Print this page
MFV: illumos-gate@2aba3acda67326648fd60aaf2bfb4e18ee8c04ed
9816 Multi-TRB xhci transfers should use event data
9817 xhci needs to always set slot context
8550 increase xhci bulk transfer sgl count
9818 xhci_transfer_get_tdsize can return values that are too large
Reviewed by: Alex Wilson <alex.wilson@joyent.com>
Reviewed by: Jerry Jelinek <jerry.jelinek@joyent.com>
Approved by: Joshua M. Clulow <josh@sysmgr.org>
Author: Robert Mustacchi <rm@joyent.com>

Split Close
Expand all
Collapse all
          --- old/usr/src/uts/common/io/usb/hcd/xhci/xhci_endpoint.c
          +++ new/usr/src/uts/common/io/usb/hcd/xhci/xhci_endpoint.c
↓ open down ↓ 2 lines elided ↑ open up ↑
   3    3   * Common Development and Distribution License ("CDDL"), version 1.0.
   4    4   * You may only use this file in accordance with the terms of version
   5    5   * 1.0 of the CDDL.
   6    6   *
   7    7   * A full copy of the text of the CDDL should have accompanied this
   8    8   * source.  A copy of the CDDL is also available via the Internet at
   9    9   * http://www.illumos.org/license/CDDL.
  10   10   */
  11   11  
  12   12  /*
  13      - * Copyright 2016 Joyent, Inc.
       13 + * Copyright (c) 2018, Joyent, Inc.
  14   14   */
  15   15  
  16   16  /*
  17   17   * xHCI Endpoint Initialization and Management
  18   18   *
  19   19   * Please see the big theory statement in xhci.c for more information.
  20   20   */
  21   21  
  22   22  #include <sys/usb/hcd/xhci/xhci.h>
  23   23  #include <sys/sdt.h>
↓ open down ↓ 268 lines elided ↑ open up ↑
 292  292  }
 293  293  
 294  294  
 295  295  /*
 296  296   * Determining the interval is unfortunately somewhat complicated as there are
 297  297   * many differnet forms that things can take. This is all summarized in a
 298  298   * somewhat helpful table, number 65, in xHCI 1.1 / 6.2.3.6. But here's
 299  299   * basically the six different cases we have to consider:
 300  300   *
 301  301   * Case 1: Non-High Speed Bulk and Control Endpoints
 302      - *      Always return 0.
      302 + *      Always return 0.
 303  303   *
 304  304   * Case 2: Super Speed and High Speed Isoch and Intr endpoints
 305      - *      Convert from a 2^(x-1) range to a 2^x range.
      305 + *      Convert from a 2^(x-1) range to a 2^x range.
 306  306   *
 307  307   * Case 3: Full Speed Isochronous Endpoints
 308      - *      As case 2, but add 3 as its values are in frames and we need to convert
 309      - *      to microframes. Adding three to the result is the same as multiplying
 310      - *      the initial value by 8.
      308 + *      As case 2, but add 3 as its values are in frames and we need to convert
      309 + *      to microframes. Adding three to the result is the same as multiplying
      310 + *      the initial value by 8.
 311  311   *
 312  312   * Case 4: Full speed and Low Speed Interrupt Endpoints
 313      - *      These have a 1-255 ms range that we need to convert to a 2^x * 128 us
 314      - *      range. We use the linear conversion and then add 3 to account for the
 315      - *      multiplying by 8 conversion from frames to microframes.
      313 + *      These have a 1-255 ms range that we need to convert to a 2^x * 128 us
      314 + *      range. We use the linear conversion and then add 3 to account for the
      315 + *      multiplying by 8 conversion from frames to microframes.
 316  316   *
 317  317   * Case 5: High Speed Interrupt and Bulk Output
 318      - *      These are a bit of a weird case. The spec and other implementations make
 319      - *      it seem that it's similar to case 4, but without the fixed addition as
 320      - *      its interpreted differently due to NAKs.
      318 + *      These are a bit of a weird case. The spec and other implementations make
      319 + *      it seem that it's similar to case 4, but without the fixed addition as
      320 + *      its interpreted differently due to NAKs.
 321  321   *
 322  322   * Case 6: Low Speed Isochronous Endpoints
 323      - *      These are not actually defined; however, like other implementations we
 324      - *      treat them like case 4.
      323 + *      These are not actually defined; however, like other implementations we
      324 + *      treat them like case 4.
 325  325   */
 326  326  static uint_t
 327  327  xhci_endpoint_interval(xhci_device_t *xd, usb_ep_descr_t *ep)
 328  328  {
 329  329          int type = ep->bmAttributes & USB_EP_ATTR_MASK;
 330  330          int speed = xd->xd_usbdev->usb_port_status;
 331  331  
 332  332          /*
 333  333           * Handle Cases 1 and 5 first.
 334  334           */
↓ open down ↓ 533 lines elided ↑ open up ↑
 868  868          ASSERT(xt->xt_ntrbs > 0);
 869  869          ASSERT(xt->xt_trbs != NULL);
 870  870  
 871  871          if ((xep->xep_state & XHCI_ENDPOINT_DONT_SCHEDULE) != 0)
 872  872                  return (USB_FAILURE);
 873  873  
 874  874          if (xhci_ring_trb_space(rp, xt->xt_ntrbs) == B_FALSE)
 875  875                  return (USB_NO_RESOURCES);
 876  876  
 877  877          for (i = xt->xt_ntrbs - 1; i > 0; i--) {
 878      -                xhci_ring_trb_fill(rp, i, &xt->xt_trbs[i], B_TRUE);
      878 +                xhci_ring_trb_fill(rp, i, &xt->xt_trbs[i], &xt->xt_trbs_pa[i],
      879 +                    B_TRUE);
 879  880          }
 880      -        xhci_ring_trb_fill(rp, 0U, &xt->xt_trbs[0], B_FALSE);
      881 +        xhci_ring_trb_fill(rp, 0U, &xt->xt_trbs[0], &xt->xt_trbs_pa[0],
      882 +            B_FALSE);
 881  883  
 882  884          XHCI_DMA_SYNC(rp->xr_dma, DDI_DMA_SYNC_FORDEV);
 883  885          xhci_ring_trb_produce(rp, xt->xt_ntrbs);
 884  886          list_insert_tail(&xep->xep_transfers, xt);
 885  887  
 886  888          XHCI_DMA_SYNC(rp->xr_dma, DDI_DMA_SYNC_FORDEV);
 887  889          if (xhci_check_dma_handle(xhcip, &rp->xr_dma) != DDI_FM_OK) {
 888  890                  xhci_error(xhcip, "failed to write out TRB for device on slot "
 889  891                      "%d, port %d, and endpoint %u: encountered fatal FM error "
 890  892                      "synchronizing ring DMA memory", xd->xd_slot, xd->xd_port,
↓ open down ↓ 11 lines elided ↑ open up ↑
 902  904          xt->xt_sched_time = gethrtime();
 903  905  
 904  906          if (ring == B_FALSE)
 905  907                  return (USB_SUCCESS);
 906  908  
 907  909          return (xhci_endpoint_ring(xhcip, xd, xep));
 908  910  }
 909  911  
 910  912  static xhci_transfer_t *
 911  913  xhci_endpoint_determine_transfer(xhci_t *xhcip, xhci_endpoint_t *xep,
 912      -    xhci_trb_t *trb, int *offp)
      914 +    xhci_trb_t *trb, uint_t *offp)
 913  915  {
      916 +        uint_t i;
      917 +        uint64_t addr;
 914  918          xhci_transfer_t *xt;
 915  919  
 916  920          ASSERT(xhcip != NULL);
 917  921          ASSERT(offp != NULL);
 918  922          ASSERT(xep != NULL);
 919  923          ASSERT(trb != NULL);
 920  924          ASSERT(MUTEX_HELD(&xhcip->xhci_lock));
 921  925  
 922  926          if ((xt = list_head(&xep->xep_transfers)) == NULL)
 923  927                  return (NULL);
 924  928  
 925      -        *offp = xhci_ring_trb_valid_range(&xep->xep_ring, LE_64(trb->trb_addr),
 926      -            xt->xt_ntrbs);
 927      -        if (*offp == -1)
      929 +        addr = LE_64(trb->trb_addr);
      930 +
      931 +        /*
      932 +         * Check if this is the simple case of an event data. If it is, then all
      933 +         * we need to do is look and see its data matches the address of the
      934 +         * transfer.
      935 +         */
      936 +        if (XHCI_TRB_GET_ED(LE_32(trb->trb_flags)) != 0) {
      937 +                if (LE_64(trb->trb_addr) != (uintptr_t)xt)
      938 +                        return (NULL);
      939 +
      940 +                *offp = xt->xt_ntrbs - 1;
      941 +                return (xt);
      942 +        }
      943 +
      944 +        /*
      945 +         * This represents an error that has occurred. We need to check two
      946 +         * different things. The first is that the TRB PA maps to one of the
      947 +         * TRBs in the transfer. Secondly, we need to make sure that it makes
      948 +         * sense in the context of the ring and our notion of where the tail is.
      949 +         */
      950 +        for (i = 0; i < xt->xt_ntrbs; i++) {
      951 +                if (xt->xt_trbs_pa[i] == addr)
      952 +                        break;
      953 +        }
      954 +
      955 +        if (i == xt->xt_ntrbs)
 928  956                  return (NULL);
      957 +
      958 +        if (xhci_ring_trb_valid_range(&xep->xep_ring, LE_64(trb->trb_addr),
      959 +            xt->xt_ntrbs) == -1)
      960 +                return (NULL);
      961 +
      962 +        *offp = i;
 929  963          return (xt);
 930  964  }
 931  965  
 932  966  static void
 933  967  xhci_endpoint_reschedule_periodic(xhci_t *xhcip, xhci_device_t *xd,
 934  968      xhci_endpoint_t *xep, xhci_transfer_t *xt)
 935  969  {
 936  970          int ret;
 937  971          xhci_pipe_t *xp = (xhci_pipe_t *)xep->xep_pipe->p_hcd_private;
 938  972          xhci_periodic_pipe_t *xpp = &xp->xp_periodic;
↓ open down ↓ 49 lines elided ↑ open up ↑
 988 1022   *
 989 1023   * We generally set ourselves up such that we get interrupted and notified only
 990 1024   * on the status stage and for short transfers in the data stage. If we
 991 1025   * encounter a short transfer in the data stage, then we need to go through and
 992 1026   * check whether or not the short transfer is allowed. If it is, then there's
 993 1027   * nothing to do. We'll update everything and call back the framework once we
 994 1028   * get the status stage.
 995 1029   */
 996 1030  static boolean_t
 997 1031  xhci_endpoint_control_callback(xhci_t *xhcip, xhci_device_t *xd,
 998      -    xhci_endpoint_t *xep, xhci_transfer_t *xt, int off, xhci_trb_t *trb)
     1032 +    xhci_endpoint_t *xep, xhci_transfer_t *xt, uint_t off, xhci_trb_t *trb)
 999 1033  {
1000 1034          int code;
1001 1035          usb_ctrl_req_t *ucrp;
1002 1036          xhci_transfer_t *rem;
1003 1037  
1004 1038          ASSERT(MUTEX_HELD(&xhcip->xhci_lock));
1005 1039  
1006 1040          code = XHCI_TRB_GET_CODE(LE_32(trb->trb_status));
1007 1041          ucrp = (usb_ctrl_req_t *)xt->xt_usba_req;
1008 1042  
1009 1043          /*
1010 1044           * Now that we know what this TRB is for, was it for a data/normal stage
1011 1045           * or is it the status stage. We cheat by looking at the last entry. If
1012      -         * it's a data stage, then we must have gotten a short write. In that
1013      -         * case, we should go through and check to make sure it's allowed. If
1014      -         * not, we need to fail the transfer, try to stop the ring, and make
1015      -         * callbacks. We'll clean up the xhci transfer at this time.
     1046 +         * it's a data stage, then we must have gotten a short write. We record
     1047 +         * this fact and whether we should consider the transfer fatal for the
     1048 +         * subsequent status stage.
1016 1049           */
1017 1050          if (off != xt->xt_ntrbs - 1) {
1018 1051                  uint_t remain;
1019 1052                  usb_ctrl_req_t *ucrp = (usb_ctrl_req_t *)xt->xt_usba_req;
1020 1053  
1021 1054                  /*
1022 1055                   * This is a data stage TRB. The only reason we should have
1023 1056                   * gotten something for this is beacuse it was short. Make sure
1024 1057                   * it's okay before we continue.
1025 1058                   */
↓ open down ↓ 117 lines elided ↑ open up ↑
1143 1176  
1144 1177          return (NULL);
1145 1178  }
1146 1179  
1147 1180  /*
1148 1181   * Handle things which consist solely of normal tranfers, in other words, bulk
1149 1182   * and interrupt transfers.
1150 1183   */
1151 1184  static boolean_t
1152 1185  xhci_endpoint_norm_callback(xhci_t *xhcip, xhci_device_t *xd,
1153      -    xhci_endpoint_t *xep, xhci_transfer_t *xt, int off, xhci_trb_t *trb)
     1186 +    xhci_endpoint_t *xep, xhci_transfer_t *xt, uint_t off, xhci_trb_t *trb)
1154 1187  {
1155 1188          int code;
1156 1189          usb_cr_t cr;
1157 1190          xhci_transfer_t *rem;
1158 1191          int attrs;
1159 1192          mblk_t *mp;
1160 1193          boolean_t periodic = B_FALSE;
1161 1194          usb_opaque_t urp;
1162 1195  
1163 1196          ASSERT(MUTEX_HELD(&xhcip->xhci_lock));
1164 1197          ASSERT(xep->xep_type == USB_EP_ATTR_BULK ||
1165 1198              xep->xep_type == USB_EP_ATTR_INTR);
1166 1199  
1167 1200          code = XHCI_TRB_GET_CODE(LE_32(trb->trb_status));
1168 1201  
1169 1202          if (code == XHCI_CODE_SHORT_XFER) {
1170      -                int residue;
     1203 +                uint_t residue;
1171 1204                  residue = XHCI_TRB_REMAIN(LE_32(trb->trb_status));
1172      -                xt->xt_short = xt->xt_buffer.xdb_len - residue;
     1205 +
     1206 +                if (xep->xep_type == USB_EP_ATTR_BULK) {
     1207 +                        VERIFY3U(XHCI_TRB_GET_ED(LE_32(trb->trb_flags)), !=, 0);
     1208 +                        xt->xt_short = residue;
     1209 +                } else {
     1210 +                        xt->xt_short = xt->xt_buffer.xdb_len - residue;
     1211 +                }
1173 1212          }
1174 1213  
1175 1214          /*
1176 1215           * If we have an interrupt from something that's not the last entry,
1177 1216           * that must mean we had a short transfer, so there's nothing more for
1178 1217           * us to do at the moment. We won't call back until everything's
1179 1218           * finished for the general transfer.
1180 1219           */
1181 1220          if (off < xt->xt_ntrbs - 1) {
1182 1221                  mutex_exit(&xhcip->xhci_lock);
↓ open down ↓ 48 lines elided ↑ open up ↑
1231 1270                          mutex_exit(&xhcip->xhci_lock);
1232 1271                          return (B_FALSE);
1233 1272                  }
1234 1273  
1235 1274                  xhci_transfer_copy(xt, mp->b_rptr, len, B_TRUE);
1236 1275                  mp->b_wptr += len;
1237 1276          }
1238 1277          cr = USB_CR_OK;
1239 1278  
1240 1279  out:
1241      -        VERIFY(xhci_ring_trb_consumed(&xep->xep_ring, LE_64(trb->trb_addr)));
     1280 +        /*
     1281 +         * Don't use the address from the TRB here. When we're dealing with
     1282 +         * event data that will be entirely wrong.
     1283 +         */
     1284 +        VERIFY(xhci_ring_trb_consumed(&xep->xep_ring, xt->xt_trbs_pa[off]));
1242 1285          rem = list_remove_head(&xep->xep_transfers);
1243 1286          VERIFY3P(rem, ==, xt);
1244 1287          mutex_exit(&xhcip->xhci_lock);
1245 1288  
1246 1289          usba_hcdi_cb(xep->xep_pipe, urp, cr);
1247 1290          if (periodic == B_TRUE) {
1248 1291                  xhci_endpoint_reschedule_periodic(xhcip, xd, xep, xt);
1249 1292          } else {
1250 1293                  xhci_transfer_free(xhcip, xt);
1251 1294          }
1252 1295  
1253 1296          return (B_TRUE);
1254 1297  }
1255 1298  
1256 1299  static boolean_t
1257 1300  xhci_endpoint_isoch_callback(xhci_t *xhcip, xhci_device_t *xd,
1258      -    xhci_endpoint_t *xep, xhci_transfer_t *xt, int off, xhci_trb_t *trb)
     1301 +    xhci_endpoint_t *xep, xhci_transfer_t *xt, uint_t off, xhci_trb_t *trb)
1259 1302  {
1260 1303          int code;
1261 1304          usb_cr_t cr;
1262 1305          xhci_transfer_t *rem;
1263 1306          usb_isoc_pkt_descr_t *desc;
1264 1307          usb_isoc_req_t *usrp;
1265 1308  
1266 1309          ASSERT(MUTEX_HELD(&xhcip->xhci_lock));
1267 1310          ASSERT3S(xep->xep_type, ==, USB_EP_ATTR_ISOCH);
1268 1311  
↓ open down ↓ 69 lines elided ↑ open up ↑
1338 1381                  xhci_transfer_free(xhcip, xt);
1339 1382          }
1340 1383  
1341 1384          return (B_TRUE);
1342 1385  }
1343 1386  
1344 1387  boolean_t
1345 1388  xhci_endpoint_transfer_callback(xhci_t *xhcip, xhci_trb_t *trb)
1346 1389  {
1347 1390          boolean_t ret;
1348      -        int slot, endpoint, code, off;
     1391 +        int slot, endpoint, code;
     1392 +        uint_t off;
1349 1393          xhci_device_t *xd;
1350 1394          xhci_endpoint_t *xep;
1351 1395          xhci_transfer_t *xt;
1352 1396          boolean_t transfer_done;
1353 1397  
1354 1398          endpoint = XHCI_TRB_GET_EP(LE_32(trb->trb_flags));
1355 1399          slot = XHCI_TRB_GET_SLOT(LE_32(trb->trb_flags));
1356 1400          code = XHCI_TRB_GET_CODE(LE_32(trb->trb_status));
1357 1401  
     1402 +        switch (code) {
     1403 +        case XHCI_CODE_RING_UNDERRUN:
     1404 +        case XHCI_CODE_RING_OVERRUN:
     1405 +                /*
     1406 +                 * If we have an ISOC overrun or underrun then there will be no
     1407 +                 * valid data pointer in the TRB associated with it. Just drive
     1408 +                 * on.
     1409 +                 */
     1410 +                return (B_TRUE);
     1411 +        case XHCI_CODE_UNDEFINED:
     1412 +                xhci_error(xhcip, "received transfer trb with undefined fatal "
     1413 +                    "error: resetting device");
     1414 +                xhci_fm_runtime_reset(xhcip);
     1415 +                return (B_FALSE);
     1416 +        case XHCI_CODE_XFER_STOPPED:
     1417 +        case XHCI_CODE_XFER_STOPINV:
     1418 +        case XHCI_CODE_XFER_STOPSHORT:
     1419 +                /*
     1420 +                 * This causes us to transition the endpoint to a stopped state.
     1421 +                 * Each of these indicate a different possible state that we
     1422 +                 * have to deal with. Effectively we're going to drop it and
     1423 +                 * leave it up to the consumers to figure out what to do. For
     1424 +                 * the moment, that's generally okay because stops are only used
     1425 +                 * in cases where we're cleaning up outstanding reqs, etc.
     1426 +                 *
     1427 +                 * We do this before we check for the corresponding transfer as
     1428 +                 * this will generally be generated by a command issued that's
     1429 +                 * stopping the ring.
     1430 +                 */
     1431 +                return (B_TRUE);
     1432 +        default:
     1433 +                break;
     1434 +        }
     1435 +
1358 1436          mutex_enter(&xhcip->xhci_lock);
1359 1437          xd = xhci_device_lookup_by_slot(xhcip, slot);
1360 1438          if (xd == NULL) {
1361 1439                  xhci_error(xhcip, "received transfer trb with code %d for "
1362 1440                      "unknown slot %d and endpoint %d: resetting device", code,
1363 1441                      slot, endpoint);
1364 1442                  mutex_exit(&xhcip->xhci_lock);
1365 1443                  xhci_fm_runtime_reset(xhcip);
1366 1444                  return (B_FALSE);
1367 1445          }
↓ open down ↓ 6 lines elided ↑ open up ↑
1374 1452          if (xep == NULL) {
1375 1453                  xhci_error(xhcip, "received transfer trb with code %d, slot "
1376 1454                      "%d, and unknown endpoint %d: resetting device", code,
1377 1455                      slot, endpoint);
1378 1456                  mutex_exit(&xhcip->xhci_lock);
1379 1457                  xhci_fm_runtime_reset(xhcip);
1380 1458                  return (B_FALSE);
1381 1459          }
1382 1460  
1383 1461          /*
1384      -         * This TRB should be part of a transfer. If it's not, then we ignore
1385      -         * it. We also check whether or not it's for the first transfer. Because
1386      -         * the rings are serviced in order, it should be.
     1462 +         * The TRB that we recieved may be an event data TRB for a bulk
     1463 +         * endpoint, a normal or short completion for any other endpoint or an
     1464 +         * error. In all cases, we need to figure out what transfer this
     1465 +         * corresponds to. If this is an error, then we need to make sure that
     1466 +         * the generating ring has been cleaned up.
     1467 +         *
     1468 +         * TRBs should be delivered in order, based on the ring. If for some
     1469 +         * reason we find something that doesn't add up here, then we need to
     1470 +         * assume that something has gone horribly wrong in the system and issue
     1471 +         * a runtime reset. We issue the runtime reset rather than just trying
     1472 +         * to stop and flush the ring, because it's unclear if we could stop
     1473 +         * the ring in time.
1387 1474           */
1388 1475          if ((xt = xhci_endpoint_determine_transfer(xhcip, xep, trb, &off)) ==
1389 1476              NULL) {
     1477 +                xhci_error(xhcip, "received transfer trb with code %d, slot "
     1478 +                    "%d, and endpoint %d, but does not match current transfer "
     1479 +                    "for endpoint: resetting device", code, slot, endpoint);
1390 1480                  mutex_exit(&xhcip->xhci_lock);
1391      -                return (B_TRUE);
     1481 +                xhci_fm_runtime_reset(xhcip);
     1482 +                return (B_FALSE);
1392 1483          }
1393 1484  
1394 1485          transfer_done = B_FALSE;
1395 1486  
1396 1487          switch (code) {
1397 1488          case XHCI_CODE_SUCCESS:
1398 1489          case XHCI_CODE_SHORT_XFER:
1399 1490                  /* Handled by endpoint logic */
1400 1491                  break;
1401      -        case XHCI_CODE_XFER_STOPPED:
1402      -        case XHCI_CODE_XFER_STOPINV:
1403      -        case XHCI_CODE_XFER_STOPSHORT:
1404      -                /*
1405      -                 * This causes us to transition the endpoint to a stopped state.
1406      -                 * Each of these indicate a different possible state that we
1407      -                 * have to deal with. Effectively we're going to drop it and
1408      -                 * leave it up to the consumers to figure out what to do. For
1409      -                 * the moment, that's generally okay because stops are only used
1410      -                 * in cases where we're cleaning up outstanding reqs, etc.
1411      -                 */
1412      -                mutex_exit(&xhcip->xhci_lock);
1413      -                return (B_TRUE);
1414 1492          case XHCI_CODE_STALL:
1415 1493                  /*
1416 1494                   * This causes us to transition to the halted state;
1417 1495                   * however, downstream clients are able to handle this just
1418 1496                   * fine.
1419 1497                   */
1420 1498                  xep->xep_state |= XHCI_ENDPOINT_HALTED;
1421 1499                  xt->xt_cr = USB_CR_STALL;
1422 1500                  transfer_done = B_TRUE;
1423 1501                  break;
↓ open down ↓ 1 lines elided ↑ open up ↑
1425 1503                  transfer_done = B_TRUE;
1426 1504                  xt->xt_cr = USB_CR_DATA_OVERRUN;
1427 1505                  xep->xep_state |= XHCI_ENDPOINT_HALTED;
1428 1506                  break;
1429 1507          case XHCI_CODE_TXERR:
1430 1508          case XHCI_CODE_SPLITERR:
1431 1509                  transfer_done = B_TRUE;
1432 1510                  xt->xt_cr = USB_CR_DEV_NOT_RESP;
1433 1511                  xep->xep_state |= XHCI_ENDPOINT_HALTED;
1434 1512                  break;
     1513 +        case XHCI_CODE_BW_OVERRUN:
     1514 +                transfer_done = B_TRUE;
     1515 +                xt->xt_cr = USB_CR_DATA_OVERRUN;
     1516 +                break;
     1517 +        case XHCI_CODE_DATA_BUF:
     1518 +                transfer_done = B_TRUE;
     1519 +                if (xt->xt_data_tohost)
     1520 +                        xt->xt_cr = USB_CR_DATA_OVERRUN;
     1521 +                else
     1522 +                        xt->xt_cr = USB_CR_DATA_UNDERRUN;
     1523 +                break;
1435 1524          default:
1436 1525                  /*
1437 1526                   * Treat these as general unspecified errors that don't cause a
1438 1527                   * stop of the ring. Even if it does, a subsequent timeout
1439 1528                   * should occur which causes us to end up dropping a pipe reset
1440 1529                   * or at least issuing a reset of the device as part of
1441 1530                   * quiescing.
1442 1531                   */
1443 1532                  transfer_done = B_TRUE;
     1533 +                xt->xt_cr = USB_CR_HC_HARDWARE_ERR;
1444 1534                  break;
1445 1535          }
1446 1536  
1447 1537          if (transfer_done == B_TRUE) {
1448 1538                  xhci_transfer_t *alt;
1449 1539  
1450 1540                  alt = list_remove_head(&xep->xep_transfers);
1451 1541                  VERIFY3P(alt, ==, xt);
1452 1542                  mutex_exit(&xhcip->xhci_lock);
1453 1543                  if (xt->xt_usba_req == NULL) {
↓ open down ↓ 43 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX