xref: /freebsd/sys/dev/usb/usb_transfer.c (revision a134ebd6e63f658f2d3d04ac0c60d23bcaa86dd7)
1 /* $FreeBSD$ */
2 /*-
3  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4  *
5  * Copyright (c) 2008 Hans Petter Selasky. All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #ifdef USB_GLOBAL_INCLUDE_FILE
30 #include USB_GLOBAL_INCLUDE_FILE
31 #else
32 #include <sys/stdint.h>
33 #include <sys/stddef.h>
34 #include <sys/param.h>
35 #include <sys/queue.h>
36 #include <sys/types.h>
37 #include <sys/systm.h>
38 #include <sys/kernel.h>
39 #include <sys/bus.h>
40 #include <sys/module.h>
41 #include <sys/lock.h>
42 #include <sys/mutex.h>
43 #include <sys/condvar.h>
44 #include <sys/sysctl.h>
45 #include <sys/sx.h>
46 #include <sys/unistd.h>
47 #include <sys/callout.h>
48 #include <sys/malloc.h>
49 #include <sys/priv.h>
50 
51 #include <dev/usb/usb.h>
52 #include <dev/usb/usbdi.h>
53 #include <dev/usb/usbdi_util.h>
54 
55 #define	USB_DEBUG_VAR usb_debug
56 
57 #include <dev/usb/usb_core.h>
58 #include <dev/usb/usb_busdma.h>
59 #include <dev/usb/usb_process.h>
60 #include <dev/usb/usb_transfer.h>
61 #include <dev/usb/usb_device.h>
62 #include <dev/usb/usb_debug.h>
63 #include <dev/usb/usb_util.h>
64 
65 #include <dev/usb/usb_controller.h>
66 #include <dev/usb/usb_bus.h>
67 #include <dev/usb/usb_pf.h>
68 #endif			/* USB_GLOBAL_INCLUDE_FILE */
69 
70 struct usb_std_packet_size {
71 	struct {
72 		uint16_t min;		/* inclusive */
73 		uint16_t max;		/* inclusive */
74 	}	range;
75 
76 	uint16_t fixed[4];
77 };
78 
79 static usb_callback_t usb_request_callback;
80 
81 static const struct usb_config usb_control_ep_cfg[USB_CTRL_XFER_MAX] = {
82 
83 	/* This transfer is used for generic control endpoint transfers */
84 
85 	[0] = {
86 		.type = UE_CONTROL,
87 		.endpoint = 0x00,	/* Control endpoint */
88 		.direction = UE_DIR_ANY,
89 		.bufsize = USB_EP0_BUFSIZE,	/* bytes */
90 		.flags = {.proxy_buffer = 1,},
91 		.callback = &usb_request_callback,
92 		.usb_mode = USB_MODE_DUAL,	/* both modes */
93 	},
94 
95 	/* This transfer is used for generic clear stall only */
96 
97 	[1] = {
98 		.type = UE_CONTROL,
99 		.endpoint = 0x00,	/* Control pipe */
100 		.direction = UE_DIR_ANY,
101 		.bufsize = sizeof(struct usb_device_request),
102 		.callback = &usb_do_clear_stall_callback,
103 		.timeout = 1000,	/* 1 second */
104 		.interval = 50,	/* 50ms */
105 		.usb_mode = USB_MODE_HOST,
106 	},
107 };
108 
109 static const struct usb_config usb_control_ep_quirk_cfg[USB_CTRL_XFER_MAX] = {
110 
111 	/* This transfer is used for generic control endpoint transfers */
112 
113 	[0] = {
114 		.type = UE_CONTROL,
115 		.endpoint = 0x00,	/* Control endpoint */
116 		.direction = UE_DIR_ANY,
117 		.bufsize = 65535,	/* bytes */
118 		.callback = &usb_request_callback,
119 		.usb_mode = USB_MODE_DUAL,	/* both modes */
120 	},
121 
122 	/* This transfer is used for generic clear stall only */
123 
124 	[1] = {
125 		.type = UE_CONTROL,
126 		.endpoint = 0x00,	/* Control pipe */
127 		.direction = UE_DIR_ANY,
128 		.bufsize = sizeof(struct usb_device_request),
129 		.callback = &usb_do_clear_stall_callback,
130 		.timeout = 1000,	/* 1 second */
131 		.interval = 50,	/* 50ms */
132 		.usb_mode = USB_MODE_HOST,
133 	},
134 };
135 
136 /* function prototypes */
137 
138 static void	usbd_update_max_frame_size(struct usb_xfer *);
139 static void	usbd_transfer_unsetup_sub(struct usb_xfer_root *, uint8_t);
140 static void	usbd_control_transfer_init(struct usb_xfer *);
141 static int	usbd_setup_ctrl_transfer(struct usb_xfer *);
142 static void	usb_callback_proc(struct usb_proc_msg *);
143 static void	usbd_callback_ss_done_defer(struct usb_xfer *);
144 static void	usbd_callback_wrapper(struct usb_xfer_queue *);
145 static void	usbd_transfer_start_cb(void *);
146 static uint8_t	usbd_callback_wrapper_sub(struct usb_xfer *);
147 static void	usbd_get_std_packet_size(struct usb_std_packet_size *ptr,
148 		    uint8_t type, enum usb_dev_speed speed);
149 
150 /*------------------------------------------------------------------------*
151  *	usb_request_callback
152  *------------------------------------------------------------------------*/
153 static void
154 usb_request_callback(struct usb_xfer *xfer, usb_error_t error)
155 {
156 	if (xfer->flags_int.usb_mode == USB_MODE_DEVICE)
157 		usb_handle_request_callback(xfer, error);
158 	else
159 		usbd_do_request_callback(xfer, error);
160 }
161 
162 /*------------------------------------------------------------------------*
163  *	usbd_update_max_frame_size
164  *
165  * This function updates the maximum frame size, hence high speed USB
166  * can transfer multiple consecutive packets.
167  *------------------------------------------------------------------------*/
168 static void
169 usbd_update_max_frame_size(struct usb_xfer *xfer)
170 {
171 	/* compute maximum frame size */
172 	/* this computation should not overflow 16-bit */
173 	/* max = 15 * 1024 */
174 
175 	xfer->max_frame_size = xfer->max_packet_size * xfer->max_packet_count;
176 }
177 
178 /*------------------------------------------------------------------------*
179  *	usbd_get_dma_delay
180  *
181  * The following function is called when we need to
182  * synchronize with DMA hardware.
183  *
184  * Returns:
185  *    0: no DMA delay required
186  * Else: milliseconds of DMA delay
187  *------------------------------------------------------------------------*/
188 usb_timeout_t
189 usbd_get_dma_delay(struct usb_device *udev)
190 {
191 	const struct usb_bus_methods *mtod;
192 	uint32_t temp;
193 
194 	mtod = udev->bus->methods;
195 	temp = 0;
196 
197 	if (mtod->get_dma_delay) {
198 		(mtod->get_dma_delay) (udev, &temp);
199 		/*
200 		 * Round up and convert to milliseconds. Note that we use
201 		 * 1024 milliseconds per second. to save a division.
202 		 */
203 		temp += 0x3FF;
204 		temp /= 0x400;
205 	}
206 	return (temp);
207 }
208 
209 /*------------------------------------------------------------------------*
210  *	usbd_transfer_setup_sub_malloc
211  *
212  * This function will allocate one or more DMA'able memory chunks
213  * according to "size", "align" and "count" arguments. "ppc" is
214  * pointed to a linear array of USB page caches afterwards.
215  *
216  * If the "align" argument is equal to "1" a non-contiguous allocation
217  * can happen. Else if the "align" argument is greater than "1", the
218  * allocation will always be contiguous in memory.
219  *
220  * Returns:
221  *    0: Success
222  * Else: Failure
223  *------------------------------------------------------------------------*/
224 #if USB_HAVE_BUSDMA
225 uint8_t
226 usbd_transfer_setup_sub_malloc(struct usb_setup_params *parm,
227     struct usb_page_cache **ppc, usb_size_t size, usb_size_t align,
228     usb_size_t count)
229 {
230 	struct usb_page_cache *pc;
231 	struct usb_page *pg;
232 	void *buf;
233 	usb_size_t n_dma_pc;
234 	usb_size_t n_dma_pg;
235 	usb_size_t n_obj;
236 	usb_size_t x;
237 	usb_size_t y;
238 	usb_size_t r;
239 	usb_size_t z;
240 
241 	USB_ASSERT(align > 0, ("Invalid alignment, 0x%08x\n",
242 	    align));
243 	USB_ASSERT(size > 0, ("Invalid size = 0\n"));
244 
245 	if (count == 0) {
246 		return (0);		/* nothing to allocate */
247 	}
248 	/*
249 	 * Make sure that the size is aligned properly.
250 	 */
251 	size = -((-size) & (-align));
252 
253 	/*
254 	 * Try multi-allocation chunks to reduce the number of DMA
255 	 * allocations, hence DMA allocations are slow.
256 	 */
257 	if (align == 1) {
258 		/* special case - non-cached multi page DMA memory */
259 		n_dma_pc = count;
260 		n_dma_pg = (2 + (size / USB_PAGE_SIZE));
261 		n_obj = 1;
262 	} else if (size >= USB_PAGE_SIZE) {
263 		n_dma_pc = count;
264 		n_dma_pg = 1;
265 		n_obj = 1;
266 	} else {
267 		/* compute number of objects per page */
268 #ifdef USB_DMA_SINGLE_ALLOC
269 		n_obj = 1;
270 #else
271 		n_obj = (USB_PAGE_SIZE / size);
272 #endif
273 		/*
274 		 * Compute number of DMA chunks, rounded up
275 		 * to nearest one:
276 		 */
277 		n_dma_pc = howmany(count, n_obj);
278 		n_dma_pg = 1;
279 	}
280 
281 	/*
282 	 * DMA memory is allocated once, but mapped twice. That's why
283 	 * there is one list for auto-free and another list for
284 	 * non-auto-free which only holds the mapping and not the
285 	 * allocation.
286 	 */
287 	if (parm->buf == NULL) {
288 		/* reserve memory (auto-free) */
289 		parm->dma_page_ptr += n_dma_pc * n_dma_pg;
290 		parm->dma_page_cache_ptr += n_dma_pc;
291 
292 		/* reserve memory (no-auto-free) */
293 		parm->dma_page_ptr += count * n_dma_pg;
294 		parm->xfer_page_cache_ptr += count;
295 		return (0);
296 	}
297 	for (x = 0; x != n_dma_pc; x++) {
298 		/* need to initialize the page cache */
299 		parm->dma_page_cache_ptr[x].tag_parent =
300 		    &parm->curr_xfer->xroot->dma_parent_tag;
301 	}
302 	for (x = 0; x != count; x++) {
303 		/* need to initialize the page cache */
304 		parm->xfer_page_cache_ptr[x].tag_parent =
305 		    &parm->curr_xfer->xroot->dma_parent_tag;
306 	}
307 
308 	if (ppc != NULL) {
309 		if (n_obj != 1)
310 			*ppc = parm->xfer_page_cache_ptr;
311 		else
312 			*ppc = parm->dma_page_cache_ptr;
313 	}
314 	r = count;			/* set remainder count */
315 	z = n_obj * size;		/* set allocation size */
316 	pc = parm->xfer_page_cache_ptr;
317 	pg = parm->dma_page_ptr;
318 
319 	if (n_obj == 1) {
320 	    /*
321 	     * Avoid mapping memory twice if only a single object
322 	     * should be allocated per page cache:
323 	     */
324 	    for (x = 0; x != n_dma_pc; x++) {
325 		if (usb_pc_alloc_mem(parm->dma_page_cache_ptr,
326 		    pg, z, align)) {
327 			return (1);	/* failure */
328 		}
329 		/* Make room for one DMA page cache and "n_dma_pg" pages */
330 		parm->dma_page_cache_ptr++;
331 		pg += n_dma_pg;
332 	    }
333 	} else {
334 	    for (x = 0; x != n_dma_pc; x++) {
335 
336 		if (r < n_obj) {
337 			/* compute last remainder */
338 			z = r * size;
339 			n_obj = r;
340 		}
341 		if (usb_pc_alloc_mem(parm->dma_page_cache_ptr,
342 		    pg, z, align)) {
343 			return (1);	/* failure */
344 		}
345 		/* Set beginning of current buffer */
346 		buf = parm->dma_page_cache_ptr->buffer;
347 		/* Make room for one DMA page cache and "n_dma_pg" pages */
348 		parm->dma_page_cache_ptr++;
349 		pg += n_dma_pg;
350 
351 		for (y = 0; (y != n_obj); y++, r--, pc++, pg += n_dma_pg) {
352 
353 			/* Load sub-chunk into DMA */
354 			if (usb_pc_dmamap_create(pc, size)) {
355 				return (1);	/* failure */
356 			}
357 			pc->buffer = USB_ADD_BYTES(buf, y * size);
358 			pc->page_start = pg;
359 
360 			USB_MTX_LOCK(pc->tag_parent->mtx);
361 			if (usb_pc_load_mem(pc, size, 1 /* synchronous */ )) {
362 				USB_MTX_UNLOCK(pc->tag_parent->mtx);
363 				return (1);	/* failure */
364 			}
365 			USB_MTX_UNLOCK(pc->tag_parent->mtx);
366 		}
367 	    }
368 	}
369 
370 	parm->xfer_page_cache_ptr = pc;
371 	parm->dma_page_ptr = pg;
372 	return (0);
373 }
374 #endif
375 
376 /*------------------------------------------------------------------------*
377  *	usbd_get_max_frame_length
378  *
379  * This function returns the maximum single frame length as computed by
380  * usbd_transfer_setup(). It is useful when computing buffer sizes for
381  * devices having multiple alternate settings. The SuperSpeed endpoint
382  * companion pointer is allowed to be NULL.
383  *------------------------------------------------------------------------*/
384 uint32_t
385 usbd_get_max_frame_length(const struct usb_endpoint_descriptor *edesc,
386     const struct usb_endpoint_ss_comp_descriptor *ecomp,
387     enum usb_dev_speed speed)
388 {
389 	uint32_t max_packet_size;
390 	uint32_t max_packet_count;
391 	uint8_t type;
392 
393 	max_packet_size = UGETW(edesc->wMaxPacketSize);
394 	max_packet_count = 1;
395 	type = (edesc->bmAttributes & UE_XFERTYPE);
396 
397 	switch (speed) {
398 	case USB_SPEED_HIGH:
399 		switch (type) {
400 		case UE_ISOCHRONOUS:
401 		case UE_INTERRUPT:
402 			max_packet_count +=
403 			    (max_packet_size >> 11) & 3;
404 
405 			/* check for invalid max packet count */
406 			if (max_packet_count > 3)
407 				max_packet_count = 3;
408 			break;
409 		default:
410 			break;
411 		}
412 		max_packet_size &= 0x7FF;
413 		break;
414 	case USB_SPEED_SUPER:
415 		max_packet_count += (max_packet_size >> 11) & 3;
416 
417 		if (ecomp != NULL)
418 			max_packet_count += ecomp->bMaxBurst;
419 
420 		if ((max_packet_count == 0) ||
421 		    (max_packet_count > 16))
422 			max_packet_count = 16;
423 
424 		switch (type) {
425 		case UE_CONTROL:
426 			max_packet_count = 1;
427 			break;
428 		case UE_ISOCHRONOUS:
429 			if (ecomp != NULL) {
430 				uint8_t mult;
431 
432 				mult = UE_GET_SS_ISO_MULT(
433 				    ecomp->bmAttributes) + 1;
434 				if (mult > 3)
435 					mult = 3;
436 
437 				max_packet_count *= mult;
438 			}
439 			break;
440 		default:
441 			break;
442 		}
443 		max_packet_size &= 0x7FF;
444 		break;
445 	default:
446 		break;
447 	}
448 	return (max_packet_size * max_packet_count);
449 }
450 
451 /*------------------------------------------------------------------------*
452  *	usbd_transfer_setup_sub - transfer setup subroutine
453  *
454  * This function must be called from the "xfer_setup" callback of the
455  * USB Host or Device controller driver when setting up an USB
456  * transfer. This function will setup correct packet sizes, buffer
457  * sizes, flags and more, that are stored in the "usb_xfer"
458  * structure.
459  *------------------------------------------------------------------------*/
460 void
461 usbd_transfer_setup_sub(struct usb_setup_params *parm)
462 {
463 	enum {
464 		REQ_SIZE = 8,
465 		MIN_PKT = 8,
466 	};
467 	struct usb_xfer *xfer = parm->curr_xfer;
468 	const struct usb_config *setup = parm->curr_setup;
469 	struct usb_endpoint_ss_comp_descriptor *ecomp;
470 	struct usb_endpoint_descriptor *edesc;
471 	struct usb_std_packet_size std_size;
472 	usb_frcount_t n_frlengths;
473 	usb_frcount_t n_frbuffers;
474 	usb_frcount_t x;
475 	uint16_t maxp_old;
476 	uint8_t type;
477 	uint8_t zmps;
478 
479 	/*
480 	 * Sanity check. The following parameters must be initialized before
481 	 * calling this function.
482 	 */
483 	if ((parm->hc_max_packet_size == 0) ||
484 	    (parm->hc_max_packet_count == 0) ||
485 	    (parm->hc_max_frame_size == 0)) {
486 		parm->err = USB_ERR_INVAL;
487 		goto done;
488 	}
489 	edesc = xfer->endpoint->edesc;
490 	ecomp = xfer->endpoint->ecomp;
491 
492 	type = (edesc->bmAttributes & UE_XFERTYPE);
493 
494 	xfer->flags = setup->flags;
495 	xfer->nframes = setup->frames;
496 	xfer->timeout = setup->timeout;
497 	xfer->callback = setup->callback;
498 	xfer->interval = setup->interval;
499 	xfer->endpointno = edesc->bEndpointAddress;
500 	xfer->max_packet_size = UGETW(edesc->wMaxPacketSize);
501 	xfer->max_packet_count = 1;
502 	/* make a shadow copy: */
503 	xfer->flags_int.usb_mode = parm->udev->flags.usb_mode;
504 
505 	parm->bufsize = setup->bufsize;
506 
507 	switch (parm->speed) {
508 	case USB_SPEED_HIGH:
509 		switch (type) {
510 		case UE_ISOCHRONOUS:
511 		case UE_INTERRUPT:
512 			xfer->max_packet_count +=
513 			    (xfer->max_packet_size >> 11) & 3;
514 
515 			/* check for invalid max packet count */
516 			if (xfer->max_packet_count > 3)
517 				xfer->max_packet_count = 3;
518 			break;
519 		default:
520 			break;
521 		}
522 		xfer->max_packet_size &= 0x7FF;
523 		break;
524 	case USB_SPEED_SUPER:
525 		xfer->max_packet_count += (xfer->max_packet_size >> 11) & 3;
526 
527 		if (ecomp != NULL)
528 			xfer->max_packet_count += ecomp->bMaxBurst;
529 
530 		if ((xfer->max_packet_count == 0) ||
531 		    (xfer->max_packet_count > 16))
532 			xfer->max_packet_count = 16;
533 
534 		switch (type) {
535 		case UE_CONTROL:
536 			xfer->max_packet_count = 1;
537 			break;
538 		case UE_ISOCHRONOUS:
539 			if (ecomp != NULL) {
540 				uint8_t mult;
541 
542 				mult = UE_GET_SS_ISO_MULT(
543 				    ecomp->bmAttributes) + 1;
544 				if (mult > 3)
545 					mult = 3;
546 
547 				xfer->max_packet_count *= mult;
548 			}
549 			break;
550 		default:
551 			break;
552 		}
553 		xfer->max_packet_size &= 0x7FF;
554 		break;
555 	default:
556 		break;
557 	}
558 	/* range check "max_packet_count" */
559 
560 	if (xfer->max_packet_count > parm->hc_max_packet_count) {
561 		xfer->max_packet_count = parm->hc_max_packet_count;
562 	}
563 
564 	/* store max packet size value before filtering */
565 
566 	maxp_old = xfer->max_packet_size;
567 
568 	/* filter "wMaxPacketSize" according to HC capabilities */
569 
570 	if ((xfer->max_packet_size > parm->hc_max_packet_size) ||
571 	    (xfer->max_packet_size == 0)) {
572 		xfer->max_packet_size = parm->hc_max_packet_size;
573 	}
574 	/* filter "wMaxPacketSize" according to standard sizes */
575 
576 	usbd_get_std_packet_size(&std_size, type, parm->speed);
577 
578 	if (std_size.range.min || std_size.range.max) {
579 
580 		if (xfer->max_packet_size < std_size.range.min) {
581 			xfer->max_packet_size = std_size.range.min;
582 		}
583 		if (xfer->max_packet_size > std_size.range.max) {
584 			xfer->max_packet_size = std_size.range.max;
585 		}
586 	} else {
587 
588 		if (xfer->max_packet_size >= std_size.fixed[3]) {
589 			xfer->max_packet_size = std_size.fixed[3];
590 		} else if (xfer->max_packet_size >= std_size.fixed[2]) {
591 			xfer->max_packet_size = std_size.fixed[2];
592 		} else if (xfer->max_packet_size >= std_size.fixed[1]) {
593 			xfer->max_packet_size = std_size.fixed[1];
594 		} else {
595 			/* only one possibility left */
596 			xfer->max_packet_size = std_size.fixed[0];
597 		}
598 	}
599 
600 	/*
601 	 * Check if the max packet size was outside its allowed range
602 	 * and clamped to a valid value:
603 	 */
604 	if (maxp_old != xfer->max_packet_size)
605 		xfer->flags_int.maxp_was_clamped = 1;
606 
607 	/* compute "max_frame_size" */
608 
609 	usbd_update_max_frame_size(xfer);
610 
611 	/* check interrupt interval and transfer pre-delay */
612 
613 	if (type == UE_ISOCHRONOUS) {
614 
615 		uint16_t frame_limit;
616 
617 		xfer->interval = 0;	/* not used, must be zero */
618 		xfer->flags_int.isochronous_xfr = 1;	/* set flag */
619 
620 		if (xfer->timeout == 0) {
621 			/*
622 			 * set a default timeout in
623 			 * case something goes wrong!
624 			 */
625 			xfer->timeout = 1000 / 4;
626 		}
627 		switch (parm->speed) {
628 		case USB_SPEED_LOW:
629 		case USB_SPEED_FULL:
630 			frame_limit = USB_MAX_FS_ISOC_FRAMES_PER_XFER;
631 			xfer->fps_shift = 0;
632 			break;
633 		default:
634 			frame_limit = USB_MAX_HS_ISOC_FRAMES_PER_XFER;
635 			xfer->fps_shift = edesc->bInterval;
636 			if (xfer->fps_shift > 0)
637 				xfer->fps_shift--;
638 			if (xfer->fps_shift > 3)
639 				xfer->fps_shift = 3;
640 			if (xfer->flags.pre_scale_frames != 0)
641 				xfer->nframes <<= (3 - xfer->fps_shift);
642 			break;
643 		}
644 
645 		if (xfer->nframes > frame_limit) {
646 			/*
647 			 * this is not going to work
648 			 * cross hardware
649 			 */
650 			parm->err = USB_ERR_INVAL;
651 			goto done;
652 		}
653 		if (xfer->nframes == 0) {
654 			/*
655 			 * this is not a valid value
656 			 */
657 			parm->err = USB_ERR_ZERO_NFRAMES;
658 			goto done;
659 		}
660 	} else {
661 
662 		/*
663 		 * If a value is specified use that else check the
664 		 * endpoint descriptor!
665 		 */
666 		if (type == UE_INTERRUPT) {
667 
668 			uint32_t temp;
669 
670 			if (xfer->interval == 0) {
671 
672 				xfer->interval = edesc->bInterval;
673 
674 				switch (parm->speed) {
675 				case USB_SPEED_LOW:
676 				case USB_SPEED_FULL:
677 					break;
678 				default:
679 					/* 125us -> 1ms */
680 					if (xfer->interval < 4)
681 						xfer->interval = 1;
682 					else if (xfer->interval > 16)
683 						xfer->interval = (1 << (16 - 4));
684 					else
685 						xfer->interval =
686 						    (1 << (xfer->interval - 4));
687 					break;
688 				}
689 			}
690 
691 			if (xfer->interval == 0) {
692 				/*
693 				 * One millisecond is the smallest
694 				 * interval we support:
695 				 */
696 				xfer->interval = 1;
697 			}
698 
699 			xfer->fps_shift = 0;
700 			temp = 1;
701 
702 			while ((temp != 0) && (temp < xfer->interval)) {
703 				xfer->fps_shift++;
704 				temp *= 2;
705 			}
706 
707 			switch (parm->speed) {
708 			case USB_SPEED_LOW:
709 			case USB_SPEED_FULL:
710 				break;
711 			default:
712 				xfer->fps_shift += 3;
713 				break;
714 			}
715 		}
716 	}
717 
718 	/*
719 	 * NOTE: we do not allow "max_packet_size" or "max_frame_size"
720 	 * to be equal to zero when setting up USB transfers, hence
721 	 * this leads to a lot of extra code in the USB kernel.
722 	 */
723 
724 	if ((xfer->max_frame_size == 0) ||
725 	    (xfer->max_packet_size == 0)) {
726 
727 		zmps = 1;
728 
729 		if ((parm->bufsize <= MIN_PKT) &&
730 		    (type != UE_CONTROL) &&
731 		    (type != UE_BULK)) {
732 
733 			/* workaround */
734 			xfer->max_packet_size = MIN_PKT;
735 			xfer->max_packet_count = 1;
736 			parm->bufsize = 0;	/* automatic setup length */
737 			usbd_update_max_frame_size(xfer);
738 
739 		} else {
740 			parm->err = USB_ERR_ZERO_MAXP;
741 			goto done;
742 		}
743 
744 	} else {
745 		zmps = 0;
746 	}
747 
748 	/*
749 	 * check if we should setup a default
750 	 * length:
751 	 */
752 
753 	if (parm->bufsize == 0) {
754 
755 		parm->bufsize = xfer->max_frame_size;
756 
757 		if (type == UE_ISOCHRONOUS) {
758 			parm->bufsize *= xfer->nframes;
759 		}
760 	}
761 	/*
762 	 * check if we are about to setup a proxy
763 	 * type of buffer:
764 	 */
765 
766 	if (xfer->flags.proxy_buffer) {
767 
768 		/* round bufsize up */
769 
770 		parm->bufsize += (xfer->max_frame_size - 1);
771 
772 		if (parm->bufsize < xfer->max_frame_size) {
773 			/* length wrapped around */
774 			parm->err = USB_ERR_INVAL;
775 			goto done;
776 		}
777 		/* subtract remainder */
778 
779 		parm->bufsize -= (parm->bufsize % xfer->max_frame_size);
780 
781 		/* add length of USB device request structure, if any */
782 
783 		if (type == UE_CONTROL) {
784 			parm->bufsize += REQ_SIZE;	/* SETUP message */
785 		}
786 	}
787 	xfer->max_data_length = parm->bufsize;
788 
789 	/* Setup "n_frlengths" and "n_frbuffers" */
790 
791 	if (type == UE_ISOCHRONOUS) {
792 		n_frlengths = xfer->nframes;
793 		n_frbuffers = 1;
794 	} else {
795 
796 		if (type == UE_CONTROL) {
797 			xfer->flags_int.control_xfr = 1;
798 			if (xfer->nframes == 0) {
799 				if (parm->bufsize <= REQ_SIZE) {
800 					/*
801 					 * there will never be any data
802 					 * stage
803 					 */
804 					xfer->nframes = 1;
805 				} else {
806 					xfer->nframes = 2;
807 				}
808 			}
809 		} else {
810 			if (xfer->nframes == 0) {
811 				xfer->nframes = 1;
812 			}
813 		}
814 
815 		n_frlengths = xfer->nframes;
816 		n_frbuffers = xfer->nframes;
817 	}
818 
819 	/*
820 	 * check if we have room for the
821 	 * USB device request structure:
822 	 */
823 
824 	if (type == UE_CONTROL) {
825 
826 		if (xfer->max_data_length < REQ_SIZE) {
827 			/* length wrapped around or too small bufsize */
828 			parm->err = USB_ERR_INVAL;
829 			goto done;
830 		}
831 		xfer->max_data_length -= REQ_SIZE;
832 	}
833 	/*
834 	 * Setup "frlengths" and shadow "frlengths" for keeping the
835 	 * initial frame lengths when a USB transfer is complete. This
836 	 * information is useful when computing isochronous offsets.
837 	 */
838 	xfer->frlengths = parm->xfer_length_ptr;
839 	parm->xfer_length_ptr += 2 * n_frlengths;
840 
841 	/* setup "frbuffers" */
842 	xfer->frbuffers = parm->xfer_page_cache_ptr;
843 	parm->xfer_page_cache_ptr += n_frbuffers;
844 
845 	/* initialize max frame count */
846 	xfer->max_frame_count = xfer->nframes;
847 
848 	/*
849 	 * check if we need to setup
850 	 * a local buffer:
851 	 */
852 
853 	if (!xfer->flags.ext_buffer) {
854 #if USB_HAVE_BUSDMA
855 		struct usb_page_search page_info;
856 		struct usb_page_cache *pc;
857 
858 		if (usbd_transfer_setup_sub_malloc(parm,
859 		    &pc, parm->bufsize, 1, 1)) {
860 			parm->err = USB_ERR_NOMEM;
861 		} else if (parm->buf != NULL) {
862 
863 			usbd_get_page(pc, 0, &page_info);
864 
865 			xfer->local_buffer = page_info.buffer;
866 
867 			usbd_xfer_set_frame_offset(xfer, 0, 0);
868 
869 			if ((type == UE_CONTROL) && (n_frbuffers > 1)) {
870 				usbd_xfer_set_frame_offset(xfer, REQ_SIZE, 1);
871 			}
872 		}
873 #else
874 		/* align data */
875 		parm->size[0] += ((-parm->size[0]) & (USB_HOST_ALIGN - 1));
876 
877 		if (parm->buf != NULL) {
878 			xfer->local_buffer =
879 			    USB_ADD_BYTES(parm->buf, parm->size[0]);
880 
881 			usbd_xfer_set_frame_offset(xfer, 0, 0);
882 
883 			if ((type == UE_CONTROL) && (n_frbuffers > 1)) {
884 				usbd_xfer_set_frame_offset(xfer, REQ_SIZE, 1);
885 			}
886 		}
887 		parm->size[0] += parm->bufsize;
888 
889 		/* align data again */
890 		parm->size[0] += ((-parm->size[0]) & (USB_HOST_ALIGN - 1));
891 #endif
892 	}
893 	/*
894 	 * Compute maximum buffer size
895 	 */
896 
897 	if (parm->bufsize_max < parm->bufsize) {
898 		parm->bufsize_max = parm->bufsize;
899 	}
900 #if USB_HAVE_BUSDMA
901 	if (xfer->flags_int.bdma_enable) {
902 		/*
903 		 * Setup "dma_page_ptr".
904 		 *
905 		 * Proof for formula below:
906 		 *
907 		 * Assume there are three USB frames having length "a", "b" and
908 		 * "c". These USB frames will at maximum need "z"
909 		 * "usb_page" structures. "z" is given by:
910 		 *
911 		 * z = ((a / USB_PAGE_SIZE) + 2) + ((b / USB_PAGE_SIZE) + 2) +
912 		 * ((c / USB_PAGE_SIZE) + 2);
913 		 *
914 		 * Constraining "a", "b" and "c" like this:
915 		 *
916 		 * (a + b + c) <= parm->bufsize
917 		 *
918 		 * We know that:
919 		 *
920 		 * z <= ((parm->bufsize / USB_PAGE_SIZE) + (3*2));
921 		 *
922 		 * Here is the general formula:
923 		 */
924 		xfer->dma_page_ptr = parm->dma_page_ptr;
925 		parm->dma_page_ptr += (2 * n_frbuffers);
926 		parm->dma_page_ptr += (parm->bufsize / USB_PAGE_SIZE);
927 	}
928 #endif
929 	if (zmps) {
930 		/* correct maximum data length */
931 		xfer->max_data_length = 0;
932 	}
933 	/* subtract USB frame remainder from "hc_max_frame_size" */
934 
935 	xfer->max_hc_frame_size =
936 	    (parm->hc_max_frame_size -
937 	    (parm->hc_max_frame_size % xfer->max_frame_size));
938 
939 	if (xfer->max_hc_frame_size == 0) {
940 		parm->err = USB_ERR_INVAL;
941 		goto done;
942 	}
943 
944 	/* initialize frame buffers */
945 
946 	if (parm->buf) {
947 		for (x = 0; x != n_frbuffers; x++) {
948 			xfer->frbuffers[x].tag_parent =
949 			    &xfer->xroot->dma_parent_tag;
950 #if USB_HAVE_BUSDMA
951 			if (xfer->flags_int.bdma_enable &&
952 			    (parm->bufsize_max > 0)) {
953 
954 				if (usb_pc_dmamap_create(
955 				    xfer->frbuffers + x,
956 				    parm->bufsize_max)) {
957 					parm->err = USB_ERR_NOMEM;
958 					goto done;
959 				}
960 			}
961 #endif
962 		}
963 	}
964 done:
965 	if (parm->err) {
966 		/*
967 		 * Set some dummy values so that we avoid division by zero:
968 		 */
969 		xfer->max_hc_frame_size = 1;
970 		xfer->max_frame_size = 1;
971 		xfer->max_packet_size = 1;
972 		xfer->max_data_length = 0;
973 		xfer->nframes = 0;
974 		xfer->max_frame_count = 0;
975 	}
976 }
977 
978 static uint8_t
979 usbd_transfer_setup_has_bulk(const struct usb_config *setup_start,
980     uint16_t n_setup)
981 {
982 	while (n_setup--) {
983 		uint8_t type = setup_start[n_setup].type;
984 		if (type == UE_BULK || type == UE_BULK_INTR ||
985 		    type == UE_TYPE_ANY)
986 			return (1);
987 	}
988 	return (0);
989 }
990 
991 /*------------------------------------------------------------------------*
992  *	usbd_transfer_setup - setup an array of USB transfers
993  *
994  * NOTE: You must always call "usbd_transfer_unsetup" after calling
995  * "usbd_transfer_setup" if success was returned.
996  *
997  * The idea is that the USB device driver should pre-allocate all its
998  * transfers by one call to this function.
999  *
1000  * Return values:
1001  *    0: Success
1002  * Else: Failure
1003  *------------------------------------------------------------------------*/
1004 usb_error_t
1005 usbd_transfer_setup(struct usb_device *udev,
1006     const uint8_t *ifaces, struct usb_xfer **ppxfer,
1007     const struct usb_config *setup_start, uint16_t n_setup,
1008     void *priv_sc, struct mtx *xfer_mtx)
1009 {
1010 	const struct usb_config *setup_end = setup_start + n_setup;
1011 	const struct usb_config *setup;
1012 	struct usb_setup_params *parm;
1013 	struct usb_endpoint *ep;
1014 	struct usb_xfer_root *info;
1015 	struct usb_xfer *xfer;
1016 	void *buf = NULL;
1017 	usb_error_t error = 0;
1018 	uint16_t n;
1019 	uint16_t refcount;
1020 	uint8_t do_unlock;
1021 
1022 	WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
1023 	    "usbd_transfer_setup can sleep!");
1024 
1025 	/* do some checking first */
1026 
1027 	if (n_setup == 0) {
1028 		DPRINTFN(6, "setup array has zero length!\n");
1029 		return (USB_ERR_INVAL);
1030 	}
1031 	if (ifaces == NULL) {
1032 		DPRINTFN(6, "ifaces array is NULL!\n");
1033 		return (USB_ERR_INVAL);
1034 	}
1035 	if (xfer_mtx == NULL) {
1036 		DPRINTFN(6, "using global lock\n");
1037 		xfer_mtx = &Giant;
1038 	}
1039 
1040 	/* more sanity checks */
1041 
1042 	for (setup = setup_start, n = 0;
1043 	    setup != setup_end; setup++, n++) {
1044 		if (setup->bufsize == (usb_frlength_t)-1) {
1045 			error = USB_ERR_BAD_BUFSIZE;
1046 			DPRINTF("invalid bufsize\n");
1047 		}
1048 		if (setup->callback == NULL) {
1049 			error = USB_ERR_NO_CALLBACK;
1050 			DPRINTF("no callback\n");
1051 		}
1052 		ppxfer[n] = NULL;
1053 	}
1054 
1055 	if (error)
1056 		return (error);
1057 
1058 	/* Protect scratch area */
1059 	do_unlock = usbd_ctrl_lock(udev);
1060 
1061 	refcount = 0;
1062 	info = NULL;
1063 
1064 	parm = &udev->scratch.xfer_setup[0].parm;
1065 	memset(parm, 0, sizeof(*parm));
1066 
1067 	parm->udev = udev;
1068 	parm->speed = usbd_get_speed(udev);
1069 	parm->hc_max_packet_count = 1;
1070 
1071 	if (parm->speed >= USB_SPEED_MAX) {
1072 		parm->err = USB_ERR_INVAL;
1073 		goto done;
1074 	}
1075 	/* setup all transfers */
1076 
1077 	while (1) {
1078 
1079 		if (buf) {
1080 			/*
1081 			 * Initialize the "usb_xfer_root" structure,
1082 			 * which is common for all our USB transfers.
1083 			 */
1084 			info = USB_ADD_BYTES(buf, 0);
1085 
1086 			info->memory_base = buf;
1087 			info->memory_size = parm->size[0];
1088 
1089 #if USB_HAVE_BUSDMA
1090 			info->dma_page_cache_start = USB_ADD_BYTES(buf, parm->size[4]);
1091 			info->dma_page_cache_end = USB_ADD_BYTES(buf, parm->size[5]);
1092 #endif
1093 			info->xfer_page_cache_start = USB_ADD_BYTES(buf, parm->size[5]);
1094 			info->xfer_page_cache_end = USB_ADD_BYTES(buf, parm->size[2]);
1095 
1096 			cv_init(&info->cv_drain, "WDRAIN");
1097 
1098 			info->xfer_mtx = xfer_mtx;
1099 #if USB_HAVE_BUSDMA
1100 			usb_dma_tag_setup(&info->dma_parent_tag,
1101 			    parm->dma_tag_p, udev->bus->dma_parent_tag[0].tag,
1102 			    xfer_mtx, &usb_bdma_done_event, udev->bus->dma_bits,
1103 			    parm->dma_tag_max);
1104 #endif
1105 
1106 			info->bus = udev->bus;
1107 			info->udev = udev;
1108 
1109 			TAILQ_INIT(&info->done_q.head);
1110 			info->done_q.command = &usbd_callback_wrapper;
1111 #if USB_HAVE_BUSDMA
1112 			TAILQ_INIT(&info->dma_q.head);
1113 			info->dma_q.command = &usb_bdma_work_loop;
1114 #endif
1115 			info->done_m[0].hdr.pm_callback = &usb_callback_proc;
1116 			info->done_m[0].xroot = info;
1117 			info->done_m[1].hdr.pm_callback = &usb_callback_proc;
1118 			info->done_m[1].xroot = info;
1119 
1120 			/*
1121 			 * In device side mode control endpoint
1122 			 * requests need to run from a separate
1123 			 * context, else there is a chance of
1124 			 * deadlock!
1125 			 */
1126 			if (setup_start == usb_control_ep_cfg ||
1127 			    setup_start == usb_control_ep_quirk_cfg)
1128 				info->done_p =
1129 				    USB_BUS_CONTROL_XFER_PROC(udev->bus);
1130 			else if (xfer_mtx == &Giant)
1131 				info->done_p =
1132 				    USB_BUS_GIANT_PROC(udev->bus);
1133 			else if (usbd_transfer_setup_has_bulk(setup_start, n_setup))
1134 				info->done_p =
1135 				    USB_BUS_NON_GIANT_BULK_PROC(udev->bus);
1136 			else
1137 				info->done_p =
1138 				    USB_BUS_NON_GIANT_ISOC_PROC(udev->bus);
1139 		}
1140 		/* reset sizes */
1141 
1142 		parm->size[0] = 0;
1143 		parm->buf = buf;
1144 		parm->size[0] += sizeof(info[0]);
1145 
1146 		for (setup = setup_start, n = 0;
1147 		    setup != setup_end; setup++, n++) {
1148 
1149 			/* skip USB transfers without callbacks: */
1150 			if (setup->callback == NULL) {
1151 				continue;
1152 			}
1153 			/* see if there is a matching endpoint */
1154 			ep = usbd_get_endpoint(udev,
1155 			    ifaces[setup->if_index], setup);
1156 
1157 			/*
1158 			 * Check that the USB PIPE is valid and that
1159 			 * the endpoint mode is proper.
1160 			 *
1161 			 * Make sure we don't allocate a streams
1162 			 * transfer when such a combination is not
1163 			 * valid.
1164 			 */
1165 			if ((ep == NULL) || (ep->methods == NULL) ||
1166 			    ((ep->ep_mode != USB_EP_MODE_STREAMS) &&
1167 			    (ep->ep_mode != USB_EP_MODE_DEFAULT)) ||
1168 			    (setup->stream_id != 0 &&
1169 			    (setup->stream_id >= USB_MAX_EP_STREAMS ||
1170 			    (ep->ep_mode != USB_EP_MODE_STREAMS)))) {
1171 				if (setup->flags.no_pipe_ok)
1172 					continue;
1173 				if ((setup->usb_mode != USB_MODE_DUAL) &&
1174 				    (setup->usb_mode != udev->flags.usb_mode))
1175 					continue;
1176 				parm->err = USB_ERR_NO_PIPE;
1177 				goto done;
1178 			}
1179 
1180 			/* align data properly */
1181 			parm->size[0] += ((-parm->size[0]) & (USB_HOST_ALIGN - 1));
1182 
1183 			/* store current setup pointer */
1184 			parm->curr_setup = setup;
1185 
1186 			if (buf) {
1187 				/*
1188 				 * Common initialization of the
1189 				 * "usb_xfer" structure.
1190 				 */
1191 				xfer = USB_ADD_BYTES(buf, parm->size[0]);
1192 				xfer->address = udev->address;
1193 				xfer->priv_sc = priv_sc;
1194 				xfer->xroot = info;
1195 
1196 				usb_callout_init_mtx(&xfer->timeout_handle,
1197 				    &udev->bus->bus_mtx, 0);
1198 			} else {
1199 				/*
1200 				 * Setup a dummy xfer, hence we are
1201 				 * writing to the "usb_xfer"
1202 				 * structure pointed to by "xfer"
1203 				 * before we have allocated any
1204 				 * memory:
1205 				 */
1206 				xfer = &udev->scratch.xfer_setup[0].dummy;
1207 				memset(xfer, 0, sizeof(*xfer));
1208 				refcount++;
1209 			}
1210 
1211 			/* set transfer endpoint pointer */
1212 			xfer->endpoint = ep;
1213 
1214 			/* set transfer stream ID */
1215 			xfer->stream_id = setup->stream_id;
1216 
1217 			parm->size[0] += sizeof(xfer[0]);
1218 			parm->methods = xfer->endpoint->methods;
1219 			parm->curr_xfer = xfer;
1220 
1221 			/*
1222 			 * Call the Host or Device controller transfer
1223 			 * setup routine:
1224 			 */
1225 			(udev->bus->methods->xfer_setup) (parm);
1226 
1227 			/* check for error */
1228 			if (parm->err)
1229 				goto done;
1230 
1231 			if (buf) {
1232 				/*
1233 				 * Increment the endpoint refcount. This
1234 				 * basically prevents setting a new
1235 				 * configuration and alternate setting
1236 				 * when USB transfers are in use on
1237 				 * the given interface. Search the USB
1238 				 * code for "endpoint->refcount_alloc" if you
1239 				 * want more information.
1240 				 */
1241 				USB_BUS_LOCK(info->bus);
1242 				if (xfer->endpoint->refcount_alloc >= USB_EP_REF_MAX)
1243 					parm->err = USB_ERR_INVAL;
1244 
1245 				xfer->endpoint->refcount_alloc++;
1246 
1247 				if (xfer->endpoint->refcount_alloc == 0)
1248 					panic("usbd_transfer_setup(): Refcount wrapped to zero\n");
1249 				USB_BUS_UNLOCK(info->bus);
1250 
1251 				/*
1252 				 * Whenever we set ppxfer[] then we
1253 				 * also need to increment the
1254 				 * "setup_refcount":
1255 				 */
1256 				info->setup_refcount++;
1257 
1258 				/*
1259 				 * Transfer is successfully setup and
1260 				 * can be used:
1261 				 */
1262 				ppxfer[n] = xfer;
1263 			}
1264 
1265 			/* check for error */
1266 			if (parm->err)
1267 				goto done;
1268 		}
1269 
1270 		if (buf != NULL || parm->err != 0)
1271 			goto done;
1272 
1273 		/* if no transfers, nothing to do */
1274 		if (refcount == 0)
1275 			goto done;
1276 
1277 		/* align data properly */
1278 		parm->size[0] += ((-parm->size[0]) & (USB_HOST_ALIGN - 1));
1279 
1280 		/* store offset temporarily */
1281 		parm->size[1] = parm->size[0];
1282 
1283 		/*
1284 		 * The number of DMA tags required depends on
1285 		 * the number of endpoints. The current estimate
1286 		 * for maximum number of DMA tags per endpoint
1287 		 * is three:
1288 		 * 1) for loading memory
1289 		 * 2) for allocating memory
1290 		 * 3) for fixing memory [UHCI]
1291 		 */
1292 		parm->dma_tag_max += 3 * MIN(n_setup, USB_EP_MAX);
1293 
1294 		/*
1295 		 * DMA tags for QH, TD, Data and more.
1296 		 */
1297 		parm->dma_tag_max += 8;
1298 
1299 		parm->dma_tag_p += parm->dma_tag_max;
1300 
1301 		parm->size[0] += ((uint8_t *)parm->dma_tag_p) -
1302 		    ((uint8_t *)0);
1303 
1304 		/* align data properly */
1305 		parm->size[0] += ((-parm->size[0]) & (USB_HOST_ALIGN - 1));
1306 
1307 		/* store offset temporarily */
1308 		parm->size[3] = parm->size[0];
1309 
1310 		parm->size[0] += ((uint8_t *)parm->dma_page_ptr) -
1311 		    ((uint8_t *)0);
1312 
1313 		/* align data properly */
1314 		parm->size[0] += ((-parm->size[0]) & (USB_HOST_ALIGN - 1));
1315 
1316 		/* store offset temporarily */
1317 		parm->size[4] = parm->size[0];
1318 
1319 		parm->size[0] += ((uint8_t *)parm->dma_page_cache_ptr) -
1320 		    ((uint8_t *)0);
1321 
1322 		/* store end offset temporarily */
1323 		parm->size[5] = parm->size[0];
1324 
1325 		parm->size[0] += ((uint8_t *)parm->xfer_page_cache_ptr) -
1326 		    ((uint8_t *)0);
1327 
1328 		/* store end offset temporarily */
1329 
1330 		parm->size[2] = parm->size[0];
1331 
1332 		/* align data properly */
1333 		parm->size[0] += ((-parm->size[0]) & (USB_HOST_ALIGN - 1));
1334 
1335 		parm->size[6] = parm->size[0];
1336 
1337 		parm->size[0] += ((uint8_t *)parm->xfer_length_ptr) -
1338 		    ((uint8_t *)0);
1339 
1340 		/* align data properly */
1341 		parm->size[0] += ((-parm->size[0]) & (USB_HOST_ALIGN - 1));
1342 
1343 		/* allocate zeroed memory */
1344 		buf = malloc(parm->size[0], M_USB, M_WAITOK | M_ZERO);
1345 #if (USB_HAVE_MALLOC_WAITOK == 0)
1346 		if (buf == NULL) {
1347 			parm->err = USB_ERR_NOMEM;
1348 			DPRINTFN(0, "cannot allocate memory block for "
1349 			    "configuration (%d bytes)\n",
1350 			    parm->size[0]);
1351 			goto done;
1352                 }
1353 #endif
1354 		parm->dma_tag_p = USB_ADD_BYTES(buf, parm->size[1]);
1355 		parm->dma_page_ptr = USB_ADD_BYTES(buf, parm->size[3]);
1356 		parm->dma_page_cache_ptr = USB_ADD_BYTES(buf, parm->size[4]);
1357 		parm->xfer_page_cache_ptr = USB_ADD_BYTES(buf, parm->size[5]);
1358 		parm->xfer_length_ptr = USB_ADD_BYTES(buf, parm->size[6]);
1359 	}
1360 
1361 done:
1362 	if (buf) {
1363 		if (info->setup_refcount == 0) {
1364 			/*
1365 			 * "usbd_transfer_unsetup_sub" will unlock
1366 			 * the bus mutex before returning !
1367 			 */
1368 			USB_BUS_LOCK(info->bus);
1369 
1370 			/* something went wrong */
1371 			usbd_transfer_unsetup_sub(info, 0);
1372 		}
1373 	}
1374 
1375 	/* check if any errors happened */
1376 	if (parm->err)
1377 		usbd_transfer_unsetup(ppxfer, n_setup);
1378 
1379 	error = parm->err;
1380 
1381 	if (do_unlock)
1382 		usbd_ctrl_unlock(udev);
1383 
1384 	return (error);
1385 }
1386 
1387 /*------------------------------------------------------------------------*
1388  *	usbd_transfer_unsetup_sub - factored out code
1389  *------------------------------------------------------------------------*/
1390 static void
1391 usbd_transfer_unsetup_sub(struct usb_xfer_root *info, uint8_t needs_delay)
1392 {
1393 #if USB_HAVE_BUSDMA
1394 	struct usb_page_cache *pc;
1395 #endif
1396 
1397 	USB_BUS_LOCK_ASSERT(info->bus, MA_OWNED);
1398 
1399 	/* wait for any outstanding DMA operations */
1400 
1401 	if (needs_delay) {
1402 		usb_timeout_t temp;
1403 		temp = usbd_get_dma_delay(info->udev);
1404 		if (temp != 0) {
1405 			usb_pause_mtx(&info->bus->bus_mtx,
1406 			    USB_MS_TO_TICKS(temp));
1407 		}
1408 	}
1409 
1410 	/* make sure that our done messages are not queued anywhere */
1411 	usb_proc_mwait(info->done_p, &info->done_m[0], &info->done_m[1]);
1412 
1413 	USB_BUS_UNLOCK(info->bus);
1414 
1415 #if USB_HAVE_BUSDMA
1416 	/* free DMA'able memory, if any */
1417 	pc = info->dma_page_cache_start;
1418 	while (pc != info->dma_page_cache_end) {
1419 		usb_pc_free_mem(pc);
1420 		pc++;
1421 	}
1422 
1423 	/* free DMA maps in all "xfer->frbuffers" */
1424 	pc = info->xfer_page_cache_start;
1425 	while (pc != info->xfer_page_cache_end) {
1426 		usb_pc_dmamap_destroy(pc);
1427 		pc++;
1428 	}
1429 
1430 	/* free all DMA tags */
1431 	usb_dma_tag_unsetup(&info->dma_parent_tag);
1432 #endif
1433 
1434 	cv_destroy(&info->cv_drain);
1435 
1436 	/*
1437 	 * free the "memory_base" last, hence the "info" structure is
1438 	 * contained within the "memory_base"!
1439 	 */
1440 	free(info->memory_base, M_USB);
1441 }
1442 
1443 /*------------------------------------------------------------------------*
1444  *	usbd_transfer_unsetup - unsetup/free an array of USB transfers
1445  *
1446  * NOTE: All USB transfers in progress will get called back passing
1447  * the error code "USB_ERR_CANCELLED" before this function
1448  * returns.
1449  *------------------------------------------------------------------------*/
1450 void
1451 usbd_transfer_unsetup(struct usb_xfer **pxfer, uint16_t n_setup)
1452 {
1453 	struct usb_xfer *xfer;
1454 	struct usb_xfer_root *info;
1455 	uint8_t needs_delay = 0;
1456 
1457 	WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
1458 	    "usbd_transfer_unsetup can sleep!");
1459 
1460 	while (n_setup--) {
1461 		xfer = pxfer[n_setup];
1462 
1463 		if (xfer == NULL)
1464 			continue;
1465 
1466 		info = xfer->xroot;
1467 
1468 		USB_XFER_LOCK(xfer);
1469 		USB_BUS_LOCK(info->bus);
1470 
1471 		/*
1472 		 * HINT: when you start/stop a transfer, it might be a
1473 		 * good idea to directly use the "pxfer[]" structure:
1474 		 *
1475 		 * usbd_transfer_start(sc->pxfer[0]);
1476 		 * usbd_transfer_stop(sc->pxfer[0]);
1477 		 *
1478 		 * That way, if your code has many parts that will not
1479 		 * stop running under the same lock, in other words
1480 		 * "xfer_mtx", the usbd_transfer_start and
1481 		 * usbd_transfer_stop functions will simply return
1482 		 * when they detect a NULL pointer argument.
1483 		 *
1484 		 * To avoid any races we clear the "pxfer[]" pointer
1485 		 * while holding the private mutex of the driver:
1486 		 */
1487 		pxfer[n_setup] = NULL;
1488 
1489 		USB_BUS_UNLOCK(info->bus);
1490 		USB_XFER_UNLOCK(xfer);
1491 
1492 		usbd_transfer_drain(xfer);
1493 
1494 #if USB_HAVE_BUSDMA
1495 		if (xfer->flags_int.bdma_enable)
1496 			needs_delay = 1;
1497 #endif
1498 		/*
1499 		 * NOTE: default endpoint does not have an
1500 		 * interface, even if endpoint->iface_index == 0
1501 		 */
1502 		USB_BUS_LOCK(info->bus);
1503 		xfer->endpoint->refcount_alloc--;
1504 		USB_BUS_UNLOCK(info->bus);
1505 
1506 		usb_callout_drain(&xfer->timeout_handle);
1507 
1508 		USB_BUS_LOCK(info->bus);
1509 
1510 		USB_ASSERT(info->setup_refcount != 0, ("Invalid setup "
1511 		    "reference count\n"));
1512 
1513 		info->setup_refcount--;
1514 
1515 		if (info->setup_refcount == 0) {
1516 			usbd_transfer_unsetup_sub(info,
1517 			    needs_delay);
1518 		} else {
1519 			USB_BUS_UNLOCK(info->bus);
1520 		}
1521 	}
1522 }
1523 
1524 /*------------------------------------------------------------------------*
1525  *	usbd_control_transfer_init - factored out code
1526  *
1527  * In USB Device Mode we have to wait for the SETUP packet which
1528  * containst the "struct usb_device_request" structure, before we can
1529  * transfer any data. In USB Host Mode we already have the SETUP
1530  * packet at the moment the USB transfer is started. This leads us to
1531  * having to setup the USB transfer at two different places in
1532  * time. This function just contains factored out control transfer
1533  * initialisation code, so that we don't duplicate the code.
1534  *------------------------------------------------------------------------*/
1535 static void
1536 usbd_control_transfer_init(struct usb_xfer *xfer)
1537 {
1538 	struct usb_device_request req;
1539 
1540 	/* copy out the USB request header */
1541 
1542 	usbd_copy_out(xfer->frbuffers, 0, &req, sizeof(req));
1543 
1544 	/* setup remainder */
1545 
1546 	xfer->flags_int.control_rem = UGETW(req.wLength);
1547 
1548 	/* copy direction to endpoint variable */
1549 
1550 	xfer->endpointno &= ~(UE_DIR_IN | UE_DIR_OUT);
1551 	xfer->endpointno |=
1552 	    (req.bmRequestType & UT_READ) ? UE_DIR_IN : UE_DIR_OUT;
1553 }
1554 
1555 /*------------------------------------------------------------------------*
1556  *	usbd_control_transfer_did_data
1557  *
1558  * This function returns non-zero if a control endpoint has
1559  * transferred the first DATA packet after the SETUP packet.
1560  * Else it returns zero.
1561  *------------------------------------------------------------------------*/
1562 static uint8_t
1563 usbd_control_transfer_did_data(struct usb_xfer *xfer)
1564 {
1565 	struct usb_device_request req;
1566 
1567 	/* SETUP packet is not yet sent */
1568 	if (xfer->flags_int.control_hdr != 0)
1569 		return (0);
1570 
1571 	/* copy out the USB request header */
1572 	usbd_copy_out(xfer->frbuffers, 0, &req, sizeof(req));
1573 
1574 	/* compare remainder to the initial value */
1575 	return (xfer->flags_int.control_rem != UGETW(req.wLength));
1576 }
1577 
1578 /*------------------------------------------------------------------------*
1579  *	usbd_setup_ctrl_transfer
1580  *
1581  * This function handles initialisation of control transfers. Control
1582  * transfers are special in that regard that they can both transmit
1583  * and receive data.
1584  *
1585  * Return values:
1586  *    0: Success
1587  * Else: Failure
1588  *------------------------------------------------------------------------*/
1589 static int
1590 usbd_setup_ctrl_transfer(struct usb_xfer *xfer)
1591 {
1592 	usb_frlength_t len;
1593 
1594 	/* Check for control endpoint stall */
1595 	if (xfer->flags.stall_pipe && xfer->flags_int.control_act) {
1596 		/* the control transfer is no longer active */
1597 		xfer->flags_int.control_stall = 1;
1598 		xfer->flags_int.control_act = 0;
1599 	} else {
1600 		/* don't stall control transfer by default */
1601 		xfer->flags_int.control_stall = 0;
1602 	}
1603 
1604 	/* Check for invalid number of frames */
1605 	if (xfer->nframes > 2) {
1606 		/*
1607 		 * If you need to split a control transfer, you
1608 		 * have to do one part at a time. Only with
1609 		 * non-control transfers you can do multiple
1610 		 * parts a time.
1611 		 */
1612 		DPRINTFN(0, "Too many frames: %u\n",
1613 		    (unsigned int)xfer->nframes);
1614 		goto error;
1615 	}
1616 
1617 	/*
1618          * Check if there is a control
1619          * transfer in progress:
1620          */
1621 	if (xfer->flags_int.control_act) {
1622 
1623 		if (xfer->flags_int.control_hdr) {
1624 
1625 			/* clear send header flag */
1626 
1627 			xfer->flags_int.control_hdr = 0;
1628 
1629 			/* setup control transfer */
1630 			if (xfer->flags_int.usb_mode == USB_MODE_DEVICE) {
1631 				usbd_control_transfer_init(xfer);
1632 			}
1633 		}
1634 		/* get data length */
1635 
1636 		len = xfer->sumlen;
1637 
1638 	} else {
1639 
1640 		/* the size of the SETUP structure is hardcoded ! */
1641 
1642 		if (xfer->frlengths[0] != sizeof(struct usb_device_request)) {
1643 			DPRINTFN(0, "Wrong framelength %u != %zu\n",
1644 			    xfer->frlengths[0], sizeof(struct
1645 			    usb_device_request));
1646 			goto error;
1647 		}
1648 		/* check USB mode */
1649 		if (xfer->flags_int.usb_mode == USB_MODE_DEVICE) {
1650 
1651 			/* check number of frames */
1652 			if (xfer->nframes != 1) {
1653 				/*
1654 			         * We need to receive the setup
1655 			         * message first so that we know the
1656 			         * data direction!
1657 			         */
1658 				DPRINTF("Misconfigured transfer\n");
1659 				goto error;
1660 			}
1661 			/*
1662 			 * Set a dummy "control_rem" value.  This
1663 			 * variable will be overwritten later by a
1664 			 * call to "usbd_control_transfer_init()" !
1665 			 */
1666 			xfer->flags_int.control_rem = 0xFFFF;
1667 		} else {
1668 
1669 			/* setup "endpoint" and "control_rem" */
1670 
1671 			usbd_control_transfer_init(xfer);
1672 		}
1673 
1674 		/* set transfer-header flag */
1675 
1676 		xfer->flags_int.control_hdr = 1;
1677 
1678 		/* get data length */
1679 
1680 		len = (xfer->sumlen - sizeof(struct usb_device_request));
1681 	}
1682 
1683 	/* update did data flag */
1684 
1685 	xfer->flags_int.control_did_data =
1686 	    usbd_control_transfer_did_data(xfer);
1687 
1688 	/* check if there is a length mismatch */
1689 
1690 	if (len > xfer->flags_int.control_rem) {
1691 		DPRINTFN(0, "Length (%d) greater than "
1692 		    "remaining length (%d)\n", len,
1693 		    xfer->flags_int.control_rem);
1694 		goto error;
1695 	}
1696 	/* check if we are doing a short transfer */
1697 
1698 	if (xfer->flags.force_short_xfer) {
1699 		xfer->flags_int.control_rem = 0;
1700 	} else {
1701 		if ((len != xfer->max_data_length) &&
1702 		    (len != xfer->flags_int.control_rem) &&
1703 		    (xfer->nframes != 1)) {
1704 			DPRINTFN(0, "Short control transfer without "
1705 			    "force_short_xfer set\n");
1706 			goto error;
1707 		}
1708 		xfer->flags_int.control_rem -= len;
1709 	}
1710 
1711 	/* the status part is executed when "control_act" is 0 */
1712 
1713 	if ((xfer->flags_int.control_rem > 0) ||
1714 	    (xfer->flags.manual_status)) {
1715 		/* don't execute the STATUS stage yet */
1716 		xfer->flags_int.control_act = 1;
1717 
1718 		/* sanity check */
1719 		if ((!xfer->flags_int.control_hdr) &&
1720 		    (xfer->nframes == 1)) {
1721 			/*
1722 		         * This is not a valid operation!
1723 		         */
1724 			DPRINTFN(0, "Invalid parameter "
1725 			    "combination\n");
1726 			goto error;
1727 		}
1728 	} else {
1729 		/* time to execute the STATUS stage */
1730 		xfer->flags_int.control_act = 0;
1731 	}
1732 	return (0);			/* success */
1733 
1734 error:
1735 	return (1);			/* failure */
1736 }
1737 
1738 /*------------------------------------------------------------------------*
1739  *	usbd_transfer_submit - start USB hardware for the given transfer
1740  *
1741  * This function should only be called from the USB callback.
1742  *------------------------------------------------------------------------*/
1743 void
1744 usbd_transfer_submit(struct usb_xfer *xfer)
1745 {
1746 	struct usb_xfer_root *info;
1747 	struct usb_bus *bus;
1748 	usb_frcount_t x;
1749 
1750 	info = xfer->xroot;
1751 	bus = info->bus;
1752 
1753 	DPRINTF("xfer=%p, endpoint=%p, nframes=%d, dir=%s\n",
1754 	    xfer, xfer->endpoint, xfer->nframes, USB_GET_DATA_ISREAD(xfer) ?
1755 	    "read" : "write");
1756 
1757 #ifdef USB_DEBUG
1758 	if (USB_DEBUG_VAR > 0) {
1759 		USB_BUS_LOCK(bus);
1760 
1761 		usb_dump_endpoint(xfer->endpoint);
1762 
1763 		USB_BUS_UNLOCK(bus);
1764 	}
1765 #endif
1766 
1767 	USB_XFER_LOCK_ASSERT(xfer, MA_OWNED);
1768 	USB_BUS_LOCK_ASSERT(bus, MA_NOTOWNED);
1769 
1770 	/* Only open the USB transfer once! */
1771 	if (!xfer->flags_int.open) {
1772 		xfer->flags_int.open = 1;
1773 
1774 		DPRINTF("open\n");
1775 
1776 		USB_BUS_LOCK(bus);
1777 		(xfer->endpoint->methods->open) (xfer);
1778 		USB_BUS_UNLOCK(bus);
1779 	}
1780 	/* set "transferring" flag */
1781 	xfer->flags_int.transferring = 1;
1782 
1783 #if USB_HAVE_POWERD
1784 	/* increment power reference */
1785 	usbd_transfer_power_ref(xfer, 1);
1786 #endif
1787 	/*
1788 	 * Check if the transfer is waiting on a queue, most
1789 	 * frequently the "done_q":
1790 	 */
1791 	if (xfer->wait_queue) {
1792 		USB_BUS_LOCK(bus);
1793 		usbd_transfer_dequeue(xfer);
1794 		USB_BUS_UNLOCK(bus);
1795 	}
1796 	/* clear "did_dma_delay" flag */
1797 	xfer->flags_int.did_dma_delay = 0;
1798 
1799 	/* clear "did_close" flag */
1800 	xfer->flags_int.did_close = 0;
1801 
1802 #if USB_HAVE_BUSDMA
1803 	/* clear "bdma_setup" flag */
1804 	xfer->flags_int.bdma_setup = 0;
1805 #endif
1806 	/* by default we cannot cancel any USB transfer immediately */
1807 	xfer->flags_int.can_cancel_immed = 0;
1808 
1809 	/* clear lengths and frame counts by default */
1810 	xfer->sumlen = 0;
1811 	xfer->actlen = 0;
1812 	xfer->aframes = 0;
1813 
1814 	/* clear any previous errors */
1815 	xfer->error = 0;
1816 
1817 	/* Check if the device is still alive */
1818 	if (info->udev->state < USB_STATE_POWERED) {
1819 		USB_BUS_LOCK(bus);
1820 		/*
1821 		 * Must return cancelled error code else
1822 		 * device drivers can hang.
1823 		 */
1824 		usbd_transfer_done(xfer, USB_ERR_CANCELLED);
1825 		USB_BUS_UNLOCK(bus);
1826 		return;
1827 	}
1828 
1829 	/* sanity check */
1830 	if (xfer->nframes == 0) {
1831 		if (xfer->flags.stall_pipe) {
1832 			/*
1833 			 * Special case - want to stall without transferring
1834 			 * any data:
1835 			 */
1836 			DPRINTF("xfer=%p nframes=0: stall "
1837 			    "or clear stall!\n", xfer);
1838 			USB_BUS_LOCK(bus);
1839 			xfer->flags_int.can_cancel_immed = 1;
1840 			/* start the transfer */
1841 			usb_command_wrapper(&xfer->endpoint->
1842 			    endpoint_q[xfer->stream_id], xfer);
1843 			USB_BUS_UNLOCK(bus);
1844 			return;
1845 		}
1846 		USB_BUS_LOCK(bus);
1847 		usbd_transfer_done(xfer, USB_ERR_INVAL);
1848 		USB_BUS_UNLOCK(bus);
1849 		return;
1850 	}
1851 	/* compute some variables */
1852 
1853 	for (x = 0; x != xfer->nframes; x++) {
1854 		/* make a copy of the frlenghts[] */
1855 		xfer->frlengths[x + xfer->max_frame_count] = xfer->frlengths[x];
1856 		/* compute total transfer length */
1857 		xfer->sumlen += xfer->frlengths[x];
1858 		if (xfer->sumlen < xfer->frlengths[x]) {
1859 			/* length wrapped around */
1860 			USB_BUS_LOCK(bus);
1861 			usbd_transfer_done(xfer, USB_ERR_INVAL);
1862 			USB_BUS_UNLOCK(bus);
1863 			return;
1864 		}
1865 	}
1866 
1867 	/* clear some internal flags */
1868 
1869 	xfer->flags_int.short_xfer_ok = 0;
1870 	xfer->flags_int.short_frames_ok = 0;
1871 
1872 	/* check if this is a control transfer */
1873 
1874 	if (xfer->flags_int.control_xfr) {
1875 
1876 		if (usbd_setup_ctrl_transfer(xfer)) {
1877 			USB_BUS_LOCK(bus);
1878 			usbd_transfer_done(xfer, USB_ERR_STALLED);
1879 			USB_BUS_UNLOCK(bus);
1880 			return;
1881 		}
1882 	}
1883 	/*
1884 	 * Setup filtered version of some transfer flags,
1885 	 * in case of data read direction
1886 	 */
1887 	if (USB_GET_DATA_ISREAD(xfer)) {
1888 
1889 		if (xfer->flags.short_frames_ok) {
1890 			xfer->flags_int.short_xfer_ok = 1;
1891 			xfer->flags_int.short_frames_ok = 1;
1892 		} else if (xfer->flags.short_xfer_ok) {
1893 			xfer->flags_int.short_xfer_ok = 1;
1894 
1895 			/* check for control transfer */
1896 			if (xfer->flags_int.control_xfr) {
1897 				/*
1898 				 * 1) Control transfers do not support
1899 				 * reception of multiple short USB
1900 				 * frames in host mode and device side
1901 				 * mode, with exception of:
1902 				 *
1903 				 * 2) Due to sometimes buggy device
1904 				 * side firmware we need to do a
1905 				 * STATUS stage in case of short
1906 				 * control transfers in USB host mode.
1907 				 * The STATUS stage then becomes the
1908 				 * "alt_next" to the DATA stage.
1909 				 */
1910 				xfer->flags_int.short_frames_ok = 1;
1911 			}
1912 		}
1913 	}
1914 	/*
1915 	 * Check if BUS-DMA support is enabled and try to load virtual
1916 	 * buffers into DMA, if any:
1917 	 */
1918 #if USB_HAVE_BUSDMA
1919 	if (xfer->flags_int.bdma_enable) {
1920 		/* insert the USB transfer last in the BUS-DMA queue */
1921 		usb_command_wrapper(&xfer->xroot->dma_q, xfer);
1922 		return;
1923 	}
1924 #endif
1925 	/*
1926 	 * Enter the USB transfer into the Host Controller or
1927 	 * Device Controller schedule:
1928 	 */
1929 	usbd_pipe_enter(xfer);
1930 }
1931 
1932 /*------------------------------------------------------------------------*
1933  *	usbd_pipe_enter - factored out code
1934  *------------------------------------------------------------------------*/
1935 void
1936 usbd_pipe_enter(struct usb_xfer *xfer)
1937 {
1938 	struct usb_endpoint *ep;
1939 
1940 	USB_XFER_LOCK_ASSERT(xfer, MA_OWNED);
1941 
1942 	USB_BUS_LOCK(xfer->xroot->bus);
1943 
1944 	ep = xfer->endpoint;
1945 
1946 	DPRINTF("enter\n");
1947 
1948 	/* the transfer can now be cancelled */
1949 	xfer->flags_int.can_cancel_immed = 1;
1950 
1951 	/* enter the transfer */
1952 	(ep->methods->enter) (xfer);
1953 
1954 	/* check for transfer error */
1955 	if (xfer->error) {
1956 		/* some error has happened */
1957 		usbd_transfer_done(xfer, 0);
1958 		USB_BUS_UNLOCK(xfer->xroot->bus);
1959 		return;
1960 	}
1961 
1962 	/* start the transfer */
1963 	usb_command_wrapper(&ep->endpoint_q[xfer->stream_id], xfer);
1964 	USB_BUS_UNLOCK(xfer->xroot->bus);
1965 }
1966 
1967 /*------------------------------------------------------------------------*
1968  *	usbd_transfer_start - start an USB transfer
1969  *
1970  * NOTE: Calling this function more than one time will only
1971  *       result in a single transfer start, until the USB transfer
1972  *       completes.
1973  *------------------------------------------------------------------------*/
1974 void
1975 usbd_transfer_start(struct usb_xfer *xfer)
1976 {
1977 	if (xfer == NULL) {
1978 		/* transfer is gone */
1979 		return;
1980 	}
1981 	USB_XFER_LOCK_ASSERT(xfer, MA_OWNED);
1982 
1983 	/* mark the USB transfer started */
1984 
1985 	if (!xfer->flags_int.started) {
1986 		/* lock the BUS lock to avoid races updating flags_int */
1987 		USB_BUS_LOCK(xfer->xroot->bus);
1988 		xfer->flags_int.started = 1;
1989 		USB_BUS_UNLOCK(xfer->xroot->bus);
1990 	}
1991 	/* check if the USB transfer callback is already transferring */
1992 
1993 	if (xfer->flags_int.transferring) {
1994 		return;
1995 	}
1996 	USB_BUS_LOCK(xfer->xroot->bus);
1997 	/* call the USB transfer callback */
1998 	usbd_callback_ss_done_defer(xfer);
1999 	USB_BUS_UNLOCK(xfer->xroot->bus);
2000 }
2001 
2002 /*------------------------------------------------------------------------*
2003  *	usbd_transfer_stop - stop an USB transfer
2004  *
2005  * NOTE: Calling this function more than one time will only
2006  *       result in a single transfer stop.
2007  * NOTE: When this function returns it is not safe to free nor
2008  *       reuse any DMA buffers. See "usbd_transfer_drain()".
2009  *------------------------------------------------------------------------*/
2010 void
2011 usbd_transfer_stop(struct usb_xfer *xfer)
2012 {
2013 	struct usb_endpoint *ep;
2014 
2015 	if (xfer == NULL) {
2016 		/* transfer is gone */
2017 		return;
2018 	}
2019 	USB_XFER_LOCK_ASSERT(xfer, MA_OWNED);
2020 
2021 	/* check if the USB transfer was ever opened */
2022 
2023 	if (!xfer->flags_int.open) {
2024 		if (xfer->flags_int.started) {
2025 			/* nothing to do except clearing the "started" flag */
2026 			/* lock the BUS lock to avoid races updating flags_int */
2027 			USB_BUS_LOCK(xfer->xroot->bus);
2028 			xfer->flags_int.started = 0;
2029 			USB_BUS_UNLOCK(xfer->xroot->bus);
2030 		}
2031 		return;
2032 	}
2033 	/* try to stop the current USB transfer */
2034 
2035 	USB_BUS_LOCK(xfer->xroot->bus);
2036 	/* override any previous error */
2037 	xfer->error = USB_ERR_CANCELLED;
2038 
2039 	/*
2040 	 * Clear "open" and "started" when both private and USB lock
2041 	 * is locked so that we don't get a race updating "flags_int"
2042 	 */
2043 	xfer->flags_int.open = 0;
2044 	xfer->flags_int.started = 0;
2045 
2046 	/*
2047 	 * Check if we can cancel the USB transfer immediately.
2048 	 */
2049 	if (xfer->flags_int.transferring) {
2050 		if (xfer->flags_int.can_cancel_immed &&
2051 		    (!xfer->flags_int.did_close)) {
2052 			DPRINTF("close\n");
2053 			/*
2054 			 * The following will lead to an USB_ERR_CANCELLED
2055 			 * error code being passed to the USB callback.
2056 			 */
2057 			(xfer->endpoint->methods->close) (xfer);
2058 			/* only close once */
2059 			xfer->flags_int.did_close = 1;
2060 		} else {
2061 			/* need to wait for the next done callback */
2062 		}
2063 	} else {
2064 		DPRINTF("close\n");
2065 
2066 		/* close here and now */
2067 		(xfer->endpoint->methods->close) (xfer);
2068 
2069 		/*
2070 		 * Any additional DMA delay is done by
2071 		 * "usbd_transfer_unsetup()".
2072 		 */
2073 
2074 		/*
2075 		 * Special case. Check if we need to restart a blocked
2076 		 * endpoint.
2077 		 */
2078 		ep = xfer->endpoint;
2079 
2080 		/*
2081 		 * If the current USB transfer is completing we need
2082 		 * to start the next one:
2083 		 */
2084 		if (ep->endpoint_q[xfer->stream_id].curr == xfer) {
2085 			usb_command_wrapper(
2086 			    &ep->endpoint_q[xfer->stream_id], NULL);
2087 		}
2088 	}
2089 
2090 	USB_BUS_UNLOCK(xfer->xroot->bus);
2091 }
2092 
2093 /*------------------------------------------------------------------------*
2094  *	usbd_transfer_pending
2095  *
2096  * This function will check if an USB transfer is pending which is a
2097  * little bit complicated!
2098  * Return values:
2099  * 0: Not pending
2100  * 1: Pending: The USB transfer will receive a callback in the future.
2101  *------------------------------------------------------------------------*/
2102 uint8_t
2103 usbd_transfer_pending(struct usb_xfer *xfer)
2104 {
2105 	struct usb_xfer_root *info;
2106 	struct usb_xfer_queue *pq;
2107 
2108 	if (xfer == NULL) {
2109 		/* transfer is gone */
2110 		return (0);
2111 	}
2112 	USB_XFER_LOCK_ASSERT(xfer, MA_OWNED);
2113 
2114 	if (xfer->flags_int.transferring) {
2115 		/* trivial case */
2116 		return (1);
2117 	}
2118 	USB_BUS_LOCK(xfer->xroot->bus);
2119 	if (xfer->wait_queue) {
2120 		/* we are waiting on a queue somewhere */
2121 		USB_BUS_UNLOCK(xfer->xroot->bus);
2122 		return (1);
2123 	}
2124 	info = xfer->xroot;
2125 	pq = &info->done_q;
2126 
2127 	if (pq->curr == xfer) {
2128 		/* we are currently scheduled for callback */
2129 		USB_BUS_UNLOCK(xfer->xroot->bus);
2130 		return (1);
2131 	}
2132 	/* we are not pending */
2133 	USB_BUS_UNLOCK(xfer->xroot->bus);
2134 	return (0);
2135 }
2136 
2137 /*------------------------------------------------------------------------*
2138  *	usbd_transfer_drain
2139  *
2140  * This function will stop the USB transfer and wait for any
2141  * additional BUS-DMA and HW-DMA operations to complete. Buffers that
2142  * are loaded into DMA can safely be freed or reused after that this
2143  * function has returned.
2144  *------------------------------------------------------------------------*/
2145 void
2146 usbd_transfer_drain(struct usb_xfer *xfer)
2147 {
2148 	WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
2149 	    "usbd_transfer_drain can sleep!");
2150 
2151 	if (xfer == NULL) {
2152 		/* transfer is gone */
2153 		return;
2154 	}
2155 	if (xfer->xroot->xfer_mtx != &Giant) {
2156 		USB_XFER_LOCK_ASSERT(xfer, MA_NOTOWNED);
2157 	}
2158 	USB_XFER_LOCK(xfer);
2159 
2160 	usbd_transfer_stop(xfer);
2161 
2162 	while (usbd_transfer_pending(xfer) ||
2163 	    xfer->flags_int.doing_callback) {
2164 
2165 		/*
2166 		 * It is allowed that the callback can drop its
2167 		 * transfer mutex. In that case checking only
2168 		 * "usbd_transfer_pending()" is not enough to tell if
2169 		 * the USB transfer is fully drained. We also need to
2170 		 * check the internal "doing_callback" flag.
2171 		 */
2172 		xfer->flags_int.draining = 1;
2173 
2174 		/*
2175 		 * Wait until the current outstanding USB
2176 		 * transfer is complete !
2177 		 */
2178 		cv_wait(&xfer->xroot->cv_drain, xfer->xroot->xfer_mtx);
2179 	}
2180 	USB_XFER_UNLOCK(xfer);
2181 }
2182 
2183 struct usb_page_cache *
2184 usbd_xfer_get_frame(struct usb_xfer *xfer, usb_frcount_t frindex)
2185 {
2186 	KASSERT(frindex < xfer->max_frame_count, ("frame index overflow"));
2187 
2188 	return (&xfer->frbuffers[frindex]);
2189 }
2190 
2191 void *
2192 usbd_xfer_get_frame_buffer(struct usb_xfer *xfer, usb_frcount_t frindex)
2193 {
2194 	struct usb_page_search page_info;
2195 
2196 	KASSERT(frindex < xfer->max_frame_count, ("frame index overflow"));
2197 
2198 	usbd_get_page(&xfer->frbuffers[frindex], 0, &page_info);
2199 	return (page_info.buffer);
2200 }
2201 
2202 /*------------------------------------------------------------------------*
2203  *	usbd_xfer_get_fps_shift
2204  *
2205  * The following function is only useful for isochronous transfers. It
2206  * returns how many times the frame execution rate has been shifted
2207  * down.
2208  *
2209  * Return value:
2210  * Success: 0..3
2211  * Failure: 0
2212  *------------------------------------------------------------------------*/
2213 uint8_t
2214 usbd_xfer_get_fps_shift(struct usb_xfer *xfer)
2215 {
2216 	return (xfer->fps_shift);
2217 }
2218 
2219 usb_frlength_t
2220 usbd_xfer_frame_len(struct usb_xfer *xfer, usb_frcount_t frindex)
2221 {
2222 	KASSERT(frindex < xfer->max_frame_count, ("frame index overflow"));
2223 
2224 	return (xfer->frlengths[frindex]);
2225 }
2226 
2227 /*------------------------------------------------------------------------*
2228  *	usbd_xfer_set_frame_data
2229  *
2230  * This function sets the pointer of the buffer that should
2231  * loaded directly into DMA for the given USB frame. Passing "ptr"
2232  * equal to NULL while the corresponding "frlength" is greater
2233  * than zero gives undefined results!
2234  *------------------------------------------------------------------------*/
2235 void
2236 usbd_xfer_set_frame_data(struct usb_xfer *xfer, usb_frcount_t frindex,
2237     void *ptr, usb_frlength_t len)
2238 {
2239 	KASSERT(frindex < xfer->max_frame_count, ("frame index overflow"));
2240 
2241 	/* set virtual address to load and length */
2242 	xfer->frbuffers[frindex].buffer = ptr;
2243 	usbd_xfer_set_frame_len(xfer, frindex, len);
2244 }
2245 
2246 void
2247 usbd_xfer_frame_data(struct usb_xfer *xfer, usb_frcount_t frindex,
2248     void **ptr, int *len)
2249 {
2250 	KASSERT(frindex < xfer->max_frame_count, ("frame index overflow"));
2251 
2252 	if (ptr != NULL)
2253 		*ptr = xfer->frbuffers[frindex].buffer;
2254 	if (len != NULL)
2255 		*len = xfer->frlengths[frindex];
2256 }
2257 
2258 /*------------------------------------------------------------------------*
2259  *	usbd_xfer_old_frame_length
2260  *
2261  * This function returns the framelength of the given frame at the
2262  * time the transfer was submitted. This function can be used to
2263  * compute the starting data pointer of the next isochronous frame
2264  * when an isochronous transfer has completed.
2265  *------------------------------------------------------------------------*/
2266 usb_frlength_t
2267 usbd_xfer_old_frame_length(struct usb_xfer *xfer, usb_frcount_t frindex)
2268 {
2269 	KASSERT(frindex < xfer->max_frame_count, ("frame index overflow"));
2270 
2271 	return (xfer->frlengths[frindex + xfer->max_frame_count]);
2272 }
2273 
2274 void
2275 usbd_xfer_status(struct usb_xfer *xfer, int *actlen, int *sumlen, int *aframes,
2276     int *nframes)
2277 {
2278 	if (actlen != NULL)
2279 		*actlen = xfer->actlen;
2280 	if (sumlen != NULL)
2281 		*sumlen = xfer->sumlen;
2282 	if (aframes != NULL)
2283 		*aframes = xfer->aframes;
2284 	if (nframes != NULL)
2285 		*nframes = xfer->nframes;
2286 }
2287 
2288 /*------------------------------------------------------------------------*
2289  *	usbd_xfer_set_frame_offset
2290  *
2291  * This function sets the frame data buffer offset relative to the beginning
2292  * of the USB DMA buffer allocated for this USB transfer.
2293  *------------------------------------------------------------------------*/
2294 void
2295 usbd_xfer_set_frame_offset(struct usb_xfer *xfer, usb_frlength_t offset,
2296     usb_frcount_t frindex)
2297 {
2298 	KASSERT(!xfer->flags.ext_buffer, ("Cannot offset data frame "
2299 	    "when the USB buffer is external\n"));
2300 	KASSERT(frindex < xfer->max_frame_count, ("frame index overflow"));
2301 
2302 	/* set virtual address to load */
2303 	xfer->frbuffers[frindex].buffer =
2304 	    USB_ADD_BYTES(xfer->local_buffer, offset);
2305 }
2306 
2307 void
2308 usbd_xfer_set_interval(struct usb_xfer *xfer, int i)
2309 {
2310 	xfer->interval = i;
2311 }
2312 
2313 void
2314 usbd_xfer_set_timeout(struct usb_xfer *xfer, int t)
2315 {
2316 	xfer->timeout = t;
2317 }
2318 
2319 void
2320 usbd_xfer_set_frames(struct usb_xfer *xfer, usb_frcount_t n)
2321 {
2322 	xfer->nframes = n;
2323 }
2324 
2325 usb_frcount_t
2326 usbd_xfer_max_frames(struct usb_xfer *xfer)
2327 {
2328 	return (xfer->max_frame_count);
2329 }
2330 
2331 usb_frlength_t
2332 usbd_xfer_max_len(struct usb_xfer *xfer)
2333 {
2334 	return (xfer->max_data_length);
2335 }
2336 
2337 usb_frlength_t
2338 usbd_xfer_max_framelen(struct usb_xfer *xfer)
2339 {
2340 	return (xfer->max_frame_size);
2341 }
2342 
2343 void
2344 usbd_xfer_set_frame_len(struct usb_xfer *xfer, usb_frcount_t frindex,
2345     usb_frlength_t len)
2346 {
2347 	KASSERT(frindex < xfer->max_frame_count, ("frame index overflow"));
2348 
2349 	xfer->frlengths[frindex] = len;
2350 }
2351 
2352 /*------------------------------------------------------------------------*
2353  *	usb_callback_proc - factored out code
2354  *
2355  * This function performs USB callbacks.
2356  *------------------------------------------------------------------------*/
2357 static void
2358 usb_callback_proc(struct usb_proc_msg *_pm)
2359 {
2360 	struct usb_done_msg *pm = (void *)_pm;
2361 	struct usb_xfer_root *info = pm->xroot;
2362 
2363 	/* Change locking order */
2364 	USB_BUS_UNLOCK(info->bus);
2365 
2366 	/*
2367 	 * We exploit the fact that the mutex is the same for all
2368 	 * callbacks that will be called from this thread:
2369 	 */
2370 	USB_MTX_LOCK(info->xfer_mtx);
2371 	USB_BUS_LOCK(info->bus);
2372 
2373 	/* Continue where we lost track */
2374 	usb_command_wrapper(&info->done_q,
2375 	    info->done_q.curr);
2376 
2377 	USB_MTX_UNLOCK(info->xfer_mtx);
2378 }
2379 
2380 /*------------------------------------------------------------------------*
2381  *	usbd_callback_ss_done_defer
2382  *
2383  * This function will defer the start, stop and done callback to the
2384  * correct thread.
2385  *------------------------------------------------------------------------*/
2386 static void
2387 usbd_callback_ss_done_defer(struct usb_xfer *xfer)
2388 {
2389 	struct usb_xfer_root *info = xfer->xroot;
2390 	struct usb_xfer_queue *pq = &info->done_q;
2391 
2392 	USB_BUS_LOCK_ASSERT(xfer->xroot->bus, MA_OWNED);
2393 
2394 	if (pq->curr != xfer) {
2395 		usbd_transfer_enqueue(pq, xfer);
2396 	}
2397 	if (!pq->recurse_1) {
2398 
2399 		/*
2400 	         * We have to postpone the callback due to the fact we
2401 	         * will have a Lock Order Reversal, LOR, if we try to
2402 	         * proceed !
2403 	         */
2404 		(void) usb_proc_msignal(info->done_p,
2405 		    &info->done_m[0], &info->done_m[1]);
2406 	} else {
2407 		/* clear second recurse flag */
2408 		pq->recurse_2 = 0;
2409 	}
2410 	return;
2411 
2412 }
2413 
2414 /*------------------------------------------------------------------------*
2415  *	usbd_callback_wrapper
2416  *
2417  * This is a wrapper for USB callbacks. This wrapper does some
2418  * auto-magic things like figuring out if we can call the callback
2419  * directly from the current context or if we need to wakeup the
2420  * interrupt process.
2421  *------------------------------------------------------------------------*/
2422 static void
2423 usbd_callback_wrapper(struct usb_xfer_queue *pq)
2424 {
2425 	struct usb_xfer *xfer = pq->curr;
2426 	struct usb_xfer_root *info = xfer->xroot;
2427 
2428 	USB_BUS_LOCK_ASSERT(info->bus, MA_OWNED);
2429 	if ((pq->recurse_3 != 0 || mtx_owned(info->xfer_mtx) == 0) &&
2430 	    USB_IN_POLLING_MODE_FUNC() == 0) {
2431 		/*
2432 	       	 * Cases that end up here:
2433 		 *
2434 		 * 5) HW interrupt done callback or other source.
2435 		 * 6) HW completed transfer during callback
2436 		 */
2437 		DPRINTFN(3, "case 5 and 6\n");
2438 
2439 		/*
2440 	         * We have to postpone the callback due to the fact we
2441 	         * will have a Lock Order Reversal, LOR, if we try to
2442 	         * proceed!
2443 		 *
2444 		 * Postponing the callback also ensures that other USB
2445 		 * transfer queues get a chance.
2446 	         */
2447 		(void) usb_proc_msignal(info->done_p,
2448 		    &info->done_m[0], &info->done_m[1]);
2449 		return;
2450 	}
2451 	/*
2452 	 * Cases that end up here:
2453 	 *
2454 	 * 1) We are starting a transfer
2455 	 * 2) We are prematurely calling back a transfer
2456 	 * 3) We are stopping a transfer
2457 	 * 4) We are doing an ordinary callback
2458 	 */
2459 	DPRINTFN(3, "case 1-4\n");
2460 	/* get next USB transfer in the queue */
2461 	info->done_q.curr = NULL;
2462 
2463 	/* set flag in case of drain */
2464 	xfer->flags_int.doing_callback = 1;
2465 
2466 	USB_BUS_UNLOCK(info->bus);
2467 	USB_BUS_LOCK_ASSERT(info->bus, MA_NOTOWNED);
2468 
2469 	/* set correct USB state for callback */
2470 	if (!xfer->flags_int.transferring) {
2471 		xfer->usb_state = USB_ST_SETUP;
2472 		if (!xfer->flags_int.started) {
2473 			/* we got stopped before we even got started */
2474 			USB_BUS_LOCK(info->bus);
2475 			goto done;
2476 		}
2477 	} else {
2478 
2479 		if (usbd_callback_wrapper_sub(xfer)) {
2480 			/* the callback has been deferred */
2481 			USB_BUS_LOCK(info->bus);
2482 			goto done;
2483 		}
2484 #if USB_HAVE_POWERD
2485 		/* decrement power reference */
2486 		usbd_transfer_power_ref(xfer, -1);
2487 #endif
2488 		xfer->flags_int.transferring = 0;
2489 
2490 		if (xfer->error) {
2491 			xfer->usb_state = USB_ST_ERROR;
2492 		} else {
2493 			/* set transferred state */
2494 			xfer->usb_state = USB_ST_TRANSFERRED;
2495 #if USB_HAVE_BUSDMA
2496 			/* sync DMA memory, if any */
2497 			if (xfer->flags_int.bdma_enable &&
2498 			    (!xfer->flags_int.bdma_no_post_sync)) {
2499 				usb_bdma_post_sync(xfer);
2500 			}
2501 #endif
2502 		}
2503 	}
2504 
2505 #if USB_HAVE_PF
2506 	if (xfer->usb_state != USB_ST_SETUP) {
2507 		USB_BUS_LOCK(info->bus);
2508 		usbpf_xfertap(xfer, USBPF_XFERTAP_DONE);
2509 		USB_BUS_UNLOCK(info->bus);
2510 	}
2511 #endif
2512 	/* call processing routine */
2513 	(xfer->callback) (xfer, xfer->error);
2514 
2515 	/* pickup the USB mutex again */
2516 	USB_BUS_LOCK(info->bus);
2517 
2518 	/*
2519 	 * Check if we got started after that we got cancelled, but
2520 	 * before we managed to do the callback.
2521 	 */
2522 	if ((!xfer->flags_int.open) &&
2523 	    (xfer->flags_int.started) &&
2524 	    (xfer->usb_state == USB_ST_ERROR)) {
2525 		/* clear flag in case of drain */
2526 		xfer->flags_int.doing_callback = 0;
2527 		/* try to loop, but not recursivly */
2528 		usb_command_wrapper(&info->done_q, xfer);
2529 		return;
2530 	}
2531 
2532 done:
2533 	/* clear flag in case of drain */
2534 	xfer->flags_int.doing_callback = 0;
2535 
2536 	/*
2537 	 * Check if we are draining.
2538 	 */
2539 	if (xfer->flags_int.draining &&
2540 	    (!xfer->flags_int.transferring)) {
2541 		/* "usbd_transfer_drain()" is waiting for end of transfer */
2542 		xfer->flags_int.draining = 0;
2543 		cv_broadcast(&info->cv_drain);
2544 	}
2545 
2546 	/* do the next callback, if any */
2547 	usb_command_wrapper(&info->done_q,
2548 	    info->done_q.curr);
2549 }
2550 
2551 /*------------------------------------------------------------------------*
2552  *	usb_dma_delay_done_cb
2553  *
2554  * This function is called when the DMA delay has been exectuded, and
2555  * will make sure that the callback is called to complete the USB
2556  * transfer. This code path is usually only used when there is an USB
2557  * error like USB_ERR_CANCELLED.
2558  *------------------------------------------------------------------------*/
2559 void
2560 usb_dma_delay_done_cb(struct usb_xfer *xfer)
2561 {
2562 	USB_BUS_LOCK_ASSERT(xfer->xroot->bus, MA_OWNED);
2563 
2564 	DPRINTFN(3, "Completed %p\n", xfer);
2565 
2566 	/* queue callback for execution, again */
2567 	usbd_transfer_done(xfer, 0);
2568 }
2569 
2570 /*------------------------------------------------------------------------*
2571  *	usbd_transfer_dequeue
2572  *
2573  *  - This function is used to remove an USB transfer from a USB
2574  *  transfer queue.
2575  *
2576  *  - This function can be called multiple times in a row.
2577  *------------------------------------------------------------------------*/
2578 void
2579 usbd_transfer_dequeue(struct usb_xfer *xfer)
2580 {
2581 	struct usb_xfer_queue *pq;
2582 
2583 	pq = xfer->wait_queue;
2584 	if (pq) {
2585 		TAILQ_REMOVE(&pq->head, xfer, wait_entry);
2586 		xfer->wait_queue = NULL;
2587 	}
2588 }
2589 
2590 /*------------------------------------------------------------------------*
2591  *	usbd_transfer_enqueue
2592  *
2593  *  - This function is used to insert an USB transfer into a USB *
2594  *  transfer queue.
2595  *
2596  *  - This function can be called multiple times in a row.
2597  *------------------------------------------------------------------------*/
2598 void
2599 usbd_transfer_enqueue(struct usb_xfer_queue *pq, struct usb_xfer *xfer)
2600 {
2601 	/*
2602 	 * Insert the USB transfer into the queue, if it is not
2603 	 * already on a USB transfer queue:
2604 	 */
2605 	if (xfer->wait_queue == NULL) {
2606 		xfer->wait_queue = pq;
2607 		TAILQ_INSERT_TAIL(&pq->head, xfer, wait_entry);
2608 	}
2609 }
2610 
2611 /*------------------------------------------------------------------------*
2612  *	usbd_transfer_done
2613  *
2614  *  - This function is used to remove an USB transfer from the busdma,
2615  *  pipe or interrupt queue.
2616  *
2617  *  - This function is used to queue the USB transfer on the done
2618  *  queue.
2619  *
2620  *  - This function is used to stop any USB transfer timeouts.
2621  *------------------------------------------------------------------------*/
2622 void
2623 usbd_transfer_done(struct usb_xfer *xfer, usb_error_t error)
2624 {
2625 	struct usb_xfer_root *info = xfer->xroot;
2626 
2627 	USB_BUS_LOCK_ASSERT(info->bus, MA_OWNED);
2628 
2629 	DPRINTF("err=%s\n", usbd_errstr(error));
2630 
2631 	/*
2632 	 * If we are not transferring then just return.
2633 	 * This can happen during transfer cancel.
2634 	 */
2635 	if (!xfer->flags_int.transferring) {
2636 		DPRINTF("not transferring\n");
2637 		/* end of control transfer, if any */
2638 		xfer->flags_int.control_act = 0;
2639 		return;
2640 	}
2641 	/* only set transfer error, if not already set */
2642 	if (xfer->error == USB_ERR_NORMAL_COMPLETION)
2643 		xfer->error = error;
2644 
2645 	/* stop any callouts */
2646 	usb_callout_stop(&xfer->timeout_handle);
2647 
2648 	/*
2649 	 * If we are waiting on a queue, just remove the USB transfer
2650 	 * from the queue, if any. We should have the required locks
2651 	 * locked to do the remove when this function is called.
2652 	 */
2653 	usbd_transfer_dequeue(xfer);
2654 
2655 #if USB_HAVE_BUSDMA
2656 	if (mtx_owned(info->xfer_mtx)) {
2657 		struct usb_xfer_queue *pq;
2658 
2659 		/*
2660 		 * If the private USB lock is not locked, then we assume
2661 		 * that the BUS-DMA load stage has been passed:
2662 		 */
2663 		pq = &info->dma_q;
2664 
2665 		if (pq->curr == xfer) {
2666 			/* start the next BUS-DMA load, if any */
2667 			usb_command_wrapper(pq, NULL);
2668 		}
2669 	}
2670 #endif
2671 	/* keep some statistics */
2672 	if (xfer->error == USB_ERR_CANCELLED) {
2673 		info->udev->stats_cancelled.uds_requests
2674 		    [xfer->endpoint->edesc->bmAttributes & UE_XFERTYPE]++;
2675 	} else if (xfer->error != USB_ERR_NORMAL_COMPLETION) {
2676 		info->udev->stats_err.uds_requests
2677 		    [xfer->endpoint->edesc->bmAttributes & UE_XFERTYPE]++;
2678 	} else {
2679 		info->udev->stats_ok.uds_requests
2680 		    [xfer->endpoint->edesc->bmAttributes & UE_XFERTYPE]++;
2681 	}
2682 
2683 	/* call the USB transfer callback */
2684 	usbd_callback_ss_done_defer(xfer);
2685 }
2686 
2687 /*------------------------------------------------------------------------*
2688  *	usbd_transfer_start_cb
2689  *
2690  * This function is called to start the USB transfer when
2691  * "xfer->interval" is greater than zero, and and the endpoint type is
2692  * BULK or CONTROL.
2693  *------------------------------------------------------------------------*/
2694 static void
2695 usbd_transfer_start_cb(void *arg)
2696 {
2697 	struct usb_xfer *xfer = arg;
2698 	struct usb_endpoint *ep = xfer->endpoint;
2699 
2700 	USB_BUS_LOCK_ASSERT(xfer->xroot->bus, MA_OWNED);
2701 
2702 	DPRINTF("start\n");
2703 
2704 #if USB_HAVE_PF
2705 	usbpf_xfertap(xfer, USBPF_XFERTAP_SUBMIT);
2706 #endif
2707 
2708 	/* the transfer can now be cancelled */
2709 	xfer->flags_int.can_cancel_immed = 1;
2710 
2711 	/* start USB transfer, if no error */
2712 	if (xfer->error == 0)
2713 		(ep->methods->start) (xfer);
2714 
2715 	/* check for transfer error */
2716 	if (xfer->error) {
2717 		/* some error has happened */
2718 		usbd_transfer_done(xfer, 0);
2719 	}
2720 }
2721 
2722 /*------------------------------------------------------------------------*
2723  *	usbd_xfer_set_stall
2724  *
2725  * This function is used to set the stall flag outside the
2726  * callback. This function is NULL safe.
2727  *------------------------------------------------------------------------*/
2728 void
2729 usbd_xfer_set_stall(struct usb_xfer *xfer)
2730 {
2731 	if (xfer == NULL) {
2732 		/* tearing down */
2733 		return;
2734 	}
2735 	USB_XFER_LOCK_ASSERT(xfer, MA_OWNED);
2736 
2737 	/* avoid any races by locking the USB mutex */
2738 	USB_BUS_LOCK(xfer->xroot->bus);
2739 	xfer->flags.stall_pipe = 1;
2740 	USB_BUS_UNLOCK(xfer->xroot->bus);
2741 }
2742 
2743 int
2744 usbd_xfer_is_stalled(struct usb_xfer *xfer)
2745 {
2746 	return (xfer->endpoint->is_stalled);
2747 }
2748 
2749 /*------------------------------------------------------------------------*
2750  *	usbd_transfer_clear_stall
2751  *
2752  * This function is used to clear the stall flag outside the
2753  * callback. This function is NULL safe.
2754  *------------------------------------------------------------------------*/
2755 void
2756 usbd_transfer_clear_stall(struct usb_xfer *xfer)
2757 {
2758 	if (xfer == NULL) {
2759 		/* tearing down */
2760 		return;
2761 	}
2762 	USB_XFER_LOCK_ASSERT(xfer, MA_OWNED);
2763 
2764 	/* avoid any races by locking the USB mutex */
2765 	USB_BUS_LOCK(xfer->xroot->bus);
2766 
2767 	xfer->flags.stall_pipe = 0;
2768 
2769 	USB_BUS_UNLOCK(xfer->xroot->bus);
2770 }
2771 
2772 /*------------------------------------------------------------------------*
2773  *	usbd_pipe_start
2774  *
2775  * This function is used to add an USB transfer to the pipe transfer list.
2776  *------------------------------------------------------------------------*/
2777 void
2778 usbd_pipe_start(struct usb_xfer_queue *pq)
2779 {
2780 	struct usb_endpoint *ep;
2781 	struct usb_xfer *xfer;
2782 	uint8_t type;
2783 
2784 	xfer = pq->curr;
2785 	ep = xfer->endpoint;
2786 
2787 	USB_BUS_LOCK_ASSERT(xfer->xroot->bus, MA_OWNED);
2788 
2789 	/*
2790 	 * If the endpoint is already stalled we do nothing !
2791 	 */
2792 	if (ep->is_stalled) {
2793 		return;
2794 	}
2795 	/*
2796 	 * Check if we are supposed to stall the endpoint:
2797 	 */
2798 	if (xfer->flags.stall_pipe) {
2799 		struct usb_device *udev;
2800 		struct usb_xfer_root *info;
2801 
2802 		/* clear stall command */
2803 		xfer->flags.stall_pipe = 0;
2804 
2805 		/* get pointer to USB device */
2806 		info = xfer->xroot;
2807 		udev = info->udev;
2808 
2809 		/*
2810 		 * Only stall BULK and INTERRUPT endpoints.
2811 		 */
2812 		type = (ep->edesc->bmAttributes & UE_XFERTYPE);
2813 		if ((type == UE_BULK) ||
2814 		    (type == UE_INTERRUPT)) {
2815 			uint8_t did_stall;
2816 
2817 			did_stall = 1;
2818 
2819 			if (udev->flags.usb_mode == USB_MODE_DEVICE) {
2820 				(udev->bus->methods->set_stall) (
2821 				    udev, ep, &did_stall);
2822 			} else if (udev->ctrl_xfer[1]) {
2823 				info = udev->ctrl_xfer[1]->xroot;
2824 				usb_proc_msignal(
2825 				    USB_BUS_CS_PROC(info->bus),
2826 				    &udev->cs_msg[0], &udev->cs_msg[1]);
2827 			} else {
2828 				/* should not happen */
2829 				DPRINTFN(0, "No stall handler\n");
2830 			}
2831 			/*
2832 			 * Check if we should stall. Some USB hardware
2833 			 * handles set- and clear-stall in hardware.
2834 			 */
2835 			if (did_stall) {
2836 				/*
2837 				 * The transfer will be continued when
2838 				 * the clear-stall control endpoint
2839 				 * message is received.
2840 				 */
2841 				ep->is_stalled = 1;
2842 				return;
2843 			}
2844 		} else if (type == UE_ISOCHRONOUS) {
2845 
2846 			/*
2847 			 * Make sure any FIFO overflow or other FIFO
2848 			 * error conditions go away by resetting the
2849 			 * endpoint FIFO through the clear stall
2850 			 * method.
2851 			 */
2852 			if (udev->flags.usb_mode == USB_MODE_DEVICE) {
2853 				(udev->bus->methods->clear_stall) (udev, ep);
2854 			}
2855 		}
2856 	}
2857 	/* Set or clear stall complete - special case */
2858 	if (xfer->nframes == 0) {
2859 		/* we are complete */
2860 		xfer->aframes = 0;
2861 		usbd_transfer_done(xfer, 0);
2862 		return;
2863 	}
2864 	/*
2865 	 * Handled cases:
2866 	 *
2867 	 * 1) Start the first transfer queued.
2868 	 *
2869 	 * 2) Re-start the current USB transfer.
2870 	 */
2871 	/*
2872 	 * Check if there should be any
2873 	 * pre transfer start delay:
2874 	 */
2875 	if (xfer->interval > 0) {
2876 		type = (ep->edesc->bmAttributes & UE_XFERTYPE);
2877 		if ((type == UE_BULK) ||
2878 		    (type == UE_CONTROL)) {
2879 			usbd_transfer_timeout_ms(xfer,
2880 			    &usbd_transfer_start_cb,
2881 			    xfer->interval);
2882 			return;
2883 		}
2884 	}
2885 	DPRINTF("start\n");
2886 
2887 #if USB_HAVE_PF
2888 	usbpf_xfertap(xfer, USBPF_XFERTAP_SUBMIT);
2889 #endif
2890 	/* the transfer can now be cancelled */
2891 	xfer->flags_int.can_cancel_immed = 1;
2892 
2893 	/* start USB transfer, if no error */
2894 	if (xfer->error == 0)
2895 		(ep->methods->start) (xfer);
2896 
2897 	/* check for transfer error */
2898 	if (xfer->error) {
2899 		/* some error has happened */
2900 		usbd_transfer_done(xfer, 0);
2901 	}
2902 }
2903 
2904 /*------------------------------------------------------------------------*
2905  *	usbd_transfer_timeout_ms
2906  *
2907  * This function is used to setup a timeout on the given USB
2908  * transfer. If the timeout has been deferred the callback given by
2909  * "cb" will get called after "ms" milliseconds.
2910  *------------------------------------------------------------------------*/
2911 void
2912 usbd_transfer_timeout_ms(struct usb_xfer *xfer,
2913     void (*cb) (void *arg), usb_timeout_t ms)
2914 {
2915 	USB_BUS_LOCK_ASSERT(xfer->xroot->bus, MA_OWNED);
2916 
2917 	/* defer delay */
2918 	usb_callout_reset(&xfer->timeout_handle,
2919 	    USB_MS_TO_TICKS(ms) + USB_CALLOUT_ZERO_TICKS, cb, xfer);
2920 }
2921 
2922 /*------------------------------------------------------------------------*
2923  *	usbd_callback_wrapper_sub
2924  *
2925  *  - This function will update variables in an USB transfer after
2926  *  that the USB transfer is complete.
2927  *
2928  *  - This function is used to start the next USB transfer on the
2929  *  ep transfer queue, if any.
2930  *
2931  * NOTE: In some special cases the USB transfer will not be removed from
2932  * the pipe queue, but remain first. To enforce USB transfer removal call
2933  * this function passing the error code "USB_ERR_CANCELLED".
2934  *
2935  * Return values:
2936  * 0: Success.
2937  * Else: The callback has been deferred.
2938  *------------------------------------------------------------------------*/
2939 static uint8_t
2940 usbd_callback_wrapper_sub(struct usb_xfer *xfer)
2941 {
2942 	struct usb_endpoint *ep;
2943 	struct usb_bus *bus;
2944 	usb_frcount_t x;
2945 
2946 	bus = xfer->xroot->bus;
2947 
2948 	if ((!xfer->flags_int.open) &&
2949 	    (!xfer->flags_int.did_close)) {
2950 		DPRINTF("close\n");
2951 		USB_BUS_LOCK(bus);
2952 		(xfer->endpoint->methods->close) (xfer);
2953 		USB_BUS_UNLOCK(bus);
2954 		/* only close once */
2955 		xfer->flags_int.did_close = 1;
2956 		return (1);		/* wait for new callback */
2957 	}
2958 	/*
2959 	 * If we have a non-hardware induced error we
2960 	 * need to do the DMA delay!
2961 	 */
2962 	if (xfer->error != 0 && !xfer->flags_int.did_dma_delay &&
2963 	    (xfer->error == USB_ERR_CANCELLED ||
2964 	    xfer->error == USB_ERR_TIMEOUT ||
2965 	    bus->methods->start_dma_delay != NULL)) {
2966 
2967 		usb_timeout_t temp;
2968 
2969 		/* only delay once */
2970 		xfer->flags_int.did_dma_delay = 1;
2971 
2972 		/* we can not cancel this delay */
2973 		xfer->flags_int.can_cancel_immed = 0;
2974 
2975 		temp = usbd_get_dma_delay(xfer->xroot->udev);
2976 
2977 		DPRINTFN(3, "DMA delay, %u ms, "
2978 		    "on %p\n", temp, xfer);
2979 
2980 		if (temp != 0) {
2981 			USB_BUS_LOCK(bus);
2982 			/*
2983 			 * Some hardware solutions have dedicated
2984 			 * events when it is safe to free DMA'ed
2985 			 * memory. For the other hardware platforms we
2986 			 * use a static delay.
2987 			 */
2988 			if (bus->methods->start_dma_delay != NULL) {
2989 				(bus->methods->start_dma_delay) (xfer);
2990 			} else {
2991 				usbd_transfer_timeout_ms(xfer,
2992 				    (void (*)(void *))&usb_dma_delay_done_cb,
2993 				    temp);
2994 			}
2995 			USB_BUS_UNLOCK(bus);
2996 			return (1);	/* wait for new callback */
2997 		}
2998 	}
2999 	/* check actual number of frames */
3000 	if (xfer->aframes > xfer->nframes) {
3001 		if (xfer->error == 0) {
3002 			panic("%s: actual number of frames, %d, is "
3003 			    "greater than initial number of frames, %d\n",
3004 			    __FUNCTION__, xfer->aframes, xfer->nframes);
3005 		} else {
3006 			/* just set some valid value */
3007 			xfer->aframes = xfer->nframes;
3008 		}
3009 	}
3010 	/* compute actual length */
3011 	xfer->actlen = 0;
3012 
3013 	for (x = 0; x != xfer->aframes; x++) {
3014 		xfer->actlen += xfer->frlengths[x];
3015 	}
3016 
3017 	/*
3018 	 * Frames that were not transferred get zero actual length in
3019 	 * case the USB device driver does not check the actual number
3020 	 * of frames transferred, "xfer->aframes":
3021 	 */
3022 	for (; x < xfer->nframes; x++) {
3023 		usbd_xfer_set_frame_len(xfer, x, 0);
3024 	}
3025 
3026 	/* check actual length */
3027 	if (xfer->actlen > xfer->sumlen) {
3028 		if (xfer->error == 0) {
3029 			panic("%s: actual length, %d, is greater than "
3030 			    "initial length, %d\n",
3031 			    __FUNCTION__, xfer->actlen, xfer->sumlen);
3032 		} else {
3033 			/* just set some valid value */
3034 			xfer->actlen = xfer->sumlen;
3035 		}
3036 	}
3037 	DPRINTFN(1, "xfer=%p endpoint=%p sts=%d alen=%d, slen=%d, afrm=%d, nfrm=%d\n",
3038 	    xfer, xfer->endpoint, xfer->error, xfer->actlen, xfer->sumlen,
3039 	    xfer->aframes, xfer->nframes);
3040 
3041 	if (xfer->error) {
3042 		/* end of control transfer, if any */
3043 		xfer->flags_int.control_act = 0;
3044 
3045 #if USB_HAVE_TT_SUPPORT
3046 		switch (xfer->error) {
3047 		case USB_ERR_NORMAL_COMPLETION:
3048 		case USB_ERR_SHORT_XFER:
3049 		case USB_ERR_STALLED:
3050 		case USB_ERR_CANCELLED:
3051 			/* nothing to do */
3052 			break;
3053 		default:
3054 			/* try to reset the TT, if any */
3055 			USB_BUS_LOCK(bus);
3056 			uhub_tt_buffer_reset_async_locked(xfer->xroot->udev, xfer->endpoint);
3057 			USB_BUS_UNLOCK(bus);
3058 			break;
3059 		}
3060 #endif
3061 		/* check if we should block the execution queue */
3062 		if ((xfer->error != USB_ERR_CANCELLED) &&
3063 		    (xfer->flags.pipe_bof)) {
3064 			DPRINTFN(2, "xfer=%p: Block On Failure "
3065 			    "on endpoint=%p\n", xfer, xfer->endpoint);
3066 			goto done;
3067 		}
3068 	} else {
3069 		/* check for short transfers */
3070 		if (xfer->actlen < xfer->sumlen) {
3071 
3072 			/* end of control transfer, if any */
3073 			xfer->flags_int.control_act = 0;
3074 
3075 			if (!xfer->flags_int.short_xfer_ok) {
3076 				xfer->error = USB_ERR_SHORT_XFER;
3077 				if (xfer->flags.pipe_bof) {
3078 					DPRINTFN(2, "xfer=%p: Block On Failure on "
3079 					    "Short Transfer on endpoint %p.\n",
3080 					    xfer, xfer->endpoint);
3081 					goto done;
3082 				}
3083 			}
3084 		} else {
3085 			/*
3086 			 * Check if we are in the middle of a
3087 			 * control transfer:
3088 			 */
3089 			if (xfer->flags_int.control_act) {
3090 				DPRINTFN(5, "xfer=%p: Control transfer "
3091 				    "active on endpoint=%p\n", xfer, xfer->endpoint);
3092 				goto done;
3093 			}
3094 		}
3095 	}
3096 
3097 	ep = xfer->endpoint;
3098 
3099 	/*
3100 	 * If the current USB transfer is completing we need to start the
3101 	 * next one:
3102 	 */
3103 	USB_BUS_LOCK(bus);
3104 	if (ep->endpoint_q[xfer->stream_id].curr == xfer) {
3105 		usb_command_wrapper(&ep->endpoint_q[xfer->stream_id], NULL);
3106 
3107 		if (ep->endpoint_q[xfer->stream_id].curr != NULL ||
3108 		    TAILQ_FIRST(&ep->endpoint_q[xfer->stream_id].head) != NULL) {
3109 			/* there is another USB transfer waiting */
3110 		} else {
3111 			/* this is the last USB transfer */
3112 			/* clear isochronous sync flag */
3113 			xfer->endpoint->is_synced = 0;
3114 		}
3115 	}
3116 	USB_BUS_UNLOCK(bus);
3117 done:
3118 	return (0);
3119 }
3120 
3121 /*------------------------------------------------------------------------*
3122  *	usb_command_wrapper
3123  *
3124  * This function is used to execute commands non-recursivly on an USB
3125  * transfer.
3126  *------------------------------------------------------------------------*/
3127 void
3128 usb_command_wrapper(struct usb_xfer_queue *pq, struct usb_xfer *xfer)
3129 {
3130 	if (xfer) {
3131 		/*
3132 		 * If the transfer is not already processing,
3133 		 * queue it!
3134 		 */
3135 		if (pq->curr != xfer) {
3136 			usbd_transfer_enqueue(pq, xfer);
3137 			if (pq->curr != NULL) {
3138 				/* something is already processing */
3139 				DPRINTFN(6, "busy %p\n", pq->curr);
3140 				return;
3141 			}
3142 		}
3143 	} else {
3144 		/* Get next element in queue */
3145 		pq->curr = NULL;
3146 	}
3147 
3148 	if (!pq->recurse_1) {
3149 
3150 		/* clear third recurse flag */
3151 		pq->recurse_3 = 0;
3152 
3153 		do {
3154 			/* set two first recurse flags */
3155 			pq->recurse_1 = 1;
3156 			pq->recurse_2 = 1;
3157 
3158 			if (pq->curr == NULL) {
3159 				xfer = TAILQ_FIRST(&pq->head);
3160 				if (xfer) {
3161 					TAILQ_REMOVE(&pq->head, xfer,
3162 					    wait_entry);
3163 					xfer->wait_queue = NULL;
3164 					pq->curr = xfer;
3165 				} else {
3166 					break;
3167 				}
3168 			}
3169 			DPRINTFN(6, "cb %p (enter)\n", pq->curr);
3170 			(pq->command) (pq);
3171 			DPRINTFN(6, "cb %p (leave)\n", pq->curr);
3172 
3173 			/*
3174 			 * Set third recurse flag to indicate
3175 			 * recursion happened:
3176 			 */
3177 			pq->recurse_3 = 1;
3178 
3179 		} while (!pq->recurse_2);
3180 
3181 		/* clear first recurse flag */
3182 		pq->recurse_1 = 0;
3183 
3184 	} else {
3185 		/* clear second recurse flag */
3186 		pq->recurse_2 = 0;
3187 	}
3188 }
3189 
3190 /*------------------------------------------------------------------------*
3191  *	usbd_ctrl_transfer_setup
3192  *
3193  * This function is used to setup the default USB control endpoint
3194  * transfer.
3195  *------------------------------------------------------------------------*/
3196 void
3197 usbd_ctrl_transfer_setup(struct usb_device *udev)
3198 {
3199 	struct usb_xfer *xfer;
3200 	uint8_t no_resetup;
3201 	uint8_t iface_index;
3202 
3203 	/* check for root HUB */
3204 	if (udev->parent_hub == NULL)
3205 		return;
3206 repeat:
3207 
3208 	xfer = udev->ctrl_xfer[0];
3209 	if (xfer) {
3210 		USB_XFER_LOCK(xfer);
3211 		no_resetup =
3212 		    ((xfer->address == udev->address) &&
3213 		    (udev->ctrl_ep_desc.wMaxPacketSize[0] ==
3214 		    udev->ddesc.bMaxPacketSize));
3215 		if (udev->flags.usb_mode == USB_MODE_DEVICE) {
3216 			if (no_resetup) {
3217 				/*
3218 				 * NOTE: checking "xfer->address" and
3219 				 * starting the USB transfer must be
3220 				 * atomic!
3221 				 */
3222 				usbd_transfer_start(xfer);
3223 			}
3224 		}
3225 		USB_XFER_UNLOCK(xfer);
3226 	} else {
3227 		no_resetup = 0;
3228 	}
3229 
3230 	if (no_resetup) {
3231 		/*
3232 	         * All parameters are exactly the same like before.
3233 	         * Just return.
3234 	         */
3235 		return;
3236 	}
3237 	/*
3238 	 * Update wMaxPacketSize for the default control endpoint:
3239 	 */
3240 	udev->ctrl_ep_desc.wMaxPacketSize[0] =
3241 	    udev->ddesc.bMaxPacketSize;
3242 
3243 	/*
3244 	 * Unsetup any existing USB transfer:
3245 	 */
3246 	usbd_transfer_unsetup(udev->ctrl_xfer, USB_CTRL_XFER_MAX);
3247 
3248 	/*
3249 	 * Reset clear stall error counter.
3250 	 */
3251 	udev->clear_stall_errors = 0;
3252 
3253 	/*
3254 	 * Try to setup a new USB transfer for the
3255 	 * default control endpoint:
3256 	 */
3257 	iface_index = 0;
3258 	if (usbd_transfer_setup(udev, &iface_index,
3259 	    udev->ctrl_xfer, udev->bus->control_ep_quirk ?
3260 	    usb_control_ep_quirk_cfg : usb_control_ep_cfg, USB_CTRL_XFER_MAX, NULL,
3261 	    &udev->device_mtx)) {
3262 		DPRINTFN(0, "could not setup default "
3263 		    "USB transfer\n");
3264 	} else {
3265 		goto repeat;
3266 	}
3267 }
3268 
3269 /*------------------------------------------------------------------------*
3270  *	usbd_clear_data_toggle - factored out code
3271  *
3272  * NOTE: the intention of this function is not to reset the hardware
3273  * data toggle.
3274  *------------------------------------------------------------------------*/
3275 void
3276 usbd_clear_stall_locked(struct usb_device *udev, struct usb_endpoint *ep)
3277 {
3278 	USB_BUS_LOCK_ASSERT(udev->bus, MA_OWNED);
3279 
3280 	/* check that we have a valid case */
3281 	if (udev->flags.usb_mode == USB_MODE_HOST &&
3282 	    udev->parent_hub != NULL &&
3283 	    udev->bus->methods->clear_stall != NULL &&
3284 	    ep->methods != NULL) {
3285 		(udev->bus->methods->clear_stall) (udev, ep);
3286 	}
3287 }
3288 
3289 /*------------------------------------------------------------------------*
3290  *	usbd_clear_data_toggle - factored out code
3291  *
3292  * NOTE: the intention of this function is not to reset the hardware
3293  * data toggle on the USB device side.
3294  *------------------------------------------------------------------------*/
3295 void
3296 usbd_clear_data_toggle(struct usb_device *udev, struct usb_endpoint *ep)
3297 {
3298 	DPRINTFN(5, "udev=%p endpoint=%p\n", udev, ep);
3299 
3300 	USB_BUS_LOCK(udev->bus);
3301 	ep->toggle_next = 0;
3302 	/* some hardware needs a callback to clear the data toggle */
3303 	usbd_clear_stall_locked(udev, ep);
3304 	USB_BUS_UNLOCK(udev->bus);
3305 }
3306 
3307 /*------------------------------------------------------------------------*
3308  *	usbd_clear_stall_callback - factored out clear stall callback
3309  *
3310  * Input parameters:
3311  *  xfer1: Clear Stall Control Transfer
3312  *  xfer2: Stalled USB Transfer
3313  *
3314  * This function is NULL safe.
3315  *
3316  * Return values:
3317  *   0: In progress
3318  *   Else: Finished
3319  *
3320  * Clear stall config example:
3321  *
3322  * static const struct usb_config my_clearstall =  {
3323  *	.type = UE_CONTROL,
3324  *	.endpoint = 0,
3325  *	.direction = UE_DIR_ANY,
3326  *	.interval = 50, //50 milliseconds
3327  *	.bufsize = sizeof(struct usb_device_request),
3328  *	.timeout = 1000, //1.000 seconds
3329  *	.callback = &my_clear_stall_callback, // **
3330  *	.usb_mode = USB_MODE_HOST,
3331  * };
3332  *
3333  * ** "my_clear_stall_callback" calls "usbd_clear_stall_callback"
3334  * passing the correct parameters.
3335  *------------------------------------------------------------------------*/
3336 uint8_t
3337 usbd_clear_stall_callback(struct usb_xfer *xfer1,
3338     struct usb_xfer *xfer2)
3339 {
3340 	struct usb_device_request req;
3341 
3342 	if (xfer2 == NULL) {
3343 		/* looks like we are tearing down */
3344 		DPRINTF("NULL input parameter\n");
3345 		return (0);
3346 	}
3347 	USB_XFER_LOCK_ASSERT(xfer1, MA_OWNED);
3348 	USB_XFER_LOCK_ASSERT(xfer2, MA_OWNED);
3349 
3350 	switch (USB_GET_STATE(xfer1)) {
3351 	case USB_ST_SETUP:
3352 
3353 		/*
3354 		 * pre-clear the data toggle to DATA0 ("umass.c" and
3355 		 * "ata-usb.c" depends on this)
3356 		 */
3357 
3358 		usbd_clear_data_toggle(xfer2->xroot->udev, xfer2->endpoint);
3359 
3360 		/* setup a clear-stall packet */
3361 
3362 		req.bmRequestType = UT_WRITE_ENDPOINT;
3363 		req.bRequest = UR_CLEAR_FEATURE;
3364 		USETW(req.wValue, UF_ENDPOINT_HALT);
3365 		req.wIndex[0] = xfer2->endpoint->edesc->bEndpointAddress;
3366 		req.wIndex[1] = 0;
3367 		USETW(req.wLength, 0);
3368 
3369 		/*
3370 		 * "usbd_transfer_setup_sub()" will ensure that
3371 		 * we have sufficient room in the buffer for
3372 		 * the request structure!
3373 		 */
3374 
3375 		/* copy in the transfer */
3376 
3377 		usbd_copy_in(xfer1->frbuffers, 0, &req, sizeof(req));
3378 
3379 		/* set length */
3380 		xfer1->frlengths[0] = sizeof(req);
3381 		xfer1->nframes = 1;
3382 
3383 		usbd_transfer_submit(xfer1);
3384 		return (0);
3385 
3386 	case USB_ST_TRANSFERRED:
3387 		break;
3388 
3389 	default:			/* Error */
3390 		if (xfer1->error == USB_ERR_CANCELLED) {
3391 			return (0);
3392 		}
3393 		break;
3394 	}
3395 	return (1);			/* Clear Stall Finished */
3396 }
3397 
3398 /*------------------------------------------------------------------------*
3399  *	usbd_transfer_poll
3400  *
3401  * The following function gets called from the USB keyboard driver and
3402  * UMASS when the system has paniced.
3403  *
3404  * NOTE: It is currently not possible to resume normal operation on
3405  * the USB controller which has been polled, due to clearing of the
3406  * "up_dsleep" and "up_msleep" flags.
3407  *------------------------------------------------------------------------*/
3408 void
3409 usbd_transfer_poll(struct usb_xfer **ppxfer, uint16_t max)
3410 {
3411 	struct usb_xfer *xfer;
3412 	struct usb_xfer_root *xroot;
3413 	struct usb_device *udev;
3414 	struct usb_proc_msg *pm;
3415 	struct usb_bus *bus;
3416 	uint16_t n;
3417 	uint16_t drop_bus_spin;
3418 	uint16_t drop_bus;
3419 	uint16_t drop_xfer;
3420 
3421 	for (n = 0; n != max; n++) {
3422 		/* Extra checks to avoid panic */
3423 		xfer = ppxfer[n];
3424 		if (xfer == NULL)
3425 			continue;	/* no USB transfer */
3426 		xroot = xfer->xroot;
3427 		if (xroot == NULL)
3428 			continue;	/* no USB root */
3429 		udev = xroot->udev;
3430 		if (udev == NULL)
3431 			continue;	/* no USB device */
3432 		bus = udev->bus;
3433 		if (bus == NULL)
3434 			continue;	/* no BUS structure */
3435 		if (bus->methods == NULL)
3436 			continue;	/* no BUS methods */
3437 		if (bus->methods->xfer_poll == NULL)
3438 			continue;	/* no poll method */
3439 
3440 		drop_bus_spin = 0;
3441 		drop_bus = 0;
3442 		drop_xfer = 0;
3443 
3444 		if (USB_IN_POLLING_MODE_FUNC() == 0) {
3445 			/* make sure that the BUS spin mutex is not locked */
3446 			while (mtx_owned(&bus->bus_spin_lock)) {
3447 				mtx_unlock_spin(&bus->bus_spin_lock);
3448 				drop_bus_spin++;
3449 			}
3450 
3451 			/* make sure that the BUS mutex is not locked */
3452 			while (mtx_owned(&bus->bus_mtx)) {
3453 				mtx_unlock(&bus->bus_mtx);
3454 				drop_bus++;
3455 			}
3456 
3457 			/* make sure that the transfer mutex is not locked */
3458 			while (mtx_owned(xroot->xfer_mtx)) {
3459 				mtx_unlock(xroot->xfer_mtx);
3460 				drop_xfer++;
3461 			}
3462 		}
3463 
3464 		/* Make sure cv_signal() and cv_broadcast() is not called */
3465 		USB_BUS_CONTROL_XFER_PROC(bus)->up_msleep = 0;
3466 		USB_BUS_EXPLORE_PROC(bus)->up_msleep = 0;
3467 		USB_BUS_GIANT_PROC(bus)->up_msleep = 0;
3468 		USB_BUS_NON_GIANT_ISOC_PROC(bus)->up_msleep = 0;
3469 		USB_BUS_NON_GIANT_BULK_PROC(bus)->up_msleep = 0;
3470 
3471 		/* poll USB hardware */
3472 		(bus->methods->xfer_poll) (bus);
3473 
3474 		USB_BUS_LOCK(xroot->bus);
3475 
3476 		/* check for clear stall */
3477 		if (udev->ctrl_xfer[1] != NULL) {
3478 
3479 			/* poll clear stall start */
3480 			pm = &udev->cs_msg[0].hdr;
3481 			(pm->pm_callback) (pm);
3482 			/* poll clear stall done thread */
3483 			pm = &udev->ctrl_xfer[1]->
3484 			    xroot->done_m[0].hdr;
3485 			(pm->pm_callback) (pm);
3486 		}
3487 
3488 		/* poll done thread */
3489 		pm = &xroot->done_m[0].hdr;
3490 		(pm->pm_callback) (pm);
3491 
3492 		USB_BUS_UNLOCK(xroot->bus);
3493 
3494 		/* restore transfer mutex */
3495 		while (drop_xfer--)
3496 			mtx_lock(xroot->xfer_mtx);
3497 
3498 		/* restore BUS mutex */
3499 		while (drop_bus--)
3500 			mtx_lock(&bus->bus_mtx);
3501 
3502 		/* restore BUS spin mutex */
3503 		while (drop_bus_spin--)
3504 			mtx_lock_spin(&bus->bus_spin_lock);
3505 	}
3506 }
3507 
3508 static void
3509 usbd_get_std_packet_size(struct usb_std_packet_size *ptr,
3510     uint8_t type, enum usb_dev_speed speed)
3511 {
3512 	static const uint16_t intr_range_max[USB_SPEED_MAX] = {
3513 		[USB_SPEED_LOW] = 8,
3514 		[USB_SPEED_FULL] = 64,
3515 		[USB_SPEED_HIGH] = 1024,
3516 		[USB_SPEED_VARIABLE] = 1024,
3517 		[USB_SPEED_SUPER] = 1024,
3518 	};
3519 
3520 	static const uint16_t isoc_range_max[USB_SPEED_MAX] = {
3521 		[USB_SPEED_LOW] = 0,	/* invalid */
3522 		[USB_SPEED_FULL] = 1023,
3523 		[USB_SPEED_HIGH] = 1024,
3524 		[USB_SPEED_VARIABLE] = 3584,
3525 		[USB_SPEED_SUPER] = 1024,
3526 	};
3527 
3528 	static const uint16_t control_min[USB_SPEED_MAX] = {
3529 		[USB_SPEED_LOW] = 8,
3530 		[USB_SPEED_FULL] = 8,
3531 		[USB_SPEED_HIGH] = 64,
3532 		[USB_SPEED_VARIABLE] = 512,
3533 		[USB_SPEED_SUPER] = 512,
3534 	};
3535 
3536 	static const uint16_t bulk_min[USB_SPEED_MAX] = {
3537 		[USB_SPEED_LOW] = 8,
3538 		[USB_SPEED_FULL] = 8,
3539 		[USB_SPEED_HIGH] = 512,
3540 		[USB_SPEED_VARIABLE] = 512,
3541 		[USB_SPEED_SUPER] = 1024,
3542 	};
3543 
3544 	uint16_t temp;
3545 
3546 	memset(ptr, 0, sizeof(*ptr));
3547 
3548 	switch (type) {
3549 	case UE_INTERRUPT:
3550 		ptr->range.max = intr_range_max[speed];
3551 		break;
3552 	case UE_ISOCHRONOUS:
3553 		ptr->range.max = isoc_range_max[speed];
3554 		break;
3555 	default:
3556 		if (type == UE_BULK)
3557 			temp = bulk_min[speed];
3558 		else /* UE_CONTROL */
3559 			temp = control_min[speed];
3560 
3561 		/* default is fixed */
3562 		ptr->fixed[0] = temp;
3563 		ptr->fixed[1] = temp;
3564 		ptr->fixed[2] = temp;
3565 		ptr->fixed[3] = temp;
3566 
3567 		if (speed == USB_SPEED_FULL) {
3568 			/* multiple sizes */
3569 			ptr->fixed[1] = 16;
3570 			ptr->fixed[2] = 32;
3571 			ptr->fixed[3] = 64;
3572 		}
3573 		if ((speed == USB_SPEED_VARIABLE) &&
3574 		    (type == UE_BULK)) {
3575 			/* multiple sizes */
3576 			ptr->fixed[2] = 1024;
3577 			ptr->fixed[3] = 1536;
3578 		}
3579 		break;
3580 	}
3581 }
3582 
3583 void	*
3584 usbd_xfer_softc(struct usb_xfer *xfer)
3585 {
3586 	return (xfer->priv_sc);
3587 }
3588 
3589 void *
3590 usbd_xfer_get_priv(struct usb_xfer *xfer)
3591 {
3592 	return (xfer->priv_fifo);
3593 }
3594 
3595 void
3596 usbd_xfer_set_priv(struct usb_xfer *xfer, void *ptr)
3597 {
3598 	xfer->priv_fifo = ptr;
3599 }
3600 
3601 uint8_t
3602 usbd_xfer_state(struct usb_xfer *xfer)
3603 {
3604 	return (xfer->usb_state);
3605 }
3606 
3607 void
3608 usbd_xfer_set_flag(struct usb_xfer *xfer, int flag)
3609 {
3610 	switch (flag) {
3611 		case USB_FORCE_SHORT_XFER:
3612 			xfer->flags.force_short_xfer = 1;
3613 			break;
3614 		case USB_SHORT_XFER_OK:
3615 			xfer->flags.short_xfer_ok = 1;
3616 			break;
3617 		case USB_MULTI_SHORT_OK:
3618 			xfer->flags.short_frames_ok = 1;
3619 			break;
3620 		case USB_MANUAL_STATUS:
3621 			xfer->flags.manual_status = 1;
3622 			break;
3623 	}
3624 }
3625 
3626 void
3627 usbd_xfer_clr_flag(struct usb_xfer *xfer, int flag)
3628 {
3629 	switch (flag) {
3630 		case USB_FORCE_SHORT_XFER:
3631 			xfer->flags.force_short_xfer = 0;
3632 			break;
3633 		case USB_SHORT_XFER_OK:
3634 			xfer->flags.short_xfer_ok = 0;
3635 			break;
3636 		case USB_MULTI_SHORT_OK:
3637 			xfer->flags.short_frames_ok = 0;
3638 			break;
3639 		case USB_MANUAL_STATUS:
3640 			xfer->flags.manual_status = 0;
3641 			break;
3642 	}
3643 }
3644 
3645 /*
3646  * The following function returns in milliseconds when the isochronous
3647  * transfer was completed by the hardware. The returned value wraps
3648  * around 65536 milliseconds.
3649  */
3650 uint16_t
3651 usbd_xfer_get_timestamp(struct usb_xfer *xfer)
3652 {
3653 	return (xfer->isoc_time_complete);
3654 }
3655 
3656 /*
3657  * The following function returns non-zero if the max packet size
3658  * field was clamped to a valid value. Else it returns zero.
3659  */
3660 uint8_t
3661 usbd_xfer_maxp_was_clamped(struct usb_xfer *xfer)
3662 {
3663 	return (xfer->flags_int.maxp_was_clamped);
3664 }
3665