/*-
 * SPDX-License-Identifier: BSD-2-Clause
 *
 * Copyright (c) Andriy Gapon
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions, and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 */

/*
 * Hardware information links:
 * - CP2112 Datasheet
 *   https://www.silabs.com/documents/public/data-sheets/cp2112-datasheet.pdf
 * - AN495: CP2112 Interface Specification
 *   https://www.silabs.com/documents/public/application-notes/an495-cp2112-interface-specification.pdf
 * - CP2112 Errata
 *   https://www.silabs.com/documents/public/errata/cp2112-errata.pdf
 */

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/condvar.h>
#include <sys/bus.h>
#include <sys/gpio.h>
#include <sys/kernel.h>
#include <sys/lock.h>
#include <sys/module.h>
#include <sys/mutex.h>
#include <sys/sdt.h>
#include <sys/sx.h>

#include <dev/gpio/gpiobusvar.h>

#include <dev/iicbus/iiconf.h>
#include <dev/iicbus/iicbus.h>
#include "iicbus_if.h"

#include <dev/usb/usb.h>
#include <dev/usb/usbdi.h>
#include <dev/usb/usbdi_util.h>
#include <dev/usb/usbhid.h>
#include "usbdevs.h"

#define USB_DEBUG_VAR usb_debug
#include <dev/usb/usb_debug.h>

#define SIZEOF_FIELD(_s, _f)    sizeof(((struct _s *)NULL)->_f)

#define CP2112GPIO_LOCK(sc)     sx_xlock(&sc->gpio_lock)
#define CP2112GPIO_UNLOCK(sc)   sx_xunlock(&sc->gpio_lock)
#define CP2112GPIO_LOCKED(sc)   sx_assert(&sc->gpio_lock, SX_XLOCKED)

#define CP2112_PART_NUM                 0x0c
#define CP2112_GPIO_COUNT               8
#define CP2112_REPORT_SIZE              64

#define CP2112_REQ_RESET                0x1
#define CP2112_REQ_GPIO_CFG             0x2
#define CP2112_REQ_GPIO_GET             0x3
#define CP2112_REQ_GPIO_SET             0x4
#define CP2112_REQ_VERSION              0x5
#define CP2112_REQ_SMB_CFG              0x6

#define CP2112_REQ_SMB_READ             0x10
#define CP2112_REQ_SMB_WRITE_READ       0x11
#define CP2112_REQ_SMB_READ_FORCE_SEND  0x12
#define CP2112_REQ_SMB_READ_RESPONSE    0x13
#define CP2112_REQ_SMB_WRITE            0x14
#define CP2112_REQ_SMB_XFER_STATUS_REQ  0x15
#define CP2112_REQ_SMB_XFER_STATUS_RESP 0x16
#define CP2112_REQ_SMB_CANCEL           0x17

#define CP2112_REQ_LOCK                 0x20
#define CP2112_REQ_USB_CFG              0x21

#define CP2112_IIC_MAX_READ_LEN         512
#define CP2112_IIC_REPSTART_VER         2       /* Erratum CP2112_E10. */

#define CP2112_GPIO_SPEC_CLK7           1       /* Pin 7 is clock output. */
#define CP2112_GPIO_SPEC_TX0            2       /* Pin 0 pulses on USB TX. */
#define CP2112_GPIO_SPEC_RX1            4       /* Pin 1 pulses on USB RX. */

#define CP2112_IIC_STATUS0_IDLE         0
#define CP2112_IIC_STATUS0_BUSY         1
#define CP2112_IIC_STATUS0_CMP          2
#define CP2112_IIC_STATUS0_ERROR        3

#define CP2112_IIC_STATUS1_TIMEOUT_NACK 0
#define CP2112_IIC_STATUS1_TIMEOUT_BUS  1
#define CP2112_IIC_STATUS1_ARB_LOST     2

/* CP2112_REQ_VERSION */
struct version_request {
        uint8_t id;
        uint8_t part_num;
        uint8_t version;
} __packed;

/* CP2112_REQ_GPIO_GET */
struct gpio_get_req {
        uint8_t id;
        uint8_t state;
} __packed;

/* CP2112_REQ_GPIO_SET */
struct gpio_set_req {
        uint8_t id;
        uint8_t state;
        uint8_t mask;
} __packed;

/* CP2112_REQ_GPIO_CFG */
struct gpio_config_req {
        uint8_t id;
        uint8_t output;
        uint8_t pushpull;
        uint8_t special;
        uint8_t divider;
} __packed;

/* CP2112_REQ_SMB_XFER_STATUS_REQ */
struct i2c_xfer_status_req {
        uint8_t id;
        uint8_t request;
} __packed;

/* CP2112_REQ_SMB_XFER_STATUS_RESP */
struct i2c_xfer_status_resp {
        uint8_t id;
        uint8_t status0;
        uint8_t status1;
        uint16_t status2;
        uint16_t status3;
} __packed;

/* CP2112_REQ_SMB_READ_FORCE_SEND */
struct i2c_data_read_force_send_req {
        uint8_t id;
        uint16_t len;
} __packed;

/* CP2112_REQ_SMB_READ_RESPONSE */
struct i2c_data_read_resp {
        uint8_t id;
        uint8_t status;
        uint8_t len;
        uint8_t data[61];
} __packed;

/* CP2112_REQ_SMB_READ */
struct i2c_write_read_req {
        uint8_t id;
        uint8_t slave;
        uint16_t rlen;
        uint8_t wlen;
        uint8_t wdata[16];
} __packed;

/* CP2112_REQ_SMB_WRITE */
struct i2c_read_req {
        uint8_t id;
        uint8_t slave;
        uint16_t len;
} __packed;

/* CP2112_REQ_SMB_WRITE_READ */
struct i2c_write_req {
        uint8_t id;
        uint8_t slave;
        uint8_t len;
        uint8_t data[61];
} __packed;

/* CP2112_REQ_SMB_CFG */
struct i2c_cfg_req {
        uint8_t         id;
        uint32_t        speed;          /* Hz */
        uint8_t         slave_addr;     /* ACK only */
        uint8_t         auto_send_read; /* boolean */
        uint16_t        write_timeout;  /* 0-1000 ms, 0 ~ no timeout */
        uint16_t        read_timeout;   /* 0-1000 ms, 0 ~ no timeout */
        uint8_t         scl_low_timeout;/* boolean */
        uint16_t        retry_count;    /* 1-1000, 0 ~ forever */
} __packed;

enum cp2112_out_mode {
        OUT_OD,
        OUT_PP,
        OUT_KEEP
};

enum {
        CP2112_INTR_OUT = 0,
        CP2112_INTR_IN,
        CP2112_N_TRANSFER,
};

struct cp2112_softc {
        device_t                sc_gpio_dev;
        device_t                sc_iic_dev;
        struct usb_device       *sc_udev;
        uint8_t                 sc_iface_index;
        uint8_t                 sc_version;
};

struct cp2112gpio_softc {
        struct sx               gpio_lock;
        device_t                busdev;
        int                     gpio_caps;
        struct gpio_pin         pins[CP2112_GPIO_COUNT];
};

struct cp2112iic_softc {
        device_t        dev;
        device_t        iicbus_dev;
        struct usb_xfer *xfers[CP2112_N_TRANSFER];
        u_char          own_addr;
        struct {
                struct mtx      lock;
                struct cv       cv;
                struct {
                        uint8_t         *data;
                        int             len;
                        int             done;
                        int             error;
                }               in;
                struct {
                        const uint8_t   *data;
                        int             len;
                        int             done;
                        int             error;
                }               out;
        }               io;
};

static int cp2112gpio_detach(device_t dev);
static int cp2112iic_detach(device_t dev);

static const STRUCT_USB_HOST_ID cp2112_devs[] = {
        { USB_VP(USB_VENDOR_SILABS, USB_PRODUCT_SILABS_CP2112) },
        { USB_VP(0x1009, USB_PRODUCT_SILABS_CP2112) }, /* XXX */
};

static int
cp2112_get_report(device_t dev, uint8_t id, void *data, uint16_t len)
{
        struct cp2112_softc *sc;
        int err;

        sc = device_get_softc(dev);
        err = usbd_req_get_report(sc->sc_udev, NULL, data,
            len, sc->sc_iface_index, UHID_FEATURE_REPORT, id);
        return (err);
}

static int
cp2112_set_report(device_t dev, uint8_t id, void *data, uint16_t len)
{
        struct cp2112_softc *sc;
        int err;

        sc = device_get_softc(dev);
        *(uint8_t *)data = id;
        err = usbd_req_set_report(sc->sc_udev, NULL, data,
            len, sc->sc_iface_index, UHID_FEATURE_REPORT, id);
        return (err);
}

static int
cp2112_probe(device_t dev)
{
        struct usb_attach_arg *uaa;

        uaa = device_get_ivars(dev);
        if (uaa->usb_mode != USB_MODE_HOST)
                return (ENXIO);
        if (uaa->info.bInterfaceClass != UICLASS_HID)
                return (ENXIO);

        if (usbd_lookup_id_by_uaa(cp2112_devs, sizeof(cp2112_devs), uaa) == 0)
                return (BUS_PROBE_DEFAULT);
        return (ENXIO);
}

static int
cp2112_attach(device_t dev)
{
        struct version_request vdata;
        struct usb_attach_arg *uaa;
        struct cp2112_softc *sc;
        int err;

        uaa = device_get_ivars(dev);
        sc = device_get_softc(dev);

        device_set_usb_desc(dev);

        sc->sc_udev = uaa->device;
        sc->sc_iface_index = uaa->info.bIfaceIndex;

        err = cp2112_get_report(dev, CP2112_REQ_VERSION, &vdata, sizeof(vdata));
        if (err != 0)
                goto detach;
        device_printf(dev, "part number 0x%02x, version 0x%02x\n",
            vdata.part_num, vdata.version);
        if (vdata.part_num != CP2112_PART_NUM) {
                device_printf(dev, "unsupported part number\n");
                goto detach;
        }
        sc->sc_version = vdata.version;
        sc->sc_gpio_dev = device_add_child(dev, "gpio", DEVICE_UNIT_ANY);
        if (sc->sc_gpio_dev != NULL) {
                err = device_probe_and_attach(sc->sc_gpio_dev);
                if (err != 0) {
                        device_printf(dev, "failed to attach gpio child\n");
                }
        } else {
                device_printf(dev, "failed to create gpio child\n");
        }

        sc->sc_iic_dev = device_add_child(dev, "iichb", DEVICE_UNIT_ANY);
        if (sc->sc_iic_dev != NULL) {
                err = device_probe_and_attach(sc->sc_iic_dev);
                if (err != 0) {
                        device_printf(dev, "failed to attach iic child\n");
                }
        } else {
                device_printf(dev, "failed to create iic child\n");
        }

        return (0);

detach:
        bus_generic_detach(dev);
        return (ENXIO);
}

static int
cp2112_gpio_read_pin(device_t dev, uint32_t pin_num, bool *on)
{
        struct gpio_get_req data;
        struct cp2112gpio_softc *sc __diagused;
        int err;

        sc = device_get_softc(dev);
        CP2112GPIO_LOCKED(sc);

        err = cp2112_get_report(device_get_parent(dev),
            CP2112_REQ_GPIO_GET, &data, sizeof(data));
        if (err != 0)
                return (err);
        *on = (data.state & ((uint8_t)1 << pin_num)) != 0;
        return (0);

}

static int
cp2112_gpio_write_pin(device_t dev, uint32_t pin_num, bool on)
{
        struct gpio_set_req data;
        struct cp2112gpio_softc *sc __diagused;
        int err;
        bool actual;

        sc = device_get_softc(dev);
        CP2112GPIO_LOCKED(sc);

        data.state = (uint8_t)on << pin_num;
        data.mask = (uint8_t)1 << pin_num;
        err = cp2112_set_report(device_get_parent(dev),
            CP2112_REQ_GPIO_SET, &data, sizeof(data));
        if (err != 0)
                return (err);
        err = cp2112_gpio_read_pin(dev, pin_num, &actual);
        if (err != 0)
                return (err);
        if (actual != on)
                return (EIO);
        return (0);
}

static int
cp2112_gpio_configure_write_pin(device_t dev, uint32_t pin_num,
    bool output, enum cp2112_out_mode *mode)
{
        struct gpio_config_req data;
        struct cp2112gpio_softc *sc __diagused;
        int err;
        uint8_t mask;

        sc = device_get_softc(dev);
        CP2112GPIO_LOCKED(sc);

        err = cp2112_get_report(device_get_parent(dev),
            CP2112_REQ_GPIO_CFG, &data, sizeof(data));
        if (err != 0)
                return (err);

        mask = (uint8_t)1 << pin_num;
        if (output) {
                data.output |= mask;
                switch (*mode) {
                case OUT_PP:
                        data.pushpull |= mask;
                        break;
                case OUT_OD:
                        data.pushpull &= ~mask;
                        break;
                default:
                        break;
                }
        } else {
                data.output &= ~mask;
        }

        err = cp2112_set_report(device_get_parent(dev),
            CP2112_REQ_GPIO_CFG, &data, sizeof(data));
        if (err != 0)
                return (err);

        /* Read back and verify. */
        err = cp2112_get_report(device_get_parent(dev),
            CP2112_REQ_GPIO_CFG, &data, sizeof(data));
        if (err != 0)
                return (err);

        if (((data.output & mask) != 0) != output)
                return (EIO);
        if (output) {
                switch (*mode) {
                case OUT_PP:
                        if ((data.pushpull & mask) == 0)
                                return (EIO);
                        break;
                case OUT_OD:
                        if ((data.pushpull & mask) != 0)
                                return (EIO);
                        break;
                default:
                        *mode = (data.pushpull & mask) != 0 ?
                            OUT_PP : OUT_OD;
                        break;
                }
        }
        return (0);
}

static device_t
cp2112_gpio_get_bus(device_t dev)
{
        struct cp2112gpio_softc *sc;

        sc = device_get_softc(dev);
        return (sc->busdev);
}

static int
cp2112_gpio_pin_max(device_t dev, int *maxpin)
{

        *maxpin = CP2112_GPIO_COUNT - 1;
        return (0);
}

static int
cp2112_gpio_pin_set(device_t dev, uint32_t pin_num, uint32_t pin_value)
{
        struct cp2112gpio_softc *sc;
        int err;

        if (pin_num >= CP2112_GPIO_COUNT)
                return (EINVAL);

        sc = device_get_softc(dev);
        CP2112GPIO_LOCK(sc);
        err = cp2112_gpio_write_pin(dev, pin_num, pin_value != 0);
        CP2112GPIO_UNLOCK(sc);

        return (err);
}

static int
cp2112_gpio_pin_get(device_t dev, uint32_t pin_num, uint32_t *pin_value)
{
        struct cp2112gpio_softc *sc;
        int err;
        bool on;

        if (pin_num >= CP2112_GPIO_COUNT)
                return (EINVAL);

        sc = device_get_softc(dev);
        CP2112GPIO_LOCK(sc);
        err = cp2112_gpio_read_pin(dev, pin_num, &on);
        CP2112GPIO_UNLOCK(sc);

        if (err == 0)
                *pin_value = on;
        return (err);
}

static int
cp2112_gpio_pin_toggle(device_t dev, uint32_t pin_num)
{
        struct cp2112gpio_softc *sc;
        int err;
        bool on;

        if (pin_num >= CP2112_GPIO_COUNT)
                return (EINVAL);

        sc = device_get_softc(dev);
        CP2112GPIO_LOCK(sc);
        err = cp2112_gpio_read_pin(dev, pin_num, &on);
        if (err == 0)
                err = cp2112_gpio_write_pin(dev, pin_num, !on);
        CP2112GPIO_UNLOCK(sc);

        return (err);
}

static int
cp2112_gpio_pin_getcaps(device_t dev, uint32_t pin_num, uint32_t *caps)
{
        struct cp2112gpio_softc *sc;

        if (pin_num >= CP2112_GPIO_COUNT)
                return (EINVAL);

        sc = device_get_softc(dev);
        CP2112GPIO_LOCK(sc);
        *caps = sc->gpio_caps;
        CP2112GPIO_UNLOCK(sc);

        return (0);
}

static int
cp2112_gpio_pin_getflags(device_t dev, uint32_t pin_num, uint32_t *flags)
{
        struct cp2112gpio_softc *sc;

        if (pin_num >= CP2112_GPIO_COUNT)
                return (EINVAL);

        sc = device_get_softc(dev);
        CP2112GPIO_LOCK(sc);
        *flags = sc->pins[pin_num].gp_flags;
        CP2112GPIO_UNLOCK(sc);

        return (0);
}

static int
cp2112_gpio_pin_getname(device_t dev, uint32_t pin_num, char *name)
{
        struct cp2112gpio_softc *sc;

        if (pin_num >= CP2112_GPIO_COUNT)
                return (EINVAL);

        sc = device_get_softc(dev);
        CP2112GPIO_LOCK(sc);
        memcpy(name, sc->pins[pin_num].gp_name, GPIOMAXNAME);
        CP2112GPIO_UNLOCK(sc);

        return (0);
}

static int
cp2112_gpio_pin_setflags(device_t dev, uint32_t pin_num, uint32_t flags)
{
        struct cp2112gpio_softc *sc;
        struct gpio_pin *pin;
        enum cp2112_out_mode out_mode;
        int err;

        if (pin_num >= CP2112_GPIO_COUNT)
                return (EINVAL);

        sc = device_get_softc(dev);
        if ((flags & sc->gpio_caps) != flags)
                return (EINVAL);

        if ((flags & (GPIO_PIN_INPUT | GPIO_PIN_OUTPUT)) == 0)
                        return (EINVAL);
        if ((flags & (GPIO_PIN_INPUT | GPIO_PIN_OUTPUT)) ==
                (GPIO_PIN_INPUT | GPIO_PIN_OUTPUT)) {
                        return (EINVAL);
        }
        if ((flags & GPIO_PIN_INPUT) != 0) {
                if ((flags & (GPIO_PIN_OPENDRAIN | GPIO_PIN_PUSHPULL)) != 0)
                        return (EINVAL);
        } else {
                if ((flags & (GPIO_PIN_OPENDRAIN | GPIO_PIN_PUSHPULL)) ==
                    (GPIO_PIN_OPENDRAIN | GPIO_PIN_PUSHPULL))
                        return (EINVAL);
        }

        /*
         * If neither push-pull or open-drain is explicitly requested, then
         * preserve the current state.
         */
        out_mode = OUT_KEEP;
        if ((flags & GPIO_PIN_OUTPUT) != 0) {
                if ((flags & GPIO_PIN_OPENDRAIN) != 0)
                        out_mode = OUT_OD;
                if ((flags & GPIO_PIN_PUSHPULL) != 0)
                        out_mode = OUT_PP;
        }

        CP2112GPIO_LOCK(sc);
        pin = &sc->pins[pin_num];
        err = cp2112_gpio_configure_write_pin(dev, pin_num,
            (flags & GPIO_PIN_OUTPUT) != 0, &out_mode);
        if (err == 0) {
                /*
                 * If neither open-drain or push-pull was requested, then see
                 * what hardware actually had.  Otherwise, it has been
                 * reconfigured as requested.
                 */
                if ((flags & GPIO_PIN_OUTPUT) != 0 &&
                    (flags & (GPIO_PIN_OPENDRAIN | GPIO_PIN_PUSHPULL)) == 0) {
                        KASSERT(out_mode != OUT_KEEP,
                            ("impossible current output mode"));
                        if (out_mode == OUT_OD)
                                flags |= GPIO_PIN_OPENDRAIN;
                        else
                                flags |= GPIO_PIN_PUSHPULL;
                }
                pin->gp_flags = flags;
        }
        CP2112GPIO_UNLOCK(sc);

        return (err);
}

static int
cp2112gpio_probe(device_t dev)
{
        device_set_desc(dev, "CP2112 GPIO interface");
        return (BUS_PROBE_SPECIFIC);
}

static int
cp2112gpio_attach(device_t dev)
{
        struct gpio_config_req data;
        struct cp2112gpio_softc *sc;
        device_t cp2112;
        int err;
        int i;
        uint8_t mask;

        cp2112 = device_get_parent(dev);
        sc = device_get_softc(dev);
        sx_init(&sc->gpio_lock, "cp2112 lock");

        sc->gpio_caps = GPIO_PIN_INPUT | GPIO_PIN_OUTPUT | GPIO_PIN_OPENDRAIN |
            GPIO_PIN_PUSHPULL;

        err = cp2112_get_report(cp2112, CP2112_REQ_GPIO_CFG,
            &data, sizeof(data));
        if (err != 0)
                goto detach;

        for (i = 0; i < CP2112_GPIO_COUNT; i++) {
                struct gpio_pin *pin;

                mask = (uint8_t)1 << i;
                pin = &sc->pins[i];
                pin->gp_flags = 0;

                snprintf(pin->gp_name, GPIOMAXNAME, "GPIO%u", i);
                pin->gp_name[GPIOMAXNAME - 1] = '\0';

                if ((i == 0 && (data.special & CP2112_GPIO_SPEC_TX0) != 0) ||
                    (i == 1 && (data.special & CP2112_GPIO_SPEC_RX1) != 0) ||
                    (i == 7 && (data.special & CP2112_GPIO_SPEC_CLK7) != 0)) {
                        /* Special mode means that a pin is not for GPIO. */
                } else if ((data.output & mask) != 0) {
                        pin->gp_flags |= GPIO_PIN_OUTPUT;
                        if ((data.pushpull & mask) != 0)
                                pin->gp_flags |= GPIO_PIN_PUSHPULL;
                        else
                                pin->gp_flags |= GPIO_PIN_OPENDRAIN;
                } else {
                        pin->gp_flags |= GPIO_PIN_INPUT;
                }
        }

        sc->busdev = gpiobus_add_bus(dev);
        if (sc->busdev == NULL) {
                device_printf(dev, "gpiobus_add_bus failed\n");
                goto detach;
        }
        bus_attach_children(dev);
        return (0);

detach:
        cp2112gpio_detach(dev);
        return (ENXIO);
}

static int
cp2112gpio_detach(device_t dev)
{
        struct cp2112gpio_softc *sc;

        sc = device_get_softc(dev);
        if (sc->busdev != NULL)
                gpiobus_detach_bus(dev);
        sx_destroy(&sc->gpio_lock);
        return (0);
}

static void
cp2112iic_intr_write_callback(struct usb_xfer *xfer, usb_error_t error)
{
        struct cp2112iic_softc *sc;
        struct usb_page_cache *pc;

        sc = usbd_xfer_softc(xfer);

        mtx_assert(&sc->io.lock, MA_OWNED);

        switch (USB_GET_STATE(xfer)) {
        case USB_ST_SETUP:
                pc = usbd_xfer_get_frame(xfer, 0);
                usbd_copy_in(pc, 0, sc->io.out.data, sc->io.out.len);
                usbd_xfer_set_frame_len(xfer, 0, sc->io.out.len);
                usbd_xfer_set_frames(xfer, 1);
                usbd_transfer_submit(xfer);
                break;
        case USB_ST_TRANSFERRED:
                sc->io.out.error = 0;
                sc->io.out.done = 1;
                cv_signal(&sc->io.cv);
                break;
        default:                        /* Error */
                device_printf(sc->dev, "write intr state %d error %d\n",
                    USB_GET_STATE(xfer), error);
                sc->io.out.error = IIC_EBUSERR;
                cv_signal(&sc->io.cv);
                if (error != USB_ERR_CANCELLED) {
                        /* try to clear stall first */
                        usbd_xfer_set_stall(xfer);
                }
                break;
        }
}

static void
cp2112iic_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
{
        struct cp2112iic_softc *sc = usbd_xfer_softc(xfer);
        struct usb_page_cache *pc;
        int act_len, len;

        mtx_assert(&sc->io.lock, MA_OWNED);
        usbd_xfer_status(xfer, &act_len, NULL, NULL, NULL);

        switch (USB_GET_STATE(xfer)) {
        case USB_ST_TRANSFERRED:
                if (sc->io.in.done) {
                        device_printf(sc->dev,
                            "interrupt while previous is pending, ignored\n");
                } else if (sc->io.in.len == 0) {
                        uint8_t buf[8];

                        /*
                         * There is a spurious Transfer Status Response and
                         * zero-length Read Response during hardware
                         * configuration.  Possibly they carry some information
                         * about the initial bus state.
                         */
                        if (device_is_attached(sc->dev)) {
                                device_printf(sc->dev,
                                    "unsolicited interrupt, ignored\n");
                                if (bootverbose) {
                                        pc = usbd_xfer_get_frame(xfer, 0);
                                        len = MIN(sizeof(buf), act_len);
                                        usbd_copy_out(pc, 0, buf, len);
                                        device_printf(sc->dev, "data: %*D\n",
                                            len, buf, " ");
                                }
                        } else {
                                pc = usbd_xfer_get_frame(xfer, 0);
                                len = MIN(sizeof(buf), act_len);
                                usbd_copy_out(pc, 0, buf, len);
                                if (buf[0] == CP2112_REQ_SMB_XFER_STATUS_RESP) {
                                        device_printf(sc->dev,
                                            "initial bus status0 = 0x%02x, "
                                            "status1 = 0x%02x\n",
                                            buf[1], buf[2]);
                                }
                        }
                } else if (act_len == CP2112_REPORT_SIZE) {
                        pc = usbd_xfer_get_frame(xfer, 0);
                        usbd_copy_out(pc, 0, sc->io.in.data, sc->io.in.len);
                        sc->io.in.error = 0;
                        sc->io.in.done = 1;
                } else {
                        device_printf(sc->dev,
                            "unexpected input report length %u\n", act_len);
                        sc->io.in.error = IIC_EBUSERR;
                        sc->io.in.done = 1;
                }
                cv_signal(&sc->io.cv);
        case USB_ST_SETUP:
tr_setup:
                usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
                usbd_transfer_submit(xfer);
                break;

        default:                        /* Error */
                device_printf(sc->dev, "read intr state %d error %d\n",
                    USB_GET_STATE(xfer), error);

                sc->io.in.error = IIC_EBUSERR;
                sc->io.in.done = 1;
                cv_signal(&sc->io.cv);
                if (error != USB_ERR_CANCELLED) {
                        /* try to clear stall first */
                        usbd_xfer_set_stall(xfer);
                        goto tr_setup;
                }
                break;
        }
}

static const struct usb_config cp2112iic_config[CP2112_N_TRANSFER] = {
        [CP2112_INTR_OUT] = {
                .type = UE_INTERRUPT,
                .endpoint = UE_ADDR_ANY,
                .direction = UE_DIR_OUT,
                .flags = { .pipe_bof = 1, .no_pipe_ok = 1, },
                .bufsize = 0,   /* use wMaxPacketSize */
                .callback = &cp2112iic_intr_write_callback,
        },
        [CP2112_INTR_IN] = {
                .type = UE_INTERRUPT,
                .endpoint = UE_ADDR_ANY,
                .direction = UE_DIR_IN,
                .flags = { .pipe_bof = 1, .short_xfer_ok = 1, },
                .bufsize = 0,   /* use wMaxPacketSize */
                .callback = &cp2112iic_intr_read_callback,
        },
};

static int
cp2112iic_send_req(struct cp2112iic_softc *sc, const void *data,
    uint16_t len)
{
        int err;

        mtx_assert(&sc->io.lock, MA_OWNED);
        KASSERT(sc->io.out.done == 0, ("%s: conflicting request", __func__));

        sc->io.out.data = data;
        sc->io.out.len = len;

        DTRACE_PROBE1(send__req, uint8_t, *(const uint8_t *)data);

        usbd_transfer_start(sc->xfers[CP2112_INTR_OUT]);

        while (!sc->io.out.done)
                cv_wait(&sc->io.cv, &sc->io.lock);

        usbd_transfer_stop(sc->xfers[CP2112_INTR_OUT]);

        sc->io.out.done = 0;
        sc->io.out.data = NULL;
        sc->io.out.len = 0;
        err = sc->io.out.error;
        if (err != 0) {
                device_printf(sc->dev, "output report 0x%02x failed: %d\n",
                    *(const uint8_t*)data, err);
        }
        return (err);
}

static int
cp2112iic_req_resp(struct cp2112iic_softc *sc, const void *req_data,
    uint16_t req_len, void *resp_data, uint16_t resp_len)
{
        int err;

        mtx_assert(&sc->io.lock, MA_OWNED);

        /*
         * Prepare to receive a response interrupt even before the
         * request transfer is confirmed (USB_ST_TRANSFERED).
         */
        KASSERT(sc->io.in.done == 0, ("%s: conflicting request", __func__));
        sc->io.in.len = resp_len;
        sc->io.in.data = resp_data;

        err = cp2112iic_send_req(sc, req_data, req_len);
        if (err != 0) {
                sc->io.in.len = 0;
                sc->io.in.data = NULL;
                return (err);
        }

        while (!sc->io.in.done)
                cv_wait(&sc->io.cv, &sc->io.lock);

        err = sc->io.in.error;
        sc->io.in.done = 0;
        sc->io.in.error = 0;
        sc->io.in.len = 0;
        sc->io.in.data = NULL;
        return (err);
}

static int
cp2112iic_check_req_status(struct cp2112iic_softc *sc)
{
        struct i2c_xfer_status_req xfer_status_req;
        struct i2c_xfer_status_resp xfer_status_resp;
        int err;

        mtx_assert(&sc->io.lock, MA_OWNED);

        do {
                xfer_status_req.id = CP2112_REQ_SMB_XFER_STATUS_REQ;
                xfer_status_req.request = 1;
                err = cp2112iic_req_resp(sc,
                    &xfer_status_req, sizeof(xfer_status_req),
                    &xfer_status_resp, sizeof(xfer_status_resp));

                if (xfer_status_resp.id != CP2112_REQ_SMB_XFER_STATUS_RESP) {
                        device_printf(sc->dev,
                            "unexpected response 0x%02x to status request\n",
                            xfer_status_resp.id);
                        err = IIC_EBUSERR;
                        goto out;
                }

                DTRACE_PROBE4(xfer__status, uint8_t, xfer_status_resp.status0,
                    uint8_t, xfer_status_resp.status1,
                    uint16_t, be16toh(xfer_status_resp.status2),
                    uint16_t, be16toh(xfer_status_resp.status3));

                switch (xfer_status_resp.status0) {
                case CP2112_IIC_STATUS0_IDLE:
                        err = IIC_ESTATUS;
                        break;
                case CP2112_IIC_STATUS0_BUSY:
                        err = ERESTART; /* non-I2C, special handling */
                        break;
                case CP2112_IIC_STATUS0_CMP:
                        err = IIC_NOERR;
                        break;
                case CP2112_IIC_STATUS0_ERROR:
                        switch (xfer_status_resp.status1) {
                        case CP2112_IIC_STATUS1_TIMEOUT_NACK:
                                err = IIC_ENOACK;
                                break;
                        case CP2112_IIC_STATUS1_TIMEOUT_BUS:
                                err = IIC_ETIMEOUT;
                                break;
                        case CP2112_IIC_STATUS1_ARB_LOST:
                                err = IIC_EBUSBSY;
                                break;
                        default:
                                device_printf(sc->dev,
                                    "i2c error, status = 0x%02x\n",
                                    xfer_status_resp.status1);
                                err = IIC_ESTATUS;
                                break;
                        }
                        break;
                default:
                        device_printf(sc->dev,
                            "unknown i2c xfer status0 0x%02x\n",
                            xfer_status_resp.status0);
                        err = IIC_EBUSERR;
                        break;
                }

        } while (err == ERESTART);
out:
        return (err);
}

static int
cp2112iic_read_data(struct cp2112iic_softc *sc, void *data, uint16_t in_len,
    uint16_t *out_len)
{
        struct i2c_data_read_force_send_req data_read_force_send;
        struct i2c_data_read_resp data_read_resp;
        int err;

        mtx_assert(&sc->io.lock, MA_OWNED);

        /*
         * Prepare to receive a response interrupt even before the request
         * transfer is confirmed (USB_ST_TRANSFERED).
         */

        if (in_len > sizeof(data_read_resp.data))
                in_len = sizeof(data_read_resp.data);
        data_read_force_send.id = CP2112_REQ_SMB_READ_FORCE_SEND;
        data_read_force_send.len = htobe16(in_len);
        err = cp2112iic_req_resp(sc,
            &data_read_force_send, sizeof(data_read_force_send),
            &data_read_resp, sizeof(data_read_resp));
        if (err != 0)
                goto out;

        if (data_read_resp.id != CP2112_REQ_SMB_READ_RESPONSE) {
                device_printf(sc->dev,
                    "unexpected response 0x%02x to data read request\n",
                    data_read_resp.id);
                err = IIC_EBUSERR;
                goto out;
        }

        DTRACE_PROBE2(read__response, uint8_t, data_read_resp.status,
            uint8_t, data_read_resp.len);

        /*
         * We expect either the request completed status or, more typical for
         * this driver, the bus idle status because of the preceding
         * Force Read Status command (which is not an I2C request).
         */
        if (data_read_resp.status != CP2112_IIC_STATUS0_CMP &&
            data_read_resp.status != CP2112_IIC_STATUS0_IDLE) {
                err = IIC_EBUSERR;
                goto out;
        }
        if (data_read_resp.len > in_len) {
                device_printf(sc->dev, "device returns more data than asked\n");
                err = IIC_EOVERFLOW;
                goto out;
        }

        *out_len = data_read_resp.len;
        if (*out_len > 0)
                memcpy(data, data_read_resp.data, *out_len);
out:
        return (err);
}

static int
cp2112iic_transfer(device_t dev, struct iic_msg *msgs, uint32_t nmsgs)
{
        struct cp2112iic_softc *sc = device_get_softc(dev);
        struct cp2112_softc *psc = device_get_softc(device_get_parent(dev));
        const char *reason = NULL;
        uint32_t i;
        uint16_t read_off, to_read;
        int err;

        /*
         * The hardware interface imposes limits on allowed I2C messages.
         * It is not possible to explicitly send a start or stop.
         * It is not possible to do a zero length transfer.
         * For this reason it's impossible to send a message with no data
         * at all (like an SMBus quick message).
         * Each read or write transfer beginning with the start condition
         * and ends with the stop condition.  The only exception is that
         * it is possible to have a write transfer followed by a read
         * transfer to the same slave with the repeated start condition
         * between them.
         */
        for (i = 0; i < nmsgs; i++) {
                if (i == 0 && (msgs[i].flags & IIC_M_NOSTART) != 0) {
                        reason = "first message without start";
                        break;
                }
                if (i == nmsgs - 1 && (msgs[i].flags & IIC_M_NOSTOP) != 0) {
                        reason = "last message without stop";
                        break;
                }
                if (msgs[i].len == 0) {
                        reason = "message with no data";
                        break;
                }
                if ((msgs[i].flags & IIC_M_RD) != 0 &&
                    msgs[i].len > CP2112_IIC_MAX_READ_LEN) {
                        reason = "too long read";
                        break;
                }
                if ((msgs[i].flags & IIC_M_RD) == 0 &&
                    msgs[i].len > SIZEOF_FIELD(i2c_write_req, data)) {
                        reason = "too long write";
                        break;
                }
                if ((msgs[i].flags & IIC_M_NOSTART) != 0) {
                        reason = "message without start or repeated start";
                        break;
                }
                if ((msgs[i].flags & IIC_M_NOSTOP) != 0 &&
                    (msgs[i].flags & IIC_M_RD) != 0) {
                        reason = "read without stop";
                        break;
                }
                if ((msgs[i].flags & IIC_M_NOSTOP) != 0 &&
                    psc->sc_version < CP2112_IIC_REPSTART_VER) {
                        reason = "write without stop";
                        break;
                }
                if ((msgs[i].flags & IIC_M_NOSTOP) != 0 &&
                    msgs[i].len > SIZEOF_FIELD(i2c_write_read_req, wdata)) {
                        reason = "too long write without stop";
                        break;
                }
                if (i > 0) {
                        if ((msgs[i - 1].flags & IIC_M_NOSTOP) != 0 &&
                            msgs[i].slave != msgs[i - 1].slave) {
                                reason = "change of slave without stop";
                                break;
                        }
                        if ((msgs[i - 1].flags & IIC_M_NOSTOP) != 0 &&
                            (msgs[i].flags & IIC_M_RD) == 0) {
                                reason = "write after repeated start";
                                break;
                        }
                }
        }
        if (reason != NULL) {
                if (bootverbose)
                        device_printf(dev, "unsupported i2c message: %s\n",
                            reason);
                return (IIC_ENOTSUPP);
        }

        mtx_lock(&sc->io.lock);

        for (i = 0; i < nmsgs; i++) {
                if (i + 1 < nmsgs && (msgs[i].flags & IIC_M_NOSTOP) != 0) {
                        /*
                         * Combine <write><repeated start><read> into a single
                         * CP2112 operation.
                         */
                        struct i2c_write_read_req req;

                        KASSERT((msgs[i].flags & IIC_M_RD) == 0,
                            ("read without stop"));
                        KASSERT((msgs[i + 1].flags & IIC_M_RD) != 0,
                            ("write after write without stop"));
                        req.id = CP2112_REQ_SMB_WRITE_READ;
                        req.slave = msgs[i].slave & ~LSB;
                        to_read = msgs[i + 1].len;
                        req.rlen = htobe16(to_read);
                        req.wlen = msgs[i].len;
                        memcpy(req.wdata, msgs[i].buf, msgs[i].len);
                        err = cp2112iic_send_req(sc, &req, msgs[i].len + 5);

                        /*
                         * The next message is already handled.
                         * Also needed for read data to go into the right msg.
                         */
                        i++;
                } else if ((msgs[i].flags & IIC_M_RD) != 0) {
                        struct i2c_read_req req;

                        req.id = CP2112_REQ_SMB_READ;
                        req.slave = msgs[i].slave & ~LSB;
                        to_read = msgs[i].len;
                        req.len = htobe16(to_read);
                        err = cp2112iic_send_req(sc, &req, sizeof(req));
                } else {
                        struct i2c_write_req req;

                        req.id = CP2112_REQ_SMB_WRITE;
                        req.slave = msgs[i].slave & ~LSB;
                        req.len = msgs[i].len;
                        memcpy(req.data, msgs[i].buf, msgs[i].len);
                        to_read = 0;
                        err = cp2112iic_send_req(sc, &req, msgs[i].len + 3);
                }
                if (err != 0)
                        break;

                err = cp2112iic_check_req_status(sc);
                if (err != 0)
                        break;

                read_off = 0;
                while (to_read > 0) {
                        uint16_t act_read;

                        err = cp2112iic_read_data(sc, msgs[i].buf + read_off,
                            to_read, &act_read);
                        if (err != 0)
                                break;
                        KASSERT(act_read <= to_read, ("cp2112iic_read_data "
                            "returned more data than asked"));
                        read_off += act_read;
                        to_read -= act_read;
                }
                if (err != 0)
                        break;
        }

        mtx_unlock(&sc->io.lock);
        return (err);
}

static int
cp2112iic_reset(device_t dev, u_char speed, u_char addr, u_char *oldaddr)
{
        struct i2c_cfg_req i2c_cfg;
        struct cp2112iic_softc *sc;
        device_t cp2112;
        u_int busfreq;
        int err;

        sc = device_get_softc(dev);
        cp2112 = device_get_parent(dev);
        if (sc->iicbus_dev == NULL)
                busfreq = 100000;
        else
                busfreq = IICBUS_GET_FREQUENCY(sc->iicbus_dev, speed);

        err = cp2112_get_report(cp2112, CP2112_REQ_SMB_CFG,
            &i2c_cfg, sizeof(i2c_cfg));
        if (err != 0) {
                device_printf(dev, "failed to get CP2112_REQ_SMB_CFG report\n");
                return (err);
        }

        if (oldaddr != NULL)
                *oldaddr = i2c_cfg.slave_addr;
        /*
         * For simplicity we do not enable Auto Send Read
         * because of erratum CP2112_E101 (fixed in version 3).
         *
         * TODO: set I2C parameters based on configuration preferences:
         * - read and write timeouts (no timeout by default),
         * - SCL low timeout (disabled by default),
         * etc.
         *
         * TODO: should the device reset request (0x01) be sent?
         * If the device disconnects as a result, then no.
         */
        i2c_cfg.speed = htobe32(busfreq);
        if (addr != 0)
                i2c_cfg.slave_addr = addr;
        i2c_cfg.auto_send_read = 0;
        i2c_cfg.retry_count = htobe16(1);
        i2c_cfg.scl_low_timeout = 0;
        if (bootverbose) {
                device_printf(dev, "speed %d Hz\n", be32toh(i2c_cfg.speed));
                device_printf(dev, "slave addr 0x%02x\n", i2c_cfg.slave_addr);
                device_printf(dev, "auto send read %s\n",
                    i2c_cfg.auto_send_read ? "on" : "off");
                device_printf(dev, "write timeout %d ms (0 - disabled)\n",
                    be16toh(i2c_cfg.write_timeout));
                device_printf(dev, "read timeout %d ms (0 - disabled)\n",
                    be16toh(i2c_cfg.read_timeout));
                device_printf(dev, "scl low timeout %s\n",
                    i2c_cfg.scl_low_timeout ? "on" : "off");
                device_printf(dev, "retry count %d (0 - no limit)\n",
                    be16toh(i2c_cfg.retry_count));
        }
        err = cp2112_set_report(cp2112, CP2112_REQ_SMB_CFG,
            &i2c_cfg, sizeof(i2c_cfg));
        if (err != 0) {
                device_printf(dev, "failed to set CP2112_REQ_SMB_CFG report\n");
                return (err);
        }
        return (0);
}

static int
cp2112iic_probe(device_t dev)
{
        device_set_desc(dev, "CP2112 I2C interface");
        return (BUS_PROBE_SPECIFIC);
}

static int
cp2112iic_attach(device_t dev)
{
        struct cp2112iic_softc *sc;
        struct cp2112_softc *psc;
        device_t cp2112;
        int err;

        sc = device_get_softc(dev);
        sc->dev = dev;
        cp2112 = device_get_parent(dev);
        psc = device_get_softc(cp2112);

        mtx_init(&sc->io.lock, "cp2112iic lock", NULL, MTX_DEF | MTX_RECURSE);
        cv_init(&sc->io.cv, "cp2112iic cv");

        err = usbd_transfer_setup(psc->sc_udev,
            &psc->sc_iface_index, sc->xfers, cp2112iic_config,
            nitems(cp2112iic_config), sc, &sc->io.lock);
        if (err != 0) {
                device_printf(dev, "usbd_transfer_setup failed %d\n", err);
                goto detach;
        }

        /* Prepare to receive interrupts. */
        mtx_lock(&sc->io.lock);
        usbd_transfer_start(sc->xfers[CP2112_INTR_IN]);
        mtx_unlock(&sc->io.lock);

        sc->iicbus_dev = device_add_child(dev, "iicbus", DEVICE_UNIT_ANY);
        if (sc->iicbus_dev == NULL) {
                device_printf(dev, "iicbus creation failed\n");
                err = ENXIO;
                goto detach;
        }
        bus_attach_children(dev);
        return (0);

detach:
        cp2112iic_detach(dev);
        return (err);
}

static int
cp2112iic_detach(device_t dev)
{
        struct cp2112iic_softc *sc;
        int err;

        sc = device_get_softc(dev);
        err = bus_generic_detach(dev);
        if (err != 0)
                return (err);

        mtx_lock(&sc->io.lock);
        usbd_transfer_stop(sc->xfers[CP2112_INTR_IN]);
        mtx_unlock(&sc->io.lock);
        usbd_transfer_unsetup(sc->xfers, nitems(cp2112iic_config));

        cv_destroy(&sc->io.cv);
        mtx_destroy(&sc->io.lock);

        return (0);
}

static device_method_t cp2112hid_methods[] = {
        DEVMETHOD(device_probe,         cp2112_probe),
        DEVMETHOD(device_attach,        cp2112_attach),
        DEVMETHOD(device_detach,        bus_generic_detach),

        DEVMETHOD_END
};

static driver_t cp2112hid_driver = {
        .name = "cp2112hid",
        .methods = cp2112hid_methods,
        .size = sizeof(struct cp2112_softc),
};

DRIVER_MODULE(cp2112hid, uhub, cp2112hid_driver, NULL, NULL);
MODULE_DEPEND(cp2112hid, usb, 1, 1, 1);
MODULE_VERSION(cp2112hid, 1);
USB_PNP_HOST_INFO(cp2112_devs);

static device_method_t cp2112gpio_methods[] = {
        /* Device */
        DEVMETHOD(device_probe,         cp2112gpio_probe),
        DEVMETHOD(device_attach,        cp2112gpio_attach),
        DEVMETHOD(device_detach,        cp2112gpio_detach),

        /* GPIO */
        DEVMETHOD(gpio_get_bus,         cp2112_gpio_get_bus),
        DEVMETHOD(gpio_pin_max,         cp2112_gpio_pin_max),
        DEVMETHOD(gpio_pin_get,         cp2112_gpio_pin_get),
        DEVMETHOD(gpio_pin_set,         cp2112_gpio_pin_set),
        DEVMETHOD(gpio_pin_toggle,      cp2112_gpio_pin_toggle),
        DEVMETHOD(gpio_pin_getname,     cp2112_gpio_pin_getname),
        DEVMETHOD(gpio_pin_getcaps,     cp2112_gpio_pin_getcaps),
        DEVMETHOD(gpio_pin_getflags,    cp2112_gpio_pin_getflags),
        DEVMETHOD(gpio_pin_setflags,    cp2112_gpio_pin_setflags),

        DEVMETHOD_END
};

static driver_t cp2112gpio_driver = {
        .name = "gpio",
        .methods = cp2112gpio_methods,
        .size = sizeof(struct cp2112gpio_softc),
};

DRIVER_MODULE(cp2112gpio, cp2112hid, cp2112gpio_driver, NULL, NULL);
MODULE_DEPEND(cp2112gpio, cp2112hid, 1, 1, 1);
MODULE_DEPEND(cp2112gpio, gpiobus, 1, 1, 1);
MODULE_VERSION(cp2112gpio, 1);

static device_method_t cp2112iic_methods[] = {
        /* Device interface */
        DEVMETHOD(device_probe, cp2112iic_probe),
        DEVMETHOD(device_attach, cp2112iic_attach),
        DEVMETHOD(device_detach, cp2112iic_detach),

        /* I2C methods */
        DEVMETHOD(iicbus_transfer, cp2112iic_transfer),
        DEVMETHOD(iicbus_reset, cp2112iic_reset),
        DEVMETHOD(iicbus_callback, iicbus_null_callback),

        DEVMETHOD_END
};

static driver_t cp2112iic_driver = {
        "iichb",
        cp2112iic_methods,
        sizeof(struct cp2112iic_softc)
};

DRIVER_MODULE(cp2112iic, cp2112hid, cp2112iic_driver, NULL, NULL);
MODULE_DEPEND(cp2112iic, cp2112hid, 1, 1, 1);
MODULE_DEPEND(cp2112iic, iicbus, IICBUS_MINVER, IICBUS_PREFVER, IICBUS_MAXVER);
MODULE_VERSION(cp2112iic, 1);