xref: /freebsd/sys/dev/usb/net/if_usie.c (revision 2f513db7)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2011 Anybots Inc
5  * written by Akinori Furukoshi <moonlightakkiy@yahoo.ca>
6  *  - ucom part is based on u3g.c
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
32 
33 #include <sys/param.h>
34 #include <sys/eventhandler.h>
35 #include <sys/systm.h>
36 #include <sys/queue.h>
37 #include <sys/systm.h>
38 #include <sys/socket.h>
39 #include <sys/kernel.h>
40 #include <sys/bus.h>
41 #include <sys/module.h>
42 #include <sys/sockio.h>
43 #include <sys/socket.h>
44 #include <sys/lock.h>
45 #include <sys/mutex.h>
46 #include <sys/condvar.h>
47 #include <sys/sysctl.h>
48 #include <sys/malloc.h>
49 #include <sys/taskqueue.h>
50 
51 #include <net/if.h>
52 #include <net/if_var.h>
53 
54 #include <machine/bus.h>
55 
56 #include <net/if.h>
57 #include <net/if_types.h>
58 #include <net/netisr.h>
59 #include <net/bpf.h>
60 #include <net/ethernet.h>
61 
62 #include <netinet/in.h>
63 #include <netinet/ip.h>
64 #include <netinet/ip6.h>
65 #include <netinet/udp.h>
66 
67 #include <net80211/ieee80211_ioctl.h>
68 
69 #include <dev/usb/usb.h>
70 #include <dev/usb/usbdi.h>
71 #include <dev/usb/usbdi_util.h>
72 #include <dev/usb/usb_cdc.h>
73 #include "usbdevs.h"
74 
75 #define	USB_DEBUG_VAR usie_debug
76 #include <dev/usb/usb_debug.h>
77 #include <dev/usb/usb_process.h>
78 #include <dev/usb/usb_msctest.h>
79 
80 #include <dev/usb/serial/usb_serial.h>
81 
82 #include <dev/usb/net/if_usievar.h>
83 
84 #ifdef	USB_DEBUG
85 static int usie_debug = 0;
86 
87 static SYSCTL_NODE(_hw_usb, OID_AUTO, usie, CTLFLAG_RW, 0, "sierra USB modem");
88 SYSCTL_INT(_hw_usb_usie, OID_AUTO, debug, CTLFLAG_RWTUN, &usie_debug, 0,
89     "usie debug level");
90 #endif
91 
92 /* Sierra Wireless Direct IP modems */
93 static const STRUCT_USB_HOST_ID usie_devs[] = {
94 #define	USIE_DEV(v, d) {				\
95     USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##d) }
96 	USIE_DEV(SIERRA, MC8700),
97 	USIE_DEV(SIERRA, TRUINSTALL),
98 	USIE_DEV(AIRPRIME, USB308),
99 #undef	USIE_DEV
100 };
101 
102 static device_probe_t usie_probe;
103 static device_attach_t usie_attach;
104 static device_detach_t usie_detach;
105 static void usie_free_softc(struct usie_softc *);
106 
107 static void usie_free(struct ucom_softc *);
108 static void usie_uc_update_line_state(struct ucom_softc *, uint8_t);
109 static void usie_uc_cfg_get_status(struct ucom_softc *, uint8_t *, uint8_t *);
110 static void usie_uc_cfg_set_dtr(struct ucom_softc *, uint8_t);
111 static void usie_uc_cfg_set_rts(struct ucom_softc *, uint8_t);
112 static void usie_uc_cfg_open(struct ucom_softc *);
113 static void usie_uc_cfg_close(struct ucom_softc *);
114 static void usie_uc_start_read(struct ucom_softc *);
115 static void usie_uc_stop_read(struct ucom_softc *);
116 static void usie_uc_start_write(struct ucom_softc *);
117 static void usie_uc_stop_write(struct ucom_softc *);
118 
119 static usb_callback_t usie_uc_tx_callback;
120 static usb_callback_t usie_uc_rx_callback;
121 static usb_callback_t usie_uc_status_callback;
122 static usb_callback_t usie_if_tx_callback;
123 static usb_callback_t usie_if_rx_callback;
124 static usb_callback_t usie_if_status_callback;
125 
126 static void usie_if_sync_to(void *);
127 static void usie_if_sync_cb(void *, int);
128 static void usie_if_status_cb(void *, int);
129 
130 static void usie_if_start(struct ifnet *);
131 static int usie_if_output(struct ifnet *, struct mbuf *,
132 	const struct sockaddr *, struct route *);
133 static void usie_if_init(void *);
134 static void usie_if_stop(struct usie_softc *);
135 static int usie_if_ioctl(struct ifnet *, u_long, caddr_t);
136 
137 static int usie_do_request(struct usie_softc *, struct usb_device_request *, void *);
138 static int usie_if_cmd(struct usie_softc *, uint8_t);
139 static void usie_cns_req(struct usie_softc *, uint32_t, uint16_t);
140 static void usie_cns_rsp(struct usie_softc *, struct usie_cns *);
141 static void usie_hip_rsp(struct usie_softc *, uint8_t *, uint32_t);
142 static int usie_driver_loaded(struct module *, int, void *);
143 
144 static const struct usb_config usie_uc_config[USIE_UC_N_XFER] = {
145 	[USIE_UC_STATUS] = {
146 		.type = UE_INTERRUPT,
147 		.endpoint = UE_ADDR_ANY,
148 		.direction = UE_DIR_IN,
149 		.bufsize = 0,		/* use wMaxPacketSize */
150 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
151 		.callback = &usie_uc_status_callback,
152 	},
153 	[USIE_UC_RX] = {
154 		.type = UE_BULK,
155 		.endpoint = UE_ADDR_ANY,
156 		.direction = UE_DIR_IN,
157 		.bufsize = USIE_BUFSIZE,
158 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,.proxy_buffer = 1,},
159 		.callback = &usie_uc_rx_callback,
160 	},
161 	[USIE_UC_TX] = {
162 		.type = UE_BULK,
163 		.endpoint = UE_ADDR_ANY,
164 		.direction = UE_DIR_OUT,
165 		.bufsize = USIE_BUFSIZE,
166 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
167 		.callback = &usie_uc_tx_callback,
168 	}
169 };
170 
171 static const struct usb_config usie_if_config[USIE_IF_N_XFER] = {
172 	[USIE_IF_STATUS] = {
173 		.type = UE_INTERRUPT,
174 		.endpoint = UE_ADDR_ANY,
175 		.direction = UE_DIR_IN,
176 		.bufsize = 0,		/* use wMaxPacketSize */
177 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
178 		.callback = &usie_if_status_callback,
179 	},
180 	[USIE_IF_RX] = {
181 		.type = UE_BULK,
182 		.endpoint = UE_ADDR_ANY,
183 		.direction = UE_DIR_IN,
184 		.bufsize = USIE_BUFSIZE,
185 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
186 		.callback = &usie_if_rx_callback,
187 	},
188 	[USIE_IF_TX] = {
189 		.type = UE_BULK,
190 		.endpoint = UE_ADDR_ANY,
191 		.direction = UE_DIR_OUT,
192 		.bufsize = MAX(USIE_BUFSIZE, MCLBYTES),
193 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
194 		.callback = &usie_if_tx_callback,
195 	}
196 };
197 
198 static device_method_t usie_methods[] = {
199 	DEVMETHOD(device_probe, usie_probe),
200 	DEVMETHOD(device_attach, usie_attach),
201 	DEVMETHOD(device_detach, usie_detach),
202 	DEVMETHOD_END
203 };
204 
205 static driver_t usie_driver = {
206 	.name = "usie",
207 	.methods = usie_methods,
208 	.size = sizeof(struct usie_softc),
209 };
210 
211 static devclass_t usie_devclass;
212 static eventhandler_tag usie_etag;
213 
214 DRIVER_MODULE(usie, uhub, usie_driver, usie_devclass, usie_driver_loaded, 0);
215 MODULE_DEPEND(usie, ucom, 1, 1, 1);
216 MODULE_DEPEND(usie, usb, 1, 1, 1);
217 MODULE_VERSION(usie, 1);
218 USB_PNP_HOST_INFO(usie_devs);
219 
220 static const struct ucom_callback usie_uc_callback = {
221 	.ucom_cfg_get_status = &usie_uc_cfg_get_status,
222 	.ucom_cfg_set_dtr = &usie_uc_cfg_set_dtr,
223 	.ucom_cfg_set_rts = &usie_uc_cfg_set_rts,
224 	.ucom_cfg_open = &usie_uc_cfg_open,
225 	.ucom_cfg_close = &usie_uc_cfg_close,
226 	.ucom_start_read = &usie_uc_start_read,
227 	.ucom_stop_read = &usie_uc_stop_read,
228 	.ucom_start_write = &usie_uc_start_write,
229 	.ucom_stop_write = &usie_uc_stop_write,
230 	.ucom_free = &usie_free,
231 };
232 
233 static void
234 usie_autoinst(void *arg, struct usb_device *udev,
235     struct usb_attach_arg *uaa)
236 {
237 	struct usb_interface *iface;
238 	struct usb_interface_descriptor *id;
239 	struct usb_device_request req;
240 	int err;
241 
242 	if (uaa->dev_state != UAA_DEV_READY)
243 		return;
244 
245 	iface = usbd_get_iface(udev, 0);
246 	if (iface == NULL)
247 		return;
248 
249 	id = iface->idesc;
250 	if (id == NULL || id->bInterfaceClass != UICLASS_MASS)
251 		return;
252 
253 	if (usbd_lookup_id_by_uaa(usie_devs, sizeof(usie_devs), uaa) != 0)
254 		return;			/* no device match */
255 
256 	if (bootverbose) {
257 		DPRINTF("Ejecting %s %s\n",
258 		    usb_get_manufacturer(udev),
259 		    usb_get_product(udev));
260 	}
261 	req.bmRequestType = UT_VENDOR;
262 	req.bRequest = UR_SET_INTERFACE;
263 	USETW(req.wValue, UF_DEVICE_REMOTE_WAKEUP);
264 	USETW(req.wIndex, UHF_PORT_CONNECTION);
265 	USETW(req.wLength, 0);
266 
267 	/* at this moment there is no mutex */
268 	err = usbd_do_request_flags(udev, NULL, &req,
269 	    NULL, 0, NULL, 250 /* ms */ );
270 
271 	/* success, mark the udev as disappearing */
272 	if (err == 0)
273 		uaa->dev_state = UAA_DEV_EJECTING;
274 }
275 
276 static int
277 usie_probe(device_t self)
278 {
279 	struct usb_attach_arg *uaa = device_get_ivars(self);
280 
281 	if (uaa->usb_mode != USB_MODE_HOST)
282 		return (ENXIO);
283 	if (uaa->info.bConfigIndex != USIE_CNFG_INDEX)
284 		return (ENXIO);
285 	if (uaa->info.bIfaceIndex != USIE_IFACE_INDEX)
286 		return (ENXIO);
287 	if (uaa->info.bInterfaceClass != UICLASS_VENDOR)
288 		return (ENXIO);
289 
290 	return (usbd_lookup_id_by_uaa(usie_devs, sizeof(usie_devs), uaa));
291 }
292 
293 static int
294 usie_attach(device_t self)
295 {
296 	struct usie_softc *sc = device_get_softc(self);
297 	struct usb_attach_arg *uaa = device_get_ivars(self);
298 	struct ifnet *ifp;
299 	struct usb_interface *iface;
300 	struct usb_interface_descriptor *id;
301 	struct usb_device_request req;
302 	int err;
303 	uint16_t fwattr;
304 	uint8_t iface_index;
305 	uint8_t ifidx;
306 	uint8_t start;
307 
308 	device_set_usb_desc(self);
309 	sc->sc_udev = uaa->device;
310 	sc->sc_dev = self;
311 
312 	mtx_init(&sc->sc_mtx, "usie", MTX_NETWORK_LOCK, MTX_DEF);
313 	ucom_ref(&sc->sc_super_ucom);
314 
315 	TASK_INIT(&sc->sc_if_status_task, 0, usie_if_status_cb, sc);
316 	TASK_INIT(&sc->sc_if_sync_task, 0, usie_if_sync_cb, sc);
317 
318 	usb_callout_init_mtx(&sc->sc_if_sync_ch, &sc->sc_mtx, 0);
319 
320 	mtx_lock(&sc->sc_mtx);
321 
322 	/* set power mode to D0 */
323 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
324 	req.bRequest = USIE_POWER;
325 	USETW(req.wValue, 0);
326 	USETW(req.wIndex, 0);
327 	USETW(req.wLength, 0);
328 	if (usie_do_request(sc, &req, NULL)) {
329 		mtx_unlock(&sc->sc_mtx);
330 		goto detach;
331 	}
332 	/* read fw attr */
333 	fwattr = 0;
334 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
335 	req.bRequest = USIE_FW_ATTR;
336 	USETW(req.wValue, 0);
337 	USETW(req.wIndex, 0);
338 	USETW(req.wLength, sizeof(fwattr));
339 	if (usie_do_request(sc, &req, &fwattr)) {
340 		mtx_unlock(&sc->sc_mtx);
341 		goto detach;
342 	}
343 	mtx_unlock(&sc->sc_mtx);
344 
345 	/* check DHCP supports */
346 	DPRINTF("fwattr=%x\n", fwattr);
347 	if (!(fwattr & USIE_FW_DHCP)) {
348 		device_printf(self, "DHCP is not supported. A firmware upgrade might be needed.\n");
349 	}
350 
351 	/* find available interfaces */
352 	sc->sc_nucom = 0;
353 	for (ifidx = 0; ifidx < USIE_IFACE_MAX; ifidx++) {
354 		iface = usbd_get_iface(uaa->device, ifidx);
355 		if (iface == NULL)
356 			break;
357 
358 		id = usbd_get_interface_descriptor(iface);
359 		if ((id == NULL) || (id->bInterfaceClass != UICLASS_VENDOR))
360 			continue;
361 
362 		/* setup Direct IP transfer */
363 		if (id->bInterfaceNumber >= 7 && id->bNumEndpoints == 3) {
364 			sc->sc_if_ifnum = id->bInterfaceNumber;
365 			iface_index = ifidx;
366 
367 			DPRINTF("ifnum=%d, ifidx=%d\n",
368 			    sc->sc_if_ifnum, ifidx);
369 
370 			err = usbd_transfer_setup(uaa->device,
371 			    &iface_index, sc->sc_if_xfer, usie_if_config,
372 			    USIE_IF_N_XFER, sc, &sc->sc_mtx);
373 
374 			if (err == 0)
375 				continue;
376 
377 			device_printf(self,
378 			    "could not allocate USB transfers on "
379 			    "iface_index=%d, err=%s\n",
380 			    iface_index, usbd_errstr(err));
381 			goto detach;
382 		}
383 
384 		/* setup ucom */
385 		if (sc->sc_nucom >= USIE_UCOM_MAX)
386 			continue;
387 
388 		usbd_set_parent_iface(uaa->device, ifidx,
389 		    uaa->info.bIfaceIndex);
390 
391 		DPRINTF("NumEndpoints=%d bInterfaceNumber=%d\n",
392 		    id->bNumEndpoints, id->bInterfaceNumber);
393 
394 		if (id->bNumEndpoints == 2) {
395 			sc->sc_uc_xfer[sc->sc_nucom][0] = NULL;
396 			start = 1;
397 		} else
398 			start = 0;
399 
400 		err = usbd_transfer_setup(uaa->device, &ifidx,
401 		    sc->sc_uc_xfer[sc->sc_nucom] + start,
402 		    usie_uc_config + start, USIE_UC_N_XFER - start,
403 		    &sc->sc_ucom[sc->sc_nucom], &sc->sc_mtx);
404 
405 		if (err != 0) {
406 			DPRINTF("usbd_transfer_setup error=%s\n", usbd_errstr(err));
407 			continue;
408 		}
409 
410 		mtx_lock(&sc->sc_mtx);
411 		for (; start < USIE_UC_N_XFER; start++)
412 			usbd_xfer_set_stall(sc->sc_uc_xfer[sc->sc_nucom][start]);
413 		mtx_unlock(&sc->sc_mtx);
414 
415 		sc->sc_uc_ifnum[sc->sc_nucom] = id->bInterfaceNumber;
416 
417 		sc->sc_nucom++;		/* found a port */
418 	}
419 
420 	if (sc->sc_nucom == 0) {
421 		device_printf(self, "no comports found\n");
422 		goto detach;
423 	}
424 
425 	err = ucom_attach(&sc->sc_super_ucom, sc->sc_ucom,
426 	    sc->sc_nucom, sc, &usie_uc_callback, &sc->sc_mtx);
427 
428 	if (err != 0) {
429 		DPRINTF("ucom_attach failed\n");
430 		goto detach;
431 	}
432 	DPRINTF("Found %d interfaces.\n", sc->sc_nucom);
433 
434 	/* setup ifnet (Direct IP) */
435 	sc->sc_ifp = ifp = if_alloc(IFT_OTHER);
436 
437 	if (ifp == NULL) {
438 		device_printf(self, "Could not allocate a network interface\n");
439 		goto detach;
440 	}
441 	if_initname(ifp, "usie", device_get_unit(self));
442 
443 	ifp->if_softc = sc;
444 	ifp->if_mtu = USIE_MTU_MAX;
445 	ifp->if_flags |= IFF_NOARP;
446 	ifp->if_init = usie_if_init;
447 	ifp->if_ioctl = usie_if_ioctl;
448 	ifp->if_start = usie_if_start;
449 	ifp->if_output = usie_if_output;
450 	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
451 	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
452 	IFQ_SET_READY(&ifp->if_snd);
453 
454 	if_attach(ifp);
455 	bpfattach(ifp, DLT_RAW, 0);
456 
457 	if (fwattr & USIE_PM_AUTO) {
458 		usbd_set_power_mode(uaa->device, USB_POWER_MODE_SAVE);
459 		DPRINTF("enabling automatic suspend and resume\n");
460 	} else {
461 		usbd_set_power_mode(uaa->device, USB_POWER_MODE_ON);
462 		DPRINTF("USB power is always ON\n");
463 	}
464 
465 	DPRINTF("device attached\n");
466 	return (0);
467 
468 detach:
469 	usie_detach(self);
470 	return (ENOMEM);
471 }
472 
473 static int
474 usie_detach(device_t self)
475 {
476 	struct usie_softc *sc = device_get_softc(self);
477 	uint8_t x;
478 
479 	/* detach ifnet */
480 	if (sc->sc_ifp != NULL) {
481 		usie_if_stop(sc);
482 		usbd_transfer_unsetup(sc->sc_if_xfer, USIE_IF_N_XFER);
483 		bpfdetach(sc->sc_ifp);
484 		if_detach(sc->sc_ifp);
485 		if_free(sc->sc_ifp);
486 		sc->sc_ifp = NULL;
487 	}
488 	/* detach ucom */
489 	if (sc->sc_nucom > 0)
490 		ucom_detach(&sc->sc_super_ucom, sc->sc_ucom);
491 
492 	/* stop all USB transfers */
493 	usbd_transfer_unsetup(sc->sc_if_xfer, USIE_IF_N_XFER);
494 
495 	for (x = 0; x != USIE_UCOM_MAX; x++)
496 		usbd_transfer_unsetup(sc->sc_uc_xfer[x], USIE_UC_N_XFER);
497 
498 
499 	device_claim_softc(self);
500 
501 	usie_free_softc(sc);
502 
503 	return (0);
504 }
505 
506 UCOM_UNLOAD_DRAIN(usie);
507 
508 static void
509 usie_free_softc(struct usie_softc *sc)
510 {
511 	if (ucom_unref(&sc->sc_super_ucom)) {
512 		mtx_destroy(&sc->sc_mtx);
513 		device_free_softc(sc);
514 	}
515 }
516 
517 static void
518 usie_free(struct ucom_softc *ucom)
519 {
520 	usie_free_softc(ucom->sc_parent);
521 }
522 
523 static void
524 usie_uc_update_line_state(struct ucom_softc *ucom, uint8_t ls)
525 {
526 	struct usie_softc *sc = ucom->sc_parent;
527 	struct usb_device_request req;
528 
529 	if (sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_STATUS] == NULL)
530 		return;
531 
532 	req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
533 	req.bRequest = USIE_LINK_STATE;
534 	USETW(req.wValue, ls);
535 	USETW(req.wIndex, sc->sc_uc_ifnum[ucom->sc_subunit]);
536 	USETW(req.wLength, 0);
537 
538 	DPRINTF("sc_uc_ifnum=%d\n", sc->sc_uc_ifnum[ucom->sc_subunit]);
539 
540 	usie_do_request(sc, &req, NULL);
541 }
542 
543 static void
544 usie_uc_cfg_get_status(struct ucom_softc *ucom, uint8_t *lsr, uint8_t *msr)
545 {
546 	struct usie_softc *sc = ucom->sc_parent;
547 
548 	*msr = sc->sc_msr;
549 	*lsr = sc->sc_lsr;
550 }
551 
552 static void
553 usie_uc_cfg_set_dtr(struct ucom_softc *ucom, uint8_t flag)
554 {
555 	uint8_t dtr;
556 
557 	dtr = flag ? USIE_LS_DTR : 0;
558 	usie_uc_update_line_state(ucom, dtr);
559 }
560 
561 static void
562 usie_uc_cfg_set_rts(struct ucom_softc *ucom, uint8_t flag)
563 {
564 	uint8_t rts;
565 
566 	rts = flag ? USIE_LS_RTS : 0;
567 	usie_uc_update_line_state(ucom, rts);
568 }
569 
570 static void
571 usie_uc_cfg_open(struct ucom_softc *ucom)
572 {
573 	struct usie_softc *sc = ucom->sc_parent;
574 
575 	/* usbd_transfer_start() is NULL safe */
576 
577 	usbd_transfer_start(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_STATUS]);
578 }
579 
580 static void
581 usie_uc_cfg_close(struct ucom_softc *ucom)
582 {
583 	struct usie_softc *sc = ucom->sc_parent;
584 
585 	usbd_transfer_stop(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_STATUS]);
586 }
587 
588 static void
589 usie_uc_start_read(struct ucom_softc *ucom)
590 {
591 	struct usie_softc *sc = ucom->sc_parent;
592 
593 	usbd_transfer_start(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_RX]);
594 }
595 
596 static void
597 usie_uc_stop_read(struct ucom_softc *ucom)
598 {
599 	struct usie_softc *sc = ucom->sc_parent;
600 
601 	usbd_transfer_stop(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_RX]);
602 }
603 
604 static void
605 usie_uc_start_write(struct ucom_softc *ucom)
606 {
607 	struct usie_softc *sc = ucom->sc_parent;
608 
609 	usbd_transfer_start(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_TX]);
610 }
611 
612 static void
613 usie_uc_stop_write(struct ucom_softc *ucom)
614 {
615 	struct usie_softc *sc = ucom->sc_parent;
616 
617 	usbd_transfer_stop(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_TX]);
618 }
619 
620 static void
621 usie_uc_rx_callback(struct usb_xfer *xfer, usb_error_t error)
622 {
623 	struct ucom_softc *ucom = usbd_xfer_softc(xfer);
624 	struct usie_softc *sc = ucom->sc_parent;
625 	struct usb_page_cache *pc;
626 	uint32_t actlen;
627 
628 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
629 
630 	switch (USB_GET_STATE(xfer)) {
631 	case USB_ST_TRANSFERRED:
632 		pc = usbd_xfer_get_frame(xfer, 0);
633 
634 		/* handle CnS response */
635 		if (ucom == sc->sc_ucom && actlen >= USIE_HIPCNS_MIN) {
636 
637 			DPRINTF("transferred=%u\n", actlen);
638 
639 			/* check if it is really CnS reply */
640 			usbd_copy_out(pc, 0, sc->sc_resp_temp, 1);
641 
642 			if (sc->sc_resp_temp[0] == USIE_HIP_FRM_CHR) {
643 
644 				/* verify actlen */
645 				if (actlen > USIE_BUFSIZE)
646 					actlen = USIE_BUFSIZE;
647 
648 				/* get complete message */
649 				usbd_copy_out(pc, 0, sc->sc_resp_temp, actlen);
650 				usie_hip_rsp(sc, sc->sc_resp_temp, actlen);
651 
652 				/* need to fall though */
653 				goto tr_setup;
654 			}
655 			/* else call ucom_put_data() */
656 		}
657 		/* standard ucom transfer */
658 		ucom_put_data(ucom, pc, 0, actlen);
659 
660 		/* fall though */
661 	case USB_ST_SETUP:
662 tr_setup:
663 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
664 		usbd_transfer_submit(xfer);
665 		break;
666 
667 	default:			/* Error */
668 		if (error != USB_ERR_CANCELLED) {
669 			usbd_xfer_set_stall(xfer);
670 			goto tr_setup;
671 		}
672 		break;
673 	}
674 }
675 
676 static void
677 usie_uc_tx_callback(struct usb_xfer *xfer, usb_error_t error)
678 {
679 	struct ucom_softc *ucom = usbd_xfer_softc(xfer);
680 	struct usb_page_cache *pc;
681 	uint32_t actlen;
682 
683 	switch (USB_GET_STATE(xfer)) {
684 	case USB_ST_TRANSFERRED:
685 	case USB_ST_SETUP:
686 tr_setup:
687 		pc = usbd_xfer_get_frame(xfer, 0);
688 
689 		/* handle CnS request */
690 		struct mbuf *m = usbd_xfer_get_priv(xfer);
691 
692 		if (m != NULL) {
693 			usbd_m_copy_in(pc, 0, m, 0, m->m_pkthdr.len);
694 			usbd_xfer_set_frame_len(xfer, 0, m->m_pkthdr.len);
695 			usbd_xfer_set_priv(xfer, NULL);
696 			usbd_transfer_submit(xfer);
697 			m_freem(m);
698 			break;
699 		}
700 		/* standard ucom transfer */
701 		if (ucom_get_data(ucom, pc, 0, USIE_BUFSIZE, &actlen)) {
702 			usbd_xfer_set_frame_len(xfer, 0, actlen);
703 			usbd_transfer_submit(xfer);
704 		}
705 		break;
706 
707 	default:			/* Error */
708 		if (error != USB_ERR_CANCELLED) {
709 			usbd_xfer_set_stall(xfer);
710 			goto tr_setup;
711 		}
712 		break;
713 	}
714 }
715 
716 static void
717 usie_uc_status_callback(struct usb_xfer *xfer, usb_error_t error)
718 {
719 	struct usb_page_cache *pc;
720 	struct {
721 		struct usb_device_request req;
722 		uint16_t param;
723 	}      st;
724 	uint32_t actlen;
725 	uint16_t param;
726 
727 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
728 
729 	switch (USB_GET_STATE(xfer)) {
730 	case USB_ST_TRANSFERRED:
731 		DPRINTFN(4, "info received, actlen=%u\n", actlen);
732 
733 		if (actlen < sizeof(st)) {
734 			DPRINTF("data too short actlen=%u\n", actlen);
735 			goto tr_setup;
736 		}
737 		pc = usbd_xfer_get_frame(xfer, 0);
738 		usbd_copy_out(pc, 0, &st, sizeof(st));
739 
740 		if (st.req.bmRequestType == 0xa1 && st.req.bRequest == 0x20) {
741 			struct ucom_softc *ucom = usbd_xfer_softc(xfer);
742 			struct usie_softc *sc = ucom->sc_parent;
743 
744 			param = le16toh(st.param);
745 			DPRINTF("param=%x\n", param);
746 			sc->sc_msr = sc->sc_lsr = 0;
747 			sc->sc_msr |= (param & USIE_DCD) ? SER_DCD : 0;
748 			sc->sc_msr |= (param & USIE_DSR) ? SER_DSR : 0;
749 			sc->sc_msr |= (param & USIE_RI) ? SER_RI : 0;
750 			sc->sc_msr |= (param & USIE_CTS) ? 0 : SER_CTS;
751 			sc->sc_msr |= (param & USIE_RTS) ? SER_RTS : 0;
752 			sc->sc_msr |= (param & USIE_DTR) ? SER_DTR : 0;
753 		}
754 		/* fall though */
755 	case USB_ST_SETUP:
756 tr_setup:
757 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
758 		usbd_transfer_submit(xfer);
759 		break;
760 
761 	default:			/* Error */
762 		DPRINTF("USB transfer error, %s\n",
763 		    usbd_errstr(error));
764 
765 		if (error != USB_ERR_CANCELLED) {
766 			usbd_xfer_set_stall(xfer);
767 			goto tr_setup;
768 		}
769 		break;
770 	}
771 }
772 
773 static void
774 usie_if_rx_callback(struct usb_xfer *xfer, usb_error_t error)
775 {
776 	struct epoch_tracker et;
777 	struct usie_softc *sc = usbd_xfer_softc(xfer);
778 	struct ifnet *ifp = sc->sc_ifp;
779 	struct mbuf *m0;
780 	struct mbuf *m = NULL;
781 	struct usie_desc *rxd;
782 	uint32_t actlen;
783 	uint16_t err;
784 	uint16_t pkt;
785 	uint16_t ipl;
786 	uint16_t len;
787 	uint16_t diff;
788 	uint8_t pad;
789 	uint8_t ipv;
790 
791 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
792 
793 	switch (USB_GET_STATE(xfer)) {
794 	case USB_ST_TRANSFERRED:
795 		DPRINTFN(15, "rx done, actlen=%u\n", actlen);
796 
797 		if (actlen < sizeof(struct usie_hip)) {
798 			DPRINTF("data too short %u\n", actlen);
799 			goto tr_setup;
800 		}
801 		m = sc->sc_rxm;
802 		sc->sc_rxm = NULL;
803 
804 		/* fall though */
805 	case USB_ST_SETUP:
806 tr_setup:
807 
808 		if (sc->sc_rxm == NULL) {
809 			sc->sc_rxm = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR,
810 			    MJUMPAGESIZE /* could be bigger than MCLBYTES */ );
811 		}
812 		if (sc->sc_rxm == NULL) {
813 			DPRINTF("could not allocate Rx mbuf\n");
814 			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
815 			usbd_xfer_set_stall(xfer);
816 			usbd_xfer_set_frames(xfer, 0);
817 		} else {
818 			/*
819 			 * Directly loading a mbuf cluster into DMA to
820 			 * save some data copying. This works because
821 			 * there is only one cluster.
822 			 */
823 			usbd_xfer_set_frame_data(xfer, 0,
824 			    mtod(sc->sc_rxm, caddr_t), MIN(MJUMPAGESIZE, USIE_RXSZ_MAX));
825 			usbd_xfer_set_frames(xfer, 1);
826 		}
827 		usbd_transfer_submit(xfer);
828 		break;
829 
830 	default:			/* Error */
831 		DPRINTF("USB transfer error, %s\n", usbd_errstr(error));
832 
833 		if (error != USB_ERR_CANCELLED) {
834 			/* try to clear stall first */
835 			usbd_xfer_set_stall(xfer);
836 			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
837 			goto tr_setup;
838 		}
839 		if (sc->sc_rxm != NULL) {
840 			m_freem(sc->sc_rxm);
841 			sc->sc_rxm = NULL;
842 		}
843 		break;
844 	}
845 
846 	if (m == NULL)
847 		return;
848 
849 	mtx_unlock(&sc->sc_mtx);
850 
851 	m->m_pkthdr.len = m->m_len = actlen;
852 
853 	err = pkt = 0;
854 
855 	/* HW can aggregate multiple frames in a single USB xfer */
856 	NET_EPOCH_ENTER(et);
857 	for (;;) {
858 		rxd = mtod(m, struct usie_desc *);
859 
860 		len = be16toh(rxd->hip.len) & USIE_HIP_IP_LEN_MASK;
861 		pad = (rxd->hip.id & USIE_HIP_PAD) ? 1 : 0;
862 		ipl = (len - pad - ETHER_HDR_LEN);
863 		if (ipl >= len) {
864 			DPRINTF("Corrupt frame\n");
865 			m_freem(m);
866 			break;
867 		}
868 		diff = sizeof(struct usie_desc) + ipl + pad;
869 
870 		if (((rxd->hip.id & USIE_HIP_MASK) != USIE_HIP_IP) ||
871 		    (be16toh(rxd->desc_type) & USIE_TYPE_MASK) != USIE_IP_RX) {
872 			DPRINTF("received wrong type of packet\n");
873 			m->m_data += diff;
874 			m->m_pkthdr.len = (m->m_len -= diff);
875 			err++;
876 			if (m->m_pkthdr.len > 0)
877 				continue;
878 			m_freem(m);
879 			break;
880 		}
881 		switch (be16toh(rxd->ethhdr.ether_type)) {
882 		case ETHERTYPE_IP:
883 			ipv = NETISR_IP;
884 			break;
885 #ifdef INET6
886 		case ETHERTYPE_IPV6:
887 			ipv = NETISR_IPV6;
888 			break;
889 #endif
890 		default:
891 			DPRINTF("unsupported ether type\n");
892 			err++;
893 			break;
894 		}
895 
896 		/* the last packet */
897 		if (m->m_pkthdr.len <= diff) {
898 			m->m_data += (sizeof(struct usie_desc) + pad);
899 			m->m_pkthdr.len = m->m_len = ipl;
900 			m->m_pkthdr.rcvif = ifp;
901 			BPF_MTAP(sc->sc_ifp, m);
902 			netisr_dispatch(ipv, m);
903 			break;
904 		}
905 		/* copy aggregated frames to another mbuf */
906 		m0 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
907 		if (__predict_false(m0 == NULL)) {
908 			DPRINTF("could not allocate mbuf\n");
909 			err++;
910 			m_freem(m);
911 			break;
912 		}
913 		m_copydata(m, sizeof(struct usie_desc) + pad, ipl, mtod(m0, caddr_t));
914 		m0->m_pkthdr.rcvif = ifp;
915 		m0->m_pkthdr.len = m0->m_len = ipl;
916 
917 		BPF_MTAP(sc->sc_ifp, m0);
918 		netisr_dispatch(ipv, m0);
919 
920 		m->m_data += diff;
921 		m->m_pkthdr.len = (m->m_len -= diff);
922 	}
923 	NET_EPOCH_EXIT(et);
924 
925 	mtx_lock(&sc->sc_mtx);
926 
927 	if_inc_counter(ifp, IFCOUNTER_IERRORS, err);
928 	if_inc_counter(ifp, IFCOUNTER_IPACKETS, pkt);
929 }
930 
931 static void
932 usie_if_tx_callback(struct usb_xfer *xfer, usb_error_t error)
933 {
934 	struct usie_softc *sc = usbd_xfer_softc(xfer);
935 	struct usb_page_cache *pc;
936 	struct ifnet *ifp = sc->sc_ifp;
937 	struct mbuf *m;
938 	uint16_t size;
939 
940 	switch (USB_GET_STATE(xfer)) {
941 	case USB_ST_TRANSFERRED:
942 		DPRINTFN(11, "transfer complete\n");
943 		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
944 		if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
945 
946 		/* fall though */
947 	case USB_ST_SETUP:
948 tr_setup:
949 
950 		if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
951 			break;
952 
953 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
954 		if (m == NULL)
955 			break;
956 
957 		if (m->m_pkthdr.len > (int)(MCLBYTES - ETHER_HDR_LEN +
958 		    ETHER_CRC_LEN - sizeof(sc->sc_txd))) {
959 			DPRINTF("packet len is too big: %d\n",
960 			    m->m_pkthdr.len);
961 			break;
962 		}
963 		pc = usbd_xfer_get_frame(xfer, 0);
964 
965 		sc->sc_txd.hip.len = htobe16(m->m_pkthdr.len +
966 		    ETHER_HDR_LEN + ETHER_CRC_LEN);
967 		size = sizeof(sc->sc_txd);
968 
969 		usbd_copy_in(pc, 0, &sc->sc_txd, size);
970 		usbd_m_copy_in(pc, size, m, 0, m->m_pkthdr.len);
971 		usbd_xfer_set_frame_len(xfer, 0, m->m_pkthdr.len +
972 		    size + ETHER_CRC_LEN);
973 
974 		BPF_MTAP(ifp, m);
975 
976 		m_freem(m);
977 
978 		usbd_transfer_submit(xfer);
979 		break;
980 
981 	default:			/* Error */
982 		DPRINTF("USB transfer error, %s\n",
983 		    usbd_errstr(error));
984 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
985 
986 		if (error != USB_ERR_CANCELLED) {
987 			usbd_xfer_set_stall(xfer);
988 			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
989 			goto tr_setup;
990 		}
991 		break;
992 	}
993 }
994 
995 static void
996 usie_if_status_callback(struct usb_xfer *xfer, usb_error_t error)
997 {
998 	struct usie_softc *sc = usbd_xfer_softc(xfer);
999 	struct usb_page_cache *pc;
1000 	struct usb_cdc_notification cdc;
1001 	uint32_t actlen;
1002 
1003 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1004 
1005 	switch (USB_GET_STATE(xfer)) {
1006 	case USB_ST_TRANSFERRED:
1007 		DPRINTFN(4, "info received, actlen=%d\n", actlen);
1008 
1009 		/* usb_cdc_notification - .data[16] */
1010 		if (actlen < (sizeof(cdc) - 16)) {
1011 			DPRINTF("data too short %d\n", actlen);
1012 			goto tr_setup;
1013 		}
1014 		pc = usbd_xfer_get_frame(xfer, 0);
1015 		usbd_copy_out(pc, 0, &cdc, (sizeof(cdc) - 16));
1016 
1017 		DPRINTFN(4, "bNotification=%x\n", cdc.bNotification);
1018 
1019 		if (cdc.bNotification & UCDC_N_RESPONSE_AVAILABLE) {
1020 			taskqueue_enqueue(taskqueue_thread,
1021 			    &sc->sc_if_status_task);
1022 		}
1023 		/* fall though */
1024 	case USB_ST_SETUP:
1025 tr_setup:
1026 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1027 		usbd_transfer_submit(xfer);
1028 		break;
1029 
1030 	default:			/* Error */
1031 		DPRINTF("USB transfer error, %s\n",
1032 		    usbd_errstr(error));
1033 
1034 		if (error != USB_ERR_CANCELLED) {
1035 			usbd_xfer_set_stall(xfer);
1036 			goto tr_setup;
1037 		}
1038 		break;
1039 	}
1040 }
1041 
1042 static void
1043 usie_if_sync_to(void *arg)
1044 {
1045 	struct usie_softc *sc = arg;
1046 
1047 	taskqueue_enqueue(taskqueue_thread, &sc->sc_if_sync_task);
1048 }
1049 
1050 static void
1051 usie_if_sync_cb(void *arg, int pending)
1052 {
1053 	struct usie_softc *sc = arg;
1054 
1055 	mtx_lock(&sc->sc_mtx);
1056 
1057 	/* call twice */
1058 	usie_if_cmd(sc, USIE_HIP_SYNC2M);
1059 	usie_if_cmd(sc, USIE_HIP_SYNC2M);
1060 
1061 	usb_callout_reset(&sc->sc_if_sync_ch, 2 * hz, usie_if_sync_to, sc);
1062 
1063 	mtx_unlock(&sc->sc_mtx);
1064 }
1065 
1066 static void
1067 usie_if_status_cb(void *arg, int pending)
1068 {
1069 	struct usie_softc *sc = arg;
1070 	struct ifnet *ifp = sc->sc_ifp;
1071 	struct usb_device_request req;
1072 	struct usie_hip *hip;
1073 	struct usie_lsi *lsi;
1074 	uint16_t actlen;
1075 	uint8_t ntries;
1076 	uint8_t pad;
1077 
1078 	mtx_lock(&sc->sc_mtx);
1079 
1080 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
1081 	req.bRequest = UCDC_GET_ENCAPSULATED_RESPONSE;
1082 	USETW(req.wValue, 0);
1083 	USETW(req.wIndex, sc->sc_if_ifnum);
1084 	USETW(req.wLength, sizeof(sc->sc_status_temp));
1085 
1086 	for (ntries = 0; ntries != 10; ntries++) {
1087 		int err;
1088 
1089 		err = usbd_do_request_flags(sc->sc_udev,
1090 		    &sc->sc_mtx, &req, sc->sc_status_temp, USB_SHORT_XFER_OK,
1091 		    &actlen, USB_DEFAULT_TIMEOUT);
1092 
1093 		if (err == 0)
1094 			break;
1095 
1096 		DPRINTF("Control request failed: %s %d/10\n",
1097 		    usbd_errstr(err), ntries);
1098 
1099 		usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(10));
1100 	}
1101 
1102 	if (ntries == 10) {
1103 		mtx_unlock(&sc->sc_mtx);
1104 		DPRINTF("Timeout\n");
1105 		return;
1106 	}
1107 
1108 	hip = (struct usie_hip *)sc->sc_status_temp;
1109 
1110 	pad = (hip->id & USIE_HIP_PAD) ? 1 : 0;
1111 
1112 	DPRINTF("hip.id=%x hip.len=%d actlen=%u pad=%d\n",
1113 	    hip->id, be16toh(hip->len), actlen, pad);
1114 
1115 	switch (hip->id & USIE_HIP_MASK) {
1116 	case USIE_HIP_SYNC2H:
1117 		usie_if_cmd(sc, USIE_HIP_SYNC2M);
1118 		break;
1119 	case USIE_HIP_RESTR:
1120 		usb_callout_stop(&sc->sc_if_sync_ch);
1121 		break;
1122 	case USIE_HIP_UMTS:
1123 		lsi = (struct usie_lsi *)(
1124 		    sc->sc_status_temp + sizeof(struct usie_hip) + pad);
1125 
1126 		DPRINTF("lsi.proto=%x lsi.len=%d\n", lsi->proto,
1127 		    be16toh(lsi->len));
1128 
1129 		if (lsi->proto != USIE_LSI_UMTS)
1130 			break;
1131 
1132 		if (lsi->area == USIE_LSI_AREA_NO ||
1133 		    lsi->area == USIE_LSI_AREA_NODATA) {
1134 			device_printf(sc->sc_dev, "no service available\n");
1135 			break;
1136 		}
1137 		if (lsi->state == USIE_LSI_STATE_IDLE) {
1138 			DPRINTF("lsi.state=%x\n", lsi->state);
1139 			break;
1140 		}
1141 		DPRINTF("ctx=%x\n", hip->param);
1142 		sc->sc_txd.hip.param = hip->param;
1143 
1144 		sc->sc_net.addr_len = lsi->pdp_addr_len;
1145 		memcpy(&sc->sc_net.dns1_addr, &lsi->dns1_addr, 16);
1146 		memcpy(&sc->sc_net.dns2_addr, &lsi->dns2_addr, 16);
1147 		memcpy(sc->sc_net.pdp_addr, lsi->pdp_addr, 16);
1148 		memcpy(sc->sc_net.gw_addr, lsi->gw_addr, 16);
1149 		ifp->if_flags |= IFF_UP;
1150 		ifp->if_drv_flags |= IFF_DRV_RUNNING;
1151 
1152 		device_printf(sc->sc_dev, "IP Addr=%d.%d.%d.%d\n",
1153 		    *lsi->pdp_addr, *(lsi->pdp_addr + 1),
1154 		    *(lsi->pdp_addr + 2), *(lsi->pdp_addr + 3));
1155 		device_printf(sc->sc_dev, "Gateway Addr=%d.%d.%d.%d\n",
1156 		    *lsi->gw_addr, *(lsi->gw_addr + 1),
1157 		    *(lsi->gw_addr + 2), *(lsi->gw_addr + 3));
1158 		device_printf(sc->sc_dev, "Prim NS Addr=%d.%d.%d.%d\n",
1159 		    *lsi->dns1_addr, *(lsi->dns1_addr + 1),
1160 		    *(lsi->dns1_addr + 2), *(lsi->dns1_addr + 3));
1161 		device_printf(sc->sc_dev, "Scnd NS Addr=%d.%d.%d.%d\n",
1162 		    *lsi->dns2_addr, *(lsi->dns2_addr + 1),
1163 		    *(lsi->dns2_addr + 2), *(lsi->dns2_addr + 3));
1164 
1165 		usie_cns_req(sc, USIE_CNS_ID_RSSI, USIE_CNS_OB_RSSI);
1166 		break;
1167 
1168 	case USIE_HIP_RCGI:
1169 		/* ignore, workaround for sloppy windows */
1170 		break;
1171 	default:
1172 		DPRINTF("undefined msgid: %x\n", hip->id);
1173 		break;
1174 	}
1175 
1176 	mtx_unlock(&sc->sc_mtx);
1177 }
1178 
1179 static void
1180 usie_if_start(struct ifnet *ifp)
1181 {
1182 	struct usie_softc *sc = ifp->if_softc;
1183 
1184 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1185 		DPRINTF("Not running\n");
1186 		return;
1187 	}
1188 	mtx_lock(&sc->sc_mtx);
1189 	usbd_transfer_start(sc->sc_if_xfer[USIE_IF_TX]);
1190 	mtx_unlock(&sc->sc_mtx);
1191 
1192 	DPRINTFN(3, "interface started\n");
1193 }
1194 
1195 static int
1196 usie_if_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
1197     struct route *ro)
1198 {
1199 	int err;
1200 
1201 	DPRINTF("proto=%x\n", dst->sa_family);
1202 
1203 	switch (dst->sa_family) {
1204 #ifdef INET6
1205 	case AF_INET6;
1206 	/* fall though */
1207 #endif
1208 	case AF_INET:
1209 		break;
1210 
1211 		/* silently drop dhclient packets */
1212 	case AF_UNSPEC:
1213 		m_freem(m);
1214 		return (0);
1215 
1216 		/* drop other packet types */
1217 	default:
1218 		m_freem(m);
1219 		return (EAFNOSUPPORT);
1220 	}
1221 
1222 	err = (ifp->if_transmit)(ifp, m);
1223 	if (err) {
1224 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1225 		return (ENOBUFS);
1226 	}
1227 	if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
1228 
1229 	return (0);
1230 }
1231 
1232 static void
1233 usie_if_init(void *arg)
1234 {
1235 	struct usie_softc *sc = arg;
1236 	struct ifnet *ifp = sc->sc_ifp;
1237 	uint8_t i;
1238 
1239 	mtx_lock(&sc->sc_mtx);
1240 
1241 	/* write tx descriptor */
1242 	sc->sc_txd.hip.id = USIE_HIP_CTX;
1243 	sc->sc_txd.hip.param = 0;	/* init value */
1244 	sc->sc_txd.desc_type = htobe16(USIE_IP_TX);
1245 
1246 	for (i = 0; i != USIE_IF_N_XFER; i++)
1247 		usbd_xfer_set_stall(sc->sc_if_xfer[i]);
1248 
1249 	usbd_transfer_start(sc->sc_uc_xfer[USIE_HIP_IF][USIE_UC_RX]);
1250 	usbd_transfer_start(sc->sc_if_xfer[USIE_IF_STATUS]);
1251 	usbd_transfer_start(sc->sc_if_xfer[USIE_IF_RX]);
1252 
1253 	/* if not running, initiate the modem */
1254 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
1255 		usie_cns_req(sc, USIE_CNS_ID_INIT, USIE_CNS_OB_LINK_UPDATE);
1256 
1257 	mtx_unlock(&sc->sc_mtx);
1258 
1259 	DPRINTF("ifnet initialized\n");
1260 }
1261 
1262 static void
1263 usie_if_stop(struct usie_softc *sc)
1264 {
1265 	usb_callout_drain(&sc->sc_if_sync_ch);
1266 
1267 	mtx_lock(&sc->sc_mtx);
1268 
1269 	/* usie_cns_req() clears IFF_* flags */
1270 	usie_cns_req(sc, USIE_CNS_ID_STOP, USIE_CNS_OB_LINK_UPDATE);
1271 
1272 	usbd_transfer_stop(sc->sc_if_xfer[USIE_IF_TX]);
1273 	usbd_transfer_stop(sc->sc_if_xfer[USIE_IF_RX]);
1274 	usbd_transfer_stop(sc->sc_if_xfer[USIE_IF_STATUS]);
1275 
1276 	/* shutdown device */
1277 	usie_if_cmd(sc, USIE_HIP_DOWN);
1278 
1279 	mtx_unlock(&sc->sc_mtx);
1280 }
1281 
1282 static int
1283 usie_if_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1284 {
1285 	struct usie_softc *sc = ifp->if_softc;
1286 	struct ieee80211req *ireq;
1287 	struct ieee80211req_sta_info si;
1288 	struct ifmediareq *ifmr;
1289 
1290 	switch (cmd) {
1291 	case SIOCSIFFLAGS:
1292 		if (ifp->if_flags & IFF_UP) {
1293 			if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
1294 				usie_if_init(sc);
1295 		} else {
1296 			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1297 				usie_if_stop(sc);
1298 		}
1299 		break;
1300 
1301 	case SIOCSIFCAP:
1302 		if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1303 			device_printf(sc->sc_dev,
1304 			    "Connect to the network first.\n");
1305 			break;
1306 		}
1307 		mtx_lock(&sc->sc_mtx);
1308 		usie_cns_req(sc, USIE_CNS_ID_RSSI, USIE_CNS_OB_RSSI);
1309 		mtx_unlock(&sc->sc_mtx);
1310 		break;
1311 
1312 	case SIOCG80211:
1313 		ireq = (struct ieee80211req *)data;
1314 
1315 		if (ireq->i_type != IEEE80211_IOC_STA_INFO)
1316 			break;
1317 
1318 		memset(&si, 0, sizeof(si));
1319 		si.isi_len = sizeof(si);
1320 		/*
1321 		 * ifconfig expects RSSI in 0.5dBm units
1322 		 * relative to the noise floor.
1323 		 */
1324 		si.isi_rssi = 2 * sc->sc_rssi;
1325 		if (copyout(&si, (uint8_t *)ireq->i_data + 8,
1326 		    sizeof(struct ieee80211req_sta_info)))
1327 			DPRINTF("copyout failed\n");
1328 		DPRINTF("80211\n");
1329 		break;
1330 
1331 	case SIOCGIFMEDIA:		/* to fool ifconfig */
1332 		ifmr = (struct ifmediareq *)data;
1333 		ifmr->ifm_count = 1;
1334 		DPRINTF("media\n");
1335 		break;
1336 
1337 	case SIOCSIFADDR:
1338 		break;
1339 
1340 	default:
1341 		return (EINVAL);
1342 	}
1343 	return (0);
1344 }
1345 
1346 static int
1347 usie_do_request(struct usie_softc *sc, struct usb_device_request *req,
1348     void *data)
1349 {
1350 	int err = 0;
1351 	int ntries;
1352 
1353 	mtx_assert(&sc->sc_mtx, MA_OWNED);
1354 
1355 	for (ntries = 0; ntries != 10; ntries++) {
1356 		err = usbd_do_request(sc->sc_udev,
1357 		    &sc->sc_mtx, req, data);
1358 		if (err == 0)
1359 			break;
1360 
1361 		DPRINTF("Control request failed: %s %d/10\n",
1362 		    usbd_errstr(err), ntries);
1363 
1364 		usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(10));
1365 	}
1366 	return (err);
1367 }
1368 
1369 static int
1370 usie_if_cmd(struct usie_softc *sc, uint8_t cmd)
1371 {
1372 	struct usb_device_request req;
1373 	struct usie_hip msg;
1374 
1375 	msg.len = 0;
1376 	msg.id = cmd;
1377 	msg.param = 0;
1378 
1379 	req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1380 	req.bRequest = UCDC_SEND_ENCAPSULATED_COMMAND;
1381 	USETW(req.wValue, 0);
1382 	USETW(req.wIndex, sc->sc_if_ifnum);
1383 	USETW(req.wLength, sizeof(msg));
1384 
1385 	DPRINTF("cmd=%x\n", cmd);
1386 
1387 	return (usie_do_request(sc, &req, &msg));
1388 }
1389 
1390 static void
1391 usie_cns_req(struct usie_softc *sc, uint32_t id, uint16_t obj)
1392 {
1393 	struct ifnet *ifp = sc->sc_ifp;
1394 	struct mbuf *m;
1395 	struct usb_xfer *xfer;
1396 	struct usie_hip *hip;
1397 	struct usie_cns *cns;
1398 	uint8_t *param;
1399 	uint8_t *tmp;
1400 	uint8_t cns_len;
1401 
1402 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1403 	if (__predict_false(m == NULL)) {
1404 		DPRINTF("could not allocate mbuf\n");
1405 		if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1406 		return;
1407 	}
1408 	/* to align usie_hip{} on 32 bit */
1409 	m->m_data += 3;
1410 	param = mtod(m, uint8_t *);
1411 	*param++ = USIE_HIP_FRM_CHR;
1412 	hip = (struct usie_hip *)param;
1413 	cns = (struct usie_cns *)(hip + 1);
1414 
1415 	tmp = param + USIE_HIPCNS_MIN - 2;
1416 
1417 	switch (obj) {
1418 	case USIE_CNS_OB_LINK_UPDATE:
1419 		cns_len = 2;
1420 		cns->op = USIE_CNS_OP_SET;
1421 		*tmp++ = 1;		/* profile ID, always use 1 for now */
1422 		*tmp++ = id == USIE_CNS_ID_INIT ? 1 : 0;
1423 		break;
1424 
1425 	case USIE_CNS_OB_PROF_WRITE:
1426 		cns_len = 245;
1427 		cns->op = USIE_CNS_OP_SET;
1428 		*tmp++ = 1;		/* profile ID, always use 1 for now */
1429 		*tmp++ = 2;
1430 		memcpy(tmp, &sc->sc_net, 34);
1431 		memset(tmp + 35, 0, 245 - 36);
1432 		tmp += 243;
1433 		break;
1434 
1435 	case USIE_CNS_OB_RSSI:
1436 		cns_len = 0;
1437 		cns->op = USIE_CNS_OP_REQ;
1438 		break;
1439 
1440 	default:
1441 		DPRINTF("unsupported CnS object type\n");
1442 		return;
1443 	}
1444 	*tmp = USIE_HIP_FRM_CHR;
1445 
1446 	hip->len = htobe16(sizeof(struct usie_cns) + cns_len);
1447 	hip->id = USIE_HIP_CNS2M;
1448 	hip->param = 0;			/* none for CnS */
1449 
1450 	cns->obj = htobe16(obj);
1451 	cns->id = htobe32(id);
1452 	cns->len = cns_len;
1453 	cns->rsv0 = cns->rsv1 = 0;	/* always '0' */
1454 
1455 	param = (uint8_t *)(cns + 1);
1456 
1457 	DPRINTF("param: %16D\n", param, ":");
1458 
1459 	m->m_pkthdr.len = m->m_len = USIE_HIPCNS_MIN + cns_len + 2;
1460 
1461 	xfer = sc->sc_uc_xfer[USIE_HIP_IF][USIE_UC_TX];
1462 
1463 	if (usbd_xfer_get_priv(xfer) == NULL) {
1464 		usbd_xfer_set_priv(xfer, m);
1465 		usbd_transfer_start(xfer);
1466 	} else {
1467 		DPRINTF("Dropped CNS event\n");
1468 		m_freem(m);
1469 	}
1470 }
1471 
1472 static void
1473 usie_cns_rsp(struct usie_softc *sc, struct usie_cns *cns)
1474 {
1475 	struct ifnet *ifp = sc->sc_ifp;
1476 
1477 	DPRINTF("received CnS\n");
1478 
1479 	switch (be16toh(cns->obj)) {
1480 	case USIE_CNS_OB_LINK_UPDATE:
1481 		if (be32toh(cns->id) & USIE_CNS_ID_INIT)
1482 			usie_if_sync_to(sc);
1483 		else if (be32toh(cns->id) & USIE_CNS_ID_STOP) {
1484 			ifp->if_flags &= ~IFF_UP;
1485 			ifp->if_drv_flags &=
1486 			    ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
1487 		} else
1488 			DPRINTF("undefined link update\n");
1489 		break;
1490 
1491 	case USIE_CNS_OB_RSSI:
1492 		sc->sc_rssi = be16toh(*(int16_t *)(cns + 1));
1493 		if (sc->sc_rssi <= 0)
1494 			device_printf(sc->sc_dev, "No signal\n");
1495 		else {
1496 			device_printf(sc->sc_dev, "RSSI=%ddBm\n",
1497 			    sc->sc_rssi - 110);
1498 		}
1499 		break;
1500 
1501 	case USIE_CNS_OB_PROF_WRITE:
1502 		break;
1503 
1504 	case USIE_CNS_OB_PDP_READ:
1505 		break;
1506 
1507 	default:
1508 		DPRINTF("undefined CnS\n");
1509 		break;
1510 	}
1511 }
1512 
1513 static void
1514 usie_hip_rsp(struct usie_softc *sc, uint8_t *rsp, uint32_t len)
1515 {
1516 	struct usie_hip *hip;
1517 	struct usie_cns *cns;
1518 	uint32_t i;
1519 	uint32_t j;
1520 	uint32_t off;
1521 	uint8_t tmp[USIE_HIPCNS_MAX] __aligned(4);
1522 
1523 	for (off = 0; (off + USIE_HIPCNS_MIN) <= len; off++) {
1524 
1525 		uint8_t pad;
1526 
1527 		while ((off < len) && (rsp[off] == USIE_HIP_FRM_CHR))
1528 			off++;
1529 
1530 		/* Unstuff the bytes */
1531 		for (i = j = 0; ((i + off) < len) &&
1532 		    (j < USIE_HIPCNS_MAX); i++) {
1533 
1534 			if (rsp[i + off] == USIE_HIP_FRM_CHR)
1535 				break;
1536 
1537 			if (rsp[i + off] == USIE_HIP_ESC_CHR) {
1538 				if ((i + off + 1) >= len)
1539 					break;
1540 				tmp[j++] = rsp[i++ + off + 1] ^ 0x20;
1541 			} else {
1542 				tmp[j++] = rsp[i + off];
1543 			}
1544 		}
1545 
1546 		off += i;
1547 
1548 		DPRINTF("frame len=%d\n", j);
1549 
1550 		if (j < sizeof(struct usie_hip)) {
1551 			DPRINTF("too little data\n");
1552 			break;
1553 		}
1554 		/*
1555 		 * Make sure we are not reading the stack if something
1556 		 * is wrong.
1557 		 */
1558 		memset(tmp + j, 0, sizeof(tmp) - j);
1559 
1560 		hip = (struct usie_hip *)tmp;
1561 
1562 		DPRINTF("hip: len=%d msgID=%02x, param=%02x\n",
1563 		    be16toh(hip->len), hip->id, hip->param);
1564 
1565 		pad = (hip->id & USIE_HIP_PAD) ? 1 : 0;
1566 
1567 		if ((hip->id & USIE_HIP_MASK) == USIE_HIP_CNS2H) {
1568 			cns = (struct usie_cns *)(((uint8_t *)(hip + 1)) + pad);
1569 
1570 			if (j < (sizeof(struct usie_cns) +
1571 			    sizeof(struct usie_hip) + pad)) {
1572 				DPRINTF("too little data\n");
1573 				break;
1574 			}
1575 			DPRINTF("cns: obj=%04x, op=%02x, rsv0=%02x, "
1576 			    "app=%08x, rsv1=%02x, len=%d\n",
1577 			    be16toh(cns->obj), cns->op, cns->rsv0,
1578 			    be32toh(cns->id), cns->rsv1, cns->len);
1579 
1580 			if (cns->op & USIE_CNS_OP_ERR)
1581 				DPRINTF("CnS error response\n");
1582 			else
1583 				usie_cns_rsp(sc, cns);
1584 
1585 			i = sizeof(struct usie_hip) + pad + sizeof(struct usie_cns);
1586 			j = cns->len;
1587 		} else {
1588 			i = sizeof(struct usie_hip) + pad;
1589 			j = be16toh(hip->len);
1590 		}
1591 #ifdef	USB_DEBUG
1592 		if (usie_debug == 0)
1593 			continue;
1594 
1595 		while (i < USIE_HIPCNS_MAX && j > 0) {
1596 			DPRINTF("param[0x%02x] = 0x%02x\n", i, tmp[i]);
1597 			i++;
1598 			j--;
1599 		}
1600 #endif
1601 	}
1602 }
1603 
1604 static int
1605 usie_driver_loaded(struct module *mod, int what, void *arg)
1606 {
1607 	switch (what) {
1608 	case MOD_LOAD:
1609 		/* register autoinstall handler */
1610 		usie_etag = EVENTHANDLER_REGISTER(usb_dev_configured,
1611 		    usie_autoinst, NULL, EVENTHANDLER_PRI_ANY);
1612 		break;
1613 	case MOD_UNLOAD:
1614 		EVENTHANDLER_DEREGISTER(usb_dev_configured, usie_etag);
1615 		break;
1616 	default:
1617 		return (EOPNOTSUPP);
1618 	}
1619 	return (0);
1620 }
1621 
1622