1/* $FreeBSD$ */
2/*-
3 * Copyright (c) 2007 Luigi Rizzo - Universita` di Pisa. All rights reserved.
4 * Copyright (c) 2007 Hans Petter Selasky. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 */
27
28#include <sys/stdint.h>
29#include <sys/stddef.h>
30#include <sys/param.h>
31#include <sys/queue.h>
32#include <sys/types.h>
33#include <sys/systm.h>
34#include <sys/kernel.h>
35#include <sys/bus.h>
36#include <sys/module.h>
37#include <sys/lock.h>
38#include <sys/mutex.h>
39#include <sys/condvar.h>
40#include <sys/sysctl.h>
41#include <sys/sx.h>
42#include <sys/unistd.h>
43#include <sys/callout.h>
44#include <sys/malloc.h>
45#include <sys/priv.h>
46
47#include <dev/usb/usb.h>
48#include <dev/usb/usbdi.h>
49#include <dev/usb/usbdi_util.h>
50
51#define	USB_DEBUG_VAR usb_debug
52
53#include <dev/usb/usb_core.h>
54#include <dev/usb/usb_compat_linux.h>
55#include <dev/usb/usb_process.h>
56#include <dev/usb/usb_device.h>
57#include <dev/usb/usb_util.h>
58#include <dev/usb/usb_busdma.h>
59#include <dev/usb/usb_transfer.h>
60#include <dev/usb/usb_hub.h>
61#include <dev/usb/usb_request.h>
62#include <dev/usb/usb_debug.h>
63
64struct usb_linux_softc {
65	LIST_ENTRY(usb_linux_softc) sc_attached_list;
66
67	device_t sc_fbsd_dev;
68	struct usb_device *sc_fbsd_udev;
69	struct usb_interface *sc_ui;
70	struct usb_driver *sc_udrv;
71};
72
73/* prototypes */
74static device_probe_t usb_linux_probe;
75static device_attach_t usb_linux_attach;
76static device_detach_t usb_linux_detach;
77static device_suspend_t usb_linux_suspend;
78static device_resume_t usb_linux_resume;
79
80static usb_callback_t usb_linux_isoc_callback;
81static usb_callback_t usb_linux_non_isoc_callback;
82
83static usb_complete_t usb_linux_wait_complete;
84
85static uint16_t	usb_max_isoc_frames(struct usb_device *);
86static int	usb_start_wait_urb(struct urb *, usb_timeout_t, uint16_t *);
87static const struct usb_device_id *usb_linux_lookup_id(
88		    const struct usb_device_id *, struct usb_attach_arg *);
89static struct	usb_driver *usb_linux_get_usb_driver(struct usb_linux_softc *);
90static int	usb_linux_create_usb_device(struct usb_device *, device_t);
91static void	usb_linux_cleanup_interface(struct usb_device *,
92		    struct usb_interface *);
93static void	usb_linux_complete(struct usb_xfer *);
94static int	usb_unlink_urb_sub(struct urb *, uint8_t);
95
96/*------------------------------------------------------------------------*
97 * FreeBSD USB interface
98 *------------------------------------------------------------------------*/
99
100static LIST_HEAD(, usb_linux_softc) usb_linux_attached_list;
101static LIST_HEAD(, usb_driver) usb_linux_driver_list;
102
103static device_method_t usb_linux_methods[] = {
104	/* Device interface */
105	DEVMETHOD(device_probe, usb_linux_probe),
106	DEVMETHOD(device_attach, usb_linux_attach),
107	DEVMETHOD(device_detach, usb_linux_detach),
108	DEVMETHOD(device_suspend, usb_linux_suspend),
109	DEVMETHOD(device_resume, usb_linux_resume),
110
111	{0, 0}
112};
113
114static driver_t usb_linux_driver = {
115	.name = "usb_linux",
116	.methods = usb_linux_methods,
117	.size = sizeof(struct usb_linux_softc),
118};
119
120static devclass_t usb_linux_devclass;
121
122DRIVER_MODULE(usb_linux, uhub, usb_linux_driver, usb_linux_devclass, NULL, 0);
123MODULE_VERSION(usb_linux, 1);
124
125/*------------------------------------------------------------------------*
126 *	usb_linux_lookup_id
127 *
128 * This functions takes an array of "struct usb_device_id" and tries
129 * to match the entries with the information in "struct usb_attach_arg".
130 * If it finds a match the matching entry will be returned.
131 * Else "NULL" will be returned.
132 *------------------------------------------------------------------------*/
133static const struct usb_device_id *
134usb_linux_lookup_id(const struct usb_device_id *id, struct usb_attach_arg *uaa)
135{
136	if (id == NULL) {
137		goto done;
138	}
139	/*
140	 * Keep on matching array entries until we find one with
141	 * "match_flags" equal to zero, which indicates the end of the
142	 * array:
143	 */
144	for (; id->match_flags; id++) {
145
146		if ((id->match_flags & USB_DEVICE_ID_MATCH_VENDOR) &&
147		    (id->idVendor != uaa->info.idVendor)) {
148			continue;
149		}
150		if ((id->match_flags & USB_DEVICE_ID_MATCH_PRODUCT) &&
151		    (id->idProduct != uaa->info.idProduct)) {
152			continue;
153		}
154		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_LO) &&
155		    (id->bcdDevice_lo > uaa->info.bcdDevice)) {
156			continue;
157		}
158		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_HI) &&
159		    (id->bcdDevice_hi < uaa->info.bcdDevice)) {
160			continue;
161		}
162		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_CLASS) &&
163		    (id->bDeviceClass != uaa->info.bDeviceClass)) {
164			continue;
165		}
166		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_SUBCLASS) &&
167		    (id->bDeviceSubClass != uaa->info.bDeviceSubClass)) {
168			continue;
169		}
170		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_PROTOCOL) &&
171		    (id->bDeviceProtocol != uaa->info.bDeviceProtocol)) {
172			continue;
173		}
174		if ((uaa->info.bDeviceClass == 0xFF) &&
175		    !(id->match_flags & USB_DEVICE_ID_MATCH_VENDOR) &&
176		    (id->match_flags & (USB_DEVICE_ID_MATCH_INT_CLASS |
177		    USB_DEVICE_ID_MATCH_INT_SUBCLASS |
178		    USB_DEVICE_ID_MATCH_INT_PROTOCOL))) {
179			continue;
180		}
181		if ((id->match_flags & USB_DEVICE_ID_MATCH_INT_CLASS) &&
182		    (id->bInterfaceClass != uaa->info.bInterfaceClass)) {
183			continue;
184		}
185		if ((id->match_flags & USB_DEVICE_ID_MATCH_INT_SUBCLASS) &&
186		    (id->bInterfaceSubClass != uaa->info.bInterfaceSubClass)) {
187			continue;
188		}
189		if ((id->match_flags & USB_DEVICE_ID_MATCH_INT_PROTOCOL) &&
190		    (id->bInterfaceProtocol != uaa->info.bInterfaceProtocol)) {
191			continue;
192		}
193		/* we found a match! */
194		return (id);
195	}
196
197done:
198	return (NULL);
199}
200
201/*------------------------------------------------------------------------*
202 *	usb_linux_probe
203 *
204 * This function is the FreeBSD probe callback. It is called from the
205 * FreeBSD USB stack through the "device_probe_and_attach()" function.
206 *------------------------------------------------------------------------*/
207static int
208usb_linux_probe(device_t dev)
209{
210	struct usb_attach_arg *uaa = device_get_ivars(dev);
211	struct usb_driver *udrv;
212	int err = ENXIO;
213
214	if (uaa->usb_mode != USB_MODE_HOST) {
215		return (ENXIO);
216	}
217	mtx_lock(&Giant);
218	LIST_FOREACH(udrv, &usb_linux_driver_list, linux_driver_list) {
219		if (usb_linux_lookup_id(udrv->id_table, uaa)) {
220			err = 0;
221			break;
222		}
223	}
224	mtx_unlock(&Giant);
225
226	return (err);
227}
228
229/*------------------------------------------------------------------------*
230 *	usb_linux_get_usb_driver
231 *
232 * This function returns the pointer to the "struct usb_driver" where
233 * the Linux USB device driver "struct usb_device_id" match was found.
234 * We apply a lock before reading out the pointer to avoid races.
235 *------------------------------------------------------------------------*/
236static struct usb_driver *
237usb_linux_get_usb_driver(struct usb_linux_softc *sc)
238{
239	struct usb_driver *udrv;
240
241	mtx_lock(&Giant);
242	udrv = sc->sc_udrv;
243	mtx_unlock(&Giant);
244	return (udrv);
245}
246
247/*------------------------------------------------------------------------*
248 *	usb_linux_attach
249 *
250 * This function is the FreeBSD attach callback. It is called from the
251 * FreeBSD USB stack through the "device_probe_and_attach()" function.
252 * This function is called when "usb_linux_probe()" returns zero.
253 *------------------------------------------------------------------------*/
254static int
255usb_linux_attach(device_t dev)
256{
257	struct usb_attach_arg *uaa = device_get_ivars(dev);
258	struct usb_linux_softc *sc = device_get_softc(dev);
259	struct usb_driver *udrv;
260	const struct usb_device_id *id = NULL;
261
262	mtx_lock(&Giant);
263	LIST_FOREACH(udrv, &usb_linux_driver_list, linux_driver_list) {
264		id = usb_linux_lookup_id(udrv->id_table, uaa);
265		if (id)
266			break;
267	}
268	mtx_unlock(&Giant);
269
270	if (id == NULL) {
271		return (ENXIO);
272	}
273	if (usb_linux_create_usb_device(uaa->device, dev) != 0)
274		return (ENOMEM);
275	device_set_usb_desc(dev);
276
277	sc->sc_fbsd_udev = uaa->device;
278	sc->sc_fbsd_dev = dev;
279	sc->sc_udrv = udrv;
280	sc->sc_ui = usb_ifnum_to_if(uaa->device, uaa->info.bIfaceNum);
281	if (sc->sc_ui == NULL) {
282		return (EINVAL);
283	}
284	if (udrv->probe) {
285		if ((udrv->probe) (sc->sc_ui, id)) {
286			return (ENXIO);
287		}
288	}
289	mtx_lock(&Giant);
290	LIST_INSERT_HEAD(&usb_linux_attached_list, sc, sc_attached_list);
291	mtx_unlock(&Giant);
292
293	/* success */
294	return (0);
295}
296
297/*------------------------------------------------------------------------*
298 *	usb_linux_detach
299 *
300 * This function is the FreeBSD detach callback. It is called from the
301 * FreeBSD USB stack through the "device_detach()" function.
302 *------------------------------------------------------------------------*/
303static int
304usb_linux_detach(device_t dev)
305{
306	struct usb_linux_softc *sc = device_get_softc(dev);
307	struct usb_driver *udrv = NULL;
308
309	mtx_lock(&Giant);
310	if (sc->sc_attached_list.le_prev) {
311		LIST_REMOVE(sc, sc_attached_list);
312		sc->sc_attached_list.le_prev = NULL;
313		udrv = sc->sc_udrv;
314		sc->sc_udrv = NULL;
315	}
316	mtx_unlock(&Giant);
317
318	if (udrv && udrv->disconnect) {
319		(udrv->disconnect) (sc->sc_ui);
320	}
321	/*
322	 * Make sure that we free all FreeBSD USB transfers belonging to
323	 * this Linux "usb_interface", hence they will most likely not be
324	 * needed any more.
325	 */
326	usb_linux_cleanup_interface(sc->sc_fbsd_udev, sc->sc_ui);
327	return (0);
328}
329
330/*------------------------------------------------------------------------*
331 *	usb_linux_suspend
332 *
333 * This function is the FreeBSD suspend callback. Usually it does nothing.
334 *------------------------------------------------------------------------*/
335static int
336usb_linux_suspend(device_t dev)
337{
338	struct usb_linux_softc *sc = device_get_softc(dev);
339	struct usb_driver *udrv = usb_linux_get_usb_driver(sc);
340	int err;
341
342	if (udrv && udrv->suspend) {
343		err = (udrv->suspend) (sc->sc_ui, 0);
344	}
345	return (0);
346}
347
348/*------------------------------------------------------------------------*
349 *	usb_linux_resume
350 *
351 * This function is the FreeBSD resume callback. Usually it does nothing.
352 *------------------------------------------------------------------------*/
353static int
354usb_linux_resume(device_t dev)
355{
356	struct usb_linux_softc *sc = device_get_softc(dev);
357	struct usb_driver *udrv = usb_linux_get_usb_driver(sc);
358	int err;
359
360	if (udrv && udrv->resume) {
361		err = (udrv->resume) (sc->sc_ui);
362	}
363	return (0);
364}
365
366/*------------------------------------------------------------------------*
367 * Linux emulation layer
368 *------------------------------------------------------------------------*/
369
370/*------------------------------------------------------------------------*
371 *	usb_max_isoc_frames
372 *
373 * The following function returns the maximum number of isochronous
374 * frames that we support per URB. It is not part of the Linux USB API.
375 *------------------------------------------------------------------------*/
376static uint16_t
377usb_max_isoc_frames(struct usb_device *dev)
378{
379	;				/* indent fix */
380	switch (usbd_get_speed(dev)) {
381	case USB_SPEED_LOW:
382	case USB_SPEED_FULL:
383		return (USB_MAX_FULL_SPEED_ISOC_FRAMES);
384	default:
385		return (USB_MAX_HIGH_SPEED_ISOC_FRAMES);
386	}
387}
388
389/*------------------------------------------------------------------------*
390 *	usb_submit_urb
391 *
392 * This function is used to queue an URB after that it has been
393 * initialized. If it returns non-zero, it means that the URB was not
394 * queued.
395 *------------------------------------------------------------------------*/
396int
397usb_submit_urb(struct urb *urb, uint16_t mem_flags)
398{
399	struct usb_host_endpoint *uhe;
400	uint8_t do_unlock;
401	int err;
402
403	if (urb == NULL)
404		return (-EINVAL);
405
406	do_unlock = mtx_owned(&Giant) ? 0 : 1;
407	if (do_unlock)
408		mtx_lock(&Giant);
409
410	if (urb->endpoint == NULL) {
411		err = -EINVAL;
412		goto done;
413	}
414
415	/*
416         * Check to see if the urb is in the process of being killed
417         * and stop a urb that is in the process of being killed from
418         * being re-submitted (e.g. from its completion callback
419         * function).
420         */
421	if (urb->kill_count != 0) {
422		err = -EPERM;
423		goto done;
424	}
425
426	uhe = urb->endpoint;
427
428	/*
429	 * Check that we have got a FreeBSD USB transfer that will dequeue
430	 * the URB structure and do the real transfer. If there are no USB
431	 * transfers, then we return an error.
432	 */
433	if (uhe->bsd_xfer[0] ||
434	    uhe->bsd_xfer[1]) {
435		/* we are ready! */
436
437		TAILQ_INSERT_TAIL(&uhe->bsd_urb_list, urb, bsd_urb_list);
438
439		urb->status = -EINPROGRESS;
440
441		usbd_transfer_start(uhe->bsd_xfer[0]);
442		usbd_transfer_start(uhe->bsd_xfer[1]);
443		err = 0;
444	} else {
445		/* no pipes have been setup yet! */
446		urb->status = -EINVAL;
447		err = -EINVAL;
448	}
449done:
450	if (do_unlock)
451		mtx_unlock(&Giant);
452	return (err);
453}
454
455/*------------------------------------------------------------------------*
456 *	usb_unlink_urb
457 *
458 * This function is used to stop an URB after that it is been
459 * submitted, but before the "complete" callback has been called. On
460 *------------------------------------------------------------------------*/
461int
462usb_unlink_urb(struct urb *urb)
463{
464	return (usb_unlink_urb_sub(urb, 0));
465}
466
467static void
468usb_unlink_bsd(struct usb_xfer *xfer,
469    struct urb *urb, uint8_t drain)
470{
471	if (xfer == NULL)
472		return;
473	if (!usbd_transfer_pending(xfer))
474		return;
475	if (xfer->priv_fifo == (void *)urb) {
476		if (drain) {
477			mtx_unlock(&Giant);
478			usbd_transfer_drain(xfer);
479			mtx_lock(&Giant);
480		} else {
481			usbd_transfer_stop(xfer);
482		}
483		usbd_transfer_start(xfer);
484	}
485}
486
487static int
488usb_unlink_urb_sub(struct urb *urb, uint8_t drain)
489{
490	struct usb_host_endpoint *uhe;
491	uint16_t x;
492	uint8_t do_unlock;
493	int err;
494
495	if (urb == NULL)
496		return (-EINVAL);
497
498	do_unlock = mtx_owned(&Giant) ? 0 : 1;
499	if (do_unlock)
500		mtx_lock(&Giant);
501	if (drain)
502		urb->kill_count++;
503
504	if (urb->endpoint == NULL) {
505		err = -EINVAL;
506		goto done;
507	}
508	uhe = urb->endpoint;
509
510	if (urb->bsd_urb_list.tqe_prev) {
511
512		/* not started yet, just remove it from the queue */
513		TAILQ_REMOVE(&uhe->bsd_urb_list, urb, bsd_urb_list);
514		urb->bsd_urb_list.tqe_prev = NULL;
515		urb->status = -ECONNRESET;
516		urb->actual_length = 0;
517
518		for (x = 0; x < urb->number_of_packets; x++) {
519			urb->iso_frame_desc[x].actual_length = 0;
520		}
521
522		if (urb->complete) {
523			(urb->complete) (urb);
524		}
525	} else {
526
527		/*
528		 * If the URB is not on the URB list, then check if one of
529		 * the FreeBSD USB transfer are processing the current URB.
530		 * If so, re-start that transfer, which will lead to the
531		 * termination of that URB:
532		 */
533		usb_unlink_bsd(uhe->bsd_xfer[0], urb, drain);
534		usb_unlink_bsd(uhe->bsd_xfer[1], urb, drain);
535	}
536	err = 0;
537done:
538	if (drain)
539		urb->kill_count--;
540	if (do_unlock)
541		mtx_unlock(&Giant);
542	return (err);
543}
544
545/*------------------------------------------------------------------------*
546 *	usb_clear_halt
547 *
548 * This function must always be used to clear the stall. Stall is when
549 * an USB endpoint returns a stall message to the USB host controller.
550 * Until the stall is cleared, no data can be transferred.
551 *------------------------------------------------------------------------*/
552int
553usb_clear_halt(struct usb_device *dev, struct usb_host_endpoint *uhe)
554{
555	struct usb_config cfg[1];
556	struct usb_endpoint *ep;
557	uint8_t type;
558	uint8_t addr;
559
560	if (uhe == NULL)
561		return (-EINVAL);
562
563	type = uhe->desc.bmAttributes & UE_XFERTYPE;
564	addr = uhe->desc.bEndpointAddress;
565
566	memset(cfg, 0, sizeof(cfg));
567
568	cfg[0].type = type;
569	cfg[0].endpoint = addr & UE_ADDR;
570	cfg[0].direction = addr & (UE_DIR_OUT | UE_DIR_IN);
571
572	ep = usbd_get_endpoint(dev, uhe->bsd_iface_index, cfg);
573	if (ep == NULL)
574		return (-EINVAL);
575
576	usbd_clear_data_toggle(dev, ep);
577
578	return (usb_control_msg(dev, &dev->ep0,
579	    UR_CLEAR_FEATURE, UT_WRITE_ENDPOINT,
580	    UF_ENDPOINT_HALT, addr, NULL, 0, 1000));
581}
582
583/*------------------------------------------------------------------------*
584 *	usb_start_wait_urb
585 *
586 * This is an internal function that is used to perform synchronous
587 * Linux USB transfers.
588 *------------------------------------------------------------------------*/
589static int
590usb_start_wait_urb(struct urb *urb, usb_timeout_t timeout, uint16_t *p_actlen)
591{
592	int err;
593	uint8_t do_unlock;
594
595	/* you must have a timeout! */
596	if (timeout == 0) {
597		timeout = 1;
598	}
599	urb->complete = &usb_linux_wait_complete;
600	urb->timeout = timeout;
601	urb->transfer_flags |= URB_WAIT_WAKEUP;
602	urb->transfer_flags &= ~URB_IS_SLEEPING;
603
604	do_unlock = mtx_owned(&Giant) ? 0 : 1;
605	if (do_unlock)
606		mtx_lock(&Giant);
607	err = usb_submit_urb(urb, 0);
608	if (err)
609		goto done;
610
611	/*
612	 * the URB might have completed before we get here, so check that by
613	 * using some flags!
614	 */
615	while (urb->transfer_flags & URB_WAIT_WAKEUP) {
616		urb->transfer_flags |= URB_IS_SLEEPING;
617		cv_wait(&urb->cv_wait, &Giant);
618		urb->transfer_flags &= ~URB_IS_SLEEPING;
619	}
620
621	err = urb->status;
622
623done:
624	if (do_unlock)
625		mtx_unlock(&Giant);
626	if (p_actlen != NULL) {
627		if (err)
628			*p_actlen = 0;
629		else
630			*p_actlen = urb->actual_length;
631	}
632	return (err);
633}
634
635/*------------------------------------------------------------------------*
636 *	usb_control_msg
637 *
638 * The following function performs a control transfer sequence one any
639 * control, bulk or interrupt endpoint, specified by "uhe". A control
640 * transfer means that you transfer an 8-byte header first followed by
641 * a data-phase as indicated by the 8-byte header. The "timeout" is
642 * given in milliseconds.
643 *
644 * Return values:
645 *   0: Success
646 * < 0: Failure
647 * > 0: Acutal length
648 *------------------------------------------------------------------------*/
649int
650usb_control_msg(struct usb_device *dev, struct usb_host_endpoint *uhe,
651    uint8_t request, uint8_t requesttype,
652    uint16_t value, uint16_t index, void *data,
653    uint16_t size, usb_timeout_t timeout)
654{
655	struct usb_device_request req;
656	struct urb *urb;
657	int err;
658	uint16_t actlen;
659	uint8_t type;
660	uint8_t addr;
661
662	req.bmRequestType = requesttype;
663	req.bRequest = request;
664	USETW(req.wValue, value);
665	USETW(req.wIndex, index);
666	USETW(req.wLength, size);
667
668	if (uhe == NULL) {
669		return (-EINVAL);
670	}
671	type = (uhe->desc.bmAttributes & UE_XFERTYPE);
672	addr = (uhe->desc.bEndpointAddress & UE_ADDR);
673
674	if (type != UE_CONTROL) {
675		return (-EINVAL);
676	}
677	if (addr == 0) {
678		/*
679		 * The FreeBSD USB stack supports standard control
680		 * transfers on control endpoint zero:
681		 */
682		err = usbd_do_request_flags(dev,
683		    NULL, &req, data, USB_SHORT_XFER_OK,
684		    &actlen, timeout);
685		if (err) {
686			err = -EPIPE;
687		} else {
688			err = actlen;
689		}
690		return (err);
691	}
692	if (dev->flags.usb_mode != USB_MODE_HOST) {
693		/* not supported */
694		return (-EINVAL);
695	}
696	err = usb_setup_endpoint(dev, uhe, 1 /* dummy */ );
697
698	/*
699	 * NOTE: we need to allocate real memory here so that we don't
700	 * transfer data to/from the stack!
701	 *
702	 * 0xFFFF is a FreeBSD specific magic value.
703	 */
704	urb = usb_alloc_urb(0xFFFF, size);
705	if (urb == NULL)
706		return (-ENOMEM);
707
708	urb->dev = dev;
709	urb->endpoint = uhe;
710
711	memcpy(urb->setup_packet, &req, sizeof(req));
712
713	if (size && (!(req.bmRequestType & UT_READ))) {
714		/* move the data to a real buffer */
715		memcpy(USB_ADD_BYTES(urb->setup_packet, sizeof(req)),
716		    data, size);
717	}
718	err = usb_start_wait_urb(urb, timeout, &actlen);
719
720	if (req.bmRequestType & UT_READ) {
721		if (actlen) {
722			bcopy(USB_ADD_BYTES(urb->setup_packet,
723			    sizeof(req)), data, actlen);
724		}
725	}
726	usb_free_urb(urb);
727
728	if (err == 0) {
729		err = actlen;
730	}
731	return (err);
732}
733
734/*------------------------------------------------------------------------*
735 *	usb_set_interface
736 *
737 * The following function will select which alternate setting of an
738 * USB interface you plan to use. By default alternate setting with
739 * index zero is selected. Note that "iface_no" is not the interface
740 * index, but rather the value of "bInterfaceNumber".
741 *------------------------------------------------------------------------*/
742int
743usb_set_interface(struct usb_device *dev, uint8_t iface_no, uint8_t alt_index)
744{
745	struct usb_interface *p_ui = usb_ifnum_to_if(dev, iface_no);
746	int err;
747
748	if (p_ui == NULL)
749		return (-EINVAL);
750	if (alt_index >= p_ui->num_altsetting)
751		return (-EINVAL);
752	usb_linux_cleanup_interface(dev, p_ui);
753	err = -usbd_set_alt_interface_index(dev,
754	    p_ui->bsd_iface_index, alt_index);
755	if (err == 0) {
756		p_ui->cur_altsetting = p_ui->altsetting + alt_index;
757	}
758	return (err);
759}
760
761/*------------------------------------------------------------------------*
762 *	usb_setup_endpoint
763 *
764 * The following function is an extension to the Linux USB API that
765 * allows you to set a maximum buffer size for a given USB endpoint.
766 * The maximum buffer size is per URB. If you don't call this function
767 * to set a maximum buffer size, the endpoint will not be functional.
768 * Note that for isochronous endpoints the maximum buffer size must be
769 * a non-zero dummy, hence this function will base the maximum buffer
770 * size on "wMaxPacketSize".
771 *------------------------------------------------------------------------*/
772int
773usb_setup_endpoint(struct usb_device *dev,
774    struct usb_host_endpoint *uhe, usb_size_t bufsize)
775{
776	struct usb_config cfg[2];
777	uint8_t type = uhe->desc.bmAttributes & UE_XFERTYPE;
778	uint8_t addr = uhe->desc.bEndpointAddress;
779
780	if (uhe->fbsd_buf_size == bufsize) {
781		/* optimize */
782		return (0);
783	}
784	usbd_transfer_unsetup(uhe->bsd_xfer, 2);
785
786	uhe->fbsd_buf_size = bufsize;
787
788	if (bufsize == 0) {
789		return (0);
790	}
791	memset(cfg, 0, sizeof(cfg));
792
793	if (type == UE_ISOCHRONOUS) {
794
795		/*
796		 * Isochronous transfers are special in that they don't fit
797		 * into the BULK/INTR/CONTROL transfer model.
798		 */
799
800		cfg[0].type = type;
801		cfg[0].endpoint = addr & UE_ADDR;
802		cfg[0].direction = addr & (UE_DIR_OUT | UE_DIR_IN);
803		cfg[0].callback = &usb_linux_isoc_callback;
804		cfg[0].bufsize = 0;	/* use wMaxPacketSize */
805		cfg[0].frames = usb_max_isoc_frames(dev);
806		cfg[0].flags.proxy_buffer = 1;
807#if 0
808		/*
809		 * The Linux USB API allows non back-to-back
810		 * isochronous frames which we do not support. If the
811		 * isochronous frames are not back-to-back we need to
812		 * do a copy, and then we need a buffer for
813		 * that. Enable this at your own risk.
814		 */
815		cfg[0].flags.ext_buffer = 1;
816#endif
817		cfg[0].flags.short_xfer_ok = 1;
818
819		bcopy(cfg, cfg + 1, sizeof(*cfg));
820
821		/* Allocate and setup two generic FreeBSD USB transfers */
822
823		if (usbd_transfer_setup(dev, &uhe->bsd_iface_index,
824		    uhe->bsd_xfer, cfg, 2, uhe, &Giant)) {
825			return (-EINVAL);
826		}
827	} else {
828		if (bufsize > (1 << 22)) {
829			/* limit buffer size */
830			bufsize = (1 << 22);
831		}
832		/* Allocate and setup one generic FreeBSD USB transfer */
833
834		cfg[0].type = type;
835		cfg[0].endpoint = addr & UE_ADDR;
836		cfg[0].direction = addr & (UE_DIR_OUT | UE_DIR_IN);
837		cfg[0].callback = &usb_linux_non_isoc_callback;
838		cfg[0].bufsize = bufsize;
839		cfg[0].flags.ext_buffer = 1;	/* enable zero-copy */
840		cfg[0].flags.proxy_buffer = 1;
841		cfg[0].flags.short_xfer_ok = 1;
842
843		if (usbd_transfer_setup(dev, &uhe->bsd_iface_index,
844		    uhe->bsd_xfer, cfg, 1, uhe, &Giant)) {
845			return (-EINVAL);
846		}
847	}
848	return (0);
849}
850
851/*------------------------------------------------------------------------*
852 *	usb_linux_create_usb_device
853 *
854 * The following function is used to build up a per USB device
855 * structure tree, that mimics the Linux one. The root structure
856 * is returned by this function.
857 *------------------------------------------------------------------------*/
858static int
859usb_linux_create_usb_device(struct usb_device *udev, device_t dev)
860{
861	struct usb_config_descriptor *cd = usbd_get_config_descriptor(udev);
862	struct usb_descriptor *desc;
863	struct usb_interface_descriptor *id;
864	struct usb_endpoint_descriptor *ed;
865	struct usb_interface *p_ui = NULL;
866	struct usb_host_interface *p_uhi = NULL;
867	struct usb_host_endpoint *p_uhe = NULL;
868	usb_size_t size;
869	uint16_t niface_total;
870	uint16_t nedesc;
871	uint16_t iface_no_curr;
872	uint16_t iface_index;
873	uint8_t pass;
874	uint8_t iface_no;
875
876	/*
877	 * We do two passes. One pass for computing necessary memory size
878	 * and one pass to initialize all the allocated memory structures.
879	 */
880	for (pass = 0; pass < 2; pass++) {
881
882		iface_no_curr = 0xFFFF;
883		niface_total = 0;
884		iface_index = 0;
885		nedesc = 0;
886		desc = NULL;
887
888		/*
889		 * Iterate over all the USB descriptors. Use the USB config
890		 * descriptor pointer provided by the FreeBSD USB stack.
891		 */
892		while ((desc = usb_desc_foreach(cd, desc))) {
893
894			/*
895			 * Build up a tree according to the descriptors we
896			 * find:
897			 */
898			switch (desc->bDescriptorType) {
899			case UDESC_DEVICE:
900				break;
901
902			case UDESC_ENDPOINT:
903				ed = (void *)desc;
904				if ((ed->bLength < sizeof(*ed)) ||
905				    (iface_index == 0))
906					break;
907				if (p_uhe) {
908					bcopy(ed, &p_uhe->desc, sizeof(p_uhe->desc));
909					p_uhe->bsd_iface_index = iface_index - 1;
910					TAILQ_INIT(&p_uhe->bsd_urb_list);
911					p_uhe++;
912				}
913				if (p_uhi) {
914					(p_uhi - 1)->desc.bNumEndpoints++;
915				}
916				nedesc++;
917				break;
918
919			case UDESC_INTERFACE:
920				id = (void *)desc;
921				if (id->bLength < sizeof(*id))
922					break;
923				if (p_uhi) {
924					bcopy(id, &p_uhi->desc, sizeof(p_uhi->desc));
925					p_uhi->desc.bNumEndpoints = 0;
926					p_uhi->endpoint = p_uhe;
927					p_uhi->string = "";
928					p_uhi->bsd_iface_index = iface_index;
929					p_uhi++;
930				}
931				iface_no = id->bInterfaceNumber;
932				niface_total++;
933				if (iface_no_curr != iface_no) {
934					if (p_ui) {
935						p_ui->altsetting = p_uhi - 1;
936						p_ui->cur_altsetting = p_uhi - 1;
937						p_ui->num_altsetting = 1;
938						p_ui->bsd_iface_index = iface_index;
939						p_ui->linux_udev = udev;
940						p_ui++;
941					}
942					iface_no_curr = iface_no;
943					iface_index++;
944				} else {
945					if (p_ui) {
946						(p_ui - 1)->num_altsetting++;
947					}
948				}
949				break;
950
951			default:
952				break;
953			}
954		}
955
956		if (pass == 0) {
957
958			size = (sizeof(*p_uhe) * nedesc) +
959			    (sizeof(*p_ui) * iface_index) +
960			    (sizeof(*p_uhi) * niface_total);
961
962			p_uhe = malloc(size, M_USBDEV, M_WAITOK | M_ZERO);
963			p_ui = (void *)(p_uhe + nedesc);
964			p_uhi = (void *)(p_ui + iface_index);
965
966			udev->linux_iface_start = p_ui;
967			udev->linux_iface_end = p_ui + iface_index;
968			udev->linux_endpoint_start = p_uhe;
969			udev->linux_endpoint_end = p_uhe + nedesc;
970			udev->devnum = device_get_unit(dev);
971			bcopy(&udev->ddesc, &udev->descriptor,
972			    sizeof(udev->descriptor));
973			bcopy(udev->ctrl_ep.edesc, &udev->ep0.desc,
974			    sizeof(udev->ep0.desc));
975		}
976	}
977	return (0);
978}
979
980/*------------------------------------------------------------------------*
981 *	usb_alloc_urb
982 *
983 * This function should always be used when you allocate an URB for
984 * use with the USB Linux stack. In case of an isochronous transfer
985 * you must specifiy the maximum number of "iso_packets" which you
986 * plan to transfer per URB. This function is always blocking, and
987 * "mem_flags" are not regarded like on Linux.
988 *------------------------------------------------------------------------*/
989struct urb *
990usb_alloc_urb(uint16_t iso_packets, uint16_t mem_flags)
991{
992	struct urb *urb;
993	usb_size_t size;
994
995	if (iso_packets == 0xFFFF) {
996		/*
997		 * FreeBSD specific magic value to ask for control transfer
998		 * memory allocation:
999		 */
1000		size = sizeof(*urb) + sizeof(struct usb_device_request) + mem_flags;
1001	} else {
1002		size = sizeof(*urb) + (iso_packets * sizeof(urb->iso_frame_desc[0]));
1003	}
1004
1005	urb = malloc(size, M_USBDEV, M_WAITOK | M_ZERO);
1006	if (urb) {
1007
1008		cv_init(&urb->cv_wait, "URBWAIT");
1009		if (iso_packets == 0xFFFF) {
1010			urb->setup_packet = (void *)(urb + 1);
1011			urb->transfer_buffer = (void *)(urb->setup_packet +
1012			    sizeof(struct usb_device_request));
1013		} else {
1014			urb->number_of_packets = iso_packets;
1015		}
1016	}
1017	return (urb);
1018}
1019
1020/*------------------------------------------------------------------------*
1021 *	usb_find_host_endpoint
1022 *
1023 * The following function will return the Linux USB host endpoint
1024 * structure that matches the given endpoint type and endpoint
1025 * value. If no match is found, NULL is returned. This function is not
1026 * part of the Linux USB API and is only used internally.
1027 *------------------------------------------------------------------------*/
1028struct usb_host_endpoint *
1029usb_find_host_endpoint(struct usb_device *dev, uint8_t type, uint8_t ep)
1030{
1031	struct usb_host_endpoint *uhe;
1032	struct usb_host_endpoint *uhe_end;
1033	struct usb_host_interface *uhi;
1034	struct usb_interface *ui;
1035	uint8_t ea;
1036	uint8_t at;
1037	uint8_t mask;
1038
1039	if (dev == NULL) {
1040		return (NULL);
1041	}
1042	if (type == UE_CONTROL) {
1043		mask = UE_ADDR;
1044	} else {
1045		mask = (UE_DIR_IN | UE_DIR_OUT | UE_ADDR);
1046	}
1047
1048	ep &= mask;
1049
1050	/*
1051	 * Iterate over all the interfaces searching the selected alternate
1052	 * setting only, and all belonging endpoints.
1053	 */
1054	for (ui = dev->linux_iface_start;
1055	    ui != dev->linux_iface_end;
1056	    ui++) {
1057		uhi = ui->cur_altsetting;
1058		if (uhi) {
1059			uhe_end = uhi->endpoint + uhi->desc.bNumEndpoints;
1060			for (uhe = uhi->endpoint;
1061			    uhe != uhe_end;
1062			    uhe++) {
1063				ea = uhe->desc.bEndpointAddress;
1064				at = uhe->desc.bmAttributes;
1065
1066				if (((ea & mask) == ep) &&
1067				    ((at & UE_XFERTYPE) == type)) {
1068					return (uhe);
1069				}
1070			}
1071		}
1072	}
1073
1074	if ((type == UE_CONTROL) && ((ep & UE_ADDR) == 0)) {
1075		return (&dev->ep0);
1076	}
1077	return (NULL);
1078}
1079
1080/*------------------------------------------------------------------------*
1081 *	usb_altnum_to_altsetting
1082 *
1083 * The following function returns a pointer to an alternate setting by
1084 * index given a "usb_interface" pointer. If the alternate setting by
1085 * index does not exist, NULL is returned. And alternate setting is a
1086 * variant of an interface, but usually with slightly different
1087 * characteristics.
1088 *------------------------------------------------------------------------*/
1089struct usb_host_interface *
1090usb_altnum_to_altsetting(const struct usb_interface *intf, uint8_t alt_index)
1091{
1092	if (alt_index >= intf->num_altsetting) {
1093		return (NULL);
1094	}
1095	return (intf->altsetting + alt_index);
1096}
1097
1098/*------------------------------------------------------------------------*
1099 *	usb_ifnum_to_if
1100 *
1101 * The following function searches up an USB interface by
1102 * "bInterfaceNumber". If no match is found, NULL is returned.
1103 *------------------------------------------------------------------------*/
1104struct usb_interface *
1105usb_ifnum_to_if(struct usb_device *dev, uint8_t iface_no)
1106{
1107	struct usb_interface *p_ui;
1108
1109	for (p_ui = dev->linux_iface_start;
1110	    p_ui != dev->linux_iface_end;
1111	    p_ui++) {
1112		if ((p_ui->num_altsetting > 0) &&
1113		    (p_ui->altsetting->desc.bInterfaceNumber == iface_no)) {
1114			return (p_ui);
1115		}
1116	}
1117	return (NULL);
1118}
1119
1120/*------------------------------------------------------------------------*
1121 *	usb_buffer_alloc
1122 *------------------------------------------------------------------------*/
1123void   *
1124usb_buffer_alloc(struct usb_device *dev, usb_size_t size, uint16_t mem_flags, uint8_t *dma_addr)
1125{
1126	return (malloc(size, M_USBDEV, M_WAITOK | M_ZERO));
1127}
1128
1129/*------------------------------------------------------------------------*
1130 *	usbd_get_intfdata
1131 *------------------------------------------------------------------------*/
1132void   *
1133usbd_get_intfdata(struct usb_interface *intf)
1134{
1135	return (intf->bsd_priv_sc);
1136}
1137
1138/*------------------------------------------------------------------------*
1139 *	usb_linux_register
1140 *
1141 * The following function is used by the "USB_DRIVER_EXPORT()" macro,
1142 * and is used to register a Linux USB driver, so that its
1143 * "usb_device_id" structures gets searched a probe time. This
1144 * function is not part of the Linux USB API, and is for internal use
1145 * only.
1146 *------------------------------------------------------------------------*/
1147void
1148usb_linux_register(void *arg)
1149{
1150	struct usb_driver *drv = arg;
1151
1152	mtx_lock(&Giant);
1153	LIST_INSERT_HEAD(&usb_linux_driver_list, drv, linux_driver_list);
1154	mtx_unlock(&Giant);
1155
1156	usb_needs_explore_all();
1157}
1158
1159/*------------------------------------------------------------------------*
1160 *	usb_linux_deregister
1161 *
1162 * The following function is used by the "USB_DRIVER_EXPORT()" macro,
1163 * and is used to deregister a Linux USB driver. This function will
1164 * ensure that all driver instances belonging to the Linux USB device
1165 * driver in question, gets detached before the driver is
1166 * unloaded. This function is not part of the Linux USB API, and is
1167 * for internal use only.
1168 *------------------------------------------------------------------------*/
1169void
1170usb_linux_deregister(void *arg)
1171{
1172	struct usb_driver *drv = arg;
1173	struct usb_linux_softc *sc;
1174
1175repeat:
1176	mtx_lock(&Giant);
1177	LIST_FOREACH(sc, &usb_linux_attached_list, sc_attached_list) {
1178		if (sc->sc_udrv == drv) {
1179			mtx_unlock(&Giant);
1180			device_detach(sc->sc_fbsd_dev);
1181			goto repeat;
1182		}
1183	}
1184	LIST_REMOVE(drv, linux_driver_list);
1185	mtx_unlock(&Giant);
1186}
1187
1188/*------------------------------------------------------------------------*
1189 *	usb_linux_free_device
1190 *
1191 * The following function is only used by the FreeBSD USB stack, to
1192 * cleanup and free memory after that a Linux USB device was attached.
1193 *------------------------------------------------------------------------*/
1194void
1195usb_linux_free_device(struct usb_device *dev)
1196{
1197	struct usb_host_endpoint *uhe;
1198	struct usb_host_endpoint *uhe_end;
1199	int err;
1200
1201	uhe = dev->linux_endpoint_start;
1202	uhe_end = dev->linux_endpoint_end;
1203	while (uhe != uhe_end) {
1204		err = usb_setup_endpoint(dev, uhe, 0);
1205		uhe++;
1206	}
1207	err = usb_setup_endpoint(dev, &dev->ep0, 0);
1208	free(dev->linux_endpoint_start, M_USBDEV);
1209}
1210
1211/*------------------------------------------------------------------------*
1212 *	usb_buffer_free
1213 *------------------------------------------------------------------------*/
1214void
1215usb_buffer_free(struct usb_device *dev, usb_size_t size,
1216    void *addr, uint8_t dma_addr)
1217{
1218	free(addr, M_USBDEV);
1219}
1220
1221/*------------------------------------------------------------------------*
1222 *	usb_free_urb
1223 *------------------------------------------------------------------------*/
1224void
1225usb_free_urb(struct urb *urb)
1226{
1227	if (urb == NULL) {
1228		return;
1229	}
1230	/* make sure that the current URB is not active */
1231	usb_kill_urb(urb);
1232
1233	/* destroy condition variable */
1234	cv_destroy(&urb->cv_wait);
1235
1236	/* just free it */
1237	free(urb, M_USBDEV);
1238}
1239
1240/*------------------------------------------------------------------------*
1241 *	usb_init_urb
1242 *
1243 * The following function can be used to initialize a custom URB. It
1244 * is not recommended to use this function. Use "usb_alloc_urb()"
1245 * instead.
1246 *------------------------------------------------------------------------*/
1247void
1248usb_init_urb(struct urb *urb)
1249{
1250	if (urb == NULL) {
1251		return;
1252	}
1253	memset(urb, 0, sizeof(*urb));
1254}
1255
1256/*------------------------------------------------------------------------*
1257 *	usb_kill_urb
1258 *------------------------------------------------------------------------*/
1259void
1260usb_kill_urb(struct urb *urb)
1261{
1262	usb_unlink_urb_sub(urb, 1);
1263}
1264
1265/*------------------------------------------------------------------------*
1266 *	usb_set_intfdata
1267 *
1268 * The following function sets the per Linux USB interface private
1269 * data pointer. It is used by most Linux USB device drivers.
1270 *------------------------------------------------------------------------*/
1271void
1272usb_set_intfdata(struct usb_interface *intf, void *data)
1273{
1274	intf->bsd_priv_sc = data;
1275}
1276
1277/*------------------------------------------------------------------------*
1278 *	usb_linux_cleanup_interface
1279 *
1280 * The following function will release all FreeBSD USB transfers
1281 * associated with a Linux USB interface. It is for internal use only.
1282 *------------------------------------------------------------------------*/
1283static void
1284usb_linux_cleanup_interface(struct usb_device *dev, struct usb_interface *iface)
1285{
1286	struct usb_host_interface *uhi;
1287	struct usb_host_interface *uhi_end;
1288	struct usb_host_endpoint *uhe;
1289	struct usb_host_endpoint *uhe_end;
1290	int err;
1291
1292	uhi = iface->altsetting;
1293	uhi_end = iface->altsetting + iface->num_altsetting;
1294	while (uhi != uhi_end) {
1295		uhe = uhi->endpoint;
1296		uhe_end = uhi->endpoint + uhi->desc.bNumEndpoints;
1297		while (uhe != uhe_end) {
1298			err = usb_setup_endpoint(dev, uhe, 0);
1299			uhe++;
1300		}
1301		uhi++;
1302	}
1303}
1304
1305/*------------------------------------------------------------------------*
1306 *	usb_linux_wait_complete
1307 *
1308 * The following function is used by "usb_start_wait_urb()" to wake it
1309 * up, when an USB transfer has finished.
1310 *------------------------------------------------------------------------*/
1311static void
1312usb_linux_wait_complete(struct urb *urb)
1313{
1314	if (urb->transfer_flags & URB_IS_SLEEPING) {
1315		cv_signal(&urb->cv_wait);
1316	}
1317	urb->transfer_flags &= ~URB_WAIT_WAKEUP;
1318}
1319
1320/*------------------------------------------------------------------------*
1321 *	usb_linux_complete
1322 *------------------------------------------------------------------------*/
1323static void
1324usb_linux_complete(struct usb_xfer *xfer)
1325{
1326	struct urb *urb;
1327
1328	urb = usbd_xfer_get_priv(xfer);
1329	usbd_xfer_set_priv(xfer, NULL);
1330	if (urb->complete) {
1331		(urb->complete) (urb);
1332	}
1333}
1334
1335/*------------------------------------------------------------------------*
1336 *	usb_linux_isoc_callback
1337 *
1338 * The following is the FreeBSD isochronous USB callback. Isochronous
1339 * frames are USB packets transferred 1000 or 8000 times per second,
1340 * depending on whether a full- or high- speed USB transfer is
1341 * used.
1342 *------------------------------------------------------------------------*/
1343static void
1344usb_linux_isoc_callback(struct usb_xfer *xfer, usb_error_t error)
1345{
1346	usb_frlength_t max_frame = xfer->max_frame_size;
1347	usb_frlength_t offset;
1348	usb_frcount_t x;
1349	struct urb *urb = usbd_xfer_get_priv(xfer);
1350	struct usb_host_endpoint *uhe = usbd_xfer_softc(xfer);
1351	struct usb_iso_packet_descriptor *uipd;
1352
1353	DPRINTF("\n");
1354
1355	switch (USB_GET_STATE(xfer)) {
1356	case USB_ST_TRANSFERRED:
1357
1358		if (urb->bsd_isread) {
1359
1360			/* copy in data with regard to the URB */
1361
1362			offset = 0;
1363
1364			for (x = 0; x < urb->number_of_packets; x++) {
1365				uipd = urb->iso_frame_desc + x;
1366				if (uipd->length > xfer->frlengths[x]) {
1367					if (urb->transfer_flags & URB_SHORT_NOT_OK) {
1368						/* XXX should be EREMOTEIO */
1369						uipd->status = -EPIPE;
1370					} else {
1371						uipd->status = 0;
1372					}
1373				} else {
1374					uipd->status = 0;
1375				}
1376				uipd->actual_length = xfer->frlengths[x];
1377				if (!xfer->flags.ext_buffer) {
1378					usbd_copy_out(xfer->frbuffers, offset,
1379					    USB_ADD_BYTES(urb->transfer_buffer,
1380					    uipd->offset), uipd->actual_length);
1381				}
1382				offset += max_frame;
1383			}
1384		} else {
1385			for (x = 0; x < urb->number_of_packets; x++) {
1386				uipd = urb->iso_frame_desc + x;
1387				uipd->actual_length = xfer->frlengths[x];
1388				uipd->status = 0;
1389			}
1390		}
1391
1392		urb->actual_length = xfer->actlen;
1393
1394		/* check for short transfer */
1395		if (xfer->actlen < xfer->sumlen) {
1396			/* short transfer */
1397			if (urb->transfer_flags & URB_SHORT_NOT_OK) {
1398				/* XXX should be EREMOTEIO */
1399				urb->status = -EPIPE;
1400			} else {
1401				urb->status = 0;
1402			}
1403		} else {
1404			/* success */
1405			urb->status = 0;
1406		}
1407
1408		/* call callback */
1409		usb_linux_complete(xfer);
1410
1411	case USB_ST_SETUP:
1412tr_setup:
1413
1414		if (xfer->priv_fifo == NULL) {
1415
1416			/* get next transfer */
1417			urb = TAILQ_FIRST(&uhe->bsd_urb_list);
1418			if (urb == NULL) {
1419				/* nothing to do */
1420				return;
1421			}
1422			TAILQ_REMOVE(&uhe->bsd_urb_list, urb, bsd_urb_list);
1423			urb->bsd_urb_list.tqe_prev = NULL;
1424
1425			x = xfer->max_frame_count;
1426			if (urb->number_of_packets > x) {
1427				/* XXX simply truncate the transfer */
1428				urb->number_of_packets = x;
1429			}
1430		} else {
1431			DPRINTF("Already got a transfer\n");
1432
1433			/* already got a transfer (should not happen) */
1434			urb = usbd_xfer_get_priv(xfer);
1435		}
1436
1437		urb->bsd_isread = (uhe->desc.bEndpointAddress & UE_DIR_IN) ? 1 : 0;
1438
1439		if (xfer->flags.ext_buffer) {
1440			/* set virtual address to load */
1441			usbd_xfer_set_frame_data(xfer, 0, urb->transfer_buffer, 0);
1442		}
1443		if (!(urb->bsd_isread)) {
1444
1445			/* copy out data with regard to the URB */
1446
1447			offset = 0;
1448
1449			for (x = 0; x < urb->number_of_packets; x++) {
1450				uipd = urb->iso_frame_desc + x;
1451				usbd_xfer_set_frame_len(xfer, x, uipd->length);
1452				if (!xfer->flags.ext_buffer) {
1453					usbd_copy_in(xfer->frbuffers, offset,
1454					    USB_ADD_BYTES(urb->transfer_buffer,
1455					    uipd->offset), uipd->length);
1456				}
1457				offset += uipd->length;
1458			}
1459		} else {
1460
1461			/*
1462			 * compute the transfer length into the "offset"
1463			 * variable
1464			 */
1465
1466			offset = urb->number_of_packets * max_frame;
1467
1468			/* setup "frlengths" array */
1469
1470			for (x = 0; x < urb->number_of_packets; x++) {
1471				uipd = urb->iso_frame_desc + x;
1472				usbd_xfer_set_frame_len(xfer, x, max_frame);
1473			}
1474		}
1475		usbd_xfer_set_priv(xfer, urb);
1476		xfer->flags.force_short_xfer = 0;
1477		xfer->timeout = urb->timeout;
1478		xfer->nframes = urb->number_of_packets;
1479		usbd_transfer_submit(xfer);
1480		return;
1481
1482	default:			/* Error */
1483		if (xfer->error == USB_ERR_CANCELLED) {
1484			urb->status = -ECONNRESET;
1485		} else {
1486			urb->status = -EPIPE;	/* stalled */
1487		}
1488
1489		/* Set zero for "actual_length" */
1490		urb->actual_length = 0;
1491
1492		/* Set zero for "actual_length" */
1493		for (x = 0; x < urb->number_of_packets; x++) {
1494			urb->iso_frame_desc[x].actual_length = 0;
1495			urb->iso_frame_desc[x].status = urb->status;
1496		}
1497
1498		/* call callback */
1499		usb_linux_complete(xfer);
1500
1501		if (xfer->error == USB_ERR_CANCELLED) {
1502			/* we need to return in this case */
1503			return;
1504		}
1505		goto tr_setup;
1506
1507	}
1508}
1509
1510/*------------------------------------------------------------------------*
1511 *	usb_linux_non_isoc_callback
1512 *
1513 * The following is the FreeBSD BULK/INTERRUPT and CONTROL USB
1514 * callback. It dequeues Linux USB stack compatible URB's, transforms
1515 * the URB fields into a FreeBSD USB transfer, and defragments the USB
1516 * transfer as required. When the transfer is complete the "complete"
1517 * callback is called.
1518 *------------------------------------------------------------------------*/
1519static void
1520usb_linux_non_isoc_callback(struct usb_xfer *xfer, usb_error_t error)
1521{
1522	enum {
1523		REQ_SIZE = sizeof(struct usb_device_request)
1524	};
1525	struct urb *urb = usbd_xfer_get_priv(xfer);
1526	struct usb_host_endpoint *uhe = usbd_xfer_softc(xfer);
1527	uint8_t *ptr;
1528	usb_frlength_t max_bulk = usbd_xfer_max_len(xfer);
1529	uint8_t data_frame = xfer->flags_int.control_xfr ? 1 : 0;
1530
1531	DPRINTF("\n");
1532
1533	switch (USB_GET_STATE(xfer)) {
1534	case USB_ST_TRANSFERRED:
1535
1536		if (xfer->flags_int.control_xfr) {
1537
1538			/* don't transfer the setup packet again: */
1539
1540			usbd_xfer_set_frame_len(xfer, 0, 0);
1541		}
1542		if (urb->bsd_isread && (!xfer->flags.ext_buffer)) {
1543			/* copy in data with regard to the URB */
1544			usbd_copy_out(xfer->frbuffers + data_frame, 0,
1545			    urb->bsd_data_ptr, xfer->frlengths[data_frame]);
1546		}
1547		urb->bsd_length_rem -= xfer->frlengths[data_frame];
1548		urb->bsd_data_ptr += xfer->frlengths[data_frame];
1549		urb->actual_length += xfer->frlengths[data_frame];
1550
1551		/* check for short transfer */
1552		if (xfer->actlen < xfer->sumlen) {
1553			urb->bsd_length_rem = 0;
1554
1555			/* short transfer */
1556			if (urb->transfer_flags & URB_SHORT_NOT_OK) {
1557				urb->status = -EPIPE;
1558			} else {
1559				urb->status = 0;
1560			}
1561		} else {
1562			/* check remainder */
1563			if (urb->bsd_length_rem > 0) {
1564				goto setup_bulk;
1565			}
1566			/* success */
1567			urb->status = 0;
1568		}
1569
1570		/* call callback */
1571		usb_linux_complete(xfer);
1572
1573	case USB_ST_SETUP:
1574tr_setup:
1575		/* get next transfer */
1576		urb = TAILQ_FIRST(&uhe->bsd_urb_list);
1577		if (urb == NULL) {
1578			/* nothing to do */
1579			return;
1580		}
1581		TAILQ_REMOVE(&uhe->bsd_urb_list, urb, bsd_urb_list);
1582		urb->bsd_urb_list.tqe_prev = NULL;
1583
1584		usbd_xfer_set_priv(xfer, urb);
1585		xfer->flags.force_short_xfer = 0;
1586		xfer->timeout = urb->timeout;
1587
1588		if (xfer->flags_int.control_xfr) {
1589
1590			/*
1591		         * USB control transfers need special handling.
1592		         * First copy in the header, then copy in data!
1593		         */
1594			if (!xfer->flags.ext_buffer) {
1595				usbd_copy_in(xfer->frbuffers, 0,
1596				    urb->setup_packet, REQ_SIZE);
1597				usbd_xfer_set_frame_len(xfer, 0, REQ_SIZE);
1598			} else {
1599				/* set virtual address to load */
1600				usbd_xfer_set_frame_data(xfer, 0,
1601				    urb->setup_packet, REQ_SIZE);
1602			}
1603
1604			ptr = urb->setup_packet;
1605
1606			/* setup data transfer direction and length */
1607			urb->bsd_isread = (ptr[0] & UT_READ) ? 1 : 0;
1608			urb->bsd_length_rem = ptr[6] | (ptr[7] << 8);
1609
1610		} else {
1611
1612			/* setup data transfer direction */
1613
1614			urb->bsd_length_rem = urb->transfer_buffer_length;
1615			urb->bsd_isread = (uhe->desc.bEndpointAddress &
1616			    UE_DIR_IN) ? 1 : 0;
1617		}
1618
1619		urb->bsd_data_ptr = urb->transfer_buffer;
1620		urb->actual_length = 0;
1621
1622setup_bulk:
1623		if (max_bulk > urb->bsd_length_rem) {
1624			max_bulk = urb->bsd_length_rem;
1625		}
1626		/* check if we need to force a short transfer */
1627
1628		if ((max_bulk == urb->bsd_length_rem) &&
1629		    (urb->transfer_flags & URB_ZERO_PACKET) &&
1630		    (!xfer->flags_int.control_xfr)) {
1631			xfer->flags.force_short_xfer = 1;
1632		}
1633		/* check if we need to copy in data */
1634
1635		if (xfer->flags.ext_buffer) {
1636			/* set virtual address to load */
1637			usbd_xfer_set_frame_data(xfer, data_frame,
1638			    urb->bsd_data_ptr, max_bulk);
1639		} else if (!urb->bsd_isread) {
1640			/* copy out data with regard to the URB */
1641			usbd_copy_in(xfer->frbuffers + data_frame, 0,
1642			    urb->bsd_data_ptr, max_bulk);
1643			usbd_xfer_set_frame_len(xfer, data_frame, max_bulk);
1644		}
1645		if (xfer->flags_int.control_xfr) {
1646			if (max_bulk > 0) {
1647				xfer->nframes = 2;
1648			} else {
1649				xfer->nframes = 1;
1650			}
1651		} else {
1652			xfer->nframes = 1;
1653		}
1654		usbd_transfer_submit(xfer);
1655		return;
1656
1657	default:
1658		if (xfer->error == USB_ERR_CANCELLED) {
1659			urb->status = -ECONNRESET;
1660		} else {
1661			urb->status = -EPIPE;
1662		}
1663
1664		/* Set zero for "actual_length" */
1665		urb->actual_length = 0;
1666
1667		/* call callback */
1668		usb_linux_complete(xfer);
1669
1670		if (xfer->error == USB_ERR_CANCELLED) {
1671			/* we need to return in this case */
1672			return;
1673		}
1674		goto tr_setup;
1675	}
1676}
1677
1678/*------------------------------------------------------------------------*
1679 *	usb_fill_bulk_urb
1680 *------------------------------------------------------------------------*/
1681void
1682usb_fill_bulk_urb(struct urb *urb, struct usb_device *udev,
1683    struct usb_host_endpoint *uhe, void *buf,
1684    int length, usb_complete_t callback, void *arg)
1685{
1686	urb->dev = udev;
1687	urb->endpoint = uhe;
1688	urb->transfer_buffer = buf;
1689	urb->transfer_buffer_length = length;
1690	urb->complete = callback;
1691	urb->context = arg;
1692}
1693
1694/*------------------------------------------------------------------------*
1695 *	usb_bulk_msg
1696 *
1697 * NOTE: This function can also be used for interrupt endpoints!
1698 *
1699 * Return values:
1700 *    0: Success
1701 * Else: Failure
1702 *------------------------------------------------------------------------*/
1703int
1704usb_bulk_msg(struct usb_device *udev, struct usb_host_endpoint *uhe,
1705    void *data, int len, uint16_t *pactlen, usb_timeout_t timeout)
1706{
1707	struct urb *urb;
1708	int err;
1709
1710	if (uhe == NULL)
1711		return (-EINVAL);
1712	if (len < 0)
1713		return (-EINVAL);
1714
1715	err = usb_setup_endpoint(udev, uhe, 4096 /* bytes */);
1716	if (err)
1717		return (err);
1718
1719	urb = usb_alloc_urb(0, 0);
1720	if (urb == NULL)
1721		return (-ENOMEM);
1722
1723        usb_fill_bulk_urb(urb, udev, uhe, data, len,
1724	    usb_linux_wait_complete, NULL);
1725
1726	err = usb_start_wait_urb(urb, timeout, pactlen);
1727
1728	usb_free_urb(urb);
1729
1730	return (err);
1731}
1732