1/* $FreeBSD: stable/11/sys/compat/linuxkpi/common/src/linux_usb.c 368827 2020-12-30 01:11:12Z hselasky $ */
2/*-
3 * Copyright (c) 2007 Luigi Rizzo - Universita` di Pisa. All rights reserved.
4 * Copyright (c) 2007 Hans Petter Selasky. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 */
27
28#ifdef USB_GLOBAL_INCLUDE_FILE
29#include USB_GLOBAL_INCLUDE_FILE
30#else
31#include <sys/stdint.h>
32#include <sys/stddef.h>
33#include <sys/param.h>
34#include <sys/queue.h>
35#include <sys/types.h>
36#include <sys/systm.h>
37#include <sys/kernel.h>
38#include <sys/bus.h>
39#include <sys/module.h>
40#include <sys/lock.h>
41#include <sys/mutex.h>
42#include <sys/condvar.h>
43#include <sys/sysctl.h>
44#include <sys/sx.h>
45#include <sys/unistd.h>
46#include <sys/callout.h>
47#include <sys/malloc.h>
48#include <sys/priv.h>
49
50#include <dev/usb/usb.h>
51#include <dev/usb/usbdi.h>
52#include <dev/usb/usbdi_util.h>
53
54#define	USB_DEBUG_VAR usb_debug
55
56#include <dev/usb/usb_core.h>
57#include <linux/usb.h>
58#include <dev/usb/usb_process.h>
59#include <dev/usb/usb_device.h>
60#include <dev/usb/usb_util.h>
61#include <dev/usb/usb_busdma.h>
62#include <dev/usb/usb_transfer.h>
63#include <dev/usb/usb_hub.h>
64#include <dev/usb/usb_request.h>
65#include <dev/usb/usb_debug.h>
66#include <dev/usb/usb_dynamic.h>
67#endif			/* USB_GLOBAL_INCLUDE_FILE */
68
69struct usb_linux_softc {
70	LIST_ENTRY(usb_linux_softc) sc_attached_list;
71
72	device_t sc_fbsd_dev;
73	struct usb_device *sc_fbsd_udev;
74	struct usb_interface *sc_ui;
75	struct usb_driver *sc_udrv;
76};
77
78/* prototypes */
79static device_probe_t usb_linux_probe;
80static device_attach_t usb_linux_attach;
81static device_detach_t usb_linux_detach;
82static device_suspend_t usb_linux_suspend;
83static device_resume_t usb_linux_resume;
84
85static usb_callback_t usb_linux_isoc_callback;
86static usb_callback_t usb_linux_non_isoc_callback;
87
88static usb_complete_t usb_linux_wait_complete;
89
90static uint16_t	usb_max_isoc_frames(struct usb_device *);
91static int	usb_start_wait_urb(struct urb *, usb_timeout_t, uint16_t *);
92static const struct usb_device_id *usb_linux_lookup_id(
93		    const struct usb_device_id *, struct usb_attach_arg *);
94static struct	usb_driver *usb_linux_get_usb_driver(struct usb_linux_softc *);
95static int	usb_linux_create_usb_device(struct usb_device *, device_t);
96static void	usb_linux_cleanup_interface(struct usb_device *,
97		    struct usb_interface *);
98static void	usb_linux_complete(struct usb_xfer *);
99static int	usb_unlink_urb_sub(struct urb *, uint8_t);
100
101/*------------------------------------------------------------------------*
102 * FreeBSD USB interface
103 *------------------------------------------------------------------------*/
104
105static LIST_HEAD(, usb_linux_softc) usb_linux_attached_list;
106static LIST_HEAD(, usb_driver) usb_linux_driver_list;
107
108static device_method_t usb_linux_methods[] = {
109	/* Device interface */
110	DEVMETHOD(device_probe, usb_linux_probe),
111	DEVMETHOD(device_attach, usb_linux_attach),
112	DEVMETHOD(device_detach, usb_linux_detach),
113	DEVMETHOD(device_suspend, usb_linux_suspend),
114	DEVMETHOD(device_resume, usb_linux_resume),
115
116	DEVMETHOD_END
117};
118
119static driver_t usb_linux_driver = {
120	.name = "usb_linux",
121	.methods = usb_linux_methods,
122	.size = sizeof(struct usb_linux_softc),
123};
124
125static devclass_t usb_linux_devclass;
126
127DRIVER_MODULE(usb_linux, uhub, usb_linux_driver, usb_linux_devclass, NULL, 0);
128MODULE_VERSION(usb_linux, 1);
129
130/*------------------------------------------------------------------------*
131 *	usb_linux_lookup_id
132 *
133 * This functions takes an array of "struct usb_device_id" and tries
134 * to match the entries with the information in "struct usb_attach_arg".
135 * If it finds a match the matching entry will be returned.
136 * Else "NULL" will be returned.
137 *------------------------------------------------------------------------*/
138static const struct usb_device_id *
139usb_linux_lookup_id(const struct usb_device_id *id, struct usb_attach_arg *uaa)
140{
141	if (id == NULL) {
142		goto done;
143	}
144	/*
145	 * Keep on matching array entries until we find one with
146	 * "match_flags" equal to zero, which indicates the end of the
147	 * array:
148	 */
149	for (; id->match_flags; id++) {
150
151		if ((id->match_flags & USB_DEVICE_ID_MATCH_VENDOR) &&
152		    (id->idVendor != uaa->info.idVendor)) {
153			continue;
154		}
155		if ((id->match_flags & USB_DEVICE_ID_MATCH_PRODUCT) &&
156		    (id->idProduct != uaa->info.idProduct)) {
157			continue;
158		}
159		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_LO) &&
160		    (id->bcdDevice_lo > uaa->info.bcdDevice)) {
161			continue;
162		}
163		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_HI) &&
164		    (id->bcdDevice_hi < uaa->info.bcdDevice)) {
165			continue;
166		}
167		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_CLASS) &&
168		    (id->bDeviceClass != uaa->info.bDeviceClass)) {
169			continue;
170		}
171		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_SUBCLASS) &&
172		    (id->bDeviceSubClass != uaa->info.bDeviceSubClass)) {
173			continue;
174		}
175		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_PROTOCOL) &&
176		    (id->bDeviceProtocol != uaa->info.bDeviceProtocol)) {
177			continue;
178		}
179		if ((uaa->info.bDeviceClass == 0xFF) &&
180		    !(id->match_flags & USB_DEVICE_ID_MATCH_VENDOR) &&
181		    (id->match_flags & (USB_DEVICE_ID_MATCH_INT_CLASS |
182		    USB_DEVICE_ID_MATCH_INT_SUBCLASS |
183		    USB_DEVICE_ID_MATCH_INT_PROTOCOL))) {
184			continue;
185		}
186		if ((id->match_flags & USB_DEVICE_ID_MATCH_INT_CLASS) &&
187		    (id->bInterfaceClass != uaa->info.bInterfaceClass)) {
188			continue;
189		}
190		if ((id->match_flags & USB_DEVICE_ID_MATCH_INT_SUBCLASS) &&
191		    (id->bInterfaceSubClass != uaa->info.bInterfaceSubClass)) {
192			continue;
193		}
194		if ((id->match_flags & USB_DEVICE_ID_MATCH_INT_PROTOCOL) &&
195		    (id->bInterfaceProtocol != uaa->info.bInterfaceProtocol)) {
196			continue;
197		}
198		/* we found a match! */
199		return (id);
200	}
201
202done:
203	return (NULL);
204}
205
206/*------------------------------------------------------------------------*
207 *	usb_linux_probe
208 *
209 * This function is the FreeBSD probe callback. It is called from the
210 * FreeBSD USB stack through the "device_probe_and_attach()" function.
211 *------------------------------------------------------------------------*/
212static int
213usb_linux_probe(device_t dev)
214{
215	struct usb_attach_arg *uaa = device_get_ivars(dev);
216	struct usb_driver *udrv;
217	int err = ENXIO;
218
219	if (uaa->usb_mode != USB_MODE_HOST) {
220		return (ENXIO);
221	}
222	mtx_lock(&Giant);
223	LIST_FOREACH(udrv, &usb_linux_driver_list, linux_driver_list) {
224		if (usb_linux_lookup_id(udrv->id_table, uaa)) {
225			err = 0;
226			break;
227		}
228	}
229	mtx_unlock(&Giant);
230
231	return (err);
232}
233
234/*------------------------------------------------------------------------*
235 *	usb_linux_get_usb_driver
236 *
237 * This function returns the pointer to the "struct usb_driver" where
238 * the Linux USB device driver "struct usb_device_id" match was found.
239 * We apply a lock before reading out the pointer to avoid races.
240 *------------------------------------------------------------------------*/
241static struct usb_driver *
242usb_linux_get_usb_driver(struct usb_linux_softc *sc)
243{
244	struct usb_driver *udrv;
245
246	mtx_lock(&Giant);
247	udrv = sc->sc_udrv;
248	mtx_unlock(&Giant);
249	return (udrv);
250}
251
252/*------------------------------------------------------------------------*
253 *	usb_linux_attach
254 *
255 * This function is the FreeBSD attach callback. It is called from the
256 * FreeBSD USB stack through the "device_probe_and_attach()" function.
257 * This function is called when "usb_linux_probe()" returns zero.
258 *------------------------------------------------------------------------*/
259static int
260usb_linux_attach(device_t dev)
261{
262	struct usb_attach_arg *uaa = device_get_ivars(dev);
263	struct usb_linux_softc *sc = device_get_softc(dev);
264	struct usb_driver *udrv;
265	const struct usb_device_id *id = NULL;
266
267	mtx_lock(&Giant);
268	LIST_FOREACH(udrv, &usb_linux_driver_list, linux_driver_list) {
269		id = usb_linux_lookup_id(udrv->id_table, uaa);
270		if (id)
271			break;
272	}
273	mtx_unlock(&Giant);
274
275	if (id == NULL) {
276		return (ENXIO);
277	}
278	if (usb_linux_create_usb_device(uaa->device, dev) != 0)
279		return (ENOMEM);
280	device_set_usb_desc(dev);
281
282	sc->sc_fbsd_udev = uaa->device;
283	sc->sc_fbsd_dev = dev;
284	sc->sc_udrv = udrv;
285	sc->sc_ui = usb_ifnum_to_if(uaa->device, uaa->info.bIfaceNum);
286	if (sc->sc_ui == NULL) {
287		return (EINVAL);
288	}
289	if (udrv->probe) {
290		if ((udrv->probe) (sc->sc_ui, id)) {
291			return (ENXIO);
292		}
293	}
294	mtx_lock(&Giant);
295	LIST_INSERT_HEAD(&usb_linux_attached_list, sc, sc_attached_list);
296	mtx_unlock(&Giant);
297
298	/* success */
299	return (0);
300}
301
302/*------------------------------------------------------------------------*
303 *	usb_linux_detach
304 *
305 * This function is the FreeBSD detach callback. It is called from the
306 * FreeBSD USB stack through the "device_detach()" function.
307 *------------------------------------------------------------------------*/
308static int
309usb_linux_detach(device_t dev)
310{
311	struct usb_linux_softc *sc = device_get_softc(dev);
312	struct usb_driver *udrv = NULL;
313
314	mtx_lock(&Giant);
315	if (sc->sc_attached_list.le_prev) {
316		LIST_REMOVE(sc, sc_attached_list);
317		sc->sc_attached_list.le_prev = NULL;
318		udrv = sc->sc_udrv;
319		sc->sc_udrv = NULL;
320	}
321	mtx_unlock(&Giant);
322
323	if (udrv && udrv->disconnect) {
324		(udrv->disconnect) (sc->sc_ui);
325	}
326	/*
327	 * Make sure that we free all FreeBSD USB transfers belonging to
328	 * this Linux "usb_interface", hence they will most likely not be
329	 * needed any more.
330	 */
331	usb_linux_cleanup_interface(sc->sc_fbsd_udev, sc->sc_ui);
332	return (0);
333}
334
335/*------------------------------------------------------------------------*
336 *	usb_linux_suspend
337 *
338 * This function is the FreeBSD suspend callback. Usually it does nothing.
339 *------------------------------------------------------------------------*/
340static int
341usb_linux_suspend(device_t dev)
342{
343	struct usb_linux_softc *sc = device_get_softc(dev);
344	struct usb_driver *udrv = usb_linux_get_usb_driver(sc);
345	int err;
346
347	if (udrv && udrv->suspend) {
348		err = (udrv->suspend) (sc->sc_ui, 0);
349	}
350	return (0);
351}
352
353/*------------------------------------------------------------------------*
354 *	usb_linux_resume
355 *
356 * This function is the FreeBSD resume callback. Usually it does nothing.
357 *------------------------------------------------------------------------*/
358static int
359usb_linux_resume(device_t dev)
360{
361	struct usb_linux_softc *sc = device_get_softc(dev);
362	struct usb_driver *udrv = usb_linux_get_usb_driver(sc);
363	int err;
364
365	if (udrv && udrv->resume) {
366		err = (udrv->resume) (sc->sc_ui);
367	}
368	return (0);
369}
370
371/*------------------------------------------------------------------------*
372 * Linux emulation layer
373 *------------------------------------------------------------------------*/
374
375/*------------------------------------------------------------------------*
376 *	usb_max_isoc_frames
377 *
378 * The following function returns the maximum number of isochronous
379 * frames that we support per URB. It is not part of the Linux USB API.
380 *------------------------------------------------------------------------*/
381static uint16_t
382usb_max_isoc_frames(struct usb_device *dev)
383{
384	;				/* indent fix */
385	switch (usbd_get_speed(dev)) {
386	case USB_SPEED_LOW:
387	case USB_SPEED_FULL:
388		return (USB_MAX_FULL_SPEED_ISOC_FRAMES);
389	default:
390		return (USB_MAX_HIGH_SPEED_ISOC_FRAMES);
391	}
392}
393
394/*------------------------------------------------------------------------*
395 *	usb_submit_urb
396 *
397 * This function is used to queue an URB after that it has been
398 * initialized. If it returns non-zero, it means that the URB was not
399 * queued.
400 *------------------------------------------------------------------------*/
401int
402usb_submit_urb(struct urb *urb, uint16_t mem_flags)
403{
404	struct usb_host_endpoint *uhe;
405	uint8_t do_unlock;
406	int err;
407
408	if (urb == NULL)
409		return (-EINVAL);
410
411	do_unlock = mtx_owned(&Giant) ? 0 : 1;
412	if (do_unlock)
413		mtx_lock(&Giant);
414
415	if (urb->endpoint == NULL) {
416		err = -EINVAL;
417		goto done;
418	}
419
420	/*
421	 * Check to see if the urb is in the process of being killed
422	 * and stop a urb that is in the process of being killed from
423	 * being re-submitted (e.g. from its completion callback
424	 * function).
425	 */
426	if (urb->kill_count != 0) {
427		err = -EPERM;
428		goto done;
429	}
430
431	uhe = urb->endpoint;
432
433	/*
434	 * Check that we have got a FreeBSD USB transfer that will dequeue
435	 * the URB structure and do the real transfer. If there are no USB
436	 * transfers, then we return an error.
437	 */
438	if (uhe->bsd_xfer[0] ||
439	    uhe->bsd_xfer[1]) {
440		/* we are ready! */
441
442		TAILQ_INSERT_TAIL(&uhe->bsd_urb_list, urb, bsd_urb_list);
443
444		urb->status = -EINPROGRESS;
445
446		usbd_transfer_start(uhe->bsd_xfer[0]);
447		usbd_transfer_start(uhe->bsd_xfer[1]);
448		err = 0;
449	} else {
450		/* no pipes have been setup yet! */
451		urb->status = -EINVAL;
452		err = -EINVAL;
453	}
454done:
455	if (do_unlock)
456		mtx_unlock(&Giant);
457	return (err);
458}
459
460/*------------------------------------------------------------------------*
461 *	usb_unlink_urb
462 *
463 * This function is used to stop an URB after that it is been
464 * submitted, but before the "complete" callback has been called. On
465 *------------------------------------------------------------------------*/
466int
467usb_unlink_urb(struct urb *urb)
468{
469	return (usb_unlink_urb_sub(urb, 0));
470}
471
472static void
473usb_unlink_bsd(struct usb_xfer *xfer,
474    struct urb *urb, uint8_t drain)
475{
476	if (xfer == NULL)
477		return;
478	if (!usbd_transfer_pending(xfer))
479		return;
480	if (xfer->priv_fifo == (void *)urb) {
481		if (drain) {
482			mtx_unlock(&Giant);
483			usbd_transfer_drain(xfer);
484			mtx_lock(&Giant);
485		} else {
486			usbd_transfer_stop(xfer);
487		}
488		usbd_transfer_start(xfer);
489	}
490}
491
492static int
493usb_unlink_urb_sub(struct urb *urb, uint8_t drain)
494{
495	struct usb_host_endpoint *uhe;
496	uint16_t x;
497	uint8_t do_unlock;
498	int err;
499
500	if (urb == NULL)
501		return (-EINVAL);
502
503	do_unlock = mtx_owned(&Giant) ? 0 : 1;
504	if (do_unlock)
505		mtx_lock(&Giant);
506	if (drain)
507		urb->kill_count++;
508
509	if (urb->endpoint == NULL) {
510		err = -EINVAL;
511		goto done;
512	}
513	uhe = urb->endpoint;
514
515	if (urb->bsd_urb_list.tqe_prev) {
516
517		/* not started yet, just remove it from the queue */
518		TAILQ_REMOVE(&uhe->bsd_urb_list, urb, bsd_urb_list);
519		urb->bsd_urb_list.tqe_prev = NULL;
520		urb->status = -ECONNRESET;
521		urb->actual_length = 0;
522
523		for (x = 0; x < urb->number_of_packets; x++) {
524			urb->iso_frame_desc[x].actual_length = 0;
525		}
526
527		if (urb->complete) {
528			(urb->complete) (urb);
529		}
530	} else {
531
532		/*
533		 * If the URB is not on the URB list, then check if one of
534		 * the FreeBSD USB transfer are processing the current URB.
535		 * If so, re-start that transfer, which will lead to the
536		 * termination of that URB:
537		 */
538		usb_unlink_bsd(uhe->bsd_xfer[0], urb, drain);
539		usb_unlink_bsd(uhe->bsd_xfer[1], urb, drain);
540	}
541	err = 0;
542done:
543	if (drain)
544		urb->kill_count--;
545	if (do_unlock)
546		mtx_unlock(&Giant);
547	return (err);
548}
549
550/*------------------------------------------------------------------------*
551 *	usb_clear_halt
552 *
553 * This function must always be used to clear the stall. Stall is when
554 * an USB endpoint returns a stall message to the USB host controller.
555 * Until the stall is cleared, no data can be transferred.
556 *------------------------------------------------------------------------*/
557int
558usb_clear_halt(struct usb_device *dev, struct usb_host_endpoint *uhe)
559{
560	struct usb_config cfg[1];
561	struct usb_endpoint *ep;
562	uint8_t type;
563	uint8_t addr;
564
565	if (uhe == NULL)
566		return (-EINVAL);
567
568	type = uhe->desc.bmAttributes & UE_XFERTYPE;
569	addr = uhe->desc.bEndpointAddress;
570
571	memset(cfg, 0, sizeof(cfg));
572
573	cfg[0].type = type;
574	cfg[0].endpoint = addr & UE_ADDR;
575	cfg[0].direction = addr & (UE_DIR_OUT | UE_DIR_IN);
576
577	ep = usbd_get_endpoint(dev, uhe->bsd_iface_index, cfg);
578	if (ep == NULL)
579		return (-EINVAL);
580
581	usbd_clear_data_toggle(dev, ep);
582
583	return (usb_control_msg(dev, &dev->ep0,
584	    UR_CLEAR_FEATURE, UT_WRITE_ENDPOINT,
585	    UF_ENDPOINT_HALT, addr, NULL, 0, 1000));
586}
587
588/*------------------------------------------------------------------------*
589 *	usb_start_wait_urb
590 *
591 * This is an internal function that is used to perform synchronous
592 * Linux USB transfers.
593 *------------------------------------------------------------------------*/
594static int
595usb_start_wait_urb(struct urb *urb, usb_timeout_t timeout, uint16_t *p_actlen)
596{
597	int err;
598	uint8_t do_unlock;
599
600	/* you must have a timeout! */
601	if (timeout == 0) {
602		timeout = 1;
603	}
604	urb->complete = &usb_linux_wait_complete;
605	urb->timeout = timeout;
606	urb->transfer_flags |= URB_WAIT_WAKEUP;
607	urb->transfer_flags &= ~URB_IS_SLEEPING;
608
609	do_unlock = mtx_owned(&Giant) ? 0 : 1;
610	if (do_unlock)
611		mtx_lock(&Giant);
612	err = usb_submit_urb(urb, 0);
613	if (err)
614		goto done;
615
616	/*
617	 * the URB might have completed before we get here, so check that by
618	 * using some flags!
619	 */
620	while (urb->transfer_flags & URB_WAIT_WAKEUP) {
621		urb->transfer_flags |= URB_IS_SLEEPING;
622		cv_wait(&urb->cv_wait, &Giant);
623		urb->transfer_flags &= ~URB_IS_SLEEPING;
624	}
625
626	err = urb->status;
627
628done:
629	if (do_unlock)
630		mtx_unlock(&Giant);
631	if (p_actlen != NULL) {
632		if (err)
633			*p_actlen = 0;
634		else
635			*p_actlen = urb->actual_length;
636	}
637	return (err);
638}
639
640/*------------------------------------------------------------------------*
641 *	usb_control_msg
642 *
643 * The following function performs a control transfer sequence one any
644 * control, bulk or interrupt endpoint, specified by "uhe". A control
645 * transfer means that you transfer an 8-byte header first followed by
646 * a data-phase as indicated by the 8-byte header. The "timeout" is
647 * given in milliseconds.
648 *
649 * Return values:
650 *   0: Success
651 * < 0: Failure
652 * > 0: Actual length
653 *------------------------------------------------------------------------*/
654int
655usb_control_msg(struct usb_device *dev, struct usb_host_endpoint *uhe,
656    uint8_t request, uint8_t requesttype,
657    uint16_t value, uint16_t index, void *data,
658    uint16_t size, usb_timeout_t timeout)
659{
660	struct usb_device_request req;
661	struct urb *urb;
662	int err;
663	uint16_t actlen;
664	uint8_t type;
665	uint8_t addr;
666
667	req.bmRequestType = requesttype;
668	req.bRequest = request;
669	USETW(req.wValue, value);
670	USETW(req.wIndex, index);
671	USETW(req.wLength, size);
672
673	if (uhe == NULL) {
674		return (-EINVAL);
675	}
676	type = (uhe->desc.bmAttributes & UE_XFERTYPE);
677	addr = (uhe->desc.bEndpointAddress & UE_ADDR);
678
679	if (type != UE_CONTROL) {
680		return (-EINVAL);
681	}
682	if (addr == 0) {
683		/*
684		 * The FreeBSD USB stack supports standard control
685		 * transfers on control endpoint zero:
686		 */
687		err = usbd_do_request_flags(dev,
688		    NULL, &req, data, USB_SHORT_XFER_OK,
689		    &actlen, timeout);
690		if (err) {
691			err = -EPIPE;
692		} else {
693			err = actlen;
694		}
695		return (err);
696	}
697	if (dev->flags.usb_mode != USB_MODE_HOST) {
698		/* not supported */
699		return (-EINVAL);
700	}
701	err = usb_setup_endpoint(dev, uhe, 1 /* dummy */ );
702
703	/*
704	 * NOTE: we need to allocate real memory here so that we don't
705	 * transfer data to/from the stack!
706	 *
707	 * 0xFFFF is a FreeBSD specific magic value.
708	 */
709	urb = usb_alloc_urb(0xFFFF, size);
710
711	urb->dev = dev;
712	urb->endpoint = uhe;
713
714	memcpy(urb->setup_packet, &req, sizeof(req));
715
716	if (size && (!(req.bmRequestType & UT_READ))) {
717		/* move the data to a real buffer */
718		memcpy(USB_ADD_BYTES(urb->setup_packet, sizeof(req)),
719		    data, size);
720	}
721	err = usb_start_wait_urb(urb, timeout, &actlen);
722
723	if (req.bmRequestType & UT_READ) {
724		if (actlen) {
725			bcopy(USB_ADD_BYTES(urb->setup_packet,
726			    sizeof(req)), data, actlen);
727		}
728	}
729	usb_free_urb(urb);
730
731	if (err == 0) {
732		err = actlen;
733	}
734	return (err);
735}
736
737/*------------------------------------------------------------------------*
738 *	usb_set_interface
739 *
740 * The following function will select which alternate setting of an
741 * USB interface you plan to use. By default alternate setting with
742 * index zero is selected. Note that "iface_no" is not the interface
743 * index, but rather the value of "bInterfaceNumber".
744 *------------------------------------------------------------------------*/
745int
746usb_set_interface(struct usb_device *dev, uint8_t iface_no, uint8_t alt_index)
747{
748	struct usb_interface *p_ui = usb_ifnum_to_if(dev, iface_no);
749	int err;
750
751	if (p_ui == NULL)
752		return (-EINVAL);
753	if (alt_index >= p_ui->num_altsetting)
754		return (-EINVAL);
755	usb_linux_cleanup_interface(dev, p_ui);
756	err = -usbd_set_alt_interface_index(dev,
757	    p_ui->bsd_iface_index, alt_index);
758	if (err == 0) {
759		p_ui->cur_altsetting = p_ui->altsetting + alt_index;
760	}
761	return (err);
762}
763
764/*------------------------------------------------------------------------*
765 *	usb_setup_endpoint
766 *
767 * The following function is an extension to the Linux USB API that
768 * allows you to set a maximum buffer size for a given USB endpoint.
769 * The maximum buffer size is per URB. If you don't call this function
770 * to set a maximum buffer size, the endpoint will not be functional.
771 * Note that for isochronous endpoints the maximum buffer size must be
772 * a non-zero dummy, hence this function will base the maximum buffer
773 * size on "wMaxPacketSize".
774 *------------------------------------------------------------------------*/
775int
776usb_setup_endpoint(struct usb_device *dev,
777    struct usb_host_endpoint *uhe, usb_size_t bufsize)
778{
779	struct usb_config cfg[2];
780	uint8_t type = uhe->desc.bmAttributes & UE_XFERTYPE;
781	uint8_t addr = uhe->desc.bEndpointAddress;
782
783	if (uhe->fbsd_buf_size == bufsize) {
784		/* optimize */
785		return (0);
786	}
787	usbd_transfer_unsetup(uhe->bsd_xfer, 2);
788
789	uhe->fbsd_buf_size = bufsize;
790
791	if (bufsize == 0) {
792		return (0);
793	}
794	memset(cfg, 0, sizeof(cfg));
795
796	if (type == UE_ISOCHRONOUS) {
797
798		/*
799		 * Isochronous transfers are special in that they don't fit
800		 * into the BULK/INTR/CONTROL transfer model.
801		 */
802
803		cfg[0].type = type;
804		cfg[0].endpoint = addr & UE_ADDR;
805		cfg[0].direction = addr & (UE_DIR_OUT | UE_DIR_IN);
806		cfg[0].callback = &usb_linux_isoc_callback;
807		cfg[0].bufsize = 0;	/* use wMaxPacketSize */
808		cfg[0].frames = usb_max_isoc_frames(dev);
809		cfg[0].flags.proxy_buffer = 1;
810#if 0
811		/*
812		 * The Linux USB API allows non back-to-back
813		 * isochronous frames which we do not support. If the
814		 * isochronous frames are not back-to-back we need to
815		 * do a copy, and then we need a buffer for
816		 * that. Enable this at your own risk.
817		 */
818		cfg[0].flags.ext_buffer = 1;
819#endif
820		cfg[0].flags.short_xfer_ok = 1;
821
822		bcopy(cfg, cfg + 1, sizeof(*cfg));
823
824		/* Allocate and setup two generic FreeBSD USB transfers */
825
826		if (usbd_transfer_setup(dev, &uhe->bsd_iface_index,
827		    uhe->bsd_xfer, cfg, 2, uhe, &Giant)) {
828			return (-EINVAL);
829		}
830	} else {
831		if (bufsize > (1 << 22)) {
832			/* limit buffer size */
833			bufsize = (1 << 22);
834		}
835		/* Allocate and setup one generic FreeBSD USB transfer */
836
837		cfg[0].type = type;
838		cfg[0].endpoint = addr & UE_ADDR;
839		cfg[0].direction = addr & (UE_DIR_OUT | UE_DIR_IN);
840		cfg[0].callback = &usb_linux_non_isoc_callback;
841		cfg[0].bufsize = bufsize;
842		cfg[0].flags.ext_buffer = 1;	/* enable zero-copy */
843		cfg[0].flags.proxy_buffer = 1;
844		cfg[0].flags.short_xfer_ok = 1;
845
846		if (usbd_transfer_setup(dev, &uhe->bsd_iface_index,
847		    uhe->bsd_xfer, cfg, 1, uhe, &Giant)) {
848			return (-EINVAL);
849		}
850	}
851	return (0);
852}
853
854/*------------------------------------------------------------------------*
855 *	usb_linux_create_usb_device
856 *
857 * The following function is used to build up a per USB device
858 * structure tree, that mimics the Linux one. The root structure
859 * is returned by this function.
860 *------------------------------------------------------------------------*/
861static int
862usb_linux_create_usb_device(struct usb_device *udev, device_t dev)
863{
864	struct usb_config_descriptor *cd = usbd_get_config_descriptor(udev);
865	struct usb_descriptor *desc;
866	struct usb_interface_descriptor *id;
867	struct usb_endpoint_descriptor *ed;
868	struct usb_interface *p_ui = NULL;
869	struct usb_host_interface *p_uhi = NULL;
870	struct usb_host_endpoint *p_uhe = NULL;
871	usb_size_t size;
872	uint16_t niface_total;
873	uint16_t nedesc;
874	uint16_t iface_no_curr;
875	uint16_t iface_index;
876	uint8_t pass;
877	uint8_t iface_no;
878
879	/*
880	 * We do two passes. One pass for computing necessary memory size
881	 * and one pass to initialize all the allocated memory structures.
882	 */
883	for (pass = 0; pass < 2; pass++) {
884
885		iface_no_curr = 0xFFFF;
886		niface_total = 0;
887		iface_index = 0;
888		nedesc = 0;
889		desc = NULL;
890
891		/*
892		 * Iterate over all the USB descriptors. Use the USB config
893		 * descriptor pointer provided by the FreeBSD USB stack.
894		 */
895		while ((desc = usb_desc_foreach(cd, desc))) {
896
897			/*
898			 * Build up a tree according to the descriptors we
899			 * find:
900			 */
901			switch (desc->bDescriptorType) {
902			case UDESC_DEVICE:
903				break;
904
905			case UDESC_ENDPOINT:
906				ed = (void *)desc;
907				if ((ed->bLength < sizeof(*ed)) ||
908				    (iface_index == 0))
909					break;
910				if (p_uhe) {
911					bcopy(ed, &p_uhe->desc, sizeof(p_uhe->desc));
912					p_uhe->bsd_iface_index = iface_index - 1;
913					TAILQ_INIT(&p_uhe->bsd_urb_list);
914					p_uhe++;
915				}
916				if (p_uhi) {
917					(p_uhi - 1)->desc.bNumEndpoints++;
918				}
919				nedesc++;
920				break;
921
922			case UDESC_INTERFACE:
923				id = (void *)desc;
924				if (id->bLength < sizeof(*id))
925					break;
926				if (p_uhi) {
927					bcopy(id, &p_uhi->desc, sizeof(p_uhi->desc));
928					p_uhi->desc.bNumEndpoints = 0;
929					p_uhi->endpoint = p_uhe;
930					p_uhi->string = "";
931					p_uhi->bsd_iface_index = iface_index;
932					p_uhi++;
933				}
934				iface_no = id->bInterfaceNumber;
935				niface_total++;
936				if (iface_no_curr != iface_no) {
937					if (p_ui) {
938						p_ui->altsetting = p_uhi - 1;
939						p_ui->cur_altsetting = p_uhi - 1;
940						p_ui->bsd_iface_index = iface_index;
941						p_ui->linux_udev = udev;
942						p_ui++;
943					}
944					iface_no_curr = iface_no;
945					iface_index++;
946				}
947				break;
948
949			default:
950				break;
951			}
952		}
953
954		if (pass == 0) {
955
956			size = (sizeof(*p_uhe) * nedesc) +
957			    (sizeof(*p_ui) * iface_index) +
958			    (sizeof(*p_uhi) * niface_total);
959
960			p_uhe = malloc(size, M_USBDEV, M_WAITOK | M_ZERO);
961			p_ui = (void *)(p_uhe + nedesc);
962			p_uhi = (void *)(p_ui + iface_index);
963
964			udev->linux_iface_start = p_ui;
965			udev->linux_iface_end = p_ui + iface_index;
966			udev->linux_endpoint_start = p_uhe;
967			udev->linux_endpoint_end = p_uhe + nedesc;
968			udev->devnum = device_get_unit(dev);
969			bcopy(&udev->ddesc, &udev->descriptor,
970			    sizeof(udev->descriptor));
971			bcopy(udev->ctrl_ep.edesc, &udev->ep0.desc,
972			    sizeof(udev->ep0.desc));
973		}
974	}
975	return (0);
976}
977
978/*------------------------------------------------------------------------*
979 *	usb_alloc_urb
980 *
981 * This function should always be used when you allocate an URB for
982 * use with the USB Linux stack. In case of an isochronous transfer
983 * you must specifiy the maximum number of "iso_packets" which you
984 * plan to transfer per URB. This function is always blocking, and
985 * "mem_flags" are not regarded like on Linux.
986 *------------------------------------------------------------------------*/
987struct urb *
988usb_alloc_urb(uint16_t iso_packets, uint16_t mem_flags)
989{
990	struct urb *urb;
991	usb_size_t size;
992
993	if (iso_packets == 0xFFFF) {
994		/*
995		 * FreeBSD specific magic value to ask for control transfer
996		 * memory allocation:
997		 */
998		size = sizeof(*urb) + sizeof(struct usb_device_request) + mem_flags;
999	} else {
1000		size = sizeof(*urb) + (iso_packets * sizeof(urb->iso_frame_desc[0]));
1001	}
1002
1003	urb = malloc(size, M_USBDEV, M_WAITOK | M_ZERO);
1004
1005	cv_init(&urb->cv_wait, "URBWAIT");
1006	if (iso_packets == 0xFFFF) {
1007		urb->setup_packet = (void *)(urb + 1);
1008		urb->transfer_buffer = (void *)(urb->setup_packet +
1009		    sizeof(struct usb_device_request));
1010	} else {
1011		urb->number_of_packets = iso_packets;
1012	}
1013	return (urb);
1014}
1015
1016/*------------------------------------------------------------------------*
1017 *	usb_find_host_endpoint
1018 *
1019 * The following function will return the Linux USB host endpoint
1020 * structure that matches the given endpoint type and endpoint
1021 * value. If no match is found, NULL is returned. This function is not
1022 * part of the Linux USB API and is only used internally.
1023 *------------------------------------------------------------------------*/
1024struct usb_host_endpoint *
1025usb_find_host_endpoint(struct usb_device *dev, uint8_t type, uint8_t ep)
1026{
1027	struct usb_host_endpoint *uhe;
1028	struct usb_host_endpoint *uhe_end;
1029	struct usb_host_interface *uhi;
1030	struct usb_interface *ui;
1031	uint8_t ea;
1032	uint8_t at;
1033	uint8_t mask;
1034
1035	if (dev == NULL) {
1036		return (NULL);
1037	}
1038	if (type == UE_CONTROL) {
1039		mask = UE_ADDR;
1040	} else {
1041		mask = (UE_DIR_IN | UE_DIR_OUT | UE_ADDR);
1042	}
1043
1044	ep &= mask;
1045
1046	/*
1047	 * Iterate over all the interfaces searching the selected alternate
1048	 * setting only, and all belonging endpoints.
1049	 */
1050	for (ui = dev->linux_iface_start;
1051	    ui != dev->linux_iface_end;
1052	    ui++) {
1053		uhi = ui->cur_altsetting;
1054		if (uhi) {
1055			uhe_end = uhi->endpoint + uhi->desc.bNumEndpoints;
1056			for (uhe = uhi->endpoint;
1057			    uhe != uhe_end;
1058			    uhe++) {
1059				ea = uhe->desc.bEndpointAddress;
1060				at = uhe->desc.bmAttributes;
1061
1062				if (((ea & mask) == ep) &&
1063				    ((at & UE_XFERTYPE) == type)) {
1064					return (uhe);
1065				}
1066			}
1067		}
1068	}
1069
1070	if ((type == UE_CONTROL) && ((ep & UE_ADDR) == 0)) {
1071		return (&dev->ep0);
1072	}
1073	return (NULL);
1074}
1075
1076/*------------------------------------------------------------------------*
1077 *	usb_altnum_to_altsetting
1078 *
1079 * The following function returns a pointer to an alternate setting by
1080 * index given a "usb_interface" pointer. If the alternate setting by
1081 * index does not exist, NULL is returned. And alternate setting is a
1082 * variant of an interface, but usually with slightly different
1083 * characteristics.
1084 *------------------------------------------------------------------------*/
1085struct usb_host_interface *
1086usb_altnum_to_altsetting(const struct usb_interface *intf, uint8_t alt_index)
1087{
1088	if (alt_index >= intf->num_altsetting) {
1089		return (NULL);
1090	}
1091	return (intf->altsetting + alt_index);
1092}
1093
1094/*------------------------------------------------------------------------*
1095 *	usb_ifnum_to_if
1096 *
1097 * The following function searches up an USB interface by
1098 * "bInterfaceNumber". If no match is found, NULL is returned.
1099 *------------------------------------------------------------------------*/
1100struct usb_interface *
1101usb_ifnum_to_if(struct usb_device *dev, uint8_t iface_no)
1102{
1103	struct usb_interface *p_ui;
1104
1105	for (p_ui = dev->linux_iface_start;
1106	    p_ui != dev->linux_iface_end;
1107	    p_ui++) {
1108		if ((p_ui->num_altsetting > 0) &&
1109		    (p_ui->altsetting->desc.bInterfaceNumber == iface_no)) {
1110			return (p_ui);
1111		}
1112	}
1113	return (NULL);
1114}
1115
1116/*------------------------------------------------------------------------*
1117 *	usb_buffer_alloc
1118 *------------------------------------------------------------------------*/
1119void   *
1120usb_buffer_alloc(struct usb_device *dev, usb_size_t size, uint16_t mem_flags, uint8_t *dma_addr)
1121{
1122	return (malloc(size, M_USBDEV, M_WAITOK | M_ZERO));
1123}
1124
1125/*------------------------------------------------------------------------*
1126 *	usbd_get_intfdata
1127 *------------------------------------------------------------------------*/
1128void   *
1129usbd_get_intfdata(struct usb_interface *intf)
1130{
1131	return (intf->bsd_priv_sc);
1132}
1133
1134/*------------------------------------------------------------------------*
1135 *	usb_linux_register
1136 *
1137 * The following function is used by the "USB_DRIVER_EXPORT()" macro,
1138 * and is used to register a Linux USB driver, so that its
1139 * "usb_device_id" structures gets searched a probe time. This
1140 * function is not part of the Linux USB API, and is for internal use
1141 * only.
1142 *------------------------------------------------------------------------*/
1143void
1144usb_linux_register(void *arg)
1145{
1146	struct usb_driver *drv = arg;
1147
1148	mtx_lock(&Giant);
1149	LIST_INSERT_HEAD(&usb_linux_driver_list, drv, linux_driver_list);
1150	mtx_unlock(&Giant);
1151
1152	usb_needs_explore_all();
1153}
1154
1155/*------------------------------------------------------------------------*
1156 *	usb_linux_deregister
1157 *
1158 * The following function is used by the "USB_DRIVER_EXPORT()" macro,
1159 * and is used to deregister a Linux USB driver. This function will
1160 * ensure that all driver instances belonging to the Linux USB device
1161 * driver in question, gets detached before the driver is
1162 * unloaded. This function is not part of the Linux USB API, and is
1163 * for internal use only.
1164 *------------------------------------------------------------------------*/
1165void
1166usb_linux_deregister(void *arg)
1167{
1168	struct usb_driver *drv = arg;
1169	struct usb_linux_softc *sc;
1170
1171repeat:
1172	mtx_lock(&Giant);
1173	LIST_FOREACH(sc, &usb_linux_attached_list, sc_attached_list) {
1174		if (sc->sc_udrv == drv) {
1175			mtx_unlock(&Giant);
1176			device_detach(sc->sc_fbsd_dev);
1177			goto repeat;
1178		}
1179	}
1180	LIST_REMOVE(drv, linux_driver_list);
1181	mtx_unlock(&Giant);
1182}
1183
1184/*------------------------------------------------------------------------*
1185 *	usb_linux_free_device
1186 *
1187 * The following function is only used by the FreeBSD USB stack, to
1188 * cleanup and free memory after that a Linux USB device was attached.
1189 *------------------------------------------------------------------------*/
1190void
1191usb_linux_free_device(struct usb_device *dev)
1192{
1193	struct usb_host_endpoint *uhe;
1194	struct usb_host_endpoint *uhe_end;
1195	int err;
1196
1197	uhe = dev->linux_endpoint_start;
1198	uhe_end = dev->linux_endpoint_end;
1199	while (uhe != uhe_end) {
1200		err = usb_setup_endpoint(dev, uhe, 0);
1201		uhe++;
1202	}
1203	err = usb_setup_endpoint(dev, &dev->ep0, 0);
1204	free(dev->linux_endpoint_start, M_USBDEV);
1205}
1206
1207/*------------------------------------------------------------------------*
1208 *	usb_buffer_free
1209 *------------------------------------------------------------------------*/
1210void
1211usb_buffer_free(struct usb_device *dev, usb_size_t size,
1212    void *addr, uint8_t dma_addr)
1213{
1214	free(addr, M_USBDEV);
1215}
1216
1217/*------------------------------------------------------------------------*
1218 *	usb_free_urb
1219 *------------------------------------------------------------------------*/
1220void
1221usb_free_urb(struct urb *urb)
1222{
1223	if (urb == NULL) {
1224		return;
1225	}
1226	/* make sure that the current URB is not active */
1227	usb_kill_urb(urb);
1228
1229	/* destroy condition variable */
1230	cv_destroy(&urb->cv_wait);
1231
1232	/* just free it */
1233	free(urb, M_USBDEV);
1234}
1235
1236/*------------------------------------------------------------------------*
1237 *	usb_init_urb
1238 *
1239 * The following function can be used to initialize a custom URB. It
1240 * is not recommended to use this function. Use "usb_alloc_urb()"
1241 * instead.
1242 *------------------------------------------------------------------------*/
1243void
1244usb_init_urb(struct urb *urb)
1245{
1246	if (urb == NULL) {
1247		return;
1248	}
1249	memset(urb, 0, sizeof(*urb));
1250}
1251
1252/*------------------------------------------------------------------------*
1253 *	usb_kill_urb
1254 *------------------------------------------------------------------------*/
1255void
1256usb_kill_urb(struct urb *urb)
1257{
1258	usb_unlink_urb_sub(urb, 1);
1259}
1260
1261/*------------------------------------------------------------------------*
1262 *	usb_set_intfdata
1263 *
1264 * The following function sets the per Linux USB interface private
1265 * data pointer. It is used by most Linux USB device drivers.
1266 *------------------------------------------------------------------------*/
1267void
1268usb_set_intfdata(struct usb_interface *intf, void *data)
1269{
1270	intf->bsd_priv_sc = data;
1271}
1272
1273/*------------------------------------------------------------------------*
1274 *	usb_linux_cleanup_interface
1275 *
1276 * The following function will release all FreeBSD USB transfers
1277 * associated with a Linux USB interface. It is for internal use only.
1278 *------------------------------------------------------------------------*/
1279static void
1280usb_linux_cleanup_interface(struct usb_device *dev, struct usb_interface *iface)
1281{
1282	struct usb_host_interface *uhi;
1283	struct usb_host_interface *uhi_end;
1284	struct usb_host_endpoint *uhe;
1285	struct usb_host_endpoint *uhe_end;
1286	int err;
1287
1288	uhi = iface->altsetting;
1289	uhi_end = iface->altsetting + iface->num_altsetting;
1290	while (uhi != uhi_end) {
1291		uhe = uhi->endpoint;
1292		uhe_end = uhi->endpoint + uhi->desc.bNumEndpoints;
1293		while (uhe != uhe_end) {
1294			err = usb_setup_endpoint(dev, uhe, 0);
1295			uhe++;
1296		}
1297		uhi++;
1298	}
1299}
1300
1301/*------------------------------------------------------------------------*
1302 *	usb_linux_wait_complete
1303 *
1304 * The following function is used by "usb_start_wait_urb()" to wake it
1305 * up, when an USB transfer has finished.
1306 *------------------------------------------------------------------------*/
1307static void
1308usb_linux_wait_complete(struct urb *urb)
1309{
1310	if (urb->transfer_flags & URB_IS_SLEEPING) {
1311		cv_signal(&urb->cv_wait);
1312	}
1313	urb->transfer_flags &= ~URB_WAIT_WAKEUP;
1314}
1315
1316/*------------------------------------------------------------------------*
1317 *	usb_linux_complete
1318 *------------------------------------------------------------------------*/
1319static void
1320usb_linux_complete(struct usb_xfer *xfer)
1321{
1322	struct urb *urb;
1323
1324	urb = usbd_xfer_get_priv(xfer);
1325	usbd_xfer_set_priv(xfer, NULL);
1326	if (urb->complete) {
1327		(urb->complete) (urb);
1328	}
1329}
1330
1331/*------------------------------------------------------------------------*
1332 *	usb_linux_isoc_callback
1333 *
1334 * The following is the FreeBSD isochronous USB callback. Isochronous
1335 * frames are USB packets transferred 1000 or 8000 times per second,
1336 * depending on whether a full- or high- speed USB transfer is
1337 * used.
1338 *------------------------------------------------------------------------*/
1339static void
1340usb_linux_isoc_callback(struct usb_xfer *xfer, usb_error_t error)
1341{
1342	usb_frlength_t max_frame = xfer->max_frame_size;
1343	usb_frlength_t offset;
1344	usb_frcount_t x;
1345	struct urb *urb = usbd_xfer_get_priv(xfer);
1346	struct usb_host_endpoint *uhe = usbd_xfer_softc(xfer);
1347	struct usb_iso_packet_descriptor *uipd;
1348
1349	DPRINTF("\n");
1350
1351	switch (USB_GET_STATE(xfer)) {
1352	case USB_ST_TRANSFERRED:
1353
1354		if (urb->bsd_isread) {
1355
1356			/* copy in data with regard to the URB */
1357
1358			offset = 0;
1359
1360			for (x = 0; x < urb->number_of_packets; x++) {
1361				uipd = urb->iso_frame_desc + x;
1362				if (uipd->length > xfer->frlengths[x]) {
1363					if (urb->transfer_flags & URB_SHORT_NOT_OK) {
1364						/* XXX should be EREMOTEIO */
1365						uipd->status = -EPIPE;
1366					} else {
1367						uipd->status = 0;
1368					}
1369				} else {
1370					uipd->status = 0;
1371				}
1372				uipd->actual_length = xfer->frlengths[x];
1373				if (!xfer->flags.ext_buffer) {
1374					usbd_copy_out(xfer->frbuffers, offset,
1375					    USB_ADD_BYTES(urb->transfer_buffer,
1376					    uipd->offset), uipd->actual_length);
1377				}
1378				offset += max_frame;
1379			}
1380		} else {
1381			for (x = 0; x < urb->number_of_packets; x++) {
1382				uipd = urb->iso_frame_desc + x;
1383				uipd->actual_length = xfer->frlengths[x];
1384				uipd->status = 0;
1385			}
1386		}
1387
1388		urb->actual_length = xfer->actlen;
1389
1390		/* check for short transfer */
1391		if (xfer->actlen < xfer->sumlen) {
1392			/* short transfer */
1393			if (urb->transfer_flags & URB_SHORT_NOT_OK) {
1394				/* XXX should be EREMOTEIO */
1395				urb->status = -EPIPE;
1396			} else {
1397				urb->status = 0;
1398			}
1399		} else {
1400			/* success */
1401			urb->status = 0;
1402		}
1403
1404		/* call callback */
1405		usb_linux_complete(xfer);
1406
1407	case USB_ST_SETUP:
1408tr_setup:
1409
1410		if (xfer->priv_fifo == NULL) {
1411
1412			/* get next transfer */
1413			urb = TAILQ_FIRST(&uhe->bsd_urb_list);
1414			if (urb == NULL) {
1415				/* nothing to do */
1416				return;
1417			}
1418			TAILQ_REMOVE(&uhe->bsd_urb_list, urb, bsd_urb_list);
1419			urb->bsd_urb_list.tqe_prev = NULL;
1420
1421			x = xfer->max_frame_count;
1422			if (urb->number_of_packets > x) {
1423				/* XXX simply truncate the transfer */
1424				urb->number_of_packets = x;
1425			}
1426		} else {
1427			DPRINTF("Already got a transfer\n");
1428
1429			/* already got a transfer (should not happen) */
1430			urb = usbd_xfer_get_priv(xfer);
1431		}
1432
1433		urb->bsd_isread = (uhe->desc.bEndpointAddress & UE_DIR_IN) ? 1 : 0;
1434
1435		if (xfer->flags.ext_buffer) {
1436			/* set virtual address to load */
1437			usbd_xfer_set_frame_data(xfer, 0, urb->transfer_buffer, 0);
1438		}
1439		if (!(urb->bsd_isread)) {
1440
1441			/* copy out data with regard to the URB */
1442
1443			offset = 0;
1444
1445			for (x = 0; x < urb->number_of_packets; x++) {
1446				uipd = urb->iso_frame_desc + x;
1447				usbd_xfer_set_frame_len(xfer, x, uipd->length);
1448				if (!xfer->flags.ext_buffer) {
1449					usbd_copy_in(xfer->frbuffers, offset,
1450					    USB_ADD_BYTES(urb->transfer_buffer,
1451					    uipd->offset), uipd->length);
1452				}
1453				offset += uipd->length;
1454			}
1455		} else {
1456
1457			/*
1458			 * compute the transfer length into the "offset"
1459			 * variable
1460			 */
1461
1462			offset = urb->number_of_packets * max_frame;
1463
1464			/* setup "frlengths" array */
1465
1466			for (x = 0; x < urb->number_of_packets; x++) {
1467				uipd = urb->iso_frame_desc + x;
1468				usbd_xfer_set_frame_len(xfer, x, max_frame);
1469			}
1470		}
1471		usbd_xfer_set_priv(xfer, urb);
1472		xfer->flags.force_short_xfer = 0;
1473		xfer->timeout = urb->timeout;
1474		xfer->nframes = urb->number_of_packets;
1475		usbd_transfer_submit(xfer);
1476		return;
1477
1478	default:			/* Error */
1479		if (xfer->error == USB_ERR_CANCELLED) {
1480			urb->status = -ECONNRESET;
1481		} else {
1482			urb->status = -EPIPE;	/* stalled */
1483		}
1484
1485		/* Set zero for "actual_length" */
1486		urb->actual_length = 0;
1487
1488		/* Set zero for "actual_length" */
1489		for (x = 0; x < urb->number_of_packets; x++) {
1490			urb->iso_frame_desc[x].actual_length = 0;
1491			urb->iso_frame_desc[x].status = urb->status;
1492		}
1493
1494		/* call callback */
1495		usb_linux_complete(xfer);
1496
1497		if (xfer->error == USB_ERR_CANCELLED) {
1498			/* we need to return in this case */
1499			return;
1500		}
1501		goto tr_setup;
1502
1503	}
1504}
1505
1506/*------------------------------------------------------------------------*
1507 *	usb_linux_non_isoc_callback
1508 *
1509 * The following is the FreeBSD BULK/INTERRUPT and CONTROL USB
1510 * callback. It dequeues Linux USB stack compatible URB's, transforms
1511 * the URB fields into a FreeBSD USB transfer, and defragments the USB
1512 * transfer as required. When the transfer is complete the "complete"
1513 * callback is called.
1514 *------------------------------------------------------------------------*/
1515static void
1516usb_linux_non_isoc_callback(struct usb_xfer *xfer, usb_error_t error)
1517{
1518	enum {
1519		REQ_SIZE = sizeof(struct usb_device_request)
1520	};
1521	struct urb *urb = usbd_xfer_get_priv(xfer);
1522	struct usb_host_endpoint *uhe = usbd_xfer_softc(xfer);
1523	uint8_t *ptr;
1524	usb_frlength_t max_bulk = usbd_xfer_max_len(xfer);
1525	uint8_t data_frame = xfer->flags_int.control_xfr ? 1 : 0;
1526
1527	DPRINTF("\n");
1528
1529	switch (USB_GET_STATE(xfer)) {
1530	case USB_ST_TRANSFERRED:
1531
1532		if (xfer->flags_int.control_xfr) {
1533
1534			/* don't transfer the setup packet again: */
1535
1536			usbd_xfer_set_frame_len(xfer, 0, 0);
1537		}
1538		if (urb->bsd_isread && (!xfer->flags.ext_buffer)) {
1539			/* copy in data with regard to the URB */
1540			usbd_copy_out(xfer->frbuffers + data_frame, 0,
1541			    urb->bsd_data_ptr, xfer->frlengths[data_frame]);
1542		}
1543		urb->bsd_length_rem -= xfer->frlengths[data_frame];
1544		urb->bsd_data_ptr += xfer->frlengths[data_frame];
1545		urb->actual_length += xfer->frlengths[data_frame];
1546
1547		/* check for short transfer */
1548		if (xfer->actlen < xfer->sumlen) {
1549			urb->bsd_length_rem = 0;
1550
1551			/* short transfer */
1552			if (urb->transfer_flags & URB_SHORT_NOT_OK) {
1553				urb->status = -EPIPE;
1554			} else {
1555				urb->status = 0;
1556			}
1557		} else {
1558			/* check remainder */
1559			if (urb->bsd_length_rem > 0) {
1560				goto setup_bulk;
1561			}
1562			/* success */
1563			urb->status = 0;
1564		}
1565
1566		/* call callback */
1567		usb_linux_complete(xfer);
1568
1569	case USB_ST_SETUP:
1570tr_setup:
1571		/* get next transfer */
1572		urb = TAILQ_FIRST(&uhe->bsd_urb_list);
1573		if (urb == NULL) {
1574			/* nothing to do */
1575			return;
1576		}
1577		TAILQ_REMOVE(&uhe->bsd_urb_list, urb, bsd_urb_list);
1578		urb->bsd_urb_list.tqe_prev = NULL;
1579
1580		usbd_xfer_set_priv(xfer, urb);
1581		xfer->flags.force_short_xfer = 0;
1582		xfer->timeout = urb->timeout;
1583
1584		if (xfer->flags_int.control_xfr) {
1585
1586			/*
1587			 * USB control transfers need special handling.
1588			 * First copy in the header, then copy in data!
1589			 */
1590			if (!xfer->flags.ext_buffer) {
1591				usbd_copy_in(xfer->frbuffers, 0,
1592				    urb->setup_packet, REQ_SIZE);
1593				usbd_xfer_set_frame_len(xfer, 0, REQ_SIZE);
1594			} else {
1595				/* set virtual address to load */
1596				usbd_xfer_set_frame_data(xfer, 0,
1597				    urb->setup_packet, REQ_SIZE);
1598			}
1599
1600			ptr = urb->setup_packet;
1601
1602			/* setup data transfer direction and length */
1603			urb->bsd_isread = (ptr[0] & UT_READ) ? 1 : 0;
1604			urb->bsd_length_rem = ptr[6] | (ptr[7] << 8);
1605
1606		} else {
1607
1608			/* setup data transfer direction */
1609
1610			urb->bsd_length_rem = urb->transfer_buffer_length;
1611			urb->bsd_isread = (uhe->desc.bEndpointAddress &
1612			    UE_DIR_IN) ? 1 : 0;
1613		}
1614
1615		urb->bsd_data_ptr = urb->transfer_buffer;
1616		urb->actual_length = 0;
1617
1618setup_bulk:
1619		if (max_bulk > urb->bsd_length_rem) {
1620			max_bulk = urb->bsd_length_rem;
1621		}
1622		/* check if we need to force a short transfer */
1623
1624		if ((max_bulk == urb->bsd_length_rem) &&
1625		    (urb->transfer_flags & URB_ZERO_PACKET) &&
1626		    (!xfer->flags_int.control_xfr)) {
1627			xfer->flags.force_short_xfer = 1;
1628		}
1629		/* check if we need to copy in data */
1630
1631		if (xfer->flags.ext_buffer) {
1632			/* set virtual address to load */
1633			usbd_xfer_set_frame_data(xfer, data_frame,
1634			    urb->bsd_data_ptr, max_bulk);
1635		} else if (!urb->bsd_isread) {
1636			/* copy out data with regard to the URB */
1637			usbd_copy_in(xfer->frbuffers + data_frame, 0,
1638			    urb->bsd_data_ptr, max_bulk);
1639			usbd_xfer_set_frame_len(xfer, data_frame, max_bulk);
1640		}
1641		if (xfer->flags_int.control_xfr) {
1642			if (max_bulk > 0) {
1643				xfer->nframes = 2;
1644			} else {
1645				xfer->nframes = 1;
1646			}
1647		} else {
1648			xfer->nframes = 1;
1649		}
1650		usbd_transfer_submit(xfer);
1651		return;
1652
1653	default:
1654		if (xfer->error == USB_ERR_CANCELLED) {
1655			urb->status = -ECONNRESET;
1656		} else {
1657			urb->status = -EPIPE;
1658		}
1659
1660		/* Set zero for "actual_length" */
1661		urb->actual_length = 0;
1662
1663		/* call callback */
1664		usb_linux_complete(xfer);
1665
1666		if (xfer->error == USB_ERR_CANCELLED) {
1667			/* we need to return in this case */
1668			return;
1669		}
1670		goto tr_setup;
1671	}
1672}
1673
1674/*------------------------------------------------------------------------*
1675 *	usb_fill_bulk_urb
1676 *------------------------------------------------------------------------*/
1677void
1678usb_fill_bulk_urb(struct urb *urb, struct usb_device *udev,
1679    struct usb_host_endpoint *uhe, void *buf,
1680    int length, usb_complete_t callback, void *arg)
1681{
1682	urb->dev = udev;
1683	urb->endpoint = uhe;
1684	urb->transfer_buffer = buf;
1685	urb->transfer_buffer_length = length;
1686	urb->complete = callback;
1687	urb->context = arg;
1688}
1689
1690/*------------------------------------------------------------------------*
1691 *	usb_bulk_msg
1692 *
1693 * NOTE: This function can also be used for interrupt endpoints!
1694 *
1695 * Return values:
1696 *    0: Success
1697 * Else: Failure
1698 *------------------------------------------------------------------------*/
1699int
1700usb_bulk_msg(struct usb_device *udev, struct usb_host_endpoint *uhe,
1701    void *data, int len, uint16_t *pactlen, usb_timeout_t timeout)
1702{
1703	struct urb *urb;
1704	int err;
1705
1706	if (uhe == NULL)
1707		return (-EINVAL);
1708	if (len < 0)
1709		return (-EINVAL);
1710
1711	err = usb_setup_endpoint(udev, uhe, 4096 /* bytes */);
1712	if (err)
1713		return (err);
1714
1715	urb = usb_alloc_urb(0, 0);
1716
1717	usb_fill_bulk_urb(urb, udev, uhe, data, len,
1718	    usb_linux_wait_complete, NULL);
1719
1720	err = usb_start_wait_urb(urb, timeout, pactlen);
1721
1722	usb_free_urb(urb);
1723
1724	return (err);
1725}
1726MODULE_DEPEND(linuxkpi, usb, 1, 1, 1);
1727
1728static void
1729usb_linux_init(void *arg)
1730{
1731	/* register our function */
1732	usb_linux_free_device_p = &usb_linux_free_device;
1733}
1734SYSINIT(usb_linux_init, SI_SUB_LOCK, SI_ORDER_FIRST, usb_linux_init, NULL);
1735SYSUNINIT(usb_linux_unload, SI_SUB_LOCK, SI_ORDER_ANY, usb_linux_unload, NULL);
1736