 @@ -1,14 +1,14 @@
-/*	$NetBSD: ehci.c,v 1.228.2.2 2018/01/03 20:02:37 snj Exp $ */
+/*	$NetBSD: ehci.c,v 1.228.2.3 2018/08/25 14:57:35 martin Exp $ */
 /*
  * Copyright (c) 2004-2012 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Lennart Augustsson (lennart@augustsson.net), Charles M. Hannum,
  * Jeremy Morse (jeremy.morse@gmail.com), Jared D. McNeill
  * (jmcneill@invisible.ca) and Matthew R. Green (mrg@eterna.com.au).
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
 @@ -43,27 +43,27 @@
 /*
  * TODO:
  * 1) hold off explorations by companion controllers until ehci has started.
+ *
  * 2) The hub driver needs to handle and schedule the transaction translator,
  *    to assign place in frame where different devices get to go. See chapter
  *    on hubs in USB 2.0 for details.
+ *
  * 3) Command failures are not recovered correctly.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ehci.c,v 1.228.2.2 2018/01/03 20:02:37 snj Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ehci.c,v 1.228.2.3 2018/08/25 14:57:35 martin Exp $");
 #include "ohci.h"
 #include "uhci.h"
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
 #endif
 #include <sys/param.h>
 #include <sys/bus.h>
 #include <sys/cpu.h>
 #include <sys/device.h>
 @@ -402,28 +402,27 @@ ehci_init(ehci_softc_t *sc)
 	uint32_t vers, sparams, cparams, hcr;
 	u_int i;
 	usbd_status err;
 	ehci_soft_qh_t *sqh;
 	u_int ncomp;
 	EHCIHIST_FUNC(); EHCIHIST_CALLED();
 #ifdef EHCI_DEBUG
 	theehci = sc;
 #endif
 	mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_SOFTUSB);
 	mutex_init(&sc->sc_intr_lock, MUTEX_DEFAULT, IPL_USB);
-	cv_init(&sc->sc_softwake_cv, "ehciab");
+	cv_init(&sc->sc_doorbell, "ehcidb");
 	cv_init(&sc->sc_doorbell, "ehcidi");
 	sc->sc_xferpool = pool_cache_init(sizeof(struct ehci_xfer), 0, 0, 0,
 	    "ehcixfer", NULL, IPL_USB, NULL, NULL, NULL);
 	sc->sc_doorbell_si = softint_establish(SOFTINT_USB | SOFTINT_MPSAFE,
 	    ehci_doorbell, sc);
 	KASSERT(sc->sc_doorbell_si != NULL);
 	sc->sc_pcd_si = softint_establish(SOFTINT_USB | SOFTINT_MPSAFE,
 	    ehci_pcd, sc);
 	KASSERT(sc->sc_pcd_si != NULL);
 	sc->sc_offs = EREAD1(sc, EHCI_CAPLENGTH);
 @@ -741,26 +740,27 @@ ehci_intr1(ehci_softc_t *sc)
 		sc->sc_eintrs &= ~eintrs;
 		EOWRITE4(sc, EHCI_USBINTR, sc->sc_eintrs);
 		printf("%s: blocking intrs 0x%x\n",
 		       device_xname(sc->sc_dev), eintrs);
+	}
 	return 1;
+}
 Static void
 ehci_doorbell(void *addr)
+{
 	ehci_softc_t *sc = addr;
 	EHCIHIST_FUNC(); EHCIHIST_CALLED();
 	mutex_enter(&sc->sc_lock);
 	cv_broadcast(&sc->sc_doorbell);
 	mutex_exit(&sc->sc_lock);
+}
 Static void
 ehci_pcd(void *addr)
+{
 	ehci_softc_t *sc = addr;
 	struct usbd_xfer *xfer;
 	u_char *p;
 	int i, m;
 @@ -843,31 +843,26 @@ ehci_softintr(void *v)
 	 * We abuse ex_next for the interrupt and complete lists and
 	 * interrupt transfers will get re-added here so use
 	 * the _SAFE version of TAILQ_FOREACH.
 	 */
 	TAILQ_FOREACH_SAFE(ex, &cq, ex_next, nextex) {
 		usb_transfer_complete(&ex->ex_xfer);
+	}
 	/* Schedule a callout to catch any dropped transactions. */
 	if ((sc->sc_flags & EHCIF_DROPPED_INTR_WORKAROUND) &&
 	    !TAILQ_EMPTY(&sc->sc_intrhead))
 		callout_reset(&sc->sc_tmo_intrlist,
 		    hz, ehci_intrlist_timeout, sc);
 	if (sc->sc_softwake) {
 		sc->sc_softwake = 0;
 		cv_broadcast(&sc->sc_softwake_cv);
+}
 Static void
 ehci_check_qh_intr(ehci_softc_t *sc, struct ehci_xfer *ex, ex_completeq_t *cq)
+{
 	ehci_soft_qtd_t *sqtd, *fsqtd, *lsqtd;
 	uint32_t status;
 	EHCIHIST_FUNC(); EHCIHIST_CALLED();
 	KASSERT(sc->sc_bus.ub_usepolling || mutex_owned(&sc->sc_lock));
 	if (ex->ex_type == EX_CTRL) {
 @@ -929,27 +924,26 @@ ehci_check_qh_intr(ehci_softc_t *sc, str
+			}
+		}
 		DPRINTFN(10, "ex=%p std=%p still active", ex, ex->ex_sqtdstart,
 , 0);
 #ifdef EHCI_DEBUG
 		DPRINTFN(5, "--- still active start ---", 0, 0, 0, 0);
 		ehci_dump_sqtds(ex->ex_sqtdstart);
 		DPRINTFN(5, "--- still active end ---", 0, 0, 0, 0);
 #endif
 		return;
+	}
  done:
 	DPRINTFN(10, "ex=%p done", ex, 0, 0, 0);
 	callout_stop(&ex->ex_xfer.ux_callout);
 	ehci_idone(ex, cq);
+}
 Static void
 ehci_check_itd_intr(ehci_softc_t *sc, struct ehci_xfer *ex, ex_completeq_t *cq)
+{
 	ehci_soft_itd_t *itd;
 	int i;
 	EHCIHIST_FUNC(); EHCIHIST_CALLED();
 	KASSERT(mutex_owned(&sc->sc_lock));
 @@ -975,27 +969,26 @@ ehci_check_itd_intr(ehci_softc_t *sc, st
+	}
 	if (i == EHCI_ITD_NUFRAMES) {
 		goto done; /* All 8 descriptors inactive, it's done */
+	}
 	usb_syncmem(&itd->dma, itd->offs + offsetof(ehci_itd_t, itd_ctl),
 	    sizeof(itd->itd.itd_ctl), BUS_DMASYNC_PREREAD);
 	DPRINTFN(10, "ex %p itd %p still active", ex, ex->ex_itdstart, 0, 0);
 	return;
 done:
 	DPRINTF("ex %p done", ex, 0, 0, 0);
 	callout_stop(&ex->ex_xfer.ux_callout);
 	ehci_idone(ex, cq);
+}
 void
 ehci_check_sitd_intr(ehci_softc_t *sc, struct ehci_xfer *ex, ex_completeq_t *cq)
+{
 	ehci_soft_sitd_t *sitd;
 	EHCIHIST_FUNC(); EHCIHIST_CALLED();
 	KASSERT(mutex_owned(&sc->sc_lock));
 	if (&ex->ex_xfer != SIMPLEQ_FIRST(&ex->ex_xfer.ux_pipe->up_queue))
 @@ -1013,53 +1006,65 @@ ehci_check_sitd_intr(ehci_softc_t *sc, s
 	usb_syncmem(&sitd->dma, sitd->offs + offsetof(ehci_sitd_t, sitd_trans),
 	    sizeof(sitd->sitd.sitd_trans),
 	    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
 	bool active = ((le32toh(sitd->sitd.sitd_trans) & EHCI_SITD_ACTIVE) != 0);
 	usb_syncmem(&sitd->dma, sitd->offs + offsetof(ehci_sitd_t, sitd_trans),
 	    sizeof(sitd->sitd.sitd_trans), BUS_DMASYNC_PREREAD);
 	if (active)
 		return;
 	DPRINTFN(10, "ex=%p done", ex, 0, 0, 0);
 	callout_stop(&(ex->ex_xfer.ux_callout));
 	ehci_idone(ex, cq);
+}
 Static void
 ehci_idone(struct ehci_xfer *ex, ex_completeq_t *cq)
+{
 	EHCIHIST_FUNC(); EHCIHIST_CALLED();
 	struct usbd_xfer *xfer = &ex->ex_xfer;
 	struct ehci_pipe *epipe = EHCI_XFER2EPIPE(xfer);
 	struct ehci_softc *sc = EHCI_XFER2SC(xfer);
 	ehci_soft_qtd_t *sqtd, *fsqtd, *lsqtd;
 	uint32_t status = 0, nstatus = 0;
 	int actlen = 0;
 	EHCIHIST_FUNC(); EHCIHIST_CALLED();
 	KASSERT(sc->sc_bus.ub_usepolling || mutex_owned(&sc->sc_lock));
 	DPRINTF("ex=%p", ex, 0, 0, 0);
-	if (xfer->ux_status == USBD_CANCELLED ||
+	/*
-	    xfer->ux_status == USBD_TIMEOUT) {
+	 * If software has completed it, either by cancellation
 	 * or timeout, drop it on the floor.
 	 */
 	if (xfer->ux_status != USBD_IN_PROGRESS) {
 		KASSERT(xfer->ux_status == USBD_CANCELLED ||
 		    xfer->ux_status == USBD_TIMEOUT);
 		DPRINTF("aborted xfer=%p", xfer, 0, 0, 0);
 		return;
+	}
 	/*
 	 * Cancel the timeout and the task, which have not yet
 	 * run.  If they have already fired, at worst they are
 	 * waiting for the lock.  They will see that the xfer
 	 * is no longer in progress and give up.
 	 */
 	callout_stop(&xfer->ux_callout);
 	usb_rem_task(xfer->ux_pipe->up_dev, &xfer->ux_aborttask);
 #ifdef DIAGNOSTIC
 #ifdef EHCI_DEBUG
 	if (ex->ex_isdone) {
 		DPRINTFN(5, "--- dump start ---", 0, 0, 0, 0);
 		ehci_dump_exfer(ex);
 		DPRINTFN(5, "--- dump end ---", 0, 0, 0, 0);
+	}
 #endif
 	KASSERTMSG(!ex->ex_isdone, "xfer %p type %d status %d", xfer,
 	    ex->ex_type, xfer->ux_status);
 	ex->ex_isdone = true;
 #endif
 @@ -1322,27 +1327,26 @@ ehci_detach(struct ehci_softc *sc, int f
 		rv = config_detach(sc->sc_child, flags);
 	if (rv != 0)
 		return rv;
 	callout_halt(&sc->sc_tmo_intrlist, NULL);
 	callout_destroy(&sc->sc_tmo_intrlist);
 	/* XXX free other data structures XXX */
 	if (sc->sc_softitds)
 		kmem_free(sc->sc_softitds,
 		    sc->sc_flsize * sizeof(ehci_soft_itd_t *));
 	cv_destroy(&sc->sc_doorbell);
 	cv_destroy(&sc->sc_softwake_cv);
 #if 0
 	/* XXX destroyed in ehci_pci.c as it controls ehci_intr access */
 	softint_disestablish(sc->sc_doorbell_si);
 	softint_disestablish(sc->sc_pcd_si);
 	mutex_destroy(&sc->sc_lock);
 	mutex_destroy(&sc->sc_intr_lock);
 #endif
 	pool_cache_destroy(sc->sc_xferpool);
 @@ -1501,26 +1505,30 @@ ehci_shutdown(device_t self, int flags)
 	EOWRITE4(sc, EHCI_USBCMD, EHCI_CMD_HCRESET);
 	return true;
+}
 Static struct usbd_xfer *
 ehci_allocx(struct usbd_bus *bus, unsigned int nframes)
+{
 	struct ehci_softc *sc = EHCI_BUS2SC(bus);
 	struct usbd_xfer *xfer;
 	xfer = pool_cache_get(sc->sc_xferpool, PR_WAITOK);
 	if (xfer != NULL) {
 		memset(xfer, 0, sizeof(struct ehci_xfer));
 		/* Initialise this always so we can call remove on it. */
 		usb_init_task(&xfer->ux_aborttask, ehci_timeout_task, xfer,
 		    USB_TASKQ_MPSAFE);
 #ifdef DIAGNOSTIC
 		struct ehci_xfer *ex = EHCI_XFER2EXFER(xfer);
 		ex->ex_isdone = true;
 		xfer->ux_state = XFER_BUSY;
 #endif
+	}
 	return xfer;
+}
 Static void
 ehci_freex(struct usbd_bus *bus, struct usbd_xfer *xfer)
+{
 	struct ehci_softc *sc = EHCI_BUS2SC(bus);
 @@ -2148,26 +2156,27 @@ ehci_set_qh_qtd(ehci_soft_qh_t *sqh, ehc
 Static void
 ehci_sync_hc(ehci_softc_t *sc)
+{
 	int error __diagused;
 	KASSERT(mutex_owned(&sc->sc_lock));
 	EHCIHIST_FUNC(); EHCIHIST_CALLED();
 	if (sc->sc_dying) {
 		DPRINTF("dying", 0, 0, 0, 0);
 		return;
+	}
 	/* ask for doorbell */
 	EOWRITE4(sc, EHCI_USBCMD, EOREAD4(sc, EHCI_USBCMD) | EHCI_CMD_IAAD);
 	DPRINTF("cmd = 0x%08x sts = 0x%08x",
 	    EOREAD4(sc, EHCI_USBCMD), EOREAD4(sc, EHCI_USBSTS), 0, 0);
 	error = cv_timedwait(&sc->sc_doorbell, &sc->sc_lock, hz); /* bell wait */
 	DPRINTF("cmd = 0x%08x sts = 0x%08x ... done",
 	    EOREAD4(sc, EHCI_USBCMD), EOREAD4(sc, EHCI_USBSTS), 0, 0);
 #ifdef DIAGNOSTIC
 	if (error == EWOULDBLOCK) {
 		printf("ehci_sync_hc: timed out\n");
 	} else if (error) {
 @@ -3085,90 +3094,105 @@ Static void
 ehci_close_pipe(struct usbd_pipe *pipe, ehci_soft_qh_t *head)
+{
 	struct ehci_pipe *epipe = EHCI_PIPE2EPIPE(pipe);
 	ehci_softc_t *sc = EHCI_PIPE2SC(pipe);
 	ehci_soft_qh_t *sqh = epipe->sqh;
 	KASSERT(mutex_owned(&sc->sc_lock));
 	ehci_rem_qh(sc, sqh, head);
 	ehci_free_sqh(sc, epipe->sqh);
+}
 /*
- * Abort a device request.
+ * Cancel or timeout a device request.  We have two cases to deal with
  * If this routine is called at splusb() it guarantees that the request
- * will be removed from the hardware scheduling and that the callback
+ * 1) A driver wants to stop scheduled or inflight transfers
- * for it will be called with USBD_CANCELLED status.
+ * 2) A transfer has timed out
  * It's impossible to guarantee that the requested transfer will not
- * have happened since the hardware runs concurrently.
+ * have (partially) happened since the hardware runs concurrently.
  * If the transaction has already happened we rely on the ordinary
- * interrupt processing to process it.
+ * Transfer state is protected by the bus lock and we set the transfer status
- * XXX This is most probably wrong.
+ * as soon as either of the above happens (with bus lock held).
  * XXXMRG this doesn't make sense anymore.
  * Then we arrange for the hardware to tells us that it is not still
  * processing the TDs by setting the QH halted bit and wait for the ehci
  * door bell
  */
 Static void
 ehci_abort_xfer(struct usbd_xfer *xfer, usbd_status status)
+{
 	EHCIHIST_FUNC(); EHCIHIST_CALLED();
 	struct ehci_pipe *epipe = EHCI_XFER2EPIPE(xfer);
 	struct ehci_xfer *exfer = EHCI_XFER2EXFER(xfer);
 	ehci_softc_t *sc = EHCI_XFER2SC(xfer);
 	ehci_soft_qh_t *sqh = epipe->sqh;
 	ehci_soft_qtd_t *sqtd, *fsqtd, *lsqtd;
 	ehci_physaddr_t cur;
 	uint32_t qhstatus;
 	int hit;
 	int wake;
-	EHCIHIST_FUNC(); EHCIHIST_CALLED();
+	KASSERTMSG((status == USBD_CANCELLED || status == USBD_TIMEOUT),
 	    "invalid status for abort: %d", (int)status);
 	DPRINTF("xfer=%p pipe=%p", xfer, epipe, 0, 0);
 	KASSERT(mutex_owned(&sc->sc_lock));
 	ASSERT_SLEEPABLE();
-	if (sc->sc_dying) {
+	if (status == USBD_CANCELLED) {
-		/* If we're dying, just do the software part. */
+		/*
-		xfer->ux_status = status;	/* make software ignore it */
+		 * We are synchronously aborting.  Try to stop the
-		callout_stop(&xfer->ux_callout);
+		 * callout and task, but if we can't, wait for them to
-		usb_transfer_complete(xfer);
+		 * complete.
-		return;
+		 */
 		callout_halt(&xfer->ux_callout, &sc->sc_lock);
 		usb_rem_task_wait(xfer->ux_pipe->up_dev, &xfer->ux_aborttask,
 		    USB_TASKQ_HC, &sc->sc_lock);
 	} else {
 		/* Otherwise, we are timing out.  */
 		KASSERT(status == USBD_TIMEOUT);
+	}
 	/*
-	 * If an abort is already in progress then just wait for it to
+	 * The xfer cannot have been cancelled already.  It is the
-	 * complete and return.
+	 * responsibility of the caller of usbd_abort_pipe not to try
 	 * to abort a pipe multiple times, whether concurrently or
 	 * sequentially.
 	 */
 	if (xfer->ux_hcflags & UXFER_ABORTING) {
-		DPRINTF("already aborting", 0, 0, 0, 0);
+	KASSERT(xfer->ux_status != USBD_CANCELLED);
 #ifdef DIAGNOSTIC
-		if (status == USBD_TIMEOUT)
+	/* Only the timeout, which runs only once, can time it out.  */
-			printf("ehci_abort_xfer: TIMEOUT while aborting\n");
+	KASSERT(xfer->ux_status != USBD_TIMEOUT);
 #endif
-		/* Override the status which might be USBD_TIMEOUT. */
+	/* If anyone else beat us, we're done.  */
-		xfer->ux_status = status;
+	if (xfer->ux_status != USBD_IN_PROGRESS)
 		DPRINTF("waiting for abort to finish", 0, 0, 0, 0);
 		xfer->ux_hcflags |= UXFER_ABORTWAIT;
 		while (xfer->ux_hcflags & UXFER_ABORTING)
 			cv_wait(&xfer->ux_hccv, &sc->sc_lock);
 		return;
 	/* We beat everyone else.  Claim the status.  */
 	xfer->ux_status = status;
 	/*
 	 * If we're dying, skip the hardware action and just notify the
 	 * software that we're done.
 	 */
 	if (sc->sc_dying) {
 		goto dying;
+	}
 	xfer->ux_hcflags |= UXFER_ABORTING;
 	/*
-	 * Step 1: Make interrupt routine and hardware ignore xfer.
+	 * HC Step 1: Make interrupt routine and hardware ignore xfer.
 	 */
 	xfer->ux_status = status;	/* make software ignore it */
 	callout_stop(&xfer->ux_callout);
 	ehci_del_intr_list(sc, exfer);
 	usb_syncmem(&sqh->dma,
 	    sqh->offs + offsetof(ehci_qh_t, qh_qtd.qtd_status),
 	    sizeof(sqh->qh.qh_qtd.qtd_status),
 	    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
 	qhstatus = sqh->qh.qh_qtd.qtd_status;
 	sqh->qh.qh_qtd.qtd_status = qhstatus | htole32(EHCI_QTD_HALTED);
 	usb_syncmem(&sqh->dma,
 	    sqh->offs + offsetof(ehci_qh_t, qh_qtd.qtd_status),
 	    sizeof(sqh->qh.qh_qtd.qtd_status),
 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
 @@ -3184,37 +3208,33 @@ ehci_abort_xfer(struct usbd_xfer *xfer,
 		    sqtd->offs + offsetof(ehci_qtd_t, qtd_status),
 		    sizeof(sqtd->qtd.qtd_status),
 		    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
 		sqtd->qtd.qtd_status |= htole32(EHCI_QTD_HALTED);
 		usb_syncmem(&sqtd->dma,
 		    sqtd->offs + offsetof(ehci_qtd_t, qtd_status),
 		    sizeof(sqtd->qtd.qtd_status),
 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
 		if (sqtd == lsqtd)
 			break;
+	}
 	/*
-	 * Step 2: Wait until we know hardware has finished any possible
+	 * HC Step 2: Wait until we know hardware has finished any possible
-	 * use of the xfer.  Also make sure the soft interrupt routine
+	 * use of the xfer.
 	 * has run.
 	 */
 	ehci_sync_hc(sc);
 	sc->sc_softwake = 1;
 	usb_schedsoftintr(&sc->sc_bus);
 	cv_wait(&sc->sc_softwake_cv, &sc->sc_lock);
 	/*
-	 * Step 3: Remove any vestiges of the xfer from the hardware.
+	 * HC Step 3: Remove any vestiges of the xfer from the hardware.
 	 * The complication here is that the hardware may have executed
 	 * beyond the xfer we're trying to abort.  So as we're scanning
 	 * the TDs of this xfer we check if the hardware points to
 	 * any of them.
 	 */
 	usb_syncmem(&sqh->dma,
 	    sqh->offs + offsetof(ehci_qh_t, qh_curqtd),
 	    sizeof(sqh->qh.qh_curqtd),
 	    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
 	cur = EHCI_LINK_ADDR(le32toh(sqh->qh.qh_curqtd));
 	hit = 0;
 	for (sqtd = fsqtd; ; sqtd = sqtd->nextqtd) {
 @@ -3235,86 +3255,88 @@ ehci_abort_xfer(struct usbd_xfer *xfer,
 		usb_syncmem(&sqh->dma,
 		    sqh->offs + offsetof(ehci_qh_t, qh_qtd.qtd_status),
 		    sizeof(sqh->qh.qh_qtd.qtd_status),
 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
 	} else {
 		DPRINTF("no hit", 0, 0, 0, 0);
 		usb_syncmem(&sqh->dma,
 		    sqh->offs + offsetof(ehci_qh_t, qh_curqtd),
 		    sizeof(sqh->qh.qh_curqtd),
 		    BUS_DMASYNC_PREREAD);
+	}
 	/*
-	 * Step 4: Execute callback.
+	 * Final step: Notify completion to waiting xfers.
 	 */
 dying:
 #ifdef DIAGNOSTIC
 	exfer->ex_isdone = true;
 #endif
 	wake = xfer->ux_hcflags & UXFER_ABORTWAIT;
 	xfer->ux_hcflags &= ~(UXFER_ABORTING | UXFER_ABORTWAIT);
 	usb_transfer_complete(xfer);
-	if (wake) {
+	DPRINTFN(14, "end", 0, 0, 0, 0);
 		cv_broadcast(&xfer->ux_hccv);
 	KASSERT(mutex_owned(&sc->sc_lock));
+}
 Static void
 ehci_abort_isoc_xfer(struct usbd_xfer *xfer, usbd_status status)
+{
 	EHCIHIST_FUNC(); EHCIHIST_CALLED();
 	ehci_isoc_trans_t trans_status;
 	struct ehci_xfer *exfer;
 	ehci_softc_t *sc;
 	struct ehci_soft_itd *itd;
 	struct ehci_soft_sitd *sitd;
-	int i, wake;
+	int i;
-	EHCIHIST_FUNC(); EHCIHIST_CALLED();
+	KASSERTMSG(status == USBD_CANCELLED,
 	    "invalid status for abort: %d", (int)status);
 	exfer = EHCI_XFER2EXFER(xfer);
 	sc = EHCI_XFER2SC(xfer);
 	DPRINTF("xfer %p pipe %p", xfer, xfer->ux_pipe, 0, 0);
 	KASSERT(mutex_owned(&sc->sc_lock));
 	ASSERT_SLEEPABLE();
-	if (sc->sc_dying) {
+	/* No timeout or task here. */
 		xfer->ux_status = status;
 		callout_stop(&xfer->ux_callout);
 		usb_transfer_complete(xfer);
 		return;
-	if (xfer->ux_hcflags & UXFER_ABORTING) {
+	/*
-		DPRINTF("already aborting", 0, 0, 0, 0);
+	 * The xfer cannot have been cancelled already.  It is the
 	 * responsibility of the caller of usbd_abort_pipe not to try
 	 * to abort a pipe multiple times, whether concurrently or
 	 * sequentially.
 	 */
 	KASSERT(xfer->ux_status != USBD_CANCELLED);
-#ifdef DIAGNOSTIC
+	/* If anyone else beat us, we're done.  */
-		if (status == USBD_TIMEOUT)
+	if (xfer->ux_status != USBD_IN_PROGRESS)
-			printf("ehci_abort_isoc_xfer: TIMEOUT while aborting\n");
+		return;
 #endif
-		xfer->ux_status = status;
+	/* We beat everyone else.  Claim the status.  */
-		DPRINTF("waiting for abort to finish", 0, 0, 0, 0);
+	xfer->ux_status = status;
 		xfer->ux_hcflags |= UXFER_ABORTWAIT;
-		while (xfer->ux_hcflags & UXFER_ABORTING)
+	/*
-			cv_wait(&xfer->ux_hccv, &sc->sc_lock);
+	 * If we're dying, skip the hardware action and just notify the
-		goto done;
+	 * software that we're done.
 	 */
 	if (sc->sc_dying) {
 		goto dying;
+	}
 	xfer->ux_hcflags |= UXFER_ABORTING;
-	xfer->ux_status = status;
+	/*
-	callout_stop(&xfer->ux_callout);
+	 * HC Step 1: Make interrupt routine and hardware ignore xfer.
 	 */
 	ehci_del_intr_list(sc, exfer);
 	if (xfer->ux_pipe->up_dev->ud_speed == USB_SPEED_HIGH) {
 		for (itd = exfer->ex_itdstart; itd != NULL;
 		     itd = itd->xfer_next) {
 			usb_syncmem(&itd->dma,
 			    itd->offs + offsetof(ehci_itd_t, itd_ctl),
 			    sizeof(itd->itd.itd_ctl),
 			    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
 			for (i = 0; i < 8; i++) {
 				trans_status = le32toh(itd->itd.itd_ctl[i]);
 				trans_status &= ~EHCI_ITD_ACTIVE;
 @@ -3335,73 +3357,56 @@ ehci_abort_isoc_xfer(struct usbd_xfer *x
 			    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
 			trans_status = le32toh(sitd->sitd.sitd_trans);
 			trans_status &= ~EHCI_SITD_ACTIVE;
 			sitd->sitd.sitd_trans = htole32(trans_status);
 			usb_syncmem(&sitd->dma,
 			    sitd->offs + offsetof(ehci_sitd_t, sitd_buffer),
 			    sizeof(sitd->sitd.sitd_buffer),
 			    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
+		}
+	}
-	sc->sc_softwake = 1;
+dying:
 	usb_schedsoftintr(&sc->sc_bus);
 	cv_wait(&sc->sc_softwake_cv, &sc->sc_lock);
 #ifdef DIAGNOSTIC
 	exfer->ex_isdone = true;
 #endif
 	wake = xfer->ux_hcflags & UXFER_ABORTWAIT;
 	xfer->ux_hcflags &= ~(UXFER_ABORTING | UXFER_ABORTWAIT);
 	usb_transfer_complete(xfer);
-	if (wake) {
+	DPRINTFN(14, "end", 0, 0, 0, 0);
 		cv_broadcast(&xfer->ux_hccv);
 done:
 	KASSERT(mutex_owned(&sc->sc_lock));
 	return;
+}
 Static void
 ehci_timeout(void *addr)
+{
 	EHCIHIST_FUNC(); EHCIHIST_CALLED();
 	struct usbd_xfer *xfer = addr;
 	struct ehci_xfer *exfer = EHCI_XFER2EXFER(xfer);
 	struct usbd_pipe *pipe = xfer->ux_pipe;
 	struct usbd_device *dev = pipe->up_dev;
 	ehci_softc_t *sc = EHCI_XFER2SC(xfer);
 	struct usbd_device *dev = xfer->ux_pipe->up_dev;
-	EHCIHIST_FUNC(); EHCIHIST_CALLED();
+	DPRINTF("xfer %p", xfer, 0, 0, 0);
 	DPRINTF("exfer %p", exfer, 0, 0, 0);
 #ifdef EHCI_DEBUG
-	if (ehcidebug >= 2)
+	if (ehcidebug >= 2) {
 		struct usbd_pipe *pipe = xfer->ux_pipe;
 		usbd_dump_pipe(pipe);
 #endif
 	if (sc->sc_dying) {
 		mutex_enter(&sc->sc_lock);
 		ehci_abort_xfer(xfer, USBD_TIMEOUT);
 		mutex_exit(&sc->sc_lock);
 		return;
+	}
 #endif
-	/* Execute the abort in a process context. */
+	mutex_enter(&sc->sc_lock);
-	usb_init_task(&exfer->ex_aborttask, ehci_timeout_task, xfer,
+	if (!sc->sc_dying && xfer->ux_status == USBD_IN_PROGRESS)
-	    USB_TASKQ_MPSAFE);
+		usb_add_task(dev, &xfer->ux_aborttask, USB_TASKQ_HC);
-	usb_add_task(dev, &exfer->ex_aborttask, USB_TASKQ_HC);
+	mutex_exit(&sc->sc_lock);
+}
 Static void
 ehci_timeout_task(void *addr)
+{
 	struct usbd_xfer *xfer = addr;
 	ehci_softc_t *sc = EHCI_XFER2SC(xfer);
 	EHCIHIST_FUNC(); EHCIHIST_CALLED();
 	DPRINTF("xfer=%p", xfer, 0, 0, 0);
 	mutex_enter(&sc->sc_lock);
 @@ -4448,27 +4453,26 @@ ehci_device_fs_isoc_transfer(struct usbd
 		sitd->slot = frindex;
 		sitd->frame_list.prev = NULL;
 		frindex += i;
 		if (frindex >= sc->sc_flsize)
 			frindex -= sc->sc_flsize;
+	}
 	epipe->isoc.cur_xfers++;
 	epipe->isoc.next_frame = frindex;
 	ehci_add_intr_list(sc, exfer);
 	xfer->ux_status = USBD_IN_PROGRESS;
 	mutex_exit(&sc->sc_lock);
 	return USBD_IN_PROGRESS;
+}
 Static void
 ehci_device_fs_isoc_abort(struct usbd_xfer *xfer)
+{
 	EHCIHIST_FUNC(); EHCIHIST_CALLED();
 	DPRINTF("xfer = %p", xfer, 0, 0, 0);
 	ehci_abort_isoc_xfer(xfer, USBD_CANCELLED);
+}
 @@ -4842,27 +4846,26 @@ ehci_device_isoc_transfer(struct usbd_xf
 		frindex += i;
 		if (frindex >= sc->sc_flsize)
 			frindex -= sc->sc_flsize;
 		itd = itd->xfer_next;
+	}
 	epipe->isoc.cur_xfers++;
 	epipe->isoc.next_frame = frindex;
 	ehci_add_intr_list(sc, exfer);
 	xfer->ux_status = USBD_IN_PROGRESS;
 	mutex_exit(&sc->sc_lock);
 	return USBD_IN_PROGRESS;
+}
 Static void
 ehci_device_isoc_abort(struct usbd_xfer *xfer)
+{
 	EHCIHIST_FUNC(); EHCIHIST_CALLED();
 	DPRINTF("xfer = %p", xfer, 0, 0, 0);
 	ehci_abort_isoc_xfer(xfer, USBD_CANCELLED);
+}

 @@ -1,14 +1,14 @@
-/*	$NetBSD: ohci.c,v 1.253.2.4 2018/01/03 20:02:37 snj Exp $	*/
+/*	$NetBSD: ohci.c,v 1.253.2.5 2018/08/25 14:57:35 martin Exp $	*/
 /*
  * Copyright (c) 1998, 2004, 2005, 2012 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Lennart Augustsson (lennart@augustsson.net) at
  * Carlstedt Research & Technology, Jared D. McNeill (jmcneill@invisible.ca)
  * and Matthew R. Green (mrg@eterna.com.au).
  * This code is derived from software contributed to The NetBSD Foundation
  * by Charles M. Hannum.
+ *
  * Redistribution and use in source and binary forms, with or without
 @@ -31,27 +31,27 @@
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  */
 /*
  * USB Open Host Controller driver.
+ *
  * OHCI spec: http://www.compaq.com/productinfo/development/openhci.html
  * USB spec: http://www.usb.org/developers/docs/
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ohci.c,v 1.253.2.4 2018/01/03 20:02:37 snj Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ohci.c,v 1.253.2.5 2018/08/25 14:57:35 martin Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
 #endif
 #include <sys/param.h>
 #include <sys/cpu.h>
 #include <sys/device.h>
 #include <sys/kernel.h>
 #include <sys/kmem.h>
 #include <sys/proc.h>
 #include <sys/queue.h>
 @@ -374,28 +374,26 @@ ohci_detach(struct ohci_softc *sc, int f
 	if (sc->sc_child != NULL)
 		rv = config_detach(sc->sc_child, flags);
 	if (rv != 0)
 		return rv;
 	callout_halt(&sc->sc_tmo_rhsc, &sc->sc_lock);
 	usb_delay_ms(&sc->sc_bus, 300); /* XXX let stray task complete */
 	callout_destroy(&sc->sc_tmo_rhsc);
 	softint_disestablish(sc->sc_rhsc_si);
 	cv_destroy(&sc->sc_softwake_cv);
 	mutex_destroy(&sc->sc_lock);
 	mutex_destroy(&sc->sc_intr_lock);
 	if (sc->sc_hcca != NULL)
 		usb_freemem(&sc->sc_bus, &sc->sc_hccadma);
 	pool_cache_destroy(sc->sc_xferpool);
 	return rv;
+}
 ohci_soft_ed_t *
 ohci_alloc_sed(ohci_softc_t *sc)
+{
 @@ -776,27 +774,26 @@ ohci_init(ohci_softc_t *sc)
 	usbd_status err;
 	int i;
 	uint32_t s, ctl, rwc, ival, hcr, fm, per, rev, desca /*, descb */;
 	OHCIHIST_FUNC(); OHCIHIST_CALLED();
 	aprint_normal_dev(sc->sc_dev, "");
 	sc->sc_hcca = NULL;
 	callout_init(&sc->sc_tmo_rhsc, CALLOUT_MPSAFE);
 	mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_SOFTUSB);
 	mutex_init(&sc->sc_intr_lock, MUTEX_DEFAULT, IPL_USB);
 	cv_init(&sc->sc_softwake_cv, "ohciab");
 	sc->sc_rhsc_si = softint_establish(SOFTINT_USB | SOFTINT_MPSAFE,
 	    ohci_rhsc_softint, sc);
 	for (i = 0; i < OHCI_HASH_SIZE; i++)
 		LIST_INIT(&sc->sc_hash_tds[i]);
 	for (i = 0; i < OHCI_HASH_SIZE; i++)
 		LIST_INIT(&sc->sc_hash_itds[i]);
 	sc->sc_xferpool = pool_cache_init(sizeof(struct ohci_xfer), 0, 0, 0,
 	    "ohcixfer", NULL, IPL_USB, NULL, NULL, NULL);
 	rev = OREAD4(sc, OHCI_REVISION);
 @@ -1058,26 +1055,30 @@ ohci_init(ohci_softc_t *sc)
 	sc->sc_hcca = NULL;
 	return err;
+}
 struct usbd_xfer *
 ohci_allocx(struct usbd_bus *bus, unsigned int nframes)
+{
 	ohci_softc_t *sc = OHCI_BUS2SC(bus);
 	struct usbd_xfer *xfer;
 	xfer = pool_cache_get(sc->sc_xferpool, PR_WAITOK);
 	if (xfer != NULL) {
 		memset(xfer, 0, sizeof(struct ohci_xfer));
 		/* Initialise this always so we can call remove on it. */
 		usb_init_task(&xfer->ux_aborttask, ohci_timeout_task, xfer,
 		    USB_TASKQ_MPSAFE);
 #ifdef DIAGNOSTIC
 		xfer->ux_state = XFER_BUSY;
 #endif
+	}
 	return xfer;
+}
 void
 ohci_freex(struct usbd_bus *bus, struct usbd_xfer *xfer)
+{
 	ohci_softc_t *sc = OHCI_BUS2SC(bus);
 	KASSERTMSG(xfer->ux_state == XFER_BUSY,
 @@ -1443,33 +1444,45 @@ ohci_softintr(void *v)
 		xfer = std->xfer;
 		stdnext = std->dnext;
 		DPRINTFN(10, "std=%p xfer=%p hcpriv=%p", std, xfer,
 		    xfer ? xfer->ux_hcpriv : 0, 0);
 		if (xfer == NULL) {
 			/*
 			 * xfer == NULL: There seems to be no xfer associated
 			 * with this TD. It is tailp that happened to end up on
 			 * the done queue.
 			 * Shouldn't happen, but some chips are broken(?).
 			 */
 			continue;
+		}
 		if (xfer->ux_status == USBD_CANCELLED ||
-		    xfer->ux_status == USBD_TIMEOUT) {
+		/*
-			DPRINTF("cancel/timeout %p", xfer, 0, 0, 0);
+		 * If software has completed it, either by cancellation
-			/* Handled by abort routine. */
+		 * or timeout, drop it on the floor.
 		 */
 		if (xfer->ux_status != USBD_IN_PROGRESS) {
 			KASSERT(xfer->ux_status == USBD_CANCELLED ||
 			    xfer->ux_status == USBD_TIMEOUT);
 			continue;
+		}
 		/*
 		 * Cancel the timeout and the task, which have not yet
 		 * run.  If they have already fired, at worst they are
 		 * waiting for the lock.  They will see that the xfer
 		 * is no longer in progress and give up.
 		 */
 		callout_stop(&xfer->ux_callout);
 		usb_rem_task(xfer->ux_pipe->up_dev, &xfer->ux_aborttask);
 		len = std->len;
 		if (std->td.td_cbp != 0)
 			len -= O32TOH(std->td.td_be) -
 			       O32TOH(std->td.td_cbp) + 1;
 		DPRINTFN(10, "len=%d, flags=0x%x", len, std->flags, 0, 0);
 		if (std->flags & OHCI_ADD_LEN)
 			xfer->ux_actlen += len;
 		cc = OHCI_TD_GET_CC(O32TOH(std->td.td_flags));
 		if (cc == OHCI_CC_NO_ERROR) {
 			ohci_hash_rem_td(sc, std);
 			if (std->flags & OHCI_CALL_DONE) {
 @@ -1519,32 +1532,46 @@ ohci_softintr(void *v)
 		for (sitd = sidone; sitd; sitd = sitd->dnext)
 			ohci_dump_itd(sc, sitd);
+	}
 #endif
 	DPRINTFN(10, "--- ITD dump end ---", 0, 0, 0, 0);
 	for (sitd = sidone; sitd != NULL; sitd = sitdnext) {
 		xfer = sitd->xfer;
 		sitdnext = sitd->dnext;
 		DPRINTFN(1, "sitd=%p xfer=%p hcpriv=%p", sitd, xfer,
 		    xfer ? xfer->ux_hcpriv : 0, 0);
 		if (xfer == NULL)
 			continue;
 		if (xfer->ux_status == USBD_CANCELLED ||
-		    xfer->ux_status == USBD_TIMEOUT) {
+		/*
-			DPRINTF("cancel/timeout %p", xfer, 0, 0, 0);
+		 * If software has completed it, either by cancellation
-			/* Handled by abort routine. */
+		 * or timeout, drop it on the floor.
 		 */
 		if (xfer->ux_status != USBD_IN_PROGRESS) {
 			KASSERT(xfer->ux_status == USBD_CANCELLED ||
 			    xfer->ux_status == USBD_TIMEOUT);
 			continue;
+		}
 		/*
 		 * Cancel the timeout and the task, which have not yet
 		 * run.  If they have already fired, at worst they are
 		 * waiting for the lock.  They will see that the xfer
 		 * is no longer in progress and give up.
 		 */
 		callout_stop(&xfer->ux_callout);
 		usb_rem_task(xfer->ux_pipe->up_dev, &xfer->ux_aborttask);
 		KASSERT(!sitd->isdone);
 #ifdef DIAGNOSTIC
 		sitd->isdone = true;
 #endif
 		if (sitd->flags & OHCI_CALL_DONE) {
 			ohci_soft_itd_t *next;
 			opipe = OHCI_PIPE2OPIPE(xfer->ux_pipe);
 			opipe->isoc.inuse -= xfer->ux_nframes;
 			uedir = UE_GET_DIR(xfer->ux_pipe->up_endpoint->ue_edesc->
 			    bEndpointAddress);
 			xfer->ux_status = USBD_NORMAL_COMPLETION;
 			actlen = 0;
 @@ -1578,32 +1605,28 @@ ohci_softintr(void *v)
 				ohci_hash_rem_itd(sc, sitd);
+			}
 			ohci_hash_rem_itd(sc, sitd);
 			if (uedir == UE_DIR_IN &&
 			    xfer->ux_status == USBD_NORMAL_COMPLETION)
 				xfer->ux_actlen = actlen;
 			xfer->ux_hcpriv = NULL;
 			usb_transfer_complete(xfer);
+		}
+	}
 	if (sc->sc_softwake) {
 		sc->sc_softwake = 0;
 		cv_broadcast(&sc->sc_softwake_cv);
 	DPRINTFN(10, "done", 0, 0, 0, 0);
 	KASSERT(sc->sc_bus.ub_usepolling || mutex_owned(&sc->sc_lock));
+}
 void
 ohci_device_ctrl_done(struct usbd_xfer *xfer)
+{
 	struct ohci_pipe *opipe = OHCI_PIPE2OPIPE(xfer->ux_pipe);
 	ohci_softc_t *sc __diagused = OHCI_XFER2SC(xfer);
 	int len = UGETW(xfer->ux_request.wLength);
 	int isread = (xfer->ux_request.bmRequestType & UT_READ);
 	OHCIHIST_FUNC(); OHCIHIST_CALLED();
 	DPRINTFN(10, "xfer=%p", xfer, 0, 0, 0);
 @@ -1866,45 +1889,37 @@ ohci_hash_find_itd(ohci_softc_t *sc, ohc
 	ohci_soft_itd_t *sitd;
 	for (sitd = LIST_FIRST(&sc->sc_hash_itds[h]);
 	     sitd != NULL;
 	     sitd = LIST_NEXT(sitd, hnext))
 		if (sitd->physaddr == a)
 			return sitd;
 	return NULL;
+}
 void
 ohci_timeout(void *addr)
+{
 	OHCIHIST_FUNC(); OHCIHIST_CALLED();
 	struct usbd_xfer *xfer = addr;
 	struct ohci_xfer *oxfer = OHCI_XFER2OXFER(xfer);
 	ohci_softc_t *sc = OHCI_XFER2SC(xfer);
 	struct usbd_device *dev = xfer->ux_pipe->up_dev;
-	OHCIHIST_FUNC(); OHCIHIST_CALLED();
+	DPRINTF("xfer=%p", xfer, 0, 0, 0);
 	DPRINTF("oxfer=%p", oxfer, 0, 0, 0);
 	if (sc->sc_dying) {
 		mutex_enter(&sc->sc_lock);
 		ohci_abort_xfer(xfer, USBD_TIMEOUT);
 		mutex_exit(&sc->sc_lock);
 		return;
-	/* Execute the abort in a process context. */
+	mutex_enter(&sc->sc_lock);
-	usb_init_task(&oxfer->abort_task, ohci_timeout_task, addr,
+	if (!sc->sc_dying && xfer->ux_status == USBD_IN_PROGRESS)
-	    USB_TASKQ_MPSAFE);
+		usb_add_task(dev, &xfer->ux_aborttask, USB_TASKQ_HC);
-	usb_add_task(xfer->ux_pipe->up_dev, &oxfer->abort_task,
+	mutex_exit(&sc->sc_lock);
 	    USB_TASKQ_HC);
+}
 void
 ohci_timeout_task(void *addr)
+{
 	struct usbd_xfer *xfer = addr;
 	ohci_softc_t *sc = OHCI_XFER2SC(xfer);
 	OHCIHIST_FUNC(); OHCIHIST_CALLED();
 	DPRINTF("xfer=%p", xfer, 0, 0, 0);
 	mutex_enter(&sc->sc_lock);
 @@ -2174,109 +2189,133 @@ ohci_close_pipe(struct usbd_pipe *pipe,
 		    (O32TOH(sed->ed.ed_headp) & OHCI_HEADMASK))
 			printf("ohci_close_pipe: pipe still not empty\n");
+	}
 #endif
 	ohci_rem_ed(sc, sed, head);
 	/* Make sure the host controller is not touching this ED */
 	usb_delay_ms(&sc->sc_bus, 1);
 	pipe->up_endpoint->ue_toggle =
 	    (O32TOH(sed->ed.ed_headp) & OHCI_TOGGLECARRY) ? 1 : 0;
 	ohci_free_sed_locked(sc, opipe->sed);
+}
 /*
- * Abort a device request.
+ * Cancel or timeout a device request.  We have two cases to deal with
  * If this routine is called at splusb() it guarantees that the request
- * will be removed from the hardware scheduling and that the callback
+ * 1) A driver wants to stop scheduled or inflight transfers
- * for it will be called with USBD_CANCELLED status.
+ * 2) A transfer has timed out
+ *
  * It's impossible to guarantee that the requested transfer will not
- * have happened since the hardware runs concurrently.
+ * have (partially) happened since the hardware runs concurrently.
  * If the transaction has already happened we rely on the ordinary
- * interrupt processing to process it.
+ * Transfer state is protected by the bus lock and we set the transfer status
- * XXX This is most probably wrong.
+ * as soon as either of the above happens (with bus lock held).
  * XXXMRG this doesn't make sense anymore.
  * Then we arrange for the hardware to tells us that it is not still
  * processing the TDs by setting the sKip bit and requesting a SOF interrupt
+ *
  * Once we see the SOF interrupt we can check the transfer TDs/iTDs to see if
  * they've been processed and either
  * 	a) if they're unused recover them for later use, or
  *	b) if they've been used allocate new TD/iTDs to replace those
  *         used.  The softint handler will free the old ones.
  */
 void
 ohci_abort_xfer(struct usbd_xfer *xfer, usbd_status status)
+{
 	OHCIHIST_FUNC(); OHCIHIST_CALLED();
 	struct ohci_pipe *opipe = OHCI_PIPE2OPIPE(xfer->ux_pipe);
 	ohci_softc_t *sc = OHCI_XFER2SC(xfer);
 	ohci_soft_ed_t *sed = opipe->sed;
 	ohci_soft_td_t *p, *n;
 	ohci_physaddr_t headp;
 	int hit;
 	int wake;
-	OHCIHIST_FUNC(); OHCIHIST_CALLED();
+	KASSERTMSG((status == USBD_CANCELLED || status == USBD_TIMEOUT),
 	    "invalid status for abort: %d", (int)status);
 	DPRINTF("xfer=%p pipe=%p sed=%p", xfer, opipe,sed, 0);
 	KASSERT(mutex_owned(&sc->sc_lock));
 	ASSERT_SLEEPABLE();
-	if (sc->sc_dying) {
+	if (status == USBD_CANCELLED) {
-		/* If we're dying, just do the software part. */
+		/*
-		xfer->ux_status = status;	/* make software ignore it */
+		 * We are synchronously aborting.  Try to stop the
 		 * callout and task, but if we can't, wait for them to
 		 * complete.
 		 */
 		callout_halt(&xfer->ux_callout, &sc->sc_lock);
-		usb_transfer_complete(xfer);
+		usb_rem_task_wait(xfer->ux_pipe->up_dev, &xfer->ux_aborttask,
-		return;
+		    USB_TASKQ_HC, &sc->sc_lock);
 	} else {
 		/* Otherwise, we are timing out.  */
 		KASSERT(status == USBD_TIMEOUT);
+	}
 	/*
-	 * If an abort is already in progress then just wait for it to
+	 * The xfer cannot have been cancelled already.  It is the
-	 * complete and return.
+	 * responsibility of the caller of usbd_abort_pipe not to try
 	 * to abort a pipe multiple times, whether concurrently or
 	 * sequentially.
 	 */
-	if (xfer->ux_hcflags & UXFER_ABORTING) {
+	KASSERT(xfer->ux_status != USBD_CANCELLED);
 		DPRINTFN(2, "already aborting", 0, 0, 0, 0);
-#ifdef DIAGNOSTIC
+	/* Only the timeout, which runs only once, can time it out.  */
-		if (status == USBD_TIMEOUT)
+	KASSERT(xfer->ux_status != USBD_TIMEOUT);
 			printf("%s: TIMEOUT while aborting\n", __func__);
-#endif
+	/* If anyone else beat us, we're done.  */
-		/* Override the status which might be USBD_TIMEOUT. */
+	if (xfer->ux_status != USBD_IN_PROGRESS)
-		xfer->ux_status = status;
+		return;
 		DPRINTFN(2, "waiting for abort to finish", 0, 0, 0, 0);
-		xfer->ux_hcflags |= UXFER_ABORTWAIT;
+	/* We beat everyone else.  Claim the status.  */
-		while (xfer->ux_hcflags & UXFER_ABORTING)
+	xfer->ux_status = status;
 			cv_wait(&xfer->ux_hccv, &sc->sc_lock);
-		goto done;
+	/*
 	 * If we're dying, skip the hardware action and just notify the
 	 * software that we're done.
 	 */
 	if (sc->sc_dying) {
 		DPRINTFN(4, "xfer %#jx dying %ju", (uintptr_t)xfer,
 		    xfer->ux_status, 0, 0);
 		goto dying;
+	}
 	xfer->ux_hcflags |= UXFER_ABORTING;
 	/*
-	 * Step 1: Make interrupt routine and hardware ignore xfer.
+	 * HC Step 1: Unless the endpoint is already halted, we set the endpoint
 	 * descriptor sKip bit and wait for hardware to complete processing.
+	 *
 	 * This includes ensuring that any TDs of the transfer that got onto
 	 * the done list are also removed.  We ensure this by waiting for
 	 * both a WDH and SOF interrupt.
 	 */
 	xfer->ux_status = status;	/* make software ignore it */
 	callout_stop(&xfer->ux_callout);
 	DPRINTFN(1, "stop ed=%p", sed, 0, 0, 0);
 	usb_syncmem(&sed->dma, sed->offs + offsetof(ohci_ed_t, ed_flags),
 	    sizeof(sed->ed.ed_flags),
 	    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
 	sed->ed.ed_flags |= HTOO32(OHCI_ED_SKIP); /* force hardware skip */
 	usb_syncmem(&sed->dma, sed->offs + offsetof(ohci_ed_t, ed_flags),
 	    sizeof(sed->ed.ed_flags),
 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
 	/*
-	 * Step 2: Wait until we know hardware has finished any possible
+	 * HC Step 2: Wait until we know hardware has finished any possible
-	 * use of the xfer.  Also make sure the soft interrupt routine
+	 * use of the xfer.
 	 * has run.
 	 */
 	/* Hardware finishes in 1ms */
 	usb_delay_ms_locked(opipe->pipe.up_dev->ud_bus, 20, &sc->sc_lock);
 	sc->sc_softwake = 1;
 	usb_schedsoftintr(&sc->sc_bus);
 	cv_wait(&sc->sc_softwake_cv, &sc->sc_lock);
 	/*
-	 * Step 3: Remove any vestiges of the xfer from the hardware.
+	 * HC Step 3: Remove any vestiges of the xfer from the hardware.
 	 * The complication here is that the hardware may have executed
 	 * beyond the xfer we're trying to abort.  So as we're scanning
 	 * the TDs of this xfer we check if the hardware points to
 	 * any of them.
 	 */
 	p = xfer->ux_hcpriv;
 	KASSERT(p);
 #ifdef OHCI_DEBUG
 	DPRINTF("--- dump start ---", 0, 0, 0, 0);
 	if (ohcidebug >= 2) {
 		DPRINTF("sed:", 0, 0, 0, 0);
 @@ -2296,46 +2335,43 @@ ohci_abort_xfer(struct usbd_xfer *xfer,
 	if (hit) {
 		DPRINTFN(1, "set hd=0x%08x, tl=0x%08x",  (int)p->physaddr,
 		    (int)O32TOH(sed->ed.ed_tailp), 0, 0);
 		sed->ed.ed_headp = HTOO32(p->physaddr); /* unlink TDs */
 		usb_syncmem(&sed->dma,
 		    sed->offs + offsetof(ohci_ed_t, ed_headp),
 		    sizeof(sed->ed.ed_headp),
 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
 	} else {
 		DPRINTFN(1, "no hit", 0, 0, 0, 0);
+	}
 	/*
-	 * Step 4: Turn on hardware again.
+	 * HC Step 4: Turn on hardware again.
 	 */
 	usb_syncmem(&sed->dma, sed->offs + offsetof(ohci_ed_t, ed_flags),
 	    sizeof(sed->ed.ed_flags),
 	    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
 	sed->ed.ed_flags &= HTOO32(~OHCI_ED_SKIP); /* remove hardware skip */
 	usb_syncmem(&sed->dma, sed->offs + offsetof(ohci_ed_t, ed_flags),
 	    sizeof(sed->ed.ed_flags),
 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
 	/*
-	 * Step 5: Execute callback.
+	 * Final step: Notify completion to waiting xfers.
 	 */
-	wake = xfer->ux_hcflags & UXFER_ABORTWAIT;
+dying:
 	xfer->ux_hcflags &= ~(UXFER_ABORTING | UXFER_ABORTWAIT);
 	usb_transfer_complete(xfer);
-	if (wake)
+	DPRINTFN(14, "end", 0, 0, 0, 0);
 		cv_broadcast(&xfer->ux_hccv);
 done:
 	KASSERT(mutex_owned(&sc->sc_lock));
+}
 /*
  * Data structures and routines to emulate the root hub.
  */
 Static int
 ohci_roothub_ctrl(struct usbd_bus *bus, usb_device_request_t *req,
     void *buf, int buflen)
+{
 	ohci_softc_t *sc = OHCI_BUS2SC(bus);
 	usb_port_status_t ps;
 	uint16_t len, value, index;
 @@ -2830,26 +2866,27 @@ ohci_device_ctrl_start(struct usbd_xfer
 	sed->ed.ed_tailp = HTOO32(tail->physaddr);
 	usb_syncmem(&sed->dma,
 	    sed->offs + offsetof(ohci_ed_t, ed_tailp),
 	    sizeof(sed->ed.ed_tailp),
 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
 	OWRITE4(sc, OHCI_COMMAND_STATUS, OHCI_CLF);
 	if (xfer->ux_timeout && !sc->sc_bus.ub_usepolling) {
 		callout_reset(&xfer->ux_callout, mstohz(xfer->ux_timeout),
 			    ohci_timeout, xfer);
+	}
 	DPRINTF("done", 0, 0, 0, 0);
 	xfer->ux_status = USBD_IN_PROGRESS;
 	mutex_exit(&sc->sc_lock);
 	return USBD_IN_PROGRESS;
+}
 /* Abort a device control request. */
 Static void
 ohci_device_ctrl_abort(struct usbd_xfer *xfer)
+{
 	ohci_softc_t *sc __diagused = OHCI_XFER2SC(xfer);
 	KASSERT(mutex_owned(&sc->sc_lock));
 @@ -3037,26 +3074,28 @@ ohci_device_bulk_start(struct usbd_xfer
 		KASSERT(tdp->xfer == xfer);
+	}
 	usb_syncmem(&sed->dma, sed->offs, sizeof(sed->ed),
 	    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
 	sed->ed.ed_tailp = HTOO32(tail->physaddr);
 	sed->ed.ed_flags &= HTOO32(~OHCI_ED_SKIP);
 	usb_syncmem(&sed->dma, sed->offs, sizeof(sed->ed),
 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
 	OWRITE4(sc, OHCI_COMMAND_STATUS, OHCI_BLF);
 	if (xfer->ux_timeout && !sc->sc_bus.ub_usepolling) {
 		callout_reset(&xfer->ux_callout, mstohz(xfer->ux_timeout),
 			    ohci_timeout, xfer);
+	}
 	xfer->ux_status = USBD_IN_PROGRESS;
 	mutex_exit(&sc->sc_lock);
 	return USBD_IN_PROGRESS;
+}
 Static void
 ohci_device_bulk_abort(struct usbd_xfer *xfer)
+{
 	ohci_softc_t *sc __diagused = OHCI_XFER2SC(xfer);
 	OHCIHIST_FUNC(); OHCIHIST_CALLED();
 	KASSERT(mutex_owned(&sc->sc_lock));
 @@ -3221,26 +3260,27 @@ ohci_device_intr_start(struct usbd_xfer
 		ohci_dump_tds(sc, data);
+	}
 	DPRINTFN(5, "--- dump end ---", 0, 0, 0, 0);
 #endif
 	/* Insert ED in schedule */
 	usb_syncmem(&sed->dma, sed->offs, sizeof(sed->ed),
 	    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
 	sed->ed.ed_tailp = HTOO32(tail->physaddr);
 	sed->ed.ed_flags &= HTOO32(~OHCI_ED_SKIP);
 	usb_syncmem(&sed->dma, sed->offs, sizeof(sed->ed),
 	    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
 	xfer->ux_status = USBD_IN_PROGRESS;
 	mutex_exit(&sc->sc_lock);
 	return USBD_IN_PROGRESS;
+}
 /* Abort a device interrupt request. */
 Static void
 ohci_device_intr_abort(struct usbd_xfer *xfer)
+{
 	ohci_softc_t *sc __diagused = OHCI_XFER2SC(xfer);
 	KASSERT(mutex_owned(&sc->sc_lock));
 	KASSERT(xfer->ux_pipe->up_intrxfer == xfer);

 @@ -1,14 +1,14 @@
-/*	$NetBSD: uhci.c,v 1.264.2.3 2018/01/03 20:02:37 snj Exp $	*/
+/*	$NetBSD: uhci.c,v 1.264.2.4 2018/08/25 14:57:35 martin Exp $	*/
 /*
  * Copyright (c) 1998, 2004, 2011, 2012 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Lennart Augustsson (lennart@augustsson.net) at
  * Carlstedt Research & Technology, Jared D. McNeill (jmcneill@invisible.ca)
  * and Matthew R. Green (mrg@eterna.com.au).
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
 @@ -32,27 +32,27 @@
  */
 /*
  * USB Universal Host Controller driver.
  * Handles e.g. PIIX3 and PIIX4.
+ *
  * UHCI spec: http://www.intel.com/technology/usb/spec.htm
  * USB spec: http://www.usb.org/developers/docs/
  * PIIXn spec: ftp://download.intel.com/design/intarch/datashts/29055002.pdf
  *             ftp://download.intel.com/design/intarch/datashts/29056201.pdf
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uhci.c,v 1.264.2.3 2018/01/03 20:02:37 snj Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uhci.c,v 1.264.2.4 2018/08/25 14:57:35 martin Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
 #endif
 #include <sys/param.h>
 #include <sys/bus.h>
 #include <sys/cpu.h>
 #include <sys/device.h>
 #include <sys/kernel.h>
 #include <sys/kmem.h>
 #include <sys/mutex.h>
 @@ -564,28 +564,26 @@ uhci_init(uhci_softc_t *sc)
+	}
 	usb_syncmem(&sc->sc_dma, 0,
 	    UHCI_FRAMELIST_COUNT * sizeof(uhci_physaddr_t),
 	    BUS_DMASYNC_PREWRITE);
 	TAILQ_INIT(&sc->sc_intrhead);
 	sc->sc_xferpool = pool_cache_init(sizeof(struct uhci_xfer), 0, 0, 0,
 	    "uhcixfer", NULL, IPL_USB, NULL, NULL, NULL);
 	callout_init(&sc->sc_poll_handle, CALLOUT_MPSAFE);
 	cv_init(&sc->sc_softwake_cv, "uhciab");
 	/* Set up the bus struct. */
 	sc->sc_bus.ub_methods = &uhci_bus_methods;
 	sc->sc_bus.ub_pipesize = sizeof(struct uhci_pipe);
 	sc->sc_bus.ub_usedma = true;
 	UHCICMD(sc, UHCI_CMD_MAXP); /* Assume 64 byte packets at frame end */
 	DPRINTF("Enabling...", 0, 0, 0, 0);
 	err = uhci_run(sc, 1, 0);		/* and here we go... */
 	UWRITE2(sc, UHCI_INTR, UHCI_INTR_TOCRCIE | UHCI_INTR_RIE |
 		UHCI_INTR_IOCE | UHCI_INTR_SPIE);	/* enable interrupts */
 	return err;
 @@ -629,48 +627,49 @@ int
 uhci_detach(struct uhci_softc *sc, int flags)
+{
 	int rv = 0;
 	if (sc->sc_child != NULL)
 		rv = config_detach(sc->sc_child, flags);
 	if (rv != 0)
 		return rv;
 	callout_halt(&sc->sc_poll_handle, NULL);
 	callout_destroy(&sc->sc_poll_handle);
 	cv_destroy(&sc->sc_softwake_cv);
 	mutex_destroy(&sc->sc_lock);
 	mutex_destroy(&sc->sc_intr_lock);
 	pool_cache_destroy(sc->sc_xferpool);
 	/* XXX free other data structures XXX */
 	return rv;
+}
 struct usbd_xfer *
 uhci_allocx(struct usbd_bus *bus, unsigned int nframes)
+{
 	struct uhci_softc *sc = UHCI_BUS2SC(bus);
 	struct usbd_xfer *xfer;
 	xfer = pool_cache_get(sc->sc_xferpool, PR_WAITOK);
 	if (xfer != NULL) {
 		memset(xfer, 0, sizeof(struct uhci_xfer));
 		/* Initialise this always so we can call remove on it. */
 		usb_init_task(&xfer->ux_aborttask, uhci_timeout_task, xfer,
 		    USB_TASKQ_MPSAFE);
 #ifdef DIAGNOSTIC
 		struct uhci_xfer *uxfer = UHCI_XFER2UXFER(xfer);
 		uxfer->ux_isdone = true;
 		xfer->ux_state = XFER_BUSY;
 #endif
+	}
 	return xfer;
+}
 void
 uhci_freex(struct usbd_bus *bus, struct usbd_xfer *xfer)
+{
 	struct uhci_softc *sc = UHCI_BUS2SC(bus);
 @@ -1413,30 +1412,27 @@ uhci_softintr(void *v)
 		uhci_check_intr(sc, ux, &cq);
+	}
 	/*
 	 * We abuse ux_list for the interrupt and complete lists and
 	 * interrupt transfers will get re-added here so use
 	 * the _SAFE version of TAILQ_FOREACH.
 	 */
 	TAILQ_FOREACH_SAFE(ux, &cq, ux_list, nextux) {
 		DPRINTF("ux %p", ux, 0, 0, 0);
 		usb_transfer_complete(&ux->ux_xfer);
+	}
-	if (sc->sc_softwake) {
+	KASSERT(sc->sc_bus.ub_usepolling || mutex_owned(&sc->sc_lock));
 		sc->sc_softwake = 0;
 		cv_broadcast(&sc->sc_softwake_cv);
+}
 /* Check for an interrupt. */
 void
 uhci_check_intr(uhci_softc_t *sc, struct uhci_xfer *ux, ux_completeq_t *cqp)
+{
 	uhci_soft_td_t *std, *fstd = NULL, *lstd = NULL;
 	uint32_t status;
 	UHCIHIST_FUNC(); UHCIHIST_CALLED();
 	DPRINTFN(15, "ux %p", ux, 0, 0, 0);
 	KASSERT(ux != NULL);
 @@ -1472,28 +1468,26 @@ uhci_check_intr(uhci_softc_t *sc, struct
 	    lstd->offs + offsetof(uhci_td_t, td_status),
 	    sizeof(lstd->td.td_status),
 	    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
 	status = le32toh(lstd->td.td_status);
 	usb_syncmem(&lstd->dma,
 	    lstd->offs + offsetof(uhci_td_t, td_status),
 	    sizeof(lstd->td.td_status),
 	    BUS_DMASYNC_PREREAD);
 	/* If the last TD is not marked active we can complete */
 	if (!(status & UHCI_TD_ACTIVE)) {
  done:
 		DPRINTFN(12, "ux=%p done", ux, 0, 0, 0);
 		callout_stop(&xfer->ux_callout);
 		uhci_idone(ux, cqp);
 		return;
+	}
 	/*
 	 * If the last TD is still active we need to check whether there
 	 * is an error somewhere in the middle, or whether there was a
 	 * short packet (SPD and not ACTIVE).
 	 */
 	DPRINTFN(12, "active ux=%p", ux, 0, 0, 0);
 	for (std = fstd; std != lstd; std = std->link.std) {
 		usb_syncmem(&std->dma,
 		    std->offs + offsetof(uhci_td_t, td_status),
 @@ -1544,38 +1538,58 @@ uhci_check_intr(uhci_softc_t *sc, struct
 		if ((status & UHCI_TD_SPD) &&
 			UHCI_TD_GET_ACTLEN(status) <
 			UHCI_TD_GET_MAXLEN(le32toh(std->td.td_token))) {
 			goto done;
+		}
+	}
+}
 /* Called with USB lock held. */
 void
 uhci_idone(struct uhci_xfer *ux, ux_completeq_t *cqp)
+{
 	UHCIHIST_FUNC(); UHCIHIST_CALLED();
 	struct usbd_xfer *xfer = &ux->ux_xfer;
 	uhci_softc_t *sc __diagused = UHCI_XFER2SC(xfer);
 	struct uhci_pipe *upipe = UHCI_PIPE2UPIPE(xfer->ux_pipe);
 	uhci_soft_td_t *std;
 	uint32_t status = 0, nstatus;
 	int actlen;
 	KASSERT(sc->sc_bus.ub_usepolling || mutex_owned(&sc->sc_lock));
 	UHCIHIST_FUNC(); UHCIHIST_CALLED();
 	DPRINTFN(12, "ux=%p", ux, 0, 0, 0);
 	/*
 	 * If software has completed it, either by cancellation
 	 * or timeout, drop it on the floor.
 	 */
 	if (xfer->ux_status != USBD_IN_PROGRESS) {
 		KASSERT(xfer->ux_status == USBD_CANCELLED ||
 		    xfer->ux_status == USBD_TIMEOUT);
 		DPRINTF("aborted xfer=%#jx", (uintptr_t)xfer, 0, 0, 0);
 		return;
+	}
 	/*
 	 * Cancel the timeout and the task, which have not yet
 	 * run.  If they have already fired, at worst they are
 	 * waiting for the lock.  They will see that the xfer
 	 * is no longer in progress and give up.
 	 */
 	callout_stop(&xfer->ux_callout);
 	usb_rem_task(xfer->ux_pipe->up_dev, &xfer->ux_aborttask);
 #ifdef DIAGNOSTIC
 #ifdef UHCI_DEBUG
 	if (ux->ux_isdone) {
 		DPRINTF("--- dump start ---", 0, 0, 0, 0);
 		uhci_dump_ii(ux);
 		DPRINTF("--- dump end ---", 0, 0, 0, 0);
+	}
 #endif
 	KASSERT(!ux->ux_isdone);
 	KASSERTMSG(!ux->ux_isdone, "xfer %p type %d status %d", xfer,
 	    ux->ux_type, xfer->ux_status);
 	ux->ux_isdone = true;
 #endif
 @@ -1689,46 +1703,37 @@ uhci_idone(struct uhci_xfer *ux, ux_comp
 	if (cqp)
 		TAILQ_INSERT_TAIL(cqp, ux, ux_list);
 	KASSERT(sc->sc_bus.ub_usepolling || mutex_owned(&sc->sc_lock));
 	DPRINTFN(12, "ux=%p done", ux, 0, 0, 0);
+}
 /*
  * Called when a request does not complete.
  */
 void
 uhci_timeout(void *addr)
+{
 	UHCIHIST_FUNC(); UHCIHIST_CALLED();
 	struct usbd_xfer *xfer = addr;
 	struct uhci_xfer *uxfer = UHCI_XFER2UXFER(xfer);
 	uhci_softc_t *sc = UHCI_XFER2SC(xfer);
 	struct usbd_device *dev = xfer->ux_pipe->up_dev;
-	UHCIHIST_FUNC(); UHCIHIST_CALLED();
+	DPRINTF("xfer %p", xfer, 0, 0, 0);
 	DPRINTF("uxfer %p", uxfer, 0, 0, 0);
-	if (sc->sc_dying) {
+	mutex_enter(&sc->sc_lock);
-		mutex_enter(&sc->sc_lock);
+	if (!sc->sc_dying && xfer->ux_status == USBD_IN_PROGRESS)
-		uhci_abort_xfer(xfer, USBD_TIMEOUT);
+		usb_add_task(dev, &xfer->ux_aborttask, USB_TASKQ_HC);
-		mutex_exit(&sc->sc_lock);
+	mutex_exit(&sc->sc_lock);
 		return;
 	/* Execute the abort in a process context. */
 	usb_init_task(&uxfer->ux_aborttask, uhci_timeout_task, xfer,
 	    USB_TASKQ_MPSAFE);
 	usb_add_task(uxfer->ux_xfer.ux_pipe->up_dev, &uxfer->ux_aborttask,
 	    USB_TASKQ_HC);
+}
 void
 uhci_timeout_task(void *addr)
+{
 	struct usbd_xfer *xfer = addr;
 	uhci_softc_t *sc = UHCI_XFER2SC(xfer);
 	UHCIHIST_FUNC(); UHCIHIST_CALLED();
 	DPRINTF("xfer=%p", xfer, 0, 0, 0);
 	mutex_enter(&sc->sc_lock);
 @@ -2315,125 +2320,133 @@ uhci_device_bulk_start(struct usbd_xfer
 void
 uhci_device_bulk_abort(struct usbd_xfer *xfer)
+{
 	uhci_softc_t *sc __diagused = UHCI_XFER2SC(xfer);
 	KASSERT(mutex_owned(&sc->sc_lock));
 	UHCIHIST_FUNC(); UHCIHIST_CALLED();
 	uhci_abort_xfer(xfer, USBD_CANCELLED);
+}
 /*
- * Abort a device request.
+ * Cancel or timeout a device request.  We have two cases to deal with
  * If this routine is called at splusb() it guarantees that the request
- * will be removed from the hardware scheduling and that the callback
+ * 1) A driver wants to stop scheduled or inflight transfers
- * for it will be called with USBD_CANCELLED status.
+ * 2) A transfer has timed out
+ *
  * It's impossible to guarantee that the requested transfer will not
- * have happened since the hardware runs concurrently.
+ * have (partially) happened since the hardware runs concurrently.
  * If the transaction has already happened we rely on the ordinary
- * interrupt processing to process it.
+ * Transfer state is protected by the bus lock and we set the transfer status
- * XXX This is most probably wrong.
+ * as soon as either of the above happens (with bus lock held).
  * XXXMRG this doesn't make sense anymore.
  * To allow the hardware time to notice we simply wait.
  */
 void
 uhci_abort_xfer(struct usbd_xfer *xfer, usbd_status status)
+{
 	UHCIHIST_FUNC(); UHCIHIST_CALLED();
 	struct uhci_xfer *ux = UHCI_XFER2UXFER(xfer);
 	struct uhci_pipe *upipe = UHCI_PIPE2UPIPE(xfer->ux_pipe);
 	uhci_softc_t *sc = UHCI_XFER2SC(xfer);
 	uhci_soft_td_t *std;
 	int wake;
-	UHCIHIST_FUNC(); UHCIHIST_CALLED();
+	KASSERTMSG((status == USBD_CANCELLED || status == USBD_TIMEOUT),
 	    "invalid status for abort: %d", (int)status);
 	DPRINTFN(1,"xfer=%p, status=%d", xfer, status, 0, 0);
 	KASSERT(mutex_owned(&sc->sc_lock));
 	ASSERT_SLEEPABLE();
-	if (sc->sc_dying) {
+	if (status == USBD_CANCELLED) {
-		/* If we're dying, just do the software part. */
+		/*
-		xfer->ux_status = status;	/* make software ignore it */
+		 * We are synchronously aborting.  Try to stop the
-		callout_stop(&xfer->ux_callout);
+		 * callout and task, but if we can't, wait for them to
-		usb_transfer_complete(xfer);
+		 * complete.
-		return;
+		 */
 		callout_halt(&xfer->ux_callout, &sc->sc_lock);
 		usb_rem_task_wait(xfer->ux_pipe->up_dev, &xfer->ux_aborttask,
 		    USB_TASKQ_HC, &sc->sc_lock);
 	} else {
 		/* Otherwise, we are timing out.  */
 		KASSERT(status == USBD_TIMEOUT);
+	}
 	/*
-	 * If an abort is already in progress then just wait for it to
+	 * The xfer cannot have been cancelled already.  It is the
-	 * complete and return.
+	 * responsibility of the caller of usbd_abort_pipe not to try
 	 * to abort a pipe multiple times, whether concurrently or
 	 * sequentially.
 	 */
-	if (xfer->ux_hcflags & UXFER_ABORTING) {
+	KASSERT(xfer->ux_status != USBD_CANCELLED);
 		DPRINTFN(2, "already aborting", 0, 0, 0, 0);
-#ifdef DIAGNOSTIC
+	/* Only the timeout, which runs only once, can time it out.  */
-		if (status == USBD_TIMEOUT)
+	KASSERT(xfer->ux_status != USBD_TIMEOUT);
 			printf("%s: TIMEOUT while aborting\n", __func__);
-#endif
+	/* If anyone else beat us, we're done.  */
-		/* Override the status which might be USBD_TIMEOUT. */
+	if (xfer->ux_status != USBD_IN_PROGRESS)
-		xfer->ux_status = status;
+		return;
 		DPRINTFN(2, "waiting for abort to finish", 0, 0, 0, 0);
-		xfer->ux_hcflags |= UXFER_ABORTWAIT;
+	/* We beat everyone else.  Claim the status.  */
-		while (xfer->ux_hcflags & UXFER_ABORTING)
+	xfer->ux_status = status;
 			cv_wait(&xfer->ux_hccv, &sc->sc_lock);
-		goto done;
+	/*
 	 * If we're dying, skip the hardware action and just notify the
 	 * software that we're done.
 	 */
 	if (sc->sc_dying) {
 		DPRINTFN(4, "xfer %#jx dying %ju", (uintptr_t)xfer,
 		    xfer->ux_status, 0, 0);
 		goto dying;
+	}
 	xfer->ux_hcflags |= UXFER_ABORTING;
 	/*
-	 * Step 1: Make interrupt routine and hardware ignore xfer.
+	 * HC Step 1: Make interrupt routine and hardware ignore xfer.
 	 */
 	xfer->ux_status = status;	/* make software ignore it */
 	callout_stop(&xfer->ux_callout);
 	uhci_del_intr_list(sc, ux);
 	DPRINTF("stop ux=%p", ux, 0, 0, 0);
 	for (std = ux->ux_stdstart; std != NULL; std = std->link.std) {
 		usb_syncmem(&std->dma,
 		    std->offs + offsetof(uhci_td_t, td_status),
 		    sizeof(std->td.td_status),
 		    BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_POSTREAD);
 		std->td.td_status &= htole32(~(UHCI_TD_ACTIVE | UHCI_TD_IOC));
 		usb_syncmem(&std->dma,
 		    std->offs + offsetof(uhci_td_t, td_status),
 		    sizeof(std->td.td_status),
 		    BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD);
+	}
 	/*
-	 * Step 2: Wait until we know hardware has finished any possible
+	 * HC Step 2: Wait until we know hardware has finished any possible
-	 * use of the xfer.  Also make sure the soft interrupt routine
+	 * use of the xfer.
 	 * has run.
 	 */
 	/* Hardware finishes in 1ms */
 	usb_delay_ms_locked(upipe->pipe.up_dev->ud_bus, 2, &sc->sc_lock);
 	sc->sc_softwake = 1;
 	usb_schedsoftintr(&sc->sc_bus);
 	DPRINTF("cv_wait", 0, 0, 0, 0);
 	cv_wait(&sc->sc_softwake_cv, &sc->sc_lock);
 	/*
-	 * Step 3: Execute callback.
+	 * HC Step 3: Notify completion to waiting xfers.
 	 */
-	DPRINTF("callback", 0, 0, 0, 0);
+dying:
 #ifdef DIAGNOSTIC
 	ux->ux_isdone = true;
 #endif
 	wake = xfer->ux_hcflags & UXFER_ABORTWAIT;
 	xfer->ux_hcflags &= ~(UXFER_ABORTING | UXFER_ABORTWAIT);
 	usb_transfer_complete(xfer);
-	if (wake)
+	DPRINTFN(14, "end", 0, 0, 0, 0);
 		cv_broadcast(&xfer->ux_hccv);
 done:
 	KASSERT(mutex_owned(&sc->sc_lock));
+}
 /* Close a device bulk pipe. */
 void
 uhci_device_bulk_close(struct usbd_pipe *pipe)
+{
 	struct uhci_pipe *upipe = UHCI_PIPE2UPIPE(pipe);
 	uhci_softc_t *sc = UHCI_PIPE2SC(pipe);
 	KASSERT(mutex_owned(&sc->sc_lock));
 	uhci_free_sqh(sc, upipe->bulk.sqh);

 @@ -1,14 +1,14 @@
-/*	$NetBSD: usbdi.c,v 1.161.2.2 2017/04/05 19:54:21 snj Exp $	*/
+/*	$NetBSD: usbdi.c,v 1.161.2.3 2018/08/25 14:57:35 martin Exp $	*/
 /*
  * Copyright (c) 1998, 2012, 2015 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Lennart Augustsson (lennart@augustsson.net) at
  * Carlstedt Research & Technology, Matthew R. Green (mrg@eterna.com.au),
  * and Nick Hudson.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
 @@ -22,27 +22,27 @@
  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: usbdi.c,v 1.161.2.2 2017/04/05 19:54:21 snj Exp $");
+__KERNEL_RCSID(0, "$NetBSD: usbdi.c,v 1.161.2.3 2018/08/25 14:57:35 martin Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
 #include "opt_compat_netbsd.h"
 #include "usb_dma.h"
 #endif
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/device.h>
 #include <sys/kmem.h>
 #include <sys/proc.h>
 @@ -269,26 +269,27 @@ usbd_close_pipe(struct usbd_pipe *pipe)
 usbd_status
 usbd_transfer(struct usbd_xfer *xfer)
+{
 	struct usbd_pipe *pipe = xfer->ux_pipe;
 	usbd_status err;
 	unsigned int size, flags;
 	USBHIST_FUNC(); USBHIST_CALLED(usbdebug);
 	USBHIST_LOG(usbdebug,
 	    "xfer = %p, flags = %#x, pipe = %p, running = %d",
 	    xfer, xfer->ux_flags, pipe, pipe->up_running);
 	KASSERT(xfer->ux_status == USBD_NOT_STARTED);
 #ifdef USB_DEBUG
 	if (usbdebug > 5)
 		usbd_dump_queue(pipe);
 #endif
 	xfer->ux_done = 0;
 	if (pipe->up_aborting) {
 		USBHIST_LOG(usbdebug, "<- done xfer %p, aborting", xfer, 0, 0,
 );
 		return USBD_CANCELLED;
+	}
 @@ -333,27 +334,27 @@ usbd_transfer(struct usbd_xfer *xfer)
 		SIMPLEQ_REMOVE_HEAD(&pipe->up_queue, ux_next);
 		if (pipe->up_serialise)
 			usbd_start_next(pipe);
 		usbd_unlock_pipe(pipe);
+	}
 	if (!(flags & USBD_SYNCHRONOUS)) {
 		USBHIST_LOG(usbdebug, "<- done xfer %p, not sync (err %d)",
 		    xfer, err, 0, 0);
 		return err;
+	}
 	if (err != USBD_IN_PROGRESS) {
-		USBHIST_LOG(usbdebug, "<- done xfer %p, err %d (complete/error)", xfer,
+		USBHIST_LOG(usbdebug, "<- done xfer %p, sync err %d (complete/error)", xfer,
 		    err, 0, 0);
 		return err;
+	}
 	/* Sync transfer, wait for completion. */
 	usbd_lock_pipe(pipe);
 	while (!xfer->ux_done) {
 		if (pipe->up_dev->ud_bus->ub_usepolling)
 			panic("usbd_transfer: not done");
 		USBHIST_LOG(usbdebug, "<- sleeping on xfer %p", xfer, 0, 0, 0);
 		err = 0;
 		if ((flags & USBD_SYNCHRONOUS_SIG) != 0) {
 @@ -465,50 +466,48 @@ usbd_alloc_xfer(struct usbd_device *dev,
+{
 	struct usbd_xfer *xfer;
 	USBHIST_FUNC(); USBHIST_CALLED(usbdebug);
 	ASSERT_SLEEPABLE();
 	xfer = dev->ud_bus->ub_methods->ubm_allocx(dev->ud_bus, nframes);
 	if (xfer == NULL)
 		return NULL;
 	xfer->ux_bus = dev->ud_bus;
 	callout_init(&xfer->ux_callout, CALLOUT_MPSAFE);
 	cv_init(&xfer->ux_cv, "usbxfer");
 	cv_init(&xfer->ux_hccv, "usbhcxfer");
 	USBHIST_LOG(usbdebug, "returns %p", xfer, 0, 0, 0);
 	return xfer;
+}
 static usbd_status
 usbd_free_xfer(struct usbd_xfer *xfer)
+{
 	USBHIST_FUNC(); USBHIST_CALLED(usbdebug);
 	USBHIST_LOG(usbdebug, "%p", xfer, 0, 0, 0);
 	if (xfer->ux_buf) {
 		usbd_free_buffer(xfer);
+	}
 #if defined(DIAGNOSTIC)
 	if (callout_pending(&xfer->ux_callout)) {
 		callout_stop(&xfer->ux_callout);
 		printf("usbd_free_xfer: timeout_handle pending\n");
+	}
 #endif
 	cv_destroy(&xfer->ux_cv);
 	cv_destroy(&xfer->ux_hccv);
 	xfer->ux_bus->ub_methods->ubm_freex(xfer->ux_bus, xfer);
 	return USBD_NORMAL_COMPLETION;
+}
 int
 usbd_create_xfer(struct usbd_pipe *pipe, size_t len, unsigned int flags,
     unsigned int nframes, struct usbd_xfer **xp)
+{
 	KASSERT(xp != NULL);
 	void *buf = NULL;
 	struct usbd_xfer *xfer = usbd_alloc_xfer(pipe->up_dev, nframes);
 	if (xfer == NULL)
 @@ -897,27 +896,28 @@ usb_transfer_complete(struct usbd_xfer *
 	int sync = xfer->ux_flags & USBD_SYNCHRONOUS;
 	int erred =
 	    xfer->ux_status == USBD_CANCELLED ||
 	    xfer->ux_status == USBD_TIMEOUT;
 	int polling = bus->ub_usepolling;
 	int repeat = pipe->up_repeat;
 	USBHIST_FUNC(); USBHIST_CALLED(usbdebug);
 	USBHIST_LOG(usbdebug, "pipe = %p xfer = %p status = %d actlen = %d",
 		pipe, xfer, xfer->ux_status, xfer->ux_actlen);
 	KASSERT(polling || mutex_owned(pipe->up_dev->ud_bus->ub_lock));
-	KASSERT(xfer->ux_state == XFER_ONQU);
+	KASSERTMSG(xfer->ux_state == XFER_ONQU, "xfer %p state is %x", xfer,
 	    xfer->ux_state);
 	KASSERT(pipe != NULL);
 	if (!repeat) {
 		/* Remove request from queue. */
 		KASSERTMSG(!SIMPLEQ_EMPTY(&pipe->up_queue),
 		    "pipe %p is empty, but xfer %p wants to complete", pipe,
 		     xfer);
 		KASSERTMSG(xfer == SIMPLEQ_FIRST(&pipe->up_queue),
 		    "xfer %p is not start of queue (%p is at start)", xfer,
 		   SIMPLEQ_FIRST(&pipe->up_queue));
 #ifdef DIAGNOSTIC

 @@ -1,14 +1,14 @@
-/*	$NetBSD: xhci.c,v 1.23.2.7 2018/01/03 20:02:37 snj Exp $	*/
+/*	$NetBSD: xhci.c,v 1.23.2.8 2018/08/25 14:57:35 martin Exp $	*/
 /*
  * Copyright (c) 2013 Jonathan A. Kollasch
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
 @@ -24,27 +24,27 @@
  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 /*
  * USB rev 2.0 and rev 3.1 specification
  *  http://www.usb.org/developers/docs/
  * xHCI rev 1.1 specification
  *  http://www.intel.com/technology/usb/spec.htm
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xhci.c,v 1.23.2.7 2018/01/03 20:02:37 snj Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xhci.c,v 1.23.2.8 2018/08/25 14:57:35 martin Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
 #endif
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/kmem.h>
 #include <sys/device.h>
 #include <sys/select.h>
 #include <sys/proc.h>
 #include <sys/queue.h>
 @@ -1650,105 +1650,111 @@ xhci_close_pipe(struct usbd_pipe *pipe)
 	    XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_CONFIGURE_EP);
 	(void)xhci_do_command_locked(sc, &trb, USBD_DEFAULT_TIMEOUT);
 	usb_syncmem(&xs->xs_dc_dma, 0, sc->sc_pgsz, BUS_DMASYNC_POSTREAD);
+}
 /*
  * Abort transfer.
  * Should be called with sc_lock held.
  */
 static void
 xhci_abort_xfer(struct usbd_xfer *xfer, usbd_status status)
+{
 	XHCIHIST_FUNC(); XHCIHIST_CALLED();
 	struct xhci_softc * const sc = XHCI_XFER2SC(xfer);
 	struct xhci_slot * const xs = xfer->ux_pipe->up_dev->ud_hcpriv;
 	const u_int dci = xhci_ep_get_dci(xfer->ux_pipe->up_endpoint->ue_edesc);
-	XHCIHIST_FUNC(); XHCIHIST_CALLED();
+	KASSERTMSG((status == USBD_CANCELLED || status == USBD_TIMEOUT),
 	    "invalid status for abort: %d", (int)status);
 	DPRINTFN(4, "xfer %p pipe %p status %d",
 	    xfer, xfer->ux_pipe, status, 0);
 	KASSERT(mutex_owned(&sc->sc_lock));
 	ASSERT_SLEEPABLE();
-	if (sc->sc_dying) {
+	if (status == USBD_CANCELLED) {
-		/* If we're dying, just do the software part. */
+		/*
-		DPRINTFN(4, "xfer %p dying %u", xfer, xfer->ux_status, 0, 0);
+		 * We are synchronously aborting.  Try to stop the
-		xfer->ux_status = status;
+		 * callout and task, but if we can't, wait for them to
-		callout_stop(&xfer->ux_callout);
+		 * complete.
-		usb_transfer_complete(xfer);
+		 */
-		return;
+		callout_halt(&xfer->ux_callout, &sc->sc_lock);
 		usb_rem_task_wait(xfer->ux_pipe->up_dev, &xfer->ux_aborttask,
 		    USB_TASKQ_HC, &sc->sc_lock);
 	} else {
 		/* Otherwise, we are timing out.  */
 		KASSERT(status == USBD_TIMEOUT);
+	}
 	/*
-	 * If an abort is already in progress then just wait for it to
+	 * The xfer cannot have been cancelled already.  It is the
-	 * complete and return.
+	 * responsibility of the caller of usbd_abort_pipe not to try
 	 * to abort a pipe multiple times, whether concurrently or
 	 * sequentially.
 	 */
-	if (xfer->ux_hcflags & UXFER_ABORTING) {
+	KASSERT(xfer->ux_status != USBD_CANCELLED);
 		DPRINTFN(4, "already aborting", 0, 0, 0, 0);
-#ifdef DIAGNOSTIC
+	/* Only the timeout, which runs only once, can time it out.  */
-		if (status == USBD_TIMEOUT)
+	KASSERT(xfer->ux_status != USBD_TIMEOUT);
 			DPRINTFN(4, "TIMEOUT while aborting", 0, 0, 0, 0);
-#endif
+	/* If anyone else beat us, we're done.  */
-		/* Override the status which might be USBD_TIMEOUT. */
+	if (xfer->ux_status != USBD_IN_PROGRESS)
-		xfer->ux_status = status;
+ 		return;
 		DPRINTFN(4, "xfer %p waiting for abort to finish", xfer, 0, 0,
-);
+	/* We beat everyone else.  Claim the status.  */
-		xfer->ux_hcflags |= UXFER_ABORTWAIT;
+	xfer->ux_status = status;
 		while (xfer->ux_hcflags & UXFER_ABORTING)
 			cv_wait(&xfer->ux_hccv, &sc->sc_lock);
 		return;
 	xfer->ux_hcflags |= UXFER_ABORTING;
 	/*
-	 * Step 1: Stop xfer timeout timer.
+	 * If we're dying, skip the hardware action and just notify the
 	 * software that we're done.
 	 */
-	xfer->ux_status = status;
+	if (sc->sc_dying) {
-	callout_stop(&xfer->ux_callout);
+		DPRINTFN(4, "xfer %#jx dying %ju", (uintptr_t)xfer,
 		    xfer->ux_status, 0, 0);
 		goto dying;
+	}
 	/*
-	 * Step 2: Stop execution of TD on the ring.
+	 * HC Step 1: Stop execution of TD on the ring.
 	 */
 	switch (xhci_get_epstate(sc, xs, dci)) {
 	case XHCI_EPSTATE_HALTED:
 		(void)xhci_reset_endpoint_locked(xfer->ux_pipe);
 		break;
 	case XHCI_EPSTATE_STOPPED:
 		break;
 	default:
 		(void)xhci_stop_endpoint(xfer->ux_pipe);
 		break;
+	}
 #ifdef DIAGNOSTIC
 	uint32_t epst = xhci_get_epstate(sc, xs, dci);
 	if (epst != XHCI_EPSTATE_STOPPED)
 		DPRINTFN(4, "dci %u not stopped %u", dci, epst, 0, 0);
 #endif
 	/*
-	 * Step 3: Remove any vestiges of the xfer from the ring.
+	 * HC Step 2: Remove any vestiges of the xfer from the ring.
 	 */
 	xhci_set_dequeue_locked(xfer->ux_pipe);
 	/*
-	 * Step 4: Notify completion to waiting xfers.
+	 * Final Step: Notify completion to waiting xfers.
 	 */
-	int wake = xfer->ux_hcflags & UXFER_ABORTWAIT;
+dying:
 	xfer->ux_hcflags &= ~(UXFER_ABORTING | UXFER_ABORTWAIT);
 	usb_transfer_complete(xfer);
 	if (wake) {
 		cv_broadcast(&xfer->ux_hccv);
 	DPRINTFN(14, "end", 0, 0, 0, 0);
 	KASSERT(mutex_owned(&sc->sc_lock));
+}
 static void
 xhci_host_dequeue(struct xhci_ring * const xr)
+{
 	/* When dequeueing the controller, update our struct copy too */
 	memset(xr->xr_trb, 0, xr->xr_ntrb * XHCI_TRB_SIZE);
 	usb_syncmem(&xr->xr_dma, 0, xr->xr_ntrb * XHCI_TRB_SIZE,
 	    BUS_DMASYNC_PREWRITE);
 	memset(xr->xr_cookies, 0, xr->xr_ntrb * sizeof(*xr->xr_cookies));
 @@ -1957,68 +1963,96 @@ xhci_event_transfer(struct xhci_softc *
+			}
 		} else if ((trb_0 & 0x3) == 0x3) {
 			return;
+		}
 		err = USBD_NORMAL_COMPLETION;
 		break;
 	case XHCI_TRB_ERROR_STOPPED:
 	case XHCI_TRB_ERROR_LENGTH:
 	case XHCI_TRB_ERROR_STOPPED_SHORT:
 		/*
 		 * don't complete the transfer being aborted
 		 * as abort_xfer does instead.
 		 */
-		if (xfer->ux_hcflags & UXFER_ABORTING) {
+		if (xfer->ux_status == USBD_CANCELLED ||
 		    xfer->ux_status == USBD_TIMEOUT) {
 			DPRINTFN(14, "ignore aborting xfer %p", xfer, 0, 0, 0);
 			return;
+		}
 		err = USBD_CANCELLED;
 		break;
 	case XHCI_TRB_ERROR_STALL:
 	case XHCI_TRB_ERROR_BABBLE:
 		DPRINTFN(1, "ERR %u slot %u dci %u", trbcode, slot, dci, 0);
 		xr->is_halted = true;
 		err = USBD_STALLED;
 		/*
 		 * Stalled endpoints can be recoverd by issuing
 		 * command TRB TYPE_RESET_EP on xHCI instead of
 		 * issuing request CLEAR_FEATURE UF_ENDPOINT_HALT
 		 * on the endpoint. However, this function may be
 		 * called from softint context (e.g. from umass),
 		 * in that case driver gets KASSERT in cv_timedwait
 		 * in xhci_do_command.
 		 * To avoid this, this runs reset_endpoint and
 		 * usb_transfer_complete in usb task thread
 		 * asynchronously (and then umass issues clear
 		 * UF_ENDPOINT_HALT).
 		 */
 		xfer->ux_status = err;
 		/* Override the status.  */
 		xfer->ux_status = USBD_STALLED;
 		/*
 		 * Cancel the timeout and the task, which have not yet
 		 * run.  If they have already fired, at worst they are
 		 * waiting for the lock.  They will see that the xfer
 		 * is no longer in progress and give up.
 		 */
 		callout_stop(&xfer->ux_callout);
 		usb_rem_task(xfer->ux_pipe->up_dev, &xfer->ux_aborttask);
 		xhci_clear_endpoint_stall_async(xfer);
 		return;
 	default:
 		DPRINTFN(1, "ERR %u slot %u dci %u", trbcode, slot, dci, 0);
 		err = USBD_IOERROR;
 		break;
+	}
 	/*
 	 * If software has completed it, either by cancellation
 	 * or timeout, drop it on the floor.
 	 */
 	if (xfer->ux_status != USBD_IN_PROGRESS) {
 		KASSERTMSG((xfer->ux_status == USBD_CANCELLED ||
 		            xfer->ux_status == USBD_TIMEOUT),
 			   "xfer %p status %x", xfer, xfer->ux_status);
 		return;;
+	}
 	/* Otherwise, set the status.  */
 	xfer->ux_status = err;
-	if ((trb_3 & XHCI_TRB_3_ED_BIT) != 0) {
+	/*
-		if ((trb_0 & 0x3) == 0x0) {
+	 * Cancel the timeout and the task, which have not yet
-			callout_stop(&xfer->ux_callout);
+	 * run.  If they have already fired, at worst they are
-			usb_transfer_complete(xfer);
+	 * waiting for the lock.  They will see that the xfer
 	 * is no longer in progress and give up.
-	} else {
+	 */
-		callout_stop(&xfer->ux_callout);
+	callout_stop(&xfer->ux_callout);
 	usb_rem_task(xfer->ux_pipe->up_dev, &xfer->ux_aborttask);
 	if ((trb_3 & XHCI_TRB_3_ED_BIT) == 0 ||
 	    (trb_0 & 0x3) == 0x0) {
 		usb_transfer_complete(xfer);
+	}
+}
 /* Process Command complete events */
 static void
 xhci_event_cmd(struct xhci_softc * const sc, const struct xhci_trb * const trb)
+{
 	uint64_t trb_0;
 	uint32_t trb_2, trb_3;
 	XHCIHIST_FUNC(); XHCIHIST_CALLED();
 @@ -2161,26 +2195,28 @@ xhci_poll(struct usbd_bus *bus)
+}
 static struct usbd_xfer *
 xhci_allocx(struct usbd_bus *bus, unsigned int nframes)
+{
 	struct xhci_softc * const sc = XHCI_BUS2SC(bus);
 	struct usbd_xfer *xfer;
 	XHCIHIST_FUNC(); XHCIHIST_CALLED();
 	xfer = pool_cache_get(sc->sc_xferpool, PR_WAITOK);
 	if (xfer != NULL) {
 		memset(xfer, 0, sizeof(struct xhci_xfer));
 		usb_init_task(&xfer->ux_aborttask, xhci_timeout_task, xfer,
 		    USB_TASKQ_MPSAFE);
 #ifdef DIAGNOSTIC
 		xfer->ux_state = XFER_BUSY;
 #endif
+	}
 	return xfer;
+}
 static void
 xhci_freex(struct usbd_bus *bus, struct usbd_xfer *xfer)
+{
 	struct xhci_softc * const sc = XHCI_BUS2SC(bus);
 @@ -3762,26 +3798,27 @@ xhci_device_ctrl_start(struct usbd_xfer
 		    XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_DATA_STAGE) |
 		    (usbd_xfer_isread(xfer) ? XHCI_TRB_3_ISP_BIT : 0) |
 		    XHCI_TRB_3_IOC_BIT;
 		xhci_trb_put(&xx->xx_trb[i++], parameter, status, control);
+	}
 	parameter = 0;
 	status = XHCI_TRB_2_IRQ_SET(0);
 	/* the status stage has inverted direction */
 	control = ((isread && (len > 0)) ? 0 : XHCI_TRB_3_DIR_IN) |
 	    XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_STATUS_STAGE) |
 	    XHCI_TRB_3_IOC_BIT;
 	xhci_trb_put(&xx->xx_trb[i++], parameter, status, control);
 	xfer->ux_status = USBD_IN_PROGRESS;
 	mutex_enter(&tr->xr_lock);
 	xhci_ring_put(sc, tr, xfer, xx->xx_trb, i);
 	mutex_exit(&tr->xr_lock);
 	xhci_db_write_4(sc, XHCI_DOORBELL(xs->xs_idx), dci);
 	if (xfer->ux_timeout && !sc->sc_bus.ub_usepolling) {
 		callout_reset(&xfer->ux_callout, mstohz(xfer->ux_timeout),
 		    xhci_timeout, xfer);
+	}
 	return USBD_IN_PROGRESS;
 @@ -3878,26 +3915,27 @@ xhci_device_bulk_start(struct usbd_xfer
 	 * blocks needed to complete the transfer.
 	 * Setting it to 1 in the last TRB causes an extra zero-length
 	 * data block be sent.
 	 * The earlier documentation differs, I don't know how it behaves.
 	 */
 	KASSERTMSG(len <= 0x10000, "len %d", len);
 	status = XHCI_TRB_2_IRQ_SET(0) |
 	    XHCI_TRB_2_TDSZ_SET(1) |
 	    XHCI_TRB_2_BYTES_SET(len);
 	control = XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_NORMAL) |
 	    (usbd_xfer_isread(xfer) ? XHCI_TRB_3_ISP_BIT : 0) |
 	    XHCI_TRB_3_IOC_BIT;
 	xhci_trb_put(&xx->xx_trb[i++], parameter, status, control);
 	xfer->ux_status = USBD_IN_PROGRESS;
 	mutex_enter(&tr->xr_lock);
 	xhci_ring_put(sc, tr, xfer, xx->xx_trb, i);
 	mutex_exit(&tr->xr_lock);
 	xhci_db_write_4(sc, XHCI_DOORBELL(xs->xs_idx), dci);
 	if (xfer->ux_timeout && !sc->sc_bus.ub_usepolling) {
 		callout_reset(&xfer->ux_callout, mstohz(xfer->ux_timeout),
 		    xhci_timeout, xfer);
+	}
 	return USBD_IN_PROGRESS;
 @@ -3984,26 +4022,27 @@ xhci_device_intr_start(struct usbd_xfer
 		return USBD_IOERROR;
 	KASSERT((xfer->ux_rqflags & URQ_REQUEST) == 0);
 	parameter = DMAADDR(dma, 0);
 	KASSERTMSG(len <= 0x10000, "len %d", len);
 	status = XHCI_TRB_2_IRQ_SET(0) |
 	    XHCI_TRB_2_TDSZ_SET(1) |
 	    XHCI_TRB_2_BYTES_SET(len);
 	control = XHCI_TRB_3_TYPE_SET(XHCI_TRB_TYPE_NORMAL) |
 	    (usbd_xfer_isread(xfer) ? XHCI_TRB_3_ISP_BIT : 0) |
 	    XHCI_TRB_3_IOC_BIT;
 	xhci_trb_put(&xx->xx_trb[i++], parameter, status, control);
 	xfer->ux_status = USBD_IN_PROGRESS;
 	mutex_enter(&tr->xr_lock);
 	xhci_ring_put(sc, tr, xfer, xx->xx_trb, i);
 	mutex_exit(&tr->xr_lock);
 	xhci_db_write_4(sc, XHCI_DOORBELL(xs->xs_idx), dci);
 	if (xfer->ux_timeout && !sc->sc_bus.ub_usepolling) {
 		callout_reset(&xfer->ux_callout, mstohz(xfer->ux_timeout),
 		    xhci_timeout, xfer);
+	}
 	return USBD_IN_PROGRESS;
 @@ -4048,41 +4087,36 @@ xhci_device_intr_close(struct usbd_pipe
 	//struct xhci_softc * const sc = XHCI_PIPE2SC(pipe);
 	XHCIHIST_FUNC(); XHCIHIST_CALLED();
 	DPRINTFN(15, "%p", pipe, 0, 0, 0);
 	xhci_close_pipe(pipe);
+}
 /* ------------ */
 static void
 xhci_timeout(void *addr)
+{
 	XHCIHIST_FUNC(); XHCIHIST_CALLED();
 	struct xhci_xfer * const xx = addr;
 	struct usbd_xfer * const xfer = &xx->xx_xfer;
 	struct xhci_softc * const sc = XHCI_XFER2SC(xfer);
 	struct usbd_device *dev = xfer->ux_pipe->up_dev;
-	XHCIHIST_FUNC(); XHCIHIST_CALLED();
+	mutex_enter(&sc->sc_lock);
 	if (!sc->sc_dying && xfer->ux_status == USBD_IN_PROGRESS)
-	if (sc->sc_dying) {
+		usb_add_task(dev, &xfer->ux_aborttask, USB_TASKQ_HC);
-		return;
+	mutex_exit(&sc->sc_lock);
 	usb_init_task(&xx->xx_abort_task, xhci_timeout_task, addr,
 	    USB_TASKQ_MPSAFE);
 	usb_add_task(xx->xx_xfer.ux_pipe->up_dev, &xx->xx_abort_task,
 	    USB_TASKQ_HC);
+}
 static void
 xhci_timeout_task(void *addr)
+{
 	XHCIHIST_FUNC(); XHCIHIST_CALLED();
 	struct usbd_xfer * const xfer = addr;
 	struct xhci_softc * const sc = XHCI_XFER2SC(xfer);
 	XHCIHIST_FUNC(); XHCIHIST_CALLED();
 	mutex_enter(&sc->sc_lock);
 	xhci_abort_xfer(xfer, USBD_TIMEOUT);
 	mutex_exit(&sc->sc_lock);
+}

 @@ -1,14 +1,14 @@
-/*	$NetBSD: dwc2.c,v 1.31.2.3 2018/01/03 20:02:37 snj Exp $	*/
+/*	$NetBSD: dwc2.c,v 1.31.2.4 2018/08/25 14:57:35 martin Exp $	*/
 /*-
  * Copyright (c) 2013 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Nick Hudson
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
 @@ -20,27 +20,27 @@
  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: dwc2.c,v 1.31.2.3 2018/01/03 20:02:37 snj Exp $");
+__KERNEL_RCSID(0, "$NetBSD: dwc2.c,v 1.31.2.4 2018/08/25 14:57:35 martin Exp $");
 #include "opt_usb.h"
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kmem.h>
 #include <sys/kernel.h>
 #include <sys/device.h>
 #include <sys/select.h>
 #include <sys/proc.h>
 #include <sys/queue.h>
 #include <sys/cpu.h>
 @@ -193,37 +193,42 @@ Static const struct usbd_pipe_methods dw
 Static const struct usbd_pipe_methods dwc2_device_isoc_methods = {
 	.upm_transfer =	dwc2_device_isoc_transfer,
 	.upm_abort =	dwc2_device_isoc_abort,
 	.upm_close =	dwc2_device_isoc_close,
 	.upm_cleartoggle =	dwc2_noop,
 	.upm_done =	dwc2_device_isoc_done,
 };
 struct usbd_xfer *
 dwc2_allocx(struct usbd_bus *bus, unsigned int nframes)
+{
 	struct dwc2_softc *sc = DWC2_BUS2SC(bus);
 	struct dwc2_xfer *dxfer;
 	struct usbd_xfer *xfer;
 	DPRINTFN(10, "\n");
 	DWC2_EVCNT_INCR(sc->sc_ev_xferpoolget);
 	dxfer = pool_cache_get(sc->sc_xferpool, PR_WAITOK);
 	xfer = (struct usbd_xfer *)dxfer;
 	if (dxfer != NULL) {
 		memset(dxfer, 0, sizeof(*dxfer));
 		dxfer->urb = dwc2_hcd_urb_alloc(sc->sc_hsotg,
 		    nframes, GFP_KERNEL);
 		/* Initialise this always so we can call remove on it. */
 		usb_init_task(&xfer->ux_aborttask, dwc2_timeout_task, xfer,
 		    USB_TASKQ_MPSAFE);
 #ifdef DIAGNOSTIC
 		dxfer->xfer.ux_state = XFER_BUSY;
 #endif
+	}
 	return (struct usbd_xfer *)dxfer;
+}
 void
 dwc2_freex(struct usbd_bus *bus, struct usbd_xfer *xfer)
+{
 	struct dwc2_xfer *dxfer = DWC2_XFER2DXFER(xfer);
 	struct dwc2_softc *sc = DWC2_BUS2SC(bus);
 @@ -288,62 +293,53 @@ dwc2_softintr(void *v)
 	KASSERT(sc->sc_bus.ub_usepolling || mutex_owned(&sc->sc_lock));
 	mutex_spin_enter(&hsotg->lock);
 	while ((dxfer = TAILQ_FIRST(&sc->sc_complete)) != NULL) {
 		KASSERTMSG(!callout_pending(&dxfer->xfer.ux_callout),
 		    "xfer %p pipe %p\n", dxfer, dxfer->xfer.ux_pipe);
 		/*
 		 * dwc2_abort_xfer will remove this transfer from the
 		 * sc_complete queue
 		 */
 		/*XXXNH not tested */
-		if (dxfer->xfer.ux_hcflags & UXFER_ABORTING) {
+		if (dxfer->xfer.ux_status == USBD_CANCELLED ||
-			cv_broadcast(&dxfer->xfer.ux_hccv);
+		    dxfer->xfer.ux_status == USBD_TIMEOUT) {
 			continue;
+		}
 		TAILQ_REMOVE(&sc->sc_complete, dxfer, xnext);
 		mutex_spin_exit(&hsotg->lock);
 		usb_transfer_complete(&dxfer->xfer);
 		mutex_spin_enter(&hsotg->lock);
+	}
 	mutex_spin_exit(&hsotg->lock);
+}
 Static void
 dwc2_timeout(void *addr)
+{
 	struct usbd_xfer *xfer = addr;
 	struct dwc2_xfer *dxfer = DWC2_XFER2DXFER(xfer);
 // 	struct dwc2_pipe *dpipe = DWC2_XFER2DPIPE(xfer);
  	struct dwc2_softc *sc = DWC2_XFER2SC(xfer);
 	struct usbd_device *dev = xfer->ux_pipe->up_dev;
 	DPRINTF("dxfer=%p\n", dxfer);
-	if (sc->sc_dying) {
+	mutex_enter(&sc->sc_lock);
-		mutex_enter(&sc->sc_lock);
+	if (!sc->sc_dying && xfer->ux_status == USBD_IN_PROGRESS)
-		dwc2_abort_xfer(&dxfer->xfer, USBD_TIMEOUT);
+		usb_add_task(dev, &xfer->ux_aborttask, USB_TASKQ_HC);
-		mutex_exit(&sc->sc_lock);
+	mutex_exit(&sc->sc_lock);
 		return;
 	/* Execute the abort in a process context. */
 	usb_init_task(&dxfer->abort_task, dwc2_timeout_task, addr,
 	    USB_TASKQ_MPSAFE);
 	usb_add_task(dxfer->xfer.ux_pipe->up_dev, &dxfer->abort_task,
 	    USB_TASKQ_HC);
+}
 Static void
 dwc2_timeout_task(void *addr)
+{
 	struct usbd_xfer *xfer = addr;
  	struct dwc2_softc *sc = DWC2_XFER2SC(xfer);
 	DPRINTF("xfer=%p\n", xfer);
 	mutex_enter(&sc->sc_lock);
 	dwc2_abort_xfer(xfer, USBD_TIMEOUT);
 	mutex_exit(&sc->sc_lock);
 @@ -439,86 +435,103 @@ dwc2_close_pipe(struct usbd_pipe *pipe)
 	KASSERT(mutex_owned(&sc->sc_lock));
+}
 /*
  * Abort a device request.
  */
 Static void
 dwc2_abort_xfer(struct usbd_xfer *xfer, usbd_status status)
+{
 	struct dwc2_xfer *dxfer = DWC2_XFER2DXFER(xfer);
 	struct dwc2_softc *sc = DWC2_XFER2SC(xfer);
 	struct dwc2_hsotg *hsotg = sc->sc_hsotg;
 	struct dwc2_xfer *d, *tmp;
 	bool wake;
 	int err;
-	DPRINTF("xfer=%p\n", xfer);
+	KASSERTMSG((status == USBD_CANCELLED || status == USBD_TIMEOUT),
 	    "invalid status for abort: %d", (int)status);
 	DPRINTF("xfer %pjx pipe %pjx status %jd", xfer, xfer->ux_pipe, status);
 	KASSERT(mutex_owned(&sc->sc_lock));
-	KASSERT(!cpu_intr_p() && !cpu_softintr_p());
+	ASSERT_SLEEPABLE();
-	if (sc->sc_dying) {
+	if (status == USBD_CANCELLED) {
-		xfer->ux_status = status;
+		/*
-		callout_stop(&xfer->ux_callout);
+		 * We are synchronously aborting.  Try to stop the
-		usb_transfer_complete(xfer);
+		 * callout and task, but if we can't, wait for them to
-		return;
+		 * complete.
 		 */
 		callout_halt(&xfer->ux_callout, &sc->sc_lock);
 		usb_rem_task_wait(xfer->ux_pipe->up_dev, &xfer->ux_aborttask,
 		    USB_TASKQ_HC, &sc->sc_lock);
 	} else {
 		/* Otherwise, we are timing out.  */
 		KASSERT(status == USBD_TIMEOUT);
+	}
 	/*
-	 * If an abort is already in progress then just wait for it to
+	 * The xfer cannot have been cancelled already.  It is the
-	 * complete and return.
+	 * responsibility of the caller of usbd_abort_pipe not to try
 	 * to abort a pipe multiple times, whether concurrently or
 	 * sequentially.
 	 */
-	if (xfer->ux_hcflags & UXFER_ABORTING) {
+	KASSERT(xfer->ux_status != USBD_CANCELLED);
 		xfer->ux_status = status;
-		xfer->ux_hcflags |= UXFER_ABORTWAIT;
+	/* Only the timeout, which runs only once, can time it out.  */
-		while (xfer->ux_hcflags & UXFER_ABORTING)
+	KASSERT(xfer->ux_status != USBD_TIMEOUT);
 			cv_wait(&xfer->ux_hccv, &sc->sc_lock);
 	/* If anyone else beat us, we're done.  */
 	if (xfer->ux_status != USBD_IN_PROGRESS)
 		return;
 	/* We beat everyone else.  Claim the status.  */
 	xfer->ux_status = status;
 	/*
 	 * If we're dying, skip the hardware action and just notify the
 	 * software that we're done.
 	 */
 	if (sc->sc_dying) {
 		DPRINTFN(4, "xfer %#jx dying %ju", (uintptr_t)xfer,
 		    xfer->ux_status, 0, 0);
 		goto dying;
+	}
 	/*
-	 * Step 1: Make the stack ignore it and stop the callout.
+	 * HC Step 1: Handle the hardware.
 	 */
 	mutex_spin_enter(&hsotg->lock);
 	xfer->ux_hcflags |= UXFER_ABORTING;
 	xfer->ux_status = status;	/* make software ignore it */
 	callout_stop(&xfer->ux_callout);
 	/* XXXNH suboptimal */
 	TAILQ_FOREACH_SAFE(d, &sc->sc_complete, xnext, tmp) {
 		if (d == dxfer) {
 			TAILQ_REMOVE(&sc->sc_complete, dxfer, xnext);
 			break;
+		}
+	}
 	err = dwc2_hcd_urb_dequeue(hsotg, dxfer->urb);
 	if (err) {
 		DPRINTF("dwc2_hcd_urb_dequeue failed\n");
+	}
 	mutex_spin_exit(&hsotg->lock);
 	/*
-	 * Step 2: Execute callback.
+	 * Final Step: Notify completion to waiting xfers.
 	 */
-	wake = xfer->ux_hcflags & UXFER_ABORTWAIT;
+dying:
 	xfer->ux_hcflags &= ~(UXFER_ABORTING | UXFER_ABORTWAIT);
 	usb_transfer_complete(xfer);
-	if (wake) {
+	KASSERT(mutex_owned(&sc->sc_lock));
 		cv_broadcast(&xfer->ux_hccv);
+}
 Static void
 dwc2_noop(struct usbd_pipe *pipe)
+{
+}
 Static void
 dwc2_device_clear_toggle(struct usbd_pipe *pipe)
+{
 	DPRINTF("toggle %d -> 0", pipe->up_endpoint->ue_toggle);
 @@ -1108,27 +1121,27 @@ dwc2_device_start(struct usbd_xfer *xfer
 	if (alloc_bandwidth) {
 		dwc2_allocate_bus_bandwidth(hsotg,
 				dwc2_hcd_get_ep_bandwidth(hsotg, dpipe),
 				xfer);
+	}
 	mutex_spin_exit(&hsotg->lock);
 // 	mutex_exit(&sc->sc_lock);
 	return USBD_IN_PROGRESS;
 fail2:
-	callout_stop(&xfer->ux_callout);
+	callout_halt(&xfer->ux_callout, &hsotg->lock);
 	dwc2_urb->priv = NULL;
 	mutex_spin_exit(&hsotg->lock);
 	pool_cache_put(sc->sc_qtdpool, qtd);
 fail1:
 	if (qh_allocated) {
 		dpipe->priv = NULL;
 		dwc2_hcd_qh_free(hsotg, qh);
+	}
 fail:
 	switch (retval) {
 	case -EINVAL:
 @@ -1416,26 +1429,45 @@ void dwc2_host_complete(struct dwc2_hsot
+	}
 	if (!qtd->urb) {
 		dev_dbg(hsotg->dev, "## %s: qtd->urb is NULL ##\n", __func__);
 		return;
+	}
 	xfer = qtd->urb->priv;
 	if (!xfer) {
 		dev_dbg(hsotg->dev, "## %s: urb->priv is NULL ##\n", __func__);
 		return;
+	}
 	/*
 	 * If software has completed it, either by cancellation
 	 * or timeout, drop it on the floor.
 	 */
 	if (xfer->ux_status != USBD_IN_PROGRESS) {
 		KASSERT(xfer->ux_status == USBD_CANCELLED ||
 		    xfer->ux_status == USBD_TIMEOUT);
 		return;
+	}
 	/*
 	 * Cancel the timeout and the task, which have not yet
 	 * run.  If they have already fired, at worst they are
 	 * waiting for the lock.  They will see that the xfer
 	 * is no longer in progress and give up.
 	 */
 	callout_stop(&xfer->ux_callout);
 	usb_rem_task(xfer->ux_pipe->up_dev, &xfer->ux_aborttask);
 	dxfer = DWC2_XFER2DXFER(xfer);
 	sc = DWC2_XFER2SC(xfer);
 	ed = xfer->ux_pipe->up_endpoint->ue_edesc;
 	xfertype = UE_GET_XFERTYPE(ed->bmAttributes);
 	struct dwc2_hcd_urb *urb = qtd->urb;
 	xfer->ux_actlen = dwc2_hcd_urb_get_actual_length(urb);
 	DPRINTFN(3, "xfer=%p actlen=%d\n", xfer, xfer->ux_actlen);
 	if (xfertype == UE_ISOCHRONOUS) {
 		int i;
 @@ -1500,28 +1532,26 @@ void dwc2_host_complete(struct dwc2_hsot
+		}
+	}
 	if (xfertype == UE_ISOCHRONOUS ||
 	    xfertype == UE_INTERRUPT) {
 		struct dwc2_pipe *dpipe = DWC2_XFER2DPIPE(xfer);
 		dwc2_free_bus_bandwidth(hsotg,
 					dwc2_hcd_get_ep_bandwidth(hsotg, dpipe),
 					xfer);
+	}
 	qtd->urb = NULL;
 	callout_stop(&xfer->ux_callout);
 	KASSERT(mutex_owned(&hsotg->lock));
 	TAILQ_INSERT_TAIL(&sc->sc_complete, dxfer, xnext);
 	mutex_spin_exit(&hsotg->lock);
 	usb_schedsoftintr(&sc->sc_bus);
 	mutex_spin_enter(&hsotg->lock);
+}
 int
 _dwc2_hcd_start(struct dwc2_hsotg *hsotg)
+{

 @@ -1,14 +1,14 @@
-/*	$NetBSD: ehcivar.h,v 1.42.12.1 2017/04/05 19:54:19 snj Exp $ */
+/*	$NetBSD: ehcivar.h,v 1.42.12.2 2018/08/25 14:57:35 martin Exp $ */
 /*
  * Copyright (c) 2001 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Lennart Augustsson (lennart@augustsson.net).
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
 @@ -81,27 +81,26 @@ typedef struct ehci_soft_itd {
 	struct timeval t; /* store free time */
 } ehci_soft_itd_t;
 #define EHCI_ITD_SIZE ((sizeof(struct ehci_soft_itd) + EHCI_QH_ALIGN - 1) / EHCI_ITD_ALIGN * EHCI_ITD_ALIGN)
 #define EHCI_ITD_CHUNK (EHCI_PAGE_SIZE / EHCI_ITD_SIZE)
 #define ehci_soft_sitd_t ehci_soft_itd_t
 #define ehci_soft_sitd ehci_soft_itd
 #define sc_softsitds sc_softitds
 #define EHCI_SITD_SIZE ((sizeof(struct ehci_soft_sitd) + EHCI_QH_ALIGN - 1) / EHCI_SITD_ALIGN * EHCI_SITD_ALIGN)
 #define EHCI_SITD_CHUNK (EHCI_PAGE_SIZE / EHCI_SITD_SIZE)
 struct ehci_xfer {
 	struct usbd_xfer ex_xfer;
 	struct usb_task ex_aborttask;
 	TAILQ_ENTRY(ehci_xfer) ex_next; /* list of active xfers */
 	enum {
 		EX_NONE,
 		EX_CTRL,
 		EX_BULK,
 		EX_INTR,
 		EX_ISOC,
 		EX_FS_ISOC
 	} ex_type;
 	/* ctrl/bulk/intr */
 	struct {
 		ehci_soft_qtd_t **ex_sqtds;
 		size_t ex_nsqtd;
 @@ -201,28 +200,26 @@ typedef struct ehci_softc {
 	TAILQ_HEAD(, ehci_xfer) sc_intrhead;
 	ehci_soft_qh_t *sc_freeqhs;
 	ehci_soft_qtd_t *sc_freeqtds;
 	LIST_HEAD(sc_freeitds, ehci_soft_itd) sc_freeitds;
 	LIST_HEAD(sc_freesitds, ehci_soft_sitd) sc_freesitds;
 	int sc_noport;
 	uint8_t sc_hasppc;		/* has Port Power Control */
 	uint8_t sc_istthreshold;	/* ISOC Scheduling Threshold (uframes) */
 	struct usbd_xfer *sc_intrxfer;
 	char sc_isreset[EHCI_MAX_PORTS];
 	char sc_softwake;
 	kcondvar_t sc_softwake_cv;
 	uint32_t sc_eintrs;
 	ehci_soft_qh_t *sc_async_head;
 	pool_cache_t sc_xferpool;	/* free xfer pool */
 	struct callout sc_tmo_intrlist;
 	device_t sc_child; /* /dev/usb# device */
 	char sc_dying;
 	void (*sc_vendor_init)(struct ehci_softc *);
 	int (*sc_vendor_port_status)(struct ehci_softc *, uint32_t, int);

 @@ -1,14 +1,14 @@
-/*	$NetBSD: ohcivar.h,v 1.55.4.1 2017/04/05 19:54:19 snj Exp $	*/
+/*	$NetBSD: ohcivar.h,v 1.55.4.2 2018/08/25 14:57:35 martin Exp $	*/
 /*
  * Copyright (c) 1998 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Lennart Augustsson (lennart@augustsson.net) at
  * Carlstedt Research & Technology.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
 @@ -108,54 +108,50 @@ typedef struct ohci_softc {
 	LIST_HEAD(, ohci_soft_td)  sc_hash_tds[OHCI_HASH_SIZE];
 	LIST_HEAD(, ohci_soft_itd) sc_hash_itds[OHCI_HASH_SIZE];
 	int sc_noport;
 	int sc_endian;
 #define	OHCI_LITTLE_ENDIAN	0	/* typical (uninitialized default) */
 #define	OHCI_BIG_ENDIAN		1	/* big endian OHCI? never seen it */
 #define	OHCI_HOST_ENDIAN	2	/* if OHCI always matches CPU */
 	int sc_flags;
 #define OHCIF_SUPERIO		0x0001
 	char sc_softwake;
 	kcondvar_t sc_softwake_cv;
 	ohci_soft_ed_t *sc_freeeds;
 	ohci_soft_td_t *sc_freetds;
 	ohci_soft_itd_t *sc_freeitds;
 	pool_cache_t sc_xferpool;	/* free xfer pool */
 	struct usbd_xfer *sc_intrxfer;
 	char sc_vendor[32];
 	int sc_id_vendor;
 	uint32_t sc_control;		/* Preserved during suspend/standby */
 	uint32_t sc_intre;
 	u_int sc_overrun_cnt;
 	struct timeval sc_overrun_ntc;
 	struct callout sc_tmo_rhsc;
 	device_t sc_child;
 	char sc_dying;
 } ohci_softc_t;
 struct ohci_xfer {
 	struct usbd_xfer xfer;
 	struct usb_task abort_task;
 	/* ctrl */
 	ohci_soft_td_t *ox_setup;
 	ohci_soft_td_t *ox_stat;
 	union {
 		/* ctrl/bulk/intr */
 		struct {
 			ohci_soft_td_t **ox_stds;
 			size_t ox_nstd;
 		};
 		/* isoc */
 		struct {
 			ohci_soft_itd_t **ox_sitds;
 			size_t ox_nsitd;

 @@ -1,14 +1,14 @@
-/*	$NetBSD: uhcivar.h,v 1.52.12.1 2017/04/05 19:54:20 snj Exp $	*/
+/*	$NetBSD: uhcivar.h,v 1.52.12.2 2018/08/25 14:57:35 martin Exp $	*/
 /*
  * Copyright (c) 1998 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Lennart Augustsson (lennart@augustsson.net) at
  * Carlstedt Research & Technology.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
 @@ -51,27 +51,26 @@
  */
 #define UHCI_VFRAMELIST_COUNT 128
 typedef struct uhci_soft_qh uhci_soft_qh_t;
 typedef struct uhci_soft_td uhci_soft_td_t;
 typedef union {
 	struct uhci_soft_qh *sqh;
 	struct uhci_soft_td *std;
 } uhci_soft_td_qh_t;
 struct uhci_xfer {
 	struct usbd_xfer ux_xfer;
 	struct usb_task ux_aborttask;
 	enum {
 		UX_NONE, UX_CTRL, UX_BULK, UX_INTR, UX_ISOC
 	} ux_type;
 	/* ctrl/bulk/intr */
 	struct {
 		uhci_soft_td_t **ux_stds;
 		size_t ux_nstd;
 	};
 	union {
 		/* ctrl */
 		struct {
 			uhci_soft_td_t *ux_setup;
 			uhci_soft_td_t *ux_data;
 @@ -142,51 +141,48 @@ struct uhci_vframe {
 	uhci_soft_qh_t *eqh;		/* pointer to last QH */
 	u_int bandwidth;		/* max bandwidth used by this frame */
 };
 typedef struct uhci_softc {
 	device_t sc_dev;
 	struct usbd_bus sc_bus;
 	bus_space_tag_t iot;
 	bus_space_handle_t ioh;
 	bus_size_t sc_size;
 	kmutex_t sc_lock;
 	kmutex_t sc_intr_lock;
 	kcondvar_t sc_softwake_cv;
 	uhci_physaddr_t *sc_pframes;
 	usb_dma_t sc_dma;
 	struct uhci_vframe sc_vframes[UHCI_VFRAMELIST_COUNT];
 	uhci_soft_qh_t *sc_lctl_start;	/* dummy QH for low speed control */
 	uhci_soft_qh_t *sc_lctl_end;	/* last control QH */
 	uhci_soft_qh_t *sc_hctl_start;	/* dummy QH for high speed control */
 	uhci_soft_qh_t *sc_hctl_end;	/* last control QH */
 	uhci_soft_qh_t *sc_bulk_start;	/* dummy QH for bulk */
 	uhci_soft_qh_t *sc_bulk_end;	/* last bulk transfer */
 	uhci_soft_qh_t *sc_last_qh;	/* dummy QH at the end */
 	uint32_t sc_loops;		/* number of QHs that wants looping */
 	uhci_soft_td_t *sc_freetds;	/* TD free list */
 	uhci_soft_qh_t *sc_freeqhs;	/* QH free list */
 	pool_cache_t sc_xferpool;	/* free xfer pool */
 	uint8_t sc_saved_sof;
 	uint16_t sc_saved_frnum;
 	char sc_softwake;
 	char sc_isreset;
 	char sc_suspend;
 	char sc_dying;
 	TAILQ_HEAD(, uhci_xfer) sc_intrhead;
 	/* Info for the root hub interrupt "pipe". */
 	int sc_ival;			/* time between root hub intrs */
 	struct usbd_xfer *sc_intr_xfer;	/* root hub interrupt transfer */
 	struct callout sc_poll_handle;
 	char sc_vendor[32];		/* vendor string for root hub */
 	int sc_id_vendor;		/* vendor ID for root hub */

 @@ -1,14 +1,14 @@
-/*	$NetBSD: usbdivar.h,v 1.107.4.2 2017/04/05 19:54:21 snj Exp $	*/
+/*	$NetBSD: usbdivar.h,v 1.107.4.3 2018/08/25 14:57:35 martin Exp $	*/
 /*
  * Copyright (c) 1998, 2012 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Lennart Augustsson (lennart@augustsson.net) at
  * Carlstedt Research & Technology and Matthew R. Green (mrg@eterna.com.au).
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
 @@ -274,31 +274,28 @@ struct usbd_xfer {
 	/* For memory allocation and softc */
 	struct usbd_bus        *ux_bus;
 	usb_dma_t		ux_dmabuf;
 	void		       *ux_buf;
 	uint32_t		ux_bufsize;
 	uint8_t			ux_rqflags;
 #define URQ_REQUEST	0x01
 	SIMPLEQ_ENTRY(usbd_xfer)
 				ux_next;
 	void		       *ux_hcpriv;	/* private use by the HC driver */
 	uint8_t			ux_hcflags;	/* private use by the HC driver */
 #define UXFER_ABORTING	0x01	/* xfer is aborting. */
 #define UXFER_ABORTWAIT	0x02	/* abort completion is being awaited. */
 	kcondvar_t		ux_hccv;	/* private use by the HC driver */
 	struct usb_task		ux_aborttask;
 	struct callout		ux_callout;
 };
 void usbd_init(void);
 void usbd_finish(void);
 #if defined(USB_DEBUG)
 void usbd_dump_iface(struct usbd_interface *);
 void usbd_dump_device(struct usbd_device *);
 void usbd_dump_endpoint(struct usbd_endpoint *);
 void usbd_dump_queue(struct usbd_pipe *);
 void usbd_dump_pipe(struct usbd_pipe *);
 #endif

 @@ -1,14 +1,14 @@
-/*	$NetBSD: xhcivar.h,v 1.4.8.1 2017/04/05 19:54:21 snj Exp $	*/
+/*	$NetBSD: xhcivar.h,v 1.4.8.2 2018/08/25 14:57:35 martin Exp $	*/
 /*
  * Copyright (c) 2013 Jonathan A. Kollasch
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
 @@ -25,27 +25,26 @@
  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #ifndef _DEV_USB_XHCIVAR_H_
 #define _DEV_USB_XHCIVAR_H_
 #include <sys/pool.h>
 #define XHCI_XFER_NTRB	20
 struct xhci_xfer {
 	struct usbd_xfer xx_xfer;
 	struct usb_task xx_abort_task;
 	struct xhci_trb xx_trb[XHCI_XFER_NTRB];
 };
 #define XHCI_BUS2SC(bus)	((bus)->ub_hcpriv)
 #define XHCI_PIPE2SC(pipe)	XHCI_BUS2SC((pipe)->up_dev->ud_bus)
 #define XHCI_XFER2SC(xfer)	XHCI_BUS2SC((xfer)->ux_bus)
 #define XHCI_XFER2BUS(xfer)	((xfer)->ux_bus)
 #define XHCI_XPIPE2SC(d)	XHCI_BUS2SC((d)->xp_pipe.up_dev->ud_bus)
 #define XHCI_XFER2XXFER(xfer)	((struct xhci_xfer *)(xfer))
 struct xhci_ring {
 	usb_dma_t xr_dma;
 @@ -75,27 +74,26 @@ struct xhci_softc {
 	device_t sc_child2;
 	bus_size_t sc_ios;
 	bus_space_tag_t sc_iot;
 	bus_space_handle_t sc_ioh;	/* Base */
 	bus_space_handle_t sc_cbh;	/* Capability Base */
 	bus_space_handle_t sc_obh;	/* Operational Base */
 	bus_space_handle_t sc_rbh;	/* Runtime Base */
 	bus_space_handle_t sc_dbh;	/* Doorbell Registers */
 	struct usbd_bus sc_bus;		/* USB 3 bus */
 	struct usbd_bus sc_bus2;	/* USB 2 bus */
 	kmutex_t sc_lock;
 	kmutex_t sc_intr_lock;
 	kcondvar_t sc_softwake_cv;
 	char sc_vendor[32];		/* vendor string for root hub */
 	int sc_id_vendor;		/* vendor ID for root hub */
 	pool_cache_t sc_xferpool;
 	bus_size_t sc_pgsz;		/* xHCI page size */
 	uint32_t sc_ctxsz;
 	int sc_maxslots;
 	int sc_maxintrs;
 	int sc_maxspbuf;
 	/*