[PATCH] isdn4linux: Siemens Gigaset drivers - direct USB connection

And: Tilman Schmidt <tilman@imap.cc>

This patch adds the main source file of the connection-specific module
"bas_gigaset", the hardware driver for Gigaset base stations connected
directly to the computer via USB.  It contains the code for handling
probe/disconnect, AT command/response transmission, and call setup and
termination.

Signed-off-by: Hansjoerg Lipp <hjlipp@web.de>
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Cc: Karsten Keil <kkeil@suse.de>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 2365 insertions, 0 deletions

diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
new file mode 100644
index 000000000000..31f0f07832bc
--- /dev/null
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -0,0 +1,2365 @@
+/*
+ * USB driver for Gigaset 307x base via direct USB connection.
+ *
+ * Copyright (c) 2001 by Hansjoerg Lipp <hjlipp@web.de>,
+ *                       Tilman Schmidt <tilman@imap.cc>,
+ *                       Stefan Eilers <Eilers.Stefan@epost.de>.
+ *
+ * Based on usb-gigaset.c.
+ *
+ * =====================================================================
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License as
+ *	published by the Free Software Foundation; either version 2 of
+ *	the License, or (at your option) any later version.
+ * =====================================================================
+ * ToDo: ...
+ * =====================================================================
+ * Version: $Id: bas-gigaset.c,v 1.52.4.19 2006/02/04 18:28:16 hjlipp Exp $
+ * =====================================================================
+ */
+
+#include "gigaset.h"
+
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/timer.h>
+#include <linux/usb.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+
+/* Version Information */
+#define DRIVER_AUTHOR "Tilman Schmidt <tilman@imap.cc>, Hansjoerg Lipp <hjlipp@web.de>, Stefan Eilers <Eilers.Stefan@epost.de>"
+#define DRIVER_DESC "USB Driver for Gigaset 307x"
+
+
+/* Module parameters */
+
+static int startmode = SM_ISDN;
+static int cidmode = 1;
+
+module_param(startmode, int, S_IRUGO);
+module_param(cidmode, int, S_IRUGO);
+MODULE_PARM_DESC(startmode, "start in isdn4linux mode");
+MODULE_PARM_DESC(cidmode, "Call-ID mode");
+
+#define GIGASET_MINORS     1
+#define GIGASET_MINOR      16
+#define GIGASET_MODULENAME "bas_gigaset"
+#define GIGASET_DEVFSNAME  "gig/bas/"
+#define GIGASET_DEVNAME    "ttyGB"
+
+#define IF_WRITEBUF 256 //FIXME
+
+/* Values for the Gigaset 307x */
+#define USB_GIGA_VENDOR_ID      0x0681
+#define USB_GIGA_PRODUCT_ID     0x0001
+#define USB_4175_PRODUCT_ID     0x0002
+#define USB_SX303_PRODUCT_ID    0x0021
+#define USB_SX353_PRODUCT_ID    0x0022
+
+/* table of devices that work with this driver */
+static struct usb_device_id gigaset_table [] = {
+	{ USB_DEVICE(USB_GIGA_VENDOR_ID, USB_GIGA_PRODUCT_ID) },
+	{ USB_DEVICE(USB_GIGA_VENDOR_ID, USB_4175_PRODUCT_ID) },
+	{ USB_DEVICE(USB_GIGA_VENDOR_ID, USB_SX303_PRODUCT_ID) },
+	{ USB_DEVICE(USB_GIGA_VENDOR_ID, USB_SX353_PRODUCT_ID) },
+	{ } /* Terminating entry */
+};
+
+MODULE_DEVICE_TABLE(usb, gigaset_table);
+
+/* Get a minor range for your devices from the usb maintainer */
+#define USB_SKEL_MINOR_BASE	200
+
+/*======================= local function prototypes =============================*/
+
+/* This function is called if a new device is connected to the USB port. It
+ * checks whether this new device belongs to this driver.
+ */
+static int gigaset_probe(struct usb_interface *interface,
+			 const struct usb_device_id *id);
+
+/* Function will be called if the device is unplugged */
+static void gigaset_disconnect(struct usb_interface *interface);
+
+
+/*==============================================================================*/
+
+struct bas_cardstate {
+	struct usb_device       *udev;		/* USB device pointer */
+	struct usb_interface    *interface;	/* interface for this device */
+	unsigned char		minor;		/* starting minor number */
+
+	struct urb              *urb_ctrl;	/* control pipe default URB */
+	struct usb_ctrlrequest	dr_ctrl;
+	struct timer_list	timer_ctrl;	/* control request timeout */
+
+	struct timer_list	timer_atrdy;	/* AT command ready timeout */
+	struct urb              *urb_cmd_out;	/* for sending AT commands */
+	struct usb_ctrlrequest	dr_cmd_out;
+	int			retry_cmd_out;
+
+	struct urb              *urb_cmd_in;	/* for receiving AT replies */
+	struct usb_ctrlrequest	dr_cmd_in;
+	struct timer_list	timer_cmd_in;	/* receive request timeout */
+	unsigned char           *rcvbuf;	/* AT reply receive buffer */
+
+	struct urb              *urb_int_in;	/* URB for interrupt pipe */
+	unsigned char		int_in_buf[3];
+
+	spinlock_t		lock;		/* locks all following */
+	atomic_t		basstate;	/* bitmap (BS_*) */
+	int			pending;	/* uncompleted base request */
+	int			rcvbuf_size;	/* size of AT receive buffer */
+						/* 0: no receive in progress */
+	int			retry_cmd_in;	/* receive req retry count */
+};
+
+/* status of direct USB connection to 307x base (bits in basstate) */
+#define BS_ATOPEN	0x001
+#define BS_B1OPEN	0x002
+#define BS_B2OPEN	0x004
+#define BS_ATREADY	0x008
+#define BS_INIT		0x010
+#define BS_ATTIMER	0x020
+
+
+static struct gigaset_driver *driver = NULL;
+static struct cardstate *cardstate = NULL;
+
+/* usb specific object needed to register this driver with the usb subsystem */
+static struct usb_driver gigaset_usb_driver = {
+	.name =         GIGASET_MODULENAME,
+	.probe =        gigaset_probe,
+	.disconnect =   gigaset_disconnect,
+	.id_table =     gigaset_table,
+};
+
+/* get message text for USB status code
+ */
+static char *get_usb_statmsg(int status)
+{
+	static char unkmsg[28];
+
+	switch (status) {
+	case 0:
+		return "success";
+	case -ENOENT:
+		return "canceled";
+	case -ECONNRESET:
+		return "canceled (async)";
+	case -EINPROGRESS:
+		return "pending";
+	case -EPROTO:
+		return "bit stuffing or unknown USB error";
+	case -EILSEQ:
+		return "Illegal byte sequence (CRC mismatch)";
+	case -EPIPE:
+		return "babble detect or endpoint stalled";
+	case -ENOSR:
+		return "buffer error";
+	case -ETIMEDOUT:
+		return "timed out";
+	case -ENODEV:
+		return "device not present";
+	case -EREMOTEIO:
+		return "short packet detected";
+	case -EXDEV:
+		return "partial isochronous transfer";
+	case -EINVAL:
+		return "invalid argument";
+	case -ENXIO:
+		return "URB already queued";
+	case -EAGAIN:
+		return "isochronous start frame too early or too much scheduled";
+	case -EFBIG:
+		return "too many isochronous frames requested";
+	case -EMSGSIZE:
+		return "endpoint message size zero";
+	case -ESHUTDOWN:
+		return "endpoint shutdown";
+	case -EBUSY:
+		return "another request pending";
+	default:
+		snprintf(unkmsg, sizeof(unkmsg), "unknown error %d", status);
+		return unkmsg;
+	}
+}
+
+/* usb_pipetype_str
+ * retrieve string representation of USB pipe type
+ */
+static inline char *usb_pipetype_str(int pipe)
+{
+	if (usb_pipeisoc(pipe))
+		return "Isoc";
+	if (usb_pipeint(pipe))
+		return "Int";
+	if (usb_pipecontrol(pipe))
+		return "Ctrl";
+	if (usb_pipebulk(pipe))
+		return "Bulk";
+	return "?";
+}
+
+/* dump_urb
+ * write content of URB to syslog for debugging
+ */
+static inline void dump_urb(enum debuglevel level, const char *tag,
+                            struct urb *urb)
+{
+#ifdef CONFIG_GIGASET_DEBUG
+	int i;
+	IFNULLRET(tag);
+	dbg(level, "%s urb(0x%08lx)->{", tag, (unsigned long) urb);
+	if (urb) {
+		dbg(level,
+		    "  dev=0x%08lx, pipe=%s:EP%d/DV%d:%s, "
+		    "status=%d, hcpriv=0x%08lx, transfer_flags=0x%x,",
+		    (unsigned long) urb->dev,
+		    usb_pipetype_str(urb->pipe),
+		    usb_pipeendpoint(urb->pipe), usb_pipedevice(urb->pipe),
+		    usb_pipein(urb->pipe) ? "in" : "out",
+		    urb->status, (unsigned long) urb->hcpriv,
+		    urb->transfer_flags);
+		dbg(level,
+		    "  transfer_buffer=0x%08lx[%d], actual_length=%d, "
+		    "bandwidth=%d, setup_packet=0x%08lx,",
+		    (unsigned long) urb->transfer_buffer,
+		    urb->transfer_buffer_length, urb->actual_length,
+		    urb->bandwidth, (unsigned long) urb->setup_packet);
+		dbg(level,
+		    "  start_frame=%d, number_of_packets=%d, interval=%d, "
+		    "error_count=%d,",
+		    urb->start_frame, urb->number_of_packets, urb->interval,
+		    urb->error_count);
+		dbg(level,
+		    "  context=0x%08lx, complete=0x%08lx, iso_frame_desc[]={",
+		    (unsigned long) urb->context,
+		    (unsigned long) urb->complete);
+		for (i = 0; i < urb->number_of_packets; i++) {
+			struct usb_iso_packet_descriptor *pifd = &urb->iso_frame_desc[i];
+			dbg(level,
+			    "    {offset=%u, length=%u, actual_length=%u, "
+			    "status=%u}",
+			    pifd->offset, pifd->length, pifd->actual_length,
+			    pifd->status);
+		}
+	}
+	dbg(level, "}}");
+#endif
+}
+
+/* read/set modem control bits etc. (m10x only) */
+static int gigaset_set_modem_ctrl(struct cardstate *cs, unsigned old_state,
+                                  unsigned new_state)
+{
+	return -EINVAL;
+}
+
+static int gigaset_baud_rate(struct cardstate *cs, unsigned cflag)
+{
+	return -EINVAL;
+}
+
+static int gigaset_set_line_ctrl(struct cardstate *cs, unsigned cflag)
+{
+	return -EINVAL;
+}
+
+/* error_hangup
+ * hang up any existing connection because of an unrecoverable error
+ * This function may be called from any context and takes care of scheduling
+ * the necessary actions for execution outside of interrupt context.
+ * argument:
+ *	B channel control structure
+ */
+static inline void error_hangup(struct bc_state *bcs)
+{
+	struct cardstate *cs = bcs->cs;
+
+	dbg(DEBUG_ANY,
+	    "%s: scheduling HUP for channel %d", __func__, bcs->channel);
+
+	if (!gigaset_add_event(cs, &bcs->at_state, EV_HUP, NULL, 0, NULL)) {
+		//FIXME what should we do?
+		return;
+	}
+
+	gigaset_schedule_event(cs);
+}
+
+/* error_reset
+ * reset Gigaset device because of an unrecoverable error
+ * This function may be called from any context and takes care of scheduling
+ * the necessary actions for execution outside of interrupt context.
+ * argument:
+ *	controller state structure
+ */
+static inline void error_reset(struct cardstate *cs)
+{
+	//FIXME try to recover without bothering the user
+	err("unrecoverable error - please disconnect the Gigaset base to reset");
+}
+
+/* check_pending
+ * check for completion of pending control request
+ * parameter:
+ *	urb	USB request block of completed request
+ *		urb->context = hardware specific controller state structure
+ */
+static void check_pending(struct bas_cardstate *ucs)
+{
+	unsigned long flags;
+
+	IFNULLRET(ucs);
+	IFNULLRET(cardstate);
+
+	spin_lock_irqsave(&ucs->lock, flags);
+	switch (ucs->pending) {
+	case 0:
+		break;
+	case HD_OPEN_ATCHANNEL:
+		if (atomic_read(&ucs->basstate) & BS_ATOPEN)
+			ucs->pending = 0;
+		break;
+	case HD_OPEN_B1CHANNEL:
+		if (atomic_read(&ucs->basstate) & BS_B1OPEN)
+			ucs->pending = 0;
+		break;
+	case HD_OPEN_B2CHANNEL:
+		if (atomic_read(&ucs->basstate) & BS_B2OPEN)
+			ucs->pending = 0;
+		break;
+	case HD_CLOSE_ATCHANNEL:
+		if (!(atomic_read(&ucs->basstate) & BS_ATOPEN))
+			ucs->pending = 0;
+		//wake_up_interruptible(cs->initwait);
+		//FIXME need own wait queue?
+		break;
+	case HD_CLOSE_B1CHANNEL:
+		if (!(atomic_read(&ucs->basstate) & BS_B1OPEN))
+			ucs->pending = 0;
+		break;
+	case HD_CLOSE_B2CHANNEL:
+		if (!(atomic_read(&ucs->basstate) & BS_B2OPEN))
+			ucs->pending = 0;
+		break;
+	case HD_DEVICE_INIT_ACK:		/* no reply expected */
+		ucs->pending = 0;
+		break;
+	/* HD_READ_ATMESSAGE, HD_WRITE_ATMESSAGE, HD_RESET_INTERRUPTPIPE
+	 * are handled separately and should never end up here
+	 */
+	default:
+		warn("unknown pending request 0x%02x cleared", ucs->pending);
+		ucs->pending = 0;
+	}
+
+	if (!ucs->pending)
+		del_timer(&ucs->timer_ctrl);
+
+	spin_unlock_irqrestore(&ucs->lock, flags);
+}
+
+/* cmd_in_timeout
+ * timeout routine for command input request
+ * argument:
+ *	controller state structure
+ */
+static void cmd_in_timeout(unsigned long data)
+{
+	struct cardstate *cs = (struct cardstate *) data;
+	struct bas_cardstate *ucs;
+	unsigned long flags;
+
+	IFNULLRET(cs);
+	ucs = cs->hw.bas;
+	IFNULLRET(ucs);
+
+	spin_lock_irqsave(&cs->lock, flags);
+	if (!atomic_read(&cs->connected)) {
+		dbg(DEBUG_USBREQ, "%s: disconnected", __func__);
+		spin_unlock_irqrestore(&cs->lock, flags);
+		return;
+	}
+	if (!ucs->rcvbuf_size) {
+		dbg(DEBUG_USBREQ, "%s: no receive in progress", __func__);
+		spin_unlock_irqrestore(&cs->lock, flags);
+		return;
+	}
+	spin_unlock_irqrestore(&cs->lock, flags);
+
+	err("timeout reading AT response");
+	error_reset(cs);	//FIXME retry?
+}
+
+
+static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs);
+
+/* atread_submit
+ * submit an HD_READ_ATMESSAGE command URB
+ * parameters:
+ *	cs	controller state structure
+ *	timeout	timeout in 1/10 sec., 0: none
+ * return value:
+ *	0 on success
+ *	-EINVAL if a NULL pointer is encountered somewhere
+ *	-EBUSY if another request is pending
+ *	any URB submission error code
+ */
+static int atread_submit(struct cardstate *cs, int timeout)
+{
+	struct bas_cardstate *ucs;
+	int ret;
+
+	IFNULLRETVAL(cs, -EINVAL);
+	ucs = cs->hw.bas;
+	IFNULLRETVAL(ucs, -EINVAL);
+	IFNULLRETVAL(ucs->urb_cmd_in, -EINVAL);
+
+	dbg(DEBUG_USBREQ, "-------> HD_READ_ATMESSAGE (%d)", ucs->rcvbuf_size);
+
+	if (ucs->urb_cmd_in->status == -EINPROGRESS) {
+		err("could not submit HD_READ_ATMESSAGE: URB busy");
+		return -EBUSY;
+	}
+
+	ucs->dr_cmd_in.bRequestType = IN_VENDOR_REQ;
+	ucs->dr_cmd_in.bRequest = HD_READ_ATMESSAGE;
+	ucs->dr_cmd_in.wValue = 0;
+	ucs->dr_cmd_in.wIndex = 0;
+	ucs->dr_cmd_in.wLength = cpu_to_le16(ucs->rcvbuf_size);
+	usb_fill_control_urb(ucs->urb_cmd_in, ucs->udev,
+	                     usb_rcvctrlpipe(ucs->udev, 0),
+	                     (unsigned char*) & ucs->dr_cmd_in,
+	                     ucs->rcvbuf, ucs->rcvbuf_size,
+	                     read_ctrl_callback, cs->inbuf);
+
+	if ((ret = usb_submit_urb(ucs->urb_cmd_in, SLAB_ATOMIC)) != 0) {
+		err("could not submit HD_READ_ATMESSAGE: %s",
+		    get_usb_statmsg(ret));
+		return ret;
+	}
+
+	if (timeout > 0) {
+		dbg(DEBUG_USBREQ, "setting timeout of %d/10 secs", timeout);
+		ucs->timer_cmd_in.expires = jiffies + timeout * HZ / 10;
+		ucs->timer_cmd_in.data = (unsigned long) cs;
+		ucs->timer_cmd_in.function = cmd_in_timeout;
+		add_timer(&ucs->timer_cmd_in);
+	}
+	return 0;
+}
+
+static void stopurbs(struct bas_bc_state *);
+static int start_cbsend(struct cardstate *);
+
+/* set/clear bits in base connection state
+ */
+inline static void update_basstate(struct bas_cardstate *ucs,
+				   int set, int clear)
+{
+	unsigned long flags;
+	int state;
+
+	spin_lock_irqsave(&ucs->lock, flags);
+	state = atomic_read(&ucs->basstate);
+	state &= ~clear;
+	state |= set;
+	atomic_set(&ucs->basstate, state);
+	spin_unlock_irqrestore(&ucs->lock, flags);
+}
+
+
+/* read_int_callback
+ * USB completion handler for interrupt pipe input
+ * called by the USB subsystem in interrupt context
+ * parameter:
+ *	urb	USB request block
+ *		urb->context = controller state structure
+ */
+static void read_int_callback(struct urb *urb, struct pt_regs *regs)
+{
+	struct cardstate *cs;
+	struct bas_cardstate *ucs;
+	struct bc_state *bcs;
+	unsigned long flags;
+	int status;
+	unsigned l;
+	int channel;
+
+	IFNULLRET(urb);
+	cs = (struct cardstate *) urb->context;
+	IFNULLRET(cs);
+	ucs = cs->hw.bas;
+	IFNULLRET(ucs);
+
+	if (unlikely(!atomic_read(&cs->connected))) {
+		warn("%s: disconnected", __func__);
+		return;
+	}
+
+	switch (urb->status) {
+	case 0:			/* success */
+		break;
+	case -ENOENT:			/* canceled */
+	case -ECONNRESET:		/* canceled (async) */
+	case -EINPROGRESS:		/* pending */
+		/* ignore silently */
+		dbg(DEBUG_USBREQ,
+		    "%s: %s", __func__, get_usb_statmsg(urb->status));
+		return;
+	default:		/* severe trouble */
+		warn("interrupt read: %s", get_usb_statmsg(urb->status));
+		//FIXME corrective action? resubmission always ok?
+		goto resubmit;
+	}
+
+	l = (unsigned) ucs->int_in_buf[1] +
+	    (((unsigned) ucs->int_in_buf[2]) << 8);
+
+	dbg(DEBUG_USBREQ,
+	    "<-------%d: 0x%02x (%u [0x%02x 0x%02x])", urb->actual_length,
+	    (int)ucs->int_in_buf[0], l,
+	    (int)ucs->int_in_buf[1], (int)ucs->int_in_buf[2]);
+
+	channel = 0;
+
+	switch (ucs->int_in_buf[0]) {
+	case HD_DEVICE_INIT_OK:
+		update_basstate(ucs, BS_INIT, 0);
+		break;
+
+	case HD_READY_SEND_ATDATA:
+		del_timer(&ucs->timer_atrdy);
+		update_basstate(ucs, BS_ATREADY, BS_ATTIMER);
+		start_cbsend(cs);
+		break;
+
+	case HD_OPEN_B2CHANNEL_ACK:
+		++channel;
+	case HD_OPEN_B1CHANNEL_ACK:
+		bcs = cs->bcs + channel;
+		update_basstate(ucs, BS_B1OPEN << channel, 0);
+		gigaset_bchannel_up(bcs);
+		break;
+
+	case HD_OPEN_ATCHANNEL_ACK:
+		update_basstate(ucs, BS_ATOPEN, 0);
+		start_cbsend(cs);
+		break;
+
+	case HD_CLOSE_B2CHANNEL_ACK:
+		++channel;
+	case HD_CLOSE_B1CHANNEL_ACK:
+		bcs = cs->bcs + channel;
+		update_basstate(ucs, 0, BS_B1OPEN << channel);
+		stopurbs(bcs->hw.bas);
+		gigaset_bchannel_down(bcs);
+		break;
+
+	case HD_CLOSE_ATCHANNEL_ACK:
+		update_basstate(ucs, 0, BS_ATOPEN);
+		break;
+
+	case HD_B2_FLOW_CONTROL:
+		++channel;
+	case HD_B1_FLOW_CONTROL:
+		bcs = cs->bcs + channel;
+		atomic_add((l - BAS_NORMFRAME) * BAS_CORRFRAMES,
+		           &bcs->hw.bas->corrbytes);
+		dbg(DEBUG_ISO,
+		    "Flow control (channel %d, sub %d): 0x%02x => %d",
+		    channel, bcs->hw.bas->numsub, l,
+		    atomic_read(&bcs->hw.bas->corrbytes));
+		break;
+
+	case HD_RECEIVEATDATA_ACK:	/* AT response ready to be received */
+		if (!l) {
+			warn("HD_RECEIVEATDATA_ACK with length 0 ignored");
+			break;
+		}
+		spin_lock_irqsave(&cs->lock, flags);
+		if (ucs->rcvbuf_size) {
+			spin_unlock_irqrestore(&cs->lock, flags);
+			err("receive AT data overrun, %d bytes lost", l);
+			error_reset(cs);	//FIXME reschedule
+			break;
+		}
+		if ((ucs->rcvbuf = kmalloc(l, GFP_ATOMIC)) == NULL) {
+			spin_unlock_irqrestore(&cs->lock, flags);
+			err("%s: out of memory, %d bytes lost", __func__, l);
+			error_reset(cs);	//FIXME reschedule
+			break;
+		}
+		ucs->rcvbuf_size = l;
+		ucs->retry_cmd_in = 0;
+		if ((status = atread_submit(cs, BAS_TIMEOUT)) < 0) {
+			kfree(ucs->rcvbuf);
+			ucs->rcvbuf = NULL;
+			ucs->rcvbuf_size = 0;
+			error_reset(cs);	//FIXME reschedule
+		}
+		spin_unlock_irqrestore(&cs->lock, flags);
+		break;
+
+	case HD_RESET_INTERRUPT_PIPE_ACK:
+		dbg(DEBUG_USBREQ, "HD_RESET_INTERRUPT_PIPE_ACK");
+		break;
+
+	case HD_SUSPEND_END:
+		dbg(DEBUG_USBREQ, "HD_SUSPEND_END");
+		break;
+
+	default:
+		warn("unknown Gigaset signal 0x%02x (%u) ignored",
+		     (int) ucs->int_in_buf[0], l);
+	}
+
+	check_pending(ucs);
+
+resubmit:
+	status = usb_submit_urb(urb, SLAB_ATOMIC);
+	if (unlikely(status)) {
+		err("could not resubmit interrupt URB: %s",
+		    get_usb_statmsg(status));
+		error_reset(cs);
+	}
+}
+
+/* read_ctrl_callback
+ * USB completion handler for control pipe input
+ * called by the USB subsystem in interrupt context
+ * parameter:
+ *	urb	USB request block
+ *		urb->context = inbuf structure for controller state
+ */
+static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
+{
+	struct cardstate *cs;
+	struct bas_cardstate *ucs;
+	unsigned numbytes;
+	unsigned long flags;
+	struct inbuf_t *inbuf;
+	int have_data = 0;
+
+	IFNULLRET(urb);
+	inbuf = (struct inbuf_t *) urb->context;
+	IFNULLRET(inbuf);
+	cs = inbuf->cs;
+	IFNULLRET(cs);
+	ucs = cs->hw.bas;
+	IFNULLRET(ucs);
+
+	spin_lock_irqsave(&cs->lock, flags);
+	if (!atomic_read(&cs->connected)) {
+		warn("%s: disconnected", __func__);
+		spin_unlock_irqrestore(&cs->lock, flags);
+		return;
+	}
+
+	if (!ucs->rcvbuf_size) {
+		warn("%s: no receive in progress", __func__);
+		spin_unlock_irqrestore(&cs->lock, flags);
+		return;
+	}
+
+	del_timer(&ucs->timer_cmd_in);
+
+	switch (urb->status) {
+	case 0:				/* normal completion */
+		numbytes = urb->actual_length;
+		if (unlikely(numbytes == 0)) {
+			warn("control read: empty block received");
+			goto retry;
+		}
+		if (unlikely(numbytes != ucs->rcvbuf_size)) {
+			warn("control read: received %d chars, expected %d",
+			     numbytes, ucs->rcvbuf_size);
+			if (numbytes > ucs->rcvbuf_size)
+				numbytes = ucs->rcvbuf_size;
+		}
+
+		/* copy received bytes to inbuf */
+		have_data = gigaset_fill_inbuf(inbuf, ucs->rcvbuf, numbytes);
+
+		if (unlikely(numbytes < ucs->rcvbuf_size)) {
+			/* incomplete - resubmit for remaining bytes */
+			ucs->rcvbuf_size -= numbytes;
+			ucs->retry_cmd_in = 0;
+			goto retry;
+		}
+		break;
+
+	case -ENOENT:			/* canceled */
+	case -ECONNRESET:		/* canceled (async) */
+	case -EINPROGRESS:		/* pending */
+		/* no action necessary */
+		dbg(DEBUG_USBREQ,
+		    "%s: %s", __func__, get_usb_statmsg(urb->status));
+		break;
+
+	default:			/* severe trouble */
+		warn("control read: %s", get_usb_statmsg(urb->status));
+	retry:
+		if (ucs->retry_cmd_in++ < BAS_RETRY) {
+			notice("control read: retry %d", ucs->retry_cmd_in);
+			if (atread_submit(cs, BAS_TIMEOUT) >= 0) {
+				/* resubmitted - bypass regular exit block */
+				spin_unlock_irqrestore(&cs->lock, flags);
+				return;
+			}
+		} else {
+			err("control read: giving up after %d tries",
+			    ucs->retry_cmd_in);
+		}
+		error_reset(cs);
+	}
+
+	kfree(ucs->rcvbuf);
+	ucs->rcvbuf = NULL;
+	ucs->rcvbuf_size = 0;
+	spin_unlock_irqrestore(&cs->lock, flags);
+	if (have_data) {
+		dbg(DEBUG_INTR, "%s-->BH", __func__);
+		gigaset_schedule_event(cs);
+	}
+}
+
+/* read_iso_callback
+ * USB completion handler for B channel isochronous input
+ * called by the USB subsystem in interrupt context
+ * parameter:
+ *	urb	USB request block of completed request
+ *		urb->context = bc_state structure
+ */
+static void read_iso_callback(struct urb *urb, struct pt_regs *regs)
+{
+	struct bc_state *bcs;
+	struct bas_bc_state *ubc;
+	unsigned long flags;
+	int i, rc;
+
+	IFNULLRET(urb);
+	IFNULLRET(urb->context);
+	IFNULLRET(cardstate);
+
+	/* status codes not worth bothering the tasklet with */
+	if (unlikely(urb->status == -ENOENT || urb->status == -ECONNRESET ||
+	             urb->status == -EINPROGRESS)) {
+		dbg(DEBUG_ISO,
+		    "%s: %s", __func__, get_usb_statmsg(urb->status));
+		return;
+	}
+
+	bcs = (struct bc_state *) urb->context;
+	ubc = bcs->hw.bas;
+	IFNULLRET(ubc);
+
+	spin_lock_irqsave(&ubc->isoinlock, flags);
+	if (likely(ubc->isoindone == NULL)) {
+		/* pass URB to tasklet */
+		ubc->isoindone = urb;
+		tasklet_schedule(&ubc->rcvd_tasklet);
+	} else {
+		/* tasklet still busy, drop data and resubmit URB */
+		ubc->loststatus = urb->status;
+		for (i = 0; i < BAS_NUMFRAMES; i++) {
+			ubc->isoinlost += urb->iso_frame_desc[i].actual_length;
+			if (unlikely(urb->iso_frame_desc[i].status != 0 &&
+				     urb->iso_frame_desc[i].status != -EINPROGRESS)) {
+				ubc->loststatus = urb->iso_frame_desc[i].status;
+			}
+			urb->iso_frame_desc[i].status = 0;
+			urb->iso_frame_desc[i].actual_length = 0;
+		}
+		if (likely(atomic_read(&ubc->running))) {
+			urb->dev = bcs->cs->hw.bas->udev;	/* clobbered by USB subsystem */
+			urb->transfer_flags = URB_ISO_ASAP;
+			urb->number_of_packets = BAS_NUMFRAMES;
+			dbg(DEBUG_ISO, "%s: isoc read overrun/resubmit", __func__);
+			rc = usb_submit_urb(urb, SLAB_ATOMIC);
+			if (unlikely(rc != 0)) {
+				err("could not resubmit isochronous read URB: %s",
+				    get_usb_statmsg(rc));
+				dump_urb(DEBUG_ISO, "isoc read", urb);
+				error_hangup(bcs);
+			}
+		}
+	}
+	spin_unlock_irqrestore(&ubc->isoinlock, flags);
+}
+
+/* write_iso_callback
+ * USB completion handler for B channel isochronous output
+ * called by the USB subsystem in interrupt context
+ * parameter:
+ *	urb	USB request block of completed request
+ *		urb->context = isow_urbctx_t structure
+ */
+static void write_iso_callback(struct urb *urb, struct pt_regs *regs)
+{
+	struct isow_urbctx_t *ucx;
+	struct bas_bc_state *ubc;
+	unsigned long flags;
+
+	IFNULLRET(urb);
+	IFNULLRET(urb->context);
+	IFNULLRET(cardstate);
+
+	/* status codes not worth bothering the tasklet with */
+	if (unlikely(urb->status == -ENOENT || urb->status == -ECONNRESET ||
+	             urb->status == -EINPROGRESS)) {
+		dbg(DEBUG_ISO,
+		    "%s: %s", __func__, get_usb_statmsg(urb->status));
+		return;
+	}
+
+	/* pass URB context to tasklet */
+	ucx = (struct isow_urbctx_t *) urb->context;
+	IFNULLRET(ucx->bcs);
+	ubc = ucx->bcs->hw.bas;
+	IFNULLRET(ubc);
+
+	spin_lock_irqsave(&ubc->isooutlock, flags);
+	ubc->isooutovfl = ubc->isooutdone;
+	ubc->isooutdone = ucx;
+	spin_unlock_irqrestore(&ubc->isooutlock, flags);
+	tasklet_schedule(&ubc->sent_tasklet);
+}
+
+/* starturbs
+ * prepare and submit USB request blocks for isochronous input and output
+ * argument:
+ *	B channel control structure
+ * return value:
+ *	0 on success
+ *	< 0 on error (no URBs submitted)
+ */
+static int starturbs(struct bc_state *bcs)
+{
+	struct urb *urb;
+	struct bas_bc_state *ubc;
+	int j, k;
+	int rc;
+
+	IFNULLRETVAL(bcs, -EFAULT);
+	ubc = bcs->hw.bas;
+	IFNULLRETVAL(ubc, -EFAULT);
+
+	/* initialize L2 reception */
+	if (bcs->proto2 == ISDN_PROTO_L2_HDLC)
+		bcs->inputstate |= INS_flag_hunt;
+
+	/* submit all isochronous input URBs */
+	atomic_set(&ubc->running, 1);
+	for (k = 0; k < BAS_INURBS; k++) {
+		urb = ubc->isoinurbs[k];
+		if (!urb) {
+			err("isoinurbs[%d]==NULL", k);
+			rc = -EFAULT;
+			goto error;
+		}
+
+		urb->dev = bcs->cs->hw.bas->udev;
+		urb->pipe = usb_rcvisocpipe(urb->dev, 3 + 2 * bcs->channel);
+		urb->transfer_flags = URB_ISO_ASAP;
+		urb->transfer_buffer = ubc->isoinbuf + k * BAS_INBUFSIZE;
+		urb->transfer_buffer_length = BAS_INBUFSIZE;
+		urb->number_of_packets = BAS_NUMFRAMES;
+		urb->interval = BAS_FRAMETIME;
+		urb->complete = read_iso_callback;
+		urb->context = bcs;
+		for (j = 0; j < BAS_NUMFRAMES; j++) {
+			urb->iso_frame_desc[j].offset = j * BAS_MAXFRAME;
+			urb->iso_frame_desc[j].length = BAS_MAXFRAME;
+			urb->iso_frame_desc[j].status = 0;
+			urb->iso_frame_desc[j].actual_length = 0;
+		}
+
+		dump_urb(DEBUG_ISO, "Initial isoc read", urb);
+		if ((rc = usb_submit_urb(urb, SLAB_ATOMIC)) != 0) {
+			err("could not submit isochronous read URB %d: %s",
+			    k, get_usb_statmsg(rc));
+			goto error;
+		}
+	}
+
+	/* initialize L2 transmission */
+	gigaset_isowbuf_init(ubc->isooutbuf, PPP_FLAG);
+
+	/* set up isochronous output URBs for flag idling */
+	for (k = 0; k < BAS_OUTURBS; ++k) {
+		urb = ubc->isoouturbs[k].urb;
+		if (!urb) {
+			err("isoouturbs[%d].urb==NULL", k);
+			rc = -EFAULT;
+			goto error;
+		}
+		urb->dev = bcs->cs->hw.bas->udev;
+		urb->pipe = usb_sndisocpipe(urb->dev, 4 + 2 * bcs->channel);
+		urb->transfer_flags = URB_ISO_ASAP;
+		urb->transfer_buffer = ubc->isooutbuf->data;
+		urb->transfer_buffer_length = sizeof(ubc->isooutbuf->data);
+		urb->number_of_packets = BAS_NUMFRAMES;
+		urb->interval = BAS_FRAMETIME;
+		urb->complete = write_iso_callback;
+		urb->context = &ubc->isoouturbs[k];
+		for (j = 0; j < BAS_NUMFRAMES; ++j) {
+			urb->iso_frame_desc[j].offset = BAS_OUTBUFSIZE;
+			urb->iso_frame_desc[j].length = BAS_NORMFRAME;
+			urb->iso_frame_desc[j].status = 0;
+			urb->iso_frame_desc[j].actual_length = 0;
+		}
+		ubc->isoouturbs[k].limit = -1;
+	}
+
+	/* submit two URBs, keep third one */
+	for (k = 0; k < 2; ++k) {
+		dump_urb(DEBUG_ISO, "Initial isoc write", urb);
+		rc = usb_submit_urb(ubc->isoouturbs[k].urb, SLAB_ATOMIC);
+		if (rc != 0) {
+			err("could not submit isochronous write URB %d: %s",
+			    k, get_usb_statmsg(rc));
+			goto error;
+		}
+	}
+	dump_urb(DEBUG_ISO, "Initial isoc write (free)", urb);
+	ubc->isooutfree = &ubc->isoouturbs[2];
+	ubc->isooutdone = ubc->isooutovfl = NULL;
+	return 0;
+ error:
+	stopurbs(ubc);
+	return rc;
+}
+
+/* stopurbs
+ * cancel the USB request blocks for isochronous input and output
+ * errors are silently ignored
+ * argument:
+ *	B channel control structure
+ */
+static void stopurbs(struct bas_bc_state *ubc)
+{
+	int k, rc;
+
+	IFNULLRET(ubc);
+
+	atomic_set(&ubc->running, 0);
+
+	for (k = 0; k < BAS_INURBS; ++k) {
+		rc = usb_unlink_urb(ubc->isoinurbs[k]);
+		dbg(DEBUG_ISO, "%s: isoc input URB %d unlinked, result = %d",
+		    __func__, k, rc);
+	}
+
+	for (k = 0; k < BAS_OUTURBS; ++k) {
+		rc = usb_unlink_urb(ubc->isoouturbs[k].urb);
+		dbg(DEBUG_ISO, "%s: isoc output URB %d unlinked, result = %d",
+		    __func__, k, rc);
+	}
+}
+
+/* Isochronous Write - Bottom Half */
+/* =============================== */
+
+/* submit_iso_write_urb
+ * fill and submit the next isochronous write URB
+ * parameters:
+ *	bcs	B channel state structure
+ * return value:
+ *	number of frames submitted in URB
+ *	0 if URB not submitted because no data available (isooutbuf busy)
+ *	error code < 0 on error
+ */
+static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
+{
+	struct urb *urb;
+	struct bas_bc_state *ubc;
+	struct usb_iso_packet_descriptor *ifd;
+	int corrbytes, nframe, rc;
+
+	IFNULLRETVAL(ucx, -EFAULT);
+	urb = ucx->urb;
+	IFNULLRETVAL(urb, -EFAULT);
+	IFNULLRETVAL(ucx->bcs, -EFAULT);
+	ubc = ucx->bcs->hw.bas;
+	IFNULLRETVAL(ubc, -EFAULT);
+
+	urb->dev = ucx->bcs->cs->hw.bas->udev;	/* clobbered by USB subsystem */
+	urb->transfer_flags = URB_ISO_ASAP;
+	urb->transfer_buffer = ubc->isooutbuf->data;
+	urb->transfer_buffer_length = sizeof(ubc->isooutbuf->data);
+
+	for (nframe = 0; nframe < BAS_NUMFRAMES; nframe++) {
+		ifd = &urb->iso_frame_desc[nframe];
+
+		/* compute frame length according to flow control */
+		ifd->length = BAS_NORMFRAME;
+		if ((corrbytes = atomic_read(&ubc->corrbytes)) != 0) {
+			dbg(DEBUG_ISO, "%s: corrbytes=%d", __func__, corrbytes);
+			if (corrbytes > BAS_HIGHFRAME - BAS_NORMFRAME)
+				corrbytes = BAS_HIGHFRAME - BAS_NORMFRAME;
+			else if (corrbytes < BAS_LOWFRAME - BAS_NORMFRAME)
+				corrbytes = BAS_LOWFRAME - BAS_NORMFRAME;
+			ifd->length += corrbytes;
+			atomic_add(-corrbytes, &ubc->corrbytes);
+		}
+		//dbg(DEBUG_ISO, "%s: frame %d length=%d", __func__, nframe, ifd->length);
+
+		/* retrieve block of data to send */
+		ifd->offset = gigaset_isowbuf_getbytes(ubc->isooutbuf, ifd->length);
+		if (ifd->offset < 0) {
+			if (ifd->offset == -EBUSY) {
+				dbg(DEBUG_ISO, "%s: buffer busy at frame %d",
+				    __func__, nframe);
+				/* tasklet will be restarted from gigaset_send_skb() */
+			} else {
+				err("%s: buffer error %d at frame %d",
+				    __func__, ifd->offset, nframe);
+				return ifd->offset;
+			}
+			break;
+		}
+		ucx->limit = atomic_read(&ubc->isooutbuf->nextread);
+		ifd->status = 0;
+		ifd->actual_length = 0;
+	}
+	if ((urb->number_of_packets = nframe) > 0) {
+		if ((rc = usb_submit_urb(urb, SLAB_ATOMIC)) != 0) {
+			err("could not submit isochronous write URB: %s",
+			    get_usb_statmsg(rc));
+			dump_urb(DEBUG_ISO, "isoc write", urb);
+			return rc;
+		}
+		++ubc->numsub;
+	}
+	return nframe;
+}
+
+/* write_iso_tasklet
+ * tasklet scheduled when an isochronous output URB from the Gigaset device
+ * has completed
+ * parameter:
+ *	data	B channel state structure
+ */
+static void write_iso_tasklet(unsigned long data)
+{
+	struct bc_state *bcs;
+	struct bas_bc_state *ubc;
+	struct cardstate *cs;
+	struct isow_urbctx_t *done, *next, *ovfl;
+	struct urb *urb;
+	struct usb_iso_packet_descriptor *ifd;
+	int offset;
+	unsigned long flags;
+	int i;
+	struct sk_buff *skb;
+	int len;
+
+	bcs = (struct bc_state *) data;
+	IFNULLRET(bcs);
+	ubc = bcs->hw.bas;
+	IFNULLRET(ubc);
+	cs = bcs->cs;
+	IFNULLRET(cs);
+
+	/* loop while completed URBs arrive in time */
+	for (;;) {
+		if (unlikely(!atomic_read(&cs->connected))) {
+			warn("%s: disconnected", __func__);
+			return;
+		}
+
+		if (unlikely(!(atomic_read(&ubc->running)))) {
+			dbg(DEBUG_ISO, "%s: not running", __func__);
+			return;
+		}
+
+		/* retrieve completed URBs */
+		spin_lock_irqsave(&ubc->isooutlock, flags);
+		done = ubc->isooutdone;
+		ubc->isooutdone = NULL;
+		ovfl = ubc->isooutovfl;
+		ubc->isooutovfl = NULL;
+		spin_unlock_irqrestore(&ubc->isooutlock, flags);
+		if (ovfl) {
+			err("isochronous write buffer underrun - buy a faster machine :-)");
+			error_hangup(bcs);
+			break;
+		}
+		if (!done)
+			break;
+
+		/* submit free URB if available */
+		spin_lock_irqsave(&ubc->isooutlock, flags);
+		next = ubc->isooutfree;
+		ubc->isooutfree = NULL;
+		spin_unlock_irqrestore(&ubc->isooutlock, flags);
+		if (next) {
+			if (submit_iso_write_urb(next) <= 0) {
+				/* could not submit URB, put it back */
+				spin_lock_irqsave(&ubc->isooutlock, flags);
+				if (ubc->isooutfree == NULL) {
+					ubc->isooutfree = next;
+					next = NULL;
+				}
+				spin_unlock_irqrestore(&ubc->isooutlock, flags);
+				if (next) {
+					/* couldn't put it back */
+					err("losing isochronous write URB");
+					error_hangup(bcs);
+				}
+			}
+		}
+
+		/* process completed URB */
+		urb = done->urb;
+		switch (urb->status) {
+		case 0:				/* normal completion */
+			break;
+		case -EXDEV:			/* inspect individual frames */
+			/* assumptions (for lack of documentation):
+			 * - actual_length bytes of the frame in error are successfully sent
+			 * - all following frames are not sent at all
+			 */
+			dbg(DEBUG_ISO, "%s: URB partially completed", __func__);
+			offset = done->limit;	/* just in case */
+			for (i = 0; i < BAS_NUMFRAMES; i++) {
+				ifd = &urb->iso_frame_desc[i];
+				if (ifd->status ||
+				    ifd->actual_length != ifd->length) {