1 /* $FreeBSD$ */
2 /*-
3  * Copyright (c) 2007 Luigi Rizzo - Universita` di Pisa. All rights reserved.
4  * Copyright (c) 2007 Hans Petter Selasky. All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  */
27 
28 #ifdef USB_GLOBAL_INCLUDE_FILE
29 #include USB_GLOBAL_INCLUDE_FILE
30 #else
31 #include <sys/stdint.h>
32 #include <sys/stddef.h>
33 #include <sys/param.h>
34 #include <sys/queue.h>
35 #include <sys/types.h>
36 #include <sys/systm.h>
37 #include <sys/kernel.h>
38 #include <sys/bus.h>
39 #include <sys/module.h>
40 #include <sys/lock.h>
41 #include <sys/mutex.h>
42 #include <sys/condvar.h>
43 #include <sys/sysctl.h>
44 #include <sys/sx.h>
45 #include <sys/unistd.h>
46 #include <sys/callout.h>
47 #include <sys/malloc.h>
48 #include <sys/priv.h>
49 
50 #include <dev/usb/usb.h>
51 #include <dev/usb/usbdi.h>
52 #include <dev/usb/usbdi_util.h>
53 
54 #define	USB_DEBUG_VAR usb_debug
55 
56 #include <dev/usb/usb_core.h>
57 #include <linux/usb.h>
58 #include <dev/usb/usb_process.h>
59 #include <dev/usb/usb_device.h>
60 #include <dev/usb/usb_util.h>
61 #include <dev/usb/usb_busdma.h>
62 #include <dev/usb/usb_transfer.h>
63 #include <dev/usb/usb_hub.h>
64 #include <dev/usb/usb_request.h>
65 #include <dev/usb/usb_debug.h>
66 #include <dev/usb/usb_dynamic.h>
67 #endif			/* USB_GLOBAL_INCLUDE_FILE */
68 
69 struct usb_linux_softc {
70 	LIST_ENTRY(usb_linux_softc) sc_attached_list;
71 
72 	device_t sc_fbsd_dev;
73 	struct usb_device *sc_fbsd_udev;
74 	struct usb_interface *sc_ui;
75 	struct usb_driver *sc_udrv;
76 };
77 
78 /* prototypes */
79 static device_probe_t usb_linux_probe;
80 static device_attach_t usb_linux_attach;
81 static device_detach_t usb_linux_detach;
82 static device_suspend_t usb_linux_suspend;
83 static device_resume_t usb_linux_resume;
84 
85 static usb_callback_t usb_linux_isoc_callback;
86 static usb_callback_t usb_linux_non_isoc_callback;
87 
88 static usb_complete_t usb_linux_wait_complete;
89 
90 static uint16_t	usb_max_isoc_frames(struct usb_device *);
91 static int	usb_start_wait_urb(struct urb *, usb_timeout_t, uint16_t *);
92 static const struct usb_device_id *usb_linux_lookup_id(
93 		    const struct usb_device_id *, struct usb_attach_arg *);
94 static struct	usb_driver *usb_linux_get_usb_driver(struct usb_linux_softc *);
95 static int	usb_linux_create_usb_device(struct usb_device *, device_t);
96 static void	usb_linux_cleanup_interface(struct usb_device *,
97 		    struct usb_interface *);
98 static void	usb_linux_complete(struct usb_xfer *);
99 static int	usb_unlink_urb_sub(struct urb *, uint8_t);
100 
101 /*------------------------------------------------------------------------*
102  * FreeBSD USB interface
103  *------------------------------------------------------------------------*/
104 
105 static LIST_HEAD(, usb_linux_softc) usb_linux_attached_list;
106 static LIST_HEAD(, usb_driver) usb_linux_driver_list;
107 
108 static device_method_t usb_linux_methods[] = {
109 	/* Device interface */
110 	DEVMETHOD(device_probe, usb_linux_probe),
111 	DEVMETHOD(device_attach, usb_linux_attach),
112 	DEVMETHOD(device_detach, usb_linux_detach),
113 	DEVMETHOD(device_suspend, usb_linux_suspend),
114 	DEVMETHOD(device_resume, usb_linux_resume),
115 
116 	DEVMETHOD_END
117 };
118 
119 static driver_t usb_linux_driver = {
120 	.name = "usb_linux",
121 	.methods = usb_linux_methods,
122 	.size = sizeof(struct usb_linux_softc),
123 };
124 
125 DRIVER_MODULE(usb_linux, uhub, usb_linux_driver, NULL, NULL);
126 MODULE_VERSION(usb_linux, 1);
127 
128 /*------------------------------------------------------------------------*
129  *	usb_linux_lookup_id
130  *
131  * This functions takes an array of "struct usb_device_id" and tries
132  * to match the entries with the information in "struct usb_attach_arg".
133  * If it finds a match the matching entry will be returned.
134  * Else "NULL" will be returned.
135  *------------------------------------------------------------------------*/
136 static const struct usb_device_id *
137 usb_linux_lookup_id(const struct usb_device_id *id, struct usb_attach_arg *uaa)
138 {
139 	if (id == NULL) {
140 		goto done;
141 	}
142 	/*
143 	 * Keep on matching array entries until we find one with
144 	 * "match_flags" equal to zero, which indicates the end of the
145 	 * array:
146 	 */
147 	for (; id->match_flags; id++) {
148 		if ((id->match_flags & USB_DEVICE_ID_MATCH_VENDOR) &&
149 		    (id->idVendor != uaa->info.idVendor)) {
150 			continue;
151 		}
152 		if ((id->match_flags & USB_DEVICE_ID_MATCH_PRODUCT) &&
153 		    (id->idProduct != uaa->info.idProduct)) {
154 			continue;
155 		}
156 		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_LO) &&
157 		    (id->bcdDevice_lo > uaa->info.bcdDevice)) {
158 			continue;
159 		}
160 		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_HI) &&
161 		    (id->bcdDevice_hi < uaa->info.bcdDevice)) {
162 			continue;
163 		}
164 		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_CLASS) &&
165 		    (id->bDeviceClass != uaa->info.bDeviceClass)) {
166 			continue;
167 		}
168 		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_SUBCLASS) &&
169 		    (id->bDeviceSubClass != uaa->info.bDeviceSubClass)) {
170 			continue;
171 		}
172 		if ((id->match_flags & USB_DEVICE_ID_MATCH_DEV_PROTOCOL) &&
173 		    (id->bDeviceProtocol != uaa->info.bDeviceProtocol)) {
174 			continue;
175 		}
176 		if ((uaa->info.bDeviceClass == 0xFF) &&
177 		    !(id->match_flags & USB_DEVICE_ID_MATCH_VENDOR) &&
178 		    (id->match_flags & (USB_DEVICE_ID_MATCH_INT_CLASS |
179 		    USB_DEVICE_ID_MATCH_INT_SUBCLASS |
180 		    USB_DEVICE_ID_MATCH_INT_PROTOCOL))) {
181 			continue;
182 		}
183 		if ((id->match_flags & USB_DEVICE_ID_MATCH_INT_CLASS) &&
184 		    (id->bInterfaceClass != uaa->info.bInterfaceClass)) {
185 			continue;
186 		}
187 		if ((id->match_flags & USB_DEVICE_ID_MATCH_INT_SUBCLASS) &&
188 		    (id->bInterfaceSubClass != uaa->info.bInterfaceSubClass)) {
189 			continue;
190 		}
191 		if ((id->match_flags & USB_DEVICE_ID_MATCH_INT_PROTOCOL) &&
192 		    (id->bInterfaceProtocol != uaa->info.bInterfaceProtocol)) {
193 			continue;
194 		}
195 		/* we found a match! */
196 		return (id);
197 	}
198 
199 done:
200 	return (NULL);
201 }
202 
203 /*------------------------------------------------------------------------*
204  *	usb_linux_probe
205  *
206  * This function is the FreeBSD probe callback. It is called from the
207  * FreeBSD USB stack through the "device_probe_and_attach()" function.
208  *------------------------------------------------------------------------*/
209 static int
210 usb_linux_probe(device_t dev)
211 {
212 	struct usb_attach_arg *uaa = device_get_ivars(dev);
213 	struct usb_driver *udrv;
214 	int err = ENXIO;
215 
216 	if (uaa->usb_mode != USB_MODE_HOST) {
217 		return (ENXIO);
218 	}
219 	mtx_lock(&Giant);
220 	LIST_FOREACH(udrv, &usb_linux_driver_list, linux_driver_list) {
221 		if (usb_linux_lookup_id(udrv->id_table, uaa)) {
222 			err = BUS_PROBE_DEFAULT;
223 			break;
224 		}
225 	}
226 	mtx_unlock(&Giant);
227 
228 	return (err);
229 }
230 
231 /*------------------------------------------------------------------------*
232  *	usb_linux_get_usb_driver
233  *
234  * This function returns the pointer to the "struct usb_driver" where
235  * the Linux USB device driver "struct usb_device_id" match was found.
236  * We apply a lock before reading out the pointer to avoid races.
237  *------------------------------------------------------------------------*/
238 static struct usb_driver *
239 usb_linux_get_usb_driver(struct usb_linux_softc *sc)
240 {
241 	struct usb_driver *udrv;
242 
243 	mtx_lock(&Giant);
244 	udrv = sc->sc_udrv;
245 	mtx_unlock(&Giant);
246 	return (udrv);
247 }
248 
249 /*------------------------------------------------------------------------*
250  *	usb_linux_attach
251  *
252  * This function is the FreeBSD attach callback. It is called from the
253  * FreeBSD USB stack through the "device_probe_and_attach()" function.
254  * This function is called when "usb_linux_probe()" returns zero.
255  *------------------------------------------------------------------------*/
256 static int
257 usb_linux_attach(device_t dev)
258 {
259 	struct usb_attach_arg *uaa = device_get_ivars(dev);
260 	struct usb_linux_softc *sc = device_get_softc(dev);
261 	struct usb_driver *udrv;
262 	const struct usb_device_id *id = NULL;
263 
264 	mtx_lock(&Giant);
265 	LIST_FOREACH(udrv, &usb_linux_driver_list, linux_driver_list) {
266 		id = usb_linux_lookup_id(udrv->id_table, uaa);
267 		if (id)
268 			break;
269 	}
270 	mtx_unlock(&Giant);
271 
272 	if (id == NULL) {
273 		return (ENXIO);
274 	}
275 	if (usb_linux_create_usb_device(uaa->device, dev) != 0)
276 		return (ENOMEM);
277 	device_set_usb_desc(dev);
278 
279 	sc->sc_fbsd_udev = uaa->device;
280 	sc->sc_fbsd_dev = dev;
281 	sc->sc_udrv = udrv;
282 	sc->sc_ui = usb_ifnum_to_if(uaa->device, uaa->info.bIfaceNum);
283 	if (sc->sc_ui == NULL) {
284 		return (EINVAL);
285 	}
286 	if (udrv->probe) {
287 		if ((udrv->probe) (sc->sc_ui, id)) {
288 			return (ENXIO);
289 		}
290 	}
291 	mtx_lock(&Giant);
292 	LIST_INSERT_HEAD(&usb_linux_attached_list, sc, sc_attached_list);
293 	mtx_unlock(&Giant);
294 
295 	/* success */
296 	return (0);
297 }
298 
299 /*------------------------------------------------------------------------*
300  *	usb_linux_detach
301  *
302  * This function is the FreeBSD detach callback. It is called from the
303  * FreeBSD USB stack through the "device_detach()" function.
304  *------------------------------------------------------------------------*/
305 static int
306 usb_linux_detach(device_t dev)
307 {
308 	struct usb_linux_softc *sc = device_get_softc(dev);
309 	struct usb_driver *udrv = NULL;
310 
311 	mtx_lock(&Giant);
312 	if (sc->sc_attached_list.le_prev) {
313 		LIST_REMOVE(sc, sc_attached_list);
314 		sc->sc_attached_list.le_prev = NULL;
315 		udrv = sc->sc_udrv;
316 		sc->sc_udrv = NULL;
317 	}
318 	mtx_unlock(&Giant);
319 
320 	if (udrv && udrv->disconnect) {
321 		(udrv->disconnect) (sc->sc_ui);
322 	}
323 	/*
324 	 * Make sure that we free all FreeBSD USB transfers belonging to
325 	 * this Linux "usb_interface", hence they will most likely not be
326 	 * needed any more.
327 	 */
328 	usb_linux_cleanup_interface(sc->sc_fbsd_udev, sc->sc_ui);
329 	return (0);
330 }
331 
332 /*------------------------------------------------------------------------*
333  *	usb_linux_suspend
334  *
335  * This function is the FreeBSD suspend callback. Usually it does nothing.
336  *------------------------------------------------------------------------*/
337 static int
338 usb_linux_suspend(device_t dev)
339 {
340 	struct usb_linux_softc *sc = device_get_softc(dev);
341 	struct usb_driver *udrv = usb_linux_get_usb_driver(sc);
342 	pm_message_t pm_msg;
343 	int err;
344 
345 	err = 0;
346 	if (udrv && udrv->suspend) {
347 		pm_msg.event = 0;				/* XXX */
348 		err = (udrv->suspend) (sc->sc_ui, pm_msg);
349 	}
350 	return (-err);
351 }
352 
353 /*------------------------------------------------------------------------*
354  *	usb_linux_resume
355  *
356  * This function is the FreeBSD resume callback. Usually it does nothing.
357  *------------------------------------------------------------------------*/
358 static int
359 usb_linux_resume(device_t dev)
360 {
361 	struct usb_linux_softc *sc = device_get_softc(dev);
362 	struct usb_driver *udrv = usb_linux_get_usb_driver(sc);
363 	int err;
364 
365 	err = 0;
366 	if (udrv && udrv->resume)
367 		err = (udrv->resume) (sc->sc_ui);
368 	return (-err);
369 }
370 
371 /*------------------------------------------------------------------------*
372  * Linux emulation layer
373  *------------------------------------------------------------------------*/
374 
375 /*------------------------------------------------------------------------*
376  *	usb_max_isoc_frames
377  *
378  * The following function returns the maximum number of isochronous
379  * frames that we support per URB. It is not part of the Linux USB API.
380  *------------------------------------------------------------------------*/
381 static uint16_t
382 usb_max_isoc_frames(struct usb_device *dev)
383 {
384 	;				/* indent fix */
385 	switch (usbd_get_speed(dev)) {
386 	case USB_SPEED_LOW:
387 	case USB_SPEED_FULL:
388 		return (USB_MAX_FULL_SPEED_ISOC_FRAMES);
389 	default:
390 		return (USB_MAX_HIGH_SPEED_ISOC_FRAMES);
391 	}
392 }
393 
394 /*------------------------------------------------------------------------*
395  *	usb_submit_urb
396  *
397  * This function is used to queue an URB after that it has been
398  * initialized. If it returns non-zero, it means that the URB was not
399  * queued.
400  *------------------------------------------------------------------------*/
401 int
402 usb_submit_urb(struct urb *urb, uint16_t mem_flags)
403 {
404 	struct usb_host_endpoint *uhe;
405 	uint8_t do_unlock;
406 	int err;
407 
408 	if (urb == NULL)
409 		return (-EINVAL);
410 
411 	do_unlock = mtx_owned(&Giant) ? 0 : 1;
412 	if (do_unlock)
413 		mtx_lock(&Giant);
414 
415 	if (urb->endpoint == NULL) {
416 		err = -EINVAL;
417 		goto done;
418 	}
419 
420 	/*
421 	 * Check to see if the urb is in the process of being killed
422 	 * and stop a urb that is in the process of being killed from
423 	 * being re-submitted (e.g. from its completion callback
424 	 * function).
425 	 */
426 	if (urb->kill_count != 0) {
427 		err = -EPERM;
428 		goto done;
429 	}
430 
431 	uhe = urb->endpoint;
432 
433 	/*
434 	 * Check that we have got a FreeBSD USB transfer that will dequeue
435 	 * the URB structure and do the real transfer. If there are no USB
436 	 * transfers, then we return an error.
437 	 */
438 	if (uhe->bsd_xfer[0] ||
439 	    uhe->bsd_xfer[1]) {
440 		/* we are ready! */
441 
442 		TAILQ_INSERT_TAIL(&uhe->bsd_urb_list, urb, bsd_urb_list);
443 
444 		urb->status = -EINPROGRESS;
445 
446 		usbd_transfer_start(uhe->bsd_xfer[0]);
447 		usbd_transfer_start(uhe->bsd_xfer[1]);
448 		err = 0;
449 	} else {
450 		/* no pipes have been setup yet! */
451 		urb->status = -EINVAL;
452 		err = -EINVAL;
453 	}
454 done:
455 	if (do_unlock)
456 		mtx_unlock(&Giant);
457 	return (err);
458 }
459 
460 /*------------------------------------------------------------------------*
461  *	usb_unlink_urb
462  *
463  * This function is used to stop an URB after that it is been
464  * submitted, but before the "complete" callback has been called. On
465  *------------------------------------------------------------------------*/
466 int
467 usb_unlink_urb(struct urb *urb)
468 {
469 	return (usb_unlink_urb_sub(urb, 0));
470 }
471 
472 static void
473 usb_unlink_bsd(struct usb_xfer *xfer,
474     struct urb *urb, uint8_t drain)
475 {
476 	if (xfer == NULL)
477 		return;
478 	if (!usbd_transfer_pending(xfer))
479 		return;
480 	if (xfer->priv_fifo == (void *)urb) {
481 		if (drain) {
482 			mtx_unlock(&Giant);
483 			usbd_transfer_drain(xfer);
484 			mtx_lock(&Giant);
485 		} else {
486 			usbd_transfer_stop(xfer);
487 		}
488 		usbd_transfer_start(xfer);
489 	}
490 }
491 
492 static int
493 usb_unlink_urb_sub(struct urb *urb, uint8_t drain)
494 {
495 	struct usb_host_endpoint *uhe;
496 	uint16_t x;
497 	uint8_t do_unlock;
498 	int err;
499 
500 	if (urb == NULL)
501 		return (-EINVAL);
502 
503 	do_unlock = mtx_owned(&Giant) ? 0 : 1;
504 	if (do_unlock)
505 		mtx_lock(&Giant);
506 	if (drain)
507 		urb->kill_count++;
508 
509 	if (urb->endpoint == NULL) {
510 		err = -EINVAL;
511 		goto done;
512 	}
513 	uhe = urb->endpoint;
514 
515 	if (urb->bsd_urb_list.tqe_prev) {
516 		/* not started yet, just remove it from the queue */
517 		TAILQ_REMOVE(&uhe->bsd_urb_list, urb, bsd_urb_list);
518 		urb->bsd_urb_list.tqe_prev = NULL;
519 		urb->status = -ECONNRESET;
520 		urb->actual_length = 0;
521 
522 		for (x = 0; x < urb->number_of_packets; x++) {
523 			urb->iso_frame_desc[x].actual_length = 0;
524 		}
525 
526 		if (urb->complete) {
527 			(urb->complete) (urb);
528 		}
529 	} else {
530 		/*
531 		 * If the URB is not on the URB list, then check if one of
532 		 * the FreeBSD USB transfer are processing the current URB.
533 		 * If so, re-start that transfer, which will lead to the
534 		 * termination of that URB:
535 		 */
536 		usb_unlink_bsd(uhe->bsd_xfer[0], urb, drain);
537 		usb_unlink_bsd(uhe->bsd_xfer[1], urb, drain);
538 	}
539 	err = 0;
540 done:
541 	if (drain)
542 		urb->kill_count--;
543 	if (do_unlock)
544 		mtx_unlock(&Giant);
545 	return (err);
546 }
547 
548 /*------------------------------------------------------------------------*
549  *	usb_clear_halt
550  *
551  * This function must always be used to clear the stall. Stall is when
552  * an USB endpoint returns a stall message to the USB host controller.
553  * Until the stall is cleared, no data can be transferred.
554  *------------------------------------------------------------------------*/
555 int
556 usb_clear_halt(struct usb_device *dev, struct usb_host_endpoint *uhe)
557 {
558 	struct usb_config cfg[1];
559 	struct usb_endpoint *ep;
560 	uint8_t type;
561 	uint8_t addr;
562 
563 	if (uhe == NULL)
564 		return (-EINVAL);
565 
566 	type = uhe->desc.bmAttributes & UE_XFERTYPE;
567 	addr = uhe->desc.bEndpointAddress;
568 
569 	memset(cfg, 0, sizeof(cfg));
570 
571 	cfg[0].type = type;
572 	cfg[0].endpoint = addr & UE_ADDR;
573 	cfg[0].direction = addr & (UE_DIR_OUT | UE_DIR_IN);
574 
575 	ep = usbd_get_endpoint(dev, uhe->bsd_iface_index, cfg);
576 	if (ep == NULL)
577 		return (-EINVAL);
578 
579 	usbd_clear_data_toggle(dev, ep);
580 
581 	return (usb_control_msg(dev, &dev->ep0,
582 	    UR_CLEAR_FEATURE, UT_WRITE_ENDPOINT,
583 	    UF_ENDPOINT_HALT, addr, NULL, 0, 1000));
584 }
585 
586 /*------------------------------------------------------------------------*
587  *	usb_start_wait_urb
588  *
589  * This is an internal function that is used to perform synchronous
590  * Linux USB transfers.
591  *------------------------------------------------------------------------*/
592 static int
593 usb_start_wait_urb(struct urb *urb, usb_timeout_t timeout, uint16_t *p_actlen)
594 {
595 	int err;
596 	uint8_t do_unlock;
597 
598 	/* you must have a timeout! */
599 	if (timeout == 0) {
600 		timeout = 1;
601 	}
602 	urb->complete = &usb_linux_wait_complete;
603 	urb->timeout = timeout;
604 	urb->transfer_flags |= URB_WAIT_WAKEUP;
605 	urb->transfer_flags &= ~URB_IS_SLEEPING;
606 
607 	do_unlock = mtx_owned(&Giant) ? 0 : 1;
608 	if (do_unlock)
609 		mtx_lock(&Giant);
610 	err = usb_submit_urb(urb, 0);
611 	if (err)
612 		goto done;
613 
614 	/*
615 	 * the URB might have completed before we get here, so check that by
616 	 * using some flags!
617 	 */
618 	while (urb->transfer_flags & URB_WAIT_WAKEUP) {
619 		urb->transfer_flags |= URB_IS_SLEEPING;
620 		cv_wait(&urb->cv_wait, &Giant);
621 		urb->transfer_flags &= ~URB_IS_SLEEPING;
622 	}
623 
624 	err = urb->status;
625 
626 done:
627 	if (do_unlock)
628 		mtx_unlock(&Giant);
629 	if (p_actlen != NULL) {
630 		if (err)
631 			*p_actlen = 0;
632 		else
633 			*p_actlen = urb->actual_length;
634 	}
635 	return (err);
636 }
637 
638 /*------------------------------------------------------------------------*
639  *	usb_control_msg
640  *
641  * The following function performs a control transfer sequence one any
642  * control, bulk or interrupt endpoint, specified by "uhe". A control
643  * transfer means that you transfer an 8-byte header first followed by
644  * a data-phase as indicated by the 8-byte header. The "timeout" is
645  * given in milliseconds.
646  *
647  * Return values:
648  *   0: Success
649  * < 0: Failure
650  * > 0: Actual length
651  *------------------------------------------------------------------------*/
652 int
653 usb_control_msg(struct usb_device *dev, struct usb_host_endpoint *uhe,
654     uint8_t request, uint8_t requesttype,
655     uint16_t value, uint16_t index, void *data,
656     uint16_t size, usb_timeout_t timeout)
657 {
658 	struct usb_device_request req;
659 	struct urb *urb;
660 	int err;
661 	uint16_t actlen;
662 	uint8_t type;
663 	uint8_t addr;
664 
665 	req.bmRequestType = requesttype;
666 	req.bRequest = request;
667 	USETW(req.wValue, value);
668 	USETW(req.wIndex, index);
669 	USETW(req.wLength, size);
670 
671 	if (uhe == NULL) {
672 		return (-EINVAL);
673 	}
674 	type = (uhe->desc.bmAttributes & UE_XFERTYPE);
675 	addr = (uhe->desc.bEndpointAddress & UE_ADDR);
676 
677 	if (type != UE_CONTROL) {
678 		return (-EINVAL);
679 	}
680 	if (addr == 0) {
681 		/*
682 		 * The FreeBSD USB stack supports standard control
683 		 * transfers on control endpoint zero:
684 		 */
685 		err = usbd_do_request_flags(dev,
686 		    NULL, &req, data, USB_SHORT_XFER_OK,
687 		    &actlen, timeout);
688 		if (err) {
689 			err = -EPIPE;
690 		} else {
691 			err = actlen;
692 		}
693 		return (err);
694 	}
695 	if (dev->flags.usb_mode != USB_MODE_HOST) {
696 		/* not supported */
697 		return (-EINVAL);
698 	}
699 	err = usb_setup_endpoint(dev, uhe, 1 /* dummy */ );
700 
701 	/*
702 	 * NOTE: we need to allocate real memory here so that we don't
703 	 * transfer data to/from the stack!
704 	 *
705 	 * 0xFFFF is a FreeBSD specific magic value.
706 	 */
707 	urb = usb_alloc_urb(0xFFFF, size);
708 
709 	urb->dev = dev;
710 	urb->endpoint = uhe;
711 
712 	memcpy(urb->setup_packet, &req, sizeof(req));
713 
714 	if (size && (!(req.bmRequestType & UT_READ))) {
715 		/* move the data to a real buffer */
716 		memcpy(USB_ADD_BYTES(urb->setup_packet, sizeof(req)),
717 		    data, size);
718 	}
719 	err = usb_start_wait_urb(urb, timeout, &actlen);
720 
721 	if (req.bmRequestType & UT_READ) {
722 		if (actlen) {
723 			bcopy(USB_ADD_BYTES(urb->setup_packet,
724 			    sizeof(req)), data, actlen);
725 		}
726 	}
727 	usb_free_urb(urb);
728 
729 	if (err == 0) {
730 		err = actlen;
731 	}
732 	return (err);
733 }
734 
735 /*------------------------------------------------------------------------*
736  *	usb_set_interface
737  *
738  * The following function will select which alternate setting of an
739  * USB interface you plan to use. By default alternate setting with
740  * index zero is selected. Note that "iface_no" is not the interface
741  * index, but rather the value of "bInterfaceNumber".
742  *------------------------------------------------------------------------*/
743 int
744 usb_set_interface(struct usb_device *dev, uint8_t iface_no, uint8_t alt_index)
745 {
746 	struct usb_interface *p_ui = usb_ifnum_to_if(dev, iface_no);
747 	int err;
748 
749 	if (p_ui == NULL)
750 		return (-EINVAL);
751 	if (alt_index >= p_ui->num_altsetting)
752 		return (-EINVAL);
753 	usb_linux_cleanup_interface(dev, p_ui);
754 	err = -usbd_set_alt_interface_index(dev,
755 	    p_ui->bsd_iface_index, alt_index);
756 	if (err == 0) {
757 		p_ui->cur_altsetting = p_ui->altsetting + alt_index;
758 	}
759 	return (err);
760 }
761 
762 /*------------------------------------------------------------------------*
763  *	usb_setup_endpoint
764  *
765  * The following function is an extension to the Linux USB API that
766  * allows you to set a maximum buffer size for a given USB endpoint.
767  * The maximum buffer size is per URB. If you don't call this function
768  * to set a maximum buffer size, the endpoint will not be functional.
769  * Note that for isochronous endpoints the maximum buffer size must be
770  * a non-zero dummy, hence this function will base the maximum buffer
771  * size on "wMaxPacketSize".
772  *------------------------------------------------------------------------*/
773 int
774 usb_setup_endpoint(struct usb_device *dev,
775     struct usb_host_endpoint *uhe, usb_size_t bufsize)
776 {
777 	struct usb_config cfg[2];
778 	uint8_t type = uhe->desc.bmAttributes & UE_XFERTYPE;
779 	uint8_t addr = uhe->desc.bEndpointAddress;
780 
781 	if (uhe->fbsd_buf_size == bufsize) {
782 		/* optimize */
783 		return (0);
784 	}
785 	usbd_transfer_unsetup(uhe->bsd_xfer, 2);
786 
787 	uhe->fbsd_buf_size = bufsize;
788 
789 	if (bufsize == 0) {
790 		return (0);
791 	}
792 	memset(cfg, 0, sizeof(cfg));
793 
794 	if (type == UE_ISOCHRONOUS) {
795 		/*
796 		 * Isochronous transfers are special in that they don't fit
797 		 * into the BULK/INTR/CONTROL transfer model.
798 		 */
799 
800 		cfg[0].type = type;
801 		cfg[0].endpoint = addr & UE_ADDR;
802 		cfg[0].direction = addr & (UE_DIR_OUT | UE_DIR_IN);
803 		cfg[0].callback = &usb_linux_isoc_callback;
804 		cfg[0].bufsize = 0;	/* use wMaxPacketSize */
805 		cfg[0].frames = usb_max_isoc_frames(dev);
806 		cfg[0].flags.proxy_buffer = 1;
807 #if 0
808 		/*
809 		 * The Linux USB API allows non back-to-back
810 		 * isochronous frames which we do not support. If the
811 		 * isochronous frames are not back-to-back we need to
812 		 * do a copy, and then we need a buffer for
813 		 * that. Enable this at your own risk.
814 		 */
815 		cfg[0].flags.ext_buffer = 1;
816 #endif
817 		cfg[0].flags.short_xfer_ok = 1;
818 
819 		bcopy(cfg, cfg + 1, sizeof(*cfg));
820 
821 		/* Allocate and setup two generic FreeBSD USB transfers */
822 
823 		if (usbd_transfer_setup(dev, &uhe->bsd_iface_index,
824 		    uhe->bsd_xfer, cfg, 2, uhe, &Giant)) {
825 			return (-EINVAL);
826 		}
827 	} else {
828 		if (bufsize > (1 << 22)) {
829 			/* limit buffer size */
830 			bufsize = (1 << 22);
831 		}
832 		/* Allocate and setup one generic FreeBSD USB transfer */
833 
834 		cfg[0].type = type;
835 		cfg[0].endpoint = addr & UE_ADDR;
836 		cfg[0].direction = addr & (UE_DIR_OUT | UE_DIR_IN);
837 		cfg[0].callback = &usb_linux_non_isoc_callback;
838 		cfg[0].bufsize = bufsize;
839 		cfg[0].flags.ext_buffer = 1;	/* enable zero-copy */
840 		cfg[0].flags.proxy_buffer = 1;
841 		cfg[0].flags.short_xfer_ok = 1;
842 
843 		if (usbd_transfer_setup(dev, &uhe->bsd_iface_index,
844 		    uhe->bsd_xfer, cfg, 1, uhe, &Giant)) {
845 			return (-EINVAL);
846 		}
847 	}
848 	return (0);
849 }
850 
851 /*------------------------------------------------------------------------*
852  *	usb_linux_create_usb_device
853  *
854  * The following function is used to build up a per USB device
855  * structure tree, that mimics the Linux one. The root structure
856  * is returned by this function.
857  *------------------------------------------------------------------------*/
858 static int
859 usb_linux_create_usb_device(struct usb_device *udev, device_t dev)
860 {
861 	struct usb_config_descriptor *cd = usbd_get_config_descriptor(udev);
862 	struct usb_descriptor *desc;
863 	struct usb_interface_descriptor *id;
864 	struct usb_endpoint_descriptor *ed;
865 	struct usb_interface *p_ui = NULL;
866 	struct usb_host_interface *p_uhi = NULL;
867 	struct usb_host_endpoint *p_uhe = NULL;
868 	usb_size_t size;
869 	uint16_t niface_total;
870 	uint16_t nedesc;
871 	uint16_t iface_no_curr;
872 	uint16_t iface_index;
873 	uint8_t pass;
874 	uint8_t iface_no;
875 
876 	/*
877 	 * We do two passes. One pass for computing necessary memory size
878 	 * and one pass to initialize all the allocated memory structures.
879 	 */
880 	for (pass = 0; pass < 2; pass++) {
881 		iface_no_curr = 0xFFFF;
882 		niface_total = 0;
883 		iface_index = 0;
884 		nedesc = 0;
885 		desc = NULL;
886 
887 		/*
888 		 * Iterate over all the USB descriptors. Use the USB config
889 		 * descriptor pointer provided by the FreeBSD USB stack.
890 		 */
891 		while ((desc = usb_desc_foreach(cd, desc))) {
892 			/*
893 			 * Build up a tree according to the descriptors we
894 			 * find:
895 			 */
896 			switch (desc->bDescriptorType) {
897 			case UDESC_DEVICE:
898 				break;
899 
900 			case UDESC_ENDPOINT:
901 				ed = (void *)desc;
902 				if ((ed->bLength < sizeof(*ed)) ||
903 				    (iface_index == 0))
904 					break;
905 				if (p_uhe) {
906 					bcopy(ed, &p_uhe->desc, sizeof(p_uhe->desc));
907 					p_uhe->bsd_iface_index = iface_index - 1;
908 					TAILQ_INIT(&p_uhe->bsd_urb_list);
909 					p_uhe++;
910 				}
911 				if (p_uhi) {
912 					(p_uhi - 1)->desc.bNumEndpoints++;
913 				}
914 				nedesc++;
915 				break;
916 
917 			case UDESC_INTERFACE:
918 				id = (void *)desc;
919 				if (id->bLength < sizeof(*id))
920 					break;
921 				if (p_uhi) {
922 					bcopy(id, &p_uhi->desc, sizeof(p_uhi->desc));
923 					p_uhi->desc.bNumEndpoints = 0;
924 					p_uhi->endpoint = p_uhe;
925 					p_uhi->string = "";
926 					p_uhi->bsd_iface_index = iface_index;
927 					p_uhi++;
928 				}
929 				iface_no = id->bInterfaceNumber;
930 				niface_total++;
931 				if (iface_no_curr != iface_no) {
932 					if (p_ui) {
933 						p_ui->altsetting = p_uhi - 1;
934 						p_ui->cur_altsetting = p_uhi - 1;
935 						p_ui->bsd_iface_index = iface_index;
936 						p_ui->linux_udev = udev;
937 						p_ui++;
938 					}
939 					iface_no_curr = iface_no;
940 					iface_index++;
941 				}
942 				break;
943 
944 			default:
945 				break;
946 			}
947 		}
948 
949 		if (pass == 0) {
950 			size = (sizeof(*p_uhe) * nedesc) +
951 			    (sizeof(*p_ui) * iface_index) +
952 			    (sizeof(*p_uhi) * niface_total);
953 
954 			p_uhe = malloc(size, M_USBDEV, M_WAITOK | M_ZERO);
955 			p_ui = (void *)(p_uhe + nedesc);
956 			p_uhi = (void *)(p_ui + iface_index);
957 
958 			udev->linux_iface_start = p_ui;
959 			udev->linux_iface_end = p_ui + iface_index;
960 			udev->linux_endpoint_start = p_uhe;
961 			udev->linux_endpoint_end = p_uhe + nedesc;
962 			udev->devnum = device_get_unit(dev);
963 			bcopy(&udev->ddesc, &udev->descriptor,
964 			    sizeof(udev->descriptor));
965 			bcopy(udev->ctrl_ep.edesc, &udev->ep0.desc,
966 			    sizeof(udev->ep0.desc));
967 		}
968 	}
969 	return (0);
970 }
971 
972 /*------------------------------------------------------------------------*
973  *	usb_alloc_urb
974  *
975  * This function should always be used when you allocate an URB for
976  * use with the USB Linux stack. In case of an isochronous transfer
977  * you must specifiy the maximum number of "iso_packets" which you
978  * plan to transfer per URB. This function is always blocking, and
979  * "mem_flags" are not regarded like on Linux.
980  *------------------------------------------------------------------------*/
981 struct urb *
982 usb_alloc_urb(uint16_t iso_packets, uint16_t mem_flags)
983 {
984 	struct urb *urb;
985 	usb_size_t size;
986 
987 	if (iso_packets == 0xFFFF) {
988 		/*
989 		 * FreeBSD specific magic value to ask for control transfer
990 		 * memory allocation:
991 		 */
992 		size = sizeof(*urb) + sizeof(struct usb_device_request) + mem_flags;
993 	} else {
994 		size = sizeof(*urb) + (iso_packets * sizeof(urb->iso_frame_desc[0]));
995 	}
996 
997 	urb = malloc(size, M_USBDEV, M_WAITOK | M_ZERO);
998 
999 	cv_init(&urb->cv_wait, "URBWAIT");
1000 	if (iso_packets == 0xFFFF) {
1001 		urb->setup_packet = (void *)(urb + 1);
1002 		urb->transfer_buffer = (void *)(urb->setup_packet +
1003 		    sizeof(struct usb_device_request));
1004 	} else {
1005 		urb->number_of_packets = iso_packets;
1006 	}
1007 	return (urb);
1008 }
1009 
1010 /*------------------------------------------------------------------------*
1011  *	usb_find_host_endpoint
1012  *
1013  * The following function will return the Linux USB host endpoint
1014  * structure that matches the given endpoint type and endpoint
1015  * value. If no match is found, NULL is returned. This function is not
1016  * part of the Linux USB API and is only used internally.
1017  *------------------------------------------------------------------------*/
1018 struct usb_host_endpoint *
1019 usb_find_host_endpoint(struct usb_device *dev, uint8_t type, uint8_t ep)
1020 {
1021 	struct usb_host_endpoint *uhe;
1022 	struct usb_host_endpoint *uhe_end;
1023 	struct usb_host_interface *uhi;
1024 	struct usb_interface *ui;
1025 	uint8_t ea;
1026 	uint8_t at;
1027 	uint8_t mask;
1028 
1029 	if (dev == NULL) {
1030 		return (NULL);
1031 	}
1032 	if (type == UE_CONTROL) {
1033 		mask = UE_ADDR;
1034 	} else {
1035 		mask = (UE_DIR_IN | UE_DIR_OUT | UE_ADDR);
1036 	}
1037 
1038 	ep &= mask;
1039 
1040 	/*
1041 	 * Iterate over all the interfaces searching the selected alternate
1042 	 * setting only, and all belonging endpoints.
1043 	 */
1044 	for (ui = dev->linux_iface_start;
1045 	    ui != dev->linux_iface_end;
1046 	    ui++) {
1047 		uhi = ui->cur_altsetting;
1048 		if (uhi) {
1049 			uhe_end = uhi->endpoint + uhi->desc.bNumEndpoints;
1050 			for (uhe = uhi->endpoint;
1051 			    uhe != uhe_end;
1052 			    uhe++) {
1053 				ea = uhe->desc.bEndpointAddress;
1054 				at = uhe->desc.bmAttributes;
1055 
1056 				if (((ea & mask) == ep) &&
1057 				    ((at & UE_XFERTYPE) == type)) {
1058 					return (uhe);
1059 				}
1060 			}
1061 		}
1062 	}
1063 
1064 	if ((type == UE_CONTROL) && ((ep & UE_ADDR) == 0)) {
1065 		return (&dev->ep0);
1066 	}
1067 	return (NULL);
1068 }
1069 
1070 /*------------------------------------------------------------------------*
1071  *	usb_altnum_to_altsetting
1072  *
1073  * The following function returns a pointer to an alternate setting by
1074  * index given a "usb_interface" pointer. If the alternate setting by
1075  * index does not exist, NULL is returned. And alternate setting is a
1076  * variant of an interface, but usually with slightly different
1077  * characteristics.
1078  *------------------------------------------------------------------------*/
1079 struct usb_host_interface *
1080 usb_altnum_to_altsetting(const struct usb_interface *intf, uint8_t alt_index)
1081 {
1082 	if (alt_index >= intf->num_altsetting) {
1083 		return (NULL);
1084 	}
1085 	return (intf->altsetting + alt_index);
1086 }
1087 
1088 /*------------------------------------------------------------------------*
1089  *	usb_ifnum_to_if
1090  *
1091  * The following function searches up an USB interface by
1092  * "bInterfaceNumber". If no match is found, NULL is returned.
1093  *------------------------------------------------------------------------*/
1094 struct usb_interface *
1095 usb_ifnum_to_if(struct usb_device *dev, uint8_t iface_no)
1096 {
1097 	struct usb_interface *p_ui;
1098 
1099 	for (p_ui = dev->linux_iface_start;
1100 	    p_ui != dev->linux_iface_end;
1101 	    p_ui++) {
1102 		if ((p_ui->num_altsetting > 0) &&
1103 		    (p_ui->altsetting->desc.bInterfaceNumber == iface_no)) {
1104 			return (p_ui);
1105 		}
1106 	}
1107 	return (NULL);
1108 }
1109 
1110 /*------------------------------------------------------------------------*
1111  *	usb_buffer_alloc
1112  *------------------------------------------------------------------------*/
1113 void   *
1114 usb_buffer_alloc(struct usb_device *dev, usb_size_t size, uint16_t mem_flags, uint8_t *dma_addr)
1115 {
1116 	return (malloc(size, M_USBDEV, M_WAITOK | M_ZERO));
1117 }
1118 
1119 /*------------------------------------------------------------------------*
1120  *	usbd_get_intfdata
1121  *------------------------------------------------------------------------*/
1122 void   *
1123 usbd_get_intfdata(struct usb_interface *intf)
1124 {
1125 	return (intf->bsd_priv_sc);
1126 }
1127 
1128 /*------------------------------------------------------------------------*
1129  *	usb_linux_register
1130  *
1131  * The following function is used by the "USB_DRIVER_EXPORT()" macro,
1132  * and is used to register a Linux USB driver, so that its
1133  * "usb_device_id" structures gets searched a probe time. This
1134  * function is not part of the Linux USB API, and is for internal use
1135  * only.
1136  *------------------------------------------------------------------------*/
1137 void
1138 usb_linux_register(void *arg)
1139 {
1140 	struct usb_driver *drv = arg;
1141 
1142 	mtx_lock(&Giant);
1143 	LIST_INSERT_HEAD(&usb_linux_driver_list, drv, linux_driver_list);
1144 	mtx_unlock(&Giant);
1145 
1146 	usb_needs_explore_all();
1147 }
1148 
1149 /*------------------------------------------------------------------------*
1150  *	usb_linux_deregister
1151  *
1152  * The following function is used by the "USB_DRIVER_EXPORT()" macro,
1153  * and is used to deregister a Linux USB driver. This function will
1154  * ensure that all driver instances belonging to the Linux USB device
1155  * driver in question, gets detached before the driver is
1156  * unloaded. This function is not part of the Linux USB API, and is
1157  * for internal use only.
1158  *------------------------------------------------------------------------*/
1159 void
1160 usb_linux_deregister(void *arg)
1161 {
1162 	struct usb_driver *drv = arg;
1163 	struct usb_linux_softc *sc;
1164 
1165 repeat:
1166 	mtx_lock(&Giant);
1167 	LIST_FOREACH(sc, &usb_linux_attached_list, sc_attached_list) {
1168 		if (sc->sc_udrv == drv) {
1169 			mtx_unlock(&Giant);
1170 			bus_topo_lock();
1171 			device_detach(sc->sc_fbsd_dev);
1172 			bus_topo_unlock();
1173 			goto repeat;
1174 		}
1175 	}
1176 	LIST_REMOVE(drv, linux_driver_list);
1177 	mtx_unlock(&Giant);
1178 }
1179 
1180 /*------------------------------------------------------------------------*
1181  *	usb_linux_free_device
1182  *
1183  * The following function is only used by the FreeBSD USB stack, to
1184  * cleanup and free memory after that a Linux USB device was attached.
1185  *------------------------------------------------------------------------*/
1186 void
1187 usb_linux_free_device(struct usb_device *dev)
1188 {
1189 	struct usb_host_endpoint *uhe;
1190 	struct usb_host_endpoint *uhe_end;
1191 
1192 	uhe = dev->linux_endpoint_start;
1193 	uhe_end = dev->linux_endpoint_end;
1194 	while (uhe != uhe_end) {
1195 		usb_setup_endpoint(dev, uhe, 0);
1196 		uhe++;
1197 	}
1198 	usb_setup_endpoint(dev, &dev->ep0, 0);
1199 	free(dev->linux_endpoint_start, M_USBDEV);
1200 }
1201 
1202 /*------------------------------------------------------------------------*
1203  *	usb_buffer_free
1204  *------------------------------------------------------------------------*/
1205 void
1206 usb_buffer_free(struct usb_device *dev, usb_size_t size,
1207     void *addr, uint8_t dma_addr)
1208 {
1209 	free(addr, M_USBDEV);
1210 }
1211 
1212 /*------------------------------------------------------------------------*
1213  *	usb_free_urb
1214  *------------------------------------------------------------------------*/
1215 void
1216 usb_free_urb(struct urb *urb)
1217 {
1218 	if (urb == NULL) {
1219 		return;
1220 	}
1221 	/* make sure that the current URB is not active */
1222 	usb_kill_urb(urb);
1223 
1224 	/* destroy condition variable */
1225 	cv_destroy(&urb->cv_wait);
1226 
1227 	/* just free it */
1228 	free(urb, M_USBDEV);
1229 }
1230 
1231 /*------------------------------------------------------------------------*
1232  *	usb_init_urb
1233  *
1234  * The following function can be used to initialize a custom URB. It
1235  * is not recommended to use this function. Use "usb_alloc_urb()"
1236  * instead.
1237  *------------------------------------------------------------------------*/
1238 void
1239 usb_init_urb(struct urb *urb)
1240 {
1241 	if (urb == NULL) {
1242 		return;
1243 	}
1244 	memset(urb, 0, sizeof(*urb));
1245 }
1246 
1247 /*------------------------------------------------------------------------*
1248  *	usb_kill_urb
1249  *------------------------------------------------------------------------*/
1250 void
1251 usb_kill_urb(struct urb *urb)
1252 {
1253 	usb_unlink_urb_sub(urb, 1);
1254 }
1255 
1256 /*------------------------------------------------------------------------*
1257  *	usb_set_intfdata
1258  *
1259  * The following function sets the per Linux USB interface private
1260  * data pointer. It is used by most Linux USB device drivers.
1261  *------------------------------------------------------------------------*/
1262 void
1263 usb_set_intfdata(struct usb_interface *intf, void *data)
1264 {
1265 	intf->bsd_priv_sc = data;
1266 }
1267 
1268 /*------------------------------------------------------------------------*
1269  *	usb_linux_cleanup_interface
1270  *
1271  * The following function will release all FreeBSD USB transfers
1272  * associated with a Linux USB interface. It is for internal use only.
1273  *------------------------------------------------------------------------*/
1274 static void
1275 usb_linux_cleanup_interface(struct usb_device *dev, struct usb_interface *iface)
1276 {
1277 	struct usb_host_interface *uhi;
1278 	struct usb_host_interface *uhi_end;
1279 	struct usb_host_endpoint *uhe;
1280 	struct usb_host_endpoint *uhe_end;
1281 
1282 	uhi = iface->altsetting;
1283 	uhi_end = iface->altsetting + iface->num_altsetting;
1284 	while (uhi != uhi_end) {
1285 		uhe = uhi->endpoint;
1286 		uhe_end = uhi->endpoint + uhi->desc.bNumEndpoints;
1287 		while (uhe != uhe_end) {
1288 			usb_setup_endpoint(dev, uhe, 0);
1289 			uhe++;
1290 		}
1291 		uhi++;
1292 	}
1293 }
1294 
1295 /*------------------------------------------------------------------------*
1296  *	usb_linux_wait_complete
1297  *
1298  * The following function is used by "usb_start_wait_urb()" to wake it
1299  * up, when an USB transfer has finished.
1300  *------------------------------------------------------------------------*/
1301 static void
1302 usb_linux_wait_complete(struct urb *urb)
1303 {
1304 	if (urb->transfer_flags & URB_IS_SLEEPING) {
1305 		cv_signal(&urb->cv_wait);
1306 	}
1307 	urb->transfer_flags &= ~URB_WAIT_WAKEUP;
1308 }
1309 
1310 /*------------------------------------------------------------------------*
1311  *	usb_linux_complete
1312  *------------------------------------------------------------------------*/
1313 static void
1314 usb_linux_complete(struct usb_xfer *xfer)
1315 {
1316 	struct urb *urb;
1317 
1318 	urb = usbd_xfer_get_priv(xfer);
1319 	usbd_xfer_set_priv(xfer, NULL);
1320 	if (urb->complete) {
1321 		(urb->complete) (urb);
1322 	}
1323 }
1324 
1325 /*------------------------------------------------------------------------*
1326  *	usb_linux_isoc_callback
1327  *
1328  * The following is the FreeBSD isochronous USB callback. Isochronous
1329  * frames are USB packets transferred 1000 or 8000 times per second,
1330  * depending on whether a full- or high- speed USB transfer is
1331  * used.
1332  *------------------------------------------------------------------------*/
1333 static void
1334 usb_linux_isoc_callback(struct usb_xfer *xfer, usb_error_t error)
1335 {
1336 	usb_frlength_t max_frame = xfer->max_frame_size;
1337 	usb_frlength_t offset;
1338 	usb_frcount_t x;
1339 	struct urb *urb = usbd_xfer_get_priv(xfer);
1340 	struct usb_host_endpoint *uhe = usbd_xfer_softc(xfer);
1341 	struct usb_iso_packet_descriptor *uipd;
1342 
1343 	DPRINTF("\n");
1344 
1345 	switch (USB_GET_STATE(xfer)) {
1346 	case USB_ST_TRANSFERRED:
1347 
1348 		if (urb->bsd_isread) {
1349 			/* copy in data with regard to the URB */
1350 
1351 			offset = 0;
1352 
1353 			for (x = 0; x < urb->number_of_packets; x++) {
1354 				uipd = urb->iso_frame_desc + x;
1355 				if (uipd->length > xfer->frlengths[x]) {
1356 					if (urb->transfer_flags & URB_SHORT_NOT_OK) {
1357 						/* XXX should be EREMOTEIO */
1358 						uipd->status = -EPIPE;
1359 					} else {
1360 						uipd->status = 0;
1361 					}
1362 				} else {
1363 					uipd->status = 0;
1364 				}
1365 				uipd->actual_length = xfer->frlengths[x];
1366 				if (!xfer->flags.ext_buffer) {
1367 					usbd_copy_out(xfer->frbuffers, offset,
1368 					    USB_ADD_BYTES(urb->transfer_buffer,
1369 					    uipd->offset), uipd->actual_length);
1370 				}
1371 				offset += max_frame;
1372 			}
1373 		} else {
1374 			for (x = 0; x < urb->number_of_packets; x++) {
1375 				uipd = urb->iso_frame_desc + x;
1376 				uipd->actual_length = xfer->frlengths[x];
1377 				uipd->status = 0;
1378 			}
1379 		}
1380 
1381 		urb->actual_length = xfer->actlen;
1382 
1383 		/* check for short transfer */
1384 		if (xfer->actlen < xfer->sumlen) {
1385 			/* short transfer */
1386 			if (urb->transfer_flags & URB_SHORT_NOT_OK) {
1387 				/* XXX should be EREMOTEIO */
1388 				urb->status = -EPIPE;
1389 			} else {
1390 				urb->status = 0;
1391 			}
1392 		} else {
1393 			/* success */
1394 			urb->status = 0;
1395 		}
1396 
1397 		/* call callback */
1398 		usb_linux_complete(xfer);
1399 
1400 	case USB_ST_SETUP:
1401 tr_setup:
1402 
1403 		if (xfer->priv_fifo == NULL) {
1404 			/* get next transfer */
1405 			urb = TAILQ_FIRST(&uhe->bsd_urb_list);
1406 			if (urb == NULL) {
1407 				/* nothing to do */
1408 				return;
1409 			}
1410 			TAILQ_REMOVE(&uhe->bsd_urb_list, urb, bsd_urb_list);
1411 			urb->bsd_urb_list.tqe_prev = NULL;
1412 
1413 			x = xfer->max_frame_count;
1414 			if (urb->number_of_packets > x) {
1415 				/* XXX simply truncate the transfer */
1416 				urb->number_of_packets = x;
1417 			}
1418 		} else {
1419 			DPRINTF("Already got a transfer\n");
1420 
1421 			/* already got a transfer (should not happen) */
1422 			urb = usbd_xfer_get_priv(xfer);
1423 		}
1424 
1425 		urb->bsd_isread = (uhe->desc.bEndpointAddress & UE_DIR_IN) ? 1 : 0;
1426 
1427 		if (xfer->flags.ext_buffer) {
1428 			/* set virtual address to load */
1429 			usbd_xfer_set_frame_data(xfer, 0, urb->transfer_buffer, 0);
1430 		}
1431 		if (!(urb->bsd_isread)) {
1432 			/* copy out data with regard to the URB */
1433 
1434 			offset = 0;
1435 
1436 			for (x = 0; x < urb->number_of_packets; x++) {
1437 				uipd = urb->iso_frame_desc + x;
1438 				usbd_xfer_set_frame_len(xfer, x, uipd->length);
1439 				if (!xfer->flags.ext_buffer) {
1440 					usbd_copy_in(xfer->frbuffers, offset,
1441 					    USB_ADD_BYTES(urb->transfer_buffer,
1442 					    uipd->offset), uipd->length);
1443 				}
1444 				offset += uipd->length;
1445 			}
1446 		} else {
1447 			/*
1448 			 * compute the transfer length into the "offset"
1449 			 * variable
1450 			 */
1451 
1452 			offset = urb->number_of_packets * max_frame;
1453 
1454 			/* setup "frlengths" array */
1455 
1456 			for (x = 0; x < urb->number_of_packets; x++) {
1457 				uipd = urb->iso_frame_desc + x;
1458 				usbd_xfer_set_frame_len(xfer, x, max_frame);
1459 			}
1460 		}
1461 		usbd_xfer_set_priv(xfer, urb);
1462 		xfer->flags.force_short_xfer = 0;
1463 		xfer->timeout = urb->timeout;
1464 		xfer->nframes = urb->number_of_packets;
1465 		usbd_transfer_submit(xfer);
1466 		return;
1467 
1468 	default:			/* Error */
1469 		if (xfer->error == USB_ERR_CANCELLED) {
1470 			urb->status = -ECONNRESET;
1471 		} else {
1472 			urb->status = -EPIPE;	/* stalled */
1473 		}
1474 
1475 		/* Set zero for "actual_length" */
1476 		urb->actual_length = 0;
1477 
1478 		/* Set zero for "actual_length" */
1479 		for (x = 0; x < urb->number_of_packets; x++) {
1480 			urb->iso_frame_desc[x].actual_length = 0;
1481 			urb->iso_frame_desc[x].status = urb->status;
1482 		}
1483 
1484 		/* call callback */
1485 		usb_linux_complete(xfer);
1486 
1487 		if (xfer->error == USB_ERR_CANCELLED) {
1488 			/* we need to return in this case */
1489 			return;
1490 		}
1491 		goto tr_setup;
1492 	}
1493 }
1494 
1495 /*------------------------------------------------------------------------*
1496  *	usb_linux_non_isoc_callback
1497  *
1498  * The following is the FreeBSD BULK/INTERRUPT and CONTROL USB
1499  * callback. It dequeues Linux USB stack compatible URB's, transforms
1500  * the URB fields into a FreeBSD USB transfer, and defragments the USB
1501  * transfer as required. When the transfer is complete the "complete"
1502  * callback is called.
1503  *------------------------------------------------------------------------*/
1504 static void
1505 usb_linux_non_isoc_callback(struct usb_xfer *xfer, usb_error_t error)
1506 {
1507 	enum {
1508 		REQ_SIZE = sizeof(struct usb_device_request)
1509 	};
1510 	struct urb *urb = usbd_xfer_get_priv(xfer);
1511 	struct usb_host_endpoint *uhe = usbd_xfer_softc(xfer);
1512 	uint8_t *ptr;
1513 	usb_frlength_t max_bulk = usbd_xfer_max_len(xfer);
1514 	uint8_t data_frame = xfer->flags_int.control_xfr ? 1 : 0;
1515 
1516 	DPRINTF("\n");
1517 
1518 	switch (USB_GET_STATE(xfer)) {
1519 	case USB_ST_TRANSFERRED:
1520 
1521 		if (xfer->flags_int.control_xfr) {
1522 			/* don't transfer the setup packet again: */
1523 
1524 			usbd_xfer_set_frame_len(xfer, 0, 0);
1525 		}
1526 		if (urb->bsd_isread && (!xfer->flags.ext_buffer)) {
1527 			/* copy in data with regard to the URB */
1528 			usbd_copy_out(xfer->frbuffers + data_frame, 0,
1529 			    urb->bsd_data_ptr, xfer->frlengths[data_frame]);
1530 		}
1531 		urb->bsd_length_rem -= xfer->frlengths[data_frame];
1532 		urb->bsd_data_ptr += xfer->frlengths[data_frame];
1533 		urb->actual_length += xfer->frlengths[data_frame];
1534 
1535 		/* check for short transfer */
1536 		if (xfer->actlen < xfer->sumlen) {
1537 			urb->bsd_length_rem = 0;
1538 
1539 			/* short transfer */
1540 			if (urb->transfer_flags & URB_SHORT_NOT_OK) {
1541 				urb->status = -EPIPE;
1542 			} else {
1543 				urb->status = 0;
1544 			}
1545 		} else {
1546 			/* check remainder */
1547 			if (urb->bsd_length_rem > 0) {
1548 				goto setup_bulk;
1549 			}
1550 			/* success */
1551 			urb->status = 0;
1552 		}
1553 
1554 		/* call callback */
1555 		usb_linux_complete(xfer);
1556 
1557 	case USB_ST_SETUP:
1558 tr_setup:
1559 		/* get next transfer */
1560 		urb = TAILQ_FIRST(&uhe->bsd_urb_list);
1561 		if (urb == NULL) {
1562 			/* nothing to do */
1563 			return;
1564 		}
1565 		TAILQ_REMOVE(&uhe->bsd_urb_list, urb, bsd_urb_list);
1566 		urb->bsd_urb_list.tqe_prev = NULL;
1567 
1568 		usbd_xfer_set_priv(xfer, urb);
1569 		xfer->flags.force_short_xfer = 0;
1570 		xfer->timeout = urb->timeout;
1571 
1572 		if (xfer->flags_int.control_xfr) {
1573 			/*
1574 			 * USB control transfers need special handling.
1575 			 * First copy in the header, then copy in data!
1576 			 */
1577 			if (!xfer->flags.ext_buffer) {
1578 				usbd_copy_in(xfer->frbuffers, 0,
1579 				    urb->setup_packet, REQ_SIZE);
1580 				usbd_xfer_set_frame_len(xfer, 0, REQ_SIZE);
1581 			} else {
1582 				/* set virtual address to load */
1583 				usbd_xfer_set_frame_data(xfer, 0,
1584 				    urb->setup_packet, REQ_SIZE);
1585 			}
1586 
1587 			ptr = urb->setup_packet;
1588 
1589 			/* setup data transfer direction and length */
1590 			urb->bsd_isread = (ptr[0] & UT_READ) ? 1 : 0;
1591 			urb->bsd_length_rem = ptr[6] | (ptr[7] << 8);
1592 
1593 		} else {
1594 			/* setup data transfer direction */
1595 
1596 			urb->bsd_length_rem = urb->transfer_buffer_length;
1597 			urb->bsd_isread = (uhe->desc.bEndpointAddress &
1598 			    UE_DIR_IN) ? 1 : 0;
1599 		}
1600 
1601 		urb->bsd_data_ptr = urb->transfer_buffer;
1602 		urb->actual_length = 0;
1603 
1604 setup_bulk:
1605 		if (max_bulk > urb->bsd_length_rem) {
1606 			max_bulk = urb->bsd_length_rem;
1607 		}
1608 		/* check if we need to force a short transfer */
1609 
1610 		if ((max_bulk == urb->bsd_length_rem) &&
1611 		    (urb->transfer_flags & URB_ZERO_PACKET) &&
1612 		    (!xfer->flags_int.control_xfr)) {
1613 			xfer->flags.force_short_xfer = 1;
1614 		}
1615 		/* check if we need to copy in data */
1616 
1617 		if (xfer->flags.ext_buffer) {
1618 			/* set virtual address to load */
1619 			usbd_xfer_set_frame_data(xfer, data_frame,
1620 			    urb->bsd_data_ptr, max_bulk);
1621 		} else if (!urb->bsd_isread) {
1622 			/* copy out data with regard to the URB */
1623 			usbd_copy_in(xfer->frbuffers + data_frame, 0,
1624 			    urb->bsd_data_ptr, max_bulk);
1625 			usbd_xfer_set_frame_len(xfer, data_frame, max_bulk);
1626 		}
1627 		if (xfer->flags_int.control_xfr) {
1628 			if (max_bulk > 0) {
1629 				xfer->nframes = 2;
1630 			} else {
1631 				xfer->nframes = 1;
1632 			}
1633 		} else {
1634 			xfer->nframes = 1;
1635 		}
1636 		usbd_transfer_submit(xfer);
1637 		return;
1638 
1639 	default:
1640 		if (xfer->error == USB_ERR_CANCELLED) {
1641 			urb->status = -ECONNRESET;
1642 		} else {
1643 			urb->status = -EPIPE;
1644 		}
1645 
1646 		/* Set zero for "actual_length" */
1647 		urb->actual_length = 0;
1648 
1649 		/* call callback */
1650 		usb_linux_complete(xfer);
1651 
1652 		if (xfer->error == USB_ERR_CANCELLED) {
1653 			/* we need to return in this case */
1654 			return;
1655 		}
1656 		goto tr_setup;
1657 	}
1658 }
1659 
1660 /*------------------------------------------------------------------------*
1661  *	usb_fill_bulk_urb
1662  *------------------------------------------------------------------------*/
1663 void
1664 usb_fill_bulk_urb(struct urb *urb, struct usb_device *udev,
1665     struct usb_host_endpoint *uhe, void *buf,
1666     int length, usb_complete_t callback, void *arg)
1667 {
1668 	urb->dev = udev;
1669 	urb->endpoint = uhe;
1670 	urb->transfer_buffer = buf;
1671 	urb->transfer_buffer_length = length;
1672 	urb->complete = callback;
1673 	urb->context = arg;
1674 }
1675 
1676 /*------------------------------------------------------------------------*
1677  *	usb_bulk_msg
1678  *
1679  * NOTE: This function can also be used for interrupt endpoints!
1680  *
1681  * Return values:
1682  *    0: Success
1683  * Else: Failure
1684  *------------------------------------------------------------------------*/
1685 int
1686 usb_bulk_msg(struct usb_device *udev, struct usb_host_endpoint *uhe,
1687     void *data, int len, uint16_t *pactlen, usb_timeout_t timeout)
1688 {
1689 	struct urb *urb;
1690 	int err;
1691 
1692 	if (uhe == NULL)
1693 		return (-EINVAL);
1694 	if (len < 0)
1695 		return (-EINVAL);
1696 
1697 	err = usb_setup_endpoint(udev, uhe, 4096 /* bytes */);
1698 	if (err)
1699 		return (err);
1700 
1701 	urb = usb_alloc_urb(0, 0);
1702 
1703 	usb_fill_bulk_urb(urb, udev, uhe, data, len,
1704 	    usb_linux_wait_complete, NULL);
1705 
1706 	err = usb_start_wait_urb(urb, timeout, pactlen);
1707 
1708 	usb_free_urb(urb);
1709 
1710 	return (err);
1711 }
1712 MODULE_DEPEND(linuxkpi, usb, 1, 1, 1);
1713 
1714 static void
1715 usb_linux_init(void *arg)
1716 {
1717 	/* register our function */
1718 	usb_linux_free_device_p = &usb_linux_free_device;
1719 }
1720 SYSINIT(usb_linux_init, SI_SUB_LOCK, SI_ORDER_FIRST, usb_linux_init, NULL);
1721 SYSUNINIT(usb_linux_unload, SI_SUB_LOCK, SI_ORDER_ANY, usb_linux_unload, NULL);
1722