xref: /netbsd-src/sys/dev/usb/ugen.c (revision ce2c90c7c172d95d2402a5b3d96d8f8e6d138a21)
1 /*	$NetBSD: ugen.c,v 1.87 2006/10/12 17:50:07 xtraeme Exp $	*/
2 
3 /*
4  * Copyright (c) 1998, 2004 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Lennart Augustsson (lennart@augustsson.net) at
9  * Carlstedt Research & Technology.
10  *
11  * Copyright (c) 2006 BBN Technologies Corp.  All rights reserved.
12  * Effort sponsored in part by the Defense Advanced Research Projects
13  * Agency (DARPA) and the Department of the Interior National Business
14  * Center under agreement number NBCHC050166.
15  *
16  * Redistribution and use in source and binary forms, with or without
17  * modification, are permitted provided that the following conditions
18  * are met:
19  * 1. Redistributions of source code must retain the above copyright
20  *    notice, this list of conditions and the following disclaimer.
21  * 2. Redistributions in binary form must reproduce the above copyright
22  *    notice, this list of conditions and the following disclaimer in the
23  *    documentation and/or other materials provided with the distribution.
24  * 3. All advertising materials mentioning features or use of this software
25  *    must display the following acknowledgement:
26  *	This product includes software developed by the NetBSD
27  *	Foundation, Inc. and its contributors.
28  * 4. Neither the name of The NetBSD Foundation nor the names of its
29  *    contributors may be used to endorse or promote products derived
30  *    from this software without specific prior written permission.
31  *
32  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
33  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
34  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
35  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
36  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
37  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
38  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
39  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
40  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
41  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
42  * POSSIBILITY OF SUCH DAMAGE.
43  */
44 
45 
46 #include <sys/cdefs.h>
47 __KERNEL_RCSID(0, "$NetBSD: ugen.c,v 1.87 2006/10/12 17:50:07 xtraeme Exp $");
48 
49 #include "opt_ugen_bulk_ra_wb.h"
50 
51 #include <sys/param.h>
52 #include <sys/systm.h>
53 #include <sys/kernel.h>
54 #include <sys/malloc.h>
55 #if defined(__NetBSD__) || defined(__OpenBSD__)
56 #include <sys/device.h>
57 #include <sys/ioctl.h>
58 #elif defined(__FreeBSD__)
59 #include <sys/module.h>
60 #include <sys/bus.h>
61 #include <sys/ioccom.h>
62 #include <sys/conf.h>
63 #include <sys/fcntl.h>
64 #include <sys/filio.h>
65 #endif
66 #include <sys/conf.h>
67 #include <sys/tty.h>
68 #include <sys/file.h>
69 #include <sys/select.h>
70 #include <sys/proc.h>
71 #include <sys/vnode.h>
72 #include <sys/poll.h>
73 
74 #include <dev/usb/usb.h>
75 #include <dev/usb/usbdi.h>
76 #include <dev/usb/usbdi_util.h>
77 
78 #ifdef UGEN_DEBUG
79 #define DPRINTF(x)	if (ugendebug) logprintf x
80 #define DPRINTFN(n,x)	if (ugendebug>(n)) logprintf x
81 int	ugendebug = 0;
82 #else
83 #define DPRINTF(x)
84 #define DPRINTFN(n,x)
85 #endif
86 
87 #define	UGEN_CHUNK	128	/* chunk size for read */
88 #define	UGEN_IBSIZE	1020	/* buffer size */
89 #define	UGEN_BBSIZE	1024
90 
91 #define	UGEN_NISOFRAMES	500	/* 0.5 seconds worth */
92 #define UGEN_NISOREQS	6	/* number of outstanding xfer requests */
93 #define UGEN_NISORFRMS	4	/* number of frames (miliseconds) per req */
94 
95 #define UGEN_BULK_RA_WB_BUFSIZE	16384		/* default buffer size */
96 #define UGEN_BULK_RA_WB_BUFMAX	(1 << 20)	/* maximum allowed buffer */
97 
98 struct ugen_endpoint {
99 	struct ugen_softc *sc;
100 	usb_endpoint_descriptor_t *edesc;
101 	usbd_interface_handle iface;
102 	int state;
103 #define	UGEN_ASLP	0x02	/* waiting for data */
104 #define UGEN_SHORT_OK	0x04	/* short xfers are OK */
105 #define UGEN_BULK_RA	0x08	/* in bulk read-ahead mode */
106 #define UGEN_BULK_WB	0x10	/* in bulk write-behind mode */
107 #define UGEN_RA_WB_STOP	0x20	/* RA/WB xfer is stopped (buffer full/empty) */
108 	usbd_pipe_handle pipeh;
109 	struct clist q;
110 	struct selinfo rsel;
111 	u_char *ibuf;		/* start of buffer (circular for isoc) */
112 	u_char *fill;		/* location for input (isoc) */
113 	u_char *limit;		/* end of circular buffer (isoc) */
114 	u_char *cur;		/* current read location (isoc) */
115 	u_int32_t timeout;
116 #ifdef UGEN_BULK_RA_WB
117 	u_int32_t ra_wb_bufsize; /* requested size for RA/WB buffer */
118 	u_int32_t ra_wb_reqsize; /* requested xfer length for RA/WB */
119 	u_int32_t ra_wb_used;	 /* how much is in buffer */
120 	u_int32_t ra_wb_xferlen; /* current xfer length for RA/WB */
121 	usbd_xfer_handle ra_wb_xfer;
122 #endif
123 	struct isoreq {
124 		struct ugen_endpoint *sce;
125 		usbd_xfer_handle xfer;
126 		void *dmabuf;
127 		u_int16_t sizes[UGEN_NISORFRMS];
128 	} isoreqs[UGEN_NISOREQS];
129 };
130 
131 struct ugen_softc {
132 	USBBASEDEVICE sc_dev;		/* base device */
133 	usbd_device_handle sc_udev;
134 
135 	char sc_is_open[USB_MAX_ENDPOINTS];
136 	struct ugen_endpoint sc_endpoints[USB_MAX_ENDPOINTS][2];
137 #define OUT 0
138 #define IN  1
139 
140 	int sc_refcnt;
141 	char sc_buffer[UGEN_BBSIZE];
142 	u_char sc_dying;
143 };
144 
145 #if defined(__NetBSD__)
146 dev_type_open(ugenopen);
147 dev_type_close(ugenclose);
148 dev_type_read(ugenread);
149 dev_type_write(ugenwrite);
150 dev_type_ioctl(ugenioctl);
151 dev_type_poll(ugenpoll);
152 dev_type_kqfilter(ugenkqfilter);
153 
154 const struct cdevsw ugen_cdevsw = {
155 	ugenopen, ugenclose, ugenread, ugenwrite, ugenioctl,
156 	nostop, notty, ugenpoll, nommap, ugenkqfilter, D_OTHER,
157 };
158 #elif defined(__OpenBSD__)
159 cdev_decl(ugen);
160 #elif defined(__FreeBSD__)
161 d_open_t  ugenopen;
162 d_close_t ugenclose;
163 d_read_t  ugenread;
164 d_write_t ugenwrite;
165 d_ioctl_t ugenioctl;
166 d_poll_t  ugenpoll;
167 
168 #define UGEN_CDEV_MAJOR	114
169 
170 Static struct cdevsw ugen_cdevsw = {
171 	/* open */	ugenopen,
172 	/* close */	ugenclose,
173 	/* read */	ugenread,
174 	/* write */	ugenwrite,
175 	/* ioctl */	ugenioctl,
176 	/* poll */	ugenpoll,
177 	/* mmap */	nommap,
178 	/* strategy */	nostrategy,
179 	/* name */	"ugen",
180 	/* maj */	UGEN_CDEV_MAJOR,
181 	/* dump */	nodump,
182 	/* psize */	nopsize,
183 	/* flags */	0,
184 	/* bmaj */	-1
185 };
186 #endif
187 
188 Static void ugenintr(usbd_xfer_handle xfer, usbd_private_handle addr,
189 		     usbd_status status);
190 Static void ugen_isoc_rintr(usbd_xfer_handle xfer, usbd_private_handle addr,
191 			    usbd_status status);
192 #ifdef UGEN_BULK_RA_WB
193 Static void ugen_bulkra_intr(usbd_xfer_handle xfer, usbd_private_handle addr,
194 			     usbd_status status);
195 Static void ugen_bulkwb_intr(usbd_xfer_handle xfer, usbd_private_handle addr,
196 			     usbd_status status);
197 #endif
198 Static int ugen_do_read(struct ugen_softc *, int, struct uio *, int);
199 Static int ugen_do_write(struct ugen_softc *, int, struct uio *, int);
200 Static int ugen_do_ioctl(struct ugen_softc *, int, u_long,
201 			 caddr_t, int, struct lwp *);
202 Static int ugen_set_config(struct ugen_softc *sc, int configno);
203 Static usb_config_descriptor_t *ugen_get_cdesc(struct ugen_softc *sc,
204 					       int index, int *lenp);
205 Static usbd_status ugen_set_interface(struct ugen_softc *, int, int);
206 Static int ugen_get_alt_index(struct ugen_softc *sc, int ifaceidx);
207 
208 #define UGENUNIT(n) ((minor(n) >> 4) & 0xf)
209 #define UGENENDPOINT(n) (minor(n) & 0xf)
210 #define UGENDEV(u, e) (makedev(0, ((u) << 4) | (e)))
211 
212 USB_DECLARE_DRIVER(ugen);
213 
214 USB_MATCH(ugen)
215 {
216 	USB_MATCH_START(ugen, uaa);
217 
218 	if (match->cf_flags & 1)
219 		return (UMATCH_HIGHEST);
220 	else if (uaa->usegeneric)
221 		return (UMATCH_GENERIC);
222 	else
223 		return (UMATCH_NONE);
224 }
225 
226 USB_ATTACH(ugen)
227 {
228 	USB_ATTACH_START(ugen, sc, uaa);
229 	usbd_device_handle udev;
230 	char *devinfop;
231 	usbd_status err;
232 	int conf;
233 
234 	devinfop = usbd_devinfo_alloc(uaa->device, 0);
235 	USB_ATTACH_SETUP;
236 	printf("%s: %s\n", USBDEVNAME(sc->sc_dev), devinfop);
237 	usbd_devinfo_free(devinfop);
238 
239 	sc->sc_udev = udev = uaa->device;
240 
241 	/* First set configuration index 0, the default one for ugen. */
242 	err = usbd_set_config_index(udev, 0, 0);
243 	if (err) {
244 		printf("%s: setting configuration index 0 failed\n",
245 		       USBDEVNAME(sc->sc_dev));
246 		sc->sc_dying = 1;
247 		USB_ATTACH_ERROR_RETURN;
248 	}
249 	conf = usbd_get_config_descriptor(udev)->bConfigurationValue;
250 
251 	/* Set up all the local state for this configuration. */
252 	err = ugen_set_config(sc, conf);
253 	if (err) {
254 		printf("%s: setting configuration %d failed\n",
255 		       USBDEVNAME(sc->sc_dev), conf);
256 		sc->sc_dying = 1;
257 		USB_ATTACH_ERROR_RETURN;
258 	}
259 
260 #ifdef __FreeBSD__
261 	{
262 		static int global_init_done = 0;
263 		if (!global_init_done) {
264 			cdevsw_add(&ugen_cdevsw);
265 			global_init_done = 1;
266 		}
267 	}
268 #endif
269 
270 	usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev,
271 			   USBDEV(sc->sc_dev));
272 
273 	USB_ATTACH_SUCCESS_RETURN;
274 }
275 
276 Static int
277 ugen_set_config(struct ugen_softc *sc, int configno)
278 {
279 	usbd_device_handle dev = sc->sc_udev;
280 	usbd_interface_handle iface;
281 	usb_endpoint_descriptor_t *ed;
282 	struct ugen_endpoint *sce;
283 	u_int8_t niface, nendpt;
284 	int ifaceno, endptno, endpt;
285 	usbd_status err;
286 	int dir;
287 
288 	DPRINTFN(1,("ugen_set_config: %s to configno %d, sc=%p\n",
289 		    USBDEVNAME(sc->sc_dev), configno, sc));
290 
291 	/*
292 	 * We start at 1, not 0, because we don't care whether the
293 	 * control endpoint is open or not. It is always present.
294 	 */
295 	for (endptno = 1; endptno < USB_MAX_ENDPOINTS; endptno++)
296 		if (sc->sc_is_open[endptno]) {
297 			DPRINTFN(1,
298 			     ("ugen_set_config: %s - endpoint %d is open\n",
299 			      USBDEVNAME(sc->sc_dev), endptno));
300 			return (USBD_IN_USE);
301 		}
302 
303 	/* Avoid setting the current value. */
304 	if (usbd_get_config_descriptor(dev)->bConfigurationValue != configno) {
305 		err = usbd_set_config_no(dev, configno, 1);
306 		if (err)
307 			return (err);
308 	}
309 
310 	err = usbd_interface_count(dev, &niface);
311 	if (err)
312 		return (err);
313 	memset(sc->sc_endpoints, 0, sizeof sc->sc_endpoints);
314 	for (ifaceno = 0; ifaceno < niface; ifaceno++) {
315 		DPRINTFN(1,("ugen_set_config: ifaceno %d\n", ifaceno));
316 		err = usbd_device2interface_handle(dev, ifaceno, &iface);
317 		if (err)
318 			return (err);
319 		err = usbd_endpoint_count(iface, &nendpt);
320 		if (err)
321 			return (err);
322 		for (endptno = 0; endptno < nendpt; endptno++) {
323 			ed = usbd_interface2endpoint_descriptor(iface,endptno);
324 			KASSERT(ed != NULL);
325 			endpt = ed->bEndpointAddress;
326 			dir = UE_GET_DIR(endpt) == UE_DIR_IN ? IN : OUT;
327 			sce = &sc->sc_endpoints[UE_GET_ADDR(endpt)][dir];
328 			DPRINTFN(1,("ugen_set_config: endptno %d, endpt=0x%02x"
329 				    "(%d,%d), sce=%p\n",
330 				    endptno, endpt, UE_GET_ADDR(endpt),
331 				    UE_GET_DIR(endpt), sce));
332 			sce->sc = sc;
333 			sce->edesc = ed;
334 			sce->iface = iface;
335 		}
336 	}
337 	return (USBD_NORMAL_COMPLETION);
338 }
339 
340 int
341 ugenopen(dev_t dev, int flag, int mode __unused, struct lwp *l __unused)
342 {
343 	struct ugen_softc *sc;
344 	int unit = UGENUNIT(dev);
345 	int endpt = UGENENDPOINT(dev);
346 	usb_endpoint_descriptor_t *edesc;
347 	struct ugen_endpoint *sce;
348 	int dir, isize;
349 	usbd_status err;
350 	usbd_xfer_handle xfer;
351 	void *tbuf;
352 	int i, j;
353 
354 	USB_GET_SC_OPEN(ugen, unit, sc);
355 
356 	DPRINTFN(5, ("ugenopen: flag=%d, mode=%d, unit=%d endpt=%d\n",
357 		     flag, mode, unit, endpt));
358 
359 	if (sc == NULL || sc->sc_dying)
360 		return (ENXIO);
361 
362 	/* The control endpoint allows multiple opens. */
363 	if (endpt == USB_CONTROL_ENDPOINT) {
364 		sc->sc_is_open[USB_CONTROL_ENDPOINT] = 1;
365 		return (0);
366 	}
367 
368 	if (sc->sc_is_open[endpt])
369 		return (EBUSY);
370 
371 	/* Make sure there are pipes for all directions. */
372 	for (dir = OUT; dir <= IN; dir++) {
373 		if (flag & (dir == OUT ? FWRITE : FREAD)) {
374 			sce = &sc->sc_endpoints[endpt][dir];
375 			if (sce == 0 || sce->edesc == 0)
376 				return (ENXIO);
377 		}
378 	}
379 
380 	/* Actually open the pipes. */
381 	/* XXX Should back out properly if it fails. */
382 	for (dir = OUT; dir <= IN; dir++) {
383 		if (!(flag & (dir == OUT ? FWRITE : FREAD)))
384 			continue;
385 		sce = &sc->sc_endpoints[endpt][dir];
386 		sce->state = 0;
387 		sce->timeout = USBD_NO_TIMEOUT;
388 		DPRINTFN(5, ("ugenopen: sc=%p, endpt=%d, dir=%d, sce=%p\n",
389 			     sc, endpt, dir, sce));
390 		edesc = sce->edesc;
391 		switch (edesc->bmAttributes & UE_XFERTYPE) {
392 		case UE_INTERRUPT:
393 			if (dir == OUT) {
394 				err = usbd_open_pipe(sce->iface,
395 				    edesc->bEndpointAddress, 0, &sce->pipeh);
396 				if (err)
397 					return (EIO);
398 				break;
399 			}
400 			isize = UGETW(edesc->wMaxPacketSize);
401 			if (isize == 0)	/* shouldn't happen */
402 				return (EINVAL);
403 			sce->ibuf = malloc(isize, M_USBDEV, M_WAITOK);
404 			DPRINTFN(5, ("ugenopen: intr endpt=%d,isize=%d\n",
405 				     endpt, isize));
406 			if (clalloc(&sce->q, UGEN_IBSIZE, 0) == -1)
407 				return (ENOMEM);
408 			err = usbd_open_pipe_intr(sce->iface,
409 				  edesc->bEndpointAddress,
410 				  USBD_SHORT_XFER_OK, &sce->pipeh, sce,
411 				  sce->ibuf, isize, ugenintr,
412 				  USBD_DEFAULT_INTERVAL);
413 			if (err) {
414 				free(sce->ibuf, M_USBDEV);
415 				clfree(&sce->q);
416 				return (EIO);
417 			}
418 			DPRINTFN(5, ("ugenopen: interrupt open done\n"));
419 			break;
420 		case UE_BULK:
421 			err = usbd_open_pipe(sce->iface,
422 				  edesc->bEndpointAddress, 0, &sce->pipeh);
423 			if (err)
424 				return (EIO);
425 #ifdef UGEN_BULK_RA_WB
426 			sce->ra_wb_bufsize = UGEN_BULK_RA_WB_BUFSIZE;
427 			/*
428 			 * Use request size for non-RA/WB transfers
429 			 * as the default.
430 			 */
431 			sce->ra_wb_reqsize = UGEN_BBSIZE;
432 #endif
433 			break;
434 		case UE_ISOCHRONOUS:
435 			if (dir == OUT)
436 				return (EINVAL);
437 			isize = UGETW(edesc->wMaxPacketSize);
438 			if (isize == 0)	/* shouldn't happen */
439 				return (EINVAL);
440 			sce->ibuf = malloc(isize * UGEN_NISOFRAMES,
441 				M_USBDEV, M_WAITOK);
442 			sce->cur = sce->fill = sce->ibuf;
443 			sce->limit = sce->ibuf + isize * UGEN_NISOFRAMES;
444 			DPRINTFN(5, ("ugenopen: isoc endpt=%d, isize=%d\n",
445 				     endpt, isize));
446 			err = usbd_open_pipe(sce->iface,
447 				  edesc->bEndpointAddress, 0, &sce->pipeh);
448 			if (err) {
449 				free(sce->ibuf, M_USBDEV);
450 				return (EIO);
451 			}
452 			for(i = 0; i < UGEN_NISOREQS; ++i) {
453 				sce->isoreqs[i].sce = sce;
454 				xfer = usbd_alloc_xfer(sc->sc_udev);
455 				if (xfer == 0)
456 					goto bad;
457 				sce->isoreqs[i].xfer = xfer;
458 				tbuf = usbd_alloc_buffer
459 					(xfer, isize * UGEN_NISORFRMS);
460 				if (tbuf == 0) {
461 					i++;
462 					goto bad;
463 				}
464 				sce->isoreqs[i].dmabuf = tbuf;
465 				for(j = 0; j < UGEN_NISORFRMS; ++j)
466 					sce->isoreqs[i].sizes[j] = isize;
467 				usbd_setup_isoc_xfer
468 					(xfer, sce->pipeh, &sce->isoreqs[i],
469 					 sce->isoreqs[i].sizes,
470 					 UGEN_NISORFRMS, USBD_NO_COPY,
471 					 ugen_isoc_rintr);
472 				(void)usbd_transfer(xfer);
473 			}
474 			DPRINTFN(5, ("ugenopen: isoc open done\n"));
475 			break;
476 		bad:
477 			while (--i >= 0) /* implicit buffer free */
478 				usbd_free_xfer(sce->isoreqs[i].xfer);
479 			return (ENOMEM);
480 		case UE_CONTROL:
481 			sce->timeout = USBD_DEFAULT_TIMEOUT;
482 			return (EINVAL);
483 		}
484 	}
485 	sc->sc_is_open[endpt] = 1;
486 	return (0);
487 }
488 
489 int
490 ugenclose(dev_t dev, int flag, int mode __unused, struct lwp *l __unused)
491 {
492 	int endpt = UGENENDPOINT(dev);
493 	struct ugen_softc *sc;
494 	struct ugen_endpoint *sce;
495 	int dir;
496 	int i;
497 
498 	USB_GET_SC(ugen, UGENUNIT(dev), sc);
499 
500 	DPRINTFN(5, ("ugenclose: flag=%d, mode=%d, unit=%d, endpt=%d\n",
501 		     flag, mode, UGENUNIT(dev), endpt));
502 
503 #ifdef DIAGNOSTIC
504 	if (!sc->sc_is_open[endpt]) {
505 		printf("ugenclose: not open\n");
506 		return (EINVAL);
507 	}
508 #endif
509 
510 	if (endpt == USB_CONTROL_ENDPOINT) {
511 		DPRINTFN(5, ("ugenclose: close control\n"));
512 		sc->sc_is_open[endpt] = 0;
513 		return (0);
514 	}
515 
516 	for (dir = OUT; dir <= IN; dir++) {
517 		if (!(flag & (dir == OUT ? FWRITE : FREAD)))
518 			continue;
519 		sce = &sc->sc_endpoints[endpt][dir];
520 		if (sce == NULL || sce->pipeh == NULL)
521 			continue;
522 		DPRINTFN(5, ("ugenclose: endpt=%d dir=%d sce=%p\n",
523 			     endpt, dir, sce));
524 
525 		usbd_abort_pipe(sce->pipeh);
526 		usbd_close_pipe(sce->pipeh);
527 		sce->pipeh = NULL;
528 
529 		switch (sce->edesc->bmAttributes & UE_XFERTYPE) {
530 		case UE_INTERRUPT:
531 			ndflush(&sce->q, sce->q.c_cc);
532 			clfree(&sce->q);
533 			break;
534 		case UE_ISOCHRONOUS:
535 			for (i = 0; i < UGEN_NISOREQS; ++i)
536 				usbd_free_xfer(sce->isoreqs[i].xfer);
537 			break;
538 #ifdef UGEN_BULK_RA_WB
539 		case UE_BULK:
540 			if (sce->state & (UGEN_BULK_RA | UGEN_BULK_WB))
541 				/* ibuf freed below */
542 				usbd_free_xfer(sce->ra_wb_xfer);
543 			break;
544 #endif
545 		default:
546 			break;
547 		}
548 
549 		if (sce->ibuf != NULL) {
550 			free(sce->ibuf, M_USBDEV);
551 			sce->ibuf = NULL;
552 			clfree(&sce->q);
553 		}
554 	}
555 	sc->sc_is_open[endpt] = 0;
556 
557 	return (0);
558 }
559 
560 Static int
561 ugen_do_read(struct ugen_softc *sc, int endpt, struct uio *uio, int flag)
562 {
563 	struct ugen_endpoint *sce = &sc->sc_endpoints[endpt][IN];
564 	u_int32_t n, tn;
565 	usbd_xfer_handle xfer;
566 	usbd_status err;
567 	int s;
568 	int error = 0;
569 
570 	DPRINTFN(5, ("%s: ugenread: %d\n", USBDEVNAME(sc->sc_dev), endpt));
571 
572 	if (sc->sc_dying)
573 		return (EIO);
574 
575 	if (endpt == USB_CONTROL_ENDPOINT)
576 		return (ENODEV);
577 
578 #ifdef DIAGNOSTIC
579 	if (sce->edesc == NULL) {
580 		printf("ugenread: no edesc\n");
581 		return (EIO);
582 	}
583 	if (sce->pipeh == NULL) {
584 		printf("ugenread: no pipe\n");
585 		return (EIO);
586 	}
587 #endif
588 
589 	switch (sce->edesc->bmAttributes & UE_XFERTYPE) {
590 	case UE_INTERRUPT:
591 		/* Block until activity occurred. */
592 		s = splusb();
593 		while (sce->q.c_cc == 0) {
594 			if (flag & IO_NDELAY) {
595 				splx(s);
596 				return (EWOULDBLOCK);
597 			}
598 			sce->state |= UGEN_ASLP;
599 			DPRINTFN(5, ("ugenread: sleep on %p\n", sce));
600 			error = tsleep(sce, PZERO | PCATCH, "ugenri", 0);
601 			DPRINTFN(5, ("ugenread: woke, error=%d\n", error));
602 			if (sc->sc_dying)
603 				error = EIO;
604 			if (error) {
605 				sce->state &= ~UGEN_ASLP;
606 				break;
607 			}
608 		}
609 		splx(s);
610 
611 		/* Transfer as many chunks as possible. */
612 		while (sce->q.c_cc > 0 && uio->uio_resid > 0 && !error) {
613 			n = min(sce->q.c_cc, uio->uio_resid);
614 			if (n > sizeof(sc->sc_buffer))
615 				n = sizeof(sc->sc_buffer);
616 
617 			/* Remove a small chunk from the input queue. */
618 			q_to_b(&sce->q, sc->sc_buffer, n);
619 			DPRINTFN(5, ("ugenread: got %d chars\n", n));
620 
621 			/* Copy the data to the user process. */
622 			error = uiomove(sc->sc_buffer, n, uio);
623 			if (error)
624 				break;
625 		}
626 		break;
627 	case UE_BULK:
628 #ifdef UGEN_BULK_RA_WB
629 		if (sce->state & UGEN_BULK_RA) {
630 			DPRINTFN(5, ("ugenread: BULK_RA req: %d used: %d\n",
631 				     uio->uio_resid, sce->ra_wb_used));
632 			xfer = sce->ra_wb_xfer;
633 
634 			s = splusb();
635 			if (sce->ra_wb_used == 0 && flag & IO_NDELAY) {
636 				splx(s);
637 				return (EWOULDBLOCK);
638 			}
639 			while (uio->uio_resid > 0 && !error) {
640 				while (sce->ra_wb_used == 0) {
641 					sce->state |= UGEN_ASLP;
642 					DPRINTFN(5,
643 						 ("ugenread: sleep on %p\n",
644 						  sce));
645 					error = tsleep(sce, PZERO | PCATCH,
646 						       "ugenrb", 0);
647 					DPRINTFN(5,
648 						 ("ugenread: woke, error=%d\n",
649 						  error));
650 					if (sc->sc_dying)
651 						error = EIO;
652 					if (error) {
653 						sce->state &= ~UGEN_ASLP;
654 						break;
655 					}
656 				}
657 
658 				/* Copy data to the process. */
659 				while (uio->uio_resid > 0
660 				       && sce->ra_wb_used > 0) {
661 					n = min(uio->uio_resid,
662 						sce->ra_wb_used);
663 					n = min(n, sce->limit - sce->cur);
664 					error = uiomove(sce->cur, n, uio);
665 					if (error)
666 						break;
667 					sce->cur += n;
668 					sce->ra_wb_used -= n;
669 					if (sce->cur == sce->limit)
670 						sce->cur = sce->ibuf;
671 				}
672 
673 				/*
674 				 * If the transfers stopped because the
675 				 * buffer was full, restart them.
676 				 */
677 				if (sce->state & UGEN_RA_WB_STOP &&
678 				    sce->ra_wb_used < sce->limit - sce->ibuf) {
679 					n = (sce->limit - sce->ibuf)
680 					    - sce->ra_wb_used;
681 					usbd_setup_xfer(xfer,
682 					    sce->pipeh, sce, NULL,
683 					    min(n, sce->ra_wb_xferlen),
684 					    USBD_NO_COPY, USBD_NO_TIMEOUT,
685 					    ugen_bulkra_intr);
686 					sce->state &= ~UGEN_RA_WB_STOP;
687 					err = usbd_transfer(xfer);
688 					if (err != USBD_IN_PROGRESS)
689 						/*
690 						 * The transfer has not been
691 						 * queued.  Setting STOP
692 						 * will make us try
693 						 * again at the next read.
694 						 */
695 						sce->state |= UGEN_RA_WB_STOP;
696 				}
697 			}
698 			splx(s);
699 			break;
700 		}
701 #endif
702 		xfer = usbd_alloc_xfer(sc->sc_udev);
703 		if (xfer == 0)
704 			return (ENOMEM);
705 		while ((n = min(UGEN_BBSIZE, uio->uio_resid)) != 0) {
706 			DPRINTFN(1, ("ugenread: start transfer %d bytes\n",n));
707 			tn = n;
708 			err = usbd_bulk_transfer(
709 				  xfer, sce->pipeh,
710 				  sce->state & UGEN_SHORT_OK ?
711 				      USBD_SHORT_XFER_OK : 0,
712 				  sce->timeout, sc->sc_buffer, &tn, "ugenrb");
713 			if (err) {
714 				if (err == USBD_INTERRUPTED)
715 					error = EINTR;
716 				else if (err == USBD_TIMEOUT)
717 					error = ETIMEDOUT;
718 				else
719 					error = EIO;
720 				break;
721 			}
722 			DPRINTFN(1, ("ugenread: got %d bytes\n", tn));
723 			error = uiomove(sc->sc_buffer, tn, uio);
724 			if (error || tn < n)
725 				break;
726 		}
727 		usbd_free_xfer(xfer);
728 		break;
729 	case UE_ISOCHRONOUS:
730 		s = splusb();
731 		while (sce->cur == sce->fill) {
732 			if (flag & IO_NDELAY) {
733 				splx(s);
734 				return (EWOULDBLOCK);
735 			}
736 			sce->state |= UGEN_ASLP;
737 			DPRINTFN(5, ("ugenread: sleep on %p\n", sce));
738 			error = tsleep(sce, PZERO | PCATCH, "ugenri", 0);
739 			DPRINTFN(5, ("ugenread: woke, error=%d\n", error));
740 			if (sc->sc_dying)
741 				error = EIO;
742 			if (error) {
743 				sce->state &= ~UGEN_ASLP;
744 				break;
745 			}
746 		}
747 
748 		while (sce->cur != sce->fill && uio->uio_resid > 0 && !error) {
749 			if(sce->fill > sce->cur)
750 				n = min(sce->fill - sce->cur, uio->uio_resid);
751 			else
752 				n = min(sce->limit - sce->cur, uio->uio_resid);
753 
754 			DPRINTFN(5, ("ugenread: isoc got %d chars\n", n));
755 
756 			/* Copy the data to the user process. */
757 			error = uiomove(sce->cur, n, uio);
758 			if (error)
759 				break;
760 			sce->cur += n;
761 			if(sce->cur >= sce->limit)
762 				sce->cur = sce->ibuf;
763 		}
764 		splx(s);
765 		break;
766 
767 
768 	default:
769 		return (ENXIO);
770 	}
771 	return (error);
772 }
773 
774 int
775 ugenread(dev_t dev, struct uio *uio, int flag)
776 {
777 	int endpt = UGENENDPOINT(dev);
778 	struct ugen_softc *sc;
779 	int error;
780 
781 	USB_GET_SC(ugen, UGENUNIT(dev), sc);
782 
783 	sc->sc_refcnt++;
784 	error = ugen_do_read(sc, endpt, uio, flag);
785 	if (--sc->sc_refcnt < 0)
786 		usb_detach_wakeup(USBDEV(sc->sc_dev));
787 	return (error);
788 }
789 
790 Static int
791 ugen_do_write(struct ugen_softc *sc, int endpt, struct uio *uio,
792 	int flag __unused)
793 {
794 	struct ugen_endpoint *sce = &sc->sc_endpoints[endpt][OUT];
795 	u_int32_t n;
796 	int error = 0;
797 #ifdef UGEN_BULK_RA_WB
798 	int s;
799 	u_int32_t tn;
800 	char *dbuf;
801 #endif
802 	usbd_xfer_handle xfer;
803 	usbd_status err;
804 
805 	DPRINTFN(5, ("%s: ugenwrite: %d\n", USBDEVNAME(sc->sc_dev), endpt));
806 
807 	if (sc->sc_dying)
808 		return (EIO);
809 
810 	if (endpt == USB_CONTROL_ENDPOINT)
811 		return (ENODEV);
812 
813 #ifdef DIAGNOSTIC
814 	if (sce->edesc == NULL) {
815 		printf("ugenwrite: no edesc\n");
816 		return (EIO);
817 	}
818 	if (sce->pipeh == NULL) {
819 		printf("ugenwrite: no pipe\n");
820 		return (EIO);
821 	}
822 #endif
823 
824 	switch (sce->edesc->bmAttributes & UE_XFERTYPE) {
825 	case UE_BULK:
826 #ifdef UGEN_BULK_RA_WB
827 		if (sce->state & UGEN_BULK_WB) {
828 			DPRINTFN(5, ("ugenwrite: BULK_WB req: %d used: %d\n",
829 				     uio->uio_resid, sce->ra_wb_used));
830 			xfer = sce->ra_wb_xfer;
831 
832 			s = splusb();
833 			if (sce->ra_wb_used == sce->limit - sce->ibuf &&
834 			    flag & IO_NDELAY) {
835 				splx(s);
836 				return (EWOULDBLOCK);
837 			}
838 			while (uio->uio_resid > 0 && !error) {
839 				while (sce->ra_wb_used ==
840 				       sce->limit - sce->ibuf) {
841 					sce->state |= UGEN_ASLP;
842 					DPRINTFN(5,
843 						 ("ugenwrite: sleep on %p\n",
844 						  sce));
845 					error = tsleep(sce, PZERO | PCATCH,
846 						       "ugenwb", 0);
847 					DPRINTFN(5,
848 						 ("ugenwrite: woke, error=%d\n",
849 						  error));
850 					if (sc->sc_dying)
851 						error = EIO;
852 					if (error) {
853 						sce->state &= ~UGEN_ASLP;
854 						break;
855 					}
856 				}
857 
858 				/* Copy data from the process. */
859 				while (uio->uio_resid > 0 &&
860 				    sce->ra_wb_used < sce->limit - sce->ibuf) {
861 					n = min(uio->uio_resid,
862 						(sce->limit - sce->ibuf)
863 						 - sce->ra_wb_used);
864 					n = min(n, sce->limit - sce->fill);
865 					error = uiomove(sce->fill, n, uio);
866 					if (error)
867 						break;
868 					sce->fill += n;
869 					sce->ra_wb_used += n;
870 					if (sce->fill == sce->limit)
871 						sce->fill = sce->ibuf;
872 				}
873 
874 				/*
875 				 * If the transfers stopped because the
876 				 * buffer was empty, restart them.
877 				 */
878 				if (sce->state & UGEN_RA_WB_STOP &&
879 				    sce->ra_wb_used > 0) {
880 					dbuf = (char *)usbd_get_buffer(xfer);
881 					n = min(sce->ra_wb_used,
882 						sce->ra_wb_xferlen);
883 					tn = min(n, sce->limit - sce->cur);
884 					memcpy(dbuf, sce->cur, tn);
885 					dbuf += tn;
886 					if (n - tn > 0)
887 						memcpy(dbuf, sce->ibuf,
888 						       n - tn);
889 					usbd_setup_xfer(xfer,
890 					    sce->pipeh, sce, NULL, n,
891 					    USBD_NO_COPY, USBD_NO_TIMEOUT,
892 					    ugen_bulkwb_intr);
893 					sce->state &= ~UGEN_RA_WB_STOP;
894 					err = usbd_transfer(xfer);
895 					if (err != USBD_IN_PROGRESS)
896 						/*
897 						 * The transfer has not been
898 						 * queued.  Setting STOP
899 						 * will make us try again
900 						 * at the next read.
901 						 */
902 						sce->state |= UGEN_RA_WB_STOP;
903 				}
904 			}
905 			splx(s);
906 			break;
907 		}
908 #endif
909 		xfer = usbd_alloc_xfer(sc->sc_udev);
910 		if (xfer == 0)
911 			return (EIO);
912 		while ((n = min(UGEN_BBSIZE, uio->uio_resid)) != 0) {
913 			error = uiomove(sc->sc_buffer, n, uio);
914 			if (error)
915 				break;
916 			DPRINTFN(1, ("ugenwrite: transfer %d bytes\n", n));
917 			err = usbd_bulk_transfer(xfer, sce->pipeh, 0,
918 				  sce->timeout, sc->sc_buffer, &n,"ugenwb");
919 			if (err) {
920 				if (err == USBD_INTERRUPTED)
921 					error = EINTR;
922 				else if (err == USBD_TIMEOUT)
923 					error = ETIMEDOUT;
924 				else
925 					error = EIO;
926 				break;
927 			}
928 		}
929 		usbd_free_xfer(xfer);
930 		break;
931 	case UE_INTERRUPT:
932 		xfer = usbd_alloc_xfer(sc->sc_udev);
933 		if (xfer == 0)
934 			return (EIO);
935 		while ((n = min(UGETW(sce->edesc->wMaxPacketSize),
936 		    uio->uio_resid)) != 0) {
937 			error = uiomove(sc->sc_buffer, n, uio);
938 			if (error)
939 				break;
940 			DPRINTFN(1, ("ugenwrite: transfer %d bytes\n", n));
941 			err = usbd_intr_transfer(xfer, sce->pipeh, 0,
942 			    sce->timeout, sc->sc_buffer, &n, "ugenwi");
943 			if (err) {
944 				if (err == USBD_INTERRUPTED)
945 					error = EINTR;
946 				else if (err == USBD_TIMEOUT)
947 					error = ETIMEDOUT;
948 				else
949 					error = EIO;
950 				break;
951 			}
952 		}
953 		usbd_free_xfer(xfer);
954 		break;
955 	default:
956 		return (ENXIO);
957 	}
958 	return (error);
959 }
960 
961 int
962 ugenwrite(dev_t dev, struct uio *uio, int flag)
963 {
964 	int endpt = UGENENDPOINT(dev);
965 	struct ugen_softc *sc;
966 	int error;
967 
968 	USB_GET_SC(ugen, UGENUNIT(dev), sc);
969 
970 	sc->sc_refcnt++;
971 	error = ugen_do_write(sc, endpt, uio, flag);
972 	if (--sc->sc_refcnt < 0)
973 		usb_detach_wakeup(USBDEV(sc->sc_dev));
974 	return (error);
975 }
976 
977 #if defined(__NetBSD__) || defined(__OpenBSD__)
978 int
979 ugen_activate(device_ptr_t self, enum devact act)
980 {
981 	struct ugen_softc *sc = (struct ugen_softc *)self;
982 
983 	switch (act) {
984 	case DVACT_ACTIVATE:
985 		return (EOPNOTSUPP);
986 
987 	case DVACT_DEACTIVATE:
988 		sc->sc_dying = 1;
989 		break;
990 	}
991 	return (0);
992 }
993 #endif
994 
995 USB_DETACH(ugen)
996 {
997 	USB_DETACH_START(ugen, sc);
998 	struct ugen_endpoint *sce;
999 	int i, dir;
1000 	int s;
1001 #if defined(__NetBSD__) || defined(__OpenBSD__)
1002 	int maj, mn;
1003 
1004 	DPRINTF(("ugen_detach: sc=%p flags=%d\n", sc, flags));
1005 #elif defined(__FreeBSD__)
1006 	DPRINTF(("ugen_detach: sc=%p\n", sc));
1007 #endif
1008 
1009 	sc->sc_dying = 1;
1010 	/* Abort all pipes.  Causes processes waiting for transfer to wake. */
1011 	for (i = 0; i < USB_MAX_ENDPOINTS; i++) {
1012 		for (dir = OUT; dir <= IN; dir++) {
1013 			sce = &sc->sc_endpoints[i][dir];
1014 			if (sce && sce->pipeh)
1015 				usbd_abort_pipe(sce->pipeh);
1016 		}
1017 	}
1018 
1019 	s = splusb();
1020 	if (--sc->sc_refcnt >= 0) {
1021 		/* Wake everyone */
1022 		for (i = 0; i < USB_MAX_ENDPOINTS; i++)
1023 			wakeup(&sc->sc_endpoints[i][IN]);
1024 		/* Wait for processes to go away. */
1025 		usb_detach_wait(USBDEV(sc->sc_dev));
1026 	}
1027 	splx(s);
1028 
1029 #if defined(__NetBSD__) || defined(__OpenBSD__)
1030 	/* locate the major number */
1031 #if defined(__NetBSD__)
1032 	maj = cdevsw_lookup_major(&ugen_cdevsw);
1033 #elif defined(__OpenBSD__)
1034 	for (maj = 0; maj < nchrdev; maj++)
1035 		if (cdevsw[maj].d_open == ugenopen)
1036 			break;
1037 #endif
1038 
1039 	/* Nuke the vnodes for any open instances (calls close). */
1040 	mn = device_unit(self) * USB_MAX_ENDPOINTS;
1041 	vdevgone(maj, mn, mn + USB_MAX_ENDPOINTS - 1, VCHR);
1042 #elif defined(__FreeBSD__)
1043 	/* XXX not implemented yet */
1044 #endif
1045 
1046 	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, sc->sc_udev,
1047 			   USBDEV(sc->sc_dev));
1048 
1049 	return (0);
1050 }
1051 
1052 Static void
1053 ugenintr(usbd_xfer_handle xfer, usbd_private_handle addr, usbd_status status)
1054 {
1055 	struct ugen_endpoint *sce = addr;
1056 	/*struct ugen_softc *sc = sce->sc;*/
1057 	u_int32_t count;
1058 	u_char *ibuf;
1059 
1060 	if (status == USBD_CANCELLED)
1061 		return;
1062 
1063 	if (status != USBD_NORMAL_COMPLETION) {
1064 		DPRINTF(("ugenintr: status=%d\n", status));
1065 		if (status == USBD_STALLED)
1066 		    usbd_clear_endpoint_stall_async(sce->pipeh);
1067 		return;
1068 	}
1069 
1070 	usbd_get_xfer_status(xfer, NULL, NULL, &count, NULL);
1071 	ibuf = sce->ibuf;
1072 
1073 	DPRINTFN(5, ("ugenintr: xfer=%p status=%d count=%d\n",
1074 		     xfer, status, count));
1075 	DPRINTFN(5, ("          data = %02x %02x %02x\n",
1076 		     ibuf[0], ibuf[1], ibuf[2]));
1077 
1078 	(void)b_to_q(ibuf, count, &sce->q);
1079 
1080 	if (sce->state & UGEN_ASLP) {
1081 		sce->state &= ~UGEN_ASLP;
1082 		DPRINTFN(5, ("ugen_intr: waking %p\n", sce));
1083 		wakeup(sce);
1084 	}
1085 	selnotify(&sce->rsel, 0);
1086 }
1087 
1088 Static void
1089 ugen_isoc_rintr(usbd_xfer_handle xfer, usbd_private_handle addr,
1090 		usbd_status status)
1091 {
1092 	struct isoreq *req = addr;
1093 	struct ugen_endpoint *sce = req->sce;
1094 	u_int32_t count, n;
1095 	int i, isize;
1096 
1097 	/* Return if we are aborting. */
1098 	if (status == USBD_CANCELLED)
1099 		return;
1100 
1101 	usbd_get_xfer_status(xfer, NULL, NULL, &count, NULL);
1102 	DPRINTFN(5,("ugen_isoc_rintr: xfer %ld, count=%d\n",
1103 	    (long)(req - sce->isoreqs), count));
1104 
1105 	/* throw away oldest input if the buffer is full */
1106 	if(sce->fill < sce->cur && sce->cur <= sce->fill + count) {
1107 		sce->cur += count;
1108 		if(sce->cur >= sce->limit)
1109 			sce->cur = sce->ibuf + (sce->limit - sce->cur);
1110 		DPRINTFN(5, ("ugen_isoc_rintr: throwing away %d bytes\n",
1111 			     count));
1112 	}
1113 
1114 	isize = UGETW(sce->edesc->wMaxPacketSize);
1115 	for (i = 0; i < UGEN_NISORFRMS; i++) {
1116 		u_int32_t actlen = req->sizes[i];
1117 		char const *tbuf = (char const *)req->dmabuf + isize * i;
1118 
1119 		/* copy data to buffer */
1120 		while (actlen > 0) {
1121 			n = min(actlen, sce->limit - sce->fill);
1122 			memcpy(sce->fill, tbuf, n);
1123 
1124 			tbuf += n;
1125 			actlen -= n;
1126 			sce->fill += n;
1127 			if(sce->fill == sce->limit)
1128 				sce->fill = sce->ibuf;
1129 		}
1130 
1131 		/* setup size for next transfer */
1132 		req->sizes[i] = isize;
1133 	}
1134 
1135 	usbd_setup_isoc_xfer(xfer, sce->pipeh, req, req->sizes, UGEN_NISORFRMS,
1136 			     USBD_NO_COPY, ugen_isoc_rintr);
1137 	(void)usbd_transfer(xfer);
1138 
1139 	if (sce->state & UGEN_ASLP) {
1140 		sce->state &= ~UGEN_ASLP;
1141 		DPRINTFN(5, ("ugen_isoc_rintr: waking %p\n", sce));
1142 		wakeup(sce);
1143 	}
1144 	selnotify(&sce->rsel, 0);
1145 }
1146 
1147 #ifdef UGEN_BULK_RA_WB
1148 Static void
1149 ugen_bulkra_intr(usbd_xfer_handle xfer, usbd_private_handle addr,
1150 		 usbd_status status)
1151 {
1152 	struct ugen_endpoint *sce = addr;
1153 	u_int32_t count, n;
1154 	char const *tbuf;
1155 	usbd_status err;
1156 
1157 	/* Return if we are aborting. */
1158 	if (status == USBD_CANCELLED)
1159 		return;
1160 
1161 	if (status != USBD_NORMAL_COMPLETION) {
1162 		DPRINTF(("ugen_bulkra_intr: status=%d\n", status));
1163 		sce->state |= UGEN_RA_WB_STOP;
1164 		if (status == USBD_STALLED)
1165 		    usbd_clear_endpoint_stall_async(sce->pipeh);
1166 		return;
1167 	}
1168 
1169 	usbd_get_xfer_status(xfer, NULL, NULL, &count, NULL);
1170 
1171 	/* Keep track of how much is in the buffer. */
1172 	sce->ra_wb_used += count;
1173 
1174 	/* Copy data to buffer. */
1175 	tbuf = (char const *)usbd_get_buffer(sce->ra_wb_xfer);
1176 	n = min(count, sce->limit - sce->fill);
1177 	memcpy(sce->fill, tbuf, n);
1178 	tbuf += n;
1179 	count -= n;
1180 	sce->fill += n;
1181 	if (sce->fill == sce->limit)
1182 		sce->fill = sce->ibuf;
1183 	if (count > 0) {
1184 		memcpy(sce->fill, tbuf, count);
1185 		sce->fill += count;
1186 	}
1187 
1188 	/* Set up the next request if necessary. */
1189 	n = (sce->limit - sce->ibuf) - sce->ra_wb_used;
1190 	if (n > 0) {
1191 		usbd_setup_xfer(xfer, sce->pipeh, sce, NULL,
1192 		    min(n, sce->ra_wb_xferlen), USBD_NO_COPY,
1193 		    USBD_NO_TIMEOUT, ugen_bulkra_intr);
1194 		err = usbd_transfer(xfer);
1195 		if (err != USBD_IN_PROGRESS) {
1196 			printf("usbd_bulkra_intr: error=%d\n", err);
1197 			/*
1198 			 * The transfer has not been queued.  Setting STOP
1199 			 * will make us try again at the next read.
1200 			 */
1201 			sce->state |= UGEN_RA_WB_STOP;
1202 		}
1203 	}
1204 	else
1205 		sce->state |= UGEN_RA_WB_STOP;
1206 
1207 	if (sce->state & UGEN_ASLP) {
1208 		sce->state &= ~UGEN_ASLP;
1209 		DPRINTFN(5, ("ugen_bulkra_intr: waking %p\n", sce));
1210 		wakeup(sce);
1211 	}
1212 	selnotify(&sce->rsel, 0);
1213 }
1214 
1215 Static void
1216 ugen_bulkwb_intr(usbd_xfer_handle xfer, usbd_private_handle addr,
1217 		 usbd_status status)
1218 {
1219 	struct ugen_endpoint *sce = addr;
1220 	u_int32_t count, n;
1221 	char *tbuf;
1222 	usbd_status err;
1223 
1224 	/* Return if we are aborting. */
1225 	if (status == USBD_CANCELLED)
1226 		return;
1227 
1228 	if (status != USBD_NORMAL_COMPLETION) {
1229 		DPRINTF(("ugen_bulkwb_intr: status=%d\n", status));
1230 		sce->state |= UGEN_RA_WB_STOP;
1231 		if (status == USBD_STALLED)
1232 		    usbd_clear_endpoint_stall_async(sce->pipeh);
1233 		return;
1234 	}
1235 
1236 	usbd_get_xfer_status(xfer, NULL, NULL, &count, NULL);
1237 
1238 	/* Keep track of how much is in the buffer. */
1239 	sce->ra_wb_used -= count;
1240 
1241 	/* Update buffer pointers. */
1242 	sce->cur += count;
1243 	if (sce->cur >= sce->limit)
1244 		sce->cur = sce->ibuf + (sce->cur - sce->limit);
1245 
1246 	/* Set up next request if necessary. */
1247 	if (sce->ra_wb_used > 0) {
1248 		/* copy data from buffer */
1249 		tbuf = (char *)usbd_get_buffer(sce->ra_wb_xfer);
1250 		count = min(sce->ra_wb_used, sce->ra_wb_xferlen);
1251 		n = min(count, sce->limit - sce->cur);
1252 		memcpy(tbuf, sce->cur, n);
1253 		tbuf += n;
1254 		if (count - n > 0)
1255 			memcpy(tbuf, sce->ibuf, count - n);
1256 
1257 		usbd_setup_xfer(xfer, sce->pipeh, sce, NULL,
1258 		    count, USBD_NO_COPY, USBD_NO_TIMEOUT, ugen_bulkwb_intr);
1259 		err = usbd_transfer(xfer);
1260 		if (err != USBD_IN_PROGRESS) {
1261 			printf("usbd_bulkwb_intr: error=%d\n", err);
1262 			/*
1263 			 * The transfer has not been queued.  Setting STOP
1264 			 * will make us try again at the next write.
1265 			 */
1266 			sce->state |= UGEN_RA_WB_STOP;
1267 		}
1268 	}
1269 	else
1270 		sce->state |= UGEN_RA_WB_STOP;
1271 
1272 	if (sce->state & UGEN_ASLP) {
1273 		sce->state &= ~UGEN_ASLP;
1274 		DPRINTFN(5, ("ugen_bulkwb_intr: waking %p\n", sce));
1275 		wakeup(sce);
1276 	}
1277 	selnotify(&sce->rsel, 0);
1278 }
1279 #endif
1280 
1281 Static usbd_status
1282 ugen_set_interface(struct ugen_softc *sc, int ifaceidx, int altno)
1283 {
1284 	usbd_interface_handle iface;
1285 	usb_endpoint_descriptor_t *ed;
1286 	usbd_status err;
1287 	struct ugen_endpoint *sce;
1288 	u_int8_t niface, nendpt, endptno, endpt;
1289 	int dir;
1290 
1291 	DPRINTFN(15, ("ugen_set_interface %d %d\n", ifaceidx, altno));
1292 
1293 	err = usbd_interface_count(sc->sc_udev, &niface);
1294 	if (err)
1295 		return (err);
1296 	if (ifaceidx < 0 || ifaceidx >= niface)
1297 		return (USBD_INVAL);
1298 
1299 	err = usbd_device2interface_handle(sc->sc_udev, ifaceidx, &iface);
1300 	if (err)
1301 		return (err);
1302 	err = usbd_endpoint_count(iface, &nendpt);
1303 	if (err)
1304 		return (err);
1305 	/* XXX should only do this after setting new altno has succeeded */
1306 	for (endptno = 0; endptno < nendpt; endptno++) {
1307 		ed = usbd_interface2endpoint_descriptor(iface,endptno);
1308 		endpt = ed->bEndpointAddress;
1309 		dir = UE_GET_DIR(endpt) == UE_DIR_IN ? IN : OUT;
1310 		sce = &sc->sc_endpoints[UE_GET_ADDR(endpt)][dir];
1311 		sce->sc = 0;
1312 		sce->edesc = 0;
1313 		sce->iface = 0;
1314 	}
1315 
1316 	/* change setting */
1317 	err = usbd_set_interface(iface, altno);
1318 	if (err)
1319 		return (err);
1320 
1321 	err = usbd_endpoint_count(iface, &nendpt);
1322 	if (err)
1323 		return (err);
1324 	for (endptno = 0; endptno < nendpt; endptno++) {
1325 		ed = usbd_interface2endpoint_descriptor(iface,endptno);
1326 		KASSERT(ed != NULL);
1327 		endpt = ed->bEndpointAddress;
1328 		dir = UE_GET_DIR(endpt) == UE_DIR_IN ? IN : OUT;
1329 		sce = &sc->sc_endpoints[UE_GET_ADDR(endpt)][dir];
1330 		sce->sc = sc;
1331 		sce->edesc = ed;
1332 		sce->iface = iface;
1333 	}
1334 	return (0);
1335 }
1336 
1337 /* Retrieve a complete descriptor for a certain device and index. */
1338 Static usb_config_descriptor_t *
1339 ugen_get_cdesc(struct ugen_softc *sc, int index, int *lenp)
1340 {
1341 	usb_config_descriptor_t *cdesc, *tdesc, cdescr;
1342 	int len;
1343 	usbd_status err;
1344 
1345 	if (index == USB_CURRENT_CONFIG_INDEX) {
1346 		tdesc = usbd_get_config_descriptor(sc->sc_udev);
1347 		len = UGETW(tdesc->wTotalLength);
1348 		if (lenp)
1349 			*lenp = len;
1350 		cdesc = malloc(len, M_TEMP, M_WAITOK);
1351 		memcpy(cdesc, tdesc, len);
1352 		DPRINTFN(5,("ugen_get_cdesc: current, len=%d\n", len));
1353 	} else {
1354 		err = usbd_get_config_desc(sc->sc_udev, index, &cdescr);
1355 		if (err)
1356 			return (0);
1357 		len = UGETW(cdescr.wTotalLength);
1358 		DPRINTFN(5,("ugen_get_cdesc: index=%d, len=%d\n", index, len));
1359 		if (lenp)
1360 			*lenp = len;
1361 		cdesc = malloc(len, M_TEMP, M_WAITOK);
1362 		err = usbd_get_config_desc_full(sc->sc_udev, index, cdesc, len);
1363 		if (err) {
1364 			free(cdesc, M_TEMP);
1365 			return (0);
1366 		}
1367 	}
1368 	return (cdesc);
1369 }
1370 
1371 Static int
1372 ugen_get_alt_index(struct ugen_softc *sc, int ifaceidx)
1373 {
1374 	usbd_interface_handle iface;
1375 	usbd_status err;
1376 
1377 	err = usbd_device2interface_handle(sc->sc_udev, ifaceidx, &iface);
1378 	if (err)
1379 		return (-1);
1380 	return (usbd_get_interface_altindex(iface));
1381 }
1382 
1383 Static int
1384 ugen_do_ioctl(struct ugen_softc *sc, int endpt, u_long cmd,
1385 	      caddr_t addr, int flag, struct lwp *l)
1386 {
1387 	struct ugen_endpoint *sce;
1388 	usbd_status err;
1389 	usbd_interface_handle iface;
1390 	struct usb_config_desc *cd;
1391 	usb_config_descriptor_t *cdesc;
1392 	struct usb_interface_desc *id;
1393 	usb_interface_descriptor_t *idesc;
1394 	struct usb_endpoint_desc *ed;
1395 	usb_endpoint_descriptor_t *edesc;
1396 	struct usb_alt_interface *ai;
1397 	struct usb_string_desc *si;
1398 	u_int8_t conf, alt;
1399 
1400 	DPRINTFN(5, ("ugenioctl: cmd=%08lx\n", cmd));
1401 	if (sc->sc_dying)
1402 		return (EIO);
1403 
1404 	switch (cmd) {
1405 	case FIONBIO:
1406 		/* All handled in the upper FS layer. */
1407 		return (0);
1408 	case USB_SET_SHORT_XFER:
1409 		if (endpt == USB_CONTROL_ENDPOINT)
1410 			return (EINVAL);
1411 		/* This flag only affects read */
1412 		sce = &sc->sc_endpoints[endpt][IN];
1413 		if (sce == NULL || sce->pipeh == NULL)
1414 			return (EINVAL);
1415 		if (*(int *)addr)
1416 			sce->state |= UGEN_SHORT_OK;
1417 		else
1418 			sce->state &= ~UGEN_SHORT_OK;
1419 		return (0);
1420 	case USB_SET_TIMEOUT:
1421 		sce = &sc->sc_endpoints[endpt][IN];
1422 		if (sce == NULL
1423 		    /* XXX this shouldn't happen, but the distinction between
1424 		       input and output pipes isn't clear enough.
1425 		       || sce->pipeh == NULL */
1426 			)
1427 			return (EINVAL);
1428 		sce->timeout = *(int *)addr;
1429 		return (0);
1430 	case USB_SET_BULK_RA:
1431 #ifdef UGEN_BULK_RA_WB
1432 		if (endpt == USB_CONTROL_ENDPOINT)
1433 			return (EINVAL);
1434 		sce = &sc->sc_endpoints[endpt][IN];
1435 		if (sce == NULL || sce->pipeh == NULL)
1436 			return (EINVAL);
1437 		edesc = sce->edesc;
1438 		if ((edesc->bmAttributes & UE_XFERTYPE) != UE_BULK)
1439 			return (EINVAL);
1440 
1441 		if (*(int *)addr) {
1442 			/* Only turn RA on if it's currently off. */
1443 			if (sce->state & UGEN_BULK_RA)
1444 				return (0);
1445 
1446 			if (sce->ra_wb_bufsize == 0 || sce->ra_wb_reqsize == 0)
1447 				/* shouldn't happen */
1448 				return (EINVAL);
1449 			sce->ra_wb_xfer = usbd_alloc_xfer(sc->sc_udev);
1450 			if (sce->ra_wb_xfer == NULL)
1451 				return (ENOMEM);
1452 			sce->ra_wb_xferlen = sce->ra_wb_reqsize;
1453 			/*
1454 			 * Set up a dmabuf because we reuse the xfer with
1455 			 * the same (max) request length like isoc.
1456 			 */
1457 			if (usbd_alloc_buffer(sce->ra_wb_xfer,
1458 					      sce->ra_wb_xferlen) == 0) {
1459 				usbd_free_xfer(sce->ra_wb_xfer);
1460 				return (ENOMEM);
1461 			}
1462 			sce->ibuf = malloc(sce->ra_wb_bufsize,
1463 					   M_USBDEV, M_WAITOK);
1464 			sce->fill = sce->cur = sce->ibuf;
1465 			sce->limit = sce->ibuf + sce->ra_wb_bufsize;
1466 			sce->ra_wb_used = 0;
1467 			sce->state |= UGEN_BULK_RA;
1468 			sce->state &= ~UGEN_RA_WB_STOP;
1469 			/* Now start reading. */
1470 			usbd_setup_xfer(sce->ra_wb_xfer, sce->pipeh, sce,
1471 			    NULL,
1472 			    min(sce->ra_wb_xferlen, sce->ra_wb_bufsize),
1473 			    USBD_NO_COPY, USBD_NO_TIMEOUT,
1474 			    ugen_bulkra_intr);
1475 			err = usbd_transfer(sce->ra_wb_xfer);
1476 			if (err != USBD_IN_PROGRESS) {
1477 				sce->state &= ~UGEN_BULK_RA;
1478 				free(sce->ibuf, M_USBDEV);
1479 				sce->ibuf = NULL;
1480 				usbd_free_xfer(sce->ra_wb_xfer);
1481 				return (EIO);
1482 			}
1483 		} else {
1484 			/* Only turn RA off if it's currently on. */
1485 			if (!(sce->state & UGEN_BULK_RA))
1486 				return (0);
1487 
1488 			sce->state &= ~UGEN_BULK_RA;
1489 			usbd_abort_pipe(sce->pipeh);
1490 			usbd_free_xfer(sce->ra_wb_xfer);
1491 			/*
1492 			 * XXX Discard whatever's in the buffer, but we
1493 			 * should keep it around and drain the buffer
1494 			 * instead.
1495 			 */
1496 			free(sce->ibuf, M_USBDEV);
1497 			sce->ibuf = NULL;
1498 		}
1499 		return (0);
1500 #else
1501 		return (EOPNOTSUPP);
1502 #endif
1503 	case USB_SET_BULK_WB:
1504 #ifdef UGEN_BULK_RA_WB
1505 		if (endpt == USB_CONTROL_ENDPOINT)
1506 			return (EINVAL);
1507 		sce = &sc->sc_endpoints[endpt][OUT];
1508 		if (sce == NULL || sce->pipeh == NULL)
1509 			return (EINVAL);
1510 		edesc = sce->edesc;
1511 		if ((edesc->bmAttributes & UE_XFERTYPE) != UE_BULK)
1512 			return (EINVAL);
1513 
1514 		if (*(int *)addr) {
1515 			/* Only turn WB on if it's currently off. */
1516 			if (sce->state & UGEN_BULK_WB)
1517 				return (0);
1518 
1519 			if (sce->ra_wb_bufsize == 0 || sce->ra_wb_reqsize == 0)
1520 				/* shouldn't happen */
1521 				return (EINVAL);
1522 			sce->ra_wb_xfer = usbd_alloc_xfer(sc->sc_udev);
1523 			if (sce->ra_wb_xfer == NULL)
1524 				return (ENOMEM);
1525 			sce->ra_wb_xferlen = sce->ra_wb_reqsize;
1526 			/*
1527 			 * Set up a dmabuf because we reuse the xfer with
1528 			 * the same (max) request length like isoc.
1529 			 */
1530 			if (usbd_alloc_buffer(sce->ra_wb_xfer,
1531 					      sce->ra_wb_xferlen) == 0) {
1532 				usbd_free_xfer(sce->ra_wb_xfer);
1533 				return (ENOMEM);
1534 			}
1535 			sce->ibuf = malloc(sce->ra_wb_bufsize,
1536 					   M_USBDEV, M_WAITOK);
1537 			sce->fill = sce->cur = sce->ibuf;
1538 			sce->limit = sce->ibuf + sce->ra_wb_bufsize;
1539 			sce->ra_wb_used = 0;
1540 			sce->state |= UGEN_BULK_WB | UGEN_RA_WB_STOP;
1541 		} else {
1542 			/* Only turn WB off if it's currently on. */
1543 			if (!(sce->state & UGEN_BULK_WB))
1544 				return (0);
1545 
1546 			sce->state &= ~UGEN_BULK_WB;
1547 			/*
1548 			 * XXX Discard whatever's in the buffer, but we
1549 			 * should keep it around and keep writing to
1550 			 * drain the buffer instead.
1551 			 */
1552 			usbd_abort_pipe(sce->pipeh);
1553 			usbd_free_xfer(sce->ra_wb_xfer);
1554 			free(sce->ibuf, M_USBDEV);
1555 			sce->ibuf = NULL;
1556 		}
1557 		return (0);
1558 #else
1559 		return (EOPNOTSUPP);
1560 #endif
1561 	case USB_SET_BULK_RA_OPT:
1562 	case USB_SET_BULK_WB_OPT:
1563 #ifdef UGEN_BULK_RA_WB
1564 	{
1565 		struct usb_bulk_ra_wb_opt *opt;
1566 
1567 		if (endpt == USB_CONTROL_ENDPOINT)
1568 			return (EINVAL);
1569 		opt = (struct usb_bulk_ra_wb_opt *)addr;
1570 		if (cmd == USB_SET_BULK_RA_OPT)
1571 			sce = &sc->sc_endpoints[endpt][IN];
1572 		else
1573 			sce = &sc->sc_endpoints[endpt][OUT];
1574 		if (sce == NULL || sce->pipeh == NULL)
1575 			return (EINVAL);
1576 		if (opt->ra_wb_buffer_size < 1 ||
1577 		    opt->ra_wb_buffer_size > UGEN_BULK_RA_WB_BUFMAX ||
1578 		    opt->ra_wb_request_size < 1 ||
1579 		    opt->ra_wb_request_size > opt->ra_wb_buffer_size)
1580 			return (EINVAL);
1581 		/*
1582 		 * XXX These changes do not take effect until the
1583 		 * next time RA/WB mode is enabled but they ought to
1584 		 * take effect immediately.
1585 		 */
1586 		sce->ra_wb_bufsize = opt->ra_wb_buffer_size;
1587 		sce->ra_wb_reqsize = opt->ra_wb_request_size;
1588 		return (0);
1589 	}
1590 #else
1591 		return (EOPNOTSUPP);
1592 #endif
1593 	default:
1594 		break;
1595 	}
1596 
1597 	if (endpt != USB_CONTROL_ENDPOINT)
1598 		return (EINVAL);
1599 
1600 	switch (cmd) {
1601 #ifdef UGEN_DEBUG
1602 	case USB_SETDEBUG:
1603 		ugendebug = *(int *)addr;
1604 		break;
1605 #endif
1606 	case USB_GET_CONFIG:
1607 		err = usbd_get_config(sc->sc_udev, &conf);
1608 		if (err)
1609 			return (EIO);
1610 		*(int *)addr = conf;
1611 		break;
1612 	case USB_SET_CONFIG:
1613 		if (!(flag & FWRITE))
1614 			return (EPERM);
1615 		err = ugen_set_config(sc, *(int *)addr);
1616 		switch (err) {
1617 		case USBD_NORMAL_COMPLETION:
1618 			break;
1619 		case USBD_IN_USE:
1620 			return (EBUSY);
1621 		default:
1622 			return (EIO);
1623 		}
1624 		break;
1625 	case USB_GET_ALTINTERFACE:
1626 		ai = (struct usb_alt_interface *)addr;
1627 		err = usbd_device2interface_handle(sc->sc_udev,
1628 			  ai->uai_interface_index, &iface);
1629 		if (err)
1630 			return (EINVAL);
1631 		idesc = usbd_get_interface_descriptor(iface);
1632 		if (idesc == NULL)
1633 			return (EIO);
1634 		ai->uai_alt_no = idesc->bAlternateSetting;
1635 		break;
1636 	case USB_SET_ALTINTERFACE:
1637 		if (!(flag & FWRITE))
1638 			return (EPERM);
1639 		ai = (struct usb_alt_interface *)addr;
1640 		err = usbd_device2interface_handle(sc->sc_udev,
1641 			  ai->uai_interface_index, &iface);
1642 		if (err)
1643 			return (EINVAL);
1644 		err = ugen_set_interface(sc, ai->uai_interface_index,
1645 		    ai->uai_alt_no);
1646 		if (err)
1647 			return (EINVAL);
1648 		break;
1649 	case USB_GET_NO_ALT:
1650 		ai = (struct usb_alt_interface *)addr;
1651 		cdesc = ugen_get_cdesc(sc, ai->uai_config_index, 0);
1652 		if (cdesc == NULL)
1653 			return (EINVAL);
1654 		idesc = usbd_find_idesc(cdesc, ai->uai_interface_index, 0);
1655 		if (idesc == NULL) {
1656 			free(cdesc, M_TEMP);
1657 			return (EINVAL);
1658 		}
1659 		ai->uai_alt_no = usbd_get_no_alts(cdesc,
1660 		    idesc->bInterfaceNumber);
1661 		free(cdesc, M_TEMP);
1662 		break;
1663 	case USB_GET_DEVICE_DESC:
1664 		*(usb_device_descriptor_t *)addr =
1665 			*usbd_get_device_descriptor(sc->sc_udev);
1666 		break;
1667 	case USB_GET_CONFIG_DESC:
1668 		cd = (struct usb_config_desc *)addr;
1669 		cdesc = ugen_get_cdesc(sc, cd->ucd_config_index, 0);
1670 		if (cdesc == NULL)
1671 			return (EINVAL);
1672 		cd->ucd_desc = *cdesc;
1673 		free(cdesc, M_TEMP);
1674 		break;
1675 	case USB_GET_INTERFACE_DESC:
1676 		id = (struct usb_interface_desc *)addr;
1677 		cdesc = ugen_get_cdesc(sc, id->uid_config_index, 0);
1678 		if (cdesc == NULL)
1679 			return (EINVAL);
1680 		if (id->uid_config_index == USB_CURRENT_CONFIG_INDEX &&
1681 		    id->uid_alt_index == USB_CURRENT_ALT_INDEX)
1682 			alt = ugen_get_alt_index(sc, id->uid_interface_index);
1683 		else
1684 			alt = id->uid_alt_index;
1685 		idesc = usbd_find_idesc(cdesc, id->uid_interface_index, alt);
1686 		if (idesc == NULL) {
1687 			free(cdesc, M_TEMP);
1688 			return (EINVAL);
1689 		}
1690 		id->uid_desc = *idesc;
1691 		free(cdesc, M_TEMP);
1692 		break;
1693 	case USB_GET_ENDPOINT_DESC:
1694 		ed = (struct usb_endpoint_desc *)addr;
1695 		cdesc = ugen_get_cdesc(sc, ed->ued_config_index, 0);
1696 		if (cdesc == NULL)
1697 			return (EINVAL);
1698 		if (ed->ued_config_index == USB_CURRENT_CONFIG_INDEX &&
1699 		    ed->ued_alt_index == USB_CURRENT_ALT_INDEX)
1700 			alt = ugen_get_alt_index(sc, ed->ued_interface_index);
1701 		else
1702 			alt = ed->ued_alt_index;
1703 		edesc = usbd_find_edesc(cdesc, ed->ued_interface_index,
1704 					alt, ed->ued_endpoint_index);
1705 		if (edesc == NULL) {
1706 			free(cdesc, M_TEMP);
1707 			return (EINVAL);
1708 		}
1709 		ed->ued_desc = *edesc;
1710 		free(cdesc, M_TEMP);
1711 		break;
1712 	case USB_GET_FULL_DESC:
1713 	{
1714 		int len;
1715 		struct iovec iov;
1716 		struct uio uio;
1717 		struct usb_full_desc *fd = (struct usb_full_desc *)addr;
1718 		int error;
1719 
1720 		cdesc = ugen_get_cdesc(sc, fd->ufd_config_index, &len);
1721 		if (len > fd->ufd_size)
1722 			len = fd->ufd_size;
1723 		iov.iov_base = (caddr_t)fd->ufd_data;
1724 		iov.iov_len = len;
1725 		uio.uio_iov = &iov;
1726 		uio.uio_iovcnt = 1;
1727 		uio.uio_resid = len;
1728 		uio.uio_offset = 0;
1729 		uio.uio_rw = UIO_READ;
1730 		uio.uio_vmspace = l->l_proc->p_vmspace;
1731 		error = uiomove((void *)cdesc, len, &uio);
1732 		free(cdesc, M_TEMP);
1733 		return (error);
1734 	}
1735 	case USB_GET_STRING_DESC: {
1736 		int len;
1737 		si = (struct usb_string_desc *)addr;
1738 		err = usbd_get_string_desc(sc->sc_udev, si->usd_string_index,
1739 			  si->usd_language_id, &si->usd_desc, &len);
1740 		if (err)
1741 			return (EINVAL);
1742 		break;
1743 	}
1744 	case USB_DO_REQUEST:
1745 	{
1746 		struct usb_ctl_request *ur = (void *)addr;
1747 		int len = UGETW(ur->ucr_request.wLength);
1748 		struct iovec iov;
1749 		struct uio uio;
1750 		void *ptr = 0;
1751 		usbd_status xerr;
1752 		int error = 0;
1753 
1754 		if (!(flag & FWRITE))
1755 			return (EPERM);
1756 		/* Avoid requests that would damage the bus integrity. */
1757 		if ((ur->ucr_request.bmRequestType == UT_WRITE_DEVICE &&
1758 		     ur->ucr_request.bRequest == UR_SET_ADDRESS) ||
1759 		    (ur->ucr_request.bmRequestType == UT_WRITE_DEVICE &&
1760 		     ur->ucr_request.bRequest == UR_SET_CONFIG) ||
1761 		    (ur->ucr_request.bmRequestType == UT_WRITE_INTERFACE &&
1762 		     ur->ucr_request.bRequest == UR_SET_INTERFACE))
1763 			return (EINVAL);
1764 
1765 		if (len < 0 || len > 32767)
1766 			return (EINVAL);
1767 		if (len != 0) {
1768 			iov.iov_base = (caddr_t)ur->ucr_data;
1769 			iov.iov_len = len;
1770 			uio.uio_iov = &iov;
1771 			uio.uio_iovcnt = 1;
1772 			uio.uio_resid = len;
1773 			uio.uio_offset = 0;
1774 			uio.uio_rw =
1775 				ur->ucr_request.bmRequestType & UT_READ ?
1776 				UIO_READ : UIO_WRITE;
1777 			uio.uio_vmspace = l->l_proc->p_vmspace;
1778 			ptr = malloc(len, M_TEMP, M_WAITOK);
1779 			if (uio.uio_rw == UIO_WRITE) {
1780 				error = uiomove(ptr, len, &uio);
1781 				if (error)
1782 					goto ret;
1783 			}
1784 		}
1785 		sce = &sc->sc_endpoints[endpt][IN];
1786 		xerr = usbd_do_request_flags(sc->sc_udev, &ur->ucr_request,
1787 			  ptr, ur->ucr_flags, &ur->ucr_actlen, sce->timeout);
1788 		if (xerr) {
1789 			error = EIO;
1790 			goto ret;
1791 		}
1792 		if (len != 0) {
1793 			if (uio.uio_rw == UIO_READ) {
1794 				error = uiomove(ptr, len, &uio);
1795 				if (error)
1796 					goto ret;
1797 			}
1798 		}
1799 	ret:
1800 		if (ptr)
1801 			free(ptr, M_TEMP);
1802 		return (error);
1803 	}
1804 	case USB_GET_DEVICEINFO:
1805 		usbd_fill_deviceinfo(sc->sc_udev,
1806 				     (struct usb_device_info *)addr, 1);
1807 		break;
1808 	default:
1809 		return (EINVAL);
1810 	}
1811 	return (0);
1812 }
1813 
1814 int
1815 ugenioctl(dev_t dev, u_long cmd, caddr_t addr, int flag, struct lwp *l)
1816 {
1817 	int endpt = UGENENDPOINT(dev);
1818 	struct ugen_softc *sc;
1819 	int error;
1820 
1821 	USB_GET_SC(ugen, UGENUNIT(dev), sc);
1822 
1823 	sc->sc_refcnt++;
1824 	error = ugen_do_ioctl(sc, endpt, cmd, addr, flag, l);
1825 	if (--sc->sc_refcnt < 0)
1826 		usb_detach_wakeup(USBDEV(sc->sc_dev));
1827 	return (error);
1828 }
1829 
1830 int
1831 ugenpoll(dev_t dev, int events, struct lwp *l)
1832 {
1833 	struct ugen_softc *sc;
1834 	struct ugen_endpoint *sce_in, *sce_out;
1835 	int revents = 0;
1836 	int s;
1837 
1838 	USB_GET_SC(ugen, UGENUNIT(dev), sc);
1839 
1840 	if (sc->sc_dying)
1841 		return (POLLHUP);
1842 
1843 	sce_in = &sc->sc_endpoints[UGENENDPOINT(dev)][IN];
1844 	sce_out = &sc->sc_endpoints[UGENENDPOINT(dev)][OUT];
1845 	if (sce_in == NULL && sce_out == NULL)
1846 		return (POLLERR);
1847 #ifdef DIAGNOSTIC
1848 	if (!sce_in->edesc && !sce_out->edesc) {
1849 		printf("ugenpoll: no edesc\n");
1850 		return (POLLERR);
1851 	}
1852 	/* It's possible to have only one pipe open. */
1853 	if (!sce_in->pipeh && !sce_out->pipeh) {
1854 		printf("ugenpoll: no pipe\n");
1855 		return (POLLERR);
1856 	}
1857 #endif
1858 	s = splusb();
1859 	if (sce_in && sce_in->pipeh && (events & (POLLIN | POLLRDNORM)))
1860 		switch (sce_in->edesc->bmAttributes & UE_XFERTYPE) {
1861 		case UE_INTERRUPT:
1862 			if (sce_in->q.c_cc > 0)
1863 				revents |= events & (POLLIN | POLLRDNORM);
1864 			else
1865 				selrecord(l, &sce_in->rsel);
1866 			break;
1867 		case UE_ISOCHRONOUS:
1868 			if (sce_in->cur != sce_in->fill)
1869 				revents |= events & (POLLIN | POLLRDNORM);
1870 			else
1871 				selrecord(l, &sce_in->rsel);
1872 			break;
1873 		case UE_BULK:
1874 #ifdef UGEN_BULK_RA_WB
1875 			if (sce_in->state & UGEN_BULK_RA) {
1876 				if (sce_in->ra_wb_used > 0)
1877 					revents |= events &
1878 					    (POLLIN | POLLRDNORM);
1879 				else
1880 					selrecord(l, &sce_in->rsel);
1881 				break;
1882 			}
1883 #endif
1884 			/*
1885 			 * We have no easy way of determining if a read will
1886 			 * yield any data or a write will happen.
1887 			 * Pretend they will.
1888 			 */
1889 			 revents |= events & (POLLIN | POLLRDNORM);
1890 			 break;
1891 		default:
1892 			break;
1893 		}
1894 	if (sce_out && sce_out->pipeh && (events & (POLLOUT | POLLWRNORM)))
1895 		switch (sce_out->edesc->bmAttributes & UE_XFERTYPE) {
1896 		case UE_INTERRUPT:
1897 		case UE_ISOCHRONOUS:
1898 			/* XXX unimplemented */
1899 			break;
1900 		case UE_BULK:
1901 #ifdef UGEN_BULK_RA_WB
1902 			if (sce_out->state & UGEN_BULK_WB) {
1903 				if (sce_out->ra_wb_used <
1904 				    sce_out->limit - sce_out->ibuf)
1905 					revents |= events &
1906 					    (POLLOUT | POLLWRNORM);
1907 				else
1908 					selrecord(l, &sce_out->rsel);
1909 				break;
1910 			}
1911 #endif
1912 			/*
1913 			 * We have no easy way of determining if a read will
1914 			 * yield any data or a write will happen.
1915 			 * Pretend they will.
1916 			 */
1917 			 revents |= events & (POLLOUT | POLLWRNORM);
1918 			 break;
1919 		default:
1920 			break;
1921 		}
1922 
1923 
1924 	splx(s);
1925 	return (revents);
1926 }
1927 
1928 static void
1929 filt_ugenrdetach(struct knote *kn)
1930 {
1931 	struct ugen_endpoint *sce = kn->kn_hook;
1932 	int s;
1933 
1934 	s = splusb();
1935 	SLIST_REMOVE(&sce->rsel.sel_klist, kn, knote, kn_selnext);
1936 	splx(s);
1937 }
1938 
1939 static int
1940 filt_ugenread_intr(struct knote *kn, long hint __unused)
1941 {
1942 	struct ugen_endpoint *sce = kn->kn_hook;
1943 
1944 	kn->kn_data = sce->q.c_cc;
1945 	return (kn->kn_data > 0);
1946 }
1947 
1948 static int
1949 filt_ugenread_isoc(struct knote *kn, long hint __unused)
1950 {
1951 	struct ugen_endpoint *sce = kn->kn_hook;
1952 
1953 	if (sce->cur == sce->fill)
1954 		return (0);
1955 
1956 	if (sce->cur < sce->fill)
1957 		kn->kn_data = sce->fill - sce->cur;
1958 	else
1959 		kn->kn_data = (sce->limit - sce->cur) +
1960 		    (sce->fill - sce->ibuf);
1961 
1962 	return (1);
1963 }
1964 
1965 #ifdef UGEN_BULK_RA_WB
1966 static int
1967 filt_ugenread_bulk(struct knote *kn, long hint)
1968 {
1969 	struct ugen_endpoint *sce = kn->kn_hook;
1970 
1971 	if (!(sce->state & UGEN_BULK_RA))
1972 		/*
1973 		 * We have no easy way of determining if a read will
1974 		 * yield any data or a write will happen.
1975 		 * So, emulate "seltrue".
1976 		 */
1977 		return (filt_seltrue(kn, hint));
1978 
1979 	if (sce->ra_wb_used == 0)
1980 		return (0);
1981 
1982 	kn->kn_data = sce->ra_wb_used;
1983 
1984 	return (1);
1985 }
1986 
1987 static int
1988 filt_ugenwrite_bulk(struct knote *kn, long hint)
1989 {
1990 	struct ugen_endpoint *sce = kn->kn_hook;
1991 
1992 	if (!(sce->state & UGEN_BULK_WB))
1993 		/*
1994 		 * We have no easy way of determining if a read will
1995 		 * yield any data or a write will happen.
1996 		 * So, emulate "seltrue".
1997 		 */
1998 		return (filt_seltrue(kn, hint));
1999 
2000 	if (sce->ra_wb_used == sce->limit - sce->ibuf)
2001 		return (0);
2002 
2003 	kn->kn_data = (sce->limit - sce->ibuf) - sce->ra_wb_used;
2004 
2005 	return (1);
2006 }
2007 #endif
2008 
2009 static const struct filterops ugenread_intr_filtops =
2010 	{ 1, NULL, filt_ugenrdetach, filt_ugenread_intr };
2011 
2012 static const struct filterops ugenread_isoc_filtops =
2013 	{ 1, NULL, filt_ugenrdetach, filt_ugenread_isoc };
2014 
2015 #ifdef UGEN_BULK_RA_WB
2016 static const struct filterops ugenread_bulk_filtops =
2017 	{ 1, NULL, filt_ugenrdetach, filt_ugenread_bulk };
2018 
2019 static const struct filterops ugenwrite_bulk_filtops =
2020 	{ 1, NULL, filt_ugenrdetach, filt_ugenwrite_bulk };
2021 #else
2022 static const struct filterops ugen_seltrue_filtops =
2023 	{ 1, NULL, filt_ugenrdetach, filt_seltrue };
2024 #endif
2025 
2026 int
2027 ugenkqfilter(dev_t dev, struct knote *kn)
2028 {
2029 	struct ugen_softc *sc;
2030 	struct ugen_endpoint *sce;
2031 	struct klist *klist;
2032 	int s;
2033 
2034 	USB_GET_SC(ugen, UGENUNIT(dev), sc);
2035 
2036 	if (sc->sc_dying)
2037 		return (1);
2038 
2039 	switch (kn->kn_filter) {
2040 	case EVFILT_READ:
2041 		sce = &sc->sc_endpoints[UGENENDPOINT(dev)][IN];
2042 		if (sce == NULL)
2043 			return (1);
2044 
2045 		klist = &sce->rsel.sel_klist;
2046 		switch (sce->edesc->bmAttributes & UE_XFERTYPE) {
2047 		case UE_INTERRUPT:
2048 			kn->kn_fop = &ugenread_intr_filtops;
2049 			break;
2050 		case UE_ISOCHRONOUS:
2051 			kn->kn_fop = &ugenread_isoc_filtops;
2052 			break;
2053 		case UE_BULK:
2054 #ifdef UGEN_BULK_RA_WB
2055 			kn->kn_fop = &ugenread_bulk_filtops;
2056 			break;
2057 #else
2058 			/*
2059 			 * We have no easy way of determining if a read will
2060 			 * yield any data or a write will happen.
2061 			 * So, emulate "seltrue".
2062 			 */
2063 			kn->kn_fop = &ugen_seltrue_filtops;
2064 #endif
2065 			break;
2066 		default:
2067 			return (1);
2068 		}
2069 		break;
2070 
2071 	case EVFILT_WRITE:
2072 		sce = &sc->sc_endpoints[UGENENDPOINT(dev)][OUT];
2073 		if (sce == NULL)
2074 			return (1);
2075 
2076 		klist = &sce->rsel.sel_klist;
2077 		switch (sce->edesc->bmAttributes & UE_XFERTYPE) {
2078 		case UE_INTERRUPT:
2079 		case UE_ISOCHRONOUS:
2080 			/* XXX poll doesn't support this */
2081 			return (1);
2082 
2083 		case UE_BULK:
2084 #ifdef UGEN_BULK_RA_WB
2085 			kn->kn_fop = &ugenwrite_bulk_filtops;
2086 #else
2087 			/*
2088 			 * We have no easy way of determining if a read will
2089 			 * yield any data or a write will happen.
2090 			 * So, emulate "seltrue".
2091 			 */
2092 			kn->kn_fop = &ugen_seltrue_filtops;
2093 #endif
2094 			break;
2095 		default:
2096 			return (1);
2097 		}
2098 		break;
2099 
2100 	default:
2101 		return (1);
2102 	}
2103 
2104 	kn->kn_hook = sce;
2105 
2106 	s = splusb();
2107 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
2108 	splx(s);
2109 
2110 	return (0);
2111 }
2112 
2113 #if defined(__FreeBSD__)
2114 DRIVER_MODULE(ugen, uhub, ugen_driver, ugen_devclass, usbd_driver_load, 0);
2115 #endif
2116