1 /* $FreeBSD$ */
2 /*-
3  * Copyright (c) 2007 Luigi Rizzo - Universita` di Pisa. All rights reserved.
4  * Copyright (c) 2007 Hans Petter Selasky. All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  */
27 
28 #ifdef USB_GLOBAL_INCLUDE_FILE
29 #include USB_GLOBAL_INCLUDE_FILE
30 #else
31 #include <sys/stdint.h>
32 #include <sys/stddef.h>
33 #include <sys/param.h>
34 #include <sys/queue.h>
35 #include <sys/types.h>
36 #include <sys/systm.h>
37 #include <sys/kernel.h>
38 #include <sys/bus.h>
39 #include <sys/module.h>
40 #include <sys/lock.h>
41 #include <sys/mutex.h>
42 #include <sys/condvar.h>
43 #include <sys/sysctl.h>
44 #include <sys/sx.h>
45 #include <sys/unistd.h>
46 #include <sys/callout.h>
47 #include <sys/malloc.h>
48 #include <sys/priv.h>
49 
50 #include <dev/usb/usb.h>
51 #include <dev/usb/usbdi.h>
52 #include <dev/usb/usbdi_util.h>
53 
54 #define	USB_DEBUG_VAR usb_debug
55 
56 #include <dev/usb/usb_core.h>
57 #include <linux/usb.h>
58 #include <dev/usb/usb_process.h>
59 #include <dev/usb/usb_device.h>
60 #include <dev/usb/usb_util.h>
61 #include <dev/usb/usb_busdma.h>
62 #include <dev/usb/usb_transfer.h>
63 #include <dev/usb/usb_hub.h>
64 #include <dev/usb/usb_request.h>
65 #include <dev/usb/usb_debug.h>
66 #include <dev/usb/usb_dynamic.h>
67 #endif			/* USB_GLOBAL_INCLUDE_FILE */
68 
69 struct usb_linux_softc {
70 	LIST_ENTRY(usb_linux_softc) sc_attached_list;
71 
72 	device_t sc_fbsd_dev;
73 	struct usb_device *sc_fbsd_udev;
74 	struct usb_interface *sc_ui;
75 	struct usb_driver *sc_udrv;
76 };
77 
78 /* prototypes */
79 static device_probe_t usb_linux_probe;
80 static device_attach_t usb_linux_attach;
81 static device_detach_t usb_linux_detach;
82 static device_suspend_t usb_linux_suspend;
83 static device_resume_t usb_linux_resume;
84 
85 static usb_callback_t usb_linux_isoc_callback;
86 static usb_callback_t usb_linux_non_isoc_callback;
87 
88 static usb_complete_t usb_linux_wait_complete;
89 
90 static uint16_t	usb_max_isoc_frames(struct usb_device *);
91 static int	usb_start_wait_urb(struct urb *, usb_timeout_t, uint16_t *);
92 static const struct usb_device_id *usb_linux_lookup_id(
93 		    const struct usb_device_id *, struct usb_attach_arg *);
94 static struct	usb_driver *usb_linux_get_usb_driver(struct usb_linux_softc *);
95 static int	usb_linux_create_usb_device(struct usb_device *, device_t);
96 static void	usb_linux_cleanup_interface(struct usb_device *,
97 		    struct usb_interface *);
98 static void	usb_linux_complete(struct usb_xfer *);
99 static int	usb_unlink_urb_sub(struct urb *, uint8_t);
100 
101 /*------------------------------------------------------------------------*
102  * FreeBSD USB interface
103  *------------------------------------------------------------------------*/
104 
105 static LIST_HEAD(, usb_linux_softc) usb_linux_attached_list;
106 static LIST_HEAD(, usb_driver) usb_linux_driver_list;
107 
108 static device_method_t usb_linux_methods[] = {
109 	/* Device interface */
110 	DEVMETHOD(device_probe, usb_linux_probe),
111 	DEVMETHOD(device_attach, usb_linux_attach),
112 	DEVMETHOD(device_detach, usb_linux_detach),
113 	DEVMETHOD(device_suspend, usb_linux_suspend),
114 	DEVMETHOD(device_resume, usb_linux_resume),
115 
116 	DEVMETHOD_END
117 };
118 
119 static driver_t usb_linux_driver = {
120 	.name = "usb_linux",
121 	.methods = usb_linux_methods,
122 	.size = sizeof(struct usb_linux_softc),
123 };
124 
125 static devclass_t usb_linux_devclass;
126 
127 DRIVER_MODULE(usb_linux, uhub, usb_linux_driver, usb_linux_devclass, NULL, 0);
128 MODULE_VERSION(usb_linux, 1);
129 
130 /*------------------------------------------------------------------------*
131  *	usb_linux_lookup_id
132  *
133  * This functions takes an array of "struct usb_device_id" and tries
134  * to match the entries with the information in "struct usb_attach_arg".
135  * If it finds a match the matching entry will be returned.
136  * Else "NULL" will be returned.
137  *------------------------------------------------------------------------*/
138 static const struct usb_device_id *
139 usb_linux_lookup_id(const struct usb_device_id *id, struct usb_attach_arg *uaa)
140 {
141 	if (id == NULL) {
142 		goto done;
143 	}
144 	/*
145 	 * Keep on matching array entries until we find one with
146 	 * "match_flags" equal to zero, which indicates the end of the
147 	 * array:
148 	 */
149 	for (; id->match_flags; id++) {
150 		if ((id->match_flags & USB_DEVICE_ID_MATCH_VENDOR) &&
151 		    (id->idVendor != uaa->info.idVendor)) {
152 			continue;
153 		}
154 		if ((id->match_flags & USB_DEVICE_ID_MATCH_PRODUCT) &&
155 		    (id->idProduct != uaa->info.idProduct)) {
156 			continue;
157 		}
158 		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_LO) &&
159 		    (id->bcdDevice_lo > uaa->info.bcdDevice)) {
160 			continue;
161 		}
162 		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_HI) &&
163 		    (id->bcdDevice_hi < uaa->info.bcdDevice)) {
164 			continue;
165 		}
166 		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_CLASS) &&
167 		    (id->bDeviceClass != uaa->info.bDeviceClass)) {
168 			continue;
169 		}
170 		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_SUBCLASS) &&
171 		    (id->bDeviceSubClass != uaa->info.bDeviceSubClass)) {
172 			continue;
173 		}
174 		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_PROTOCOL) &&
175 		    (id->bDeviceProtocol != uaa->info.bDeviceProtocol)) {
176 			continue;
177 		}
178 		if ((uaa->info.bDeviceClass == 0xFF) &&
179 		    !(id->match_flags & USB_DEVICE_ID_MATCH_VENDOR) &&
180 		    (id->match_flags & (USB_DEVICE_ID_MATCH_INT_CLASS |
181 		    USB_DEVICE_ID_MATCH_INT_SUBCLASS |
182 		    USB_DEVICE_ID_MATCH_INT_PROTOCOL))) {
183 			continue;
184 		}
185 		if ((id->match_flags & USB_DEVICE_ID_MATCH_INT_CLASS) &&
186 		    (id->bInterfaceClass != uaa->info.bInterfaceClass)) {
187 			continue;
188 		}
189 		if ((id->match_flags & USB_DEVICE_ID_MATCH_INT_SUBCLASS) &&
190 		    (id->bInterfaceSubClass != uaa->info.bInterfaceSubClass)) {
191 			continue;
192 		}
193 		if ((id->match_flags & USB_DEVICE_ID_MATCH_INT_PROTOCOL) &&
194 		    (id->bInterfaceProtocol != uaa->info.bInterfaceProtocol)) {
195 			continue;
196 		}
197 		/* we found a match! */
198 		return (id);
199 	}
200 
201 done:
202 	return (NULL);
203 }
204 
205 /*------------------------------------------------------------------------*
206  *	usb_linux_probe
207  *
208  * This function is the FreeBSD probe callback. It is called from the
209  * FreeBSD USB stack through the "device_probe_and_attach()" function.
210  *------------------------------------------------------------------------*/
211 static int
212 usb_linux_probe(device_t dev)
213 {
214 	struct usb_attach_arg *uaa = device_get_ivars(dev);
215 	struct usb_driver *udrv;
216 	int err = ENXIO;
217 
218 	if (uaa->usb_mode != USB_MODE_HOST) {
219 		return (ENXIO);
220 	}
221 	mtx_lock(&Giant);
222 	LIST_FOREACH(udrv, &usb_linux_driver_list, linux_driver_list) {
223 		if (usb_linux_lookup_id(udrv->id_table, uaa)) {
224 			err = 0;
225 			break;
226 		}
227 	}
228 	mtx_unlock(&Giant);
229 
230 	return (err);
231 }
232 
233 /*------------------------------------------------------------------------*
234  *	usb_linux_get_usb_driver
235  *
236  * This function returns the pointer to the "struct usb_driver" where
237  * the Linux USB device driver "struct usb_device_id" match was found.
238  * We apply a lock before reading out the pointer to avoid races.
239  *------------------------------------------------------------------------*/
240 static struct usb_driver *
241 usb_linux_get_usb_driver(struct usb_linux_softc *sc)
242 {
243 	struct usb_driver *udrv;
244 
245 	mtx_lock(&Giant);
246 	udrv = sc->sc_udrv;
247 	mtx_unlock(&Giant);
248 	return (udrv);
249 }
250 
251 /*------------------------------------------------------------------------*
252  *	usb_linux_attach
253  *
254  * This function is the FreeBSD attach callback. It is called from the
255  * FreeBSD USB stack through the "device_probe_and_attach()" function.
256  * This function is called when "usb_linux_probe()" returns zero.
257  *------------------------------------------------------------------------*/
258 static int
259 usb_linux_attach(device_t dev)
260 {
261 	struct usb_attach_arg *uaa = device_get_ivars(dev);
262 	struct usb_linux_softc *sc = device_get_softc(dev);
263 	struct usb_driver *udrv;
264 	const struct usb_device_id *id = NULL;
265 
266 	mtx_lock(&Giant);
267 	LIST_FOREACH(udrv, &usb_linux_driver_list, linux_driver_list) {
268 		id = usb_linux_lookup_id(udrv->id_table, uaa);
269 		if (id)
270 			break;
271 	}
272 	mtx_unlock(&Giant);
273 
274 	if (id == NULL) {
275 		return (ENXIO);
276 	}
277 	if (usb_linux_create_usb_device(uaa->device, dev) != 0)
278 		return (ENOMEM);
279 	device_set_usb_desc(dev);
280 
281 	sc->sc_fbsd_udev = uaa->device;
282 	sc->sc_fbsd_dev = dev;
283 	sc->sc_udrv = udrv;
284 	sc->sc_ui = usb_ifnum_to_if(uaa->device, uaa->info.bIfaceNum);
285 	if (sc->sc_ui == NULL) {
286 		return (EINVAL);
287 	}
288 	if (udrv->probe) {
289 		if ((udrv->probe) (sc->sc_ui, id)) {
290 			return (ENXIO);
291 		}
292 	}
293 	mtx_lock(&Giant);
294 	LIST_INSERT_HEAD(&usb_linux_attached_list, sc, sc_attached_list);
295 	mtx_unlock(&Giant);
296 
297 	/* success */
298 	return (0);
299 }
300 
301 /*------------------------------------------------------------------------*
302  *	usb_linux_detach
303  *
304  * This function is the FreeBSD detach callback. It is called from the
305  * FreeBSD USB stack through the "device_detach()" function.
306  *------------------------------------------------------------------------*/
307 static int
308 usb_linux_detach(device_t dev)
309 {
310 	struct usb_linux_softc *sc = device_get_softc(dev);
311 	struct usb_driver *udrv = NULL;
312 
313 	mtx_lock(&Giant);
314 	if (sc->sc_attached_list.le_prev) {
315 		LIST_REMOVE(sc, sc_attached_list);
316 		sc->sc_attached_list.le_prev = NULL;
317 		udrv = sc->sc_udrv;
318 		sc->sc_udrv = NULL;
319 	}
320 	mtx_unlock(&Giant);
321 
322 	if (udrv && udrv->disconnect) {
323 		(udrv->disconnect) (sc->sc_ui);
324 	}
325 	/*
326 	 * Make sure that we free all FreeBSD USB transfers belonging to
327 	 * this Linux "usb_interface", hence they will most likely not be
328 	 * needed any more.
329 	 */
330 	usb_linux_cleanup_interface(sc->sc_fbsd_udev, sc->sc_ui);
331 	return (0);
332 }
333 
334 /*------------------------------------------------------------------------*
335  *	usb_linux_suspend
336  *
337  * This function is the FreeBSD suspend callback. Usually it does nothing.
338  *------------------------------------------------------------------------*/
339 static int
340 usb_linux_suspend(device_t dev)
341 {
342 	struct usb_linux_softc *sc = device_get_softc(dev);
343 	struct usb_driver *udrv = usb_linux_get_usb_driver(sc);
344 	int err;
345 
346 	if (udrv && udrv->suspend) {
347 		err = (udrv->suspend) (sc->sc_ui, 0);
348 	}
349 	return (0);
350 }
351 
352 /*------------------------------------------------------------------------*
353  *	usb_linux_resume
354  *
355  * This function is the FreeBSD resume callback. Usually it does nothing.
356  *------------------------------------------------------------------------*/
357 static int
358 usb_linux_resume(device_t dev)
359 {
360 	struct usb_linux_softc *sc = device_get_softc(dev);
361 	struct usb_driver *udrv = usb_linux_get_usb_driver(sc);
362 	int err;
363 
364 	if (udrv && udrv->resume) {
365 		err = (udrv->resume) (sc->sc_ui);
366 	}
367 	return (0);
368 }
369 
370 /*------------------------------------------------------------------------*
371  * Linux emulation layer
372  *------------------------------------------------------------------------*/
373 
374 /*------------------------------------------------------------------------*
375  *	usb_max_isoc_frames
376  *
377  * The following function returns the maximum number of isochronous
378  * frames that we support per URB. It is not part of the Linux USB API.
379  *------------------------------------------------------------------------*/
380 static uint16_t
381 usb_max_isoc_frames(struct usb_device *dev)
382 {
383 	;				/* indent fix */
384 	switch (usbd_get_speed(dev)) {
385 	case USB_SPEED_LOW:
386 	case USB_SPEED_FULL:
387 		return (USB_MAX_FULL_SPEED_ISOC_FRAMES);
388 	default:
389 		return (USB_MAX_HIGH_SPEED_ISOC_FRAMES);
390 	}
391 }
392 
393 /*------------------------------------------------------------------------*
394  *	usb_submit_urb
395  *
396  * This function is used to queue an URB after that it has been
397  * initialized. If it returns non-zero, it means that the URB was not
398  * queued.
399  *------------------------------------------------------------------------*/
400 int
401 usb_submit_urb(struct urb *urb, uint16_t mem_flags)
402 {
403 	struct usb_host_endpoint *uhe;
404 	uint8_t do_unlock;
405 	int err;
406 
407 	if (urb == NULL)
408 		return (-EINVAL);
409 
410 	do_unlock = mtx_owned(&Giant) ? 0 : 1;
411 	if (do_unlock)
412 		mtx_lock(&Giant);
413 
414 	if (urb->endpoint == NULL) {
415 		err = -EINVAL;
416 		goto done;
417 	}
418 
419 	/*
420 	 * Check to see if the urb is in the process of being killed
421 	 * and stop a urb that is in the process of being killed from
422 	 * being re-submitted (e.g. from its completion callback
423 	 * function).
424 	 */
425 	if (urb->kill_count != 0) {
426 		err = -EPERM;
427 		goto done;
428 	}
429 
430 	uhe = urb->endpoint;
431 
432 	/*
433 	 * Check that we have got a FreeBSD USB transfer that will dequeue
434 	 * the URB structure and do the real transfer. If there are no USB
435 	 * transfers, then we return an error.
436 	 */
437 	if (uhe->bsd_xfer[0] ||
438 	    uhe->bsd_xfer[1]) {
439 		/* we are ready! */
440 
441 		TAILQ_INSERT_TAIL(&uhe->bsd_urb_list, urb, bsd_urb_list);
442 
443 		urb->status = -EINPROGRESS;
444 
445 		usbd_transfer_start(uhe->bsd_xfer[0]);
446 		usbd_transfer_start(uhe->bsd_xfer[1]);
447 		err = 0;
448 	} else {
449 		/* no pipes have been setup yet! */
450 		urb->status = -EINVAL;
451 		err = -EINVAL;
452 	}
453 done:
454 	if (do_unlock)
455 		mtx_unlock(&Giant);
456 	return (err);
457 }
458 
459 /*------------------------------------------------------------------------*
460  *	usb_unlink_urb
461  *
462  * This function is used to stop an URB after that it is been
463  * submitted, but before the "complete" callback has been called. On
464  *------------------------------------------------------------------------*/
465 int
466 usb_unlink_urb(struct urb *urb)
467 {
468 	return (usb_unlink_urb_sub(urb, 0));
469 }
470 
471 static void
472 usb_unlink_bsd(struct usb_xfer *xfer,
473     struct urb *urb, uint8_t drain)
474 {
475 	if (xfer == NULL)
476 		return;
477 	if (!usbd_transfer_pending(xfer))
478 		return;
479 	if (xfer->priv_fifo == (void *)urb) {
480 		if (drain) {
481 			mtx_unlock(&Giant);
482 			usbd_transfer_drain(xfer);
483 			mtx_lock(&Giant);
484 		} else {
485 			usbd_transfer_stop(xfer);
486 		}
487 		usbd_transfer_start(xfer);
488 	}
489 }
490 
491 static int
492 usb_unlink_urb_sub(struct urb *urb, uint8_t drain)
493 {
494 	struct usb_host_endpoint *uhe;
495 	uint16_t x;
496 	uint8_t do_unlock;
497 	int err;
498 
499 	if (urb == NULL)
500 		return (-EINVAL);
501 
502 	do_unlock = mtx_owned(&Giant) ? 0 : 1;
503 	if (do_unlock)
504 		mtx_lock(&Giant);
505 	if (drain)
506 		urb->kill_count++;
507 
508 	if (urb->endpoint == NULL) {
509 		err = -EINVAL;
510 		goto done;
511 	}
512 	uhe = urb->endpoint;
513 
514 	if (urb->bsd_urb_list.tqe_prev) {
515 		/* not started yet, just remove it from the queue */
516 		TAILQ_REMOVE(&uhe->bsd_urb_list, urb, bsd_urb_list);
517 		urb->bsd_urb_list.tqe_prev = NULL;
518 		urb->status = -ECONNRESET;
519 		urb->actual_length = 0;
520 
521 		for (x = 0; x < urb->number_of_packets; x++) {
522 			urb->iso_frame_desc[x].actual_length = 0;
523 		}
524 
525 		if (urb->complete) {
526 			(urb->complete) (urb);
527 		}
528 	} else {
529 		/*
530 		 * If the URB is not on the URB list, then check if one of
531 		 * the FreeBSD USB transfer are processing the current URB.
532 		 * If so, re-start that transfer, which will lead to the
533 		 * termination of that URB:
534 		 */
535 		usb_unlink_bsd(uhe->bsd_xfer[0], urb, drain);
536 		usb_unlink_bsd(uhe->bsd_xfer[1], urb, drain);
537 	}
538 	err = 0;
539 done:
540 	if (drain)
541 		urb->kill_count--;
542 	if (do_unlock)
543 		mtx_unlock(&Giant);
544 	return (err);
545 }
546 
547 /*------------------------------------------------------------------------*
548  *	usb_clear_halt
549  *
550  * This function must always be used to clear the stall. Stall is when
551  * an USB endpoint returns a stall message to the USB host controller.
552  * Until the stall is cleared, no data can be transferred.
553  *------------------------------------------------------------------------*/
554 int
555 usb_clear_halt(struct usb_device *dev, struct usb_host_endpoint *uhe)
556 {
557 	struct usb_config cfg[1];
558 	struct usb_endpoint *ep;
559 	uint8_t type;
560 	uint8_t addr;
561 
562 	if (uhe == NULL)
563 		return (-EINVAL);
564 
565 	type = uhe->desc.bmAttributes & UE_XFERTYPE;
566 	addr = uhe->desc.bEndpointAddress;
567 
568 	memset(cfg, 0, sizeof(cfg));
569 
570 	cfg[0].type = type;
571 	cfg[0].endpoint = addr & UE_ADDR;
572 	cfg[0].direction = addr & (UE_DIR_OUT | UE_DIR_IN);
573 
574 	ep = usbd_get_endpoint(dev, uhe->bsd_iface_index, cfg);
575 	if (ep == NULL)
576 		return (-EINVAL);
577 
578 	usbd_clear_data_toggle(dev, ep);
579 
580 	return (usb_control_msg(dev, &dev->ep0,
581 	    UR_CLEAR_FEATURE, UT_WRITE_ENDPOINT,
582 	    UF_ENDPOINT_HALT, addr, NULL, 0, 1000));
583 }
584 
585 /*------------------------------------------------------------------------*
586  *	usb_start_wait_urb
587  *
588  * This is an internal function that is used to perform synchronous
589  * Linux USB transfers.
590  *------------------------------------------------------------------------*/
591 static int
592 usb_start_wait_urb(struct urb *urb, usb_timeout_t timeout, uint16_t *p_actlen)
593 {
594 	int err;
595 	uint8_t do_unlock;
596 
597 	/* you must have a timeout! */
598 	if (timeout == 0) {
599 		timeout = 1;
600 	}
601 	urb->complete = &usb_linux_wait_complete;
602 	urb->timeout = timeout;
603 	urb->transfer_flags |= URB_WAIT_WAKEUP;
604 	urb->transfer_flags &= ~URB_IS_SLEEPING;
605 
606 	do_unlock = mtx_owned(&Giant) ? 0 : 1;
607 	if (do_unlock)
608 		mtx_lock(&Giant);
609 	err = usb_submit_urb(urb, 0);
610 	if (err)
611 		goto done;
612 
613 	/*
614 	 * the URB might have completed before we get here, so check that by
615 	 * using some flags!
616 	 */
617 	while (urb->transfer_flags & URB_WAIT_WAKEUP) {
618 		urb->transfer_flags |= URB_IS_SLEEPING;
619 		cv_wait(&urb->cv_wait, &Giant);
620 		urb->transfer_flags &= ~URB_IS_SLEEPING;
621 	}
622 
623 	err = urb->status;
624 
625 done:
626 	if (do_unlock)
627 		mtx_unlock(&Giant);
628 	if (p_actlen != NULL) {
629 		if (err)
630 			*p_actlen = 0;
631 		else
632 			*p_actlen = urb->actual_length;
633 	}
634 	return (err);
635 }
636 
637 /*------------------------------------------------------------------------*
638  *	usb_control_msg
639  *
640  * The following function performs a control transfer sequence one any
641  * control, bulk or interrupt endpoint, specified by "uhe". A control
642  * transfer means that you transfer an 8-byte header first followed by
643  * a data-phase as indicated by the 8-byte header. The "timeout" is
644  * given in milliseconds.
645  *
646  * Return values:
647  *   0: Success
648  * < 0: Failure
649  * > 0: Actual length
650  *------------------------------------------------------------------------*/
651 int
652 usb_control_msg(struct usb_device *dev, struct usb_host_endpoint *uhe,
653     uint8_t request, uint8_t requesttype,
654     uint16_t value, uint16_t index, void *data,
655     uint16_t size, usb_timeout_t timeout)
656 {
657 	struct usb_device_request req;
658 	struct urb *urb;
659 	int err;
660 	uint16_t actlen;
661 	uint8_t type;
662 	uint8_t addr;
663 
664 	req.bmRequestType = requesttype;
665 	req.bRequest = request;
666 	USETW(req.wValue, value);
667 	USETW(req.wIndex, index);
668 	USETW(req.wLength, size);
669 
670 	if (uhe == NULL) {
671 		return (-EINVAL);
672 	}
673 	type = (uhe->desc.bmAttributes & UE_XFERTYPE);
674 	addr = (uhe->desc.bEndpointAddress & UE_ADDR);
675 
676 	if (type != UE_CONTROL) {
677 		return (-EINVAL);
678 	}
679 	if (addr == 0) {
680 		/*
681 		 * The FreeBSD USB stack supports standard control
682 		 * transfers on control endpoint zero:
683 		 */
684 		err = usbd_do_request_flags(dev,
685 		    NULL, &req, data, USB_SHORT_XFER_OK,
686 		    &actlen, timeout);
687 		if (err) {
688 			err = -EPIPE;
689 		} else {
690 			err = actlen;
691 		}
692 		return (err);
693 	}
694 	if (dev->flags.usb_mode != USB_MODE_HOST) {
695 		/* not supported */
696 		return (-EINVAL);
697 	}
698 	err = usb_setup_endpoint(dev, uhe, 1 /* dummy */ );
699 
700 	/*
701 	 * NOTE: we need to allocate real memory here so that we don't
702 	 * transfer data to/from the stack!
703 	 *
704 	 * 0xFFFF is a FreeBSD specific magic value.
705 	 */
706 	urb = usb_alloc_urb(0xFFFF, size);
707 
708 	urb->dev = dev;
709 	urb->endpoint = uhe;
710 
711 	memcpy(urb->setup_packet, &req, sizeof(req));
712 
713 	if (size && (!(req.bmRequestType & UT_READ))) {
714 		/* move the data to a real buffer */
715 		memcpy(USB_ADD_BYTES(urb->setup_packet, sizeof(req)),
716 		    data, size);
717 	}
718 	err = usb_start_wait_urb(urb, timeout, &actlen);
719 
720 	if (req.bmRequestType & UT_READ) {
721 		if (actlen) {
722 			bcopy(USB_ADD_BYTES(urb->setup_packet,
723 			    sizeof(req)), data, actlen);
724 		}
725 	}
726 	usb_free_urb(urb);
727 
728 	if (err == 0) {
729 		err = actlen;
730 	}
731 	return (err);
732 }
733 
734 /*------------------------------------------------------------------------*
735  *	usb_set_interface
736  *
737  * The following function will select which alternate setting of an
738  * USB interface you plan to use. By default alternate setting with
739  * index zero is selected. Note that "iface_no" is not the interface
740  * index, but rather the value of "bInterfaceNumber".
741  *------------------------------------------------------------------------*/
742 int
743 usb_set_interface(struct usb_device *dev, uint8_t iface_no, uint8_t alt_index)
744 {
745 	struct usb_interface *p_ui = usb_ifnum_to_if(dev, iface_no);
746 	int err;
747 
748 	if (p_ui == NULL)
749 		return (-EINVAL);
750 	if (alt_index >= p_ui->num_altsetting)
751 		return (-EINVAL);
752 	usb_linux_cleanup_interface(dev, p_ui);
753 	err = -usbd_set_alt_interface_index(dev,
754 	    p_ui->bsd_iface_index, alt_index);
755 	if (err == 0) {
756 		p_ui->cur_altsetting = p_ui->altsetting + alt_index;
757 	}
758 	return (err);
759 }
760 
761 /*------------------------------------------------------------------------*
762  *	usb_setup_endpoint
763  *
764  * The following function is an extension to the Linux USB API that
765  * allows you to set a maximum buffer size for a given USB endpoint.
766  * The maximum buffer size is per URB. If you don't call this function
767  * to set a maximum buffer size, the endpoint will not be functional.
768  * Note that for isochronous endpoints the maximum buffer size must be
769  * a non-zero dummy, hence this function will base the maximum buffer
770  * size on "wMaxPacketSize".
771  *------------------------------------------------------------------------*/
772 int
773 usb_setup_endpoint(struct usb_device *dev,
774     struct usb_host_endpoint *uhe, usb_size_t bufsize)
775 {
776 	struct usb_config cfg[2];
777 	uint8_t type = uhe->desc.bmAttributes & UE_XFERTYPE;
778 	uint8_t addr = uhe->desc.bEndpointAddress;
779 
780 	if (uhe->fbsd_buf_size == bufsize) {
781 		/* optimize */
782 		return (0);
783 	}
784 	usbd_transfer_unsetup(uhe->bsd_xfer, 2);
785 
786 	uhe->fbsd_buf_size = bufsize;
787 
788 	if (bufsize == 0) {
789 		return (0);
790 	}
791 	memset(cfg, 0, sizeof(cfg));
792 
793 	if (type == UE_ISOCHRONOUS) {
794 		/*
795 		 * Isochronous transfers are special in that they don't fit
796 		 * into the BULK/INTR/CONTROL transfer model.
797 		 */
798 
799 		cfg[0].type = type;
800 		cfg[0].endpoint = addr & UE_ADDR;
801 		cfg[0].direction = addr & (UE_DIR_OUT | UE_DIR_IN);
802 		cfg[0].callback = &usb_linux_isoc_callback;
803 		cfg[0].bufsize = 0;	/* use wMaxPacketSize */
804 		cfg[0].frames = usb_max_isoc_frames(dev);
805 		cfg[0].flags.proxy_buffer = 1;
806 #if 0
807 		/*
808 		 * The Linux USB API allows non back-to-back
809 		 * isochronous frames which we do not support. If the
810 		 * isochronous frames are not back-to-back we need to
811 		 * do a copy, and then we need a buffer for
812 		 * that. Enable this at your own risk.
813 		 */
814 		cfg[0].flags.ext_buffer = 1;
815 #endif
816 		cfg[0].flags.short_xfer_ok = 1;
817 
818 		bcopy(cfg, cfg + 1, sizeof(*cfg));
819 
820 		/* Allocate and setup two generic FreeBSD USB transfers */
821 
822 		if (usbd_transfer_setup(dev, &uhe->bsd_iface_index,
823 		    uhe->bsd_xfer, cfg, 2, uhe, &Giant)) {
824 			return (-EINVAL);
825 		}
826 	} else {
827 		if (bufsize > (1 << 22)) {
828 			/* limit buffer size */
829 			bufsize = (1 << 22);
830 		}
831 		/* Allocate and setup one generic FreeBSD USB transfer */
832 
833 		cfg[0].type = type;
834 		cfg[0].endpoint = addr & UE_ADDR;
835 		cfg[0].direction = addr & (UE_DIR_OUT | UE_DIR_IN);
836 		cfg[0].callback = &usb_linux_non_isoc_callback;
837 		cfg[0].bufsize = bufsize;
838 		cfg[0].flags.ext_buffer = 1;	/* enable zero-copy */
839 		cfg[0].flags.proxy_buffer = 1;
840 		cfg[0].flags.short_xfer_ok = 1;
841 
842 		if (usbd_transfer_setup(dev, &uhe->bsd_iface_index,
843 		    uhe->bsd_xfer, cfg, 1, uhe, &Giant)) {
844 			return (-EINVAL);
845 		}
846 	}
847 	return (0);
848 }
849 
850 /*------------------------------------------------------------------------*
851  *	usb_linux_create_usb_device
852  *
853  * The following function is used to build up a per USB device
854  * structure tree, that mimics the Linux one. The root structure
855  * is returned by this function.
856  *------------------------------------------------------------------------*/
857 static int
858 usb_linux_create_usb_device(struct usb_device *udev, device_t dev)
859 {
860 	struct usb_config_descriptor *cd = usbd_get_config_descriptor(udev);
861 	struct usb_descriptor *desc;
862 	struct usb_interface_descriptor *id;
863 	struct usb_endpoint_descriptor *ed;
864 	struct usb_interface *p_ui = NULL;
865 	struct usb_host_interface *p_uhi = NULL;
866 	struct usb_host_endpoint *p_uhe = NULL;
867 	usb_size_t size;
868 	uint16_t niface_total;
869 	uint16_t nedesc;
870 	uint16_t iface_no_curr;
871 	uint16_t iface_index;
872 	uint8_t pass;
873 	uint8_t iface_no;
874 
875 	/*
876 	 * We do two passes. One pass for computing necessary memory size
877 	 * and one pass to initialize all the allocated memory structures.
878 	 */
879 	for (pass = 0; pass < 2; pass++) {
880 		iface_no_curr = 0xFFFF;
881 		niface_total = 0;
882 		iface_index = 0;
883 		nedesc = 0;
884 		desc = NULL;
885 
886 		/*
887 		 * Iterate over all the USB descriptors. Use the USB config
888 		 * descriptor pointer provided by the FreeBSD USB stack.
889 		 */
890 		while ((desc = usb_desc_foreach(cd, desc))) {
891 			/*
892 			 * Build up a tree according to the descriptors we
893 			 * find:
894 			 */
895 			switch (desc->bDescriptorType) {
896 			case UDESC_DEVICE:
897 				break;
898 
899 			case UDESC_ENDPOINT:
900 				ed = (void *)desc;
901 				if ((ed->bLength < sizeof(*ed)) ||
902 				    (iface_index == 0))
903 					break;
904 				if (p_uhe) {
905 					bcopy(ed, &p_uhe->desc, sizeof(p_uhe->desc));
906 					p_uhe->bsd_iface_index = iface_index - 1;
907 					TAILQ_INIT(&p_uhe->bsd_urb_list);
908 					p_uhe++;
909 				}
910 				if (p_uhi) {
911 					(p_uhi - 1)->desc.bNumEndpoints++;
912 				}
913 				nedesc++;
914 				break;
915 
916 			case UDESC_INTERFACE:
917 				id = (void *)desc;
918 				if (id->bLength < sizeof(*id))
919 					break;
920 				if (p_uhi) {
921 					bcopy(id, &p_uhi->desc, sizeof(p_uhi->desc));
922 					p_uhi->desc.bNumEndpoints = 0;
923 					p_uhi->endpoint = p_uhe;
924 					p_uhi->string = "";
925 					p_uhi->bsd_iface_index = iface_index;
926 					p_uhi++;
927 				}
928 				iface_no = id->bInterfaceNumber;
929 				niface_total++;
930 				if (iface_no_curr != iface_no) {
931 					if (p_ui) {
932 						p_ui->altsetting = p_uhi - 1;
933 						p_ui->cur_altsetting = p_uhi - 1;
934 						p_ui->num_altsetting = 1;
935 						p_ui->bsd_iface_index = iface_index;
936 						p_ui->linux_udev = udev;
937 						p_ui++;
938 					}
939 					iface_no_curr = iface_no;
940 					iface_index++;
941 				} else {
942 					if (p_ui) {
943 						(p_ui - 1)->num_altsetting++;
944 					}
945 				}
946 				break;
947 
948 			default:
949 				break;
950 			}
951 		}
952 
953 		if (pass == 0) {
954 			size = (sizeof(*p_uhe) * nedesc) +
955 			    (sizeof(*p_ui) * iface_index) +
956 			    (sizeof(*p_uhi) * niface_total);
957 
958 			p_uhe = malloc(size, M_USBDEV, M_WAITOK | M_ZERO);
959 			p_ui = (void *)(p_uhe + nedesc);
960 			p_uhi = (void *)(p_ui + iface_index);
961 
962 			udev->linux_iface_start = p_ui;
963 			udev->linux_iface_end = p_ui + iface_index;
964 			udev->linux_endpoint_start = p_uhe;
965 			udev->linux_endpoint_end = p_uhe + nedesc;
966 			udev->devnum = device_get_unit(dev);
967 			bcopy(&udev->ddesc, &udev->descriptor,
968 			    sizeof(udev->descriptor));
969 			bcopy(udev->ctrl_ep.edesc, &udev->ep0.desc,
970 			    sizeof(udev->ep0.desc));
971 		}
972 	}
973 	return (0);
974 }
975 
976 /*------------------------------------------------------------------------*
977  *	usb_alloc_urb
978  *
979  * This function should always be used when you allocate an URB for
980  * use with the USB Linux stack. In case of an isochronous transfer
981  * you must specifiy the maximum number of "iso_packets" which you
982  * plan to transfer per URB. This function is always blocking, and
983  * "mem_flags" are not regarded like on Linux.
984  *------------------------------------------------------------------------*/
985 struct urb *
986 usb_alloc_urb(uint16_t iso_packets, uint16_t mem_flags)
987 {
988 	struct urb *urb;
989 	usb_size_t size;
990 
991 	if (iso_packets == 0xFFFF) {
992 		/*
993 		 * FreeBSD specific magic value to ask for control transfer
994 		 * memory allocation:
995 		 */
996 		size = sizeof(*urb) + sizeof(struct usb_device_request) + mem_flags;
997 	} else {
998 		size = sizeof(*urb) + (iso_packets * sizeof(urb->iso_frame_desc[0]));
999 	}
1000 
1001 	urb = malloc(size, M_USBDEV, M_WAITOK | M_ZERO);
1002 
1003 	cv_init(&urb->cv_wait, "URBWAIT");
1004 	if (iso_packets == 0xFFFF) {
1005 		urb->setup_packet = (void *)(urb + 1);
1006 		urb->transfer_buffer = (void *)(urb->setup_packet +
1007 		    sizeof(struct usb_device_request));
1008 	} else {
1009 		urb->number_of_packets = iso_packets;
1010 	}
1011 	return (urb);
1012 }
1013 
1014 /*------------------------------------------------------------------------*
1015  *	usb_find_host_endpoint
1016  *
1017  * The following function will return the Linux USB host endpoint
1018  * structure that matches the given endpoint type and endpoint
1019  * value. If no match is found, NULL is returned. This function is not
1020  * part of the Linux USB API and is only used internally.
1021  *------------------------------------------------------------------------*/
1022 struct usb_host_endpoint *
1023 usb_find_host_endpoint(struct usb_device *dev, uint8_t type, uint8_t ep)
1024 {
1025 	struct usb_host_endpoint *uhe;
1026 	struct usb_host_endpoint *uhe_end;
1027 	struct usb_host_interface *uhi;
1028 	struct usb_interface *ui;
1029 	uint8_t ea;
1030 	uint8_t at;
1031 	uint8_t mask;
1032 
1033 	if (dev == NULL) {
1034 		return (NULL);
1035 	}
1036 	if (type == UE_CONTROL) {
1037 		mask = UE_ADDR;
1038 	} else {
1039 		mask = (UE_DIR_IN | UE_DIR_OUT | UE_ADDR);
1040 	}
1041 
1042 	ep &= mask;
1043 
1044 	/*
1045 	 * Iterate over all the interfaces searching the selected alternate
1046 	 * setting only, and all belonging endpoints.
1047 	 */
1048 	for (ui = dev->linux_iface_start;
1049 	    ui != dev->linux_iface_end;
1050 	    ui++) {
1051 		uhi = ui->cur_altsetting;
1052 		if (uhi) {
1053 			uhe_end = uhi->endpoint + uhi->desc.bNumEndpoints;
1054 			for (uhe = uhi->endpoint;
1055 			    uhe != uhe_end;
1056 			    uhe++) {
1057 				ea = uhe->desc.bEndpointAddress;
1058 				at = uhe->desc.bmAttributes;
1059 
1060 				if (((ea & mask) == ep) &&
1061 				    ((at & UE_XFERTYPE) == type)) {
1062 					return (uhe);
1063 				}
1064 			}
1065 		}
1066 	}
1067 
1068 	if ((type == UE_CONTROL) && ((ep & UE_ADDR) == 0)) {
1069 		return (&dev->ep0);
1070 	}
1071 	return (NULL);
1072 }
1073 
1074 /*------------------------------------------------------------------------*
1075  *	usb_altnum_to_altsetting
1076  *
1077  * The following function returns a pointer to an alternate setting by
1078  * index given a "usb_interface" pointer. If the alternate setting by
1079  * index does not exist, NULL is returned. And alternate setting is a
1080  * variant of an interface, but usually with slightly different
1081  * characteristics.
1082  *------------------------------------------------------------------------*/
1083 struct usb_host_interface *
1084 usb_altnum_to_altsetting(const struct usb_interface *intf, uint8_t alt_index)
1085 {
1086 	if (alt_index >= intf->num_altsetting) {
1087 		return (NULL);
1088 	}
1089 	return (intf->altsetting + alt_index);
1090 }
1091 
1092 /*------------------------------------------------------------------------*
1093  *	usb_ifnum_to_if
1094  *
1095  * The following function searches up an USB interface by
1096  * "bInterfaceNumber". If no match is found, NULL is returned.
1097  *------------------------------------------------------------------------*/
1098 struct usb_interface *
1099 usb_ifnum_to_if(struct usb_device *dev, uint8_t iface_no)
1100 {
1101 	struct usb_interface *p_ui;
1102 
1103 	for (p_ui = dev->linux_iface_start;
1104 	    p_ui != dev->linux_iface_end;
1105 	    p_ui++) {
1106 		if ((p_ui->num_altsetting > 0) &&
1107 		    (p_ui->altsetting->desc.bInterfaceNumber == iface_no)) {
1108 			return (p_ui);
1109 		}
1110 	}
1111 	return (NULL);
1112 }
1113 
1114 /*------------------------------------------------------------------------*
1115  *	usb_buffer_alloc
1116  *------------------------------------------------------------------------*/
1117 void   *
1118 usb_buffer_alloc(struct usb_device *dev, usb_size_t size, uint16_t mem_flags, uint8_t *dma_addr)
1119 {
1120 	return (malloc(size, M_USBDEV, M_WAITOK | M_ZERO));
1121 }
1122 
1123 /*------------------------------------------------------------------------*
1124  *	usbd_get_intfdata
1125  *------------------------------------------------------------------------*/
1126 void   *
1127 usbd_get_intfdata(struct usb_interface *intf)
1128 {
1129 	return (intf->bsd_priv_sc);
1130 }
1131 
1132 /*------------------------------------------------------------------------*
1133  *	usb_linux_register
1134  *
1135  * The following function is used by the "USB_DRIVER_EXPORT()" macro,
1136  * and is used to register a Linux USB driver, so that its
1137  * "usb_device_id" structures gets searched a probe time. This
1138  * function is not part of the Linux USB API, and is for internal use
1139  * only.
1140  *------------------------------------------------------------------------*/
1141 void
1142 usb_linux_register(void *arg)
1143 {
1144 	struct usb_driver *drv = arg;
1145 
1146 	mtx_lock(&Giant);
1147 	LIST_INSERT_HEAD(&usb_linux_driver_list, drv, linux_driver_list);
1148 	mtx_unlock(&Giant);
1149 
1150 	usb_needs_explore_all();
1151 }
1152 
1153 /*------------------------------------------------------------------------*
1154  *	usb_linux_deregister
1155  *
1156  * The following function is used by the "USB_DRIVER_EXPORT()" macro,
1157  * and is used to deregister a Linux USB driver. This function will
1158  * ensure that all driver instances belonging to the Linux USB device
1159  * driver in question, gets detached before the driver is
1160  * unloaded. This function is not part of the Linux USB API, and is
1161  * for internal use only.
1162  *------------------------------------------------------------------------*/
1163 void
1164 usb_linux_deregister(void *arg)
1165 {
1166 	struct usb_driver *drv = arg;
1167 	struct usb_linux_softc *sc;
1168 
1169 repeat:
1170 	mtx_lock(&Giant);
1171 	LIST_FOREACH(sc, &usb_linux_attached_list, sc_attached_list) {
1172 		if (sc->sc_udrv == drv) {
1173 			mtx_unlock(&Giant);
1174 			device_detach(sc->sc_fbsd_dev);
1175 			goto repeat;
1176 		}
1177 	}
1178 	LIST_REMOVE(drv, linux_driver_list);
1179 	mtx_unlock(&Giant);
1180 }
1181 
1182 /*------------------------------------------------------------------------*
1183  *	usb_linux_free_device
1184  *
1185  * The following function is only used by the FreeBSD USB stack, to
1186  * cleanup and free memory after that a Linux USB device was attached.
1187  *------------------------------------------------------------------------*/
1188 void
1189 usb_linux_free_device(struct usb_device *dev)
1190 {
1191 	struct usb_host_endpoint *uhe;
1192 	struct usb_host_endpoint *uhe_end;
1193 	int err;
1194 
1195 	uhe = dev->linux_endpoint_start;
1196 	uhe_end = dev->linux_endpoint_end;
1197 	while (uhe != uhe_end) {
1198 		err = usb_setup_endpoint(dev, uhe, 0);
1199 		uhe++;
1200 	}
1201 	err = usb_setup_endpoint(dev, &dev->ep0, 0);
1202 	free(dev->linux_endpoint_start, M_USBDEV);
1203 }
1204 
1205 /*------------------------------------------------------------------------*
1206  *	usb_buffer_free
1207  *------------------------------------------------------------------------*/
1208 void
1209 usb_buffer_free(struct usb_device *dev, usb_size_t size,
1210     void *addr, uint8_t dma_addr)
1211 {
1212 	free(addr, M_USBDEV);
1213 }
1214 
1215 /*------------------------------------------------------------------------*
1216  *	usb_free_urb
1217  *------------------------------------------------------------------------*/
1218 void
1219 usb_free_urb(struct urb *urb)
1220 {
1221 	if (urb == NULL) {
1222 		return;
1223 	}
1224 	/* make sure that the current URB is not active */
1225 	usb_kill_urb(urb);
1226 
1227 	/* destroy condition variable */
1228 	cv_destroy(&urb->cv_wait);
1229 
1230 	/* just free it */
1231 	free(urb, M_USBDEV);
1232 }
1233 
1234 /*------------------------------------------------------------------------*
1235  *	usb_init_urb
1236  *
1237  * The following function can be used to initialize a custom URB. It
1238  * is not recommended to use this function. Use "usb_alloc_urb()"
1239  * instead.
1240  *------------------------------------------------------------------------*/
1241 void
1242 usb_init_urb(struct urb *urb)
1243 {
1244 	if (urb == NULL) {
1245 		return;
1246 	}
1247 	memset(urb, 0, sizeof(*urb));
1248 }
1249 
1250 /*------------------------------------------------------------------------*
1251  *	usb_kill_urb
1252  *------------------------------------------------------------------------*/
1253 void
1254 usb_kill_urb(struct urb *urb)
1255 {
1256 	usb_unlink_urb_sub(urb, 1);
1257 }
1258 
1259 /*------------------------------------------------------------------------*
1260  *	usb_set_intfdata
1261  *
1262  * The following function sets the per Linux USB interface private
1263  * data pointer. It is used by most Linux USB device drivers.
1264  *------------------------------------------------------------------------*/
1265 void
1266 usb_set_intfdata(struct usb_interface *intf, void *data)
1267 {
1268 	intf->bsd_priv_sc = data;
1269 }
1270 
1271 /*------------------------------------------------------------------------*
1272  *	usb_linux_cleanup_interface
1273  *
1274  * The following function will release all FreeBSD USB transfers
1275  * associated with a Linux USB interface. It is for internal use only.
1276  *------------------------------------------------------------------------*/
1277 static void
1278 usb_linux_cleanup_interface(struct usb_device *dev, struct usb_interface *iface)
1279 {
1280 	struct usb_host_interface *uhi;
1281 	struct usb_host_interface *uhi_end;
1282 	struct usb_host_endpoint *uhe;
1283 	struct usb_host_endpoint *uhe_end;
1284 	int err;
1285 
1286 	uhi = iface->altsetting;
1287 	uhi_end = iface->altsetting + iface->num_altsetting;
1288 	while (uhi != uhi_end) {
1289 		uhe = uhi->endpoint;
1290 		uhe_end = uhi->endpoint + uhi->desc.bNumEndpoints;
1291 		while (uhe != uhe_end) {
1292 			err = usb_setup_endpoint(dev, uhe, 0);
1293 			uhe++;
1294 		}
1295 		uhi++;
1296 	}
1297 }
1298 
1299 /*------------------------------------------------------------------------*
1300  *	usb_linux_wait_complete
1301  *
1302  * The following function is used by "usb_start_wait_urb()" to wake it
1303  * up, when an USB transfer has finished.
1304  *------------------------------------------------------------------------*/
1305 static void
1306 usb_linux_wait_complete(struct urb *urb)
1307 {
1308 	if (urb->transfer_flags & URB_IS_SLEEPING) {
1309 		cv_signal(&urb->cv_wait);
1310 	}
1311 	urb->transfer_flags &= ~URB_WAIT_WAKEUP;
1312 }
1313 
1314 /*------------------------------------------------------------------------*
1315  *	usb_linux_complete
1316  *------------------------------------------------------------------------*/
1317 static void
1318 usb_linux_complete(struct usb_xfer *xfer)
1319 {
1320 	struct urb *urb;
1321 
1322 	urb = usbd_xfer_get_priv(xfer);
1323 	usbd_xfer_set_priv(xfer, NULL);
1324 	if (urb->complete) {
1325 		(urb->complete) (urb);
1326 	}
1327 }
1328 
1329 /*------------------------------------------------------------------------*
1330  *	usb_linux_isoc_callback
1331  *
1332  * The following is the FreeBSD isochronous USB callback. Isochronous
1333  * frames are USB packets transferred 1000 or 8000 times per second,
1334  * depending on whether a full- or high- speed USB transfer is
1335  * used.
1336  *------------------------------------------------------------------------*/
1337 static void
1338 usb_linux_isoc_callback(struct usb_xfer *xfer, usb_error_t error)
1339 {
1340 	usb_frlength_t max_frame = xfer->max_frame_size;
1341 	usb_frlength_t offset;
1342 	usb_frcount_t x;
1343 	struct urb *urb = usbd_xfer_get_priv(xfer);
1344 	struct usb_host_endpoint *uhe = usbd_xfer_softc(xfer);
1345 	struct usb_iso_packet_descriptor *uipd;
1346 
1347 	DPRINTF("\n");
1348 
1349 	switch (USB_GET_STATE(xfer)) {
1350 	case USB_ST_TRANSFERRED:
1351 
1352 		if (urb->bsd_isread) {
1353 			/* copy in data with regard to the URB */
1354 
1355 			offset = 0;
1356 
1357 			for (x = 0; x < urb->number_of_packets; x++) {
1358 				uipd = urb->iso_frame_desc + x;
1359 				if (uipd->length > xfer->frlengths[x]) {
1360 					if (urb->transfer_flags & URB_SHORT_NOT_OK) {
1361 						/* XXX should be EREMOTEIO */
1362 						uipd->status = -EPIPE;
1363 					} else {
1364 						uipd->status = 0;
1365 					}
1366 				} else {
1367 					uipd->status = 0;
1368 				}
1369 				uipd->actual_length = xfer->frlengths[x];
1370 				if (!xfer->flags.ext_buffer) {
1371 					usbd_copy_out(xfer->frbuffers, offset,
1372 					    USB_ADD_BYTES(urb->transfer_buffer,
1373 					    uipd->offset), uipd->actual_length);
1374 				}
1375 				offset += max_frame;
1376 			}
1377 		} else {
1378 			for (x = 0; x < urb->number_of_packets; x++) {
1379 				uipd = urb->iso_frame_desc + x;
1380 				uipd->actual_length = xfer->frlengths[x];
1381 				uipd->status = 0;
1382 			}
1383 		}
1384 
1385 		urb->actual_length = xfer->actlen;
1386 
1387 		/* check for short transfer */
1388 		if (xfer->actlen < xfer->sumlen) {
1389 			/* short transfer */
1390 			if (urb->transfer_flags & URB_SHORT_NOT_OK) {
1391 				/* XXX should be EREMOTEIO */
1392 				urb->status = -EPIPE;
1393 			} else {
1394 				urb->status = 0;
1395 			}
1396 		} else {
1397 			/* success */
1398 			urb->status = 0;
1399 		}
1400 
1401 		/* call callback */
1402 		usb_linux_complete(xfer);
1403 
1404 	case USB_ST_SETUP:
1405 tr_setup:
1406 
1407 		if (xfer->priv_fifo == NULL) {
1408 			/* get next transfer */
1409 			urb = TAILQ_FIRST(&uhe->bsd_urb_list);
1410 			if (urb == NULL) {
1411 				/* nothing to do */
1412 				return;
1413 			}
1414 			TAILQ_REMOVE(&uhe->bsd_urb_list, urb, bsd_urb_list);
1415 			urb->bsd_urb_list.tqe_prev = NULL;
1416 
1417 			x = xfer->max_frame_count;
1418 			if (urb->number_of_packets > x) {
1419 				/* XXX simply truncate the transfer */
1420 				urb->number_of_packets = x;
1421 			}
1422 		} else {
1423 			DPRINTF("Already got a transfer\n");
1424 
1425 			/* already got a transfer (should not happen) */
1426 			urb = usbd_xfer_get_priv(xfer);
1427 		}
1428 
1429 		urb->bsd_isread = (uhe->desc.bEndpointAddress & UE_DIR_IN) ? 1 : 0;
1430 
1431 		if (xfer->flags.ext_buffer) {
1432 			/* set virtual address to load */
1433 			usbd_xfer_set_frame_data(xfer, 0, urb->transfer_buffer, 0);
1434 		}
1435 		if (!(urb->bsd_isread)) {
1436 			/* copy out data with regard to the URB */
1437 
1438 			offset = 0;
1439 
1440 			for (x = 0; x < urb->number_of_packets; x++) {
1441 				uipd = urb->iso_frame_desc + x;
1442 				usbd_xfer_set_frame_len(xfer, x, uipd->length);
1443 				if (!xfer->flags.ext_buffer) {
1444 					usbd_copy_in(xfer->frbuffers, offset,
1445 					    USB_ADD_BYTES(urb->transfer_buffer,
1446 					    uipd->offset), uipd->length);
1447 				}
1448 				offset += uipd->length;
1449 			}
1450 		} else {
1451 			/*
1452 			 * compute the transfer length into the "offset"
1453 			 * variable
1454 			 */
1455 
1456 			offset = urb->number_of_packets * max_frame;
1457 
1458 			/* setup "frlengths" array */
1459 
1460 			for (x = 0; x < urb->number_of_packets; x++) {
1461 				uipd = urb->iso_frame_desc + x;
1462 				usbd_xfer_set_frame_len(xfer, x, max_frame);
1463 			}
1464 		}
1465 		usbd_xfer_set_priv(xfer, urb);
1466 		xfer->flags.force_short_xfer = 0;
1467 		xfer->timeout = urb->timeout;
1468 		xfer->nframes = urb->number_of_packets;
1469 		usbd_transfer_submit(xfer);
1470 		return;
1471 
1472 	default:			/* Error */
1473 		if (xfer->error == USB_ERR_CANCELLED) {
1474 			urb->status = -ECONNRESET;
1475 		} else {
1476 			urb->status = -EPIPE;	/* stalled */
1477 		}
1478 
1479 		/* Set zero for "actual_length" */
1480 		urb->actual_length = 0;
1481 
1482 		/* Set zero for "actual_length" */
1483 		for (x = 0; x < urb->number_of_packets; x++) {
1484 			urb->iso_frame_desc[x].actual_length = 0;
1485 			urb->iso_frame_desc[x].status = urb->status;
1486 		}
1487 
1488 		/* call callback */
1489 		usb_linux_complete(xfer);
1490 
1491 		if (xfer->error == USB_ERR_CANCELLED) {
1492 			/* we need to return in this case */
1493 			return;
1494 		}
1495 		goto tr_setup;
1496 	}
1497 }
1498 
1499 /*------------------------------------------------------------------------*
1500  *	usb_linux_non_isoc_callback
1501  *
1502  * The following is the FreeBSD BULK/INTERRUPT and CONTROL USB
1503  * callback. It dequeues Linux USB stack compatible URB's, transforms
1504  * the URB fields into a FreeBSD USB transfer, and defragments the USB
1505  * transfer as required. When the transfer is complete the "complete"
1506  * callback is called.
1507  *------------------------------------------------------------------------*/
1508 static void
1509 usb_linux_non_isoc_callback(struct usb_xfer *xfer, usb_error_t error)
1510 {
1511 	enum {
1512 		REQ_SIZE = sizeof(struct usb_device_request)
1513 	};
1514 	struct urb *urb = usbd_xfer_get_priv(xfer);
1515 	struct usb_host_endpoint *uhe = usbd_xfer_softc(xfer);
1516 	uint8_t *ptr;
1517 	usb_frlength_t max_bulk = usbd_xfer_max_len(xfer);
1518 	uint8_t data_frame = xfer->flags_int.control_xfr ? 1 : 0;
1519 
1520 	DPRINTF("\n");
1521 
1522 	switch (USB_GET_STATE(xfer)) {
1523 	case USB_ST_TRANSFERRED:
1524 
1525 		if (xfer->flags_int.control_xfr) {
1526 			/* don't transfer the setup packet again: */
1527 
1528 			usbd_xfer_set_frame_len(xfer, 0, 0);
1529 		}
1530 		if (urb->bsd_isread && (!xfer->flags.ext_buffer)) {
1531 			/* copy in data with regard to the URB */
1532 			usbd_copy_out(xfer->frbuffers + data_frame, 0,
1533 			    urb->bsd_data_ptr, xfer->frlengths[data_frame]);
1534 		}
1535 		urb->bsd_length_rem -= xfer->frlengths[data_frame];
1536 		urb->bsd_data_ptr += xfer->frlengths[data_frame];
1537 		urb->actual_length += xfer->frlengths[data_frame];
1538 
1539 		/* check for short transfer */
1540 		if (xfer->actlen < xfer->sumlen) {
1541 			urb->bsd_length_rem = 0;
1542 
1543 			/* short transfer */
1544 			if (urb->transfer_flags & URB_SHORT_NOT_OK) {
1545 				urb->status = -EPIPE;
1546 			} else {
1547 				urb->status = 0;
1548 			}
1549 		} else {
1550 			/* check remainder */
1551 			if (urb->bsd_length_rem > 0) {
1552 				goto setup_bulk;
1553 			}
1554 			/* success */
1555 			urb->status = 0;
1556 		}
1557 
1558 		/* call callback */
1559 		usb_linux_complete(xfer);
1560 
1561 	case USB_ST_SETUP:
1562 tr_setup:
1563 		/* get next transfer */
1564 		urb = TAILQ_FIRST(&uhe->bsd_urb_list);
1565 		if (urb == NULL) {
1566 			/* nothing to do */
1567 			return;
1568 		}
1569 		TAILQ_REMOVE(&uhe->bsd_urb_list, urb, bsd_urb_list);
1570 		urb->bsd_urb_list.tqe_prev = NULL;
1571 
1572 		usbd_xfer_set_priv(xfer, urb);
1573 		xfer->flags.force_short_xfer = 0;
1574 		xfer->timeout = urb->timeout;
1575 
1576 		if (xfer->flags_int.control_xfr) {
1577 			/*
1578 			 * USB control transfers need special handling.
1579 			 * First copy in the header, then copy in data!
1580 			 */
1581 			if (!xfer->flags.ext_buffer) {
1582 				usbd_copy_in(xfer->frbuffers, 0,
1583 				    urb->setup_packet, REQ_SIZE);
1584 				usbd_xfer_set_frame_len(xfer, 0, REQ_SIZE);
1585 			} else {
1586 				/* set virtual address to load */
1587 				usbd_xfer_set_frame_data(xfer, 0,
1588 				    urb->setup_packet, REQ_SIZE);
1589 			}
1590 
1591 			ptr = urb->setup_packet;
1592 
1593 			/* setup data transfer direction and length */
1594 			urb->bsd_isread = (ptr[0] & UT_READ) ? 1 : 0;
1595 			urb->bsd_length_rem = ptr[6] | (ptr[7] << 8);
1596 
1597 		} else {
1598 			/* setup data transfer direction */
1599 
1600 			urb->bsd_length_rem = urb->transfer_buffer_length;
1601 			urb->bsd_isread = (uhe->desc.bEndpointAddress &
1602 			    UE_DIR_IN) ? 1 : 0;
1603 		}
1604 
1605 		urb->bsd_data_ptr = urb->transfer_buffer;
1606 		urb->actual_length = 0;
1607 
1608 setup_bulk:
1609 		if (max_bulk > urb->bsd_length_rem) {
1610 			max_bulk = urb->bsd_length_rem;
1611 		}
1612 		/* check if we need to force a short transfer */
1613 
1614 		if ((max_bulk == urb->bsd_length_rem) &&
1615 		    (urb->transfer_flags & URB_ZERO_PACKET) &&
1616 		    (!xfer->flags_int.control_xfr)) {
1617 			xfer->flags.force_short_xfer = 1;
1618 		}
1619 		/* check if we need to copy in data */
1620 
1621 		if (xfer->flags.ext_buffer) {
1622 			/* set virtual address to load */
1623 			usbd_xfer_set_frame_data(xfer, data_frame,
1624 			    urb->bsd_data_ptr, max_bulk);
1625 		} else if (!urb->bsd_isread) {
1626 			/* copy out data with regard to the URB */
1627 			usbd_copy_in(xfer->frbuffers + data_frame, 0,
1628 			    urb->bsd_data_ptr, max_bulk);
1629 			usbd_xfer_set_frame_len(xfer, data_frame, max_bulk);
1630 		}
1631 		if (xfer->flags_int.control_xfr) {
1632 			if (max_bulk > 0) {
1633 				xfer->nframes = 2;
1634 			} else {
1635 				xfer->nframes = 1;
1636 			}
1637 		} else {
1638 			xfer->nframes = 1;
1639 		}
1640 		usbd_transfer_submit(xfer);
1641 		return;
1642 
1643 	default:
1644 		if (xfer->error == USB_ERR_CANCELLED) {
1645 			urb->status = -ECONNRESET;
1646 		} else {
1647 			urb->status = -EPIPE;
1648 		}
1649 
1650 		/* Set zero for "actual_length" */
1651 		urb->actual_length = 0;
1652 
1653 		/* call callback */
1654 		usb_linux_complete(xfer);
1655 
1656 		if (xfer->error == USB_ERR_CANCELLED) {
1657 			/* we need to return in this case */
1658 			return;
1659 		}
1660 		goto tr_setup;
1661 	}
1662 }
1663 
1664 /*------------------------------------------------------------------------*
1665  *	usb_fill_bulk_urb
1666  *------------------------------------------------------------------------*/
1667 void
1668 usb_fill_bulk_urb(struct urb *urb, struct usb_device *udev,
1669     struct usb_host_endpoint *uhe, void *buf,
1670     int length, usb_complete_t callback, void *arg)
1671 {
1672 	urb->dev = udev;
1673 	urb->endpoint = uhe;
1674 	urb->transfer_buffer = buf;
1675 	urb->transfer_buffer_length = length;
1676 	urb->complete = callback;
1677 	urb->context = arg;
1678 }
1679 
1680 /*------------------------------------------------------------------------*
1681  *	usb_bulk_msg
1682  *
1683  * NOTE: This function can also be used for interrupt endpoints!
1684  *
1685  * Return values:
1686  *    0: Success
1687  * Else: Failure
1688  *------------------------------------------------------------------------*/
1689 int
1690 usb_bulk_msg(struct usb_device *udev, struct usb_host_endpoint *uhe,
1691     void *data, int len, uint16_t *pactlen, usb_timeout_t timeout)
1692 {
1693 	struct urb *urb;
1694 	int err;
1695 
1696 	if (uhe == NULL)
1697 		return (-EINVAL);
1698 	if (len < 0)
1699 		return (-EINVAL);
1700 
1701 	err = usb_setup_endpoint(udev, uhe, 4096 /* bytes */);
1702 	if (err)
1703 		return (err);
1704 
1705 	urb = usb_alloc_urb(0, 0);
1706 
1707 	usb_fill_bulk_urb(urb, udev, uhe, data, len,
1708 	    usb_linux_wait_complete, NULL);
1709 
1710 	err = usb_start_wait_urb(urb, timeout, pactlen);
1711 
1712 	usb_free_urb(urb);
1713 
1714 	return (err);
1715 }
1716 MODULE_DEPEND(linuxkpi, usb, 1, 1, 1);
1717 
1718 static void
1719 usb_linux_init(void *arg)
1720 {
1721 	/* register our function */
1722 	usb_linux_free_device_p = &usb_linux_free_device;
1723 }
1724 SYSINIT(usb_linux_init, SI_SUB_LOCK, SI_ORDER_FIRST, usb_linux_init, NULL);
1725 SYSUNINIT(usb_linux_unload, SI_SUB_LOCK, SI_ORDER_ANY, usb_linux_unload, NULL);
1726