xref: /freebsd/sys/dev/usb/net/if_cdce.c (revision 9768746b)
1 /*	$NetBSD: if_cdce.c,v 1.4 2004/10/24 12:50:54 augustss Exp $ */
2 
3 /*-
4  * SPDX-License-Identifier: BSD-4-Clause
5  *
6  * Copyright (c) 1997, 1998, 1999, 2000-2003 Bill Paul <wpaul@windriver.com>
7  * Copyright (c) 2003-2005 Craig Boston
8  * Copyright (c) 2004 Daniel Hartmeier
9  * Copyright (c) 2009 Hans Petter Selasky
10  * All rights reserved.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. All advertising materials mentioning features or use of this software
21  *    must display the following acknowledgement:
22  *	This product includes software developed by Bill Paul.
23  * 4. Neither the name of the author nor the names of any co-contributors
24  *    may be used to endorse or promote products derived from this software
25  *    without specific prior written permission.
26  *
27  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
28  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
29  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
30  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul, THE VOICES IN HIS HEAD OR
31  * THE CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
32  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
33  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
34  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
35  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
36  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
37  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
38  */
39 
40 /*
41  * USB Communication Device Class (Ethernet Networking Control Model)
42  * http://www.usb.org/developers/devclass_docs/usbcdc11.pdf
43  */
44 
45 /*
46  * USB Network Control Model (NCM)
47  * http://www.usb.org/developers/devclass_docs/NCM10.zip
48  */
49 
50 #include <sys/cdefs.h>
51 __FBSDID("$FreeBSD$");
52 
53 #include <sys/gsb_crc32.h>
54 #include <sys/eventhandler.h>
55 #include <sys/stdint.h>
56 #include <sys/stddef.h>
57 #include <sys/queue.h>
58 #include <sys/systm.h>
59 #include <sys/socket.h>
60 #include <sys/kernel.h>
61 #include <sys/bus.h>
62 #include <sys/module.h>
63 #include <sys/lock.h>
64 #include <sys/mutex.h>
65 #include <sys/condvar.h>
66 #include <sys/sysctl.h>
67 #include <sys/sx.h>
68 #include <sys/unistd.h>
69 #include <sys/callout.h>
70 #include <sys/malloc.h>
71 #include <sys/priv.h>
72 
73 #include <net/if.h>
74 #include <net/if_var.h>
75 
76 #include <dev/usb/usb.h>
77 #include <dev/usb/usbdi.h>
78 #include <dev/usb/usbdi_util.h>
79 #include <dev/usb/usb_cdc.h>
80 #include "usbdevs.h"
81 
82 #define	USB_DEBUG_VAR cdce_debug
83 #include <dev/usb/usb_debug.h>
84 #include <dev/usb/usb_process.h>
85 #include <dev/usb/usb_msctest.h>
86 #include "usb_if.h"
87 
88 #include <dev/usb/net/usb_ethernet.h>
89 #include <dev/usb/net/if_cdcereg.h>
90 
91 static device_probe_t cdce_probe;
92 static device_attach_t cdce_attach;
93 static device_detach_t cdce_detach;
94 static device_suspend_t cdce_suspend;
95 static device_resume_t cdce_resume;
96 static usb_handle_request_t cdce_handle_request;
97 
98 static usb_callback_t cdce_bulk_write_callback;
99 static usb_callback_t cdce_bulk_read_callback;
100 static usb_callback_t cdce_intr_read_callback;
101 static usb_callback_t cdce_intr_write_callback;
102 
103 #if CDCE_HAVE_NCM
104 static usb_callback_t cdce_ncm_bulk_write_callback;
105 static usb_callback_t cdce_ncm_bulk_read_callback;
106 #endif
107 
108 static uether_fn_t cdce_attach_post;
109 static uether_fn_t cdce_init;
110 static uether_fn_t cdce_stop;
111 static uether_fn_t cdce_start;
112 static uether_fn_t cdce_setmulti;
113 static uether_fn_t cdce_setpromisc;
114 static int cdce_attach_post_sub(struct usb_ether *);
115 static int cdce_ioctl(struct ifnet *, u_long, caddr_t);
116 static int cdce_media_change_cb(struct ifnet *);
117 static void cdce_media_status_cb(struct ifnet *, struct ifmediareq *);
118 
119 static uint32_t	cdce_m_crc32(struct mbuf *, uint32_t, uint32_t);
120 static void	cdce_set_filter(struct usb_ether *);
121 
122 #ifdef USB_DEBUG
123 static int cdce_debug = 0;
124 static int cdce_tx_interval = 0;
125 
126 static SYSCTL_NODE(_hw_usb, OID_AUTO, cdce, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
127     "USB CDC-Ethernet");
128 SYSCTL_INT(_hw_usb_cdce, OID_AUTO, debug, CTLFLAG_RWTUN, &cdce_debug, 0,
129     "Debug level");
130 SYSCTL_INT(_hw_usb_cdce, OID_AUTO, interval, CTLFLAG_RWTUN, &cdce_tx_interval, 0,
131     "NCM transmit interval in ms");
132 #else
133 #define cdce_debug 0
134 #endif
135 
136 static const struct usb_config cdce_config[CDCE_N_TRANSFER] = {
137 	[CDCE_BULK_RX] = {
138 		.type = UE_BULK,
139 		.endpoint = UE_ADDR_ANY,
140 		.direction = UE_DIR_RX,
141 		.if_index = 0,
142 		.frames = CDCE_FRAMES_MAX,
143 		.bufsize = (CDCE_FRAMES_MAX * MCLBYTES),
144 		.flags = {.pipe_bof = 1,.short_frames_ok = 1,.short_xfer_ok = 1,.ext_buffer = 1,},
145 		.callback = cdce_bulk_read_callback,
146 		.timeout = 0,	/* no timeout */
147 		.usb_mode = USB_MODE_DUAL,	/* both modes */
148 	},
149 
150 	[CDCE_BULK_TX] = {
151 		.type = UE_BULK,
152 		.endpoint = UE_ADDR_ANY,
153 		.direction = UE_DIR_TX,
154 		.if_index = 0,
155 		.frames = CDCE_FRAMES_MAX,
156 		.bufsize = (CDCE_FRAMES_MAX * MCLBYTES),
157 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,.ext_buffer = 1,},
158 		.callback = cdce_bulk_write_callback,
159 		.timeout = 10000,	/* 10 seconds */
160 		.usb_mode = USB_MODE_DUAL,	/* both modes */
161 	},
162 
163 	[CDCE_INTR_RX] = {
164 		.type = UE_INTERRUPT,
165 		.endpoint = UE_ADDR_ANY,
166 		.direction = UE_DIR_RX,
167 		.if_index = 1,
168 		.bufsize = CDCE_IND_SIZE_MAX,
169 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,.no_pipe_ok = 1,},
170 		.callback = cdce_intr_read_callback,
171 		.timeout = 0,
172 		.usb_mode = USB_MODE_HOST,
173 	},
174 
175 	[CDCE_INTR_TX] = {
176 		.type = UE_INTERRUPT,
177 		.endpoint = UE_ADDR_ANY,
178 		.direction = UE_DIR_TX,
179 		.if_index = 1,
180 		.bufsize = CDCE_IND_SIZE_MAX,
181 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,.no_pipe_ok = 1,},
182 		.callback = cdce_intr_write_callback,
183 		.timeout = 10000,	/* 10 seconds */
184 		.usb_mode = USB_MODE_DEVICE,
185 	},
186 };
187 
188 #if CDCE_HAVE_NCM
189 static const struct usb_config cdce_ncm_config[CDCE_N_TRANSFER] = {
190 	[CDCE_BULK_RX] = {
191 		.type = UE_BULK,
192 		.endpoint = UE_ADDR_ANY,
193 		.direction = UE_DIR_RX,
194 		.if_index = 0,
195 		.frames = CDCE_NCM_RX_FRAMES_MAX,
196 		.bufsize = (CDCE_NCM_RX_FRAMES_MAX * CDCE_NCM_RX_MAXLEN),
197 		.flags = {.pipe_bof = 1,.short_frames_ok = 1,.short_xfer_ok = 1,},
198 		.callback = cdce_ncm_bulk_read_callback,
199 		.timeout = 0,	/* no timeout */
200 		.usb_mode = USB_MODE_DUAL,	/* both modes */
201 	},
202 
203 	[CDCE_BULK_TX] = {
204 		.type = UE_BULK,
205 		.endpoint = UE_ADDR_ANY,
206 		.direction = UE_DIR_TX,
207 		.if_index = 0,
208 		.frames = CDCE_NCM_TX_FRAMES_MAX,
209 		.bufsize = (CDCE_NCM_TX_FRAMES_MAX * CDCE_NCM_TX_MAXLEN),
210 		.flags = {.pipe_bof = 1,},
211 		.callback = cdce_ncm_bulk_write_callback,
212 		.timeout = 10000,	/* 10 seconds */
213 		.usb_mode = USB_MODE_DUAL,	/* both modes */
214 	},
215 
216 	[CDCE_INTR_RX] = {
217 		.type = UE_INTERRUPT,
218 		.endpoint = UE_ADDR_ANY,
219 		.direction = UE_DIR_RX,
220 		.if_index = 1,
221 		.bufsize = CDCE_IND_SIZE_MAX,
222 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,.no_pipe_ok = 1,},
223 		.callback = cdce_intr_read_callback,
224 		.timeout = 0,
225 		.usb_mode = USB_MODE_HOST,
226 	},
227 
228 	[CDCE_INTR_TX] = {
229 		.type = UE_INTERRUPT,
230 		.endpoint = UE_ADDR_ANY,
231 		.direction = UE_DIR_TX,
232 		.if_index = 1,
233 		.bufsize = CDCE_IND_SIZE_MAX,
234 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,.no_pipe_ok = 1,},
235 		.callback = cdce_intr_write_callback,
236 		.timeout = 10000,	/* 10 seconds */
237 		.usb_mode = USB_MODE_DEVICE,
238 	},
239 };
240 #endif
241 
242 static device_method_t cdce_methods[] = {
243 	/* USB interface */
244 	DEVMETHOD(usb_handle_request, cdce_handle_request),
245 
246 	/* Device interface */
247 	DEVMETHOD(device_probe, cdce_probe),
248 	DEVMETHOD(device_attach, cdce_attach),
249 	DEVMETHOD(device_detach, cdce_detach),
250 	DEVMETHOD(device_suspend, cdce_suspend),
251 	DEVMETHOD(device_resume, cdce_resume),
252 
253 	DEVMETHOD_END
254 };
255 
256 static driver_t cdce_driver = {
257 	.name = "cdce",
258 	.methods = cdce_methods,
259 	.size = sizeof(struct cdce_softc),
260 };
261 
262 static eventhandler_tag cdce_etag;
263 
264 static int  cdce_driver_loaded(struct module *, int, void *);
265 
266 static const STRUCT_USB_HOST_ID cdce_switch_devs[] = {
267 	{USB_VPI(USB_VENDOR_HUAWEI, USB_PRODUCT_HUAWEI_E3272_INIT, MSC_EJECT_HUAWEI2)},
268 	{USB_VPI(USB_VENDOR_HUAWEI, USB_PRODUCT_HUAWEI_E3372v153_INIT, MSC_EJECT_HUAWEI2)},
269 	{USB_VPI(USB_VENDOR_HUAWEI, USB_PRODUCT_HUAWEI_E3372_INIT, MSC_EJECT_HUAWEI4)},
270 	{USB_VPI(USB_VENDOR_HUAWEI, USB_PRODUCT_HUAWEI_E5573Cs322_ECM, MSC_EJECT_HUAWEI3)},
271 };
272 
273 static const STRUCT_USB_HOST_ID cdce_host_devs[] = {
274 	{USB_VPI(USB_VENDOR_ACERLABS, USB_PRODUCT_ACERLABS_M5632, CDCE_FLAG_NO_UNION)},
275 	{USB_VPI(USB_VENDOR_AMBIT, USB_PRODUCT_AMBIT_NTL_250, CDCE_FLAG_NO_UNION)},
276 	{USB_VPI(USB_VENDOR_COMPAQ, USB_PRODUCT_COMPAQ_IPAQLINUX, CDCE_FLAG_NO_UNION)},
277 	{USB_VPI(USB_VENDOR_GMATE, USB_PRODUCT_GMATE_YP3X00, CDCE_FLAG_NO_UNION)},
278 	{USB_VPI(USB_VENDOR_MOTOROLA2, USB_PRODUCT_MOTOROLA2_USBLAN, CDCE_FLAG_ZAURUS | CDCE_FLAG_NO_UNION)},
279 	{USB_VPI(USB_VENDOR_MOTOROLA2, USB_PRODUCT_MOTOROLA2_USBLAN2, CDCE_FLAG_ZAURUS | CDCE_FLAG_NO_UNION)},
280 	{USB_VPI(USB_VENDOR_PROLIFIC, USB_PRODUCT_PROLIFIC_PL2501, CDCE_FLAG_NO_UNION)},
281 	{USB_VPI(USB_VENDOR_SHARP, USB_PRODUCT_SHARP_SL5500, CDCE_FLAG_ZAURUS)},
282 	{USB_VPI(USB_VENDOR_SHARP, USB_PRODUCT_SHARP_SL5600, CDCE_FLAG_ZAURUS | CDCE_FLAG_NO_UNION)},
283 	{USB_VPI(USB_VENDOR_SHARP, USB_PRODUCT_SHARP_SLA300, CDCE_FLAG_ZAURUS | CDCE_FLAG_NO_UNION)},
284 	{USB_VPI(USB_VENDOR_SHARP, USB_PRODUCT_SHARP_SLC700, CDCE_FLAG_ZAURUS | CDCE_FLAG_NO_UNION)},
285 	{USB_VPI(USB_VENDOR_SHARP, USB_PRODUCT_SHARP_SLC750, CDCE_FLAG_ZAURUS | CDCE_FLAG_NO_UNION)},
286 	{USB_VPI(USB_VENDOR_REALTEK, USB_PRODUCT_REALTEK_RTL8156, 0)},
287 
288 	{USB_VENDOR(USB_VENDOR_HUAWEI), USB_IFACE_CLASS(UICLASS_VENDOR),
289 		USB_IFACE_SUBCLASS(0x02), USB_IFACE_PROTOCOL(0x16),
290 		USB_DRIVER_INFO(0)},
291 	{USB_VENDOR(USB_VENDOR_HUAWEI), USB_IFACE_CLASS(UICLASS_VENDOR),
292 		USB_IFACE_SUBCLASS(0x02), USB_IFACE_PROTOCOL(0x46),
293 		USB_DRIVER_INFO(0)},
294 	{USB_VENDOR(USB_VENDOR_HUAWEI), USB_IFACE_CLASS(UICLASS_VENDOR),
295 		USB_IFACE_SUBCLASS(0x02), USB_IFACE_PROTOCOL(0x76),
296 		USB_DRIVER_INFO(0)},
297 	{USB_VENDOR(USB_VENDOR_HUAWEI), USB_IFACE_CLASS(UICLASS_VENDOR),
298 		USB_IFACE_SUBCLASS(0x03), USB_IFACE_PROTOCOL(0x16),
299 		USB_DRIVER_INFO(0)},
300 };
301 
302 static const STRUCT_USB_DUAL_ID cdce_dual_devs[] = {
303 	{USB_IF_CSI(UICLASS_CDC, UISUBCLASS_ETHERNET_NETWORKING_CONTROL_MODEL, 0)},
304 	{USB_IF_CSI(UICLASS_CDC, UISUBCLASS_MOBILE_DIRECT_LINE_MODEL, 0)},
305 	{USB_IF_CSI(UICLASS_CDC, UISUBCLASS_NETWORK_CONTROL_MODEL, 0)},
306 };
307 
308 DRIVER_MODULE(cdce, uhub, cdce_driver, cdce_driver_loaded, NULL);
309 MODULE_VERSION(cdce, 1);
310 MODULE_DEPEND(cdce, uether, 1, 1, 1);
311 MODULE_DEPEND(cdce, usb, 1, 1, 1);
312 MODULE_DEPEND(cdce, ether, 1, 1, 1);
313 USB_PNP_DEVICE_INFO(cdce_switch_devs);
314 USB_PNP_HOST_INFO(cdce_host_devs);
315 USB_PNP_DUAL_INFO(cdce_dual_devs);
316 
317 static const struct usb_ether_methods cdce_ue_methods = {
318 	.ue_attach_post = cdce_attach_post,
319 	.ue_attach_post_sub = cdce_attach_post_sub,
320 	.ue_start = cdce_start,
321 	.ue_init = cdce_init,
322 	.ue_stop = cdce_stop,
323 	.ue_setmulti = cdce_setmulti,
324 	.ue_setpromisc = cdce_setpromisc,
325 };
326 
327 #if CDCE_HAVE_NCM
328 /*------------------------------------------------------------------------*
329  *	cdce_ncm_init
330  *
331  * Return values:
332  * 0: Success
333  * Else: Failure
334  *------------------------------------------------------------------------*/
335 static uint8_t
336 cdce_ncm_init(struct cdce_softc *sc)
337 {
338 	struct usb_ncm_parameters temp;
339 	struct usb_device_request req;
340 	struct usb_ncm_func_descriptor *ufd;
341 	uint8_t value[8];
342 	int err;
343 
344 	ufd = usbd_find_descriptor(sc->sc_ue.ue_udev, NULL,
345 	    sc->sc_ifaces_index[1], UDESC_CS_INTERFACE, 0xFF,
346 	    UCDC_NCM_FUNC_DESC_SUBTYPE, 0xFF);
347 
348 	/* verify length of NCM functional descriptor */
349 	if (ufd != NULL) {
350 		if (ufd->bLength < sizeof(*ufd))
351 			ufd = NULL;
352 		else
353 			DPRINTFN(1, "Found NCM functional descriptor.\n");
354 	}
355 
356 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
357 	req.bRequest = UCDC_NCM_GET_NTB_PARAMETERS;
358 	USETW(req.wValue, 0);
359 	req.wIndex[0] = sc->sc_ifaces_index[1];
360 	req.wIndex[1] = 0;
361 	USETW(req.wLength, sizeof(temp));
362 
363 	err = usbd_do_request_flags(sc->sc_ue.ue_udev, NULL, &req,
364 	    &temp, 0, NULL, 1000 /* ms */);
365 	if (err)
366 		return (1);
367 
368 	/* Read correct set of parameters according to device mode */
369 
370 	if (usbd_get_mode(sc->sc_ue.ue_udev) == USB_MODE_HOST) {
371 		sc->sc_ncm.rx_max = UGETDW(temp.dwNtbInMaxSize);
372 		sc->sc_ncm.tx_max = UGETDW(temp.dwNtbOutMaxSize);
373 		sc->sc_ncm.tx_remainder = UGETW(temp.wNdpOutPayloadRemainder);
374 		sc->sc_ncm.tx_modulus = UGETW(temp.wNdpOutDivisor);
375 		sc->sc_ncm.tx_struct_align = UGETW(temp.wNdpOutAlignment);
376 		sc->sc_ncm.tx_nframe = UGETW(temp.wNtbOutMaxDatagrams);
377 	} else {
378 		sc->sc_ncm.rx_max = UGETDW(temp.dwNtbOutMaxSize);
379 		sc->sc_ncm.tx_max = UGETDW(temp.dwNtbInMaxSize);
380 		sc->sc_ncm.tx_remainder = UGETW(temp.wNdpInPayloadRemainder);
381 		sc->sc_ncm.tx_modulus = UGETW(temp.wNdpInDivisor);
382 		sc->sc_ncm.tx_struct_align = UGETW(temp.wNdpInAlignment);
383 		sc->sc_ncm.tx_nframe = UGETW(temp.wNtbOutMaxDatagrams);
384 	}
385 
386 	/* Verify maximum receive length */
387 
388 	if ((sc->sc_ncm.rx_max < 32) ||
389 	    (sc->sc_ncm.rx_max > CDCE_NCM_RX_MAXLEN)) {
390 		DPRINTFN(1, "Using default maximum receive length\n");
391 		sc->sc_ncm.rx_max = CDCE_NCM_RX_MAXLEN;
392 	}
393 
394 	/* Verify maximum transmit length */
395 
396 	if ((sc->sc_ncm.tx_max < 32) ||
397 	    (sc->sc_ncm.tx_max > CDCE_NCM_TX_MAXLEN)) {
398 		DPRINTFN(1, "Using default maximum transmit length\n");
399 		sc->sc_ncm.tx_max = CDCE_NCM_TX_MAXLEN;
400 	}
401 
402 	/*
403 	 * Verify that the structure alignment is:
404 	 * - power of two
405 	 * - not greater than the maximum transmit length
406 	 * - not less than four bytes
407 	 */
408 	if ((sc->sc_ncm.tx_struct_align < 4) ||
409 	    (sc->sc_ncm.tx_struct_align !=
410 	     ((-sc->sc_ncm.tx_struct_align) & sc->sc_ncm.tx_struct_align)) ||
411 	    (sc->sc_ncm.tx_struct_align >= sc->sc_ncm.tx_max)) {
412 		DPRINTFN(1, "Using default other alignment: 4 bytes\n");
413 		sc->sc_ncm.tx_struct_align = 4;
414 	}
415 
416 	/*
417 	 * Verify that the payload alignment is:
418 	 * - power of two
419 	 * - not greater than the maximum transmit length
420 	 * - not less than four bytes
421 	 */
422 	if ((sc->sc_ncm.tx_modulus < 4) ||
423 	    (sc->sc_ncm.tx_modulus !=
424 	     ((-sc->sc_ncm.tx_modulus) & sc->sc_ncm.tx_modulus)) ||
425 	    (sc->sc_ncm.tx_modulus >= sc->sc_ncm.tx_max)) {
426 		DPRINTFN(1, "Using default transmit modulus: 4 bytes\n");
427 		sc->sc_ncm.tx_modulus = 4;
428 	}
429 
430 	/* Verify that the payload remainder */
431 
432 	if ((sc->sc_ncm.tx_remainder >= sc->sc_ncm.tx_modulus)) {
433 		DPRINTFN(1, "Using default transmit remainder: 0 bytes\n");
434 		sc->sc_ncm.tx_remainder = 0;
435 	}
436 
437 	/*
438 	 * Offset the TX remainder so that IP packet payload starts at
439 	 * the tx_modulus. This is not too clear in the specification.
440 	 */
441 
442 	sc->sc_ncm.tx_remainder =
443 	    (sc->sc_ncm.tx_remainder - ETHER_HDR_LEN) &
444 	    (sc->sc_ncm.tx_modulus - 1);
445 
446 	/* Verify max datagrams */
447 
448 	if (sc->sc_ncm.tx_nframe == 0 ||
449 	    sc->sc_ncm.tx_nframe > (CDCE_NCM_SUBFRAMES_MAX - 1)) {
450 		DPRINTFN(1, "Using default max "
451 		    "subframes: %u units\n", CDCE_NCM_SUBFRAMES_MAX - 1);
452 		/* need to reserve one entry for zero padding */
453 		sc->sc_ncm.tx_nframe = (CDCE_NCM_SUBFRAMES_MAX - 1);
454 	}
455 
456 	/* Additional configuration, will fail in device side mode, which is OK. */
457 
458 	req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
459 	req.bRequest = UCDC_NCM_SET_NTB_INPUT_SIZE;
460 	USETW(req.wValue, 0);
461 	req.wIndex[0] = sc->sc_ifaces_index[1];
462 	req.wIndex[1] = 0;
463 
464 	if (ufd != NULL &&
465 	    (ufd->bmNetworkCapabilities & UCDC_NCM_CAP_MAX_DGRAM)) {
466 		USETW(req.wLength, 8);
467 		USETDW(value, sc->sc_ncm.rx_max);
468 		USETW(value + 4, (CDCE_NCM_SUBFRAMES_MAX - 1));
469 		USETW(value + 6, 0);
470 	} else {
471 		USETW(req.wLength, 4);
472 		USETDW(value, sc->sc_ncm.rx_max);
473  	}
474 
475 	err = usbd_do_request_flags(sc->sc_ue.ue_udev, NULL, &req,
476 	    &value, 0, NULL, 1000 /* ms */);
477 	if (err) {
478 		DPRINTFN(1, "Setting input size "
479 		    "to %u failed.\n", sc->sc_ncm.rx_max);
480 	}
481 
482 	req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
483 	req.bRequest = UCDC_NCM_SET_CRC_MODE;
484 	USETW(req.wValue, 0);	/* no CRC */
485 	req.wIndex[0] = sc->sc_ifaces_index[1];
486 	req.wIndex[1] = 0;
487 	USETW(req.wLength, 0);
488 
489 	err = usbd_do_request_flags(sc->sc_ue.ue_udev, NULL, &req,
490 	    NULL, 0, NULL, 1000 /* ms */);
491 	if (err) {
492 		DPRINTFN(1, "Setting CRC mode to off failed.\n");
493 	}
494 
495 	req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
496 	req.bRequest = UCDC_NCM_SET_NTB_FORMAT;
497 	USETW(req.wValue, 0);	/* NTB-16 */
498 	req.wIndex[0] = sc->sc_ifaces_index[1];
499 	req.wIndex[1] = 0;
500 	USETW(req.wLength, 0);
501 
502 	err = usbd_do_request_flags(sc->sc_ue.ue_udev, NULL, &req,
503 	    NULL, 0, NULL, 1000 /* ms */);
504 	if (err) {
505 		DPRINTFN(1, "Setting NTB format to 16-bit failed.\n");
506 	}
507 
508 	return (0);		/* success */
509 }
510 #endif
511 
512 static void
513 cdce_test_autoinst(void *arg, struct usb_device *udev,
514     struct usb_attach_arg *uaa)
515 {
516 	struct usb_interface *iface;
517 	struct usb_interface_descriptor *id;
518 
519 	if (uaa->dev_state != UAA_DEV_READY)
520 		return;
521 
522 	iface = usbd_get_iface(udev, 0);
523 	if (iface == NULL)
524 		return;
525 	id = iface->idesc;
526 	if (id == NULL || id->bInterfaceClass != UICLASS_MASS)
527 		return;
528 	if (usbd_lookup_id_by_uaa(cdce_switch_devs, sizeof(cdce_switch_devs), uaa))
529 		return;		/* no device match */
530 
531 	if (usb_msc_eject(udev, 0, USB_GET_DRIVER_INFO(uaa)) == 0) {
532 		/* success, mark the udev as disappearing */
533 		uaa->dev_state = UAA_DEV_EJECTING;
534 	}
535 }
536 
537 static int
538 cdce_driver_loaded(struct module *mod, int what, void *arg)
539 {
540 	switch (what) {
541 	case MOD_LOAD:
542 		/* register our autoinstall handler */
543 		cdce_etag = EVENTHANDLER_REGISTER(usb_dev_configured,
544 		    cdce_test_autoinst, NULL, EVENTHANDLER_PRI_ANY);
545 		return (0);
546 	case MOD_UNLOAD:
547 		EVENTHANDLER_DEREGISTER(usb_dev_configured, cdce_etag);
548 		return (0);
549 	default:
550 		return (EOPNOTSUPP);
551 	}
552 }
553 
554 static int
555 cdce_probe(device_t dev)
556 {
557 	struct usb_attach_arg *uaa = device_get_ivars(dev);
558 	int error;
559 
560 	error = usbd_lookup_id_by_uaa(cdce_host_devs, sizeof(cdce_host_devs), uaa);
561 	if (error)
562 		error = usbd_lookup_id_by_uaa(cdce_dual_devs, sizeof(cdce_dual_devs), uaa);
563 	return (error);
564 }
565 
566 static void
567 cdce_attach_post(struct usb_ether *ue)
568 {
569 	/* no-op */
570 	return;
571 }
572 
573 static int
574 cdce_attach_post_sub(struct usb_ether *ue)
575 {
576 	struct cdce_softc *sc = uether_getsc(ue);
577 	struct ifnet *ifp = uether_getifp(ue);
578 
579 	/* mostly copied from usb_ethernet.c */
580 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
581 	ifp->if_start = uether_start;
582 	ifp->if_ioctl = cdce_ioctl;
583 	ifp->if_init = uether_init;
584 	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
585 	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
586 	IFQ_SET_READY(&ifp->if_snd);
587 
588 	if ((sc->sc_flags & CDCE_FLAG_VLAN) == CDCE_FLAG_VLAN)
589 		if_setcapabilitiesbit(ifp, IFCAP_VLAN_MTU, 0);
590 
591 	if_setcapabilitiesbit(ifp, IFCAP_LINKSTATE, 0);
592 	if_setcapenable(ifp, if_getcapabilities(ifp));
593 
594 	ifmedia_init(&sc->sc_media, IFM_IMASK, cdce_media_change_cb,
595 	    cdce_media_status_cb);
596 	ifmedia_add(&sc->sc_media, IFM_ETHER | IFM_AUTO, 0, NULL);
597 	ifmedia_set(&sc->sc_media, IFM_ETHER | IFM_AUTO);
598 	sc->sc_media.ifm_media = sc->sc_media.ifm_cur->ifm_media;
599 	CDCE_LOCK(sc);
600 	cdce_set_filter(ue);
601 	CDCE_UNLOCK(sc);
602 
603 	return 0;
604 }
605 
606 static int
607 cdce_attach(device_t dev)
608 {
609 	struct cdce_softc *sc = device_get_softc(dev);
610 	struct usb_ether *ue = &sc->sc_ue;
611 	struct usb_attach_arg *uaa = device_get_ivars(dev);
612 	struct usb_interface *iface;
613 	const struct usb_cdc_union_descriptor *ud;
614 	const struct usb_interface_descriptor *id;
615 	const struct usb_cdc_ethernet_descriptor *ued;
616 	const struct usb_config *pcfg;
617 	uint32_t seed;
618 	int error;
619 	uint8_t i;
620 	uint8_t data_iface_no;
621 	char eaddr_str[5 * ETHER_ADDR_LEN];	/* approx */
622 
623 	sc->sc_flags = USB_GET_DRIVER_INFO(uaa);
624 	sc->sc_ue.ue_udev = uaa->device;
625 
626 	device_set_usb_desc(dev);
627 
628 	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF);
629 
630 	ud = usbd_find_descriptor
631 	    (uaa->device, NULL, uaa->info.bIfaceIndex,
632 	    UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_UNION, 0xFF);
633 
634 	if ((ud == NULL) || (ud->bLength < sizeof(*ud)) ||
635 	    (sc->sc_flags & CDCE_FLAG_NO_UNION)) {
636 		DPRINTFN(1, "No union descriptor!\n");
637 		sc->sc_ifaces_index[0] = uaa->info.bIfaceIndex;
638 		sc->sc_ifaces_index[1] = uaa->info.bIfaceIndex;
639 		goto alloc_transfers;
640 	}
641 	data_iface_no = ud->bSlaveInterface[0];
642 
643 	for (i = 0;; i++) {
644 		iface = usbd_get_iface(uaa->device, i);
645 
646 		if (iface) {
647 			id = usbd_get_interface_descriptor(iface);
648 
649 			if (id && (id->bInterfaceNumber == data_iface_no)) {
650 				sc->sc_ifaces_index[0] = i;
651 				sc->sc_ifaces_index[1] = uaa->info.bIfaceIndex;
652 				usbd_set_parent_iface(uaa->device, i, uaa->info.bIfaceIndex);
653 				break;
654 			}
655 		} else {
656 			device_printf(dev, "no data interface found\n");
657 			goto detach;
658 		}
659 	}
660 
661 	/*
662 	 * <quote>
663 	 *
664 	 *  The Data Class interface of a networking device shall have
665 	 *  a minimum of two interface settings. The first setting
666 	 *  (the default interface setting) includes no endpoints and
667 	 *  therefore no networking traffic is exchanged whenever the
668 	 *  default interface setting is selected. One or more
669 	 *  additional interface settings are used for normal
670 	 *  operation, and therefore each includes a pair of endpoints
671 	 *  (one IN, and one OUT) to exchange network traffic. Select
672 	 *  an alternate interface setting to initialize the network
673 	 *  aspects of the device and to enable the exchange of
674 	 *  network traffic.
675 	 *
676 	 * </quote>
677 	 *
678 	 * Some devices, most notably cable modems, include interface
679 	 * settings that have no IN or OUT endpoint, therefore loop
680 	 * through the list of all available interface settings
681 	 * looking for one with both IN and OUT endpoints.
682 	 */
683 
684 alloc_transfers:
685 
686 	pcfg = cdce_config;	/* Default Configuration */
687 
688 	for (i = 0; i != 32; i++) {
689 		error = usbd_set_alt_interface_index(uaa->device,
690 		    sc->sc_ifaces_index[0], i);
691 		if (error)
692 			break;
693 #if CDCE_HAVE_NCM
694 		if ((i == 0) && (cdce_ncm_init(sc) == 0))
695 			pcfg = cdce_ncm_config;
696 #endif
697 		error = usbd_transfer_setup(uaa->device,
698 		    sc->sc_ifaces_index, sc->sc_xfer,
699 		    pcfg, CDCE_N_TRANSFER, sc, &sc->sc_mtx);
700 
701 		if (error == 0)
702 			break;
703 	}
704 
705 	if (error || (i == 32)) {
706 		device_printf(dev, "No valid alternate "
707 		    "setting found\n");
708 		goto detach;
709 	}
710 
711 	ued = usbd_find_descriptor
712 	    (uaa->device, NULL, uaa->info.bIfaceIndex,
713 	    UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_ENF, 0xFF);
714 
715 	if ((ued == NULL) || (ued->bLength < sizeof(*ued))) {
716 		error = USB_ERR_INVAL;
717 	} else {
718 		/*
719 		 * ECM 1.2 doesn't say it excludes the CRC, but states that it's
720 		 * normally 1514, which excludes the CRC.
721 		 */
722 		DPRINTF("max segsize: %d\n", UGETW(ued->wMaxSegmentSize));
723 		if (UGETW(ued->wMaxSegmentSize) >= (ETHER_MAX_LEN - ETHER_CRC_LEN + ETHER_VLAN_ENCAP_LEN))
724 			sc->sc_flags |= CDCE_FLAG_VLAN;
725 
726 		error = usbd_req_get_string_any(uaa->device, NULL,
727 		    eaddr_str, sizeof(eaddr_str), ued->iMacAddress);
728 	}
729 
730 	if (error) {
731 		/* fake MAC address */
732 
733 		device_printf(dev, "faking MAC address\n");
734 		seed = ticks;
735 		sc->sc_ue.ue_eaddr[0] = 0x2a;
736 		memcpy(&sc->sc_ue.ue_eaddr[1], &seed, sizeof(uint32_t));
737 		sc->sc_ue.ue_eaddr[5] = device_get_unit(dev);
738 
739 	} else {
740 		memset(sc->sc_ue.ue_eaddr, 0, sizeof(sc->sc_ue.ue_eaddr));
741 
742 		for (i = 0; i != (ETHER_ADDR_LEN * 2); i++) {
743 			char c = eaddr_str[i];
744 
745 			if ('0' <= c && c <= '9')
746 				c -= '0';
747 			else if (c != 0)
748 				c -= 'A' - 10;
749 			else
750 				break;
751 
752 			c &= 0xf;
753 
754 			if ((i & 1) == 0)
755 				c <<= 4;
756 			sc->sc_ue.ue_eaddr[i / 2] |= c;
757 		}
758 
759 		if (uaa->usb_mode == USB_MODE_DEVICE) {
760 			/*
761 			 * Do not use the same MAC address like the peer !
762 			 */
763 			sc->sc_ue.ue_eaddr[5] ^= 0xFF;
764 		}
765 	}
766 
767 	ue->ue_sc = sc;
768 	ue->ue_dev = dev;
769 	ue->ue_udev = uaa->device;
770 	ue->ue_mtx = &sc->sc_mtx;
771 	ue->ue_methods = &cdce_ue_methods;
772 
773 	error = uether_ifattach(ue);
774 	if (error) {
775 		device_printf(dev, "could not attach interface\n");
776 		goto detach;
777 	}
778 	return (0);			/* success */
779 
780 detach:
781 	cdce_detach(dev);
782 	return (ENXIO);			/* failure */
783 }
784 
785 static int
786 cdce_detach(device_t dev)
787 {
788 	struct cdce_softc *sc = device_get_softc(dev);
789 	struct usb_ether *ue = &sc->sc_ue;
790 
791 	/* stop all USB transfers first */
792 	usbd_transfer_unsetup(sc->sc_xfer, CDCE_N_TRANSFER);
793 	uether_ifdetach(ue);
794 	mtx_destroy(&sc->sc_mtx);
795 
796 	ifmedia_removeall(&sc->sc_media);
797 
798 	return (0);
799 }
800 
801 static void
802 cdce_start(struct usb_ether *ue)
803 {
804 	struct cdce_softc *sc = uether_getsc(ue);
805 
806 	/*
807 	 * Start the USB transfers, if not already started:
808 	 */
809 	usbd_transfer_start(sc->sc_xfer[CDCE_BULK_TX]);
810 	usbd_transfer_start(sc->sc_xfer[CDCE_BULK_RX]);
811 }
812 
813 static int
814 cdce_ioctl(struct ifnet *ifp, u_long command, caddr_t data)
815 {
816 	struct usb_ether *ue = ifp->if_softc;
817 	struct cdce_softc *sc = uether_getsc(ue);
818 	struct ifreq *ifr = (struct ifreq *)data;
819 	int error;
820 
821 	error = 0;
822 
823 	switch(command) {
824 	case SIOCGIFMEDIA:
825 	case SIOCSIFMEDIA:
826 		error = ifmedia_ioctl(ifp, ifr, &sc->sc_media, command);
827 		break;
828 	default:
829 		error = uether_ioctl(ifp, command, data);
830 		break;
831 	}
832 
833 	return (error);
834 }
835 
836 static void
837 cdce_free_queue(struct mbuf **ppm, uint8_t n)
838 {
839 	uint8_t x;
840 	for (x = 0; x != n; x++) {
841 		if (ppm[x] != NULL) {
842 			m_freem(ppm[x]);
843 			ppm[x] = NULL;
844 		}
845 	}
846 }
847 
848 static int
849 cdce_media_change_cb(struct ifnet *ifp)
850 {
851 
852 	return (EOPNOTSUPP);
853 }
854 
855 static void
856 cdce_media_status_cb(struct ifnet *ifp, struct ifmediareq *ifmr)
857 {
858 
859 	if ((if_getflags(ifp) & IFF_UP) == 0)
860 		return;
861 
862 	ifmr->ifm_active = IFM_ETHER;
863 	ifmr->ifm_status = IFM_AVALID;
864 	ifmr->ifm_status |=
865 	    ifp->if_link_state == LINK_STATE_UP ? IFM_ACTIVE : 0;
866 }
867 
868 static void
869 cdce_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
870 {
871 	struct cdce_softc *sc = usbd_xfer_softc(xfer);
872 	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
873 	struct mbuf *m;
874 	struct mbuf *mt;
875 	uint32_t crc;
876 	uint8_t x;
877 	int actlen, aframes;
878 
879 	usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
880 
881 	DPRINTFN(1, "\n");
882 
883 	switch (USB_GET_STATE(xfer)) {
884 	case USB_ST_TRANSFERRED:
885 		DPRINTFN(11, "transfer complete: %u bytes in %u frames\n",
886 		    actlen, aframes);
887 
888 		if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
889 
890 		/* free all previous TX buffers */
891 		cdce_free_queue(sc->sc_tx_buf, CDCE_FRAMES_MAX);
892 
893 		/* FALLTHROUGH */
894 	case USB_ST_SETUP:
895 tr_setup:
896 		for (x = 0; x != CDCE_FRAMES_MAX; x++) {
897 			IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
898 
899 			if (m == NULL)
900 				break;
901 
902 			if (sc->sc_flags & CDCE_FLAG_ZAURUS) {
903 				/*
904 				 * Zaurus wants a 32-bit CRC appended
905 				 * to every frame
906 				 */
907 
908 				crc = cdce_m_crc32(m, 0, m->m_pkthdr.len);
909 				crc = htole32(crc);
910 
911 				if (!m_append(m, 4, (void *)&crc)) {
912 					m_freem(m);
913 					if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
914 					continue;
915 				}
916 			}
917 			if (m->m_len != m->m_pkthdr.len) {
918 				mt = m_defrag(m, M_NOWAIT);
919 				if (mt == NULL) {
920 					m_freem(m);
921 					if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
922 					continue;
923 				}
924 				m = mt;
925 			}
926 			if (m->m_pkthdr.len > MCLBYTES) {
927 				m->m_pkthdr.len = MCLBYTES;
928 			}
929 			sc->sc_tx_buf[x] = m;
930 			usbd_xfer_set_frame_data(xfer, x, m->m_data, m->m_len);
931 
932 			/*
933 			 * If there's a BPF listener, bounce a copy of
934 			 * this frame to him:
935 			 */
936 			BPF_MTAP(ifp, m);
937 		}
938 		if (x != 0) {
939 			usbd_xfer_set_frames(xfer, x);
940 
941 			usbd_transfer_submit(xfer);
942 		}
943 		break;
944 
945 	default:			/* Error */
946 		DPRINTFN(11, "transfer error, %s\n",
947 		    usbd_errstr(error));
948 
949 		/* free all previous TX buffers */
950 		cdce_free_queue(sc->sc_tx_buf, CDCE_FRAMES_MAX);
951 
952 		/* count output errors */
953 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
954 
955 		if (error != USB_ERR_CANCELLED) {
956 			if (usbd_get_mode(sc->sc_ue.ue_udev) == USB_MODE_HOST) {
957 				/* try to clear stall first */
958 				usbd_xfer_set_stall(xfer);
959 			}
960 			goto tr_setup;
961 		}
962 		break;
963 	}
964 }
965 
966 static int32_t
967 cdce_m_crc32_cb(void *arg, void *src, uint32_t count)
968 {
969 	uint32_t *p_crc = arg;
970 
971 	*p_crc = crc32_raw(src, count, *p_crc);
972 	return (0);
973 }
974 
975 static uint32_t
976 cdce_m_crc32(struct mbuf *m, uint32_t src_offset, uint32_t src_len)
977 {
978 	uint32_t crc = 0xFFFFFFFF;
979 
980 	(void)m_apply(m, src_offset, src_len, cdce_m_crc32_cb, &crc);
981 	return (crc ^ 0xFFFFFFFF);
982 }
983 
984 static void
985 cdce_init(struct usb_ether *ue)
986 {
987 	struct cdce_softc *sc = uether_getsc(ue);
988 	struct ifnet *ifp = uether_getifp(ue);
989 
990 	CDCE_LOCK_ASSERT(sc, MA_OWNED);
991 
992 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
993 
994 	/* start interrupt transfer */
995 	usbd_transfer_start(sc->sc_xfer[CDCE_INTR_RX]);
996 	usbd_transfer_start(sc->sc_xfer[CDCE_INTR_TX]);
997 
998 	/*
999 	 * Stall data write direction, which depends on USB mode.
1000 	 *
1001 	 * Some USB host stacks (e.g. Mac OS X) don't clears stall
1002 	 * bit as it should, so set it in our host mode only.
1003 	 */
1004 	if (usbd_get_mode(sc->sc_ue.ue_udev) == USB_MODE_HOST)
1005 		usbd_xfer_set_stall(sc->sc_xfer[CDCE_BULK_TX]);
1006 
1007 	/* start data transfers */
1008 	cdce_start(ue);
1009 }
1010 
1011 static void
1012 cdce_stop(struct usb_ether *ue)
1013 {
1014 	struct cdce_softc *sc = uether_getsc(ue);
1015 	struct ifnet *ifp = uether_getifp(ue);
1016 
1017 	CDCE_LOCK_ASSERT(sc, MA_OWNED);
1018 
1019 	ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1020 
1021 	/*
1022 	 * stop all the transfers, if not already stopped:
1023 	 */
1024 	usbd_transfer_stop(sc->sc_xfer[CDCE_BULK_RX]);
1025 	usbd_transfer_stop(sc->sc_xfer[CDCE_BULK_TX]);
1026 	usbd_transfer_stop(sc->sc_xfer[CDCE_INTR_RX]);
1027 	usbd_transfer_stop(sc->sc_xfer[CDCE_INTR_TX]);
1028 }
1029 
1030 static void
1031 cdce_setmulti(struct usb_ether *ue)
1032 {
1033 
1034 	cdce_set_filter(ue);
1035 }
1036 
1037 static void
1038 cdce_setpromisc(struct usb_ether *ue)
1039 {
1040 
1041 	cdce_set_filter(ue);
1042 }
1043 
1044 static void
1045 cdce_set_filter(struct usb_ether *ue)
1046 {
1047 	struct cdce_softc *sc = uether_getsc(ue);
1048 	struct ifnet *ifp = uether_getifp(ue);
1049 	struct usb_device_request req;
1050 	uint16_t value;
1051 
1052 	value = CDC_PACKET_TYPE_DIRECTED | CDC_PACKET_TYPE_BROADCAST;
1053 	if (if_getflags(ifp) & IFF_PROMISC)
1054 		value |= CDC_PACKET_TYPE_PROMISC;
1055 	if (if_getflags(ifp) & IFF_ALLMULTI)
1056 		value |= CDC_PACKET_TYPE_ALL_MULTICAST;
1057 
1058 	req.bmRequestType = UT_CLASS | UT_INTERFACE;
1059 	req.bRequest = CDC_SET_ETHERNET_PACKET_FILTER;
1060 	USETW(req.wValue, value);
1061 	req.wIndex[0] = sc->sc_ifaces_index[1];
1062 	req.wIndex[1] = 0;
1063 	USETW(req.wLength, 0);
1064 
1065 	/*
1066 	 * Function below will drop the sc mutex.
1067 	 * We can do that since we're called from a separate task,
1068 	 * that simply wraps the setpromisc/setmulti methods.
1069 	 */
1070 	usbd_do_request(sc->sc_ue.ue_udev, &sc->sc_mtx, &req, NULL);
1071 }
1072 
1073 static int
1074 cdce_suspend(device_t dev)
1075 {
1076 	device_printf(dev, "Suspending\n");
1077 	return (0);
1078 }
1079 
1080 static int
1081 cdce_resume(device_t dev)
1082 {
1083 	device_printf(dev, "Resuming\n");
1084 	return (0);
1085 }
1086 
1087 static void
1088 cdce_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
1089 {
1090 	struct cdce_softc *sc = usbd_xfer_softc(xfer);
1091 	struct mbuf *m;
1092 	uint8_t x;
1093 	int actlen;
1094 	int aframes;
1095 	int len;
1096 
1097 	usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
1098 
1099 	switch (USB_GET_STATE(xfer)) {
1100 	case USB_ST_TRANSFERRED:
1101 
1102 		DPRINTF("received %u bytes in %u frames\n", actlen, aframes);
1103 
1104 		for (x = 0; x != aframes; x++) {
1105 			m = sc->sc_rx_buf[x];
1106 			sc->sc_rx_buf[x] = NULL;
1107 			len = usbd_xfer_frame_len(xfer, x);
1108 
1109 			/* Strip off CRC added by Zaurus, if any */
1110 			if ((sc->sc_flags & CDCE_FLAG_ZAURUS) && len >= 14)
1111 				len -= 4;
1112 
1113 			if (len < (int)sizeof(struct ether_header)) {
1114 				m_freem(m);
1115 				continue;
1116 			}
1117 			/* queue up mbuf */
1118 			uether_rxmbuf(&sc->sc_ue, m, len);
1119 		}
1120 
1121 		/* FALLTHROUGH */
1122 	case USB_ST_SETUP:
1123 		/*
1124 		 * TODO: Implement support for multi frame transfers,
1125 		 * when the USB hardware supports it.
1126 		 */
1127 		for (x = 0; x != 1; x++) {
1128 			if (sc->sc_rx_buf[x] == NULL) {
1129 				m = uether_newbuf();
1130 				if (m == NULL)
1131 					goto tr_stall;
1132 				sc->sc_rx_buf[x] = m;
1133 			} else {
1134 				m = sc->sc_rx_buf[x];
1135 			}
1136 
1137 			usbd_xfer_set_frame_data(xfer, x, m->m_data, m->m_len);
1138 		}
1139 		/* set number of frames and start hardware */
1140 		usbd_xfer_set_frames(xfer, x);
1141 		usbd_transfer_submit(xfer);
1142 		/* flush any received frames */
1143 		uether_rxflush(&sc->sc_ue);
1144 		break;
1145 
1146 	default:			/* Error */
1147 		DPRINTF("error = %s\n",
1148 		    usbd_errstr(error));
1149 
1150 		if (error != USB_ERR_CANCELLED) {
1151 tr_stall:
1152 			if (usbd_get_mode(sc->sc_ue.ue_udev) == USB_MODE_HOST) {
1153 				/* try to clear stall first */
1154 				usbd_xfer_set_stall(xfer);
1155 				usbd_xfer_set_frames(xfer, 0);
1156 				usbd_transfer_submit(xfer);
1157 			}
1158 			break;
1159 		}
1160 
1161 		/* need to free the RX-mbufs when we are cancelled */
1162 		cdce_free_queue(sc->sc_rx_buf, CDCE_FRAMES_MAX);
1163 		break;
1164 	}
1165 }
1166 
1167 static void
1168 cdce_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
1169 {
1170 	u_char buf[CDCE_IND_SIZE_MAX];
1171 	struct usb_cdc_notification ucn;
1172 	struct cdce_softc *sc;
1173 	struct ifnet *ifp;
1174 	struct usb_page_cache *pc;
1175 	int off, actlen;
1176 	uint32_t downrate, uprate;
1177 
1178 	sc = usbd_xfer_softc(xfer);
1179 	ifp = uether_getifp(&sc->sc_ue);
1180 	pc = usbd_xfer_get_frame(xfer, 0);
1181 
1182 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1183 
1184 	switch (USB_GET_STATE(xfer)) {
1185 	case USB_ST_TRANSFERRED:
1186 		if (USB_DEBUG_VAR)
1187 			usbd_copy_out(pc, 0, buf, MIN(actlen, sizeof buf));
1188 		DPRINTF("Received %d bytes: %*D\n", actlen,
1189 		    (int)MIN(actlen, sizeof buf), buf, "");
1190 
1191 		off = 0;
1192 		while (actlen - off >= UCDC_NOTIFICATION_LENGTH) {
1193 			usbd_copy_out(pc, off, &ucn, UCDC_NOTIFICATION_LENGTH);
1194 
1195 			do {
1196 				if (ucn.bmRequestType != 0xa1)
1197 					break;
1198 
1199 				switch (ucn.bNotification) {
1200 				case UCDC_N_NETWORK_CONNECTION:
1201 					DPRINTF("changing link state: %d\n",
1202 					    UGETW(ucn.wValue));
1203 					if_link_state_change(ifp,
1204 					    UGETW(ucn.wValue) ? LINK_STATE_UP :
1205 					    LINK_STATE_DOWN);
1206 					break;
1207 
1208 				case UCDC_N_CONNECTION_SPEED_CHANGE:
1209 					if (UGETW(ucn.wLength) != 8)
1210 						break;
1211 
1212 					usbd_copy_out(pc, off +
1213 					    UCDC_NOTIFICATION_LENGTH,
1214 					    &ucn.data, UGETW(ucn.wLength));
1215 					downrate = UGETDW(ucn.data);
1216 					uprate = UGETDW(ucn.data);
1217 					if (downrate != uprate)
1218 						break;
1219 
1220 					/* set rate */
1221 					DPRINTF("changing baudrate: %u\n",
1222 					    downrate);
1223 					if_setbaudrate(ifp, downrate);
1224 					break;
1225 
1226 				default:
1227 					break;
1228 				}
1229 			} while (0);
1230 
1231 			off += UCDC_NOTIFICATION_LENGTH + UGETW(ucn.wLength);
1232 		}
1233 
1234 		/* FALLTHROUGH */
1235 	case USB_ST_SETUP:
1236 tr_setup:
1237 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1238 		usbd_transfer_submit(xfer);
1239 		break;
1240 
1241 	default:			/* Error */
1242 		if (error != USB_ERR_CANCELLED) {
1243 			/* start clear stall */
1244 			if (usbd_get_mode(sc->sc_ue.ue_udev) == USB_MODE_HOST)
1245 				usbd_xfer_set_stall(xfer);
1246 			goto tr_setup;
1247 		}
1248 		break;
1249 	}
1250 }
1251 
1252 static void
1253 cdce_intr_write_callback(struct usb_xfer *xfer, usb_error_t error)
1254 {
1255 	struct cdce_softc *sc = usbd_xfer_softc(xfer);
1256 	struct usb_cdc_notification req;
1257 	struct usb_page_cache *pc;
1258 	uint32_t speed;
1259 	int actlen;
1260 
1261 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1262 
1263 	switch (USB_GET_STATE(xfer)) {
1264 	case USB_ST_TRANSFERRED:
1265 
1266 		DPRINTF("Transferred %d bytes\n", actlen);
1267 
1268 		switch (sc->sc_notify_state) {
1269 		case CDCE_NOTIFY_NETWORK_CONNECTION:
1270 			sc->sc_notify_state = CDCE_NOTIFY_SPEED_CHANGE;
1271 			break;
1272 		case CDCE_NOTIFY_SPEED_CHANGE:
1273 			sc->sc_notify_state = CDCE_NOTIFY_DONE;
1274 			break;
1275 		default:
1276 			break;
1277 		}
1278 
1279 		/* FALLTHROUGH */
1280 	case USB_ST_SETUP:
1281 tr_setup:
1282 		/*
1283 		 * Inform host about connection. Required according to USB CDC
1284 		 * specification and communicating to Mac OS X USB host stack.
1285 		 * Some of the values seems ignored by Mac OS X though.
1286 		 */
1287 		if (sc->sc_notify_state == CDCE_NOTIFY_NETWORK_CONNECTION) {
1288 			req.bmRequestType = UCDC_NOTIFICATION;
1289 			req.bNotification = UCDC_N_NETWORK_CONNECTION;
1290 			req.wIndex[0] = sc->sc_ifaces_index[1];
1291 			req.wIndex[1] = 0;
1292 			USETW(req.wValue, 1); /* Connected */
1293 			USETW(req.wLength, 0);
1294 
1295 			pc = usbd_xfer_get_frame(xfer, 0);
1296 			usbd_copy_in(pc, 0, &req, sizeof(req));
1297 			usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1298 			usbd_xfer_set_frames(xfer, 1);
1299 			usbd_transfer_submit(xfer);
1300 
1301 		} else if (sc->sc_notify_state == CDCE_NOTIFY_SPEED_CHANGE) {
1302 			req.bmRequestType = UCDC_NOTIFICATION;
1303 			req.bNotification = UCDC_N_CONNECTION_SPEED_CHANGE;
1304 			req.wIndex[0] = sc->sc_ifaces_index[1];
1305 			req.wIndex[1] = 0;
1306 			USETW(req.wValue, 0);
1307 			USETW(req.wLength, 8);
1308 
1309 			/* Peak theoretical bulk trasfer rate in bits/s */
1310 			if (usbd_get_speed(sc->sc_ue.ue_udev) != USB_SPEED_FULL)
1311 				speed = (13 * 512 * 8 * 1000 * 8);
1312 			else
1313 				speed = (19 * 64 * 1 * 1000 * 8);
1314 
1315 			USETDW(req.data + 0, speed); /* Upstream bit rate */
1316 			USETDW(req.data + 4, speed); /* Downstream bit rate */
1317 
1318 			pc = usbd_xfer_get_frame(xfer, 0);
1319 			usbd_copy_in(pc, 0, &req, sizeof(req));
1320 			usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1321 			usbd_xfer_set_frames(xfer, 1);
1322 			usbd_transfer_submit(xfer);
1323 		}
1324 		break;
1325 
1326 	default:			/* Error */
1327 		if (error != USB_ERR_CANCELLED) {
1328 			if (usbd_get_mode(sc->sc_ue.ue_udev) == USB_MODE_HOST) {
1329 				/* start clear stall */
1330 				usbd_xfer_set_stall(xfer);
1331 			}
1332 			goto tr_setup;
1333 		}
1334 		break;
1335 	}
1336 }
1337 
1338 static int
1339 cdce_handle_request(device_t dev,
1340     const void *preq, void **pptr, uint16_t *plen,
1341     uint16_t offset, uint8_t *pstate)
1342 {
1343 	struct cdce_softc *sc = device_get_softc(dev);
1344 	const struct usb_device_request *req = preq;
1345 	uint8_t is_complete = *pstate;
1346 
1347 	/*
1348 	 * When Mac OS X resumes after suspending it expects
1349 	 * to be notified again after this request.
1350 	 */
1351 	if (req->bmRequestType == UT_WRITE_CLASS_INTERFACE && \
1352 	    req->bRequest == UCDC_NCM_SET_ETHERNET_PACKET_FILTER) {
1353 		if (is_complete == 1) {
1354 			mtx_lock(&sc->sc_mtx);
1355 			sc->sc_notify_state = CDCE_NOTIFY_SPEED_CHANGE;
1356 			usbd_transfer_start(sc->sc_xfer[CDCE_INTR_TX]);
1357 			mtx_unlock(&sc->sc_mtx);
1358 		}
1359 
1360 		return (0);
1361 	}
1362 
1363 	return (ENXIO);			/* use builtin handler */
1364 }
1365 
1366 #if CDCE_HAVE_NCM
1367 static void
1368 cdce_ncm_tx_zero(struct usb_page_cache *pc,
1369     uint32_t start, uint32_t end)
1370 {
1371 	if (start >= CDCE_NCM_TX_MAXLEN)
1372 		return;
1373 	if (end > CDCE_NCM_TX_MAXLEN)
1374 		end = CDCE_NCM_TX_MAXLEN;
1375 
1376 	usbd_frame_zero(pc, start, end - start);
1377 }
1378 
1379 static uint8_t
1380 cdce_ncm_fill_tx_frames(struct usb_xfer *xfer, uint8_t index)
1381 {
1382 	struct cdce_softc *sc = usbd_xfer_softc(xfer);
1383 	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
1384 	struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, index);
1385 	struct mbuf *m;
1386 	uint32_t rem;
1387 	uint32_t offset;
1388 	uint32_t last_offset;
1389 	uint16_t n;
1390 	uint8_t retval;
1391 
1392 	usbd_xfer_set_frame_offset(xfer, index * CDCE_NCM_TX_MAXLEN, index);
1393 
1394 	offset = sizeof(sc->sc_ncm.hdr) +
1395 	    sizeof(sc->sc_ncm.dpt) + sizeof(sc->sc_ncm.dp);
1396 
1397 	/* Store last valid offset before alignment */
1398 	last_offset = offset;
1399 
1400 	/* Align offset */
1401 	offset = CDCE_NCM_ALIGN(sc->sc_ncm.tx_remainder,
1402 	    offset, sc->sc_ncm.tx_modulus);
1403 
1404 	/* Zero pad */
1405 	cdce_ncm_tx_zero(pc, last_offset, offset);
1406 
1407 	/* buffer full */
1408 	retval = 2;
1409 
1410 	for (n = 0; n != sc->sc_ncm.tx_nframe; n++) {
1411 		/* check if end of transmit buffer is reached */
1412 
1413 		if (offset >= sc->sc_ncm.tx_max)
1414 			break;
1415 
1416 		/* compute maximum buffer size */
1417 
1418 		rem = sc->sc_ncm.tx_max - offset;
1419 
1420 		IFQ_DRV_DEQUEUE(&(ifp->if_snd), m);
1421 
1422 		if (m == NULL) {
1423 			/* buffer not full */
1424 			retval = 1;
1425 			break;
1426 		}
1427 
1428 		if (m->m_pkthdr.len > (int)rem) {
1429 			if (n == 0) {
1430 				/* The frame won't fit in our buffer */
1431 				DPRINTFN(1, "Frame too big to be transmitted!\n");
1432 				m_freem(m);
1433 				if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1434 				n--;
1435 				continue;
1436 			}
1437 			/* Wait till next buffer becomes ready */
1438 			IFQ_DRV_PREPEND(&(ifp->if_snd), m);
1439 			break;
1440 		}
1441 		usbd_m_copy_in(pc, offset, m, 0, m->m_pkthdr.len);
1442 
1443 		USETW(sc->sc_ncm.dp[n].wFrameLength, m->m_pkthdr.len);
1444 		USETW(sc->sc_ncm.dp[n].wFrameIndex, offset);
1445 
1446 		/* Update offset */
1447 		offset += m->m_pkthdr.len;
1448 
1449 		/* Store last valid offset before alignment */
1450 		last_offset = offset;
1451 
1452 		/* Align offset */
1453 		offset = CDCE_NCM_ALIGN(sc->sc_ncm.tx_remainder,
1454 		    offset, sc->sc_ncm.tx_modulus);
1455 
1456 		/* Zero pad */
1457 		cdce_ncm_tx_zero(pc, last_offset, offset);
1458 
1459 		/*
1460 		 * If there's a BPF listener, bounce a copy
1461 		 * of this frame to him:
1462 		 */
1463 		BPF_MTAP(ifp, m);
1464 
1465 		/* Free mbuf */
1466 
1467 		m_freem(m);
1468 
1469 		/* Pre-increment interface counter */
1470 
1471 		if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
1472 	}
1473 
1474 	if (n == 0)
1475 		return (0);
1476 
1477 	rem = (sizeof(sc->sc_ncm.dpt) + (4 * n) + 4);
1478 
1479 	USETW(sc->sc_ncm.dpt.wLength, rem);
1480 
1481 	/* zero the rest of the data pointer entries */
1482 	for (; n != CDCE_NCM_SUBFRAMES_MAX; n++) {
1483 		USETW(sc->sc_ncm.dp[n].wFrameLength, 0);
1484 		USETW(sc->sc_ncm.dp[n].wFrameIndex, 0);
1485 	}
1486 
1487 	offset = last_offset;
1488 
1489 	/* Align offset */
1490 	offset = CDCE_NCM_ALIGN(0, offset, CDCE_NCM_TX_MINLEN);
1491 
1492 	/* Optimise, save bandwidth and force short termination */
1493 	if (offset >= sc->sc_ncm.tx_max)
1494 		offset = sc->sc_ncm.tx_max;
1495 	else
1496 		offset ++;
1497 
1498 	/* Zero pad */
1499 	cdce_ncm_tx_zero(pc, last_offset, offset);
1500 
1501 	/* set frame length */
1502 	usbd_xfer_set_frame_len(xfer, index, offset);
1503 
1504 	/* Fill out 16-bit header */
1505 	sc->sc_ncm.hdr.dwSignature[0] = 'N';
1506 	sc->sc_ncm.hdr.dwSignature[1] = 'C';
1507 	sc->sc_ncm.hdr.dwSignature[2] = 'M';
1508 	sc->sc_ncm.hdr.dwSignature[3] = 'H';
1509 	USETW(sc->sc_ncm.hdr.wHeaderLength, sizeof(sc->sc_ncm.hdr));
1510 	USETW(sc->sc_ncm.hdr.wBlockLength, offset);
1511 	USETW(sc->sc_ncm.hdr.wSequence, sc->sc_ncm.tx_seq);
1512 	USETW(sc->sc_ncm.hdr.wDptIndex, sizeof(sc->sc_ncm.hdr));
1513 
1514 	sc->sc_ncm.tx_seq++;
1515 
1516 	/* Fill out 16-bit frame table header */
1517 	sc->sc_ncm.dpt.dwSignature[0] = 'N';
1518 	sc->sc_ncm.dpt.dwSignature[1] = 'C';
1519 	sc->sc_ncm.dpt.dwSignature[2] = 'M';
1520 	sc->sc_ncm.dpt.dwSignature[3] = '0';
1521 	USETW(sc->sc_ncm.dpt.wNextNdpIndex, 0);		/* reserved */
1522 
1523 	usbd_copy_in(pc, 0, &(sc->sc_ncm.hdr), sizeof(sc->sc_ncm.hdr));
1524 	usbd_copy_in(pc, sizeof(sc->sc_ncm.hdr), &(sc->sc_ncm.dpt),
1525 	    sizeof(sc->sc_ncm.dpt));
1526 	usbd_copy_in(pc, sizeof(sc->sc_ncm.hdr) + sizeof(sc->sc_ncm.dpt),
1527 	    &(sc->sc_ncm.dp), sizeof(sc->sc_ncm.dp));
1528 	return (retval);
1529 }
1530 
1531 static void
1532 cdce_ncm_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
1533 {
1534 	struct cdce_softc *sc = usbd_xfer_softc(xfer);
1535 	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
1536 	uint16_t x;
1537 	uint8_t temp;
1538 	int actlen;
1539 	int aframes;
1540 
1541 	switch (USB_GET_STATE(xfer)) {
1542 	case USB_ST_TRANSFERRED:
1543 
1544 		usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
1545 
1546 		DPRINTFN(10, "transfer complete: "
1547 		    "%u bytes in %u frames\n", actlen, aframes);
1548 
1549 	case USB_ST_SETUP:
1550 		for (x = 0; x != CDCE_NCM_TX_FRAMES_MAX; x++) {
1551 			temp = cdce_ncm_fill_tx_frames(xfer, x);
1552 			if (temp == 0)
1553 				break;
1554 			if (temp == 1) {
1555 				x++;
1556 				break;
1557 			}
1558 		}
1559 
1560 		if (x != 0) {
1561 #ifdef USB_DEBUG
1562 			usbd_xfer_set_interval(xfer, cdce_tx_interval);
1563 #endif
1564 			usbd_xfer_set_frames(xfer, x);
1565 			usbd_transfer_submit(xfer);
1566 		}
1567 		break;
1568 
1569 	default:			/* Error */
1570 		DPRINTFN(10, "Transfer error: %s\n",
1571 		    usbd_errstr(error));
1572 
1573 		/* update error counter */
1574 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1575 
1576 		if (error != USB_ERR_CANCELLED) {
1577 			if (usbd_get_mode(sc->sc_ue.ue_udev) == USB_MODE_HOST) {
1578 				/* try to clear stall first */
1579 				usbd_xfer_set_stall(xfer);
1580 				usbd_xfer_set_frames(xfer, 0);
1581 				usbd_transfer_submit(xfer);
1582 			}
1583 		}
1584 		break;
1585 	}
1586 }
1587 
1588 static void
1589 cdce_ncm_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
1590 {
1591 	struct cdce_softc *sc = usbd_xfer_softc(xfer);
1592 	struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, 0);
1593 	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
1594 	struct mbuf *m;
1595 	int sumdata __usbdebug_used;
1596 	int sumlen;
1597 	int actlen;
1598 	int aframes;
1599 	int temp;
1600 	int nframes;
1601 	int x;
1602 	int offset;
1603 
1604 	switch (USB_GET_STATE(xfer)) {
1605 	case USB_ST_TRANSFERRED:
1606 
1607 		usbd_xfer_status(xfer, &actlen, &sumlen, &aframes, NULL);
1608 
1609 		DPRINTFN(1, "received %u bytes in %u frames\n",
1610 		    actlen, aframes);
1611 
1612 		if (actlen < (int)(sizeof(sc->sc_ncm.hdr) +
1613 		    sizeof(sc->sc_ncm.dpt))) {
1614 			DPRINTFN(1, "frame too short\n");
1615 			goto tr_setup;
1616 		}
1617 		usbd_copy_out(pc, 0, &(sc->sc_ncm.hdr),
1618 		    sizeof(sc->sc_ncm.hdr));
1619 
1620 		if ((sc->sc_ncm.hdr.dwSignature[0] != 'N') ||
1621 		    (sc->sc_ncm.hdr.dwSignature[1] != 'C') ||
1622 		    (sc->sc_ncm.hdr.dwSignature[2] != 'M') ||
1623 		    (sc->sc_ncm.hdr.dwSignature[3] != 'H')) {
1624 			DPRINTFN(1, "invalid HDR signature: "
1625 			    "0x%02x:0x%02x:0x%02x:0x%02x\n",
1626 			    sc->sc_ncm.hdr.dwSignature[0],
1627 			    sc->sc_ncm.hdr.dwSignature[1],
1628 			    sc->sc_ncm.hdr.dwSignature[2],
1629 			    sc->sc_ncm.hdr.dwSignature[3]);
1630 			goto tr_stall;
1631 		}
1632 		temp = UGETW(sc->sc_ncm.hdr.wBlockLength);
1633 		if (temp > sumlen) {
1634 			DPRINTFN(1, "unsupported block length %u/%u\n",
1635 			    temp, sumlen);
1636 			goto tr_stall;
1637 		}
1638 		temp = UGETW(sc->sc_ncm.hdr.wDptIndex);
1639 		if ((int)(temp + sizeof(sc->sc_ncm.dpt)) > actlen) {
1640 			DPRINTFN(1, "invalid DPT index: 0x%04x\n", temp);
1641 			goto tr_stall;
1642 		}
1643 		usbd_copy_out(pc, temp, &(sc->sc_ncm.dpt),
1644 		    sizeof(sc->sc_ncm.dpt));
1645 
1646 		if ((sc->sc_ncm.dpt.dwSignature[0] != 'N') ||
1647 		    (sc->sc_ncm.dpt.dwSignature[1] != 'C') ||
1648 		    (sc->sc_ncm.dpt.dwSignature[2] != 'M') ||
1649 		    (sc->sc_ncm.dpt.dwSignature[3] != '0')) {
1650 			DPRINTFN(1, "invalid DPT signature"
1651 			    "0x%02x:0x%02x:0x%02x:0x%02x\n",
1652 			    sc->sc_ncm.dpt.dwSignature[0],
1653 			    sc->sc_ncm.dpt.dwSignature[1],
1654 			    sc->sc_ncm.dpt.dwSignature[2],
1655 			    sc->sc_ncm.dpt.dwSignature[3]);
1656 			goto tr_stall;
1657 		}
1658 		nframes = UGETW(sc->sc_ncm.dpt.wLength) / 4;
1659 
1660 		/* Subtract size of header and last zero padded entry */
1661 		if (nframes >= (2 + 1))
1662 			nframes -= (2 + 1);
1663 		else
1664 			nframes = 0;
1665 
1666 		DPRINTFN(1, "nframes = %u\n", nframes);
1667 
1668 		temp += sizeof(sc->sc_ncm.dpt);
1669 
1670 		if ((temp + (4 * nframes)) > actlen)
1671 			goto tr_stall;
1672 
1673 		if (nframes > CDCE_NCM_SUBFRAMES_MAX) {
1674 			DPRINTFN(1, "Truncating number of frames from %u to %u\n",
1675 			    nframes, CDCE_NCM_SUBFRAMES_MAX);
1676 			nframes = CDCE_NCM_SUBFRAMES_MAX;
1677 		}
1678 		usbd_copy_out(pc, temp, &(sc->sc_ncm.dp), (4 * nframes));
1679 
1680 		sumdata = 0;
1681 
1682 		for (x = 0; x != nframes; x++) {
1683 			offset = UGETW(sc->sc_ncm.dp[x].wFrameIndex);
1684 			temp = UGETW(sc->sc_ncm.dp[x].wFrameLength);
1685 
1686 			if ((offset == 0) ||
1687 			    (temp < (int)sizeof(struct ether_header)) ||
1688 			    (temp > (MCLBYTES - ETHER_ALIGN))) {
1689 				DPRINTFN(1, "NULL frame detected at %d\n", x);
1690 				m = NULL;
1691 				/* silently ignore this frame */
1692 				continue;
1693 			} else if ((offset + temp) > actlen) {
1694 				DPRINTFN(1, "invalid frame "
1695 				    "detected at %d\n", x);
1696 				m = NULL;
1697 				/* silently ignore this frame */
1698 				continue;
1699 			} else if (temp > (int)(MHLEN - ETHER_ALIGN)) {
1700 				m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1701 			} else {
1702 				m = m_gethdr(M_NOWAIT, MT_DATA);
1703 			}
1704 
1705 			DPRINTFN(16, "frame %u, offset = %u, length = %u \n",
1706 			    x, offset, temp);
1707 
1708 			/* check if we have a buffer */
1709 			if (m) {
1710 				m->m_len = m->m_pkthdr.len = temp + ETHER_ALIGN;
1711 				m_adj(m, ETHER_ALIGN);
1712 
1713 				usbd_copy_out(pc, offset, m->m_data, temp);
1714 
1715 				/* enqueue */
1716 				uether_rxmbuf(&sc->sc_ue, m, temp);
1717 
1718 				sumdata += temp;
1719 			} else {
1720 				if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1721 			}
1722 		}
1723 
1724 		DPRINTFN(1, "Efficiency: %u/%u bytes\n", sumdata, actlen);
1725 
1726 	case USB_ST_SETUP:
1727 tr_setup:
1728 		usbd_xfer_set_frame_len(xfer, 0, sc->sc_ncm.rx_max);
1729 		usbd_xfer_set_frames(xfer, 1);
1730 		usbd_transfer_submit(xfer);
1731 		uether_rxflush(&sc->sc_ue);	/* must be last */
1732 		break;
1733 
1734 	default:			/* Error */
1735 		DPRINTFN(1, "error = %s\n",
1736 		    usbd_errstr(error));
1737 
1738 		if (error != USB_ERR_CANCELLED) {
1739 tr_stall:
1740 			if (usbd_get_mode(sc->sc_ue.ue_udev) == USB_MODE_HOST) {
1741 				/* try to clear stall first */
1742 				usbd_xfer_set_stall(xfer);
1743 				usbd_xfer_set_frames(xfer, 0);
1744 				usbd_transfer_submit(xfer);
1745 			}
1746 		}
1747 		break;
1748 	}
1749 }
1750 #endif
1751