Home | History | Annotate | Download | only in usb
History log of /src/sys/dev/usb/usbdi.c
RevisionDateAuthorComments
 1.253  05-Apr-2024  riastradh usb *hci: Always set ux_status before usbd_xfer_schedule_timeout.

Add an assert to usbd_xfer_schedule_timeout to enforce this.

Since access to ux_status is serialized by the bus lock, and nothing
releases the bus lock in the interim, this doesn't make a functional
change. But it does reduce confusion by readers, who no longer have
to worry if some callers got the order wrong. It could also now
potentially be factored out in a subsequent commit.
 1.252  09-Feb-2024  andvar fix spelling mistakes, mainly in comments and log messages.
 1.251  04-Feb-2024  mrg update my email address.
 1.250  13-Jan-2024  riastradh usbdi(9): Assert not polling in abort path.

XXX Not sure if this is safe.
 1.249  13-Jan-2024  riastradh usbdi(9): Avoid taking locks in usbd_transfer while polling.

PR kern/57783

XXX pullup-10
XXX pullup-9
XXX pullup-8
 1.248  13-Jan-2024  riastradh usbdi(9): Avoid calling ubm_softint with lock held and polling on.

PR kern/57783

XXX pullup-10
XXX pullup-9
XXX pullup-8
 1.247  13-Sep-2022  riastradh branches: 1.247.4;
usbdi(9): Sprinkle usbhist into usb xfer timeout logic.
 1.246  13-Sep-2022  riastradh usbdi(9): Fix mistake in usbdi.c 1.244.

Need to clear ux_timeout_set only when we finally actually process
the timeout in usbdi_xfer_timeout_task, not in the callout which
schedules the task which asserts that the timeout is still set on
entry.

Must've exported the wrong version of my change from git.
 1.245  13-Sep-2022  riastradh usbdi(9): Rule out possible race to read xfer->ux_status.

I think this might actually be safe, because when it's synchronous,
the xfer can't be reused except by the caller after usbd_transfer
returns. But let's make it definitely not wrong instead of maybe
actually safe.
 1.244  07-Sep-2022  riastradh usbdi(9): Fix timeout after non-racy xfer resubmission.

Previously we would never clear ux_timeout_set if an xfer timedout,
so resubmission of the same xfer later would fail to schedule a
callout.
 1.243  20-Aug-2022  riastradh usbdi(9): Nix resurrected usbd_request_async.

We killed this back in 2013, but it came back from the dead on a
driver imported from OpenBSD.
 1.242  06-Apr-2022  mlelstv revert accidental last commit (except ukbd.c)
 1.241  06-Apr-2022  mlelstv remove debug printf
 1.240  20-Mar-2022  riastradh usbdi(9): Make sure aborting a pipe waits for all callbacks.

There may be a callback in flight from an xfer that has already been
taken off the queue by the time usbd_ar_pipe gets to it. We must
guarantee that even that callback has completed before returning
control to the caller.
 1.239  19-Mar-2022  riastradh usbdi(9): Fix usbd_get_no_alts.

This incorrectly rejected the configuration as invalid if any
descriptor is not large enough to be interface descriptors.

Instead, it should reject the configuration only if any descriptor is
not large enough to be a _descriptor_, or if any interface-type
descriptor is not large enough to be an interface descriptor, but
skip over descriptors of other types even if they're smaller than
interface descriptors.

Candidate fix for PR kern/56762.
 1.238  13-Mar-2022  riastradh usbdi(9): Fix paste-o in previous change to usbd_ar_pipe.
 1.237  13-Mar-2022  riastradh usb: Parse descriptors a little more robustly.

- Avoid reading past the end in the event of bogus bLength.
- Avoid arithmetic overflow by rearranging inequalities.

Reported-by: syzbot+511227c050a2f164e34c@syzkaller.appspotmail.com
 1.236  13-Mar-2022  riastradh usb: Clarify contract of usbd_xfer_trycomplete.

No functional change. This rule has always been in place since
usbd_xfer_trycomplete was created, just wasn't clearly articulated
anywhere.
 1.235  13-Mar-2022  riastradh usbdi(9): Assert no concurrent aborts on a single pipe.

It is a driver bug to try to abort a pipe at the same time in two
different threads.

HCI drivers may release the bus lock to sleep in upm_abort while
waiting for the hardware to acknowledge an abort, so it won't try to,
e.g., scribble over a DMA buffer in the xfer that we've recycled
after usbd_abort_pipe returns.

If this happens, a concurrent usbd_abort_pipe might try to apply
upm_abort to the same xfer, which HCI drivers are not prepared for
and may wreak havoc.

To avoid this, allow only one usbd_abort_pipe in flight at any given
time.
 1.234  13-Mar-2022  riastradh usbdi(9): Assert sleepable in usbd_ar_pipe.

Caller of usbd_suspend_pipe or usbd_abort_pipe must be prepared to
sleep for hardware to acknowledge abort and for in-flight callback on
another CPU to complete. Let's catch the mistake early of calling
them in non-sleepable contexts where they might get lucky.
 1.233  03-Mar-2022  riastradh usbdi(9): dtrace probes for USB control requests.
 1.232  03-Mar-2022  riastradh usb: Assert hci doesn't synchronously complete async xfers.

The xfer callback must not be invoked synchronously, because it might
need to take a lock that the caller holds.

However, the hci might return failure to the caller, meaning the xfer
callback will not be invoked at all.
 1.231  03-Mar-2022  riastradh usb: Hold pipe lock across upm_transfer and upm_start.

This simplifies the code and fixes races with abort. Access to the
pipe's queue is now done exclusively while the pipe is locked.
 1.230  03-Mar-2022  riastradh usb: In usbd_transfer, test whether aborting under the lock.

Otherwise this test is racy and can cause the bad state of a pipe
with a transfer that will never be completed in a pipe that's about
to close under the expectation that the pipe is empty.
 1.229  03-Mar-2022  riastradh usb: Inline usb_insert_transfer.

This makes it clearer which part happens irrespective of error
(putting it on the queue -- unconditional, not rolled back by
usb_insert_transfer) and what the possible `errors' mean (neither of
which is an error, per se).
 1.228  03-Mar-2022  riastradh usbdi(9): New usbd_suspend_pipe, usbd_resume_pipe.

- New usbd_suspend_pipe to persistently stop transfers on a pipe and
cancel pending ones or wait for their callbacks to finish.
Idempotent.

- New usbd_resume_pipe to allow transfers again. Idempotent, but no
new xfers may be submitted before repeating this.

This way it is safe to usbd_abort_pipe in two threads concurrently,
e.g. if one thread is closing a device while another is revoking it
-- but the threads have to agree on when it is done being aborted
before starting to use it again.

- Existing usbd_abort_pipe now does suspend then resume. No change
in semantics so drivers that relied on being able to submit
transfers again won't be broken any worse than the already are
broken.

This allows drivers to avoid races such as:

/* read */
if (sc->sc_dying)
return ENXIO;
/* (*) */
err = usbd_bulk_transfer(...);

/* detach or or close */
sc->sc_dying = true;
usbd_abort_pipe(...);
wait_for_io_to_drain(...);

The detach or close logic might happen at the same time as (*), with
no way to stop the bulk transfer before it starts, leading to
deadlock when detach/close waits for I/O operations like read to
drain. Instead, the close routine can use usbd_suspend_pipe, and the
usbd_bulk_transfer is guaranteed to fail.

But some drivers such as ucom(4) don't close and reopen pipes after
aborting them -- they open on attach and close on detach, and just
abort when the /dev node is closed, expecting that xfers will
continue to work when next opened. These drivers can instead use
usbd_suspend_pipe on close and usbd_resume_pipe on open. Perhaps it
would be better to make them open pipes on open and close pipes on
close, but these functions make for a less intrusive transition.
 1.227  03-Mar-2022  riastradh usb: Factor usb_transfer_complete out of ubm_abortx method.
 1.226  03-Mar-2022  riastradh usb: usbd_free_xfer never fails. Make it return void.
 1.225  03-Mar-2022  riastradh usb: usbd_close_pipe never fails. Make it return void.

Prune dead branches as a result of this change.
 1.224  03-Mar-2022  riastradh usb: usbd_abort_pipe never fails. Make it return void.

Prune dead branches as a result of this change.
 1.223  03-Mar-2022  riastradh usb: Factor usb_insert_transfer out of upm_transfer and make private.

Almost every upm_transfer function starts with:

mutex_enter(&sc->sc_lock);
err = usb_insert_transfer(xfer);
mutex_exit(&sc->sc_lock);
if (err)
return err;

Some of them have debug messages sprinkled in here too, or assert
that err == USBD_NORMAL_COMPLETION (alternative is USBD_IN_PROGRESS,
only for pipes with up_running or up_serialise, presumably not
applicable for these types of pipes). Some of them also assert
xfer->ux_status == USBD_NOT_STARTED, which is guaranteed on entry and
preserved by usb_insert_transer.

Exceptions:

- arch/mips/adm5120/dev/ahci.c ahci_device_isoc_transfer just returns
USBD_NORMAL_COMPLETION, but I'm pretty sure this is and always has
been broken anyway, so won't make anything worse (if anything, might
make it better...)

- external/bsd/dwc2/dwc2.c dwc2_device_bulk_transfer and
dwc2_device_isoc_transfer _also_ issue dwc2_device_start(xfer)
under the lock. This is probably a better way to do it, but let's
do it uniformly across all HCIs at once.

- rump/dev/lib/libugenhc/ugenhc.c rumpusb_device_bulk_transfer
sometimes returns USBD_IN_PROGRESS _without_ queueing the transfer,
in the !rump_threads case. Not really sure how this is supposed to
work... If it actually breaks anything, we can figure it out.
 1.222  20-Jan-2022  mrg don't 'extern' some other .c file's data, espcially when it's
already in usbhist.h.
 1.221  31-Dec-2021  skrll usbd_do_request_len (and friends) return usbd_status so return one in
the usbd_create_xfer failure case. Spotted by Riastradh.
 1.220  21-Dec-2021  skrll Change the usb_mem API to take a bus_dma_tag_t in usb_allocmem instead of
a struct usbd_bus *.

This allows an HCD to use more than one tag.
 1.219  07-Sep-2021  riastradh usb(4): Fix xfer race between software abort and hardware completion.

This fixes a bug in the API contract of usbd_abort_pipe: with the
change, the caller is guaranteed the xfer completion callbacks have
returned; without the change, completion callbacks could still be
running on the queued xfers while the caller of usbd_abort_pipe
proceeds to concurrently issue usbd_destroy_xfer.

This also fixes the following problem for interrupt pipes, whose
xfers stay on the queue until the pipe is aborted:

Thread 1: Hardware completion interrupt calls usb_transfer_complete.
Thread 1: pipe->up_repeat is 1, so usb_transfer_complete keeps xfer
queued.
Thread 2: Calls usbd_abort_pipe (e.g., in detach).
Thread 2: usbd_abort_pipe waits for bus lock.
Thread 1: usb_transfer_complete releases bus lock to invoke callback.
Thread 2: Sets pipe->up_repeat := 0 (too late for thread 1 to see).
Thread 1: usb_transfer_complete waits to reacquire bus lock before
resetting xfer status to USBD_NOT_STARTED.
Thread 2: Repeatdly calls upm_abort on the same xfer, which does
nothing because upm_abort just does usbd_abort_xfer which does
nothing because the xfer status is (e.g.) USBD_IOERROR and not
USBD_IN_PROGRESS.

Thread 2 is now spinning forever with the bus lock held (and possibly
the kernel lock) waiting for queue or xfer status to change, which
will never happen as long as it holds the bus lock.

The resolution is for thread 2 to notice that thread 1 is busy
invoking a callback, and to wait until thread 1 has finished invoking
the callback and updated the xfer status to reset it to
USBD_NOT_STARTED at which point thread 1 can make progress again.

XXX pullup-9
 1.218  16-Jun-2021  riastradh usb(4): Fix uninitialized variable for error branch.
 1.217  14-Jun-2021  mlelstv appease gcc9
 1.216  13-Jun-2021  riastradh usb(4): Tighten interface locking and pipe references.

- Just use a reference count, not a list of pipes.

- Take the reference in usbd_open_pipe*, before we even look up the
endpoint by address; the endpoint is not stable until we hold the
interface and prevent usbd_set_interface.

- Make opening pipes just fail if usbd_set_interface is in progress.
=> No need to block -- might block for a while, and this is
essentially a driver error rather than a legitimate reason to
block.
=> This should maybe be a kassert, but it's not clear that ugen(4)
doesn't have a user-triggerable path to that kassert, so let's
keep it as a graceful failure for now until someone can audit
ugen(4) and make an informed decision.

- No need for a separate interface pipe lock; just use the bus lock.

This is a little bit longer than before, but makes the bracketed
nature of the references a little clearer and introduces more
kasserts to detect mistakes with internal API usage.
 1.215  12-Jun-2021  riastradh usb(4): Nix unused struct usbd_interface::ui_priv.
 1.214  12-Jun-2021  riastradh usb(4): Make usbd_fill_iface_data atomic.

Now either it replaces and frees the old endpoints array, or it
leaves everything in place; it never leaves a partial update nor
requires the caller to free the old array.
 1.213  12-Jun-2021  riastradh usb(4): Tweak style in usbd_close_pipe.

No functional change intended.
 1.212  12-Jun-2021  riastradh usb(4): Merge logic in usbd_kill_pipe and usbd_close_pipe.

usbd_kill_pipe is now just usbd_abort/close_pipe.

No functional change intended.
 1.211  12-Jun-2021  riastradh usb(4): Fix fix for interface change pipe fix.

If there is an interface:
- Always put the pipe on the list in usbd_setup_pipe (if successful).
- Always have the pipe on the list from _before_ upm_open.
- Always keep the pipe on the list to _after_ upm_close, and after
the async task has completed.

This brings the logic in usbd_close_pipe and usbd_kill_pipe closer.
 1.210  12-Jun-2021  riastradh Revert "usb(4): Fix mistake in previous fix for pipe/interface-change races."

Little too fast on the commit trigger there before testing, oops.
We don't have the pipe yet until usbd_setup_pipe_flags returns!
 1.209  12-Jun-2021  riastradh usb(4): Fix mistake in previous fix for pipe/interface-change races.

Must block interface changes _before_ we enter usbd_setup_pipe_flags,
which calls the bus pipe open method.
 1.208  12-Jun-2021  riastradh usb(4): Fix races between usbd_open_pipe* and usbd_set_interface.
 1.207  12-Jun-2021  riastradh usb(4): Fix racy endpoint reference counting.

Rules:

1. After usbd_setup_pipe*, must usbd_kill_pipe.
2. After usbd_open_pipe*, must usbd_close_pipe.

Still haven't merged the logic in usbd_kill_pipe and usbd_close_pipe,
but getting closer.
 1.206  12-Jun-2021  riastradh usb(4): Omit needless lock/unlock cycle in usbd_pipe_close.

pipe->up_intrxfer is stable after construction, so no need to hold
the lock to check it.
 1.205  12-Jun-2021  riastradh usb(4): Cancel and wait for async task on closing pipe.

XXX usbd_kill_pipe and usbd_close_pipe should not be copypasta; there
should be only one instance of this logic.
 1.204  19-Aug-2020  msaitoh branches: 1.204.6;
s/ be be / be /
 1.203  13-Jul-2020  mrg for both usbd_transfer() and usbd_ar_pipe() be sure to reset the
xfer ux_state to XFER_BUSY when removing from the queue.

seems to fix an occasional panic i was seeing on pinebook and
pinebookpro lately with axen(4).

from riastradh@.

XXX: pullup-9.
 1.202  19-May-2020  jakllsch Use usbd_destroy_xfer() in usbd_request_async() instead of usbd_free_xfer().

The only user of usbd_request_async() & co. does a usbd_create_xfer(), so use
the correct deconstructor.
 1.201  15-May-2020  skrll Update ux_length in usbd_setup_isoc_xfer and use this to usb_syncmem
in the HCDs
 1.200  05-Apr-2020  skrll Switch USB to use non-coherent buffers for data transfers in the
same way as OpenBSD.

The use of coherent (uncacheable on ARM and other arches) mappings
for transfer buffers impacts performance, espcially where memcpys
are involved.

Audit the necessary usb_syncmem operations - a few were missing.
 1.199  03-Apr-2020  skrll Avoid crashes if we fail to allocate a transfer buffer and avoid an
unnecessary usbd_free_buffer before usbd_free_xfer

Worked out by Riastradh
 1.198  14-Mar-2020  christos revert the 0x% -> %# change for fixed width formats pointed out by uwe.
 1.197  14-Mar-2020  christos more changes from sc.dying in PR/55068
 1.196  13-Mar-2020  christos PR/55068: sc.dying: Fix printf formats:
- no %s/%p for kernel log
- 0x% -> %#
- always %j for kernel log
 1.195  19-Feb-2020  riastradh usbdi dtrace probes
 1.194  17-Feb-2020  riastradh When aborting a pipe, set pipe->up_running = 0.

This prevents any concurrent usb_transfer_complete from restarting
the pipe with usbd_start_next.
 1.193  16-Feb-2020  maxv Move usb_desc_* into usbdi_util.c, no functional change.
 1.192  12-Feb-2020  riastradh Factor out HCI-independent xfer completion logic.

New API for HCI drivers to synchronize hardware completion
interrupts, synchronous aborts, and asynchronous timeouts:

- When submitting an xfer to hardware, call
usbd_xfer_schedule_timeout(xfer).

- On HCI completion interrupt for xfer completion:

if (!usbd_xfer_trycomplete(xfer))
return; /* timed out or aborted, ignore it */

- In upm_abort methods, call usbd_xfer_abort(xfer).

For HCI drivers that use this API (not needed in drivers that don't,
or for xfers like root intr xfers that don't use it):

- New ubm_abortx method serves role of former *hci_abort_xfer, but
without any logic for wrangling timeouts/callouts/tasks -- caller
in usbd_xfer_abort has already handled them.

- New ubm_dying method, returns true if the device is in the process
of detaching, used by the timeout logic.

Converted and tested:
- ehci
- ohci

Converted and compile-tested:
- ahci (XXX did this ever work?)
- dwc2
- motg (XXX missing usbd_xfer_schedule_timeout in motg_*_start?)
- uhci
- xhci

Not changed:

- slhci (sys/dev/ic/sl811hs.c) -- doesn't use a separate per-xfer
callout for timeouts (XXX but maybe should?)

- ugenhc (sys/rump/dev/lib/libugenhc/ugenhc.c) -- doesn't manage its
own transfer timeouts

- vhci -- times transfers out only on detach; could be adapted easily
if we wanted to use the xfer->ux_callout
 1.191  12-Feb-2020  riastradh New xfer state variables ux_timeout_set and ux_timeout_reset.

These are needed because:

- The host controller interrupt cannot wait for the callout or task
to finish running.

- Nothing in the USBD API as is waits for the callout or task to
finish running.

- Callers expect to be able to resubmit USB xfers from xfer callbacks
without waiting for anything to finish running.

The variable ux_timeout_set can be used by a host controller to
decide on submission whether to schedule the callout or to ask an
already-scheduled callout or already-queued task to reschedule the
callout, by setting the variable ux_timeout_reset to true.

When the callout or task runs and sees that ux_timeout_reset is true,
rather than queue the task or abort the xfer, it can instead just
schedule the callout anew.
 1.190  12-Feb-2020  riastradh Nothing guarantees xfer's timeout has completed.

Wait for it when we free the xfer.
 1.189  08-Feb-2020  maxv Dedup usb_desc_iter_next with usb_desc_iter_peek.
 1.188  08-Feb-2020  maxv Introduce usbd_clear_endpoint_feature(), and dedup.
 1.187  08-Feb-2020  maxv Move uvideo's parsers into usbdi.c, to make them global. Rename
usb_desc_iter_peek_next -> usb_desc_iter_peek for consistency.
 1.186  28-Aug-2019  mrg branches: 1.186.2;
add new usbd_do_request_len() that can allocate a larger than
request size buffer. reimplement usbd_do_request_flags() in
terms of this. use this for fetching string descriptors.

fixes a very strange problem where an axe(4) attaching (either
has ugen(4) or axe(4)) would ask for 2 bytes, usb_mem.c would
allocate a 2 byte fragment, perform the operation, and sometime
shortly afterwards (usually by the time the next allocation
is made for this fragment), would become corrupted (usually
two bytes were written with 0x0304.)

(initial request of 4 bytes also avoids the problem on this
device. it really seems like a HC problem -- host should not
allow the device to write more than req.wLength! nor should
it allow this write to happen after completion.)

avoid an (almost) always double-log in usbd_transfer().
 1.185  24-Aug-2019  mrg don't try to deref a maybe-NULL pointer. instead of logging
potentially garbage (if not NULL), log the request length.
 1.184  22-Aug-2019  mrg fix more kernhist vs 32 bit issues.
 1.183  21-Aug-2019  mrg convert pairs of USBHIST_CALLED()+USBHIST_LOG*() into
USBHIST_CALLARGS() calls. this reduces the number of
kernel history lines consumed by these callers, and
for the +LOGN versions, add useful log info to a
message that just says "called!".

reduces the line spam which means the total info in a
full log is significantly increased.
 1.182  17-Feb-2019  rin branches: 1.182.4;
Fix system freeze when USB NICs with multiple outstanding transfers
are detached from xhci(4) or ehci(4), that enable up_serialise for
bulk transfers.

The cause of problem is that usbd_ar_pipe() waits xfers of
USBD_NOT_STARTED to be removed, although underlying upm_abort
functions do not remove such queues, as reported by "sc dying".

Therefore, remove xfers of USBD_NOT_STARTED when pipe is closed.

Patch provided by Nick Hudson.
 1.181  10-Jan-2019  skrll Avoid use after free when closing interrupt pipe transfer by calling
upm_close before destroying the interupt pipe xfer.

Found by kasan on wiz's machine.
 1.180  16-Nov-2018  manu Build fix

From David H. Gutteridge
 1.179  15-Nov-2018  manu Workaround NBP PN533 USB toggle bit bugs

The PN533 is known to mishandle the USB toggle bit, causing replies to
be filtered out by the host controller. As a result, the kernel sees
a timed out operation.

Vendor errata suggests that userland applications should detect the
situation on read timeout, and write a dumy frame to resync the toggle bit.
NFC Tools's libnfc does just that, but in order to succeed, the dummy
frame write must not be reported as timed out.

We therefore introduce a new USB quirk for devices known to miss output
acks. When that occur, we pretend that the operation succeeded, leaving
userland the duty to check that everything went okay.

This workaround lets libnfc recover from interrupted communications
without the need te reboot the system.
 1.178  16-Sep-2018  mrg consolidate the handling of polling across HC drivers, and generic USB:
- don't take mutexes if polling
- normalise the code across all drivers
- add some not yet code to block discovery to/from polling
- minor CSE
- adjust comment for usbd_set_polling() to reality now i properly
understand what it is used for and why.

this, with a hack to make RB_ASKNAME to wait 5 seconds allows boot -a
work with USB keyboards. there are still multiple issues remaining:
- discovery and polling need to be mutually exclusive
- attachment of ukbd and wskbd is not handled by config_pending, and
the 5 second delay isn't going to always be enough.
 1.177  09-Aug-2018  mrg pull across abort fixes from nick-nhusb. add more abort fixes, using
ideas from Taylor and Nick, and myself. special thanks to both who
inspired much of the code here, if not wrote it directly.

among other problems, this assert should no longer trigger:

panic: kernel diagnostic assertion "xfer->ux_state == XFER_ONQU" failed: file "/current/src/sys/dev/usb/usbdi.c", line 914

using usbhist i was able to track down my instance of it being related
to userland close() beginning, dropping the sc_lock, and then the usb
softintr completes the transfer normally, and when it is done, the
abort path attempts to re-complete the transfer, and the above assert
is tripped.


changes from nhusb were commited with these logs:
--
Move the struct usb_task to struct usbd_xfer for everyone to use.
--
Set device transfer status to USBD_IN_PROGRESS if start methods succeeds
--
Actually set the transfer status on transfers in ohci_abort_xfer and
the controller is dying
--
Don't supply the lock to callout_halt when polling as it won't be held
--
Improve transfer abort
--
Mark device transfers as USBD_IN_PROGRESS appropriately and improve
abort handling
--
#ifdef DIAGNOSTIC -> KASSERT and add another KASSERT
--
Mark device transfers as USBD_IN_PROGRESS appropriately and improve
abort handling
--

additional changes include:
- initialise the usb abort task in the HCI allocx routine, so that it
can be safely usb_rem_task()'d.
- rework the handling of softintr vs cancellation vs timeout abort based
upon a scheme from Taylor:
when completing a transfer normally:
- if the status is not in progress, it must be cancelled or timed out,
and we should not process this xfer.
- set the status as normal.
- unconditionallly callout_stop() and usb_rem_task(). they're safe and
either aren't running, or will run and do nothing.
- finally call usb_transfer_complete().
when aborting a transfer:
- status should be cancelled or timed out.
- if cancelling, callout_halt and usb_rem_task_wait() to make sure the
timer is either done or cancelled.
- at this point, the ux_status must not be cancelled or timed out, and
if it is not in progress we're done.
- set the status.
- if the controller is dying, just return.
- perform HCI-specific tasks to abort this xfer.
- finally call usb_transfer_complete().
for the timeout and timeout task:
- if the HCI is not dying, and the ux_status is in progress, then
trigger the usb abort task.
- remove UXFER_ABORTWAIT and UXFER_ABORTING.

tested on:
- multiple PC systems with several types of devices: ugen/UPS, ucom,
umass with disk, ssd and cdrom backends, kbd, ms, using uhci, ehci
and xhci.
- erlite3: sd@umass on dwc2.
- sunblade2000: kbd/ms and umass disk on ohci.

untested:
- motg, slhci and ahci. motg has some portion of the new scheme
applied, but slhci and ahci require more study.

future work includes pushing a lot of the common abort handling into
usbdi.c and leaving upm_abort() for HC specific tasks, but this change
is pullup-able to netbsd-7 and netbsd-8 as it does not change any
external API, as well as removing over 100 lines of code while adding
over 30 new asserts.

XXX: pullup-7, pullup-8.
 1.176  31-Jul-2018  khorben Add a port of the umb(4) driver from OpenBSD

The umb(4) driver provides support for USB MBIM (Mobile Broadband
Interface Model) devices.

MBIM devices establish connections via cellular networks such as GPRS,
UMTS, and LTE. They appear as a regular point-to-point network interface, transporting raw IP frames.

Required configuration parameters like PIN and APN have to be set with
umbctl(8), a new tool specific to this driver. The IP address is configured
automatically; the default route and DNS server information have to be set
separately.

The driver is not fully functional yet, it is therefore still marked as
experimental and disabled by default. Any help welcome to complete it!

Tested on NetBSD/amd64, with a Sierra Wireless EM7345 LTE modem on a Lenovo
ThinkPad T440s. No functional change expected otherwise.
 1.175  28-Oct-2017  pgoyette branches: 1.175.2; 1.175.4;
Update the kernhist(9) kernel history code to address issues identified
in PR kern/52639, as well as some general cleaning-up...

(As proposed on tech-kern@ with additional changes and enhancements.)

Details of changes:

* All history arguments are now stored as uintmax_t values[1], both in
the kernel and in the structures used for exporting the history data
to userland via sysctl(9). This avoids problems on some architectures
where passing a 64-bit (or larger) value to printf(3) can cause it to
process the value as multiple arguments. (This can be particularly
problematic when printf()'s format string is not a literal, since in
that case the compiler cannot know how large each argument should be.)

* Update the data structures used for exporting kernel history data to
include a version number as well as the length of history arguments.

* All [2] existing users of kernhist(9) have had their format strings
updated. Each format specifier now includes an explicit length
modifier 'j' to refer to numeric values of the size of uintmax_t.

* All [2] existing users of kernhist(9) have had their format strings
updated to replace uses of "%p" with "%#jx", and the pointer
arguments are now cast to (uintptr_t) before being subsequently cast
to (uintmax_t). This is needed to avoid compiler warnings about
casting "pointer to integer of a different size."

* All [2] existing users of kernhist(9) have had instances of "%s" or
"%c" format strings replaced with numeric formats; several instances
of mis-match between format string and argument list have been fixed.

* vmstat(1) has been modified to handle the new size of arguments in the
history data as exported by sysctl(9).

* vmstat(1) now provides a warning message if the history requested with
the -u option does not exist (previously, this condition was silently
ignored, with only a single blank line being printed).

* vmstat(1) now checks the version and argument length included in the
data exported via sysctl(9) and exits if they do not match the values
with which vmstat was built.

* The kernhist(9) man-page has been updated to note the additional
requirements imposed on the format strings, along with several other
minor changes and enhancements.

[1] It would have been possible to use an explicit length (for example,
uint64_t) for the history arguments. But that would require another
"rototill" of all the users in the future when we add support for an
architecture that supports a larger size. Also, the printf(3) format
specifiers for explicitly-sized values, such as "%"PRIu64, are much
more verbose (and less aesthetically appealing, IMHO) than simply
using "%ju".

[2] I've tried very hard to find "all [the] existing users of kernhist(9)"
but it is possible that I've missed some of them. I would be glad to
update any stragglers that anyone identifies.
 1.174  19-Oct-2017  skrll KASSERT -> KASSERTMSG and while I'm here update a comment
 1.173  01-Jun-2017  chs branches: 1.173.2;
remove checks for failure after memory allocation calls that cannot fail:

kmem_alloc() with KM_SLEEP
kmem_zalloc() with KM_SLEEP
percpu_alloc()
pserialize_create()
psref_class_create()

all of these paths include an assertion that the allocation has not failed,
so callers should not assert that again.
 1.172  04-Dec-2016  skrll Whitespace
 1.171  17-May-2016  pooka branches: 1.171.2;
initialize buf to NULL for error branch on line 532
 1.170  06-May-2016  skrll Fix polling mode and USB keyboards in ddb
 1.169  23-Apr-2016  skrll Merge nick-nhusb

- API / infrastructure changes to support memory management changes.
- Memory management improvements and bug fixes.
- HCDs should now be MP safe
- conversion to KERNHIST based debug
- FS/LS isoc support on ehci(4).
- conversion to kmem(9)
- Some USB 3 support - mostly from Takahiro HAYASHI (t-hash).
- interrupt transfers now get proper DMA operations
- general bug fixes
- kern/48308
- uhub status notification improvements
- umass(4) probe fix (applied to HEAD already)
- ohci(4) short transfer fix
 1.168  22-Dec-2015  skrll In usbd_transfer deal with errors from the HCD transfer (and start)
methods properly by removing the failed xfer from the pipe queue.

For example, an Apple keyboard and FS hub with attached ums(4) on
dwctwo(4) (rpo0/rpi model a) needs this fix otherwise probing
usbd_new_device will never complete after first failed attempt to get
the initial device descriptor.
 1.167  22-Dec-2015  skrll Improve debug/comments (mostly from nhusb)
 1.166  22-Dec-2015  skrll Can't use usbd_errstr in USBHIST_LOG as vmstat(1) doesn't like it
 1.165  26-Sep-2015  skrll Deal with polling in usbd_start_next
 1.164  23-Aug-2015  skrll Expose usbd_xfer_isread
 1.163  09-Feb-2015  aymeric clip xfer->actlen also in the !DIAGNOSTIC case
 1.162  12-Sep-2014  skrll branches: 1.162.2;
Improve USB debugging with USBHIST based on KERNHIST.

Convert some DPRINTFs to USBHIST_LOG and allow usbdebug, ehcidebug and
umassdebug to be changed via sysctl.

Remove the #define mess in usb.h.

This was started by mrg@ and updated by reinoud@
 1.161  05-Aug-2014  skrll branches: 1.161.2;
Simplify the freeing of the interrupt pipe transfer. Inspired by OpenBSD.
 1.160  30-Nov-2013  skrll branches: 1.160.2;
Simplify
 1.159  04-Oct-2013  skrll Small KNF
 1.158  03-Oct-2013  skrll Simply the code now that all (real) HCDs provide a get_lock method.
 1.157  26-Sep-2013  skrll Remove the usbd_do_request_async_cb prototype. This was missed from the
previous commit.
 1.156  26-Sep-2013  skrll Remove usbd_do_request_async. It's callback was calling usbd_free_xfer
from softint context.

Adjust callers appropriately

- usbd_clear_endpoint_stall_async is already triggered via a
usb_task, so simply call usbd_do_request.

- uhidev_set_report_async had one caller in ukbd_set_leds.
Convert this usage to use usb_task as well.

Discussed with mrg@
 1.155  22-Aug-2013  aymeric Check that the xfer we are about to abort didn't finish yet since abort
methods fail in this case (at least ehci's one).
 1.154  11-Jul-2013  aymeric In usbd_transfer(), abort the xfer if it is interrupted by a signal while in
progress.
This prevents that xfer from being freed while still on queue, and ensuing
panic().
 1.153  06-Jul-2013  jakllsch Use NULL instead of 0 when returning a NULL pointer.
Also, remedy minor whitespace issue.
 1.152  04-Apr-2013  skrll branches: 1.152.4;
Don't take the bus lock in usbd_transfer_complete when polling.

Sprinkle || polling in KASSERTsw
 1.151  24-Mar-2013  skrll Add || defined(OHCI_DEBUG) to pick up usbd_dump_pipe

Fixes kern/47690
 1.150  22-Jan-2013  jmcneill usbd_open_pipe and usbd_open_pipe_intr take different flags! Make sure
the value of USBD_MPSAFE doesn't conflict with flags for either of them, as
it can be passed to both.
 1.149  22-Jan-2013  jmcneill Use usbd_setup_pipe_flags instead of usbd_setup_pipe so the supplied flags
get passed through.
 1.148  22-Jan-2013  jmcneill - Add a USBD_MPSAFE flag to usbd_open_pipe. If not set, acquire KERNEL_LOCK
before invoking xfer callbacks on this pipe.
- Add an extra flags parameter to usb_init_task. If USBD_TASKQ_MPSAFE is not
present, acquire KERNEL_LOCK before invoking the task callback.
 1.147  22-Jan-2013  skrll Improve a DIAGNOSTIC so it doesn't confuse people who need more coffee,
e.g. me.
 1.146  19-Jan-2013  skrll Pay attention to the return value from cv_wait_sig as well in
usbd_transfer. hi christos.
 1.145  19-Jan-2013  skrll Improve some DIAGNOSTIC stuff
 1.144  16-Jan-2013  christos don't wait for completion if we were interrupted.
 1.143  15-Jan-2013  christos Don't do the xfer once, wait till it is done. I did not find this, someone
else did. Fixes slow devices such as scanners.
 1.142  05-Jan-2013  christos fix debug variables.
- include opt_usb.h in usb.h so that USB_DEBUG gets set properly in it.
- normalize and sort debugging variables
 1.141  05-Jan-2013  christos - need opt_usb.h if depending on USB_DEBUG
- remove trailing whitespace
- add missing KERNEL_RCSID
 1.140  04-Dec-2012  skrll Improve DIAGNOSTIC printf
 1.139  15-Jul-2012  mrg branches: 1.139.2;
commit my workaround for PR 46648 for now, as the more involved
fix is not ready yet:

move the clear endpoint stall async call into the task thread,
to avoid trying to call kmem_alloc() from a softint thread.

XXX ideally moving callbacks into the task thread (or perhaps
a different high priority task thread) would be better than this
workaround, once that method is working.
 1.138  10-Jun-2012  mrg merge the jmcneill-usbmp branch. many thanks to jared for the
initial work, and every one else who has tested things for me.
this is largely my fault at this point :-)

the main changes are something like:

- usbd_bus_methods{} gains a get_lock() to enable the
host controller to provide a lock for the USB code.
if the lock isn't provided, old-style protection is
(partially) applied.

- ehci/ohci/uhci have been converted to the new
interfaces, including mutex/cv/etc conversion.

- usbdivar.h contains a discussion about locking and
what locks are held for which method calls. more
to come for usbdi(9) here.

- audio drivers (uaudio, umidi, auvitek) have been
properly SMPified now that USB is ready.

- scsi drivers have been modified to take the kernel
lock explicitly before calling into scsi code.

- usb pipes are associated with a lock, that is the
same as the controller lock. (this could be split
up further in the future.)

- several usbfoo_locked() or usbfoo_unlocked()
functions have been added to the usbdi(9) to
enable functionality with or without the USB
lock (per controller) already being held.

the TODO.usbmp file has specific details on what is left to
do, including what device-specific changes should be done now
that the whole framework is ready.
 1.137  11-Mar-2012  mrg minor cleanups from usbmp:
- move usbd_delay_ms() into usbdivar.h in the usb_subr.c section
- minor rcsid fixes
- copyright maintenence
 1.136  11-Mar-2012  mrg pull down from usbmp branch:
- remove usbd_bus{} intr_context member, and replace the checks against
it with cpu_intr_p() and cpu_softintr_p().
 1.135  06-Mar-2012  mrg pull down from usbmp branch:

- remove SPLUSBCHECK. it has been broken and disabled for ages.
 1.134  27-Nov-2011  jmcneill branches: 1.134.2; 1.134.4; 1.134.8; 1.134.10;
assert kernel_lock in usbd_transfer, usb_transfer_complete,
and usb_insert_transfer
 1.133  30-Jul-2011  jmcneill branches: 1.133.2;
PR# port-i386/18818: cannot enter ddb with usb keyboard

- ohci: when polling, make sure sc_eintrs has the OHCI_WDH flag set
otherwise ohci_intr1 won't actually read data
- usbdi: kick the host controller by calling its soft_intr callback when
switching out of polling mode too

DDB with a USB keyboard works for me now with ohci.
 1.132  09-Jun-2011  matt Move EHCI_DEBUG, OHCI_DEBUG, UHCI_DEBUG, USB_DEBUG, UHUB_DEBUG to opt_usb.h
(ya dependencies).
Cleanup usb_mem.c a little more and add block tracking code. Help find
corruption problems.
Comment out the SPEED check for ETTF. XXX why doesn't that work right?
 1.131  20-Dec-2010  phx branches: 1.131.6;
usbd_dump_*() functions are also needed when just EHCI_DEBUG is defined,
without USB_DEBUG.
 1.130  03-Nov-2010  dyoung Stop using the compatibility macros USB_ATTACH(), USB_DETACH(),
USB_MATCH(), et cetera. These files produce the same assembly
(according to objdump -d) before and after the change
 1.129  04-Sep-2010  cegger revert previous.
requested from mrg
 1.128  03-Sep-2010  cegger fix NULL pointer dereference on detaching:
Attach an USB device that looks like this:
ugen1 at uhub0 port 2
ugen1: detached
ugen1: at uhub0 port 2 (addr 3) disconnected


When unplugging the device:

usb_transfer_complete: xfer=0xffff80000832a800 not busy 0x00000055
usb_transfer_complete: bad dequeue 0xffff80000832a800 != 0x0
 1.127  16-Jan-2010  bouyer branches: 1.127.2; 1.127.4;
Fix leak of a usbd_xfer_handle when a interrupt pipe is aborted then
closed:
usbd_open_pipe_intr() allocates a usbd_xfer_handle for pipe->intrxfer.
Most usb device drivers using interrupt pipes call usbd_abort_pipe()
then usbd_close_pipe(), usbd_close_pipe() is supposed to free pipe->intrxfer.
But usbd_abort_pipe() calls [uoe]hci_device_intr_abort() which,
if the xfer aborted is pipe's intrxfer, sets pipe->intrxfer to NULL.
So usbd_close_pipe() can't free it and the usbd_xfer_handle is lost.

To fix this, in usbd_abort_pipe() remember the pipe->intrxfer's value
on entrie, and if it's different after usbd_ar_pipe(), call
usbd_free_xfer with the original value.
Confirmed to fix the memory leak on close() with umodem(4) and
uplcom(4).
 1.126  12-Nov-2009  uebayasi Typo in a debug printf.
 1.125  12-Dec-2008  jmorse PR#39651
Fix two problems in umass:
* usb xfers being freed before being removed from pipe, leading to null deref
* config_activate requests not supported, which leads to config_deactivate requests not being passed through. Spotted by jmcneill@

Added mechanism to usbdi allowing the default pipe to be aborted
 1.124  11-Oct-2008  jmcneill branches: 1.124.2; 1.124.4;
If we're not dealing with an interrupt endpoint, invoke the xfer's
callback after calling the xfer's done method to give the device driver
a change to reschedule the same xfer, from FreeBSD.
 1.123  26-May-2008  drochner branches: 1.123.4;
some cleanup:
-unifdef
-since the roothub attach doesn't use locators, don't call
config_stdsubmatch() -- it is a no-op in that case
-ifsubmatch has configuration and interface always set to useful values,
remove unnecessary checks
-remove now unused locator definitions from shared header
 1.122  28-Apr-2008  martin branches: 1.122.2;
Remove clause 3 and 4 from TNF licenses
 1.121  19-Oct-2007  ad branches: 1.121.16; 1.121.18; 1.121.20;
machine/{bus,cpu,intr}.h -> sys/{bus,cpu,intr}.h
 1.120  15-Aug-2007  kiyohara branches: 1.120.2; 1.120.6;
* splsoftusb, IPL_SOFTUSB, and IPL_HARDUSB defines in usbdi.h
-> the current names are confusing (didn't change other drivers)
* fix invalid memory access in usbd_transfer (kern/24636)
-> needed for this driver
* fix USB HC detach race condition (kern/32011)
-> main patch needed for this driver, sc_dying changes in other drivers
not necessary but seem right to me

Patch from Matthew Orgass.
http://mail-index.netbsd.org/tech-kern/2007/06/26/0001.html
 1.119  26-Feb-2007  drochner branches: 1.119.4; 1.119.12; 1.119.14; 1.119.18;
-g/c usbd_init()/usbd_finish() which don't do anything useful
-use <fs/unicode.h> for utf16->utf8 conversion instead of a private
implementation
-streamline the COMPAT_30 utf16->ascii conversion a bit: remove
length check (USB_MAX_STRING_LEN is too large to be useful) and
replace array index arithmetics
 1.118  10-Feb-2007  mlelstv branches: 1.118.2;
The diagnostic code doesn't track busy_free correctly when a
device gets removed. However, when the diagnostic check fails,
it is much better to complete the free operation than to abort
it, because this just causes an infinite loop.
 1.117  29-Jan-2007  hubertf Remove more duplicate headers.
Patch by Slava Semushin <slava.semushin@gmail.com>

Again, this was tested by comparing obj files from a pristine and a patched
source tree against an i386/ALL kernel, and also for src/sbin/fsck_ffs,
src/sbin/fsdb and src/usr.sbin/makefs. Only changes in assert() line numbers
were detected in 'objdump -d' output.
 1.116  05-Dec-2006  macallan move int j into #ifdef COMPAT_30 to avoid an unused variable warning when
building without COMPAT_30
 1.115  03-Dec-2006  pavel Restore compatibility of USB_DEVICEINFO ioctl and reads from /dev/usb with
NetBSD 3.x. Patch from Stephan Thesing provided in
http://mail-index.netbsd.org/current-users/2006/03/21/0002.html, with some
modifications by me.
See also
http://mail-index.netbsd.org/current-users/2006/08/29/0017.html

The code is conditionally compiled depending on COMPAT_30.

Also fix a leak of struct usb_event in usbread() introduced while converting
on-stack variables to dynamic allocation.

Reviewed by martin@.
 1.114  16-Nov-2006  christos branches: 1.114.2;
__unused removal on arguments; approved by core.
 1.113  12-Oct-2006  christos - sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386
 1.112  04-Oct-2006  dogcow add braces for if-else statement, in the event that DPRINTF is an
empty statement; shuts gcc up about 'empty statement in if-else'.
 1.111  03-Oct-2006  christos Coverity CID 3014: Don't check for NULL after deref (from Arnaud Lacombe)
 1.110  24-Dec-2005  perry branches: 1.110.20; 1.110.22;
Remove leading __ from __(const|inline|signed|volatile) -- it is obsolete.
 1.109  11-Dec-2005  christos merge ktrace-lwp.
 1.108  30-May-2005  christos branches: 1.108.2;
- const poisoning
- eliminate variable shadowing
 1.107  02-May-2005  augustss Use UTF8 to encode strings read from the device (instead of using '?' for
characters >=0x100).

Also add serial number string to the device information struct.
 1.106  24-Oct-2004  augustss Whine about not being able to figure out default language if we are debugging.
 1.105  23-Oct-2004  augustss Make an iterator abstraction for looping through all descriptors.

Move usb_get_string() and make it public.
 1.104  17-Jul-2004  mycroft ugen_isoc_rintr() may recycle the xfer immediately. Therefore, we avoid
touching the xfer after calling the callback in usb_transfer_complete().
From PR 25960.
 1.103  27-Sep-2002  provos branches: 1.103.6; 1.103.8;
remove trailing \n in panic(). approved perry.
 1.102  11-Jul-2002  augustss Get rid of trailing white space.
 1.101  01-Jun-2002  lukem SIMPLEQ rototill:
- implement SIMPLEQ_REMOVE(head, elm, type, field). whilst it's O(n),
this mirrors the functionality of SLIST_REMOVE() (the other
singly-linked list type) and FreeBSD's STAILQ_REMOVE()
- remove the unnecessary elm arg from SIMPLEQ_REMOVE_HEAD().
this mirrors the functionality of SLIST_REMOVE_HEAD() (the other
singly-linked list type) and FreeBSD's STAILQ_REMOVE_HEAD()
- remove notes about SIMPLEQ not supporting arbitrary element removal
- use SIMPLEQ_FOREACH() instead of home-grown for loops
- use SIMPLEQ_EMPTY() appropriately
- use SIMPLEQ_*() instead of accessing sqh_first,sqh_last,sqe_next directly
- reorder manual page; be consistent about how the types are listed
- other minor cleanups
 1.100  19-May-2002  augustss Update dma memory access API a little.
 1.99  28-Feb-2002  thorpej branches: 1.99.8;
Don't use NULL for non-pointer arguments.
 1.98  26-Feb-2002  augustss Fix a typo that prevented timeout in control requests from working.
Spotted by Alfred Perlstein <bright@mu.org>.
 1.97  20-Feb-2002  christos Prefix structure members to protect them against clashes with eg. c++ keywords.
Suggested by Alfred Perlstein, from FreeBSD, ok'd by augustss
 1.96  11-Feb-2002  augustss Give usbd_do_request_flags() an extra argument for the timeout.
 1.95  11-Feb-2002  augustss A little const poisoning. (From FreeBSD.)
 1.94  30-Dec-2001  augustss Make sure we don't have any pending softintrs when entering polling mode.
Thanks to Darrin for finding and fixing this problem when using USB
keyboards in DDB.
 1.93  24-Dec-2001  augustss Add some more DIAGNOSTIC tests.
Make usb_match_device() match on USB_PRODUCT_ANY.
 1.92  12-Dec-2001  augustss Some more paranoia checks when DIAGNOSTIC.
 1.91  12-Dec-2001  augustss Move usbd_clear_endpoint_toggle() prototype to usbdi.h.
 1.90  03-Dec-2001  augustss Handle vendor/product lookup with a common routine.
 1.89  02-Dec-2001  augustss Add a subroutine to search for a vendor/product pair.
 1.88  22-Nov-2001  augustss Improve dump routine slightly.
 1.87  21-Nov-2001  augustss Fix indentation and typos.
 1.86  20-Nov-2001  augustss Keep track of device speed for USB 2.0.
 1.85  15-Nov-2001  augustss usbd_interface2device_handle() cannot fail.
 1.84  13-Nov-2001  lukem add RCSIDs
 1.83  10-Nov-2001  augustss Get rid of unused abort_handle.
 1.82  10-Nov-2001  augustss Add some dump routines for debugging.
 1.81  17-Apr-2001  augustss branches: 1.81.2; 1.81.6;
Add a DIAGNOSTIC.
 1.80  13-Apr-2001  augustss Finally get rid of the UGLY and EVIL hack for avoiding tsleep().
 1.79  21-Jan-2001  augustss branches: 1.79.2;
Add code to use soft interrupt to handle USB interrupt processing.
Don't enable the code since it doesn't work with the kludgy Ethernet drivers.
 1.78  19-Jan-2001  augustss Make this compile again after const-ification.
 1.77  23-Sep-2000  augustss Add a way to do control transfers on other pipes than the default pipe.
 1.76  06-Jun-2000  augustss Initialize pointer before doing free of it.
 1.75  01-Jun-2000  augustss Make it compile with USB_DEBUG.
 1.74  01-Jun-2000  augustss Bring the coding style into the 80s, i.e., get rid of __P and use
ANSI prototypes and declarations.
 1.73  31-May-2000  augustss Be more careful when setting the alternate interface so we don't end up with
nothing set at all if it fails.
 1.72  27-Apr-2000  augustss branches: 1.72.2;
Change my email address.
 1.71  29-Mar-2000  augustss Do not accept new xfers for queuing while a pipe is aborting.
 1.70  28-Mar-2000  augustss Add a comment.
 1.69  27-Mar-2000  augustss Change (almost) all static to Static. The symbol `Static' can then be defined
to `' or `static' depending on if you want to debug or not.
 1.68  25-Mar-2000  augustss Rename and move around callout handles to make it more sane.
Add some DIAGNOSTIC.
Fix buglet in isoc abort on UHCI.
 1.67  24-Mar-2000  augustss Some cleanup and renaming of the callouts used in USB drivers.
 1.66  23-Mar-2000  thorpej Shake out some bugs from the callout changes.
 1.65  08-Mar-2000  augustss Get the status right when a polled transfer times out.
 1.64  02-Mar-2000  augustss Fix typo in argument to ratecheck().
 1.63  02-Mar-2000  augustss Use ratecheck() to limit error messages on disconnect.
Break out some common functionality.
 1.62  08-Feb-2000  augustss Don't stall the control pipe on error.
 1.61  31-Jan-2000  augustss Change the way the HC done method is invoked a little.
 1.60  19-Jan-2000  augustss Add an argument to usbd_open_pipe_intr() to specify the polling interval
for an interrupt pipe in case we don't what what the descriptor suggests.
 1.59  18-Jan-2000  augustss Move the zeroing of the xfer to the individual methods.
 1.58  18-Jan-2000  augustss Turn xfer allocation into a method in the HC driver. The reason is that
an HC driver may want to subclass the xfer to have additional private fields.
 1.57  16-Jan-2000  augustss Add usbd_reload_device_desc() to get the device descriptor again from a device.
Useful if e.g. downloading firmware updates the revision number.
 1.56  16-Jan-2000  augustss Get timeout right in the gruesome hack.
 1.55  16-Jan-2000  augustss XXX Add a temporary, gruesome hack. It allows transfers to
XXX be done using delay() instead of tsleep().
XXX This enables transfers to be made from an interrupt context, which
XXX is needed until some more threads are added to the kernel.
XXX Using this hack (which is rare) causes the kernel to busy-wait
XXX for up to 1 ms at splusb().
 1.54  16-Jan-2000  augustss Let usbd_set_polling() work on a usbd_device_handle instead of
a usbd_interface_handle.
 1.53  28-Nov-1999  augustss More USB_DEBUG and DIAGNOSTIC output.
 1.52  26-Nov-1999  augustss Cosmetic change.
 1.51  18-Nov-1999  augustss Cosmetic changes and some small improvements. From FreeBSD and Nick Hibma.
 1.50  17-Nov-1999  augustss A few more purely stylistic changes that I missed in the last round.
 1.49  16-Nov-1999  augustss Add a few more diagnostics.
 1.48  12-Nov-1999  augustss A number of stylistic changes to increase readability (many suggested
by Nick Hibma):
use NULL not 0
declare all local definitions static
rename s/usbd_request/usbd_xfer/ s/reqh/xfer/
rename s/r/err/
use implicit test for no err
KNF
 1.47  13-Oct-1999  augustss branches: 1.47.2; 1.47.4;
Fix a glitch in dequeueing and aborting requests on interrupt pipes.
 1.46  13-Oct-1999  augustss Temporarily disable a DIAGNOSTIC.
 1.45  13-Oct-1999  augustss Merge in a large batch of changes from Nick Hibma <hibma@skylink.it> so
the USB stack compiles on FreeBSD again.
 1.44  12-Oct-1999  augustss Add an event mechanism so that a userland process can watch devices come
and go.
 1.43  15-Sep-1999  augustss branches: 1.43.2;
Add a sanity check to the computed actual transfer length.
 1.42  15-Sep-1999  augustss Handle the use_polling flag with a lttle more care and only set it if
we are cold booting.
 1.41  15-Sep-1999  augustss Add preliminary (untested) code for detaching the USB host controller
(needed for CardBus based controllers).
 1.40  13-Sep-1999  augustss * Make sure an aborted pipe is marked as not running.
* Start queued request in the right order.
* Insert some more DIAGNOSTIC sanity checks.
 1.39  13-Sep-1999  augustss Rearrange the code a little so we can decide if we are in process
or interrupt context in a reliable way. Mainly used for DIAGNOSTIC.
 1.38  12-Sep-1999  augustss Add a flag in the request to determine if the data copying is done by the
driver or the usbdi layer.
 1.37  11-Sep-1999  augustss * Move DMA buffer allocation to HC independent code.
* Remove (almost) unused definitions USBD_XFER_OUT and USBD_XFER_IN.
 1.36  09-Sep-1999  augustss Change the internal API to allow DMA buffers to be pre-allocated by
the device driver instead of happening automagically in the HC driver.
This affects both the HC-USBD interface as well as the USBD-device
interface.
This change will allow DMA buffers to be reused e.g. in isochronous
traffic.

Add isochronous support to the UHCI driver (not for OHCI yet).
 1.35  05-Sep-1999  augustss Change some printf to DPRINTF for consistency. From Nick Hibma, FreeBSD.
 1.34  05-Sep-1999  augustss Change the way the `struct device' base part of all driver softc are
declared and accessed to make it more portable. Idea from Nick Hibma, FreeBSD.
No functional changes.
 1.33  28-Aug-1999  augustss Add some comments.
 1.32  23-Aug-1999  augustss Make sure to mark the device as dying already in the (de)activate routine.
This avoids access to it before the detach routine has blown it away.
 1.31  22-Aug-1999  augustss Move more of the transfer completion processing to HC independent code.
Fix some problems with transfer abort & timeout.
 1.30  17-Aug-1999  augustss Redo the UHCI data toggle handling.
Make sure data toggles get synchronized on open and
when clearing an endpoint stall.
 1.29  17-Aug-1999  augustss Make some small changes to make it compile on OpenBSD.
 1.28  16-Aug-1999  augustss Change the way transfers are dequeued so thet we know that they
are removed from the queue before being deallocated.
 1.27  14-Aug-1999  augustss Some changes from FreeBSD (no functional differences).
 1.26  06-Jul-1999  augustss Add some sanity checks.
 1.25  30-Jun-1999  augustss Totally redo the way device detach is done. It now uses a kernel event
thread and the config detach method.
Squish a number of space leaks on detach.
 1.24  14-Jun-1999  augustss Get rid of a bunch of code that was part of an old USBDI proposal, but that
is unused in our USB stack.

Once upon a time, when I started writing the USB stack for NetBSD, there
was an effort to make a standard for how USB device drivers should interact
with the rest of the USB stack. This effort had contributors from just
about all Un*x camps (but not Micro$oft :). I based my design on one of their
early proposals since I thought it would be a good idea if we could all
share device drivers with a minimum effort. Shortly after I started my work
all the free Un*x people were thrown out of the USBDI work since we did not
pay the USB membership fee. Well, some time has passed now and the work of
the standardization group is almost public again. But alas, the new standard
has grown to be a monster! I do not want to have this as the basis for the
*BSD USB stack; it is far too complicated.
So, since we are not even close to being compilant with the standard, I've
thrown out some old baggage.
 1.23  13-May-1999  augustss More DIAGNOSTIC tests.
 1.22  09-May-1999  augustss Minor rearrengment for better readability.
 1.21  10-Jan-1999  augustss branches: 1.21.4;
Some minor updates from FreeBSD.
 1.20  08-Jan-1999  augustss Various little fixes from the FreeBSD version.
 1.19  03-Jan-1999  augustss Add a length paarmeter to usbd_do_request_flags().
 1.18  29-Dec-1998  augustss Minor change in a debug printf.
 1.17  29-Dec-1998  augustss Make it possible to specify the request flags when issuing a raw USB request.
 1.16  28-Dec-1998  augustss Change the host controller internal API a little and add some incomplete
support for isochronous transfers.
 1.15  26-Dec-1998  augustss Merge changes to make the USB stack work with FreeBSD. The original
diffs from Nick Hibma <n_hibma@freebsd.org>, but with substantial
changes from me.
XXX Not tested on FreeBSD yet.
 1.14  10-Dec-1998  augustss Take care of some lines > 80 chars.
 1.13  09-Dec-1998  augustss Improvement to the ugen driver.
Better error checking.
Some code rearrengment.
 1.12  08-Dec-1998  augustss Some minor API changes and additions.
 1.11  25-Nov-1998  augustss Make the copyright header conform to the NetBSD template.
 1.10  20-Oct-1998  augustss Fix typo.
 1.9  02-Aug-1998  augustss Improve some error messages.
Make some preparations for isochronous transfers.
 1.8  01-Aug-1998  augustss Switch from a global flag to tell if the host controller should use
polling to a local one for each controller.
 1.7  29-Jul-1998  augustss Add functions to execute asynchronous requests and use these from
interrupt context.
[I had some feline debugging help here. I noticed that every time Kem,
our kitty, jumped onto the USB keyboard the machine crashed.]
 1.6  26-Jul-1998  augustss A first stab att supporting console access with a USB keyboard.
 1.5  25-Jul-1998  augustss Add an ioctl() to get host controller statistics.
 1.4  24-Jul-1998  augustss Make sure requests are aborted properly when the pipe is aborted.
 1.3  23-Jul-1998  augustss Add some comments and a function to set the alternate settings in an
interface.
 1.2  22-Jul-1998  augustss Loop over all configurations when trying to probe for interface drivers.
 1.1  12-Jul-1998  augustss Add USB support. Supported so far:
* UHCI and OHCI host controllers on PCI
* Hubs
* HID devices withe special drivers for mouse and keyboard
* Printers
 1.21.4.3  02-Aug-1999  thorpej Update from trunk.
 1.21.4.2  01-Jul-1999  thorpej Sync w/ -current.
 1.21.4.1  21-Jun-1999  thorpej Sync w/ -current.
 1.43.2.1  27-Dec-1999  wrstuden Pull up to last week's -current.
 1.47.4.1  15-Nov-1999  fvdl Sync with -current
 1.47.2.3  21-Apr-2001  bouyer Sync with HEAD
 1.47.2.2  11-Feb-2001  bouyer Sync with HEAD.
 1.47.2.1  20-Nov-2000  bouyer Update thorpej_scsipi to -current as of a month ago
A i386 GENERIC kernel compiles without the siop, ahc and bha drivers
(will be updated later). i386 IDE/ATAPI and ncr work, as well as
sparc/esp_sbus. alpha should work as well (untested yet).
siop, ahc and bha will be updated once I've updated the branch to current
-current, as well as machine-dependant code.
 1.72.2.1  22-Jun-2000  minoura Sync w/ netbsd-1-5-base.
 1.79.2.8  18-Oct-2002  nathanw Catch up to -current.
 1.79.2.7  01-Aug-2002  nathanw Catch up to -current.
 1.79.2.6  20-Jun-2002  nathanw Catch up to -current.
 1.79.2.5  01-Apr-2002  nathanw Catch up to -current.
(CVS: It's not just a program. It's an adventure!)
 1.79.2.4  28-Feb-2002  nathanw Catch up to -current.
 1.79.2.3  08-Jan-2002  nathanw Catch up to -current.
 1.79.2.2  14-Nov-2001  nathanw Catch up to -current.
 1.79.2.1  21-Jun-2001  nathanw Catch up to -current.
 1.81.6.1  12-Nov-2001  thorpej Sync the thorpej-mips-cache branch with -current.
 1.81.2.5  10-Oct-2002  jdolecek sync kqueue with -current; this includes merge of gehenna-devsw branch,
merge of i386 MP branch, and part of autoconf rototil work
 1.81.2.4  06-Sep-2002  jdolecek sync kqueue branch with HEAD
 1.81.2.3  23-Jun-2002  jdolecek catch up with -current on kqueue branch
 1.81.2.2  16-Mar-2002  jdolecek Catch up with -current.
 1.81.2.1  10-Jan-2002  thorpej Sync kqueue branch with -current.
 1.99.8.3  15-Jul-2002  gehenna catch up with -current.
 1.99.8.2  20-Jun-2002  gehenna catch up with -current.
 1.99.8.1  30-May-2002  gehenna Catch up with -current.
 1.103.8.1  23-Jul-2004  tron Pull up revision 1.104 (requested by mycroft in ticket #688):
ugen_isoc_rintr() may recycle the xfer immediately. Therefore, we avoid
touching the xfer after calling the callback in usb_transfer_complete().
From PR 25960.
 1.103.6.5  10-Nov-2005  skrll Sync with HEAD. Here we go again...
 1.103.6.4  02-Nov-2004  skrll Sync with HEAD.
 1.103.6.3  21-Sep-2004  skrll Fix the sync with head I botched.
 1.103.6.2  18-Sep-2004  skrll Sync with HEAD.
 1.103.6.1  03-Aug-2004  skrll Sync with HEAD
 1.108.2.5  27-Oct-2007  yamt sync with head.
 1.108.2.4  03-Sep-2007  yamt sync with head.
 1.108.2.3  26-Feb-2007  yamt sync with head.
 1.108.2.2  30-Dec-2006  yamt sync with head.
 1.108.2.1  21-Jun-2006  yamt sync with head.
 1.110.22.2  10-Dec-2006  yamt sync with head.
 1.110.22.1  22-Oct-2006  yamt sync with head
 1.110.20.3  01-Feb-2007  ad Sync with head.
 1.110.20.2  12-Jan-2007  ad Sync with head.
 1.110.20.1  18-Nov-2006  ad Sync with head.
 1.114.2.2  06-Apr-2007  bouyer Pull up following revision(s) (requested by pavel in ticket #556):
sys/dev/usb/ugen.c: revision 1.89
sys/dev/usb/usb.c: revisions 1.92, 1.93
sys/dev/usb/usb_subr.c: revision 1.139, 1.140
sys/dev/usb/usb.h: revision 1.75
sys/dev/usb/usbdi.h: revisions 1.71, 1.72
sys/dev/usb/usbdi.c: revision 1.115, 1.116
sys/dev/usb/uhid.c: revision 1.73
Restore compatibility of USB_DEVICEINFO ioctl and reads from /dev/usb with
NetBSD 3.x. The code is conditionally compiled depending on COMPAT_30.
 1.114.2.1  21-Feb-2007  tron Pull up following revision(s) (requested by mlelstv in ticket #450):
sys/dev/usb/ohci.c: revision 1.181
sys/dev/usb/uhci.c: revision 1.207
sys/dev/usb/ehci.c: revision 1.122
sys/dev/usb/usbdi.c: revision 1.118
The diagnostic code doesn't track busy_free correctly when a
device gets removed. However, when the diagnostic check fails,
it is much better to complete the free operation than to abort
it, because this just causes an infinite loop.
 1.118.2.1  27-Feb-2007  yamt - sync with head.
- move sched_changepri back to kern_synch.c as it doesn't know PPQ anymore.
 1.119.18.2  26-Oct-2007  joerg Sync with HEAD.

Follow the merge of pmap.c on i386 and amd64 and move
pmap_init_tmp_pgtbl into arch/x86/x86/pmap.c. Modify the ACPI wakeup
code to restore CR4 before jumping back into kernel space as the large
page option might cover that.
 1.119.18.1  16-Aug-2007  jmcneill Sync with HEAD.
 1.119.14.1  15-Aug-2007  skrll Sync with HEAD.
 1.119.12.8  12-Nov-2009  uebayasi Reduce diff to HEAD.
 1.119.12.7  12-Nov-2009  uebayasi Sort functions to reduce the diff. Put a comment about a backward-incompatible
API change.
 1.119.12.6  21-May-2008  itohy Hold mbuf chain in struct usbd_xfer.
 1.119.12.5  28-Jun-2007  itohy Do not use xfer contents after non-error completion of transfer method,
since the callback function may reuse the xfer.
Pointed out by Matthew Orgass.
 1.119.12.4  22-Jun-2007  itohy Oops, xfer->rqflags -> xfer->flags
 1.119.12.3  22-Jun-2007  itohy - Introduce USBD_CALLBACK_AS_TASK flag, which causes the callback function
is called as a USB_TASKQ_DRIVER task, with thread context.
This makes sharing Ethernet drivers with FreeBSD (that requires context
for some network-related code) much easier.
The flag is not used by NetBSD/OpenBSD for now.

- Rename xfer->async_task as xfer->task, now used by both async xfer and the
callback above.

- Use 0 as idle task queue ID (definition USB_TASKQ_IDLE added), and
increase USB_TASKQ_HC and USB_TASKQ_DRIVER accordingly.
This makes passing zero-initialized (but not initialized by usb_init_task())
usb_task to usb_rem_task() be ignored, rather than panic the system.
 1.119.12.2  31-May-2007  itohy usbdi(9): Change usbd_map_buffer_mbuf to return the result, since
mbuf(9) chain may be fragmented and mapping failure will happen.
-void usbd_map_buffer_mbuf(usbd_xfer_handle xfer, struct mbuf *chain)
+usbd_status usbd_map_buffer_mbuf(usbd_xfer_handle xfer, struct mbuf *chain)

usbdi(9): Add more diagnostic assertions.
uhci(4): fix aux dma for mbuf mapping.
slhci(4): fix repeated interrupt transfer (not tested).
ehci/slhci/ohci/uhci: Add checks where mbuf(4) transfer is not supported.

usb_port.h: Add some compat macros for FreeBSD.
usb_mem_nodma.c: Fix typos.
 1.119.12.1  22-May-2007  itohy Overhaul of USB stack, mostly DMA related

This applies to NetBSD 4.99.13 (March 1, 2007)

usbdi(9) interface is based on FreeBSD version, excluding
- removal of portability code

Patch most NetBSD changes, excluding
- DMA memory "reserve", since we don't need contiguous buffers any longer
- volatiles in DMA structure, since it should not be needed
with proper bus_dmamap_sync(9)s

DMA/non-DMA memory management overhaul
- Move all DMA related code to usb_mem.[ch]
(add usb_alloc_buffer_dma(), usb_free_buffer_dma(), etc.).
XXX Should usb_mem.[ch] be renamed as usb_mem_dma.[ch] ?
- Add corresponding non-DMA code to usb_mem_nodma.[ch] .
Currently just use malloc(9).
- Above files are conditionally used by config framework (added
attributes to conf/files and dev/usb/files.usb).
- Add diagnostic panics when resource allocation is requested
on interrupt context.
- Change memory allocations (that require context) from NOWAIT to WAITOK.

Allocate DMA/non-DMA buffer per host interface, not globally.
advantage: Buffers can be freed on detaching host interface.
Activity of a host interface does not affect others.
disadvantages: It possibly consumes more memory.

API changes
- usbd_alloc_xfer() is changed:
old: usbd_xfer_handle usbd_alloc_xfer(usbd_device_handle dev);
new: usbd_xfer_handle usbd_alloc_xfer(usbd_device_handle dev,
usbd_pipe_handle pipe);
- pipe argument of usbd_setup_*xfer() are now unused
XXX the pipe argument should be removed?
- add mapping APIs
- async request will be processed as a task (kernel thread context),
and delayed to some extent
- usbdivar.h: struct usbd_xfer: renamed a member "allocbuf" to "hcbuffer"
(mapped/allocated/refered buffer for HCI driver)
- usb_port.h: change usb_proc_ptr from struct ptoc * to struct lwp *
- usb_port.h: add usb_sigproc_ptr for psignal(9) (struct proc *)
- usb.h: add UE_MAXPKTSZ(ep) and UE_MAXPKTSZ_MASK macros for USB 2.0

changes to USB device drivers
- atu, aue, axe, cdce, cue, kue, rum, udav, upl, ural, url,
uaudio, ubt, ucom, ugen, uhidev, uirda, ulpt, umidi, urio,
uscanner, ustir, utoppy:
* catch up API change of usbd_alloc_xfer()
- umass, usscanner:
* catch up API change of usbd_alloc_xfer()
* eliminate memory copy for large transfer

ohci
- free resources on detach
- add lots of bus_dmamap_sync() operations
- simplify the code of loading std chain
- rewrite code of looking up TD/ITD from DMA addr by using allocation chunk
- add workaround for CMD Tech 670 and 673 chipsets
- make sure resources are not allocated in interrupt context
- add support for mapping buffer and mbuf

slhci
- allocate xfer and slhci_xfer at once, and simplify relevant code
- add slhci_detach()
- remove second arg of slhci_attach() since it is the same as the first arg.
- add support for "mapping" (no, it doesn't map since it doesn't do DMA)
buffer and mbuf
- add pcmcia frontend
- NOT TESTED, missing hardware

ehci
- add lots of bus_dmamap_sync() operations, possibly too many
- make sure resources are not allocated in interrupt context
- add support for mapping buffer and mbuf
- done only simple test

uhci
- add lots of bus_dmamap_sync() operations, possibly too many
- make sure resources are not allocated in interrupt context
- add support for mapping buffer and mbuf

To do
- review, test, debug
- rewrite network drivers to utilize usbd_map_buffer_mbuf()
- rewrite uaudio(4) to eliminate memcpy
- "pipe" argument of usbd_setup_*xfer() should eventually be removed
 1.119.4.4  23-Oct-2007  ad Sync with head.
 1.119.4.3  20-Aug-2007  ad Sync with HEAD.
 1.119.4.2  15-Jul-2007  ad Sync with head.
 1.119.4.1  01-Jul-2007  ad Adapt to callout API change.
 1.120.6.1  25-Oct-2007  bouyer Sync with HEAD.
 1.120.2.1  06-Nov-2007  matt sync with HEAD
 1.121.20.3  11-Mar-2010  yamt sync with head
 1.121.20.2  04-May-2009  yamt sync with head.
 1.121.20.1  16-May-2008  yamt sync with head.
 1.121.18.2  04-Jun-2008  yamt sync with head
 1.121.18.1  18-May-2008  yamt sync with head.
 1.121.16.2  17-Jan-2009  mjf Sync with HEAD.
 1.121.16.1  02-Jun-2008  mjf Sync with HEAD.
 1.122.2.1  23-Jun-2008  wrstuden Sync w/ -current. 34 merge conflicts to follow.
 1.123.4.2  13-Dec-2008  haad Update haad-dm branch to haad-dm-base2.
 1.123.4.1  19-Oct-2008  haad Sync with HEAD.
 1.124.4.3  11-Feb-2015  martin Pull up following revision(s) (requested by aymeric in ticket #1948):
sys/dev/usb/usbdi.c: revision 1.163
clip xfer->actlen also in the !DIAGNOSTIC case
 1.124.4.2  27-Jan-2010  sborrill branches: 1.124.4.2.2; 1.124.4.2.6;
Pull up the following revisions(s) (requested by bouyer in ticket #1247):
sys/dev/usb/usbdi.c: revision 1.127

Fix leak of a usbd_xfer_handle when a interrupt pipe is aborted then
closed. Confirmed to fix the memory leak on close() with umodem(4) and
uplcom(4).
 1.124.4.1  13-Dec-2008  bouyer branches: 1.124.4.1.4;
Pull up following revision(s) (requested by jmorse in ticket #185):
sys/dev/usb/usbdi.c: revision 1.125
sys/dev/usb/umass.c: revision 1.130
sys/dev/usb/usbdi.h: revision 1.77
PR#39651
Fix two problems in umass:
* usb xfers being freed before being removed from pipe, leading to null
deref
* config_activate requests not supported, which leads to
config_deactivate requests not being passed through. Spotted by jmcneill@=
Added mechanism to usbdi allowing the default pipe to be aborted
 1.124.4.2.6.1  11-Feb-2015  martin Pull up following revision(s) (requested by aymeric in ticket #1948):
sys/dev/usb/usbdi.c: revision 1.163
clip xfer->actlen also in the !DIAGNOSTIC case
 1.124.4.2.2.1  11-Feb-2015  martin Pull up following revision(s) (requested by aymeric in ticket #1948):
sys/dev/usb/usbdi.c: revision 1.163
clip xfer->actlen also in the !DIAGNOSTIC case
 1.124.4.1.4.1  21-Apr-2010  matt sync to netbsd-5
 1.124.2.1  19-Jan-2009  skrll Sync with HEAD.
 1.127.4.2  12-Jun-2011  rmind sync with head
 1.127.4.1  05-Mar-2011  rmind sync with head
 1.127.2.1  06-Nov-2010  uebayasi Sync with HEAD.
 1.131.6.1  23-Jun-2011  cherry Catchup with rmind-uvmplock merge.
 1.133.2.5  22-May-2014  yamt sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs. ("Protocol error: too many arguments")
 1.133.2.4  23-Jan-2013  yamt sync with head
 1.133.2.3  16-Jan-2013  yamt sync with (a bit old) head
 1.133.2.2  30-Oct-2012  yamt sync with head
 1.133.2.1  17-Apr-2012  yamt sync with head
 1.134.10.1  11-Feb-2015  martin Pull up following revision(s) (requested by aymeric in ticket #1250):
sys/dev/usb/usbdi.c: revision 1.163
clip xfer->actlen also in the !DIAGNOSTIC case
 1.134.8.1  11-Feb-2015  martin Pull up following revision(s) (requested by aymeric in ticket #1250):
sys/dev/usb/usbdi.c: revision 1.163
clip xfer->actlen also in the !DIAGNOSTIC case
 1.134.4.1  11-Feb-2015  martin Pull up following revision(s) (requested by aymeric in ticket #1250):
sys/dev/usb/usbdi.c: revision 1.163
clip xfer->actlen also in the !DIAGNOSTIC case
 1.134.2.16  02-Jun-2012  mrg convert usbd_{intr,bulk}_transfer() in the USBMP world:
- add a new USBD_SYNCHRONOUS_SIG flag for transfers
- in usbd_transfer(), if USBD_SYNCHRONOUS_SIG is set use cv_wait_sig()
(or tlseep(xfer, PZERO|PATCH, ...) for the unconverted controllers)
- add a usbd_sync_transfer_sig() front-end to usbd_transfer()
- greatly simplify both usbd_{intr,bulk}_transfer() to just
usbd_sync_transfer_sig() and usbd_get_xfer_status().

this fixes lockdebug issues where usbd_{intr,bulk}_transfer() where it
taking the pipe lock, when usbd_transfer() would call functions that
expect the pipe lock not to be taken (and try to taken it.)
 1.134.2.15  06-Mar-2012  mrg sync to -current
 1.134.2.14  26-Feb-2012  mrg - add some more "XXXSMP ok" tags
- use cpu_softintr_p() instead of checking LP_INTR directly
 1.134.2.13  25-Feb-2012  mrg replace the (diagnostic-only) intr_context with checks against LP_INTR
and cpu_intr_p().

XXX: there's one check that changes behaviour
 1.134.2.12  25-Feb-2012  mrg copyright maintenence.
 1.134.2.11  23-Feb-2012  mrg update a bunch of comments for reality. usb lock isn't a "thread lock",
which is terminology we copied from the audiomp code.
 1.134.2.10  20-Feb-2012  mrg keep the thread lock taken for the abort() callback.
 1.134.2.9  20-Feb-2012  mrg remove the intr_lock from the mp usb api, it wasn't used.
 1.134.2.8  20-Feb-2012  mrg timeout_handle callout is MPSAFE, mark it as such.
 1.134.2.7  20-Feb-2012  mrg several changes to the MP usb apis, and other misc changes:

- usb_transfer_complete()/usb_insert_transfer()/usb_start_next() all
must have the thread lock held

- (*soft_intr) now is called with the thread lock held unless we are
in polling mode. add a usb_soft_intr() to deal with this

- XXX usbd_set_polling() api exists to increase/decrease the polling
count, but only ukbd uses. everyone else open codes it, but this
should probably be changed

- (*abort) is now called with the thread lock held

- update several comments to not refer to splusb() anymore

- add many more asserts

- use more c99 struct initialisers
 1.134.2.6  19-Feb-2012  mrg remove the spl handling from usb_insert_transfer() since we're
already holding the relevant lock (which is asserted.)
 1.134.2.5  09-Dec-2011  mrg - make pipe->close method take the thread lock

- convert usb_taskq to use mutex/cv

- convert needs_explore usage into a cv on the thread lock

- remove KERNEL_*LOCK from uaudio and umidi, since we're supposedly
MPSAFE here now

- use IPL_SCHED instead of IPL_USB (aka biglocked) interrupts

- drop the audio thread lock when calling into usb when it may sleep,
avoiding a deadlock between audiowrite and audioioctl. this fixes
mixerctl -a vs. playing hanging the system
XXX probably need to check this in a bunch more places.
 1.134.2.4  08-Dec-2011  mrg make ohci mostly work again.
 1.134.2.3  08-Dec-2011  mrg convert the remaining wakeup(xfer)'s to use the xfer->cv.

utoppy - untested.
 1.134.2.2  08-Dec-2011  mrg - convert usbd_bus_methods{} and usbd_pipe_methods{} to use
c99 struct initialisers

- move the locks from the pipe to the bus, since we'll need
access to them from bus-level ops

- remove dead-for-years SPLUSBCHECK and replaced it with
asserts that the thread lock is held

- begin to document the locking scheme

- convert usbd_*lock_pipe() into real function-like macros
 1.134.2.1  04-Dec-2011  jmcneill branches: 1.134.2.1.2;
Make ehci mpsafe.
 1.134.2.1.2.4  08-Dec-2011  mrg sync usb_subr.c and usbdivar.h with the branch entirely, and most of
usbdi.c as well.
 1.134.2.1.2.3  08-Dec-2011  mrg pull across a few more of the changes from the main branch.
 1.134.2.1.2.2  08-Dec-2011  mrg merge a few more things from the main branch. uaudio@ohci still works.
 1.134.2.1.2.1  08-Dec-2011  mrg there's something wrong with uaudio@ohci on the usbmp branch.
this is the minimally working port of ohci to mpusb, and it works
with uaudio but is lacking many other changes, yet.
 1.139.2.4  03-Dec-2017  jdolecek update from HEAD
 1.139.2.3  20-Aug-2014  tls Rebase to HEAD as of a few days ago.
 1.139.2.2  23-Jun-2013  tls resync from head
 1.139.2.1  25-Feb-2013  tls resync with head
 1.152.4.2  18-May-2014  rmind sync with head
 1.152.4.1  28-Aug-2013  rmind sync with head
 1.160.2.1  10-Aug-2014  tls Rebase.
 1.161.2.5  16-Nov-2019  martin Pull up following revision(s) (requested by mrg in ticket #1713):

sys/dev/usb/usbdi.h: revision 1.97 (via patch)
sys/dev/usb/usbdi.c: revision 1.186 (via patch)
sys/dev/usb/usb_subr.c: revision 1.239 (via patch)

add new usbd_do_request_len() that can allocate a larger than
request size buffer. reimplement usbd_do_request_flags() in
terms of this. use this for fetching string descriptors.

fixes a very strange problem where an axe(4) attaching (either
has ugen(4) or axe(4)) would ask for 2 bytes, usb_mem.c would
allocate a 2 byte fragment, perform the operation, and sometime
shortly afterwards (usually by the time the next allocation
is made for this fragment), would become corrupted (usually
two bytes were written with 0x0304.)
(initial request of 4 bytes also avoids the problem on this
device. it really seems like a HC problem -- host should not
allow the device to write more than req.wLength! nor should
it allow this write to happen after completion.)

avoid an (almost) always double-log in usbd_transfer().
 1.161.2.4  11-Jan-2019  martin Pull up following revision(s) (requested by skrll in ticket #1671):

sys/dev/usb/usbdi.c: revision 1.181

Avoid use after free when closing interrupt pipe transfer by calling
upm_close before destroying the interupt pipe xfer.

Found by kasan on wiz's machine.
 1.161.2.3  25-Aug-2018  martin Pull up following revision(s) (requested by mrg in ticket #1632):

sys/dev/usb/usbdivar.h: revision 1.117
sys/external/bsd/dwc2/dwc2.c: revision 1.52
sys/dev/usb/xhcivar.h: revision 1.10
sys/dev/usb/motg.c: revision 1.22
sys/dev/usb/ehci.c: revision 1.260
sys/dev/usb/ehci.c: revision 1.261
sys/dev/usb/xhci.c: revision 1.96
sys/dev/usb/ohci.c: revision 1.282
sys/dev/usb/ohci.c: revision 1.283
sys/dev/usb/ehcivar.h: revision 1.45
sys/dev/usb/uhci.c: revision 1.281
sys/dev/usb/uhci.c: revision 1.282
sys/dev/usb/usbdi.c: revision 1.177
sys/dev/usb/ohcivar.h: revision 1.60
sys/dev/usb/uhcivar.h: revision 1.55
(all via patch)

pull across abort fixes from nick-nhusb. add more abort fixes, using
ideas from Taylor and Nick, and myself. special thanks to both who
inspired much of the code here, if not wrote it directly.

among other problems, this assert should no longer trigger:

panic: kernel diagnostic assertion "xfer->ux_state == XFER_ONQU" failed: file "/current/src/sys/dev/usb/usbdi.c", line 914

using usbhist i was able to track down my instance of it being related
to userland close() beginning, dropping the sc_lock, and then the usb
softintr completes the transfer normally, and when it is done, the
abort path attempts to re-complete the transfer, and the above assert
is tripped.

changes from nhusb were commited with these logs:
--
Move the struct usb_task to struct usbd_xfer for everyone to use.
--
Set device transfer status to USBD_IN_PROGRESS if start methods succeeds
--
Actually set the transfer status on transfers in ohci_abort_xfer and
the controller is dying
--
Don't supply the lock to callout_halt when polling as it won't be held
--
Improve transfer abort
--
Mark device transfers as USBD_IN_PROGRESS appropriately and improve
abort handling
--
--
Mark device transfers as USBD_IN_PROGRESS appropriately and improve
abort handling
--

additional changes include:
- initialise the usb abort task in the HCI allocx routine, so that it
can be safely usb_rem_task()'d.
- rework the handling of softintr vs cancellation vs timeout abort based
upon a scheme from Taylor:
when completing a transfer normally:
- if the status is not in progress, it must be cancelled or timed out,
and we should not process this xfer.
- set the status as normal.
- unconditionallly callout_stop() and usb_rem_task(). they're safe and
either aren't running, or will run and do nothing.
- finally call usb_transfer_complete().
when aborting a transfer:
- status should be cancelled or timed out.
- if cancelling, callout_halt and usb_rem_task_wait() to make sure the
timer is either done or cancelled.
- at this point, the ux_status must not be cancelled or timed out, and
if it is not in progress we're done.
- set the status.
- if the controller is dying, just return.
- perform HCI-specific tasks to abort this xfer.
- finally call usb_transfer_complete().
for the timeout and timeout task:
- if the HCI is not dying, and the ux_status is in progress, then
trigger the usb abort task.
- remove UXFER_ABORTWAIT and UXFER_ABORTING.

tested on:
- multiple PC systems with several types of devices: ugen/UPS, ucom,
umass with disk, ssd and cdrom backends, kbd, ms, using uhci, ehci
and xhci.
- erlite3: sd@umass on dwc2.
- sunblade2000: kbd/ms and umass disk on ohci.

untested:
- motg, slhci and ahci. motg has some portion of the new scheme
applied, but slhci and ahci require more study.

future work includes pushing a lot of the common abort handling into
usbdi.c and leaving upm_abort() for HC specific tasks, but this change
is pullup-able to netbsd-7 and netbsd-8 as it does not change any
external API, as well as removing over 100 lines of code while adding
over 30 new asserts.

XXX: pullup-7, pullup-8.

fix DIAGNOSTIC build by not copying ub_usepolling to stack before use

Sprinkle __diagused
 1.161.2.2  05-Apr-2017  snj Pull up following revision(s) (requested by skrll in ticket #1395):
share/man/man4/axe.4: netbsd-7-nhusb
share/man/man4/axen.4: netbsd-7-nhusb
share/man/man4/cdce.4: netbsd-7-nhusb
share/man/man4/uaudio.4: netbsd-7-nhusb
share/man/man4/ucom.4: netbsd-7-nhusb
share/man/man4/uep.4: netbsd-7-nhusb
share/man/man4/urtw.4: netbsd-7-nhusb
share/man/man4/usb.4: netbsd-7-nhusb
share/man/man4/uyap.4: netbsd-7-nhusb
share/man/man4/xhci.4: netbsd-7-nhusb
share/man/man9/usbdi.9: netbsd-7-nhusb
sys/arch/amd64/conf/ALL: netbsd-7-nhusb
sys/arch/amd64/conf/GENERIC: netbsd-7-nhusb
sys/arch/amiga/dev/slhci_zbus.c: netbsd-7-nhusb
sys/arch/arm/allwinner/awin_otg.c: netbsd-7-nhusb
sys/arch/arm/allwinner/awin_usb.c: netbsd-7-nhusb
sys/arch/arm/amlogic/amlogic_dwctwo.c: netbsd-7-nhusb
sys/arch/arm/at91/at91ohci.c: netbsd-7-nhusb
sys/arch/arm/broadcom/bcm2835_dwctwo.c: netbsd-7-nhusb
sys/arch/arm/broadcom/bcm53xx_usb.c: netbsd-7-nhusb
sys/arch/arm/ep93xx/epohci.c: netbsd-7-nhusb
sys/arch/arm/gemini/obio_ehci.c: netbsd-7-nhusb
sys/arch/arm/imx/files.imx23: netbsd-7-nhusb
sys/arch/arm/imx/imxusb.c: netbsd-7-nhusb
sys/arch/arm/imx/imxusbreg.h: netbsd-7-nhusb
sys/arch/arm/omap/obio_ohci.c: netbsd-7-nhusb
sys/arch/arm/omap/omap3_ehci.c: netbsd-7-nhusb
sys/arch/arm/omap/omapl1x_ohci.c: netbsd-7-nhusb
sys/arch/arm/omap/tiotg.c: netbsd-7-nhusb
sys/arch/arm/s3c2xx0/ohci_s3c24x0.c: netbsd-7-nhusb
sys/arch/arm/samsung/exynos_usb.c: netbsd-7-nhusb
sys/arch/arm/xscale/pxa2x0_ohci.c: netbsd-7-nhusb
sys/arch/arm/zynq/zynq_usb.c: netbsd-7-nhusb
sys/arch/hpcarm/dev/nbp_slhci.c: netbsd-7-nhusb
sys/arch/hpcmips/dev/plumohci.c: netbsd-7-nhusb
sys/arch/i386/conf/ALL: netbsd-7-nhusb
sys/arch/i386/conf/GENERIC: netbsd-7-nhusb
sys/arch/i386/pci/gcscehci.c: netbsd-7-nhusb
sys/arch/luna68k/conf/GENERIC: netbsd-7-nhusb
sys/arch/mips/adm5120/dev/ahci.c: netbsd-7-nhusb
sys/arch/mips/adm5120/dev/ahcivar.h: netbsd-7-nhusb
sys/arch/mips/alchemy/dev/ohci_aubus.c: netbsd-7-nhusb
sys/arch/mips/atheros/dev/ehci_arbus.c: netbsd-7-nhusb
sys/arch/mips/atheros/dev/ohci_arbus.c: netbsd-7-nhusb
sys/arch/mips/conf/files.adm5120: netbsd-7-nhusb
sys/arch/mips/ralink/ralink_ehci.c: netbsd-7-nhusb
sys/arch/mips/ralink/ralink_ohci.c: netbsd-7-nhusb
sys/arch/mips/rmi/rmixl_ehci.c: netbsd-7-nhusb
sys/arch/mips/rmi/rmixl_ohci.c: netbsd-7-nhusb
sys/arch/playstation2/dev/ohci_sbus.c: netbsd-7-nhusb
sys/arch/powerpc/booke/dev/pq3ehci.c: netbsd-7-nhusb
sys/arch/powerpc/ibm4xx/dev/dwctwo_plb.c: netbsd-7-nhusb
sys/arch/x68k/dev/slhci_intio.c: netbsd-7-nhusb
sys/conf/files: netbsd-7-nhusb
sys/dev/cardbus/ehci_cardbus.c: netbsd-7-nhusb
sys/dev/cardbus/ohci_cardbus.c: netbsd-7-nhusb
sys/dev/cardbus/uhci_cardbus.c: netbsd-7-nhusb
sys/dev/ic/sl811hs.c: netbsd-7-nhusb
sys/dev/ic/sl811hsvar.h: netbsd-7-nhusb
sys/dev/isa/slhci_isa.c: netbsd-7-nhusb
sys/dev/marvell/ehci_mv.c: netbsd-7-nhusb
sys/dev/pci/ehci_pci.c: netbsd-7-nhusb
sys/dev/pci/ohci_pci.c: netbsd-7-nhusb
sys/dev/pci/uhci_pci.c: netbsd-7-nhusb
sys/dev/pci/xhci_pci.c: netbsd-7-nhusb
sys/dev/pcmcia/slhci_pcmcia.c: netbsd-7-nhusb
sys/dev/usb/Makefile.usbdevs: netbsd-7-nhusb
sys/dev/usb/TODO: netbsd-7-nhusb
sys/dev/usb/TODO.usbmp: netbsd-7-nhusb
sys/dev/usb/aubtfwl.c: netbsd-7-nhusb
sys/dev/usb/auvitek.c: netbsd-7-nhusb
sys/dev/usb/auvitek_audio.c: netbsd-7-nhusb
sys/dev/usb/auvitek_dtv.c: netbsd-7-nhusb
sys/dev/usb/auvitek_i2c.c: netbsd-7-nhusb
sys/dev/usb/auvitek_video.c: netbsd-7-nhusb
sys/dev/usb/auvitekvar.h: netbsd-7-nhusb
sys/dev/usb/ehci.c: netbsd-7-nhusb
sys/dev/usb/ehcireg.h: netbsd-7-nhusb
sys/dev/usb/ehcivar.h: netbsd-7-nhusb
sys/dev/usb/emdtv.c: netbsd-7-nhusb
sys/dev/usb/emdtv_dtv.c: netbsd-7-nhusb
sys/dev/usb/emdtv_ir.c: netbsd-7-nhusb
sys/dev/usb/emdtvvar.h: netbsd-7-nhusb
sys/dev/usb/ezload.c: netbsd-7-nhusb
sys/dev/usb/ezload.h: netbsd-7-nhusb
sys/dev/usb/files.usb: netbsd-7-nhusb
sys/dev/usb/hid.c: netbsd-7-nhusb
sys/dev/usb/hid.h: netbsd-7-nhusb
sys/dev/usb/if_athn_usb.c: netbsd-7-nhusb
sys/dev/usb/if_athn_usb.h: netbsd-7-nhusb
sys/dev/usb/if_atu.c: netbsd-7-nhusb
sys/dev/usb/if_atureg.h: netbsd-7-nhusb
sys/dev/usb/if_aue.c: netbsd-7-nhusb
sys/dev/usb/if_auereg.h: netbsd-7-nhusb
sys/dev/usb/if_axe.c: netbsd-7-nhusb
sys/dev/usb/if_axen.c: netbsd-7-nhusb
sys/dev/usb/if_axenreg.h: netbsd-7-nhusb
sys/dev/usb/if_axereg.h: netbsd-7-nhusb
sys/dev/usb/if_cdce.c: netbsd-7-nhusb
sys/dev/usb/if_cdcereg.h: netbsd-7-nhusb
sys/dev/usb/if_cue.c: netbsd-7-nhusb
sys/dev/usb/if_cuereg.h: netbsd-7-nhusb
sys/dev/usb/if_kue.c: netbsd-7-nhusb
sys/dev/usb/if_kuereg.h: netbsd-7-nhusb
sys/dev/usb/if_otus.c: netbsd-7-nhusb
sys/dev/usb/if_otusvar.h: netbsd-7-nhusb
sys/dev/usb/if_rum.c: netbsd-7-nhusb
sys/dev/usb/if_rumreg.h: netbsd-7-nhusb
sys/dev/usb/if_rumvar.h: netbsd-7-nhusb
sys/dev/usb/if_run.c: netbsd-7-nhusb
sys/dev/usb/if_runvar.h: netbsd-7-nhusb
sys/dev/usb/if_smsc.c: netbsd-7-nhusb
sys/dev/usb/if_smscreg.h: netbsd-7-nhusb
sys/dev/usb/if_smscvar.h: netbsd-7-nhusb
sys/dev/usb/if_udav.c: netbsd-7-nhusb
sys/dev/usb/if_udavreg.h: netbsd-7-nhusb
sys/dev/usb/if_upgt.c: netbsd-7-nhusb
sys/dev/usb/if_upgtvar.h: netbsd-7-nhusb
sys/dev/usb/if_upl.c: netbsd-7-nhusb
sys/dev/usb/if_ural.c: netbsd-7-nhusb
sys/dev/usb/if_uralreg.h: netbsd-7-nhusb
sys/dev/usb/if_uralvar.h: netbsd-7-nhusb
sys/dev/usb/if_url.c: netbsd-7-nhusb
sys/dev/usb/if_urlreg.h: netbsd-7-nhusb
sys/dev/usb/if_urndis.c: netbsd-7-nhusb
sys/dev/usb/if_urndisreg.h: netbsd-7-nhusb
sys/dev/usb/if_urtw.c: netbsd-7-nhusb
sys/dev/usb/if_urtwn.c: netbsd-7-nhusb
sys/dev/usb/if_urtwn_data.h: netbsd-7-nhusb
sys/dev/usb/if_urtwnreg.h: netbsd-7-nhusb
sys/dev/usb/if_urtwnvar.h: netbsd-7-nhusb
sys/dev/usb/if_urtwreg.h: netbsd-7-nhusb
sys/dev/usb/if_zyd.c: netbsd-7-nhusb
sys/dev/usb/if_zydreg.h: netbsd-7-nhusb
sys/dev/usb/irmce.c: netbsd-7-nhusb
sys/dev/usb/moscom.c: netbsd-7-nhusb
sys/dev/usb/motg.c: netbsd-7-nhusb
sys/dev/usb/motgvar.h: netbsd-7-nhusb
sys/dev/usb/ohci.c: netbsd-7-nhusb
sys/dev/usb/ohcireg.h: netbsd-7-nhusb
sys/dev/usb/ohcivar.h: netbsd-7-nhusb
sys/dev/usb/pseye.c: netbsd-7-nhusb
sys/dev/usb/slurm.c: netbsd-7-nhusb
sys/dev/usb/stuirda.c: netbsd-7-nhusb
sys/dev/usb/u3g.c: netbsd-7-nhusb
sys/dev/usb/uark.c: netbsd-7-nhusb
sys/dev/usb/uatp.c: netbsd-7-nhusb
sys/dev/usb/uaudio.c: netbsd-7-nhusb
sys/dev/usb/uberry.c: netbsd-7-nhusb
sys/dev/usb/ubsa.c: netbsd-7-nhusb
sys/dev/usb/ubsa_common.c: netbsd-7-nhusb
sys/dev/usb/ubsavar.h: netbsd-7-nhusb
sys/dev/usb/ubt.c: netbsd-7-nhusb
sys/dev/usb/uchcom.c: netbsd-7-nhusb
sys/dev/usb/ucom.c: netbsd-7-nhusb
sys/dev/usb/ucomvar.h: netbsd-7-nhusb
sys/dev/usb/ucycom.c: netbsd-7-nhusb
sys/dev/usb/udl.c: netbsd-7-nhusb
sys/dev/usb/udl.h: netbsd-7-nhusb
sys/dev/usb/udsbr.c: netbsd-7-nhusb
sys/dev/usb/udsir.c: netbsd-7-nhusb
sys/dev/usb/uep.c: netbsd-7-nhusb
sys/dev/usb/uftdi.c: netbsd-7-nhusb
sys/dev/usb/uftdireg.h: netbsd-7-nhusb
sys/dev/usb/ugen.c: netbsd-7-nhusb
sys/dev/usb/ugensa.c: netbsd-7-nhusb
sys/dev/usb/uhci.c: netbsd-7-nhusb
sys/dev/usb/uhcireg.h: netbsd-7-nhusb
sys/dev/usb/uhcivar.h: netbsd-7-nhusb
sys/dev/usb/uhid.c: netbsd-7-nhusb
sys/dev/usb/uhidev.c: netbsd-7-nhusb
sys/dev/usb/uhidev.h: netbsd-7-nhusb
sys/dev/usb/uhmodem.c: netbsd-7-nhusb
sys/dev/usb/uhso.c: netbsd-7-nhusb
sys/dev/usb/uhub.c: netbsd-7-nhusb
sys/dev/usb/uipad.c: netbsd-7-nhusb
sys/dev/usb/uipaq.c: netbsd-7-nhusb
sys/dev/usb/uirda.c: netbsd-7-nhusb
sys/dev/usb/uirdavar.h: netbsd-7-nhusb
sys/dev/usb/ukbd.c: netbsd-7-nhusb
sys/dev/usb/ukbdmap.c: netbsd-7-nhusb
sys/dev/usb/ukyopon.c: netbsd-7-nhusb
sys/dev/usb/ukyopon.h: netbsd-7-nhusb
sys/dev/usb/ulpt.c: netbsd-7-nhusb
sys/dev/usb/umass.c: netbsd-7-nhusb
sys/dev/usb/umass_isdata.c: netbsd-7-nhusb
sys/dev/usb/umass_isdata.h: netbsd-7-nhusb
sys/dev/usb/umass_quirks.c: netbsd-7-nhusb
sys/dev/usb/umass_quirks.h: netbsd-7-nhusb
sys/dev/usb/umass_scsipi.c: netbsd-7-nhusb
sys/dev/usb/umass_scsipi.h: netbsd-7-nhusb
sys/dev/usb/umassvar.h: netbsd-7-nhusb
sys/dev/usb/umcs.c: netbsd-7-nhusb
sys/dev/usb/umct.c: netbsd-7-nhusb
sys/dev/usb/umidi.c: netbsd-7-nhusb
sys/dev/usb/umidi_quirks.c: netbsd-7-nhusb
sys/dev/usb/umidi_quirks.h: netbsd-7-nhusb
sys/dev/usb/umodem.c: netbsd-7-nhusb
sys/dev/usb/umodem_common.c: netbsd-7-nhusb
sys/dev/usb/umodemvar.h: netbsd-7-nhusb
sys/dev/usb/ums.c: netbsd-7-nhusb
sys/dev/usb/uplcom.c: netbsd-7-nhusb
sys/dev/usb/urio.c: netbsd-7-nhusb
sys/dev/usb/urio.h: netbsd-7-nhusb
sys/dev/usb/usb.c: netbsd-7-nhusb
sys/dev/usb/usb.h: netbsd-7-nhusb
sys/dev/usb/usb_mem.c: netbsd-7-nhusb
sys/dev/usb/usb_mem.h: netbsd-7-nhusb
sys/dev/usb/usb_quirks.c: netbsd-7-nhusb
sys/dev/usb/usb_quirks.h: netbsd-7-nhusb
sys/dev/usb/usb_subr.c: netbsd-7-nhusb
sys/dev/usb/usbdevices.config: netbsd-7-nhusb
sys/dev/usb/usbdevs: netbsd-7-nhusb
sys/dev/usb/usbdevs.h: netbsd-7-nhusb
sys/dev/usb/usbdevs_data.h: netbsd-7-nhusb
sys/dev/usb/usbdi.c: netbsd-7-nhusb
sys/dev/usb/usbdi.h: netbsd-7-nhusb
sys/dev/usb/usbdi_util.c: netbsd-7-nhusb
sys/dev/usb/usbdi_util.h: netbsd-7-nhusb
sys/dev/usb/usbdivar.h: netbsd-7-nhusb
sys/dev/usb/usbhid.h: netbsd-7-nhusb
sys/dev/usb/usbhist.h: netbsd-7-nhusb
sys/dev/usb/usbroothub.c: netbsd-7-nhusb
sys/dev/usb/usbroothub.h: netbsd-7-nhusb
sys/dev/usb/usbroothub_subr.c: delete
sys/dev/usb/usbroothub_subr.h: delete
sys/dev/usb/uscanner.c: netbsd-7-nhusb
sys/dev/usb/uslsa.c: netbsd-7-nhusb
sys/dev/usb/usscanner.c: netbsd-7-nhusb
sys/dev/usb/ustir.c: netbsd-7-nhusb
sys/dev/usb/uthum.c: netbsd-7-nhusb
sys/dev/usb/utoppy.c: netbsd-7-nhusb
sys/dev/usb/uts.c: netbsd-7-nhusb
sys/dev/usb/uvideo.c: netbsd-7-nhusb
sys/dev/usb/uvisor.c: netbsd-7-nhusb
sys/dev/usb/uvscom.c: netbsd-7-nhusb
sys/dev/usb/uyap.c: netbsd-7-nhusb
sys/dev/usb/uyap_firmware.h: netbsd-7-nhusb
sys/dev/usb/uyurex.c: netbsd-7-nhusb
sys/dev/usb/x1input_rdesc.h: netbsd-7-nhusb
sys/dev/usb/xhci.c: netbsd-7-nhusb
sys/dev/usb/xhcireg.h: netbsd-7-nhusb
sys/dev/usb/xhcivar.h: netbsd-7-nhusb
sys/dev/usb/xinput_rdesc.h: netbsd-7-nhusb
sys/external/bsd/common/conf/files.linux: netbsd-7-nhusb
sys/external/bsd/common/include/linux/err.h: netbsd-7-nhusb
sys/external/bsd/common/include/linux/kernel.h: netbsd-7-nhusb
sys/external/bsd/common/include/linux/workqueue.h: netbsd-7-nhusb
sys/external/bsd/common/linux/linux_work.c: netbsd-7-nhusb
sys/external/bsd/drm2/dist/drm/radeon/atombios_encoders.c: netbsd-7-nhusb
sys/external/bsd/drm2/dist/drm/radeon/radeon_legacy_encoders.c: netbsd-7-nhusb
sys/external/bsd/drm2/drm/files.drmkms: netbsd-7-nhusb
sys/external/bsd/drm2/i915drm/files.i915drmkms: netbsd-7-nhusb
sys/external/bsd/drm2/include/linux/err.h: delete
sys/external/bsd/drm2/include/linux/workqueue.h: delete
sys/external/bsd/drm2/linux/files.drmkms_linux: netbsd-7-nhusb
sys/external/bsd/drm2/linux/linux_work.c: delete
sys/external/bsd/dwc2/dwc2.c: netbsd-7-nhusb
sys/external/bsd/dwc2/dwc2.h: netbsd-7-nhusb
sys/external/bsd/dwc2/dwc2var.h: netbsd-7-nhusb
sys/external/bsd/dwc2/dwctwo2netbsd: netbsd-7-nhusb
sys/external/bsd/dwc2/conf/files.dwc2: netbsd-7-nhusb
sys/external/bsd/dwc2/dist/dwc2_core.c: netbsd-7-nhusb
sys/external/bsd/dwc2/dist/dwc2_core.h: netbsd-7-nhusb
sys/external/bsd/dwc2/dist/dwc2_coreintr.c: netbsd-7-nhusb
sys/external/bsd/dwc2/dist/dwc2_hcd.c: netbsd-7-nhusb
sys/external/bsd/dwc2/dist/dwc2_hcd.h: netbsd-7-nhusb
sys/external/bsd/dwc2/dist/dwc2_hcdddma.c: netbsd-7-nhusb
sys/external/bsd/dwc2/dist/dwc2_hcdintr.c: netbsd-7-nhusb
sys/external/bsd/dwc2/dist/dwc2_hcdqueue.c: netbsd-7-nhusb
sys/external/bsd/dwc2/dist/dwc2_hw.h: netbsd-7-nhusb
sys/modules/drmkms_linux/Makefile: netbsd-7-nhusb
sys/modules/i915drmkms/Makefile: netbsd-7-nhusb
sys/rump/dev/lib/libugenhc/ugenhc.c: netbsd-7-nhusb
sys/rump/dev/lib/libusb/Makefile: netbsd-7-nhusb
sys/rump/dev/lib/libusb/USB.ioconf: netbsd-7-nhusb
sys/rump/dev/lib/libusb/usb_at_ugenhc.c: delete
sys/rump/dev/lib/libusb/opt/opt_usb.h: delete
sys/rump/dev/lib/libusb/opt/opt_usbverbose.h: delete
sys/sys/mbuf.h: netbsd-7-nhusb
usr.sbin/usbdevs/usbdevs.8: netbsd-7-nhusb
usr.sbin/usbdevs/usbdevs.c: netbsd-7-nhusb
Merge netbsd-7-nhusb:
- API / infrastructure changes to support memory management changes.
- Memory management improvements and bug fixes.
- HCDs should now be MP safe
- conversion to KERNHIST based debug
- FS/LS isoc support on ehci(4).
- conversion to kmem(9)
- Some USB 3 support - mostly from Takahiro HAYASHI (t-hash).
- interrupt transfers now get proper DMA operations
- general bug fixes
- kern/48308
- uhub status notification improvements
- umass(4) probe fix (applied to HEAD already)
- ohci(4) short transfer fix
- Change the SOFTINT level from NET to SERIAL for the USB softint handler.
This gives the callback a chance of running when another softint handler
at SOFTINT_NET has blocked holding a lock, e.g. softnet_lock and most of
the network stack.
- kern/49065 - ifconfig tun0 ... sequence locks up system / lockup:
softnet_lock held across usb xfr
- kern/50491 - unkillable wait in usbd_transfer while using usmsc0
on raspberry pi 2
- kern/51395 - USB Ethernet makes xhci hang
- Various improvements to slhci(4)
- Various improvements to dwc2(4)
 1.161.2.1  11-Feb-2015  martin branches: 1.161.2.1.4;
Pull up following revision(s) (requested by aymeric in ticket #505):
sys/dev/usb/usbdi.c: revision 1.163
clip xfer->actlen also in the !DIAGNOSTIC case
 1.161.2.1.4.3  26-Jan-2017  skrll Sync with HEAD/nhusb
 1.161.2.1.4.2  07-Sep-2016  skrll Sync with HEAD
 1.161.2.1.4.1  06-Sep-2016  skrll First pass at netbsd-7 updated with USB code from HEAD
 1.162.2.51  28-Aug-2017  skrll Sync with HEAD
 1.162.2.50  27-Dec-2016  skrll Fix a comment
 1.162.2.49  11-Dec-2016  skrll KASSERT -> KASSERTMSG
 1.162.2.48  05-Dec-2016  skrll Sync with HEAD
 1.162.2.47  29-May-2016  skrll Sync with HEAD
 1.162.2.46  16-Apr-2016  skrll Prefix ucom_attach_args struct members with ucaa_ and rename variables
for consistency.

No functional change.
 1.162.2.45  25-Mar-2016  skrll Better debug
 1.162.2.44  17-Mar-2016  skrll All HCDs were fighting the seriaisation of transfers in usbdi.c for isoc
transfers. Instead allow the HCDs to specify which pipes can handle
removing this serialisation and apply it appropriately.

dwctwo(4) can handle this for all transfer types, but only enable
bulk/isoc for now.
 1.162.2.43  28-Feb-2016  skrll Centralise the up_repeat handling and use the standard pipe method to
start the next transfer. This allows the removal of a bunch of code
in the upm_done methods for interrupt transfers which had copies of
the upm_start method code.

At the same time we can perform the upm_done method before calling the
transfer callback allowing correct bus_dma(9) operations before
using the transfer DMA buffer.
 1.162.2.42  07-Feb-2016  skrll Simplify usbd_do_request/usbd_setup_default_xfer.

G/C usbd_do_request_flags_pipe as it's not required
 1.162.2.41  28-Dec-2015  skrll Drop/re-acquire the pipe lock when destroying up_intrxfer. The fini
methods expect to be called unlocked.
 1.162.2.40  28-Dec-2015  skrll Strictly follow the sequence abort pipe, destroy xfers, and close pipe as
API now requires. Plug some memory leaks in some drivers while doing
this.

Also, remove up_refcnt as it was broken and helped leak more memory.
 1.162.2.39  27-Dec-2015  skrll Sync with HEAD (as of 26th Dec)
 1.162.2.38  21-Dec-2015  skrll Need to usbd_destroy_xfer the interrupt xfer that is automatically
provided using usbd_create_xfer
 1.162.2.37  21-Dec-2015  skrll usbd_close_pipe should never be called with NULL for pipe. Remove some
dead DIAGNOSTIC code when pipe == NULL
 1.162.2.36  19-Dec-2015  skrll Use NULL instead of 0 for (function) pointer
 1.162.2.35  19-Dec-2015  skrll Add some debug
 1.162.2.34  19-Dec-2015  skrll KNF
 1.162.2.33  21-Oct-2015  skrll Cache the usbd_bus pointer in the usbd_xfer struct for memory allocation
and softc access. This removes a level of indirection for memory
allocation.

Also cache the xfer pipe methods for later (temporary?) use.
 1.162.2.32  12-Oct-2015  skrll Provide init/fini methods for HCDs
 1.162.2.31  11-Oct-2015  skrll Update ubm_allocx with the isoc frame count parameter and use it in
dwctwo(4)
 1.162.2.30  10-Oct-2015  skrll KNF
 1.162.2.29  06-Oct-2015  skrll Move from usbd_{alloc,free}_xfer and usbd_{alloc,free}_buffer to
usbd_{create,destroy}_xfer. The API change will allow future changes
to HCDs to simplify the transfer resource allocation and activation.

Several devices tested including ucom, umass, smsc, uvideo, and uaudio.
 1.162.2.28  22-Sep-2015  skrll Sync with HEAD
 1.162.2.27  11-Jun-2015  skrll There is nothing to do on a STALL during a control transfer (aka
"protocol stall") accoriding to the USB specifications, so remove
the code in usbd_do_request_flags_pipe that tries to recover from
this.
 1.162.2.26  30-Mar-2015  skrll Replace #ifdef DIAGNOTIC code with KASSERT{,MSG}
 1.162.2.25  30-Mar-2015  skrll s/0/NULL/ for pointer
 1.162.2.24  29-Mar-2015  skrll Fix transfer buffer handling post the URQ_AUTO_BUFFER removal
 1.162.2.23  28-Mar-2015  skrll s/0/NULL/ for pointer
 1.162.2.22  19-Mar-2015  skrll Do the same as OpenBSD and get rid of the *_handle typedefs and use
plain structures insteads
 1.162.2.21  18-Mar-2015  skrll Expose usbd_xfer_isread
 1.162.2.20  17-Mar-2015  skrll Spello
 1.162.2.19  11-Mar-2015  skrll Fix malloc to kmem conversion by grabbing nendpt before calling
usbd_fill_iface_data
 1.162.2.18  06-Mar-2015  skrll Another USBD_NOMEM rather than ENOMEM where appropriate.

Pointed out by Takahiro HAYASHI. Thanks.
 1.162.2.17  06-Mar-2015  skrll Use USBD_NOMEM rather than ENOMEM where appropriate.
 1.162.2.16  06-Mar-2015  skrll Whitespace
 1.162.2.15  06-Mar-2015  skrll Actually grab the err value being reported in USBHIST_LOG.

Pointed out by Takahiro HAYASHI. Thanks.
 1.162.2.14  05-Mar-2015  skrll Minor USBHIST_LOG changes
 1.162.2.13  05-Mar-2015  skrll What was I thinking... usbd_free_xfer handles the buffer free.

Need more coffee
 1.162.2.12  05-Mar-2015  skrll Don't leak memory in previous
 1.162.2.11  05-Mar-2015  skrll Kill URQ_AUTO_BUFFER
 1.162.2.10  01-Feb-2015  skrll Remove newline character in USBHIST_LOG format
 1.162.2.9  05-Dec-2014  skrll KNF. Remove ( ) from return statements.
 1.162.2.8  03-Dec-2014  skrll Remove #include <sys/malloc.h> where it's not (no longer) needed
 1.162.2.7  03-Dec-2014  skrll Replace malloc(9) with kmem(9)
 1.162.2.6  03-Dec-2014  skrll The grand renaming of structure members.

No functional change.
 1.162.2.5  02-Dec-2014  skrll Step #1 of memory allocation re-organisation.

Centralised the buffer allocation routine which now supports DMA
and non-DMA capable host controllers. Remove the
ubm_{alloc,free}m methods from usbd_bus_methods.

The buffer allocation is only allowed in thread context and,
therefore, negates the usefulness of the reserve dma code which
is removed in this change.

USBD_NO_COPY is also no longer required as usbd_transfer and
usbd_transfer_complete now track buffer usage and handle any
copying.
 1.162.2.4  01-Dec-2014  skrll Add prefixes to method structures member names. No functional change.
 1.162.2.3  30-Nov-2014  skrll Use ASSERT_SLEEPABLE.
 1.162.2.2  30-Nov-2014  skrll Whitespace
 1.162.2.1  30-Nov-2014  skrll Use C99 types. u_int{8,16,32,64}_t to uint{8,16,32,64}_t.

No functional change.
 1.171.2.1  07-Jan-2017  pgoyette Sync with HEAD. (Note that most of these changes are simply $NetBSD$
tag issues.)
 1.173.2.6  12-Mar-2024  martin Pull up following revision(s) (requested by riastradh in ticket #1940):

sys/dev/usb/usbdi.c: revision 1.248

usbdi(9): Avoid calling ubm_softint with lock held and polling on.

PR kern/57783
 1.173.2.5  11-Jan-2019  martin Pull up following revision(s) (requested by skrll in ticket #1161):

sys/dev/usb/usbdi.c: revision 1.181

Avoid use after free when closing interrupt pipe transfer by calling
upm_close before destroying the interupt pipe xfer.

Found by kasan on wiz's machine.
 1.173.2.4  20-Nov-2018  martin Pull up following revision(s) (requested by manu in ticket #1099):

sys/dev/usb/usb_quirks.c: revision 1.90
sys/dev/usb/usbdi.c: revision 1.179
sys/dev/usb/usb_quirks.h: revision 1.29
sys/dev/usb/usbdi.c: revision 1.180

Workaround NBP PN533 USB toggle bit bugs

The PN533 is known to mishandle the USB toggle bit, causing replies to
be filtered out by the host controller. As a result, the kernel sees
a timed out operation.

Vendor errata suggests that userland applications should detect the
situation on read timeout, and write a dumy frame to resync the toggle bit.
NFC Tools's libnfc does just that, but in order to succeed, the dummy
frame write must not be reported as timed out.

We therefore introduce a new USB quirk for devices known to miss output
acks. When that occur, we pretend that the operation succeeded, leaving
userland the duty to check that everything went okay.

This workaround lets libnfc recover from interrupted communications
without the need te reboot the system.

-

Build fix
From David H. Gutteridge
 1.173.2.3  27-Sep-2018  martin Pull up following revision(s) (requested by mrg in ticket #1037):

sys/dev/usb/uhub.c: revision 1.139
sys/external/bsd/dwc2/dwc2.c: revision 1.55
sys/ddb/db_output.c: revision 1.34
sys/ddb/db_command.c: revision 1.160
sys/dev/usb/ehci.c: revision 1.264
sys/dev/usb/xhci.c: revision 1.99
sys/dev/usb/ehci.c: revision 1.265
sys/kern/subr_userconf.c: revision 1.27
sys/dev/usb/ehcivar.h: revision 1.46
sys/dev/usb/ohci.c: revision 1.287
sys/dev/usb/uhci.c: revision 1.284
sys/dev/usb/usbdi.c: revision 1.178
sys/dev/usb/usb.c: revision 1.172
sys/dev/pci/xhci_pci.c: revision 1.14
sys/dev/usb/usb.c: revision 1.173
sys/dev/usb/usb.c: revision 1.174
share/man/man4/usb.4: revision 1.110
sys/ddb/db_command.c: revision 1.159
sys/dev/usb/usb_subr.c: revision 1.227
sys/dev/usb/uhcivar.h: revision 1.56
(all via patch)

consolidate the handling of polling across HC drivers, and generic USB:
- don't take mutexes if polling
- normalise the code across all drivers
- add some not yet code to block discovery to/from polling
- minor CSE
- adjust comment for usbd_set_polling() to reality now i properly
understand what it is used for and why.

this, with a hack to make RB_ASKNAME to wait 5 seconds allows boot -a
work with USB keyboards. there are still multiple issues remaining:
- discovery and polling need to be mutually exclusive
- attachment of ukbd and wskbd is not handled by config_pending, and
the 5 second delay isn't going to always be enough.

call cnpollc(1) and cnpollc(0) around cngetc().
(christos has a good idea to add a function that does all 3,
and we should switch all the callers in this sequence to use
it (and fix the MD ones missing it still). not all can, as
eg, line-grabbing functions can use cngetsn(), which only
calls cnpollc() twice.)


When this file is used when not building the kernel (eg: /usr/sbin/crash)
make cnpollc() go away.


reorder some struct members to remove holes.


add config_pending usage to uhub and general USB device attachment.
- call config_pending_incr() and config_pending_decr() around attaching
devices against "usbdevif" attribute.

uhub:
- convert sc_explorepending and sc_running to bool. add new sc_first_explore.
- call config_pending_incr() at the start of uhub_attach(). dropped in
uhub_explore(), if this is the first explore.


implement a gross hack to fix "boot -a" on systems with usb keyboards on
systems with ehci handover to uhci (and maybe ohci), and fix a similar
problem for "boot -s".

there is effort to ensure that all devices attached via USB are probed
before RB_ASKNAME or RB_SINGLE attempts to ask any questions on the console,
and largely this works, often by chance, today, for USB disks and root.
i've recently pushed this more into uhub and general USB device attachment
as well, and kept a config_pending reference across the first explore of
a bus. these fix many issues with directly attached hubs.

however, on systems where devices connected to ehci ports are handed over
to a companion uhci or ohci port, it may not be the first, or even second,
bus explore that finds the device finally before attachment, and at this
point all config_pending references are dropped.

there is no direct communication between drivers, the potentials are
looked up but their device_t is only used for generic things like the name,
so informing the correct companion to expect a device and deal with the
config_pending references is not possible without some fairly ugly layer
violations or multi-level callbacks (eg, we have "ehci0", and usually an
the relevant companion, eg, "uhci2", but it is the uhub that uhci2 has
attached that will deal with the device attachment.)

with the above fixes to generic USB code, the disown happens during the
first explore. the hack works by, at this point, checking if (a) root
is not mounted, (b) single user or ask name are set, and (c) if the hack
as not been triggered already. if all 3 conditions are true, then a
config_pending_incr() is called and a callback is triggered for (default)
5 seconds to call config_pending_decr(). ehci detach pauses waiting for
this callback if scheduled.

this allows enough time for the uhub and the ukbd/wskbd to attach before
the RK_ASKROOT prompts appear. testing shows it takes between 1.5 and
2 seconds for the keyboard to appear after the disown occurs.

Index: dev/usb/ehcivar.c
- new sc_compcallout, sc_compcallout, sc_complock, and a state for th
handover hack.

Index: dev/usb/ehci.c
ehci_init():
- use aprint_normal_dev() instead of manual device_xname().
- initialise sc_compcallout, sc_compcallout, sc_complock, and sc_comp_state.
ehci_detach():
- if there are companion controllers, tear own the above, including waiting
if there is a callback scheduled.
ehci_disown_callback():
- new callout to call config_pending_decr() in the the future.
schedule this ca
ehci_disown_sched_callback():
- if booting to single user or asking names, call config_pending_incr() and
schedule the callout above, default 5 second delay.
ehci_disown():
- if disowning a port call ehci_disown_sched_callback().
deal with partial attach failures in usb_attach vs usb_detach aka PR 53598.
- make sure xhci's sc->sc_ios is NULL if failure happens.
- rearrange usb_attach() / usb_doattach() to make it simpler to clean up.
- move usb_async_intr softint into usb_once_init(). previously, each USB
controller would start a new one, and leave the old one leaked.
- handle controller interrupts without a bus attached


remove usb(4)'s "flags 1" code. it has been dead for a while,
as it runs during the interrupts part of configuration now,
and all the devices try attach as early as possible, including
any root or boot required disk or keyboard device, which is
what this flag was for.
 1.173.2.2  25-Aug-2018  martin Pull up following revision(s) (requested by mrg in ticket #980):

sys/dev/usb/usbdivar.h: revision 1.117
sys/external/bsd/dwc2/dwc2.c: revision 1.52
sys/dev/usb/xhcivar.h: revision 1.10
sys/dev/usb/motg.c: revision 1.22
sys/dev/usb/ehci.c: revision 1.260
sys/dev/usb/ehci.c: revision 1.261
sys/dev/usb/xhci.c: revision 1.96
sys/dev/usb/ohci.c: revision 1.282
sys/dev/usb/ohci.c: revision 1.283
sys/dev/usb/ehcivar.h: revision 1.45
sys/dev/usb/uhci.c: revision 1.281
sys/dev/usb/uhci.c: revision 1.282
sys/dev/usb/usbdi.c: revision 1.177
sys/dev/usb/ohcivar.h: revision 1.60
sys/dev/usb/uhcivar.h: revision 1.55
(all via patch)

pull across abort fixes from nick-nhusb. add more abort fixes, using
ideas from Taylor and Nick, and myself. special thanks to both who
inspired much of the code here, if not wrote it directly.
among other problems, this assert should no longer trigger:

panic: kernel diagnostic assertion "xfer->ux_state == XFER_ONQU" failed: file "/current/src/sys/dev/usb/usbdi.c", line 914

using usbhist i was able to track down my instance of it being related
to userland close() beginning, dropping the sc_lock, and then the usb
softintr completes the transfer normally, and when it is done, the
abort path attempts to re-complete the transfer, and the above assert
is tripped.

changes from nhusb were commited with these logs:
--
Move the struct usb_task to struct usbd_xfer for everyone to use.
--
Set device transfer status to USBD_IN_PROGRESS if start methods succeeds
--
Actually set the transfer status on transfers in ohci_abort_xfer and
the controller is dying
--
Don't supply the lock to callout_halt when polling as it won't be held
--
Improve transfer abort
--
Mark device transfers as USBD_IN_PROGRESS appropriately and improve
abort handling
--
--
Mark device transfers as USBD_IN_PROGRESS appropriately and improve
abort handling
--

additional changes include:
- initialise the usb abort task in the HCI allocx routine, so that it
can be safely usb_rem_task()'d.
- rework the handling of softintr vs cancellation vs timeout abort based
upon a scheme from Taylor:
when completing a transfer normally:
- if the status is not in progress, it must be cancelled or timed out,
and we should not process this xfer.
- set the status as normal.
- unconditionallly callout_stop() and usb_rem_task(). they're safe and
either aren't running, or will run and do nothing.
- finally call usb_transfer_complete().
when aborting a transfer:
- status should be cancelled or timed out.
- if cancelling, callout_halt and usb_rem_task_wait() to make sure the
timer is either done or cancelled.
- at this point, the ux_status must not be cancelled or timed out, and
if it is not in progress we're done.
- set the status.
- if the controller is dying, just return.
- perform HCI-specific tasks to abort this xfer.
- finally call usb_transfer_complete().
for the timeout and timeout task:
- if the HCI is not dying, and the ux_status is in progress, then
trigger the usb abort task.
- remove UXFER_ABORTWAIT and UXFER_ABORTING.

tested on:
- multiple PC systems with several types of devices: ugen/UPS, ucom,
umass with disk, ssd and cdrom backends, kbd, ms, using uhci, ehci
and xhci.
- erlite3: sd@umass on dwc2.
- sunblade2000: kbd/ms and umass disk on ohci.

untested:
- motg, slhci and ahci. motg has some portion of the new scheme
applied, but slhci and ahci require more study.

future work includes pushing a lot of the common abort handling into
usbdi.c and leaving upm_abort() for HC specific tasks, but this change
is pullup-able to netbsd-7 and netbsd-8 as it does not change any
external API, as well as removing over 100 lines of code while adding
over 30 new asserts.

XXX: pullup-7, pullup-8.

fix DIAGNOSTIC build by not copying ub_usepolling to stack before use

Sprinkle __diagused
 1.173.2.1  02-Nov-2017  snj Pull up following revision(s) (requested by pgoyette in ticket #335):
share/man/man9/kernhist.9: 1.5-1.8
sys/arch/acorn26/acorn26/pmap.c: 1.39
sys/arch/arm/arm32/fault.c: 1.105 via patch
sys/arch/arm/arm32/pmap.c: 1.350, 1.359
sys/arch/arm/broadcom/bcm2835_bsc.c: 1.7
sys/arch/arm/omap/if_cpsw.c: 1.20
sys/arch/arm/omap/tiotg.c: 1.7
sys/arch/evbarm/conf/RPI2_INSTALL: 1.3
sys/dev/ic/sl811hs.c: 1.98
sys/dev/usb/ehci.c: 1.256
sys/dev/usb/if_axe.c: 1.83
sys/dev/usb/motg.c: 1.18
sys/dev/usb/ohci.c: 1.274
sys/dev/usb/ucom.c: 1.119
sys/dev/usb/uhci.c: 1.277
sys/dev/usb/uhub.c: 1.137
sys/dev/usb/umass.c: 1.160-1.162
sys/dev/usb/umass_quirks.c: 1.100
sys/dev/usb/umass_scsipi.c: 1.55
sys/dev/usb/usb.c: 1.168
sys/dev/usb/usb_mem.c: 1.70
sys/dev/usb/usb_subr.c: 1.221
sys/dev/usb/usbdi.c: 1.175
sys/dev/usb/usbdi_util.c: 1.67-1.70
sys/dev/usb/usbroothub.c: 1.3
sys/dev/usb/xhci.c: 1.75
sys/external/bsd/drm2/dist/drm/i915/i915_gem.c: 1.34
sys/kern/kern_history.c: 1.15
sys/kern/kern_xxx.c: 1.74
sys/kern/vfs_bio.c: 1.275-1.276
sys/miscfs/genfs/genfs_io.c: 1.71
sys/sys/kernhist.h: 1.21
sys/ufs/ffs/ffs_balloc.c: 1.63
sys/ufs/lfs/lfs_vfsops.c: 1.361
sys/ufs/lfs/ulfs_inode.c: 1.21
sys/ufs/lfs/ulfs_vnops.c: 1.52
sys/ufs/ufs/ufs_inode.c: 1.102
sys/ufs/ufs/ufs_vnops.c: 1.239
sys/uvm/pmap/pmap.c: 1.37-1.39
sys/uvm/pmap/pmap_tlb.c: 1.22
sys/uvm/uvm_amap.c: 1.108
sys/uvm/uvm_anon.c: 1.64
sys/uvm/uvm_aobj.c: 1.126
sys/uvm/uvm_bio.c: 1.91
sys/uvm/uvm_device.c: 1.66
sys/uvm/uvm_fault.c: 1.201
sys/uvm/uvm_km.c: 1.144
sys/uvm/uvm_loan.c: 1.85
sys/uvm/uvm_map.c: 1.353
sys/uvm/uvm_page.c: 1.194
sys/uvm/uvm_pager.c: 1.111
sys/uvm/uvm_pdaemon.c: 1.109
sys/uvm/uvm_swap.c: 1.175
sys/uvm/uvm_vnode.c: 1.103
usr.bin/vmstat/vmstat.c: 1.219
Reorder to test for null before null deref in debug code
--
Reorder to test for null before null deref in debug code
--
KNF
--
No need for '\n' in UVMHIST_LOG
--
normalise a BIOHIST log message
--
Update the kernhist(9) kernel history code to address issues identified
in PR kern/52639, as well as some general cleaning-up...
(As proposed on tech-kern@ with additional changes and enhancements.)
Details of changes:
* All history arguments are now stored as uintmax_t values[1], both in
the kernel and in the structures used for exporting the history data
to userland via sysctl(9). This avoids problems on some architectures
where passing a 64-bit (or larger) value to printf(3) can cause it to
process the value as multiple arguments. (This can be particularly
problematic when printf()'s format string is not a literal, since in
that case the compiler cannot know how large each argument should be.)
* Update the data structures used for exporting kernel history data to
include a version number as well as the length of history arguments.
* All [2] existing users of kernhist(9) have had their format strings
updated. Each format specifier now includes an explicit length
modifier 'j' to refer to numeric values of the size of uintmax_t.
* All [2] existing users of kernhist(9) have had their format strings
updated to replace uses of "%p" with "%#jx", and the pointer
arguments are now cast to (uintptr_t) before being subsequently cast
to (uintmax_t). This is needed to avoid compiler warnings about
casting "pointer to integer of a different size."
* All [2] existing users of kernhist(9) have had instances of "%s" or
"%c" format strings replaced with numeric formats; several instances
of mis-match between format string and argument list have been fixed.
* vmstat(1) has been modified to handle the new size of arguments in the
history data as exported by sysctl(9).
* vmstat(1) now provides a warning message if the history requested with
the -u option does not exist (previously, this condition was silently
ignored, with only a single blank line being printed).
* vmstat(1) now checks the version and argument length included in the
data exported via sysctl(9) and exits if they do not match the values
with which vmstat was built.
* The kernhist(9) man-page has been updated to note the additional
requirements imposed on the format strings, along with several other
minor changes and enhancements.
[1] It would have been possible to use an explicit length (for example,
uint64_t) for the history arguments. But that would require another
"rototill" of all the users in the future when we add support for an
architecture that supports a larger size. Also, the printf(3)
format
specifiers for explicitly-sized values, such as "%"PRIu64, are much
more verbose (and less aesthetically appealing, IMHO) than simply
using "%ju".
[2] I've tried very hard to find "all [the] existing users of
kernhist(9)"
but it is possible that I've missed some of them. I would be glad
to
update any stragglers that anyone identifies.
--
For some reason this single kernel seems to have outgrown its declared
size as a result of the kernhist(9) changes. Bump the size.
XXX The amount of increase may be excessive - anyone with more detailed
XXX knowledge please feel free to further adjust the value
appropriately.
--
Misssed one cast of pointer --> uintptr_t in previous kernhist(9) commit
--
And yet another one. :(
--
Use correct mark-up for NetBSD version.
--
More improvements in grammar and readability.
--
Remove a stray '"' (obvious typo) and add a couple of casts that are
probably needed.
--
And replace an instance of "%p" conversion with "%#jx"
--
Whitespace fix. Give Bl tag table a width. Fix Xr.
 1.175.4.2  13-Apr-2020  martin Mostly merge changes from HEAD upto 20200411
 1.175.4.1  10-Jun-2019  christos Sync with HEAD
 1.175.2.5  18-Jan-2019  pgoyette Synch with HEAD
 1.175.2.4  26-Nov-2018  pgoyette Missed a $Id$ conflict in the last sync-with-HEAD
 1.175.2.3  26-Nov-2018  pgoyette Sync with HEAD, resolve a couple of conflicts
 1.175.2.2  30-Sep-2018  pgoyette Ssync with HEAD
 1.175.2.1  06-Sep-2018  pgoyette Sync with HEAD

Resolve a couple of conflicts (result of the uimin/uimax changes)
 1.182.4.6  12-Mar-2024  martin Pull up following revision(s) (requested by riastradh in ticket #1807):

sys/dev/usb/usbdi.c: revision 1.248

usbdi(9): Avoid calling ubm_softint with lock held and polling on.

PR kern/57783
 1.182.4.5  18-Jul-2020  martin Pull up following revision(s) (requested by mrg in ticket #1020):

sys/dev/usb/usbdi.c: revision 1.203

for both usbd_transfer() and usbd_ar_pipe() be sure to reset the
xfer ux_state to XFER_BUSY when removing from the queue.
seems to fix an occasional panic i was seeing on pinebook and
pinebookpro lately with axen(4).

from riastradh@.

XXX: pullup-9.
 1.182.4.4  03-Apr-2020  martin Pull up following revision(s) (requested by skrll in ticket #819):

sys/dev/usb/usbdi.c: revision 1.199

Avoid crashes if we fail to allocate a transfer buffer and avoid an
unnecessary usbd_free_buffer before usbd_free_xfer

Worked out by Riastradh
 1.182.4.3  01-Mar-2020  martin Pull up following revision(s) (requested by riastradh in ticket #744):

sys/dev/usb/uhci.c: revision 1.292
sys/dev/usb/uhci.c: revision 1.293
sys/dev/usb/usbdi.h: revision 1.99
sys/dev/usb/motg.c: revision 1.26
sys/dev/usb/motg.c: revision 1.27
sys/dev/usb/motg.c: revision 1.28
sys/dev/usb/motg.c: revision 1.29
sys/external/bsd/dwc2/dwc2.c: revision 1.70
sys/external/bsd/dwc2/dwc2.c: revision 1.71
sys/dev/usb/usb.c: revision 1.181
sys/arch/mips/adm5120/dev/ahci.c: revision 1.20
sys/dev/usb/usb.c: revision 1.182
sys/dev/usb/xhci.c: revision 1.116
sys/dev/usb/xhci.c: revision 1.117
sys/dev/usb/xhci.c: revision 1.118
sys/dev/usb/uhci.c: revision 1.289
sys/dev/usb/usbdivar.h: revision 1.121
sys/dev/usb/usbdi.c: revision 1.190
sys/dev/usb/usbdivar.h: revision 1.122
sys/dev/usb/usbdi.c: revision 1.191
sys/dev/usb/usbdi.c: revision 1.192
sys/external/bsd/dwc2/dwc2var.h: revision 1.7
sys/dev/usb/motg.c: revision 1.30
sys/dev/usb/motg.c: revision 1.31
sys/dev/usb/motg.c: revision 1.32
sys/dev/usb/motg.c: revision 1.33
sys/external/bsd/dwc2/dwc2.c: revision 1.67
sys/external/bsd/dwc2/dwc2.c: revision 1.68
sys/dev/usb/ehci.c: revision 1.270
sys/external/bsd/dwc2/dwc2.c: revision 1.69
sys/dev/usb/usbdi.h: revision 1.100
sys/dev/usb/ehci.c: revision 1.271
sys/arch/mips/adm5120/dev/ahci.c: revision 1.18
sys/dev/usb/usbdi.h: revision 1.101
sys/dev/usb/ehci.c: revision 1.272
sys/dev/ic/sl811hs.c: revision 1.103
sys/arch/mips/adm5120/dev/ahci.c: revision 1.19
sys/dev/usb/ehci.c: revision 1.273
sys/dev/usb/ohci.c: revision 1.293
sys/dev/usb/uhci.c: revision 1.290
sys/dev/usb/ohci.c: revision 1.294
sys/dev/usb/uhci.c: revision 1.291
sys/dev/usb/ohci.c: revision 1.295

Teach usb_rem_task to return whether removed from queue or not.

New function usb_task_pending for diagnostic assertions.
Usable only for negative diagnostic assertions:

KASSERT(!usb_task_pending(dev, task))

If you can think of a better name for this than !usb_task_pending,
I'm all ears.

-

Nothing guarantees xfer's timeout has completed.

Wait for it when we free the xfer.

-


New xfer state variables ux_timeout_set and ux_timeout_reset.

These are needed because:
- The host controller interrupt cannot wait for the callout or task
to finish running.
- Nothing in the USBD API as is waits for the callout or task to
finish running.
- Callers expect to be able to resubmit USB xfers from xfer callbacks
without waiting for anything to finish running.

The variable ux_timeout_set can be used by a host controller to
decide on submission whether to schedule the callout or to ask an
already-scheduled callout or already-queued task to reschedule the
callout, by setting the variable ux_timeout_reset to true.

When the callout or task runs and sees that ux_timeout_reset is true,
rather than queue the task or abort the xfer, it can instead just
schedule the callout anew.

-

Fix steady state of timeouts in ehci.

This is complicated because:
1. There are three ways that an xfer can be completed:
(a) hardware interrupt completes xfer
(b) software decision aborts xfer with USBD_CANCELLED
(c) timeout aborts xfer with USBD_TIMEOUT
2. The timeout abort can't be done in callout because ehci_sync_hc,
called unconditionally by ehci_abort_xfer to wait until the device
has finished using any references to the xfer, may sleep. So we
have to schedule a callout that, when run, will schedule a usb_task.
3. The hardware completion interrupt can't sleep waiting for a callout
or task to finish -- can't use callout_halt or usb_rem_task_wait.
So the callout and usb_task must be able to run _after_ the hardware
completion interrupt, and recognize that they're late to the party.
(Note, though, that usbd_free_xfer does wait for the callout and
task to complete, so there's no danger they may use themselves after
free.)
4. The xfer may resubmitted -- and the timeout may be rescheduled --
immediately after the hardware completion interrupt, _while_ the
callout and/or usb_task may still be scheduled. Specifically, we
may have the following sequence of events:
(a) hardware completion interrupt
(b) callout or usb_task fires
(c) driver resubmits xfer
(d) callout or usb_task acquires lock and looks around dazed and
bewildered at the firehose of events like reading the news in 2019

The mechanism for sorting this out is that we have two bits of state:
- xfer->ux_timeout_set informs the driver, when submitting an xfer and
setting up its timeout, whether either the callout or usb_task is
already scheduled or not.
- xfer->ux_timeout_reset informs the callout or usb_task whether it
should reschedule the callout, because the xfer got resubmitted, or
not.

-

Factor out HCI-independent xfer completion logic.

New API for HCI drivers to synchronize hardware completion
interrupts, synchronous aborts, and asynchronous timeouts:
- When submitting an xfer to hardware, call
usbd_xfer_schedule_timeout(xfer).
- On HCI completion interrupt for xfer completion:
if (!usbd_xfer_trycomplete(xfer))
return; /* timed out or aborted, ignore it */
- In upm_abort methods, call usbd_xfer_abort(xfer).

For HCI drivers that use this API (not needed in drivers that don't,
or for xfers like root intr xfers that don't use it):
- New ubm_abortx method serves role of former *hci_abort_xfer, but
without any logic for wrangling timeouts/callouts/tasks -- caller
in usbd_xfer_abort has already handled them.
- New ubm_dying method, returns true if the device is in the process
of detaching, used by the timeout logic.

Converted and tested:
- ehci
- ohci

Converted and compile-tested:
- ahci (XXX did this ever work?)
- dwc2
- motg (XXX missing usbd_xfer_schedule_timeout in motg_*_start?)
- uhci
- xhci

Not changed:
- slhci (sys/dev/ic/sl811hs.c) -- doesn't use a separate per-xfer
callout for timeouts (XXX but maybe should?)
- ugenhc (sys/rump/dev/lib/libugenhc/ugenhc.c) -- doesn't manage its
own transfer timeouts

-

Fix steady state of root intr xfers.

Why?
- Avoid completing a root intr xfer multiple times in races.
- Avoid potential use-after-free in poll_hub callouts (uhci, ahci).

How?
- Use sc->sc_intr_xfer or equivalent to store only a pending xfer
that has not yet completed -- whether successfully, by timeout, or
by synchronous abort. When any of those happens, set it to null
under the lock, so the xfer is completed only once.
- For hci drivers that use a callout to poll the root hub (uhci, ahci):
. Pass the softc pointer, not the xfer, to the callout, so the
callout is not even tempted to use xfer after free -- if the
callout fires, but the xfer is synchronously aborted before the
callout can do anything, the xfer might be freed by the time the
callout starts to examine it.
. Teach the callout to do nothing if it is callout_pending after it
has fired. This way:
1. completion or synchronous abort can just callout_stop
2. start can just callout_schedule
If the callout had already fired before (1), and doesn't acquire
the bus lock until after (2), it may be tempted to abort the new
root intr xfer just after submission, which would be wrong -- so
instead we just have the callout do nothing if it notices it has
been rescheduled, since it will fire again after the appropriate
time has elapsed.

-

Initialize xfer->ux_status in uhci_root_intr_start.

Otherwise, it will be USBD_NOT_STARTED, so usbd_ar_pipe will skip
calling upm_abort.
Candidate fix for PR kern/54963, same problem as reported at:
href="https://mail-index.NetBSD.org/current-users/2020/02/13/msg037740.html

-

Set ux_isdone in uhci_poll_hub for DIAGNOSTIC.

-

Fix mistakes in previous sloppy change with root intr xfers.
- Make sure ux_status is set to USBD_IN_PROGRESS when started.
Otherwise, if it is still in flight when we abort the pipe,
usbd_ar_pipe will skip calling upm_abort.
- Initialize ux_status under the lock; in principle a completion
interrupt (or a delay) could race with the initialization.
- KASSERT that the xfer is in progress when we're about to complete
it.

Candidate fix for PR kern/54963 for other HCI drivers than uhci.
ok nick
ok phone
(This is the change that nick evidently MEANT to ok when he ok'd the
previous one!)

-

Fix build

-

Fix non-DIAGNOSTIC builds.

-

Fix wrong KASSERT in motg abort.
This has been wrong since last summer when we did the transition to
xfer->ux_status = USBD_CANCELLED earlier.
XXX pullup-9

-

Fix mistakes in timeout/abort/completion changes in motg(4).
- Call usbd_xfer_schedule_timeout so we actually do time out.
- Don't call usbd_xfer_trycomplete until all the data have been
transferred -- it commits to completion, not timeout.
- Use xfer->ux_status != USBD_IN_PROGRESS to test whether, after a
partial write, an xfer has been interrupted or timed out and need
not be continued.
- Remove wrong assertion.

-

Fix mistake in use of usbd_xfer_schedule_timeout in motg.

This code path is used both for xfers that are new, and xfers that
are being done piece by piece and are partway done. For the latter
case, skip usbd_xfer_schedule_timeout so we schedule it only once per
xfer.

-

Simplify some branches and kassert some redundant assignments.
 1.182.4.2  20-Feb-2020  martin Pull up following revision(s) (requested by riastradh in ticket #716):

sys/dev/usb/usbdi.c: revision 1.194

When aborting a pipe, set pipe->up_running = 0.

This prevents any concurrent usb_transfer_complete from restarting
the pipe with usbd_start_next.
 1.182.4.1  01-Sep-2019  martin Pull up following revision(s) (requested by mrg in ticket #135):

distrib/sets/lists/comp/mi 1.2279
distrib/sets/lists/modules/mi 1.123
share/man/man9/Makefile 1.438
share/man/man9/usbnet.9 1.1-1.9
sys/dev/ic/rndisreg.h 1.3
sys/dev/usb/TODO 1.47-1.52
sys/dev/usb/TODO.usbmp 1.15,1.16
sys/dev/usb/files.usb 1.157-1.167
sys/dev/usb/if_aue.c 1.155-1.161
sys/dev/usb/if_auereg.h 1.30-1.32
sys/dev/usb/if_axe.c 1.103-1.119
sys/dev/usb/if_axen.c 1.51-1.53,1.55-1.67
sys/dev/usb/if_axenreg.h 1.15
sys/dev/usb/if_cdce.c 1.54-1.67
sys/dev/usb/if_cue.c 1.85,1.86
sys/dev/usb/if_cuereg.h 1.23
sys/dev/usb/if_kue.c 1.97-1.100
sys/dev/usb/if_kuereg.h 1.23,1.24
sys/dev/usb/if_mue.c 1.51-1.55
sys/dev/usb/if_muereg.h 1.6
sys/dev/usb/if_muevar.h 1.9
sys/dev/usb/if_smsc.c 1.46-1.61
sys/dev/usb/if_smscreg.h 1.6
sys/dev/usb/if_smscvar.h delete
sys/dev/usb/if_udav.c 1.60-1.71
sys/dev/usb/if_udavreg.h 1.14,1.15
sys/dev/usb/if_upl.c 1.65,1.66
sys/dev/usb/if_ure.c 1.15-1.31
sys/dev/usb/if_urevar.h 1.4,1.5
sys/dev/usb/if_url.c 1.67-1.70
sys/dev/usb/if_urlreg.h 1.14
sys/dev/usb/if_urndis.c 1.22-1.33
sys/dev/usb/if_urtwn.c 1.72
sys/dev/usb/ohci.c 1.290
sys/dev/usb/uhub.c 1.143
sys/dev/usb/usb.c 1.180
sys/dev/usb/usb.h 1.118
sys/dev/usb/usb_mem.c 1.71
sys/dev/usb/usb_subr.c 1.238,1.239
sys/dev/usb/usbdevs 1.772
sys/dev/usb/usbdi.c 1.183,1.186
sys/dev/usb/usbdi.h 1.97
sys/dev/usb/usbdi_util.c 1.75
sys/dev/usb/usbhist.h 1.5,1.6
sys/dev/usb/usbnet.c 1.1-1.24
sys/dev/usb/usbnet.h 1.1-1.14
sys/dev/usb/usbroothub.c 1.9
sys/dev/usb/xhci.c 1.109,1.110
sys/modules/Makefile 1.223
sys/modules/usbnet/Makefile 1.1

usbnet(9): Add common framework for USB network devices.
This bring various safety fixes to all updated drivers,
and includes locking clean up, detach safety when being
used or not, separate rx/tx locks to improve performance,
porting to NET_MPSAFE, many edge/error case bugs in
drivers fixed, as well as resovling PRs 54303 and 54308.
These drivers are converted: axe(4), axen(4), aue(4),
cdce(4), cue(4), kue(4), mue(4), smsc(4), udav(4),
upl(4), ure(4), url(4), and urndis(4).
 1.186.2.1  29-Feb-2020  ad Sync with head.
 1.204.6.1  17-Jun-2021  thorpej Sync w/ HEAD.
 1.247.4.1  10-Mar-2024  martin Pull up following revision(s) (requested by riastradh in ticket #613):

sys/dev/usb/usbdi.c: revision 1.248
sys/dev/usb/usbdi.c: revision 1.249

usbdi(9): Avoid calling ubm_softint with lock held and polling on.
usbdi(9): Avoid taking locks in usbd_transfer while polling.

PR kern/57783

RSS XML Feed