 		return;
181 	}
182 
183 	uint32 hciCapLength = ReadCapReg32(XHCI_HCI_CAPLENGTH);
184 	fCapabilityRegisters += offset;
185 	fCapabilityLength = HCI_CAPLENGTH(hciCapLength);
186 	TRACE("mapped capability length: 0x%" B_PRIx32 "\n", fCapabilityLength);
187 	fOperationalRegisters = fCapabilityRegisters + fCapabilityLength;
188 	fRuntimeRegisters = fCapabilityRegisters + ReadCapReg32(XHCI_RTSOFF);
189 	fDoorbellRegisters = fCapabilityRegisters + ReadCapReg32(XHCI_DBOFF);
190 	TRACE("mapped capability registers: 0x%p\n", fCapabilityRegisters);
191 	TRACE("mapped operational registers: 0x%p\n", fOperationalRegisters);
192 	TRACE("mapped runtime registers: 0x%p\n", fRuntimeRegisters);
193 	TRACE("mapped doorbell registers: 0x%p\n", fDoorbellRegisters);
194 
195 	TRACE_ALWAYS("interface version: 0x%04" B_PRIx32 "\n",
196 		HCI_VERSION(ReadCapReg32(XHCI_HCI_VERSION)));
197 	TRACE_ALWAYS("structural parameters: 1:0x%08" B_PRIx32 " 2:0x%08"
198 		B_PRIx32 " 3:0x%08" B_PRIx32 "\n", ReadCapReg32(XHCI_HCSPARAMS1),
199 		ReadCapReg32(XHCI_HCSPARAMS2), ReadCapReg32(XHCI_HCSPARAMS3));
200 	uint32 cparams = ReadCapReg32(XHCI_HCCPARAMS);
201 	TRACE_ALWAYS("capability params: 0x%08" B_PRIx32 "\n", cparams);
202 
203 	// if 64 bytes context structures, then 1
204 	fContextSizeShift = HCC_CSZ(cparams);
205 
206 	uint32 eec = 0xffffffff;
207 	uint32 eecp = HCS0_XECP(cparams) << 2;
208 	for (; eecp != 0 && XECP_NEXT(eec); eecp += XECP_NEXT(eec) << 2) {
209 		TRACE("eecp register: 0x%08" B_PRIx32 "\n", eecp);
210 
211 		eec = ReadCapReg32(eecp);
212 		if (XECP_ID(eec) != XHCI_LEGSUP_CAPID)
213 			continue;
214 
215 		if (eec & XHCI_LEGSUP_BIOSOWNED) {
216 			TRACE_ALWAYS("the host controller is bios owned, claiming"
217 				" ownership\n");
218 			WriteCapReg32(eecp, eec | XHCI_LEGSUP_OSOWNED);
219 
220 			for (int32 i = 0; i < 20; i++) {
221 				eec = ReadCapReg32(eecp);
222 
223 				if ((eec & XHCI_LEGSUP_BIOSOWNED) == 0)
224 					break;
225 
226 				TRACE_ALWAYS("controller is still bios owned, waiting\n");
227 				snooze(50000);
228 			}
229 
230 			if (eec & XHCI_LEGSUP_BIOSOWNED) {
231 				TRACE_ERROR("bios won't give up control over the host "
232 					"controller (ignoring)\n");
233 			} else if (eec & XHCI_LEGSUP_OSOWNED) {
234 				TRACE_ALWAYS("successfully took ownership of the host "
235 					"controller\n");
236 			}
237 
238 			// Force off the BIOS owned flag, and clear all SMIs. Some BIOSes
239 			// do indicate a successful handover but do not remove their SMIs
240 			// and then freeze the system when interrupts are generated.
241 			WriteCapReg32(eecp, eec & ~XHCI_LEGSUP_BIOSOWNED);
242 		}
243 		break;
244 	}
245 	uint32 legctlsts = ReadCapReg32(eecp + XHCI_LEGCTLSTS);
246 	legctlsts &= XHCI_LEGCTLSTS_DISABLE_SMI;
247 	legctlsts |= XHCI_LEGCTLSTS_EVENTS_SMI;
248 	WriteCapReg32(eecp + XHCI_LEGCTLSTS, legctlsts);
249 
250 	// On Intel's Panther Point and Lynx Point Chipset taking ownership
251 	// of EHCI owned ports, is what we do here.
252 	if (fPCIInfo->vendor_id == PCI_VENDOR_INTEL) {
253 		switch (fPCIInfo->device_id) {
254 			case PCI_DEVICE_INTEL_PANTHER_POINT_XHCI:
255 			case PCI_DEVICE_INTEL_LYNX_POINT_XHCI:
256 			case PCI_DEVICE_INTEL_LYNX_POINT_LP_XHCI:
257 			case PCI_DEVICE_INTEL_BAYTRAIL_XHCI:
258 			case PCI_DEVICE_INTEL_WILDCAT_POINT_XHCI:
259 			case PCI_DEVICE_INTEL_WILDCAT_POINT_LP_XHCI:
260 				_SwitchIntelPorts();
261 				break;
262 		}
263 	}
264 
265 	// halt the host controller
266 	if (ControllerHalt() < B_OK) {
267 		return;
268 	}
269 
270 	// reset the host controller
271 	if (ControllerReset() < B_OK) {
272 		TRACE_ERROR("host controller failed to reset\n");
273 		return;
274 	}
275 
276 	fCmdCompSem = create_sem(0, "XHCI Command Complete");
277 	fFinishTransfersSem = create_sem(0, "XHCI Finish Transfers");
278 	fEventSem = create_sem(0, "XHCI Event");
279 	if (fFinishTransfersSem < B_OK || fCmdCompSem < B_OK || fEventSem < B_OK) {
280 		TRACE_ERROR("failed to create semaphores\n");
281 		return;
282 	}
283 
284 	// create finisher service thread
285 	fFinishThread = spawn_kernel_thread(FinishThread, "xhci finish thread",
286 		B_NORMAL_PRIORITY, (void *)this);
287 	resume_thread(fFinishThread);
288 
289 	// create finisher service thread
290 	fEventThread = spawn_kernel_thread(EventThread, "xhci event thread",
291 		B_NORMAL_PRIORITY, (void *)this);
292 	resume_thread(fEventThread);
293 
294 	// Find the right interrupt vector, using MSIs if available.
295 	fIRQ = fPCIInfo->u.h0.interrupt_line;
296 	if (sPCIx86Module != NULL && sPCIx86Module->get_msi_count(fPCIInfo->bus,
297 			fPCIInfo->device, fPCIInfo->function) >= 1) {
298 		uint8 msiVector = 0;
299 		if (sPCIx86Module->configure_msi(fPCIInfo->bus, fPCIInfo->device,
300 				fPCIInfo->function, 1, &msiVector) == B_OK
301 			&& sPCIx86Module->enable_msi(fPCIInfo->bus, fPCIInfo->device,
302 				fPCIInfo->function) == B_OK) {
303 			TRACE_ALWAYS("using message signaled interrupts\n");
304 			fIRQ = msiVector;
305 			fUseMSI = true;
306 		}
307 	}
308 
309 	// Install the interrupt handler
310 	TRACE("installing interrupt handler\n");
311 	install_io_interrupt_handler(fIRQ, InterruptHandler, (void *)this, 0);
312 
313 	memset(fPortSpeeds, 0, sizeof(fPortSpeeds));
314 	memset(fPortSlots, 0, sizeof(fPortSlots));
315 	memset(fDevices, 0, sizeof(fDevices));
316 
317 	fInitOK = true;
318 	TRACE("XHCI host controller driver constructed\n");
319 }
320 
321 
322 XHCI::~XHCI()
323 {
324 	TRACE("tear down XHCI host controller driver\n");
325 
326 	WriteOpReg(XHCI_CMD, 0);
327 
328 	int32 result = 0;
329 	fStopThreads = true;
330 	delete_sem(fCmdCompSem);
331 	delete_sem(fFinishTransfersSem);
332 	delete_sem(fEventSem);
333 	wait_for_thread(fFinishThread, &result);
334 	wait_for_thread(fEventThread, &result);
335 
336 	remove_io_interrupt_handler(fIRQ, InterruptHandler, (void *)this);
337 
338 	delete_area(fRegisterArea);
339 	delete_area(fErstArea);
340 	for (uint32 i = 0; i < fScratchpadCount; i++)
341 		delete_area(fScratchpadArea[i]);
342 	delete_area(fDcbaArea);
343 
344 	if (fUseMSI && sPCIx86Module != NULL) {
345 		sPCIx86Module->disable_msi(fPCIInfo->bus,
346 			fPCIInfo->device, fPCIInfo->function);
347 		sPCIx86Module->unconfigure_msi(fPCIInfo->bus,
348 			fPCIInfo->device, fPCIInfo->function);
349 	}
350 	put_module(B_PCI_MODULE_NAME);
351 	if (sPCIx86Module != NULL) {
352 		sPCIx86Module = NULL;
353 		put_module(B_PCI_X86_MODULE_NAME);
354 	}
355 }
356 
357 
358 void
359 XHCI::_SwitchIntelPorts()
360 {
361 	TRACE("Intel xHC Controller\n");
362 	TRACE("Looking for EHCI owned ports\n");
363 	uint32 ports = sPCIModule->read_pci_config(fPCIInfo->bus,
364 		fPCIInfo->device, fPCIInfo->function, XHCI_INTEL_USB3PRM, 4);
365 	TRACE("Superspeed Ports: 0x%" B_PRIx32 "\n", ports);
366 	sPCIModule->write_pci_config(fPCIInfo->bus, fPCIInfo->device,
367 		fPCIInfo->function, XHCI_INTEL_USB3_PSSEN, 4, ports);
368 	ports = sPCIModule->read_pci_config(fPCIInfo->bus,
369 		fPCIInfo->device, fPCIInfo->function, XHCI_INTEL_USB3_PSSEN, 4);
370 	TRACE("Superspeed ports now under XHCI : 0x%" B_PRIx32 "\n", ports);
371 	ports = sPCIModule->read_pci_config(fPCIInfo->bus,
372 		fPCIInfo->device, fPCIInfo->function, XHCI_INTEL_USB2PRM, 4);
373 	TRACE("USB 2.0 Ports : 0x%" B_PRIx32 "\n", ports);
374 	sPCIModule->write_pci_config(fPCIInfo->bus, fPCIInfo->device,
375 		fPCIInfo->function, XHCI_INTEL_XUSB2PR, 4, ports);
376 	ports = sPCIModule->read_pci_config(fPCIInfo->bus,
377 		fPCIInfo->device, fPCIInfo->function, XHCI_INTEL_XUSB2PR, 4);
378 	TRACE("USB 2.0 ports now under XHCI: 0x%" B_PRIx32 "\n", ports);
379 }
380 
381 
382 status_t
383 XHCI::Start()
384 {
385 	TRACE_ALWAYS("starting XHCI host controller\n");
386 	TRACE("usbcmd: 0x%08" B_PRIx32 "; usbsts: 0x%08" B_PRIx32 "\n",
387 		ReadOpReg(XHCI_CMD), ReadOpReg(XHCI_STS));
388 
389 	if (WaitOpBits(XHCI_STS, STS_CNR, 0) != B_OK) {
390 		TRACE("Start() failed STS_CNR\n");
391 	}
392 
393 	if ((ReadOpReg(XHCI_CMD) & CMD_RUN) != 0) {
394 		TRACE_ERROR("Start() warning, starting running XHCI controller!\n");
395 	}
396 
397 	if ((ReadOpReg(XHCI_PAGESIZE) & (1 << 0)) == 0) {
398 		TRACE_ERROR("Controller does not support 4K page size.\n");
399 		return B_ERROR;
400 	}
401 
402 	// read port count from capability register
403 	uint32 capabilities = ReadCapReg32(XHCI_HCSPARAMS1);
404 	fPortCount = HCS_MAX_PORTS(capabilities);
405 	if (fPortCount == 0) {
406 		TRACE_ERROR("Invalid number of ports: %u\n", fPortCount);
407 		fPortCount = 0;
408 		return B_ERROR;
409 	}
410 	fSlotCount = HCS_MAX_SLOTS(capabilities);
411 	WriteOpReg(XHCI_CONFIG, fSlotCount);
412 
413 	// find out which protocol is used for each port
414 	uint8 portFound = 0;
415 	uint32 cparams = ReadCapReg32(XHCI_HCCPARAMS);
416 	uint32 eec = 0xffffffff;
417 	uint32 eecp = HCS0_XECP(cparams) << 2;
418 	for (; eecp != 0 && XECP_NEXT(eec) && portFound < fPortCount;
419 		eecp += XECP_NEXT(eec) << 2) {
420 		eec = ReadCapReg32(eecp);
421 		if (XECP_ID(eec) != XHCI_SUPPORTED_PROTOCOLS_CAPID)
422 			continue;
423 		if (XHCI_SUPPORTED_PROTOCOLS_0_MAJOR(eec) > 3)
424 			continue;
425 		uint32 temp = ReadCapReg32(eecp + 8);
426 		uint32 offset = XHCI_SUPPORTED_PROTOCOLS_1_OFFSET(temp);
427 		uint32 count = XHCI_SUPPORTED_PROTOCOLS_1_COUNT(temp);
428 		if (offset == 0 || count == 0)
429 			continue;
430 		offset--;
431 		for (uint32 i = offset; i < offset + count; i++) {
432 			if (XHCI_SUPPORTED_PROTOCOLS_0_MAJOR(eec) == 0x3)
433 				fPortSpeeds[i] = USB_SPEED_SUPER;
434 			else
435 				fPortSpeeds[i] = USB_SPEED_HIGHSPEED;
436 			TRACE("speed for port %" B_PRId32 " is %s\n", i,
437 				fPortSpeeds[i] == USB_SPEED_SUPER ? "super" : "high");
438 		}
439 		portFound += count;
440 	}
441 
442 	uint32 params2 = ReadCapReg32(XHCI_HCSPARAMS2);
443 	fScratchpadCount = HCS_MAX_SC_BUFFERS(params2);
444 	if (fScratchpadCount > XHCI_MAX_SCRATCHPADS) {
445 		TRACE_ERROR("Invalid number of scratchpads: %" B_PRIu32 "\n",
446 			fScratchpadCount);
447 		return B_ERROR;
448 	}
449 
450 	uint32 params3 = ReadCapReg32(XHCI_HCSPARAMS3);
451 	fExitLatMax = HCS_U1_DEVICE_LATENCY(params3)
452 		+ HCS_U2_DEVICE_LATENCY(params3);
453 
454 	WriteOpReg(XHCI_DNCTRL, 0);
455 
456 	// allocate Device Context Base Address array
457 	phys_addr_t dmaAddress;
458 	fDcbaArea = fStack->AllocateArea((void **)&fDcba, &dmaAddress,
459 		sizeof(*fDcba), "DCBA Area");
460 	if (fDcbaArea < B_OK) {
461 		TRACE_ERROR("unable to create the DCBA area\n");
462 		return B_ERROR;
463 	}
464 	memset(fDcba, 0, sizeof(*fDcba));
465 	memset(fScratchpadArea, 0, sizeof(fScratchpadArea));
466 	memset(fScratchpad, 0, sizeof(fScratchpad));
467 
468 	// setting the first address to the scratchpad array address
469 	fDcba->baseAddress[0] = dmaAddress
470 		+ offsetof(struct xhci_device_context_array, scratchpad);
471 
472 	// fill up the scratchpad array with scratchpad pages
473 	for (uint32 i = 0; i < fScratchpadCount; i++) {
474 		phys_addr_t scratchDmaAddress;
475 		fScratchpadArea[i] = fStack->AllocateArea((void **)&fScratchpad[i],
476 		&scratchDmaAddress, B_PAGE_SIZE, "Scratchpad Area");
477 		if (fScratchpadArea[i] < B_OK) {
478 			TRACE_ERROR("unable to create the scratchpad area\n");
479 			return B_ERROR;
480 		}
481 		fDcba->scratchpad[i] = scratchDmaAddress;
482 	}
483 
484 	TRACE("setting DCBAAP %" B_PRIxPHYSADDR "\n", dmaAddress);
485 	WriteOpReg(XHCI_DCBAAP_LO, (uint32)dmaAddress);
486 	WriteOpReg(XHCI_DCBAAP_HI, /*(uint32)(dmaAddress >> 32)*/0);
487 
488 	// allocate Event Ring Segment Table
489 	uint8 *addr;
490 	fErstArea = fStack->AllocateArea((void **)&addr, &dmaAddress,
491 		(XHCI_MAX_COMMANDS + XHCI_MAX_EVENTS) * sizeof(xhci_trb)
492 		+ sizeof(xhci_erst_element),
493 		"USB XHCI ERST CMD_RING and EVENT_RING Area");
494 
495 	if (fErstArea < B_OK) {
496 		TRACE_ERROR("unable to create the ERST AND RING area\n");
497 		delete_area(fDcbaArea);
498 		return B_ERROR;
499 	}
500 	fErst = (xhci_erst_element *)addr;
501 	memset(fErst, 0, (XHCI_MAX_COMMANDS + XHCI_MAX_EVENTS) * sizeof(xhci_trb)
502 		+ sizeof(xhci_erst_element));
503 
504 	// fill with Event Ring Segment Base Address and Event Ring Segment Size
505 	fErst->rs_addr = dmaAddress + sizeof(xhci_erst_element);
506 	fErst->rs_size = XHCI_MAX_EVENTS;
507 	fErst->rsvdz = 0;
508 
509 	addr += sizeof(xhci_erst_element);
510 	fEventRing = (xhci_trb *)addr;
511 	addr += XHCI_MAX_EVENTS * sizeof(xhci_trb);
512 	fCmdRing = (xhci_trb *)addr;
513 
514 	TRACE("setting ERST size\n");
515 	WriteRunReg32(XHCI_ERSTSZ(0), XHCI_ERSTS_SET(1));
516 
517 	TRACE("setting ERDP addr = 0x%" B_PRIx64 "\n", fErst->rs_addr);
518 	WriteRunReg32(XHCI_ERDP_LO(0), (uint32)fErst->rs_addr);
519 	WriteRunReg32(XHCI_ERDP_HI(0), /*(uint32)(fErst->rs_addr >> 32)*/0);
520 
521 	TRACE("setting ERST base addr = 0x%" B_PRIxPHYSADDR "\n", dmaAddress);
522 	WriteRunReg32(XHCI_ERSTBA_LO(0), (uint32)dmaAddress);
523 	WriteRunReg32(XHCI_ERSTBA_HI(0), /*(uint32)(dmaAddress >> 32)*/0);
524 
525 	dmaAddress += sizeof(xhci_erst_element) + XHCI_MAX_EVENTS
526 		* sizeof(xhci_trb);
527 
528 	// Make sure the Command Ring is stopped
529 	if ((ReadOpReg(XHCI_CRCR_LO) & CRCR_CRR) != 0) {
530 		TRACE_ALWAYS("Command Ring is running, send stop/cancel\n");
531 		WriteOpReg(XHCI_CRCR_LO, CRCR_CS);
532 		WriteOpReg(XHCI_CRCR_HI, 0);
533 		WriteOpReg(XHCI_CRCR_LO, CRCR_CA);
534 		WriteOpReg(XHCI_CRCR_HI, 0);
535 		snooze(1000);
536 		if ((ReadOpReg(XHCI_CRCR_LO) & CRCR_CRR) != 0) {
537 			TRACE_ERROR("Command Ring still running after stop/cancel\n");
538 		}
539 	}
540 	TRACE("setting CRCR addr = 0x%" B_PRIxPHYSADDR "\n", dmaAddress);
541 	WriteOpReg(XHCI_CRCR_LO, (uint32)dmaAddress | CRCR_RCS);
542 	WriteOpReg(XHCI_CRCR_HI, /*(uint32)(dmaAddress >> 32)*/0);
543 	// link trb
544 	fCmdRing[XHCI_MAX_COMMANDS - 1].qwtrb0 = dmaAddress;
545 
546 	TRACE("setting interrupt rate\n");
547 
548 	// Setting IMOD below 0x3F8 on Intel Lynx Point can cause IRQ lockups
549 	if (fPCIInfo->vendor_id == PCI_VENDOR_INTEL
550 		&& (fPCIInfo->device_id == PCI_DEVICE_INTEL_PANTHER_POINT_XHCI
551 			|| fPCIInfo->device_id == PCI_DEVICE_INTEL_LYNX_POINT_XHCI
552 			|| fPCIInfo->device_id == PCI_DEVICE_INTEL_LYNX_POINT_LP_XHCI
553 			|| fPCIInfo->device_id == PCI_DEVICE_INTEL_BAYTRAIL_XHCI
554 			|| fPCIInfo->device_id == PCI_DEVICE_INTEL_WILDCAT_POINT_XHCI)) {
555 		WriteRunReg32(XHCI_IMOD(0), 0x000003f8); // 4000 irq/s
556 	} else {
557 		WriteRunReg32(XHCI_IMOD(0), 0x000001f4); // 8000 irq/s
558 	}
559 
560 	TRACE("enabling interrupt\n");
561 	WriteRunReg32(XHCI_IMAN(0), ReadRunReg32(XHCI_IMAN(0)) | IMAN_INTR_ENA);
562 
563 	WriteOpReg(XHCI_CMD, CMD_RUN | CMD_INTE | CMD_HSEE);
564 
565 	// wait for start up state
566 	if (WaitOpBits(XHCI_STS, STS_HCH, 0) != B_OK) {
567 		TRACE_ERROR("HCH start up timeout\n");
568 	}
569 
570 	fRootHubAddress = AllocateAddress();
571 	fRootHub = new(std::nothrow) XHCIRootHub(RootObject(), fRootHubAddress);
572 	if (!fRootHub) {
573 		TRACE_ERROR("no memory to allocate root hub\n");
574 		return B_NO_MEMORY;
575 	}
576 
577 	if (fRootHub->InitCheck() < B_OK) {
578 		TRACE_ERROR("root hub failed init check\n");
579 		return fRootHub->InitCheck();
580 	}
581 
582 	SetRootHub(fRootHub);
583 
584 	TRACE_ALWAYS("successfully started the controller\n");
585 #ifdef TRACE_USB
586 	TRACE("No-Op test...\n");
587 	status_t noopResult = Noop();
588 	TRACE("No-Op %ssuccessful\n", noopResult < B_OK ? "un" : "");
589 #endif
590 
591 	//DumpRing(fCmdRing, (XHCI_MAX_COMMANDS - 1));
592 
593 	return BusManager::Start();
594 }
595 
596 
597 status_t
598 XHCI::SubmitTransfer(Transfer *transfer)
599 {
600 	// short circuit the root hub
601 	if (transfer->TransferPipe()->DeviceAddress() == fRootHubAddress)
602 		return fRootHub->ProcessTransfer(this, transfer);
603 
604 	TRACE("SubmitTransfer()\n");
605 	Pipe *pipe = transfer->TransferPipe();
606 	if ((pipe->Type() & USB_OBJECT_ISO_PIPE) != 0)
607 		return B_UNSUPPORTED;
608 	if ((pipe->Type() & USB_OBJECT_CONTROL_PIPE) != 0)
609 		return SubmitControlRequest(transfer);
610 	return SubmitNormalRequest(transfer);
611 }
612 
613 
614 status_t
615 XHCI::SubmitControlRequest(Transfer *transfer)
616 {
617 	Pipe *pipe = transfer->TransferPipe();
618 	usb_request_data *requestData = transfer->RequestData();
619 	bool directionIn = (requestData->RequestType & USB_REQTYPE_DEVICE_IN) != 0;
620 
621 	TRACE("SubmitControlRequest() length %d\n", requestData->Length);
622 
623 	xhci_td *setupDescriptor = CreateDescriptor(requestData->Length);
624 
625 	// set SetupStage
626 	uint8 index = 0;
627 	setupDescriptor->trbs[index].qwtrb0 = 0;
628 	setupDescriptor->trbs[index].dwtrb2 = TRB_2_IRQ(0) | TRB_2_BYTES(8);
629 	setupDescriptor->trbs[index].dwtrb3
630 		= B_HOST_TO_LENDIAN_INT32(TRB_3_TYPE(TRB_TYPE_SETUP_STAGE)
631 			| TRB_3_IDT_BIT | TRB_3_CYCLE_BIT);
632 	if (requestData->Length > 0) {
633 		setupDescriptor->trbs[index].dwtrb3 |= B_HOST_TO_LENDIAN_INT32(
634 			directionIn ? TRB_3_TRT_IN : TRB_3_TRT_OUT);
635 	}
636 	memcpy(&setupDescriptor->trbs[index].qwtrb0, requestData,
637 		sizeof(usb_request_data));
638 
639 	index++;
640 
641 	if (requestData->Length > 0) {
642 		// set DataStage if any
643 		setupDescriptor->trbs[index].qwtrb0 = setupDescriptor->buffer_phy[0];
644 		setupDescriptor->trbs[index].dwtrb2 = TRB_2_IRQ(0)
645 			| TRB_2_BYTES(requestData->Length)
646 			| TRB_2_TD_SIZE(transfer->VectorCount());
647 		setupDescriptor->trbs[index].dwtrb3 = B_HOST_TO_LENDIAN_INT32(
648 			TRB_3_TYPE(TRB_TYPE_DATA_STAGE)
649 				| (directionIn ? (TRB_3_DIR_IN | TRB_3_ISP_BIT) : 0)
650 				| TRB_3_CYCLE_BIT);
651 
652 		// TODO copy data for out transfers
653 		index++;
654 	}
655 
656 	// set StatusStage
657 	setupDescriptor->trbs[index].dwtrb2 = TRB_2_IRQ(0);
658 	setupDescriptor->trbs[index].dwtrb3 = B_HOST_TO_LENDIAN_INT32(
659 		TRB_3_TYPE(TRB_TYPE_STATUS_STAGE)
660 			| ((directionIn && requestData->Length > 0) ? 0 : TRB_3_DIR_IN)
661 			| TRB_3_IOC_BIT | TRB_3_CYCLE_BIT);
662 
663 	setupDescriptor->trb_count = index + 1;
664 
665 	xhci_endpoint *endpoint = (xhci_endpoint *)pipe->ControllerCookie();
666 	uint8 id = XHCI_ENDPOINT_ID(pipe);
667 	if (id >= XHCI_MAX_ENDPOINTS) {
668 		TRACE_ERROR("Invalid Endpoint");
669 		return B_BAD_VALUE;
670 	}
671 	setupDescriptor->transfer = transfer;
672 	transfer->InitKernelAccess();
673 	_LinkDescriptorForPipe(setupDescriptor, endpoint);
674 
675 	TRACE("SubmitControlRequest() request linked\n");
676 
677 	TRACE("Endpoint status 0x%08" B_PRIx32 " 0x%08" B_PRIx32 " 0x%016" B_PRIx64 "\n",
678 		_ReadContext(&endpoint->device->device_ctx->endpoints[id - 1].dwendpoint0),
679 		_ReadContext(&endpoint->device->device_ctx->endpoints[id - 1].dwendpoint1),
680 		_ReadContext(&endpoint->device->device_ctx->endpoints[id - 1].qwendpoint2));
681 	Ring(endpoint->device->slot, id);
682 	TRACE("Endpoint status 0x%08" B_PRIx32 " 0x%08" B_PRIx32 " 0x%016" B_PRIx64 "\n",
683 		_ReadContext(&endpoint->device->device_ctx->endpoints[id - 1].dwendpoint0),
684 		_ReadContext(&endpoint->device->device_ctx->endpoints[id - 1].dwendpoint1),
685 		_ReadContext(&endpoint->device->device_ctx->endpoints[id - 1].qwendpoint2));
686 	return B_OK;
687 }
688 
689 
690 status_t
691 XHCI::SubmitNormalRequest(Transfer *transfer)
692 {
693 	TRACE("SubmitNormalRequest() length %ld\n", transfer->DataLength());
694 	Pipe *pipe = transfer->TransferPipe();
695 	uint8 id = XHCI_ENDPOINT_ID(pipe);
696 	if (id >= XHCI_MAX_ENDPOINTS)
697 		return B_BAD_VALUE;
698 	bool directionIn = (pipe->Direction() == Pipe::In);
699 
700 	int32 trbCount = 0;
701 	xhci_td *descriptor = CreateDescriptorChain(transfer->DataLength(), trbCount);
702 	if (descriptor == NULL)
703 		return B_NO_MEMORY;
704 
705 	xhci_td *td_chain = descriptor;
706 	xhci_td *last = descriptor;
707 	int32 rest = trbCount - 1;
708 
709 	// set NormalStage
710 	while (td_chain != NULL) {
711 		td_chain->trb_count = td_chain->buffer_count;
712 		uint8 index;
713 		for (index = 0; index < td_chain->buffer_count; index++) {
714 			td_chain->trbs[index].qwtrb0 = descriptor->buffer_phy[index];
715 			td_chain->trbs[index].dwtrb2 = TRB_2_IRQ(0)
716 				| TRB_2_BYTES(descriptor->buffer_size[index])
717 				| TRB_2_TD_SIZE(rest);
718 			td_chain->trbs[index].dwtrb3 = B_HOST_TO_LENDIAN_INT32(
719 				TRB_3_TYPE(TRB_TYPE_NORMAL) | TRB_3_CYCLE_BIT | TRB_3_CHAIN_BIT
720 					| (directionIn ? TRB_3_ISP_BIT : 0));
721 			rest--;
722 		}
723 		// link next td, if any
724 		if (td_chain->next_chain != NULL) {
725 			td_chain->trbs[td_chain->trb_count].qwtrb0 = td_chain->next_chain->this_phy;
726 			td_chain->trbs[td_chain->trb_count].dwtrb2 = TRB_2_IRQ(0);
727 			td_chain->trbs[td_chain->trb_count].dwtrb3
728 				= B_HOST_TO_LENDIAN_INT32(TRB_3_TYPE(TRB_TYPE_LINK)
729 					| TRB_3_CYCLE_BIT | TRB_3_CHAIN_BIT);
730 		}
731 
732 		last = td_chain;
733 		td_chain = td_chain->next_chain;
734 	}
735 
736 	if (last->trb_count > 0) {
737 		last->trbs[last->trb_count - 1].dwtrb3
738 			|= B_HOST_TO_LENDIAN_INT32(TRB_3_IOC_BIT);
739 		last->trbs[last->trb_count - 1].dwtrb3
740 			&= B_HOST_TO_LENDIAN_INT32(~TRB_3_CHAIN_BIT);
741 	}
742 
743 	if (!directionIn) {
744 		TRACE("copying out iov count %ld\n", transfer->VectorCount());
745 		WriteDescriptorChain(descriptor, transfer->Vector(),
746 			transfer->VectorCount());
747 	}
748 	/*	memcpy(descriptor->buffer_log[index],
749 				(uint8 *)transfer->Vector()[index].iov_base, transfer->VectorLength());
750 		}*/
751 
752 	xhci_endpoint *endpoint = (xhci_endpoint *)pipe->ControllerCookie();
753 	descriptor->transfer = transfer;
754 	transfer->InitKernelAccess();
755 	_LinkDescriptorForPipe(descriptor, endpoint);
756 
757 	TRACE("SubmitNormalRequest() request linked\n");
758 
759 	TRACE("Endpoint status 0x%08" B_PRIx32 " 0x%08" B_PRIx32 " 0x%016" B_PRIx64 "\n",
760 		_ReadContext(&endpoint->device->device_ctx->endpoints[id - 1].dwendpoint0),
761 		_ReadContext(&endpoint->device->device_ctx->endpoints[id - 1].dwendpoint1),
762 		_ReadContext(&endpoint->device->device_ctx->endpoints[id - 1].qwendpoint2));
763 	Ring(endpoint->device->slot, id);
764 	TRACE("Endpoint status 0x%08" B_PRIx32 " 0x%08" B_PRIx32 " 0x%016" B_PRIx64 "\n",
765 		_ReadContext(&endpoint->device->device_ctx->endpoints[id - 1].dwendpoint0),
766 		_ReadContext(&endpoint->device->device_ctx->endpoints[id - 1].dwendpoint1),
767 		_ReadContext(&endpoint->device->device_ctx->endpoints[id - 1].qwendpoint2));
768 	return B_OK;
769 }
770 
771 
772 status_t
773 XHCI::CancelQueuedTransfers(Pipe *pipe, bool force)
774 {
775 	TRACE_ALWAYS("cancel queued transfers for pipe %p (%d)\n", pipe,
776 		pipe->EndpointAddress());
777 	return B_OK;
778 }
779 
780 
781 status_t
782 XHCI::NotifyPipeChange(Pipe *pipe, usb_change change)
783 {
784 	TRACE("pipe change %d for pipe %p (%d)\n", change, pipe,
785 		pipe->EndpointAddress());
786 	switch (change) {
787 		case USB_CHANGE_CREATED:
788 			_InsertEndpointForPipe(pipe);
789 			break;
790 		case USB_CHANGE_DESTROYED:
791 			_RemoveEndpointForPipe(pipe);
792 			break;
793 
794 		case USB_CHANGE_PIPE_POLICY_CHANGED: {
795 			// ToDo: for isochronous pipes we might need to adapt to new
796 			// pipe policy settings here
797 			break;
798 		}
799 	}
800 
801 	return B_OK;
802 }
803 
804 
805 status_t
806 XHCI::AddTo(Stack *stack)
807 {
808 #ifdef TRACE_USB
809 	set_dprintf_enabled(true);
810 #endif
811 
812 	if (!sPCIModule) {
813 		status_t status = get_module(B_PCI_MODULE_NAME,
814 			(module_info **)&sPCIModule);
815 		if (status < B_OK) {
816 			TRACE_MODULE_ERROR("getting pci module failed! 0x%08" B_PRIx32
817 				"\n", status);
818 			return status;
819 		}
820 	}
821 
822 	TRACE_MODULE("searching devices\n");
823 	bool found = false;
824 	pci_info *item = new(std::nothrow) pci_info;
825 	if (!item) {
826 		sPCIModule = NULL;
827 		put_module(B_PCI_MODULE_NAME);
828 		return B_NO_MEMORY;
829 	}
830 
831 	// Try to get the PCI x86 module as well so we can enable possible MSIs.
832 	if (sPCIx86Module == NULL && get_module(B_PCI_X86_MODULE_NAME,
833 			(module_info **)&sPCIx86Module) != B_OK) {
834 		// If it isn't there, that's not critical though.
835 		TRACE_MODULE_ERROR("failed to get pci x86 module\n");
836 		sPCIx86Module = NULL;
837 	}
838 
839 	for (int32 i = 0; sPCIModule->get_nth_pci_info(i, item) >= B_OK; i++) {
840 		if (item->class_base == PCI_serial_bus && item->class_sub == PCI_usb
841 			&& item->class_api == PCI_usb_xhci) {
842 			if (item->u.h0.interrupt_line == 0
843 				|| item->u.h0.interrupt_line == 0xFF) {
844 				TRACE_MODULE_ERROR("found device with invalid IRQ - check IRQ "
845 					"assignment\n");
846 				continue;
847 			}
848 
849 			TRACE_MODULE("found device at IRQ %u\n",
850 				item->u.h0.interrupt_line);
851 			XHCI *bus = new(std::nothrow) XHCI(item, stack);
852 			if (!bus) {
853 				delete item;
854 				sPCIModule = NULL;
855 				put_module(B_PCI_MODULE_NAME);
856 				return B_NO_MEMORY;
857 			}
858 
859 			if (bus->InitCheck() < B_OK) {
860 				TRACE_MODULE_ERROR("bus failed init check\n");
861 				delete bus;
862 				continue;
863 			}
864 
865 			// the bus took it away
866 			item = new(std::nothrow) pci_info;
867 
868 			bus->Start();
869 			stack->AddBusManager(bus);
870 			found = true;
871 		}
872 	}
873 
874 	if (!found) {
875 		TRACE_MODULE_ERROR("no devices found\n");
876 		delete item;
877 		sPCIModule = NULL;
878 		put_module(B_PCI_MODULE_NAME);
879 		return ENODEV;
880 	}
881 
882 	delete item;
883 	return B_OK;
884 }
885 
886 
887 xhci_td *
888 XHCI::CreateDescriptorChain(size_t bufferSize, int32 &trbCount)
889 {
890 	size_t packetSize = B_PAGE_SIZE * 16;
891 	trbCount = (bufferSize + packetSize - 1) / packetSize;
892 	// keep one trb for linking
893 	int32 tdCount = (trbCount + XHCI_MAX_TRBS_PER_TD - 2)
894 		/ (XHCI_MAX_TRBS_PER_TD - 1);
895 
896 	xhci_td *first = NULL;
897 	xhci_td *last = NULL;
898 	for (int32 i = 0; i < tdCount; i++) {
899 		xhci_td *descriptor = CreateDescriptor(0);
900 		if (!descriptor) {
901 			if (first != NULL)
902 				FreeDescriptor(first);
903 			return NULL;
904 		} else if (first == NULL)
905 			first = descriptor;
906 
907 		uint8 trbs = min_c(trbCount, XHCI_MAX_TRBS_PER_TD - 1);
908 		TRACE("CreateDescriptorChain trbs %d for td %" B_PRId32 "\n", trbs, i);
909 		for (int j = 0; j < trbs; j++) {
910 			if (fStack->AllocateChunk(&descriptor->buffer_log[j],
911 				&descriptor->buffer_phy[j],
912 				min_c(packetSize, bufferSize)) < B_OK) {
913 				TRACE_ERROR("unable to allocate space for the buffer (size %"
914 					B_PRIuSIZE ")\n", bufferSize);
915 				return NULL;
916 			}
917 
918 			descriptor->buffer_size[j] = min_c(packetSize, bufferSize);
919 			bufferSize -= descriptor->buffer_size[j];
920 			TRACE("CreateDescriptorChain allocated %ld for trb %d\n",
921 				descriptor->buffer_size[j], j);
922 		}
923 
924 		descriptor->buffer_count = trbs;
925 		trbCount -= trbs;
926 		if (last != NULL)
927 			last->next_chain = descriptor;
928 		last = descriptor;
929 	}
930 
931 	return first;
932 }
933 
934 
935 xhci_td *
936 XHCI::CreateDescriptor(size_t bufferSize)
937 {
938 	xhci_td *result;
939 	phys_addr_t physicalAddress;
940 
941 	if (fStack->AllocateChunk((void **)&result, &physicalAddress,
942 		sizeof(xhci_td)) < B_OK) {
943 		TRACE_ERROR("failed to allocate a transfer descriptor\n");
944 		return NULL;
945 	}
946 
947 	result->this_phy = physicalAddress;
948 	result->buffer_size[0] = bufferSize;
949 	result->trb_count = 0;
950 	result->buffer_count = 1;
951 	result->next = NULL;
952 	result->next_chain = NULL;
953 	if (bufferSize <= 0) {
954 		result->buffer_log[0] = NULL;
955 		result->buffer_phy[0] = 0;
956 		return result;
957 	}
958 
959 	if (fStack->AllocateChunk(&result->buffer_log[0],
960 		&result->buffer_phy[0], bufferSize) < B_OK) {
961 		TRACE_ERROR("unable to allocate space for the buffer (size %ld)\n",
962 			bufferSize);
963 		fStack->FreeChunk(result, result->this_phy, sizeof(xhci_td));
964 		return NULL;
965 	}
966 
967 	TRACE("CreateDescriptor allocated buffer_size %ld %p\n",
968 				result->buffer_size[0], result->buffer_log[0]);
969 
970 	return result;
971 }
972 
973 
974 void
975 XHCI::FreeDescriptor(xhci_td *descriptor)
976 {
977 	while (descriptor != NULL) {
978 
979 		for (int i = 0; i < descriptor->buffer_count; i++) {
980 			if (descriptor->buffer_size[i] == 0)
981 				continue;
982 			TRACE("FreeDescriptor buffer %d buffer_size %ld %p\n", i,
983 				descriptor->buffer_size[i], descriptor->buffer_log[i]);
984 			fStack->FreeChunk(descriptor->buffer_log[i],
985 				descriptor->buffer_phy[i], descriptor->buffer_size[i]);
986 		}
987 
988 		xhci_td *next = descriptor->next_chain;
989 		fStack->FreeChunk(descriptor, descriptor->this_phy,
990 			sizeof(xhci_td));
991 		descriptor = next;
992 	}
993 }
994 
995 
996 size_t
997 XHCI::WriteDescriptorChain(xhci_td *descriptor, iovec *vector,
998 	size_t vectorCount)
999 {
1000 	xhci_td *current = descriptor;
1001 	uint8 trbIndex = 0;
1002 	size_t actualLength = 0;
1003 	uint8 vectorIndex = 0;
1004 	size_t vectorOffset = 0;
1005 	size_t bufferOffset = 0;
1006 
1007 	while (current != NULL) {
1008 		if (current->buffer_log[0] == NULL)
1009 			break;
1010 
1011 		while (true) {
1012 			size_t length = min_c(current->buffer_size[trbIndex] - bufferOffset,
1013 				vector[vectorIndex].iov_len - vectorOffset);
1014 
1015 			TRACE("copying %ld bytes to bufferOffset %ld from"
1016 				" vectorOffset %ld at index %d of %ld\n", length, bufferOffset,
1017 				vectorOffset, vectorIndex, vectorCount);
1018 			memcpy((uint8 *)current->buffer_log[trbIndex] + bufferOffset,
1019 				(uint8 *)vector[vectorIndex].iov_base + vectorOffset, length);
1020 
1021 			actualLength += length;
1022 			vectorOffset += length;
1023 			bufferOffset += length;
1024 
1025 			if (vectorOffset >= vector[vectorIndex].iov_len) {
1026 				if (++vectorIndex >= vectorCount) {
1027 					TRACE("wrote descriptor chain (%ld bytes, no more vectors)\n",
1028 						actualLength);
1029 					return actualLength;
1030 				}
1031 
1032 				vectorOffset = 0;
1033 			}
1034 
1035 			if (bufferOffset >= current->buffer_size[trbIndex]) {
1036 				bufferOffset = 0;
1037 				if (++trbIndex >= current->buffer_count)
1038 					break;
1039 			}
1040 		}
1041 
1042 		current = current->next_chain;
1043 		trbIndex = 0;
1044 	}
1045 
1046 	TRACE("wrote descriptor chain (%ld bytes)\n", actualLength);
1047 	return actualLength;
1048 }
1049 
1050 
1051 size_t
1052 XHCI::ReadDescriptorChain(xhci_td *descriptor, iovec *vector,
1053 	size_t vectorCount)
1054 {
1055 	xhci_td *current = descriptor;
1056 	uint8 trbIndex = 0;
1057 	size_t actualLength = 0;
1058 	uint8 vectorIndex = 0;
1059 	size_t vectorOffset = 0;
1060 	size_t bufferOffset = 0;
1061 
1062 	while (current != NULL) {
1063 		if (current->buffer_log[0] == NULL)
1064 			break;
1065 
1066 		while (true) {
1067 			size_t length = min_c(current->buffer_size[trbIndex] - bufferOffset,
1068 				vector[vectorIndex].iov_len - vectorOffset);
1069 
1070 			TRACE("copying %ld bytes to vectorOffset %ld from"
1071 				" bufferOffset %ld at index %d of %ld\n", length, vectorOffset,
1072 				bufferOffset, vectorIndex, vectorCount);
1073 			memcpy((uint8 *)vector[vectorIndex].iov_base + vectorOffset,
1074 				(uint8 *)current->buffer_log[trbIndex] + bufferOffset, length);
1075 
1076 			actualLength += length;
1077 			vectorOffset += length;
1078 			bufferOffset += length;
1079 
1080 			if (vectorOffset >= vector[vectorIndex].iov_len) {
1081 				if (++vectorIndex >= vectorCount) {
1082 					TRACE("read descriptor chain (%ld bytes, no more vectors)\n",
1083 						actualLength);
1084 					return actualLength;
1085 				}
1086 				vectorOffset = 0;
1087 
1088 			}
1089 
1090 			if (bufferOffset >= current->buffer_size[trbIndex]) {
1091 				bufferOffset = 0;
1092 				if (++trbIndex >= current->buffer_count)
1093 					break;
1094 			}
1095 		}
1096 
1097 		current = current->next_chain;
1098 		trbIndex = 0;
1099 	}
1100 
1101 	TRACE("read descriptor chain (%ld bytes)\n", actualLength);
1102 	return actualLength;
1103 }
1104 
1105 
1106 Device *
1107 XHCI::AllocateDevice(Hub *parent, int8 hubAddress, uint8 hubPort,
1108 	usb_speed speed)
1109 {
1110 	TRACE("AllocateDevice hubAddress %d hubPort %d speed %d\n", hubAddress,
1111 		hubPort, speed);
1112 
1113 	uint8 slot = XHCI_MAX_SLOTS;
1114 	if (EnableSlot(&slot) != B_OK) {
1115 		TRACE_ERROR("AllocateDevice() failed enable slot\n");
1116 		return NULL;
1117 	}
1118 
1119 	if (slot == 0 || slot > fSlotCount) {
1120 		TRACE_ERROR("AllocateDevice() bad slot\n");
1121 		return NULL;
1122 	}
1123 
1124 	if (fDevices[slot].state != XHCI_STATE_DISABLED) {
1125 		TRACE_ERROR("AllocateDevice() slot already used\n");
1126 		return NULL;
1127 	}
1128 
1129 	struct xhci_device *device = &fDevices[slot];
1130 	memset(device, 0, sizeof(struct xhci_device));
1131 	device->state = XHCI_STATE_ENABLED;
1132 	device->slot = slot;
1133 
1134 	device->input_ctx_area = fStack->AllocateArea((void **)&device->input_ctx,
1135 		&device->input_ctx_addr, sizeof(*device->input_ctx) << fContextSizeShift,
1136 		"XHCI input context");
1137 	if (device->input_ctx_area < B_OK) {
1138 		TRACE_ERROR("unable to create a input context area\n");
1139 		device->state = XHCI_STATE_DISABLED;
1140 		return NULL;
1141 	}
1142 
1143 	memset(device->input_ctx, 0, sizeof(*device->input_ctx) << fContextSizeShift);
1144 	_WriteContext(&device->input_ctx->input.dropFlags, 0);
1145 	_WriteContext(&device->input_ctx->input.addFlags, 3);
1146 
1147 	uint32 route = 0;
1148 	uint8 routePort = hubPort;
1149 	uint8 rhPort = hubPort;
1150 	for (Device *hubDevice = parent; hubDevice != RootObject();
1151 		hubDevice = (Device *)hubDevice->Parent()) {
1152 
1153 		rhPort = routePort;
1154 		if (hubDevice->Parent() == RootObject())
1155 			break;
1156 		route *= 16;
1157 		if (hubPort > 15)
1158 			route += 15;
1159 		else
1160 			route += routePort;
1161 
1162 		routePort = hubDevice->HubPort();
1163 	}
1164 
1165 	// Get speed of port, only if device connected to root hub port
1166 	// else we have to rely on value reported by the Hub Explore thread
1167 	if (route == 0) {
1168 		GetPortSpeed(hubPort - 1, &speed);
1169 		TRACE("speed updated %d\n", speed);
1170 	}
1171 
1172 	uint32 dwslot0 = SLOT_0_NUM_ENTRIES(1) | SLOT_0_ROUTE(route);
1173 
1174 	// add the speed
1175 	switch (speed) {
1176 	case USB_SPEED_LOWSPEED:
1177 		dwslot0 |= SLOT_0_SPEED(2);
1178 		break;
1179 	case USB_SPEED_HIGHSPEED:
1180 		dwslot0 |= SLOT_0_SPEED(3);
1181 		break;
1182 	case USB_SPEED_FULLSPEED:
1183 		dwslot0 |= SLOT_0_SPEED(1);
1184 		break;
1185 	case USB_SPEED_SUPER:
1186 		dwslot0 |= SLOT_0_SPEED(4);
1187 		break;
1188 	default:
1189 		TRACE_ERROR("unknown usb speed\n");
1190 		break;
1191 	}
1192 
1193 	_WriteContext(&device->input_ctx->slot.dwslot0, dwslot0);
1194 	// TODO enable power save
1195 	_WriteContext(&device->input_ctx->slot.dwslot1, SLOT_1_RH_PORT(rhPort));
1196 	uint32 dwslot2 = SLOT_2_IRQ_TARGET(0);
1197 
1198 	// If LS/FS device connected to non-root HS device
1199 	if (route != 0 && parent->Speed() == USB_SPEED_HIGHSPEED
1200 		&& (speed == USB_SPEED_LOWSPEED || speed == USB_SPEED_FULLSPEED)) {
1201 		struct xhci_device *parenthub = (struct xhci_device *)
1202 			parent->ControllerCookie();
1203 		dwslot2 |= SLOT_2_PORT_NUM(hubPort);
1204 		dwslot2 |= SLOT_2_TT_HUB_SLOT(parenthub->slot);
1205 	}
1206 
1207 	_WriteContext(&device->input_ctx->slot.dwslot2, dwslot2);
1208 
1209 	_WriteContext(&device->input_ctx->slot.dwslot3, SLOT_3_SLOT_STATE(0)
1210 		| SLOT_3_DEVICE_ADDRESS(0));
1211 
1212 	TRACE("slot 0x%08" B_PRIx32 " 0x%08" B_PRIx32 " 0x%08" B_PRIx32 " 0x%08" B_PRIx32
1213 		"\n", _ReadContext(&device->input_ctx->slot.dwslot0),
1214 		_ReadContext(&device->input_ctx->slot.dwslot1),
1215 		_ReadContext(&device->input_ctx->slot.dwslot2),
1216 		_ReadContext(&device->input_ctx->slot.dwslot3));
1217 
1218 	device->device_ctx_area = fStack->AllocateArea((void **)&device->device_ctx,
1219 		&device->device_ctx_addr, sizeof(*device->device_ctx) << fContextSizeShift,
1220 		"XHCI device context");
1221 	if (device->device_ctx_area < B_OK) {
1222 		TRACE_ERROR("unable to create a device context area\n");
1223 		device->state = XHCI_STATE_DISABLED;
1224 		delete_area(device->input_ctx_area);
1225 		return NULL;
1226 	}
1227 	memset(device->device_ctx, 0, sizeof(*device->device_ctx) << fContextSizeShift);
1228 
1229 	device->trb_area = fStack->AllocateArea((void **)&device->trbs,
1230 		&device->trb_addr, sizeof(*device->trbs) * (XHCI_MAX_ENDPOINTS - 1)
1231 			* XHCI_MAX_TRANSFERS, "XHCI endpoint trbs");
1232 	if (device->trb_area < B_OK) {
1233 		TRACE_ERROR("unable to create a device trbs area\n");
1234 		device->state = XHCI_STATE_DISABLED;
1235 		delete_area(device->input_ctx_area);
1236 		delete_area(device->device_ctx_area);
1237 		return NULL;
1238 	}
1239 
1240 	// set up slot pointer to device context
1241 	fDcba->baseAddress[slot] = device->device_ctx_addr;
1242 
1243 	size_t maxPacketSize;
1244 	switch (speed) {
1245 	case USB_SPEED_LOWSPEED:
1246 	case USB_SPEED_FULLSPEED:
1247 		maxPacketSize = 8;
1248 		break;
1249 	case USB_SPEED_HIGHSPEED:
1250 		maxPacketSize = 64;
1251 		break;
1252 	default:
1253 		maxPacketSize = 512;
1254 		break;
1255 	}
1256 
1257 	// configure the Control endpoint 0 (type 4)
1258 	if (ConfigureEndpoint(slot, 0, 4, device->trb_addr, 0,
1259 		maxPacketSize, maxPacketSize & 0x7ff, speed) != B_OK) {
1260 		TRACE_ERROR("unable to configure default control endpoint\n");
1261 		device->state = XHCI_STATE_DISABLED;
1262 		delete_area(device->input_ctx_area);
1263 		delete_area(device->device_ctx_area);
1264 		delete_area(device->trb_area);
1265 		return NULL;
1266 	}
1267 
1268 	device->endpoints[0].device = device;
1269 	device->endpoints[0].td_head = NULL;
1270 	device->endpoints[0].trbs = device->trbs;
1271 	device->endpoints[0].used = 0;
1272 	device->endpoints[0].current = 0;
1273 	device->endpoints[0].trb_addr = device->trb_addr;
1274 	mutex_init(&device->endpoints[0].lock, "xhci endpoint lock");
1275 
1276 	// device should get to addressed state (bsr = 0)
1277 	if (SetAddress(device->input_ctx_addr, false, slot) != B_OK) {
1278 		TRACE_ERROR("unable to set address\n");
1279 		device->state = XHCI_STATE_DISABLED;
1280 		delete_area(device->input_ctx_area);
1281 		delete_area(device->device_ctx_area);
1282 		delete_area(device->trb_area);
1283 		return NULL;
1284 	}
1285 
1286 	device->state = XHCI_STATE_ADDRESSED;
1287 	device->address = SLOT_3_DEVICE_ADDRESS_GET(_ReadContext(
1288 		&device->device_ctx->slot.dwslot3));
1289 
1290 	TRACE("device: address 0x%x state 0x%08" B_PRIx32 "\n", device->address,
1291 		SLOT_3_SLOT_STATE_GET(_ReadContext(
1292 			&device->device_ctx->slot.dwslot3)));
1293 	TRACE("endpoint0 state 0x%08" B_PRIx32 "\n",
1294 		ENDPOINT_0_STATE_GET(_ReadContext(
1295 			&device->device_ctx->endpoints[0].dwendpoint0)));
1296 
1297 	// Create a temporary pipe with the new address
1298 	ControlPipe pipe(parent);
1299 	pipe.SetControllerCookie(&device->endpoints[0]);
1300 	pipe.InitCommon(device->address + 1, 0, speed, Pipe::Default, maxPacketSize, 0,
1301 		hubAddress, hubPort);
1302 
1303 	// Get the device descriptor
1304 	// Just retrieve the first 8 bytes of the descriptor -> minimum supported
1305 	// size of any device. It is enough because it includes the device type.
1306 
1307 	size_t actualLength = 0;
1308 	usb_device_descriptor deviceDescriptor;
1309 
1310 	TRACE("getting the device descriptor\n");
1311 	pipe.SendRequest(
1312 		USB_REQTYPE_DEVICE_IN | USB_REQTYPE_STANDARD,		// type
1313 		USB_REQUEST_GET_DESCRIPTOR,							// request
1314 		USB_DESCRIPTOR_DEVICE << 8,							// value
1315 		0,													// index
1316 		8,													// length
1317 		(void *)&deviceDescriptor,							// buffer
1318 		8,													// buffer length
1319 		&actualLength);										// actual length
1320 
1321 	if (actualLength != 8) {
1322 		TRACE_ERROR("error while getting the device descriptor\n");
1323 		device->state = XHCI_STATE_DISABLED;
1324 		delete_area(device->input_ctx_area);
1325 		delete_area(device->device_ctx_area);
1326 		delete_area(device->trb_area);
1327 		return NULL;
1328 	}
1329 
1330 	TRACE("device_class: %d device_subclass %d device_protocol %d\n",
1331 		deviceDescriptor.device_class, deviceDescriptor.device_subclass,
1332 		deviceDescriptor.device_protocol);
1333 
1334 	if (speed == USB_SPEED_FULLSPEED && deviceDescriptor.max_packet_size_0 != 8) {
1335 		TRACE("Full speed device with different max packet size for Endpoint 0\n");
1336 		uint32 dwendpoint1 = _ReadContext(
1337 			&device->input_ctx->endpoints[0].dwendpoint1);
1338 		dwendpoint1 &= ~ENDPOINT_1_MAXPACKETSIZE(0xffff);
1339 		dwendpoint1 |= ENDPOINT_1_MAXPACKETSIZE(
1340 			deviceDescriptor.max_packet_size_0);
1341 		_WriteContext(&device->input_ctx->endpoints[0].dwendpoint1,
1342 			dwendpoint1);
1343 		_WriteContext(&device->input_ctx->input.dropFlags, 0);
1344 		_WriteContext(&device->input_ctx->input.addFlags, (1 << 1));
1345 		EvaluateContext(device->input_ctx_addr, device->slot);
1346 	}
1347 
1348 	Device *deviceObject = NULL;
1349 	if (deviceDescriptor.device_class == 0x09) {
1350 		TRACE("creating new Hub\n");
1351 		TRACE("getting the hub descriptor\n");
1352 		size_t actualLength = 0;
1353 		usb_hub_descriptor hubDescriptor;
1354 		pipe.SendRequest(
1355 			USB_REQTYPE_DEVICE_IN | USB_REQTYPE_CLASS,			// type
1356 			USB_REQUEST_GET_DESCRIPTOR,							// request
1357 			USB_DESCRIPTOR_HUB << 8,							// value
1358 			0,													// index
1359 			sizeof(usb_hub_descriptor),							// length
1360 			(void *)&hubDescriptor,								// buffer
1361 			sizeof(usb_hub_descriptor),							// buffer length
1362 			&actualLength);
1363 
1364 		if (actualLength != sizeof(usb_hub_descriptor)) {
1365 			TRACE_ERROR("error while getting the hub descriptor\n");
1366 			device->state = XHCI_STATE_DISABLED;
1367 			delete_area(device->input_ctx_area);
1368 			delete_area(device->device_ctx_area);
1369 			delete_area(device->trb_area);
1370 			return NULL;
1371 		}
1372 
1373 		uint32 dwslot0 = _ReadContext(&device->input_ctx->slot.dwslot0);
1374 		dwslot0 |= SLOT_0_HUB_BIT;
1375 		_WriteContext(&device->input_ctx->slot.dwslot0, dwslot0);
1376 		uint32 dwslot1 = _ReadContext(&device->input_ctx->slot.dwslot1);
1377 		dwslot1 |= SLOT_1_NUM_PORTS(hubDescriptor.num_ports);
1378 		_WriteContext(&device->input_ctx->slot.dwslot1, dwslot1);
1379 		if (speed == USB_SPEED_HIGHSPEED) {
1380 			uint32 dwslot2 = _ReadContext(&device->input_ctx->slot.dwslot2);
1381 			dwslot2 |= SLOT_2_TT_TIME(HUB_TTT_GET(hubDescriptor.characteristics));
1382 			_WriteContext(&device->input_ctx->slot.dwslot2, dwslot2);
1383 		}
1384 
1385 		deviceObject = new(std::nothrow) Hub(parent, hubAddress, hubPort,
1386 			deviceDescriptor, device->address + 1, speed, false, device);
1387 	} else {
1388 		TRACE("creating new device\n");
1389 		deviceObject = new(std::nothrow) Device(parent, hubAddress, hubPort,
1390 			deviceDescriptor, device->address + 1, speed, false, device);
1391 	}
1392 	if (deviceObject == NULL) {
1393 		TRACE_ERROR("no memory to allocate device\n");
1394 		device->state = XHCI_STATE_DISABLED;
1395 		delete_area(device->input_ctx_area);
1396 		delete_area(device->device_ctx_area);
1397 		delete_area(device->trb_area);
1398 		return NULL;
1399 	}
1400 	fPortSlots[hubPort] = slot;
1401 	TRACE("AllocateDevice() port %d slot %d\n", hubPort, slot);
1402 	return deviceObject;
1403 }
1404 
1405 
1406 void
1407 XHCI::FreeDevice(Device *device)
1408 {
1409 	uint8 slot = fPortSlots[device->HubPort()];
1410 	TRACE("FreeDevice() port %d slot %d\n", device->HubPort(), slot);
1411 	DisableSlot(slot);
1412 	fDcba->baseAddress[slot] = 0;
1413 	fPortSlots[device->HubPort()] = 0;
1414 	delete_area(fDevices[slot].trb_area);
1415 	delete_area(fDevices[slot].input_ctx_area);
1416 	delete_area(fDevices[slot].device_ctx_area);
1417 	fDevices[slot].state = XHCI_STATE_DISABLED;
1418 	delete device;
1419 }
1420 
1421 
1422 status_t
1423 XHCI::_InsertEndpointForPipe(Pipe *pipe)
1424 {
1425 	TRACE("_InsertEndpointForPipe endpoint address %" B_PRId8 "\n",
1426 		pipe->EndpointAddress());
1427 	if (pipe->ControllerCookie() != NULL
1428 		|| pipe->Parent()->Type() != USB_OBJECT_DEVICE) {
1429 		// default pipe is already referenced
1430 		return B_OK;
1431 	}
1432 
1433 	Device* usbDevice = (Device *)pipe->Parent();
1434 	struct xhci_device *device = (struct xhci_device *)
1435 		usbDevice->ControllerCookie();
1436 	if (usbDevice->Parent() == RootObject())
1437 		return B_OK;
1438 	if (device == NULL) {
1439 		panic("_InsertEndpointForPipe device is NULL\n");
1440 		return B_OK;
1441 	}
1442 
1443 	uint8 id = XHCI_ENDPOINT_ID(pipe) - 1;
1444 	if (id >= XHCI_MAX_ENDPOINTS - 1)
1445 		return B_BAD_VALUE;
1446 
1447 	if (id > 0) {
1448 		uint32 devicedwslot0 = _ReadContext(&device->device_ctx->slot.dwslot0);
1449 		if (SLOT_0_NUM_ENTRIES_GET(devicedwslot0) == 1) {
1450 			uint32 inputdwslot0 = _ReadContext(&device->input_ctx->slot.dwslot0);
1451 			inputdwslot0 &= ~(SLOT_0_NUM_ENTRIES(0x1f));
1452 			inputdwslot0 |= SLOT_0_NUM_ENTRIES(XHCI_MAX_ENDPOINTS - 1);
1453 			_WriteContext(&device->input_ctx->slot.dwslot0, inputdwslot0);
1454 			EvaluateContext(device->input_ctx_addr, device->slot);
1455 		}
1456 
1457 		device->endpoints[id].device = device;
1458 		device->endpoints[id].trbs = device->trbs
1459 			+ id * XHCI_MAX_TRANSFERS;
1460 		device->endpoints[id].td_head = NULL;
1461 		device->endpoints[id].used = 0;
1462 		device->endpoints[id].trb_addr = device->trb_addr
1463 			+ id * XHCI_MAX_TRANSFERS * sizeof(xhci_trb);
1464 		mutex_init(&device->endpoints[id].lock, "xhci endpoint lock");
1465 
1466 		TRACE("_InsertEndpointForPipe trbs device %p endpoint %p\n",
1467 			device->trbs, device->endpoints[id].trbs);
1468 		TRACE("_InsertEndpointForPipe trb_addr device 0x%" B_PRIxPHYSADDR
1469 			" endpoint 0x%" B_PRIxPHYSADDR "\n", device->trb_addr,
1470 			device->endpoints[id].trb_addr);
1471 
1472 		uint8 endpoint = id + 1;
1473 
1474 		/* TODO: invalid Context State running the 3 following commands
1475 		StopEndpoint(false, endpoint, device->slot);
1476 
1477 		ResetEndpoint(false, endpoint, device->slot);
1478 
1479 		SetTRDequeue(device->endpoints[id].trb_addr, 0, endpoint,
1480 			device->slot); */
1481 
1482 		_WriteContext(&device->input_ctx->input.dropFlags, 0);
1483 		_WriteContext(&device->input_ctx->input.addFlags,
1484 			(1 << endpoint) | (1 << 0));
1485 
1486 		// configure the Control endpoint 0 (type 4)
1487 		uint32 type = 4;
1488 		if ((pipe->Type() & USB_OBJECT_INTERRUPT_PIPE) != 0)
1489 			type = 3;
1490 		if ((pipe->Type() & USB_OBJECT_BULK_PIPE) != 0)
1491 			type = 2;
1492 		if ((pipe->Type() & USB_OBJECT_ISO_PIPE) != 0)
1493 			type = 1;
1494 		type |= (pipe->Direction() == Pipe::In) ? (1 << 2) : 0;
1495 
1496 		TRACE("trb_addr 0x%" B_PRIxPHYSADDR "\n", device->endpoints[id].trb_addr);
1497 
1498 		if (ConfigureEndpoint(device->slot, id, type,
1499 			device->endpoints[id].trb_addr, pipe->Interval(),
1500 			pipe->MaxPacketSize(), pipe->MaxPacketSize() & 0x7ff,
1501 			usbDevice->Speed()) != B_OK) {
1502 			TRACE_ERROR("unable to configure endpoint\n");
1503 			return B_ERROR;
1504 		}
1505 
1506 		EvaluateContext(device->input_ctx_addr, device->slot);
1507 
1508 		ConfigureEndpoint(device->input_ctx_addr, false, device->slot);
1509 		TRACE("device: address 0x%x state 0x%08" B_PRIx32 "\n",
1510 			device->address, SLOT_3_SLOT_STATE_GET(_ReadContext(
1511 				&device->device_ctx->slot.dwslot3)));
1512 		TRACE("endpoint[0] state 0x%08" B_PRIx32 "\n",
1513 			ENDPOINT_0_STATE_GET(_ReadContext(
1514 				&device->device_ctx->endpoints[0].dwendpoint0)));
1515 		TRACE("endpoint[%d] state 0x%08" B_PRIx32 "\n", id,
1516 			ENDPOINT_0_STATE_GET(_ReadContext(
1517 				&device->device_ctx->endpoints[id].dwendpoint0)));
1518 		device->state = XHCI_STATE_CONFIGURED;
1519 	}
1520 	pipe->SetControllerCookie(&device->endpoints[id]);
1521 
1522 	TRACE("_InsertEndpointForPipe for pipe %p at id %d\n", pipe, id);
1523 
1524 	return B_OK;
1525 }
1526 
1527 
1528 status_t
1529 XHCI::_RemoveEndpointForPipe(Pipe *pipe)
1530 {
1531 	if (pipe->Parent()->Type() != USB_OBJECT_DEVICE)
1532 		return B_OK;
1533 	//Device* device = (Device *)pipe->Parent();
1534 
1535 	return B_OK;
1536 }
1537 
1538 
1539 status_t
1540 XHCI::_LinkDescriptorForPipe(xhci_td *descriptor, xhci_endpoint *endpoint)
1541 {
1542 	TRACE("_LinkDescriptorForPipe\n");
1543 	MutexLocker endpointLocker(endpoint->lock);
1544 	if (endpoint->used >= XHCI_MAX_TRANSFERS) {
1545 		TRACE_ERROR("_LinkDescriptorForPipe max transfers count exceeded\n");
1546 		return B_BAD_VALUE;
1547 	}
1548 
1549 	endpoint->used++;
1550 	if (endpoint->td_head == NULL)
1551 		descriptor->next = NULL;
1552 	else
1553 		descriptor->next = endpoint->td_head;
1554 	endpoint->td_head = descriptor;
1555 
1556 	uint8 current = endpoint->current;
1557 	uint8 next = (current + 1) % (XHCI_MAX_TRANSFERS);
1558 
1559 	TRACE("_LinkDescriptorForPipe current %d, next %d\n", current, next);
1560 
1561 	xhci_td *last = descriptor;
1562 	while (last->next_chain != NULL)
1563 		last = last->next_chain;
1564 
1565 	// compute next link
1566 	addr_t addr = endpoint->trb_addr + next * sizeof(struct xhci_trb);
1567 	last->trbs[last->trb_count].qwtrb0 = addr;
1568 	last->trbs[last->trb_count].dwtrb2 = TRB_2_IRQ(0);
1569 	last->trbs[last->trb_count].dwtrb3 = B_HOST_TO_LENDIAN_INT32(
1570 		TRB_3_TYPE(TRB_TYPE_LINK) | TRB_3_IOC_BIT | TRB_3_CYCLE_BIT);
1571 
1572 	endpoint->trbs[next].qwtrb0 = 0;
1573 	endpoint->trbs[next].dwtrb2 = 0;
1574 	endpoint->trbs[next].dwtrb3 = 0;
1575 
1576 	// link the descriptor
1577 	endpoint->trbs[current].qwtrb0 = descriptor->this_phy;
1578 	endpoint->trbs[current].dwtrb2 = TRB_2_IRQ(0);
1579 	endpoint->trbs[current].dwtrb3 = B_HOST_TO_LENDIAN_INT32(
1580 		TRB_3_TYPE(TRB_TYPE_LINK) | TRB_3_CYCLE_BIT);
1581 
1582 	TRACE("_LinkDescriptorForPipe pCurrent %p phys 0x%" B_PRIxPHYSADDR
1583 		" 0x%" B_PRIxPHYSADDR " 0x%08" B_PRIx32 "\n", &endpoint->trbs[current],
1584 		endpoint->trb_addr + current * sizeof(struct xhci_trb),
1585 		endpoint->trbs[current].qwtrb0,
1586 		B_LENDIAN_TO_HOST_INT32(endpoint->trbs[current].dwtrb3));
1587 	endpoint->current = next;
1588 
1589 	return B_OK;
1590 }
1591 
1592 
1593 status_t
1594 XHCI::_UnlinkDescriptorForPipe(xhci_td *descriptor, xhci_endpoint *endpoint)
1595 {
1596 	TRACE("_UnlinkDescriptorForPipe\n");
1597 	MutexLocker endpointLocker(endpoint->lock);
1598 	endpoint->used--;
1599 	if (descriptor == endpoint->td_head) {
1600 		endpoint->td_head = descriptor->next;
1601 		descriptor->next = NULL;
1602 		return B_OK;
1603 	} else {
1604 		for (xhci_td *td = endpoint->td_head; td->next != NULL; td = td->next) {
1605 			if (td->next == descriptor) {
1606 				td->next = descriptor->next;
1607 				descriptor->next = NULL;
1608 				return B_OK;
1609 			}
1610 		}
1611 	}
1612 
1613 	endpoint->used++;
1614 	return B_ERROR;
1615 }
1616 
1617 
1618 status_t
1619 XHCI::ConfigureEndpoint(uint8 slot, uint8 number, uint8 type, uint64 ringAddr,
1620 	uint16 interval, uint16 maxPacketSize, uint16 maxFrameSize, usb_speed speed)
1621 {
1622 	struct xhci_device* device = &fDevices[slot];
1623 
1624 	uint8 maxBurst = (maxPacketSize & 0x1800) >> 11;
1625 	maxPacketSize = (maxPacketSize & 0x7ff);
1626 
1627 	uint32 dwendpoint0 = 0;
1628 	uint32 dwendpoint1 = 0;
1629 	uint64 qwendpoint2 = 0;
1630 	uint32 dwendpoint4 = 0;
1631 
1632 	// Assigning Interval
1633 	uint16 calcInterval = 0;
1634 	if (speed == USB_SPEED_HIGHSPEED && (type == 4 || type == 2)) {
1635 		if (interval != 0) {
1636 			while ((1<<calcInterval) <= interval)
1637 				calcInterval++;
1638 			calcInterval--;
1639 		}
1640 	}
1641 	if ((type & 0x3) == 3 &&
1642 		(speed == USB_SPEED_FULLSPEED || speed == USB_SPEED_LOWSPEED)) {
1643 		while ((1<<calcInterval) <= interval * 8)
1644 			calcInterval++;
1645 		calcInterval--;
1646 	}
1647 	if ((type & 0x3) == 1 && speed == USB_SPEED_FULLSPEED) {
1648 		calcInterval = interval + 2;
1649 	}
1650 	if (((type & 0x3) == 1 || (type & 0x3) == 3) &&
1651 		(speed == USB_SPEED_HIGHSPEED || speed == USB_SPEED_SUPER)) {
1652 		calcInterval = interval - 1;
1653 	}
1654 
1655 	dwendpoint0 |= ENDPOINT_0_INTERVAL(calcInterval);
1656 
1657 	// Assigning CERR for non-isoch endpoints
1658 	if ((type & 0x3) != 1) {
1659 		dwendpoint1 |= ENDPOINT_1_CERR(3);
1660 	}
1661 
1662 	dwendpoint1 |= ENDPOINT_1_EPTYPE(type);
1663 
1664 	// Assigning MaxBurst for HighSpeed
1665 	if (speed == USB_SPEED_HIGHSPEED &&
1666 		((type & 0x3) == 1 || (type & 0x3) == 3)) {
1667 		dwendpoint1 |= ENDPOINT_1_MAXBURST(maxBurst);
1668 	}
1669 
1670 	// TODO Assign MaxBurst for SuperSpeed
1671 
1672 	dwendpoint1 |= ENDPOINT_1_MAXPACKETSIZE(maxPacketSize);
1673 	qwendpoint2 |= ENDPOINT_2_DCS_BIT | ringAddr;
1674 
1675 	// Assign MaxESITPayload
1676 	// Assign AvgTRBLength
1677 	switch (type) {
1678 		case 4:
1679 			dwendpoint4 = ENDPOINT_4_AVGTRBLENGTH(8);
1680 			break;
1681 		case 1:
1682 		case 3:
1683 		case 5:
1684 		case 7:
1685 			dwendpoint4 = ENDPOINT_4_AVGTRBLENGTH(min_c(maxFrameSize,
1686 				B_PAGE_SIZE)) | ENDPOINT_4_MAXESITPAYLOAD((
1687 					(maxBurst+1) * maxPacketSize));
1688 			break;
1689 		default:
1690 			dwendpoint4 = ENDPOINT_4_AVGTRBLENGTH(B_PAGE_SIZE);
1691 			break;
1692 	}
1693 
1694 	_WriteContext(&device->input_ctx->endpoints[number].dwendpoint0,
1695 		dwendpoint0);
1696 	_WriteContext(&device->input_ctx->endpoints[number].dwendpoint1,
1697 		dwendpoint1);
1698 	_WriteContext(&device->input_ctx->endpoints[number].qwendpoint2,
1699 		qwendpoint2);
1700 	_WriteContext(&device->input_ctx->endpoints[number].dwendpoint4,
1701 		dwendpoint4);
1702 
1703 	TRACE("endpoint 0x%" B_PRIx32 " 0x%" B_PRIx32 " 0x%" B_PRIx64 " 0x%"
1704 		B_PRIx32 "\n",
1705 		_ReadContext(&device->input_ctx->endpoints[number].dwendpoint0),
1706 		_ReadContext(&device->input_ctx->endpoints[number].dwendpoint1),
1707 		_ReadContext(&device->input_ctx->endpoints[number].qwendpoint2),
1708 		_ReadContext(&device->input_ctx->endpoints[number].dwendpoint4));
1709 
1710 	return B_OK;
1711 }
1712 
1713 
1714 status_t
1715 XHCI::GetPortSpeed(uint8 index, usb_speed* speed)
1716 {
1717 	uint32 portStatus = ReadOpReg(XHCI_PORTSC(index));
1718 
1719 	switch (PS_SPEED_GET(portStatus)) {
1720 	case 3:
1721 		*speed = USB_SPEED_HIGHSPEED;
1722 		break;
1723 	case 2:
1724 		*speed = USB_SPEED_LOWSPEED;
1725 		break;
1726 	case 1:
1727 		*speed = USB_SPEED_FULLSPEED;
1728 		break;
1729 	case 4:
1730 		*speed = USB_SPEED_SUPER;
1731 		break;
1732 	default:
1733 		TRACE("Non Standard Port Speed\n");
1734 		TRACE("Assuming Superspeed\n");
1735 		*speed = USB_SPEED_SUPER;
1736 		break;
1737 	}
1738 
1739 	return B_OK;
1740 }
1741 
1742 
1743 status_t
1744 XHCI::GetPortStatus(uint8 index, usb_port_status* status)
1745 {
1746 	if (index >= fPortCount)
1747 		return B_BAD_INDEX;
1748 
1749 	status->status = status->change = 0;
1750 	uint32 portStatus = ReadOpReg(XHCI_PORTSC(index));
1751 	TRACE("port %" B_PRId8 " status=0x%08" B_PRIx32 "\n", index, portStatus);
1752 
1753 	// build the status
1754 	switch (PS_SPEED_GET(portStatus)) {
1755 	case 3:
1756 		status->status |= PORT_STATUS_HIGH_SPEED;
1757 		break;
1758 	case 2:
1759 		status->status |= PORT_STATUS_LOW_SPEED;
1760 		break;
1761 	default:
1762 		break;
1763 	}
1764 
1765 	if (portStatus & PS_CCS)
1766 		status->status |= PORT_STATUS_CONNECTION;
1767 	if (portStatus & PS_PED)
1768 		status->status |= PORT_STATUS_ENABLE;
1769 	if (portStatus & PS_OCA)
1770 		status->status |= PORT_STATUS_OVER_CURRENT;
1771 	if (portStatus & PS_PR)
1772 		status->status |= PORT_STATUS_RESET;
1773 	if (portStatus & PS_PP) {
1774 		if (fPortSpeeds[index] == USB_SPEED_SUPER)
1775 			status->status |= PORT_STATUS_SS_POWER;
1776 		else
1777 			status->status |= PORT_STATUS_POWER;
1778 	}
1779 
1780 	// build the change
1781 	if (portStatus & PS_CSC)
1782 		status->change |= PORT_STATUS_CONNECTION;
1783 	if (portStatus & PS_PEC)
1784 		status->change |= PORT_STATUS_ENABLE;
1785 	if (portStatus & PS_OCC)
1786 		status->change |= PORT_STATUS_OVER_CURRENT;
1787 	if (portStatus & PS_PRC)
1788 		status->change |= PORT_STATUS_RESET;
1789 
1790 	if (fPortSpeeds[index] == USB_SPEED_SUPER) {
1791 		if (portStatus & PS_PLC)
1792 			status->change |= PORT_CHANGE_LINK_STATE;
1793 		if (portStatus & PS_WRC)
1794 			status->change |= PORT_CHANGE_BH_PORT_RESET;
1795 	}
1796 
1797 	return B_OK;
1798 }
1799 
1800 
1801 status_t
1802 XHCI::SetPortFeature(uint8 index, uint16 feature)
1803 {
1804 	TRACE("set port feature index %u feature %u\n", index, feature);
1805 	if (index >= fPortCount)
1806 		return B_BAD_INDEX;
1807 
1808 	uint32 portRegister = XHCI_PORTSC(index);
1809 	uint32 portStatus = ReadOpReg(portRegister) & ~PS_CLEAR;
1810 
1811 	switch (feature) {
1812 	case PORT_SUSPEND:
1813 		if ((portStatus & PS_PED) == 0 || (portStatus & PS_PR)
1814 			|| (portStatus & PS_PLS_MASK) >= PS_XDEV_U3) {
1815 			TRACE_ERROR("USB core suspending device not in U0/U1/U2.\n");
1816 			return B_BAD_VALUE;
1817 		}
1818 		portStatus &= ~PS_PLS_MASK;
1819 		WriteOpReg(portRegister, portStatus | PS_LWS | PS_XDEV_U3);
1820 		break;
1821 
1822 	case PORT_RESET:
1823 		WriteOpReg(portRegister, portStatus | PS_PR);
1824 		break;
1825 
1826 	case PORT_POWER:
1827 		WriteOpReg(portRegister, portStatus | PS_PP);
1828 		break;
1829 	default:
1830 		return B_BAD_VALUE;
1831 	}
1832 	ReadOpReg(portRegister);
1833 	return B_OK;
1834 }
1835 
1836 
1837 status_t
1838 XHCI::ClearPortFeature(uint8 index, uint16 feature)
1839 {
1840 	TRACE("clear port feature index %u feature %u\n", index, feature);
1841 	if (index >= fPortCount)
1842 		return B_BAD_INDEX;
1843 
1844 	uint32 portRegister = XHCI_PORTSC(index);
1845 	uint32 portStatus = ReadOpReg(portRegister) & ~PS_CLEAR;
1846 
1847 	switch (feature) {
1848 	case PORT_SUSPEND:
1849 		portStatus = ReadOpReg(portRegister);
1850 		if (portStatus & PS_PR)
1851 			return B_BAD_VALUE;
1852 		if (portStatus & PS_XDEV_U3) {
1853 			if ((portStatus & PS_PED) == 0)
1854 				return B_BAD_VALUE;
1855 			portStatus &= ~PS_PLS_MASK;
1856 			WriteOpReg(portRegister, portStatus | PS_XDEV_U0 | PS_LWS);
1857 		}
1858 		break;
1859 	case PORT_ENABLE:
1860 		WriteOpReg(portRegister, portStatus | PS_PED);
1861 		break;
1862 	case PORT_POWER:
1863 		WriteOpReg(portRegister, portStatus & ~PS_PP);
1864 		break;
1865 	case C_PORT_CONNECTION:
1866 		WriteOpReg(portRegister, portStatus | PS_CSC);
1867 		break;
1868 	case C_PORT_ENABLE:
1869 		WriteOpReg(portRegister, portStatus | PS_PEC);
1870 		break;
1871 	case C_PORT_OVER_CURRENT:
1872 		WriteOpReg(portRegister, portStatus | PS_OCC);
1873 		break;
1874 	case C_PORT_RESET:
1875 		WriteOpReg(portRegister, portStatus | PS_PRC);
1876 		break;
1877 	case C_PORT_BH_PORT_RESET:
1878 		WriteOpReg(portRegister, portStatus | PS_WRC);
1879 		break;
1880 	case C_PORT_LINK_STATE:
1881 		WriteOpReg(portRegister, portStatus | PS_PLC);
1882 		break;
1883 	default:
1884 		return B_BAD_VALUE;
1885 	}
1886 
1887 	ReadOpReg(portRegister);
1888 	return B_OK;
1889 }
1890 
1891 
1892 status_t
1893 XHCI::ControllerHalt()
1894 {
1895 	// Mask off run state
1896 	WriteOpReg(XHCI_CMD, ReadOpReg(XHCI_CMD) & ~CMD_RUN);
1897 
1898 	// wait for shutdown state
1899 	if (WaitOpBits(XHCI_STS, STS_HCH, STS_HCH) != B_OK) {
1900 		TRACE_ERROR("HCH shutdown timeout\n");
1901 		return B_ERROR;
1902 	}
1903 	return B_OK;
1904 }
1905 
1906 
1907 status_t
1908 XHCI::ControllerReset()
1909 {
1910 	TRACE("ControllerReset() cmd: 0x%" B_PRIx32 " sts: 0x%" B_PRIx32 "\n",
1911 		ReadOpReg(XHCI_CMD), ReadOpReg(XHCI_STS));
1912 	WriteOpReg(XHCI_CMD, ReadOpReg(XHCI_CMD) | CMD_HCRST);
1913 
1914 	if (WaitOpBits(XHCI_CMD, CMD_HCRST, 0) != B_OK) {
1915 		TRACE_ERROR("ControllerReset() failed CMD_HCRST\n");
1916 		return B_ERROR;
1917 	}
1918 
1919 	if (WaitOpBits(XHCI_STS, STS_CNR, 0) != B_OK) {
1920 		TRACE_ERROR("ControllerReset() failed STS_CNR\n");
1921 		return B_ERROR;
1922 	}
1923 
1924 	return B_OK;
1925 }
1926 
1927 
1928 int32
1929 XHCI::InterruptHandler(void* data)
1930 {
1931 	return ((XHCI*)data)->Interrupt();
1932 }
1933 
1934 
1935 int32
1936 XHCI::Interrupt()
1937 {
1938 	SpinLocker _(&fSpinlock);
1939 
1940 	uint32 status = ReadOpReg(XHCI_STS);
1941 	uint32 temp = ReadRunReg32(XHCI_IMAN(0));
1942 	WriteOpReg(XHCI_STS, status);
1943 	WriteRunReg32(XHCI_IMAN(0), temp);
1944 
1945 	int32 result = B_HANDLED_INTERRUPT;
1946 
1947 	if ((status & STS_HCH) != 0) {
1948 		TRACE_ERROR("Host Controller halted\n");
1949 		return result;
1950 	}
1951 	if ((status & STS_HSE) != 0) {
1952 		TRACE_ERROR("Host System Error\n");
1953 		return result;
1954 	}
1955 	if ((status & STS_HCE) != 0) {
1956 		TRACE_ERROR("Host Controller Error\n");
1957 		return result;
1958 	}
1959 
1960 	if ((status & STS_EINT) == 0) {
1961 		TRACE("STS: 0x%" B_PRIx32 " IRQ_PENDING: 0x%" B_PRIx32 "\n",
1962 			status, temp);
1963 		return B_UNHANDLED_INTERRUPT;
1964 	}
1965 
1966 	TRACE("Event Interrupt\n");
1967 	release_sem_etc(fEventSem, 1, B_DO_NOT_RESCHEDULE);
1968 	return B_INVOKE_SCHEDULER;
1969 }
1970 
1971 
1972 void
1973 XHCI::Ring(uint8 slot, uint8 endpoint)
1974 {
1975 	TRACE("Ding Dong! slot:%d endpoint %d\n", slot, endpoint)
1976 	if ((slot == 0 && endpoint > 0) || (slot > 0 && endpoint == 0))
1977 		panic("Ring() invalid slot/endpoint combination\n");
1978 	if (slot > fSlotCount || endpoint >= XHCI_MAX_ENDPOINTS)
1979 		panic("Ring() invalid slot or endpoint\n");
1980 	WriteDoorReg32(XHCI_DOORBELL(slot), XHCI_DOORBELL_TARGET(endpoint)
1981 		| XHCI_DOORBELL_STREAMID(0));
1982 	/* Flush PCI posted writes */
1983 	ReadDoorReg32(XHCI_DOORBELL(slot));
1984 }
1985 
1986 
1987 void
1988 XHCI::QueueCommand(xhci_trb* trb)
1989 {
1990 	uint8 i, j;
1991 	uint32 temp;
1992 
1993 	i = fCmdIdx;
1994 	j = fCmdCcs;
1995 
1996 	TRACE("command[%u] = %" B_PRId32 " (0x%016" B_PRIx64 ", 0x%08" B_PRIx32
1997 		", 0x%08" B_PRIx32 ")\n", i, TRB_3_TYPE_GET(trb->dwtrb3), trb->qwtrb0,
1998 		trb->dwtrb2, trb->dwtrb3);
1999 
2000 	fCmdRing[i].qwtrb0 = trb->qwtrb0;
2001 	fCmdRing[i].dwtrb2 = trb->dwtrb2;
2002 	temp = trb->dwtrb3;
2003 
2004 	if (j)
2005 		temp |= TRB_3_CYCLE_BIT;
2006 	else
2007 		temp &= ~TRB_3_CYCLE_BIT;
2008 	temp &= ~TRB_3_TC_BIT;
2009 	fCmdRing[i].dwtrb3 = B_HOST_TO_LENDIAN_INT32(temp);
2010 
2011 	fCmdAddr = fErst->rs_addr + (XHCI_MAX_EVENTS + i) * sizeof(xhci_trb);
2012 
2013 	i++;
2014 
2015 	if (i == (XHCI_MAX_COMMANDS - 1)) {
2016 		temp = TRB_3_TYPE(TRB_TYPE_LINK) | TRB_3_TC_BIT;
2017 		if (j)
2018 			temp |= TRB_3_CYCLE_BIT;
2019 		fCmdRing[i].dwtrb3 = B_HOST_TO_LENDIAN_INT32(temp);
2020 
2021 		i = 0;
2022 		j ^= 1;
2023 	}
2024 
2025 	fCmdIdx = i;
2026 	fCmdCcs = j;
2027 }
2028 
2029 
2030 void
2031 XHCI::HandleCmdComplete(xhci_trb* trb)
2032 {
2033 	if (fCmdAddr == trb->qwtrb0) {
2034 		TRACE("Received command event\n");
2035 		fCmdResult[0] = trb->dwtrb2;
2036 		fCmdResult[1] = B_LENDIAN_TO_HOST_INT32(trb->dwtrb3);
2037 		release_sem_etc(fCmdCompSem, 1, B_DO_NOT_RESCHEDULE);
2038 	}
2039 
2040 }
2041 
2042 
2043 void
2044 XHCI::HandleTransferComplete(xhci_trb* trb)
2045 {
2046 	TRACE("HandleTransferComplete trb %p\n", trb);
2047 	addr_t source = trb->qwtrb0;
2048 	uint8 completionCode = TRB_2_COMP_CODE_GET(trb->dwtrb2);
2049 	uint32 remainder = TRB_2_REM_GET(trb->dwtrb2);
2050 	uint8 endpointNumber
2051 		= TRB_3_ENDPOINT_GET(B_LENDIAN_TO_HOST_INT32(trb->dwtrb3));
2052 	uint8 slot = TRB_3_SLOT_GET(B_LENDIAN_TO_HOST_INT32(trb->dwtrb3));
2053 
2054 	if (slot > fSlotCount)
2055 		TRACE_ERROR("invalid slot\n");
2056 	if (endpointNumber == 0 || endpointNumber >= XHCI_MAX_ENDPOINTS)
2057 		TRACE_ERROR("invalid endpoint\n");
2058 
2059 	xhci_device *device = &fDevices[slot];
2060 	xhci_endpoint *endpoint = &device->endpoints[endpointNumber - 1];
2061 	xhci_td *td = endpoint->td_head;
2062 	for (; td != NULL; td = td->next) {
2063 		xhci_td *td_chain = td;
2064 		for (; td_chain != NULL; td_chain = td_chain->next_chain) {
2065 			int64 offset = source - td_chain->this_phy;
2066 			TRACE("HandleTransferComplete td %p offset %" B_PRId64 " %"
2067 				B_PRIxADDR "\n", td_chain, offset, source);
2068 			offset = offset / sizeof(xhci_trb) + 1;
2069 			if (offset <= td_chain->trb_count && offset >= 1) {
2070 				TRACE("HandleTransferComplete td %p trb %" B_PRId64 " found "
2071 					"\n", td_chain, offset);
2072 				// is it the last trb?
2073 				if (offset == td_chain->trb_count) {
2074 					_UnlinkDescriptorForPipe(td, endpoint);
2075 					td->trb_completion_code = completionCode;
2076 					td->trb_left = remainder;
2077 					// add descriptor to finished list
2078 					Lock();
2079 					td->next = fFinishedHead;
2080 					fFinishedHead = td;
2081 					Unlock();
2082 					release_sem(fFinishTransfersSem);
2083 					TRACE("HandleTransferComplete td %p\n", td);
2084 				}
2085 				return;
2086 			}
2087 		}
2088 	}
2089 
2090 }
2091 
2092 
2093 void
2094 XHCI::DumpRing(xhci_trb *trbs, uint32 size)
2095 {
2096 	if (!Lock()) {
2097 		TRACE("Unable to get lock!\n");
2098 		return;
2099 	}
2100 
2101 	for (uint32 i = 0; i < size; i++) {
2102 		TRACE("command[%" B_PRId32 "] = %" B_PRId32 " (0x%016" B_PRIx64 ","
2103 			" 0x%08" B_PRIx32 ", 0x%08" B_PRIx32 ")\n", i,
2104 			TRB_3_TYPE_GET(B_LENDIAN_TO_HOST_INT32(trbs[i].dwtrb3)),
2105 			trbs[i].qwtrb0, trbs[i].dwtrb2, trbs[i].dwtrb3);
2106 	}
2107 
2108 	Unlock();
2109 }
2110 
2111 
2112 status_t
2113 XHCI::DoCommand(xhci_trb* trb)
2114 {
2115 	if (!Lock()) {
2116 		TRACE("Unable to get lock!\n");
2117 		return B_ERROR;
2118 	}
2119 
2120 	QueueCommand(trb);
2121 	Ring(0, 0);
2122 
2123 	if (acquire_sem(fCmdCompSem) < B_OK) {
2124 		TRACE("Unable to obtain fCmdCompSem semaphore!\n");
2125 		Unlock();
2126 		return B_ERROR;
2127 	}
2128 	// eat up sems that have been released by multiple interrupts
2129 	int32 semCount = 0;
2130 	get_sem_count(fCmdCompSem, &semCount);
2131 	if (semCount > 0)
2132 		acquire_sem_etc(fCmdCompSem, semCount, B_RELATIVE_TIMEOUT, 0);
2133 
2134 	status_t status = B_OK;
2135 	uint32 completionCode = TRB_2_COMP_CODE_GET(fCmdResult[0]);
2136 	TRACE("Command Complete. Result: %" B_PRId32 "\n", completionCode);
2137 	if (completionCode != COMP_SUCCESS) {
2138 		uint32 errorCode = TRB_2_COMP_CODE_GET(fCmdResult[0]);
2139 		TRACE_ERROR("unsuccessful command %s (%" B_PRId32 ")\n",
2140 			xhci_error_string(errorCode), errorCode);
2141 		status = B_IO_ERROR;
2142 	}
2143 
2144 	trb->dwtrb2 = fCmdResult[0];
2145 	trb->dwtrb3 = fCmdResult[1];
2146 	TRACE("Storing trb 0x%08" B_PRIx32 " 0x%08" B_PRIx32 "\n", trb->dwtrb2,
2147 		trb->dwtrb3);
2148 
2149 	Unlock();
2150 	return status;
2151 }
2152 
2153 
2154 status_t
2155 XHCI::Noop()
2156 {
2157 	TRACE("Issue No-Op\n");
2158 	xhci_trb trb;
2159 	trb.qwtrb0 = 0;
2160 	trb.dwtrb2 = 0;
2161 	trb.dwtrb3 = TRB_3_TYPE(TRB_TYPE_CMD_NOOP);
2162 
2163 	return DoCommand(&trb);
2164 }
2165 
2166 
2167 status_t
2168 XHCI::EnableSlot(uint8* slot)
2169 {
2170 	TRACE("Enable Slot\n");
2171 	xhci_trb trb;
2172 	trb.qwtrb0 = 0;
2173 	trb.dwtrb2 = 0;
2174 	trb.dwtrb3 = TRB_3_TYPE(TRB_TYPE_ENABLE_SLOT);
2175 
2176 	status_t status = DoCommand(&trb);
2177 	if (status != B_OK)
2178 		return status;
2179 
2180 	*slot = TRB_3_SLOT_GET(trb.dwtrb3);
2181 	return *slot != 0 ? B_OK : B_BAD_VALUE;
2182 }
2183 
2184 
2185 status_t
2186 XHCI::DisableSlot(uint8 slot)
2187 {
2188 	TRACE("Disable Slot\n");
2189 	xhci_trb trb;
2190 	trb.qwtrb0 = 0;
2191 	trb.dwtrb2 = 0;
2192 	trb.dwtrb3 = TRB_3_TYPE(TRB_TYPE_DISABLE_SLOT) | TRB_3_SLOT(slot);
2193 
2194 	return DoCommand(&trb);
2195 }
2196 
2197 
2198 status_t
2199 XHCI::SetAddress(uint64 inputContext, bool bsr, uint8 slot)
2200 {
2201 	TRACE("Set Address\n");
2202 	xhci_trb trb;
2203 	trb.qwtrb0 = inputContext;
2204 	trb.dwtrb2 = 0;
2205 	trb.dwtrb3 = TRB_3_TYPE(TRB_TYPE_ADDRESS_DEVICE) | TRB_3_SLOT(slot);
2206 
2207 	if (bsr)
2208 		trb.dwtrb3 |= TRB_3_BSR_BIT;
2209 
2210 	return DoCommand(&trb);
2211 }
2212 
2213 
2214 status_t
2215 XHCI::ConfigureEndpoint(uint64 inputContext, bool deconfigure, uint8 slot)
2216 {
2217 	TRACE("Configure Endpoint\n");
2218 	xhci_trb trb;
2219 	trb.qwtrb0 = inputContext;
2220 	trb.dwtrb2 = 0;
2221 	trb.dwtrb3 = TRB_3_TYPE(TRB_TYPE_CONFIGURE_ENDPOINT) | TRB_3_SLOT(slot);
2222 
2223 	if (deconfigure)
2224 		trb.dwtrb3 |= TRB_3_DCEP_BIT;
2225 
2226 	return DoCommand(&trb);
2227 }
2228 
2229 
2230 status_t
2231 XHCI::EvaluateContext(uint64 inputContext, uint8 slot)
2232 {
2233 	TRACE("Evaluate Context\n");
2234 	xhci_trb trb;
2235 	trb.qwtrb0 = inputContext;
2236 	trb.dwtrb2 = 0;
2237 	trb.dwtrb3 = TRB_3_TYPE(TRB_TYPE_EVALUATE_CONTEXT) | TRB_3_SLOT(slot);
2238 
2239 	return DoCommand(&trb);
2240 }
2241 
2242 
2243 status_t
2244 XHCI::ResetEndpoint(bool preserve, uint8 endpoint, uint8 slot)
2245 {
2246 	TRACE("Reset Endpoint\n");
2247 	xhci_trb trb;
2248 	trb.qwtrb0 = 0;
2249 	trb.dwtrb2 = 0;
2250 	trb.dwtrb3 = TRB_3_TYPE(TRB_TYPE_RESET_ENDPOINT)
2251 		| TRB_3_SLOT(slot) | TRB_3_ENDPOINT(endpoint);
2252 	if (preserve)
2253 		trb.dwtrb3 |= TRB_3_PRSV_BIT;
2254 
2255 	return DoCommand(&trb);
2256 }
2257 
2258 
2259 status_t
2260 XHCI::StopEndpoint(bool suspend, uint8 endpoint, uint8 slot)
2261 {
2262 	TRACE("Stop Endpoint\n");
2263 	xhci_trb trb;
2264 	trb.qwtrb0 = 0;
2265 	trb.dwtrb2 = 0;
2266 	trb.dwtrb3 = TRB_3_TYPE(TRB_TYPE_STOP_ENDPOINT)
2267 		| TRB_3_SLOT(slot) | TRB_3_ENDPOINT(endpoint);
2268 	if (suspend)
2269 		trb.dwtrb3 |= TRB_3_SUSPEND_ENDPOINT_BIT;
2270 
2271 	return DoCommand(&trb);
2272 }
2273 
2274 
2275 status_t
2276 XHCI::SetTRDequeue(uint64 dequeue, uint16 stream, uint8 endpoint, uint8 slot)
2277 {
2278 	TRACE("Set TR Dequeue\n");
2279 	xhci_trb trb;
2280 	trb.qwtrb0 = dequeue;
2281 	trb.dwtrb2 = TRB_2_STREAM(stream);
2282 	trb.dwtrb3 = TRB_3_TYPE(TRB_TYPE_SET_TR_DEQUEUE)
2283 		| TRB_3_SLOT(slot) | TRB_3_ENDPOINT(endpoint);
2284 
2285 	return DoCommand(&trb);
2286 }
2287 
2288 
2289 status_t
2290 XHCI::ResetDevice(uint8 slot)
2291 {
2292 	TRACE("Reset Device\n");
2293 	xhci_trb trb;
2294 	trb.qwtrb0 = 0;
2295 	trb.dwtrb2 = 0;
2296 	trb.dwtrb3 = TRB_3_TYPE(TRB_TYPE_RESET_DEVICE) | TRB_3_SLOT(slot);
2297 
2298 	return DoCommand(&trb);
2299 }
2300 
2301 
2302 int32
2303 XHCI::EventThread(void* data)
2304 {
2305 	((XHCI *)data)->CompleteEvents();
2306 	return B_OK;
2307 }
2308 
2309 
2310 void
2311 XHCI::CompleteEvents()
2312 {
2313 	while (!fStopThreads) {
2314 		if (acquire_sem(fEventSem) < B_OK)
2315 			continue;
2316 
2317 		// eat up sems that have been released by multiple interrupts
2318 		int32 semCount = 0;
2319 		get_sem_count(fEventSem, &semCount);
2320 		if (semCount > 0)
2321 			acquire_sem_etc(fEventSem, semCount, B_RELATIVE_TIMEOUT, 0);
2322 
2323 		uint16 i = fEventIdx;
2324 		uint8 j = fEventCcs;
2325 		uint8 t = 2;
2326 
2327 		while (1) {
2328 			uint32 temp = B_LENDIAN_TO_HOST_INT32(fEventRing[i].dwtrb3);
2329 			uint8 event = TRB_3_TYPE_GET(temp);
2330 			TRACE("event[%u] = %u (0x%016" B_PRIx64 " 0x%08" B_PRIx32 " 0x%08"
2331 				B_PRIx32 ")\n", i, event, fEventRing[i].qwtrb0,
2332 				fEventRing[i].dwtrb2, B_LENDIAN_TO_HOST_INT32(fEventRing[i].dwtrb3));
2333 			uint8 k = (temp & TRB_3_CYCLE_BIT) ? 1 : 0;
2334 			if (j != k)
2335 				break;
2336 
2337 
2338 			switch (event) {
2339 			case TRB_TYPE_COMMAND_COMPLETION:
2340 				HandleCmdComplete(&fEventRing[i]);
2341 				break;
2342 			case TRB_TYPE_TRANSFER:
2343 				HandleTransferComplete(&fEventRing[i]);
2344 				break;
2345 			case TRB_TYPE_PORT_STATUS_CHANGE:
2346 				TRACE("port change detected\n");
2347 				break;
2348 			default:
2349 				TRACE_ERROR("Unhandled event = %u\n", event);
2350 				break;
2351 			}
2352 
2353 			i++;
2354 			if (i == XHCI_MAX_EVENTS) {
2355 				i = 0;
2356 				j ^= 1;
2357 				if (!--t)
2358 					break;
2359 			}
2360 		}
2361 
2362 		fEventIdx = i;
2363 		fEventCcs = j;
2364 
2365 		uint64 addr = fErst->rs_addr + i * sizeof(xhci_trb);
2366 		addr |= ERST_EHB;
2367 		WriteRunReg32(XHCI_ERDP_LO(0), (uint32)addr);
2368 		WriteRunReg32(XHCI_ERDP_HI(0), (uint32)(addr >> 32));
2369 	}
2370 }
2371 
2372 
2373 int32
2374 XHCI::FinishThread(void* data)
2375 {
2376 	((XHCI *)data)->FinishTransfers();
2377 	return B_OK;
2378 }
2379 
2380 
2381 void
2382 XHCI::FinishTransfers()
2383 {
2384 	while (!fStopThreads) {
2385 		if (acquire_sem(fFinishTransfersSem) < B_OK)
2386 			continue;
2387 
2388 		// eat up sems that have been released by multiple interrupts
2389 		int32 semCount = 0;
2390 		get_sem_count(fFinishTransfersSem, &semCount);
2391 		if (semCount > 0)
2392 			acquire_sem_etc(fFinishTransfersSem, semCount, B_RELATIVE_TIMEOUT, 0);
2393 
2394 		Lock();
2395 		TRACE("finishing transfers\n");
2396 		while (fFinishedHead != NULL) {
2397 			xhci_td* td = fFinishedHead;
2398 			fFinishedHead = td->next;
2399 			td->next = NULL;
2400 			Unlock();
2401 
2402 			TRACE("finishing transfer td %p\n", td);
2403 
2404 			Transfer* transfer = td->transfer;
2405 			bool directionIn = (transfer->TransferPipe()->Direction() != Pipe::Out);
2406 			usb_request_data *requestData = transfer->RequestData();
2407 
2408 			status_t callbackStatus = B_OK;
2409 			switch (td->trb_completion_code) {
2410 				case COMP_SHORT_PACKET:
2411 				case COMP_SUCCESS:
2412 					callbackStatus = B_OK;
2413 					break;
2414 				case COMP_DATA_BUFFER:
2415 					callbackStatus = directionIn ? B_DEV_DATA_OVERRUN
2416 						: B_DEV_DATA_UNDERRUN;
2417 					break;
2418 				case COMP_BABBLE:
2419 					callbackStatus = directionIn ? B_DEV_FIFO_OVERRUN
2420 						: B_DEV_FIFO_UNDERRUN;
2421 					break;
2422 				case COMP_USB_TRANSACTION:
2423 					callbackStatus = B_DEV_CRC_ERROR;
2424 					break;
2425 				case COMP_STALL:
2426 					callbackStatus = B_DEV_STALLED;
2427 					break;
2428 				default:
2429 					callbackStatus = B_DEV_STALLED;
2430 					break;
2431 			}
2432 
2433 			size_t actualLength = 0;
2434 			if (callbackStatus == B_OK) {
2435 				actualLength = requestData ? requestData->Length
2436 					: transfer->DataLength();
2437 
2438 				if (td->trb_completion_code == COMP_SHORT_PACKET)
2439 					actualLength -= td->trb_left;
2440 
2441 				if (directionIn && actualLength > 0) {
2442 					if (requestData) {
2443 						TRACE("copying in data %d bytes\n", requestData->Length);
2444 						transfer->PrepareKernelAccess();
2445 						memcpy((uint8 *)transfer->Vector()[0].iov_base,
2446 							td->buffer_log[0], requestData->Length);
2447 					} else {
2448 						TRACE("copying in iov count %ld\n", transfer->VectorCount());
2449 						transfer->PrepareKernelAccess();
2450 						ReadDescriptorChain(td, transfer->Vector(),
2451 							transfer->VectorCount());
2452 					}
2453 				}
2454 			}
2455 			transfer->Finished(callbackStatus, actualLength);
2456 			delete transfer;
2457 			FreeDescriptor(td);
2458 			Lock();
2459 		}
2460 		Unlock();
2461 
2462 	}
2463 }
2464 
2465 
2466 inline void
2467 XHCI::WriteOpReg(uint32 reg, uint32 value)
2468 {
2469 	*(volatile uint32 *)(fOperationalRegisters + reg) = value;
2470 }
2471 
2472 
2473 inline uint32
2474 XHCI::ReadOpReg(uint32 reg)
2475 {
2476 	return *(volatile uint32 *)(fOperationalRegisters + reg);
2477 }
2478 
2479 
2480 inline status_t
2481 XHCI::WaitOpBits(uint32 reg, uint32 mask, uint32 expected)
2482 {
2483 	int loops = 0;
2484 	uint32 value = ReadOpReg(reg);
2485 	while ((value & mask) != expected) {
2486 		snooze(1000);
2487 		value = ReadOpReg(reg);
2488 		if (loops == 25) {
2489 			TRACE("delay waiting on reg 0x%" B_PRIX32 " match 0x%" B_PRIX32
2490 				" (0x%" B_PRIX32 ")\n",	reg, expected, mask);
2491 		} else if (loops > 100) {
2492 			TRACE_ERROR("timeout waiting on reg 0x%" B_PRIX32
2493 				" match 0x%" B_PRIX32 " (0x%" B_PRIX32 ")\n", reg, expected,
2494 				mask);
2495 			return B_ERROR;
2496 		}
2497 		loops++;
2498 	}
2499 	return B_OK;
2500 }
2501 
2502 
2503 inline uint32
2504 XHCI::ReadCapReg32(uint32 reg)
2505 {
2506 	return *(volatile uint32 *)(fCapabilityRegisters + reg);
2507 }
2508 
2509 
2510 inline void
2511 XHCI::WriteCapReg32(uint32 reg, uint32 value)
2512 {
2513 	*(volatile uint32 *)(fCapabilityRegisters + reg) = value;
2514 }
2515 
2516 
2517 inline uint32
2518 XHCI::ReadRunReg32(uint32 reg)
2519 {
2520 	return *(volatile uint32 *)(fRuntimeRegisters + reg);
2521 }
2522 
2523 
2524 inline void
2525 XHCI::WriteRunReg32(uint32 reg, uint32 value)
2526 {
2527 	*(volatile uint32 *)(fRuntimeRegisters + reg) = value;
2528 }
2529 
2530 
2531 inline uint32
2532 XHCI::ReadDoorReg32(uint32 reg)
2533 {
2534 	return *(volatile uint32 *)(fDoorbellRegisters + reg);
2535 }
2536 
2537 
2538 inline void
2539 XHCI::WriteDoorReg32(uint32 reg, uint32 value)
2540 {
2541 	*(volatile uint32 *)(fDoorbellRegisters + reg) = value;
2542 }
2543 
2544 
2545 inline addr_t
2546 XHCI::_OffsetContextAddr(addr_t p)
2547 {
2548 	if (fContextSizeShift == 1) {
2549 		// each structure is page aligned, each pointer is 32 bits aligned
2550 		uint32 offset = p & ((B_PAGE_SIZE - 1) & ~31U);
2551 		p += offset;
2552 	}
2553 	return p;
2554 }
2555 
2556 inline uint32
2557 XHCI::_ReadContext(uint32* p)
2558 {
2559 	p = (uint32*)_OffsetContextAddr((addr_t)p);
2560 	return *p;
2561 }
2562 
2563 
2564 inline void
2565 XHCI::_WriteContext(uint32* p, uint32 value)
2566 {
2567 	p = (uint32*)_OffsetContextAddr((addr_t)p);
2568 	*p = value;
2569 }
2570 
2571 
2572 inline uint64
2573 XHCI::_ReadContext(uint64* p)
2574 {
2575 	p = (uint64*)_OffsetContextAddr((addr_t)p);
2576 	return *p;
2577 }
2578 
2579 
2580 inline void
2581 XHCI::_WriteContext(uint64* p, uint64 value)
2582 {
2583 	p = (uint64*)_OffsetContextAddr((addr_t)p);
2584 	*p = value;
2585 }
2586