1/* $FreeBSD$ */
2/*-
3 * Copyright (c) 2007 Luigi Rizzo - Universita` di Pisa. All rights reserved.
4 * Copyright (c) 2007 Hans Petter Selasky. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 */
27
28#ifdef USB_GLOBAL_INCLUDE_FILE
29#include USB_GLOBAL_INCLUDE_FILE
30#else
31#include <sys/stdint.h>
32#include <sys/stddef.h>
33#include <sys/param.h>
34#include <sys/queue.h>
35#include <sys/types.h>
36#include <sys/systm.h>
37#include <sys/kernel.h>
38#include <sys/bus.h>
39#include <sys/module.h>
40#include <sys/lock.h>
41#include <sys/mutex.h>
42#include <sys/condvar.h>
43#include <sys/sysctl.h>
44#include <sys/sx.h>
45#include <sys/unistd.h>
46#include <sys/callout.h>
47#include <sys/malloc.h>
48#include <sys/priv.h>
49
50#include <dev/usb/usb.h>
51#include <dev/usb/usbdi.h>
52#include <dev/usb/usbdi_util.h>
53
54#define	USB_DEBUG_VAR usb_debug
55
56#include <dev/usb/usb_core.h>
57#include <linux/usb.h>
58#include <dev/usb/usb_process.h>
59#include <dev/usb/usb_device.h>
60#include <dev/usb/usb_util.h>
61#include <dev/usb/usb_busdma.h>
62#include <dev/usb/usb_transfer.h>
63#include <dev/usb/usb_hub.h>
64#include <dev/usb/usb_request.h>
65#include <dev/usb/usb_debug.h>
66#include <dev/usb/usb_dynamic.h>
67#endif			/* USB_GLOBAL_INCLUDE_FILE */
68
69struct usb_linux_softc {
70	LIST_ENTRY(usb_linux_softc) sc_attached_list;
71
72	device_t sc_fbsd_dev;
73	struct usb_device *sc_fbsd_udev;
74	struct usb_interface *sc_ui;
75	struct usb_driver *sc_udrv;
76};
77
78/* prototypes */
79static device_probe_t usb_linux_probe;
80static device_attach_t usb_linux_attach;
81static device_detach_t usb_linux_detach;
82static device_suspend_t usb_linux_suspend;
83static device_resume_t usb_linux_resume;
84
85static usb_callback_t usb_linux_isoc_callback;
86static usb_callback_t usb_linux_non_isoc_callback;
87
88static usb_complete_t usb_linux_wait_complete;
89
90static uint16_t	usb_max_isoc_frames(struct usb_device *);
91static int	usb_start_wait_urb(struct urb *, usb_timeout_t, uint16_t *);
92static const struct usb_device_id *usb_linux_lookup_id(
93		    const struct usb_device_id *, struct usb_attach_arg *);
94static struct	usb_driver *usb_linux_get_usb_driver(struct usb_linux_softc *);
95static int	usb_linux_create_usb_device(struct usb_device *, device_t);
96static void	usb_linux_cleanup_interface(struct usb_device *,
97		    struct usb_interface *);
98static void	usb_linux_complete(struct usb_xfer *);
99static int	usb_unlink_urb_sub(struct urb *, uint8_t);
100
101/*------------------------------------------------------------------------*
102 * FreeBSD USB interface
103 *------------------------------------------------------------------------*/
104
105static LIST_HEAD(, usb_linux_softc) usb_linux_attached_list;
106static LIST_HEAD(, usb_driver) usb_linux_driver_list;
107
108static device_method_t usb_linux_methods[] = {
109	/* Device interface */
110	DEVMETHOD(device_probe, usb_linux_probe),
111	DEVMETHOD(device_attach, usb_linux_attach),
112	DEVMETHOD(device_detach, usb_linux_detach),
113	DEVMETHOD(device_suspend, usb_linux_suspend),
114	DEVMETHOD(device_resume, usb_linux_resume),
115
116	DEVMETHOD_END
117};
118
119static driver_t usb_linux_driver = {
120	.name = "usb_linux",
121	.methods = usb_linux_methods,
122	.size = sizeof(struct usb_linux_softc),
123};
124
125static devclass_t usb_linux_devclass;
126
127DRIVER_MODULE(usb_linux, uhub, usb_linux_driver, usb_linux_devclass, NULL, 0);
128MODULE_VERSION(usb_linux, 1);
129
130/*------------------------------------------------------------------------*
131 *	usb_linux_lookup_id
132 *
133 * This functions takes an array of "struct usb_device_id" and tries
134 * to match the entries with the information in "struct usb_attach_arg".
135 * If it finds a match the matching entry will be returned.
136 * Else "NULL" will be returned.
137 *------------------------------------------------------------------------*/
138static const struct usb_device_id *
139usb_linux_lookup_id(const struct usb_device_id *id, struct usb_attach_arg *uaa)
140{
141	if (id == NULL) {
142		goto done;
143	}
144	/*
145	 * Keep on matching array entries until we find one with
146	 * "match_flags" equal to zero, which indicates the end of the
147	 * array:
148	 */
149	for (; id->match_flags; id++) {
150		if ((id->match_flags & USB_DEVICE_ID_MATCH_VENDOR) &&
151		    (id->idVendor != uaa->info.idVendor)) {
152			continue;
153		}
154		if ((id->match_flags & USB_DEVICE_ID_MATCH_PRODUCT) &&
155		    (id->idProduct != uaa->info.idProduct)) {
156			continue;
157		}
158		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_LO) &&
159		    (id->bcdDevice_lo > uaa->info.bcdDevice)) {
160			continue;
161		}
162		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_HI) &&
163		    (id->bcdDevice_hi < uaa->info.bcdDevice)) {
164			continue;
165		}
166		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_CLASS) &&
167		    (id->bDeviceClass != uaa->info.bDeviceClass)) {
168			continue;
169		}
170		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_SUBCLASS) &&
171		    (id->bDeviceSubClass != uaa->info.bDeviceSubClass)) {
172			continue;
173		}
174		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_PROTOCOL) &&
175		    (id->bDeviceProtocol != uaa->info.bDeviceProtocol)) {
176			continue;
177		}
178		if ((uaa->info.bDeviceClass == 0xFF) &&
179		    !(id->match_flags & USB_DEVICE_ID_MATCH_VENDOR) &&
180		    (id->match_flags & (USB_DEVICE_ID_MATCH_INT_CLASS |
181		    USB_DEVICE_ID_MATCH_INT_SUBCLASS |
182		    USB_DEVICE_ID_MATCH_INT_PROTOCOL))) {
183			continue;
184		}
185		if ((id->match_flags & USB_DEVICE_ID_MATCH_INT_CLASS) &&
186		    (id->bInterfaceClass != uaa->info.bInterfaceClass)) {
187			continue;
188		}
189		if ((id->match_flags & USB_DEVICE_ID_MATCH_INT_SUBCLASS) &&
190		    (id->bInterfaceSubClass != uaa->info.bInterfaceSubClass)) {
191			continue;
192		}
193		if ((id->match_flags & USB_DEVICE_ID_MATCH_INT_PROTOCOL) &&
194		    (id->bInterfaceProtocol != uaa->info.bInterfaceProtocol)) {
195			continue;
196		}
197		/* we found a match! */
198		return (id);
199	}
200
201done:
202	return (NULL);
203}
204
205/*------------------------------------------------------------------------*
206 *	usb_linux_probe
207 *
208 * This function is the FreeBSD probe callback. It is called from the
209 * FreeBSD USB stack through the "device_probe_and_attach()" function.
210 *------------------------------------------------------------------------*/
211static int
212usb_linux_probe(device_t dev)
213{
214	struct usb_attach_arg *uaa = device_get_ivars(dev);
215	struct usb_driver *udrv;
216	int err = ENXIO;
217
218	if (uaa->usb_mode != USB_MODE_HOST) {
219		return (ENXIO);
220	}
221	mtx_lock(&Giant);
222	LIST_FOREACH(udrv, &usb_linux_driver_list, linux_driver_list) {
223		if (usb_linux_lookup_id(udrv->id_table, uaa)) {
224			err = 0;
225			break;
226		}
227	}
228	mtx_unlock(&Giant);
229
230	return (err);
231}
232
233/*------------------------------------------------------------------------*
234 *	usb_linux_get_usb_driver
235 *
236 * This function returns the pointer to the "struct usb_driver" where
237 * the Linux USB device driver "struct usb_device_id" match was found.
238 * We apply a lock before reading out the pointer to avoid races.
239 *------------------------------------------------------------------------*/
240static struct usb_driver *
241usb_linux_get_usb_driver(struct usb_linux_softc *sc)
242{
243	struct usb_driver *udrv;
244
245	mtx_lock(&Giant);
246	udrv = sc->sc_udrv;
247	mtx_unlock(&Giant);
248	return (udrv);
249}
250
251/*------------------------------------------------------------------------*
252 *	usb_linux_attach
253 *
254 * This function is the FreeBSD attach callback. It is called from the
255 * FreeBSD USB stack through the "device_probe_and_attach()" function.
256 * This function is called when "usb_linux_probe()" returns zero.
257 *------------------------------------------------------------------------*/
258static int
259usb_linux_attach(device_t dev)
260{
261	struct usb_attach_arg *uaa = device_get_ivars(dev);
262	struct usb_linux_softc *sc = device_get_softc(dev);
263	struct usb_driver *udrv;
264	const struct usb_device_id *id = NULL;
265
266	mtx_lock(&Giant);
267	LIST_FOREACH(udrv, &usb_linux_driver_list, linux_driver_list) {
268		id = usb_linux_lookup_id(udrv->id_table, uaa);
269		if (id)
270			break;
271	}
272	mtx_unlock(&Giant);
273
274	if (id == NULL) {
275		return (ENXIO);
276	}
277	if (usb_linux_create_usb_device(uaa->device, dev) != 0)
278		return (ENOMEM);
279	device_set_usb_desc(dev);
280
281	sc->sc_fbsd_udev = uaa->device;
282	sc->sc_fbsd_dev = dev;
283	sc->sc_udrv = udrv;
284	sc->sc_ui = usb_ifnum_to_if(uaa->device, uaa->info.bIfaceNum);
285	if (sc->sc_ui == NULL) {
286		return (EINVAL);
287	}
288	if (udrv->probe) {
289		if ((udrv->probe) (sc->sc_ui, id)) {
290			return (ENXIO);
291		}
292	}
293	mtx_lock(&Giant);
294	LIST_INSERT_HEAD(&usb_linux_attached_list, sc, sc_attached_list);
295	mtx_unlock(&Giant);
296
297	/* success */
298	return (0);
299}
300
301/*------------------------------------------------------------------------*
302 *	usb_linux_detach
303 *
304 * This function is the FreeBSD detach callback. It is called from the
305 * FreeBSD USB stack through the "device_detach()" function.
306 *------------------------------------------------------------------------*/
307static int
308usb_linux_detach(device_t dev)
309{
310	struct usb_linux_softc *sc = device_get_softc(dev);
311	struct usb_driver *udrv = NULL;
312
313	mtx_lock(&Giant);
314	if (sc->sc_attached_list.le_prev) {
315		LIST_REMOVE(sc, sc_attached_list);
316		sc->sc_attached_list.le_prev = NULL;
317		udrv = sc->sc_udrv;
318		sc->sc_udrv = NULL;
319	}
320	mtx_unlock(&Giant);
321
322	if (udrv && udrv->disconnect) {
323		(udrv->disconnect) (sc->sc_ui);
324	}
325	/*
326	 * Make sure that we free all FreeBSD USB transfers belonging to
327	 * this Linux "usb_interface", hence they will most likely not be
328	 * needed any more.
329	 */
330	usb_linux_cleanup_interface(sc->sc_fbsd_udev, sc->sc_ui);
331	return (0);
332}
333
334/*------------------------------------------------------------------------*
335 *	usb_linux_suspend
336 *
337 * This function is the FreeBSD suspend callback. Usually it does nothing.
338 *------------------------------------------------------------------------*/
339static int
340usb_linux_suspend(device_t dev)
341{
342	struct usb_linux_softc *sc = device_get_softc(dev);
343	struct usb_driver *udrv = usb_linux_get_usb_driver(sc);
344	int err;
345
346	if (udrv && udrv->suspend) {
347		err = (udrv->suspend) (sc->sc_ui, 0);
348	}
349	return (0);
350}
351
352/*------------------------------------------------------------------------*
353 *	usb_linux_resume
354 *
355 * This function is the FreeBSD resume callback. Usually it does nothing.
356 *------------------------------------------------------------------------*/
357static int
358usb_linux_resume(device_t dev)
359{
360	struct usb_linux_softc *sc = device_get_softc(dev);
361	struct usb_driver *udrv = usb_linux_get_usb_driver(sc);
362	int err;
363
364	if (udrv && udrv->resume) {
365		err = (udrv->resume) (sc->sc_ui);
366	}
367	return (0);
368}
369
370/*------------------------------------------------------------------------*
371 * Linux emulation layer
372 *------------------------------------------------------------------------*/
373
374/*------------------------------------------------------------------------*
375 *	usb_max_isoc_frames
376 *
377 * The following function returns the maximum number of isochronous
378 * frames that we support per URB. It is not part of the Linux USB API.
379 *------------------------------------------------------------------------*/
380static uint16_t
381usb_max_isoc_frames(struct usb_device *dev)
382{
383	;				/* indent fix */
384	switch (usbd_get_speed(dev)) {
385	case USB_SPEED_LOW:
386	case USB_SPEED_FULL:
387		return (USB_MAX_FULL_SPEED_ISOC_FRAMES);
388	default:
389		return (USB_MAX_HIGH_SPEED_ISOC_FRAMES);
390	}
391}
392
393/*------------------------------------------------------------------------*
394 *	usb_submit_urb
395 *
396 * This function is used to queue an URB after that it has been
397 * initialized. If it returns non-zero, it means that the URB was not
398 * queued.
399 *------------------------------------------------------------------------*/
400int
401usb_submit_urb(struct urb *urb, uint16_t mem_flags)
402{
403	struct usb_host_endpoint *uhe;
404	uint8_t do_unlock;
405	int err;
406
407	if (urb == NULL)
408		return (-EINVAL);
409
410	do_unlock = mtx_owned(&Giant) ? 0 : 1;
411	if (do_unlock)
412		mtx_lock(&Giant);
413
414	if (urb->endpoint == NULL) {
415		err = -EINVAL;
416		goto done;
417	}
418
419	/*
420	 * Check to see if the urb is in the process of being killed
421	 * and stop a urb that is in the process of being killed from
422	 * being re-submitted (e.g. from its completion callback
423	 * function).
424	 */
425	if (urb->kill_count != 0) {
426		err = -EPERM;
427		goto done;
428	}
429
430	uhe = urb->endpoint;
431
432	/*
433	 * Check that we have got a FreeBSD USB transfer that will dequeue
434	 * the URB structure and do the real transfer. If there are no USB
435	 * transfers, then we return an error.
436	 */
437	if (uhe->bsd_xfer[0] ||
438	    uhe->bsd_xfer[1]) {
439		/* we are ready! */
440
441		TAILQ_INSERT_TAIL(&uhe->bsd_urb_list, urb, bsd_urb_list);
442
443		urb->status = -EINPROGRESS;
444
445		usbd_transfer_start(uhe->bsd_xfer[0]);
446		usbd_transfer_start(uhe->bsd_xfer[1]);
447		err = 0;
448	} else {
449		/* no pipes have been setup yet! */
450		urb->status = -EINVAL;
451		err = -EINVAL;
452	}
453done:
454	if (do_unlock)
455		mtx_unlock(&Giant);
456	return (err);
457}
458
459/*------------------------------------------------------------------------*
460 *	usb_unlink_urb
461 *
462 * This function is used to stop an URB after that it is been
463 * submitted, but before the "complete" callback has been called. On
464 *------------------------------------------------------------------------*/
465int
466usb_unlink_urb(struct urb *urb)
467{
468	return (usb_unlink_urb_sub(urb, 0));
469}
470
471static void
472usb_unlink_bsd(struct usb_xfer *xfer,
473    struct urb *urb, uint8_t drain)
474{
475	if (xfer == NULL)
476		return;
477	if (!usbd_transfer_pending(xfer))
478		return;
479	if (xfer->priv_fifo == (void *)urb) {
480		if (drain) {
481			mtx_unlock(&Giant);
482			usbd_transfer_drain(xfer);
483			mtx_lock(&Giant);
484		} else {
485			usbd_transfer_stop(xfer);
486		}
487		usbd_transfer_start(xfer);
488	}
489}
490
491static int
492usb_unlink_urb_sub(struct urb *urb, uint8_t drain)
493{
494	struct usb_host_endpoint *uhe;
495	uint16_t x;
496	uint8_t do_unlock;
497	int err;
498
499	if (urb == NULL)
500		return (-EINVAL);
501
502	do_unlock = mtx_owned(&Giant) ? 0 : 1;
503	if (do_unlock)
504		mtx_lock(&Giant);
505	if (drain)
506		urb->kill_count++;
507
508	if (urb->endpoint == NULL) {
509		err = -EINVAL;
510		goto done;
511	}
512	uhe = urb->endpoint;
513
514	if (urb->bsd_urb_list.tqe_prev) {
515		/* not started yet, just remove it from the queue */
516		TAILQ_REMOVE(&uhe->bsd_urb_list, urb, bsd_urb_list);
517		urb->bsd_urb_list.tqe_prev = NULL;
518		urb->status = -ECONNRESET;
519		urb->actual_length = 0;
520
521		for (x = 0; x < urb->number_of_packets; x++) {
522			urb->iso_frame_desc[x].actual_length = 0;
523		}
524
525		if (urb->complete) {
526			(urb->complete) (urb);
527		}
528	} else {
529		/*
530		 * If the URB is not on the URB list, then check if one of
531		 * the FreeBSD USB transfer are processing the current URB.
532		 * If so, re-start that transfer, which will lead to the
533		 * termination of that URB:
534		 */
535		usb_unlink_bsd(uhe->bsd_xfer[0], urb, drain);
536		usb_unlink_bsd(uhe->bsd_xfer[1], urb, drain);
537	}
538	err = 0;
539done:
540	if (drain)
541		urb->kill_count--;
542	if (do_unlock)
543		mtx_unlock(&Giant);
544	return (err);
545}
546
547/*------------------------------------------------------------------------*
548 *	usb_clear_halt
549 *
550 * This function must always be used to clear the stall. Stall is when
551 * an USB endpoint returns a stall message to the USB host controller.
552 * Until the stall is cleared, no data can be transferred.
553 *------------------------------------------------------------------------*/
554int
555usb_clear_halt(struct usb_device *dev, struct usb_host_endpoint *uhe)
556{
557	struct usb_config cfg[1];
558	struct usb_endpoint *ep;
559	uint8_t type;
560	uint8_t addr;
561
562	if (uhe == NULL)
563		return (-EINVAL);
564
565	type = uhe->desc.bmAttributes & UE_XFERTYPE;
566	addr = uhe->desc.bEndpointAddress;
567
568	memset(cfg, 0, sizeof(cfg));
569
570	cfg[0].type = type;
571	cfg[0].endpoint = addr & UE_ADDR;
572	cfg[0].direction = addr & (UE_DIR_OUT | UE_DIR_IN);
573
574	ep = usbd_get_endpoint(dev, uhe->bsd_iface_index, cfg);
575	if (ep == NULL)
576		return (-EINVAL);
577
578	usbd_clear_data_toggle(dev, ep);
579
580	return (usb_control_msg(dev, &dev->ep0,
581	    UR_CLEAR_FEATURE, UT_WRITE_ENDPOINT,
582	    UF_ENDPOINT_HALT, addr, NULL, 0, 1000));
583}
584
585/*------------------------------------------------------------------------*
586 *	usb_start_wait_urb
587 *
588 * This is an internal function that is used to perform synchronous
589 * Linux USB transfers.
590 *------------------------------------------------------------------------*/
591static int
592usb_start_wait_urb(struct urb *urb, usb_timeout_t timeout, uint16_t *p_actlen)
593{
594	int err;
595	uint8_t do_unlock;
596
597	/* you must have a timeout! */
598	if (timeout == 0) {
599		timeout = 1;
600	}
601	urb->complete = &usb_linux_wait_complete;
602	urb->timeout = timeout;
603	urb->transfer_flags |= URB_WAIT_WAKEUP;
604	urb->transfer_flags &= ~URB_IS_SLEEPING;
605
606	do_unlock = mtx_owned(&Giant) ? 0 : 1;
607	if (do_unlock)
608		mtx_lock(&Giant);
609	err = usb_submit_urb(urb, 0);
610	if (err)
611		goto done;
612
613	/*
614	 * the URB might have completed before we get here, so check that by
615	 * using some flags!
616	 */
617	while (urb->transfer_flags & URB_WAIT_WAKEUP) {
618		urb->transfer_flags |= URB_IS_SLEEPING;
619		cv_wait(&urb->cv_wait, &Giant);
620		urb->transfer_flags &= ~URB_IS_SLEEPING;
621	}
622
623	err = urb->status;
624
625done:
626	if (do_unlock)
627		mtx_unlock(&Giant);
628	if (p_actlen != NULL) {
629		if (err)
630			*p_actlen = 0;
631		else
632			*p_actlen = urb->actual_length;
633	}
634	return (err);
635}
636
637/*------------------------------------------------------------------------*
638 *	usb_control_msg
639 *
640 * The following function performs a control transfer sequence one any
641 * control, bulk or interrupt endpoint, specified by "uhe". A control
642 * transfer means that you transfer an 8-byte header first followed by
643 * a data-phase as indicated by the 8-byte header. The "timeout" is
644 * given in milliseconds.
645 *
646 * Return values:
647 *   0: Success
648 * < 0: Failure
649 * > 0: Actual length
650 *------------------------------------------------------------------------*/
651int
652usb_control_msg(struct usb_device *dev, struct usb_host_endpoint *uhe,
653    uint8_t request, uint8_t requesttype,
654    uint16_t value, uint16_t index, void *data,
655    uint16_t size, usb_timeout_t timeout)
656{
657	struct usb_device_request req;
658	struct urb *urb;
659	int err;
660	uint16_t actlen;
661	uint8_t type;
662	uint8_t addr;
663
664	req.bmRequestType = requesttype;
665	req.bRequest = request;
666	USETW(req.wValue, value);
667	USETW(req.wIndex, index);
668	USETW(req.wLength, size);
669
670	if (uhe == NULL) {
671		return (-EINVAL);
672	}
673	type = (uhe->desc.bmAttributes & UE_XFERTYPE);
674	addr = (uhe->desc.bEndpointAddress & UE_ADDR);
675
676	if (type != UE_CONTROL) {
677		return (-EINVAL);
678	}
679	if (addr == 0) {
680		/*
681		 * The FreeBSD USB stack supports standard control
682		 * transfers on control endpoint zero:
683		 */
684		err = usbd_do_request_flags(dev,
685		    NULL, &req, data, USB_SHORT_XFER_OK,
686		    &actlen, timeout);
687		if (err) {
688			err = -EPIPE;
689		} else {
690			err = actlen;
691		}
692		return (err);
693	}
694	if (dev->flags.usb_mode != USB_MODE_HOST) {
695		/* not supported */
696		return (-EINVAL);
697	}
698	err = usb_setup_endpoint(dev, uhe, 1 /* dummy */ );
699
700	/*
701	 * NOTE: we need to allocate real memory here so that we don't
702	 * transfer data to/from the stack!
703	 *
704	 * 0xFFFF is a FreeBSD specific magic value.
705	 */
706	urb = usb_alloc_urb(0xFFFF, size);
707
708	urb->dev = dev;
709	urb->endpoint = uhe;
710
711	memcpy(urb->setup_packet, &req, sizeof(req));
712
713	if (size && (!(req.bmRequestType & UT_READ))) {
714		/* move the data to a real buffer */
715		memcpy(USB_ADD_BYTES(urb->setup_packet, sizeof(req)),
716		    data, size);
717	}
718	err = usb_start_wait_urb(urb, timeout, &actlen);
719
720	if (req.bmRequestType & UT_READ) {
721		if (actlen) {
722			bcopy(USB_ADD_BYTES(urb->setup_packet,
723			    sizeof(req)), data, actlen);
724		}
725	}
726	usb_free_urb(urb);
727
728	if (err == 0) {
729		err = actlen;
730	}
731	return (err);
732}
733
734/*------------------------------------------------------------------------*
735 *	usb_set_interface
736 *
737 * The following function will select which alternate setting of an
738 * USB interface you plan to use. By default alternate setting with
739 * index zero is selected. Note that "iface_no" is not the interface
740 * index, but rather the value of "bInterfaceNumber".
741 *------------------------------------------------------------------------*/
742int
743usb_set_interface(struct usb_device *dev, uint8_t iface_no, uint8_t alt_index)
744{
745	struct usb_interface *p_ui = usb_ifnum_to_if(dev, iface_no);
746	int err;
747
748	if (p_ui == NULL)
749		return (-EINVAL);
750	if (alt_index >= p_ui->num_altsetting)
751		return (-EINVAL);
752	usb_linux_cleanup_interface(dev, p_ui);
753	err = -usbd_set_alt_interface_index(dev,
754	    p_ui->bsd_iface_index, alt_index);
755	if (err == 0) {
756		p_ui->cur_altsetting = p_ui->altsetting + alt_index;
757	}
758	return (err);
759}
760
761/*------------------------------------------------------------------------*
762 *	usb_setup_endpoint
763 *
764 * The following function is an extension to the Linux USB API that
765 * allows you to set a maximum buffer size for a given USB endpoint.
766 * The maximum buffer size is per URB. If you don't call this function
767 * to set a maximum buffer size, the endpoint will not be functional.
768 * Note that for isochronous endpoints the maximum buffer size must be
769 * a non-zero dummy, hence this function will base the maximum buffer
770 * size on "wMaxPacketSize".
771 *------------------------------------------------------------------------*/
772int
773usb_setup_endpoint(struct usb_device *dev,
774    struct usb_host_endpoint *uhe, usb_size_t bufsize)
775{
776	struct usb_config cfg[2];
777	uint8_t type = uhe->desc.bmAttributes & UE_XFERTYPE;
778	uint8_t addr = uhe->desc.bEndpointAddress;
779
780	if (uhe->fbsd_buf_size == bufsize) {
781		/* optimize */
782		return (0);
783	}
784	usbd_transfer_unsetup(uhe->bsd_xfer, 2);
785
786	uhe->fbsd_buf_size = bufsize;
787
788	if (bufsize == 0) {
789		return (0);
790	}
791	memset(cfg, 0, sizeof(cfg));
792
793	if (type == UE_ISOCHRONOUS) {
794		/*
795		 * Isochronous transfers are special in that they don't fit
796		 * into the BULK/INTR/CONTROL transfer model.
797		 */
798
799		cfg[0].type = type;
800		cfg[0].endpoint = addr & UE_ADDR;
801		cfg[0].direction = addr & (UE_DIR_OUT | UE_DIR_IN);
802		cfg[0].callback = &usb_linux_isoc_callback;
803		cfg[0].bufsize = 0;	/* use wMaxPacketSize */
804		cfg[0].frames = usb_max_isoc_frames(dev);
805		cfg[0].flags.proxy_buffer = 1;
806#if 0
807		/*
808		 * The Linux USB API allows non back-to-back
809		 * isochronous frames which we do not support. If the
810		 * isochronous frames are not back-to-back we need to
811		 * do a copy, and then we need a buffer for
812		 * that. Enable this at your own risk.
813		 */
814		cfg[0].flags.ext_buffer = 1;
815#endif
816		cfg[0].flags.short_xfer_ok = 1;
817
818		bcopy(cfg, cfg + 1, sizeof(*cfg));
819
820		/* Allocate and setup two generic FreeBSD USB transfers */
821
822		if (usbd_transfer_setup(dev, &uhe->bsd_iface_index,
823		    uhe->bsd_xfer, cfg, 2, uhe, &Giant)) {
824			return (-EINVAL);
825		}
826	} else {
827		if (bufsize > (1 << 22)) {
828			/* limit buffer size */
829			bufsize = (1 << 22);
830		}
831		/* Allocate and setup one generic FreeBSD USB transfer */
832
833		cfg[0].type = type;
834		cfg[0].endpoint = addr & UE_ADDR;
835		cfg[0].direction = addr & (UE_DIR_OUT | UE_DIR_IN);
836		cfg[0].callback = &usb_linux_non_isoc_callback;
837		cfg[0].bufsize = bufsize;
838		cfg[0].flags.ext_buffer = 1;	/* enable zero-copy */
839		cfg[0].flags.proxy_buffer = 1;
840		cfg[0].flags.short_xfer_ok = 1;
841
842		if (usbd_transfer_setup(dev, &uhe->bsd_iface_index,
843		    uhe->bsd_xfer, cfg, 1, uhe, &Giant)) {
844			return (-EINVAL);
845		}
846	}
847	return (0);
848}
849
850/*------------------------------------------------------------------------*
851 *	usb_linux_create_usb_device
852 *
853 * The following function is used to build up a per USB device
854 * structure tree, that mimics the Linux one. The root structure
855 * is returned by this function.
856 *------------------------------------------------------------------------*/
857static int
858usb_linux_create_usb_device(struct usb_device *udev, device_t dev)
859{
860	struct usb_config_descriptor *cd = usbd_get_config_descriptor(udev);
861	struct usb_descriptor *desc;
862	struct usb_interface_descriptor *id;
863	struct usb_endpoint_descriptor *ed;
864	struct usb_interface *p_ui = NULL;
865	struct usb_host_interface *p_uhi = NULL;
866	struct usb_host_endpoint *p_uhe = NULL;
867	usb_size_t size;
868	uint16_t niface_total;
869	uint16_t nedesc;
870	uint16_t iface_no_curr;
871	uint16_t iface_index;
872	uint8_t pass;
873	uint8_t iface_no;
874
875	/*
876	 * We do two passes. One pass for computing necessary memory size
877	 * and one pass to initialize all the allocated memory structures.
878	 */
879	for (pass = 0; pass < 2; pass++) {
880		iface_no_curr = 0xFFFF;
881		niface_total = 0;
882		iface_index = 0;
883		nedesc = 0;
884		desc = NULL;
885
886		/*
887		 * Iterate over all the USB descriptors. Use the USB config
888		 * descriptor pointer provided by the FreeBSD USB stack.
889		 */
890		while ((desc = usb_desc_foreach(cd, desc))) {
891			/*
892			 * Build up a tree according to the descriptors we
893			 * find:
894			 */
895			switch (desc->bDescriptorType) {
896			case UDESC_DEVICE:
897				break;
898
899			case UDESC_ENDPOINT:
900				ed = (void *)desc;
901				if ((ed->bLength < sizeof(*ed)) ||
902				    (iface_index == 0))
903					break;
904				if (p_uhe) {
905					bcopy(ed, &p_uhe->desc, sizeof(p_uhe->desc));
906					p_uhe->bsd_iface_index = iface_index - 1;
907					TAILQ_INIT(&p_uhe->bsd_urb_list);
908					p_uhe++;
909				}
910				if (p_uhi) {
911					(p_uhi - 1)->desc.bNumEndpoints++;
912				}
913				nedesc++;
914				break;
915
916			case UDESC_INTERFACE:
917				id = (void *)desc;
918				if (id->bLength < sizeof(*id))
919					break;
920				if (p_uhi) {
921					bcopy(id, &p_uhi->desc, sizeof(p_uhi->desc));
922					p_uhi->desc.bNumEndpoints = 0;
923					p_uhi->endpoint = p_uhe;
924					p_uhi->string = "";
925					p_uhi->bsd_iface_index = iface_index;
926					p_uhi++;
927				}
928				iface_no = id->bInterfaceNumber;
929				niface_total++;
930				if (iface_no_curr != iface_no) {
931					if (p_ui) {
932						p_ui->altsetting = p_uhi - 1;
933						p_ui->cur_altsetting = p_uhi - 1;
934						p_ui->bsd_iface_index = iface_index;
935						p_ui->linux_udev = udev;
936						p_ui++;
937					}
938					iface_no_curr = iface_no;
939					iface_index++;
940				}
941				break;
942
943			default:
944				break;
945			}
946		}
947
948		if (pass == 0) {
949			size = (sizeof(*p_uhe) * nedesc) +
950			    (sizeof(*p_ui) * iface_index) +
951			    (sizeof(*p_uhi) * niface_total);
952
953			p_uhe = malloc(size, M_USBDEV, M_WAITOK | M_ZERO);
954			p_ui = (void *)(p_uhe + nedesc);
955			p_uhi = (void *)(p_ui + iface_index);
956
957			udev->linux_iface_start = p_ui;
958			udev->linux_iface_end = p_ui + iface_index;
959			udev->linux_endpoint_start = p_uhe;
960			udev->linux_endpoint_end = p_uhe + nedesc;
961			udev->devnum = device_get_unit(dev);
962			bcopy(&udev->ddesc, &udev->descriptor,
963			    sizeof(udev->descriptor));
964			bcopy(udev->ctrl_ep.edesc, &udev->ep0.desc,
965			    sizeof(udev->ep0.desc));
966		}
967	}
968	return (0);
969}
970
971/*------------------------------------------------------------------------*
972 *	usb_alloc_urb
973 *
974 * This function should always be used when you allocate an URB for
975 * use with the USB Linux stack. In case of an isochronous transfer
976 * you must specifiy the maximum number of "iso_packets" which you
977 * plan to transfer per URB. This function is always blocking, and
978 * "mem_flags" are not regarded like on Linux.
979 *------------------------------------------------------------------------*/
980struct urb *
981usb_alloc_urb(uint16_t iso_packets, uint16_t mem_flags)
982{
983	struct urb *urb;
984	usb_size_t size;
985
986	if (iso_packets == 0xFFFF) {
987		/*
988		 * FreeBSD specific magic value to ask for control transfer
989		 * memory allocation:
990		 */
991		size = sizeof(*urb) + sizeof(struct usb_device_request) + mem_flags;
992	} else {
993		size = sizeof(*urb) + (iso_packets * sizeof(urb->iso_frame_desc[0]));
994	}
995
996	urb = malloc(size, M_USBDEV, M_WAITOK | M_ZERO);
997
998	cv_init(&urb->cv_wait, "URBWAIT");
999	if (iso_packets == 0xFFFF) {
1000		urb->setup_packet = (void *)(urb + 1);
1001		urb->transfer_buffer = (void *)(urb->setup_packet +
1002		    sizeof(struct usb_device_request));
1003	} else {
1004		urb->number_of_packets = iso_packets;
1005	}
1006	return (urb);
1007}
1008
1009/*------------------------------------------------------------------------*
1010 *	usb_find_host_endpoint
1011 *
1012 * The following function will return the Linux USB host endpoint
1013 * structure that matches the given endpoint type and endpoint
1014 * value. If no match is found, NULL is returned. This function is not
1015 * part of the Linux USB API and is only used internally.
1016 *------------------------------------------------------------------------*/
1017struct usb_host_endpoint *
1018usb_find_host_endpoint(struct usb_device *dev, uint8_t type, uint8_t ep)
1019{
1020	struct usb_host_endpoint *uhe;
1021	struct usb_host_endpoint *uhe_end;
1022	struct usb_host_interface *uhi;
1023	struct usb_interface *ui;
1024	uint8_t ea;
1025	uint8_t at;
1026	uint8_t mask;
1027
1028	if (dev == NULL) {
1029		return (NULL);
1030	}
1031	if (type == UE_CONTROL) {
1032		mask = UE_ADDR;
1033	} else {
1034		mask = (UE_DIR_IN | UE_DIR_OUT | UE_ADDR);
1035	}
1036
1037	ep &= mask;
1038
1039	/*
1040	 * Iterate over all the interfaces searching the selected alternate
1041	 * setting only, and all belonging endpoints.
1042	 */
1043	for (ui = dev->linux_iface_start;
1044	    ui != dev->linux_iface_end;
1045	    ui++) {
1046		uhi = ui->cur_altsetting;
1047		if (uhi) {
1048			uhe_end = uhi->endpoint + uhi->desc.bNumEndpoints;
1049			for (uhe = uhi->endpoint;
1050			    uhe != uhe_end;
1051			    uhe++) {
1052				ea = uhe->desc.bEndpointAddress;
1053				at = uhe->desc.bmAttributes;
1054
1055				if (((ea & mask) == ep) &&
1056				    ((at & UE_XFERTYPE) == type)) {
1057					return (uhe);
1058				}
1059			}
1060		}
1061	}
1062
1063	if ((type == UE_CONTROL) && ((ep & UE_ADDR) == 0)) {
1064		return (&dev->ep0);
1065	}
1066	return (NULL);
1067}
1068
1069/*------------------------------------------------------------------------*
1070 *	usb_altnum_to_altsetting
1071 *
1072 * The following function returns a pointer to an alternate setting by
1073 * index given a "usb_interface" pointer. If the alternate setting by
1074 * index does not exist, NULL is returned. And alternate setting is a
1075 * variant of an interface, but usually with slightly different
1076 * characteristics.
1077 *------------------------------------------------------------------------*/
1078struct usb_host_interface *
1079usb_altnum_to_altsetting(const struct usb_interface *intf, uint8_t alt_index)
1080{
1081	if (alt_index >= intf->num_altsetting) {
1082		return (NULL);
1083	}
1084	return (intf->altsetting + alt_index);
1085}
1086
1087/*------------------------------------------------------------------------*
1088 *	usb_ifnum_to_if
1089 *
1090 * The following function searches up an USB interface by
1091 * "bInterfaceNumber". If no match is found, NULL is returned.
1092 *------------------------------------------------------------------------*/
1093struct usb_interface *
1094usb_ifnum_to_if(struct usb_device *dev, uint8_t iface_no)
1095{
1096	struct usb_interface *p_ui;
1097
1098	for (p_ui = dev->linux_iface_start;
1099	    p_ui != dev->linux_iface_end;
1100	    p_ui++) {
1101		if ((p_ui->num_altsetting > 0) &&
1102		    (p_ui->altsetting->desc.bInterfaceNumber == iface_no)) {
1103			return (p_ui);
1104		}
1105	}
1106	return (NULL);
1107}
1108
1109/*------------------------------------------------------------------------*
1110 *	usb_buffer_alloc
1111 *------------------------------------------------------------------------*/
1112void   *
1113usb_buffer_alloc(struct usb_device *dev, usb_size_t size, uint16_t mem_flags, uint8_t *dma_addr)
1114{
1115	return (malloc(size, M_USBDEV, M_WAITOK | M_ZERO));
1116}
1117
1118/*------------------------------------------------------------------------*
1119 *	usbd_get_intfdata
1120 *------------------------------------------------------------------------*/
1121void   *
1122usbd_get_intfdata(struct usb_interface *intf)
1123{
1124	return (intf->bsd_priv_sc);
1125}
1126
1127/*------------------------------------------------------------------------*
1128 *	usb_linux_register
1129 *
1130 * The following function is used by the "USB_DRIVER_EXPORT()" macro,
1131 * and is used to register a Linux USB driver, so that its
1132 * "usb_device_id" structures gets searched a probe time. This
1133 * function is not part of the Linux USB API, and is for internal use
1134 * only.
1135 *------------------------------------------------------------------------*/
1136void
1137usb_linux_register(void *arg)
1138{
1139	struct usb_driver *drv = arg;
1140
1141	mtx_lock(&Giant);
1142	LIST_INSERT_HEAD(&usb_linux_driver_list, drv, linux_driver_list);
1143	mtx_unlock(&Giant);
1144
1145	usb_needs_explore_all();
1146}
1147
1148/*------------------------------------------------------------------------*
1149 *	usb_linux_deregister
1150 *
1151 * The following function is used by the "USB_DRIVER_EXPORT()" macro,
1152 * and is used to deregister a Linux USB driver. This function will
1153 * ensure that all driver instances belonging to the Linux USB device
1154 * driver in question, gets detached before the driver is
1155 * unloaded. This function is not part of the Linux USB API, and is
1156 * for internal use only.
1157 *------------------------------------------------------------------------*/
1158void
1159usb_linux_deregister(void *arg)
1160{
1161	struct usb_driver *drv = arg;
1162	struct usb_linux_softc *sc;
1163
1164repeat:
1165	mtx_lock(&Giant);
1166	LIST_FOREACH(sc, &usb_linux_attached_list, sc_attached_list) {
1167		if (sc->sc_udrv == drv) {
1168			mtx_unlock(&Giant);
1169			device_detach(sc->sc_fbsd_dev);
1170			goto repeat;
1171		}
1172	}
1173	LIST_REMOVE(drv, linux_driver_list);
1174	mtx_unlock(&Giant);
1175}
1176
1177/*------------------------------------------------------------------------*
1178 *	usb_linux_free_device
1179 *
1180 * The following function is only used by the FreeBSD USB stack, to
1181 * cleanup and free memory after that a Linux USB device was attached.
1182 *------------------------------------------------------------------------*/
1183void
1184usb_linux_free_device(struct usb_device *dev)
1185{
1186	struct usb_host_endpoint *uhe;
1187	struct usb_host_endpoint *uhe_end;
1188	int err;
1189
1190	uhe = dev->linux_endpoint_start;
1191	uhe_end = dev->linux_endpoint_end;
1192	while (uhe != uhe_end) {
1193		err = usb_setup_endpoint(dev, uhe, 0);
1194		uhe++;
1195	}
1196	err = usb_setup_endpoint(dev, &dev->ep0, 0);
1197	free(dev->linux_endpoint_start, M_USBDEV);
1198}
1199
1200/*------------------------------------------------------------------------*
1201 *	usb_buffer_free
1202 *------------------------------------------------------------------------*/
1203void
1204usb_buffer_free(struct usb_device *dev, usb_size_t size,
1205    void *addr, uint8_t dma_addr)
1206{
1207	free(addr, M_USBDEV);
1208}
1209
1210/*------------------------------------------------------------------------*
1211 *	usb_free_urb
1212 *------------------------------------------------------------------------*/
1213void
1214usb_free_urb(struct urb *urb)
1215{
1216	if (urb == NULL) {
1217		return;
1218	}
1219	/* make sure that the current URB is not active */
1220	usb_kill_urb(urb);
1221
1222	/* destroy condition variable */
1223	cv_destroy(&urb->cv_wait);
1224
1225	/* just free it */
1226	free(urb, M_USBDEV);
1227}
1228
1229/*------------------------------------------------------------------------*
1230 *	usb_init_urb
1231 *
1232 * The following function can be used to initialize a custom URB. It
1233 * is not recommended to use this function. Use "usb_alloc_urb()"
1234 * instead.
1235 *------------------------------------------------------------------------*/
1236void
1237usb_init_urb(struct urb *urb)
1238{
1239	if (urb == NULL) {
1240		return;
1241	}
1242	memset(urb, 0, sizeof(*urb));
1243}
1244
1245/*------------------------------------------------------------------------*
1246 *	usb_kill_urb
1247 *------------------------------------------------------------------------*/
1248void
1249usb_kill_urb(struct urb *urb)
1250{
1251	usb_unlink_urb_sub(urb, 1);
1252}
1253
1254/*------------------------------------------------------------------------*
1255 *	usb_set_intfdata
1256 *
1257 * The following function sets the per Linux USB interface private
1258 * data pointer. It is used by most Linux USB device drivers.
1259 *------------------------------------------------------------------------*/
1260void
1261usb_set_intfdata(struct usb_interface *intf, void *data)
1262{
1263	intf->bsd_priv_sc = data;
1264}
1265
1266/*------------------------------------------------------------------------*
1267 *	usb_linux_cleanup_interface
1268 *
1269 * The following function will release all FreeBSD USB transfers
1270 * associated with a Linux USB interface. It is for internal use only.
1271 *------------------------------------------------------------------------*/
1272static void
1273usb_linux_cleanup_interface(struct usb_device *dev, struct usb_interface *iface)
1274{
1275	struct usb_host_interface *uhi;
1276	struct usb_host_interface *uhi_end;
1277	struct usb_host_endpoint *uhe;
1278	struct usb_host_endpoint *uhe_end;
1279	int err;
1280
1281	uhi = iface->altsetting;
1282	uhi_end = iface->altsetting + iface->num_altsetting;
1283	while (uhi != uhi_end) {
1284		uhe = uhi->endpoint;
1285		uhe_end = uhi->endpoint + uhi->desc.bNumEndpoints;
1286		while (uhe != uhe_end) {
1287			err = usb_setup_endpoint(dev, uhe, 0);
1288			uhe++;
1289		}
1290		uhi++;
1291	}
1292}
1293
1294/*------------------------------------------------------------------------*
1295 *	usb_linux_wait_complete
1296 *
1297 * The following function is used by "usb_start_wait_urb()" to wake it
1298 * up, when an USB transfer has finished.
1299 *------------------------------------------------------------------------*/
1300static void
1301usb_linux_wait_complete(struct urb *urb)
1302{
1303	if (urb->transfer_flags & URB_IS_SLEEPING) {
1304		cv_signal(&urb->cv_wait);
1305	}
1306	urb->transfer_flags &= ~URB_WAIT_WAKEUP;
1307}
1308
1309/*------------------------------------------------------------------------*
1310 *	usb_linux_complete
1311 *------------------------------------------------------------------------*/
1312static void
1313usb_linux_complete(struct usb_xfer *xfer)
1314{
1315	struct urb *urb;
1316
1317	urb = usbd_xfer_get_priv(xfer);
1318	usbd_xfer_set_priv(xfer, NULL);
1319	if (urb->complete) {
1320		(urb->complete) (urb);
1321	}
1322}
1323
1324/*------------------------------------------------------------------------*
1325 *	usb_linux_isoc_callback
1326 *
1327 * The following is the FreeBSD isochronous USB callback. Isochronous
1328 * frames are USB packets transferred 1000 or 8000 times per second,
1329 * depending on whether a full- or high- speed USB transfer is
1330 * used.
1331 *------------------------------------------------------------------------*/
1332static void
1333usb_linux_isoc_callback(struct usb_xfer *xfer, usb_error_t error)
1334{
1335	usb_frlength_t max_frame = xfer->max_frame_size;
1336	usb_frlength_t offset;
1337	usb_frcount_t x;
1338	struct urb *urb = usbd_xfer_get_priv(xfer);
1339	struct usb_host_endpoint *uhe = usbd_xfer_softc(xfer);
1340	struct usb_iso_packet_descriptor *uipd;
1341
1342	DPRINTF("\n");
1343
1344	switch (USB_GET_STATE(xfer)) {
1345	case USB_ST_TRANSFERRED:
1346
1347		if (urb->bsd_isread) {
1348			/* copy in data with regard to the URB */
1349
1350			offset = 0;
1351
1352			for (x = 0; x < urb->number_of_packets; x++) {
1353				uipd = urb->iso_frame_desc + x;
1354				if (uipd->length > xfer->frlengths[x]) {
1355					if (urb->transfer_flags & URB_SHORT_NOT_OK) {
1356						/* XXX should be EREMOTEIO */
1357						uipd->status = -EPIPE;
1358					} else {
1359						uipd->status = 0;
1360					}
1361				} else {
1362					uipd->status = 0;
1363				}
1364				uipd->actual_length = xfer->frlengths[x];
1365				if (!xfer->flags.ext_buffer) {
1366					usbd_copy_out(xfer->frbuffers, offset,
1367					    USB_ADD_BYTES(urb->transfer_buffer,
1368					    uipd->offset), uipd->actual_length);
1369				}
1370				offset += max_frame;
1371			}
1372		} else {
1373			for (x = 0; x < urb->number_of_packets; x++) {
1374				uipd = urb->iso_frame_desc + x;
1375				uipd->actual_length = xfer->frlengths[x];
1376				uipd->status = 0;
1377			}
1378		}
1379
1380		urb->actual_length = xfer->actlen;
1381
1382		/* check for short transfer */
1383		if (xfer->actlen < xfer->sumlen) {
1384			/* short transfer */
1385			if (urb->transfer_flags & URB_SHORT_NOT_OK) {
1386				/* XXX should be EREMOTEIO */
1387				urb->status = -EPIPE;
1388			} else {
1389				urb->status = 0;
1390			}
1391		} else {
1392			/* success */
1393			urb->status = 0;
1394		}
1395
1396		/* call callback */
1397		usb_linux_complete(xfer);
1398
1399	case USB_ST_SETUP:
1400tr_setup:
1401
1402		if (xfer->priv_fifo == NULL) {
1403			/* get next transfer */
1404			urb = TAILQ_FIRST(&uhe->bsd_urb_list);
1405			if (urb == NULL) {
1406				/* nothing to do */
1407				return;
1408			}
1409			TAILQ_REMOVE(&uhe->bsd_urb_list, urb, bsd_urb_list);
1410			urb->bsd_urb_list.tqe_prev = NULL;
1411
1412			x = xfer->max_frame_count;
1413			if (urb->number_of_packets > x) {
1414				/* XXX simply truncate the transfer */
1415				urb->number_of_packets = x;
1416			}
1417		} else {
1418			DPRINTF("Already got a transfer\n");
1419
1420			/* already got a transfer (should not happen) */
1421			urb = usbd_xfer_get_priv(xfer);
1422		}
1423
1424		urb->bsd_isread = (uhe->desc.bEndpointAddress & UE_DIR_IN) ? 1 : 0;
1425
1426		if (xfer->flags.ext_buffer) {
1427			/* set virtual address to load */
1428			usbd_xfer_set_frame_data(xfer, 0, urb->transfer_buffer, 0);
1429		}
1430		if (!(urb->bsd_isread)) {
1431			/* copy out data with regard to the URB */
1432
1433			offset = 0;
1434
1435			for (x = 0; x < urb->number_of_packets; x++) {
1436				uipd = urb->iso_frame_desc + x;
1437				usbd_xfer_set_frame_len(xfer, x, uipd->length);
1438				if (!xfer->flags.ext_buffer) {
1439					usbd_copy_in(xfer->frbuffers, offset,
1440					    USB_ADD_BYTES(urb->transfer_buffer,
1441					    uipd->offset), uipd->length);
1442				}
1443				offset += uipd->length;
1444			}
1445		} else {
1446			/*
1447			 * compute the transfer length into the "offset"
1448			 * variable
1449			 */
1450
1451			offset = urb->number_of_packets * max_frame;
1452
1453			/* setup "frlengths" array */
1454
1455			for (x = 0; x < urb->number_of_packets; x++) {
1456				uipd = urb->iso_frame_desc + x;
1457				usbd_xfer_set_frame_len(xfer, x, max_frame);
1458			}
1459		}
1460		usbd_xfer_set_priv(xfer, urb);
1461		xfer->flags.force_short_xfer = 0;
1462		xfer->timeout = urb->timeout;
1463		xfer->nframes = urb->number_of_packets;
1464		usbd_transfer_submit(xfer);
1465		return;
1466
1467	default:			/* Error */
1468		if (xfer->error == USB_ERR_CANCELLED) {
1469			urb->status = -ECONNRESET;
1470		} else {
1471			urb->status = -EPIPE;	/* stalled */
1472		}
1473
1474		/* Set zero for "actual_length" */
1475		urb->actual_length = 0;
1476
1477		/* Set zero for "actual_length" */
1478		for (x = 0; x < urb->number_of_packets; x++) {
1479			urb->iso_frame_desc[x].actual_length = 0;
1480			urb->iso_frame_desc[x].status = urb->status;
1481		}
1482
1483		/* call callback */
1484		usb_linux_complete(xfer);
1485
1486		if (xfer->error == USB_ERR_CANCELLED) {
1487			/* we need to return in this case */
1488			return;
1489		}
1490		goto tr_setup;
1491	}
1492}
1493
1494/*------------------------------------------------------------------------*
1495 *	usb_linux_non_isoc_callback
1496 *
1497 * The following is the FreeBSD BULK/INTERRUPT and CONTROL USB
1498 * callback. It dequeues Linux USB stack compatible URB's, transforms
1499 * the URB fields into a FreeBSD USB transfer, and defragments the USB
1500 * transfer as required. When the transfer is complete the "complete"
1501 * callback is called.
1502 *------------------------------------------------------------------------*/
1503static void
1504usb_linux_non_isoc_callback(struct usb_xfer *xfer, usb_error_t error)
1505{
1506	enum {
1507		REQ_SIZE = sizeof(struct usb_device_request)
1508	};
1509	struct urb *urb = usbd_xfer_get_priv(xfer);
1510	struct usb_host_endpoint *uhe = usbd_xfer_softc(xfer);
1511	uint8_t *ptr;
1512	usb_frlength_t max_bulk = usbd_xfer_max_len(xfer);
1513	uint8_t data_frame = xfer->flags_int.control_xfr ? 1 : 0;
1514
1515	DPRINTF("\n");
1516
1517	switch (USB_GET_STATE(xfer)) {
1518	case USB_ST_TRANSFERRED:
1519
1520		if (xfer->flags_int.control_xfr) {
1521			/* don't transfer the setup packet again: */
1522
1523			usbd_xfer_set_frame_len(xfer, 0, 0);
1524		}
1525		if (urb->bsd_isread && (!xfer->flags.ext_buffer)) {
1526			/* copy in data with regard to the URB */
1527			usbd_copy_out(xfer->frbuffers + data_frame, 0,
1528			    urb->bsd_data_ptr, xfer->frlengths[data_frame]);
1529		}
1530		urb->bsd_length_rem -= xfer->frlengths[data_frame];
1531		urb->bsd_data_ptr += xfer->frlengths[data_frame];
1532		urb->actual_length += xfer->frlengths[data_frame];
1533
1534		/* check for short transfer */
1535		if (xfer->actlen < xfer->sumlen) {
1536			urb->bsd_length_rem = 0;
1537
1538			/* short transfer */
1539			if (urb->transfer_flags & URB_SHORT_NOT_OK) {
1540				urb->status = -EPIPE;
1541			} else {
1542				urb->status = 0;
1543			}
1544		} else {
1545			/* check remainder */
1546			if (urb->bsd_length_rem > 0) {
1547				goto setup_bulk;
1548			}
1549			/* success */
1550			urb->status = 0;
1551		}
1552
1553		/* call callback */
1554		usb_linux_complete(xfer);
1555
1556	case USB_ST_SETUP:
1557tr_setup:
1558		/* get next transfer */
1559		urb = TAILQ_FIRST(&uhe->bsd_urb_list);
1560		if (urb == NULL) {
1561			/* nothing to do */
1562			return;
1563		}
1564		TAILQ_REMOVE(&uhe->bsd_urb_list, urb, bsd_urb_list);
1565		urb->bsd_urb_list.tqe_prev = NULL;
1566
1567		usbd_xfer_set_priv(xfer, urb);
1568		xfer->flags.force_short_xfer = 0;
1569		xfer->timeout = urb->timeout;
1570
1571		if (xfer->flags_int.control_xfr) {
1572			/*
1573			 * USB control transfers need special handling.
1574			 * First copy in the header, then copy in data!
1575			 */
1576			if (!xfer->flags.ext_buffer) {
1577				usbd_copy_in(xfer->frbuffers, 0,
1578				    urb->setup_packet, REQ_SIZE);
1579				usbd_xfer_set_frame_len(xfer, 0, REQ_SIZE);
1580			} else {
1581				/* set virtual address to load */
1582				usbd_xfer_set_frame_data(xfer, 0,
1583				    urb->setup_packet, REQ_SIZE);
1584			}
1585
1586			ptr = urb->setup_packet;
1587
1588			/* setup data transfer direction and length */
1589			urb->bsd_isread = (ptr[0] & UT_READ) ? 1 : 0;
1590			urb->bsd_length_rem = ptr[6] | (ptr[7] << 8);
1591
1592		} else {
1593			/* setup data transfer direction */
1594
1595			urb->bsd_length_rem = urb->transfer_buffer_length;
1596			urb->bsd_isread = (uhe->desc.bEndpointAddress &
1597			    UE_DIR_IN) ? 1 : 0;
1598		}
1599
1600		urb->bsd_data_ptr = urb->transfer_buffer;
1601		urb->actual_length = 0;
1602
1603setup_bulk:
1604		if (max_bulk > urb->bsd_length_rem) {
1605			max_bulk = urb->bsd_length_rem;
1606		}
1607		/* check if we need to force a short transfer */
1608
1609		if ((max_bulk == urb->bsd_length_rem) &&
1610		    (urb->transfer_flags & URB_ZERO_PACKET) &&
1611		    (!xfer->flags_int.control_xfr)) {
1612			xfer->flags.force_short_xfer = 1;
1613		}
1614		/* check if we need to copy in data */
1615
1616		if (xfer->flags.ext_buffer) {
1617			/* set virtual address to load */
1618			usbd_xfer_set_frame_data(xfer, data_frame,
1619			    urb->bsd_data_ptr, max_bulk);
1620		} else if (!urb->bsd_isread) {
1621			/* copy out data with regard to the URB */
1622			usbd_copy_in(xfer->frbuffers + data_frame, 0,
1623			    urb->bsd_data_ptr, max_bulk);
1624			usbd_xfer_set_frame_len(xfer, data_frame, max_bulk);
1625		}
1626		if (xfer->flags_int.control_xfr) {
1627			if (max_bulk > 0) {
1628				xfer->nframes = 2;
1629			} else {
1630				xfer->nframes = 1;
1631			}
1632		} else {
1633			xfer->nframes = 1;
1634		}
1635		usbd_transfer_submit(xfer);
1636		return;
1637
1638	default:
1639		if (xfer->error == USB_ERR_CANCELLED) {
1640			urb->status = -ECONNRESET;
1641		} else {
1642			urb->status = -EPIPE;
1643		}
1644
1645		/* Set zero for "actual_length" */
1646		urb->actual_length = 0;
1647
1648		/* call callback */
1649		usb_linux_complete(xfer);
1650
1651		if (xfer->error == USB_ERR_CANCELLED) {
1652			/* we need to return in this case */
1653			return;
1654		}
1655		goto tr_setup;
1656	}
1657}
1658
1659/*------------------------------------------------------------------------*
1660 *	usb_fill_bulk_urb
1661 *------------------------------------------------------------------------*/
1662void
1663usb_fill_bulk_urb(struct urb *urb, struct usb_device *udev,
1664    struct usb_host_endpoint *uhe, void *buf,
1665    int length, usb_complete_t callback, void *arg)
1666{
1667	urb->dev = udev;
1668	urb->endpoint = uhe;
1669	urb->transfer_buffer = buf;
1670	urb->transfer_buffer_length = length;
1671	urb->complete = callback;
1672	urb->context = arg;
1673}
1674
1675/*------------------------------------------------------------------------*
1676 *	usb_bulk_msg
1677 *
1678 * NOTE: This function can also be used for interrupt endpoints!
1679 *
1680 * Return values:
1681 *    0: Success
1682 * Else: Failure
1683 *------------------------------------------------------------------------*/
1684int
1685usb_bulk_msg(struct usb_device *udev, struct usb_host_endpoint *uhe,
1686    void *data, int len, uint16_t *pactlen, usb_timeout_t timeout)
1687{
1688	struct urb *urb;
1689	int err;
1690
1691	if (uhe == NULL)
1692		return (-EINVAL);
1693	if (len < 0)
1694		return (-EINVAL);
1695
1696	err = usb_setup_endpoint(udev, uhe, 4096 /* bytes */);
1697	if (err)
1698		return (err);
1699
1700	urb = usb_alloc_urb(0, 0);
1701
1702	usb_fill_bulk_urb(urb, udev, uhe, data, len,
1703	    usb_linux_wait_complete, NULL);
1704
1705	err = usb_start_wait_urb(urb, timeout, pactlen);
1706
1707	usb_free_urb(urb);
1708
1709	return (err);
1710}
1711MODULE_DEPEND(linuxkpi, usb, 1, 1, 1);
1712
1713static void
1714usb_linux_init(void *arg)
1715{
1716	/* register our function */
1717	usb_linux_free_device_p = &usb_linux_free_device;
1718}
1719SYSINIT(usb_linux_init, SI_SUB_LOCK, SI_ORDER_FIRST, usb_linux_init, NULL);
1720SYSUNINIT(usb_linux_unload, SI_SUB_LOCK, SI_ORDER_ANY, usb_linux_unload, NULL);
1721