xref: /freebsd/sys/dev/usb/net/if_cdce.c (revision b0d29bc47dba79f6f38e67eabadfb4b32ffd9390)
1 /*	$NetBSD: if_cdce.c,v 1.4 2004/10/24 12:50:54 augustss Exp $ */
2 
3 /*-
4  * SPDX-License-Identifier: BSD-4-Clause
5  *
6  * Copyright (c) 1997, 1998, 1999, 2000-2003 Bill Paul <wpaul@windriver.com>
7  * Copyright (c) 2003-2005 Craig Boston
8  * Copyright (c) 2004 Daniel Hartmeier
9  * Copyright (c) 2009 Hans Petter Selasky
10  * All rights reserved.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. All advertising materials mentioning features or use of this software
21  *    must display the following acknowledgement:
22  *	This product includes software developed by Bill Paul.
23  * 4. Neither the name of the author nor the names of any co-contributors
24  *    may be used to endorse or promote products derived from this software
25  *    without specific prior written permission.
26  *
27  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
28  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
29  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
30  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul, THE VOICES IN HIS HEAD OR
31  * THE CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
32  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
33  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
34  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
35  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
36  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
37  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
38  */
39 
40 /*
41  * USB Communication Device Class (Ethernet Networking Control Model)
42  * http://www.usb.org/developers/devclass_docs/usbcdc11.pdf
43  */
44 
45 /*
46  * USB Network Control Model (NCM)
47  * http://www.usb.org/developers/devclass_docs/NCM10.zip
48  */
49 
50 #include <sys/cdefs.h>
51 __FBSDID("$FreeBSD$");
52 
53 #include <sys/gsb_crc32.h>
54 #include <sys/eventhandler.h>
55 #include <sys/stdint.h>
56 #include <sys/stddef.h>
57 #include <sys/queue.h>
58 #include <sys/systm.h>
59 #include <sys/socket.h>
60 #include <sys/kernel.h>
61 #include <sys/bus.h>
62 #include <sys/module.h>
63 #include <sys/lock.h>
64 #include <sys/mutex.h>
65 #include <sys/condvar.h>
66 #include <sys/sysctl.h>
67 #include <sys/sx.h>
68 #include <sys/unistd.h>
69 #include <sys/callout.h>
70 #include <sys/malloc.h>
71 #include <sys/priv.h>
72 
73 #include <net/if.h>
74 #include <net/if_var.h>
75 
76 #include <dev/usb/usb.h>
77 #include <dev/usb/usbdi.h>
78 #include <dev/usb/usbdi_util.h>
79 #include <dev/usb/usb_cdc.h>
80 #include "usbdevs.h"
81 
82 #define	USB_DEBUG_VAR cdce_debug
83 #include <dev/usb/usb_debug.h>
84 #include <dev/usb/usb_process.h>
85 #include <dev/usb/usb_msctest.h>
86 #include "usb_if.h"
87 
88 #include <dev/usb/net/usb_ethernet.h>
89 #include <dev/usb/net/if_cdcereg.h>
90 
91 static device_probe_t cdce_probe;
92 static device_attach_t cdce_attach;
93 static device_detach_t cdce_detach;
94 static device_suspend_t cdce_suspend;
95 static device_resume_t cdce_resume;
96 static usb_handle_request_t cdce_handle_request;
97 
98 static usb_callback_t cdce_bulk_write_callback;
99 static usb_callback_t cdce_bulk_read_callback;
100 static usb_callback_t cdce_intr_read_callback;
101 static usb_callback_t cdce_intr_write_callback;
102 
103 #if CDCE_HAVE_NCM
104 static usb_callback_t cdce_ncm_bulk_write_callback;
105 static usb_callback_t cdce_ncm_bulk_read_callback;
106 #endif
107 
108 static uether_fn_t cdce_attach_post;
109 static uether_fn_t cdce_init;
110 static uether_fn_t cdce_stop;
111 static uether_fn_t cdce_start;
112 static uether_fn_t cdce_setmulti;
113 static uether_fn_t cdce_setpromisc;
114 
115 static uint32_t	cdce_m_crc32(struct mbuf *, uint32_t, uint32_t);
116 
117 #ifdef USB_DEBUG
118 static int cdce_debug = 0;
119 static int cdce_tx_interval = 0;
120 
121 static SYSCTL_NODE(_hw_usb, OID_AUTO, cdce, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
122     "USB CDC-Ethernet");
123 SYSCTL_INT(_hw_usb_cdce, OID_AUTO, debug, CTLFLAG_RWTUN, &cdce_debug, 0,
124     "Debug level");
125 SYSCTL_INT(_hw_usb_cdce, OID_AUTO, interval, CTLFLAG_RWTUN, &cdce_tx_interval, 0,
126     "NCM transmit interval in ms");
127 #endif
128 
129 static const struct usb_config cdce_config[CDCE_N_TRANSFER] = {
130 
131 	[CDCE_BULK_RX] = {
132 		.type = UE_BULK,
133 		.endpoint = UE_ADDR_ANY,
134 		.direction = UE_DIR_RX,
135 		.if_index = 0,
136 		.frames = CDCE_FRAMES_MAX,
137 		.bufsize = (CDCE_FRAMES_MAX * MCLBYTES),
138 		.flags = {.pipe_bof = 1,.short_frames_ok = 1,.short_xfer_ok = 1,.ext_buffer = 1,},
139 		.callback = cdce_bulk_read_callback,
140 		.timeout = 0,	/* no timeout */
141 		.usb_mode = USB_MODE_DUAL,	/* both modes */
142 	},
143 
144 	[CDCE_BULK_TX] = {
145 		.type = UE_BULK,
146 		.endpoint = UE_ADDR_ANY,
147 		.direction = UE_DIR_TX,
148 		.if_index = 0,
149 		.frames = CDCE_FRAMES_MAX,
150 		.bufsize = (CDCE_FRAMES_MAX * MCLBYTES),
151 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,.ext_buffer = 1,},
152 		.callback = cdce_bulk_write_callback,
153 		.timeout = 10000,	/* 10 seconds */
154 		.usb_mode = USB_MODE_DUAL,	/* both modes */
155 	},
156 
157 	[CDCE_INTR_RX] = {
158 		.type = UE_INTERRUPT,
159 		.endpoint = UE_ADDR_ANY,
160 		.direction = UE_DIR_RX,
161 		.if_index = 1,
162 		.bufsize = CDCE_IND_SIZE_MAX,
163 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,.no_pipe_ok = 1,},
164 		.callback = cdce_intr_read_callback,
165 		.timeout = 0,
166 		.usb_mode = USB_MODE_HOST,
167 	},
168 
169 	[CDCE_INTR_TX] = {
170 		.type = UE_INTERRUPT,
171 		.endpoint = UE_ADDR_ANY,
172 		.direction = UE_DIR_TX,
173 		.if_index = 1,
174 		.bufsize = CDCE_IND_SIZE_MAX,
175 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,.no_pipe_ok = 1,},
176 		.callback = cdce_intr_write_callback,
177 		.timeout = 10000,	/* 10 seconds */
178 		.usb_mode = USB_MODE_DEVICE,
179 	},
180 };
181 
182 #if CDCE_HAVE_NCM
183 static const struct usb_config cdce_ncm_config[CDCE_N_TRANSFER] = {
184 
185 	[CDCE_BULK_RX] = {
186 		.type = UE_BULK,
187 		.endpoint = UE_ADDR_ANY,
188 		.direction = UE_DIR_RX,
189 		.if_index = 0,
190 		.frames = CDCE_NCM_RX_FRAMES_MAX,
191 		.bufsize = (CDCE_NCM_RX_FRAMES_MAX * CDCE_NCM_RX_MAXLEN),
192 		.flags = {.pipe_bof = 1,.short_frames_ok = 1,.short_xfer_ok = 1,},
193 		.callback = cdce_ncm_bulk_read_callback,
194 		.timeout = 0,	/* no timeout */
195 		.usb_mode = USB_MODE_DUAL,	/* both modes */
196 	},
197 
198 	[CDCE_BULK_TX] = {
199 		.type = UE_BULK,
200 		.endpoint = UE_ADDR_ANY,
201 		.direction = UE_DIR_TX,
202 		.if_index = 0,
203 		.frames = CDCE_NCM_TX_FRAMES_MAX,
204 		.bufsize = (CDCE_NCM_TX_FRAMES_MAX * CDCE_NCM_TX_MAXLEN),
205 		.flags = {.pipe_bof = 1,},
206 		.callback = cdce_ncm_bulk_write_callback,
207 		.timeout = 10000,	/* 10 seconds */
208 		.usb_mode = USB_MODE_DUAL,	/* both modes */
209 	},
210 
211 	[CDCE_INTR_RX] = {
212 		.type = UE_INTERRUPT,
213 		.endpoint = UE_ADDR_ANY,
214 		.direction = UE_DIR_RX,
215 		.if_index = 1,
216 		.bufsize = CDCE_IND_SIZE_MAX,
217 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,.no_pipe_ok = 1,},
218 		.callback = cdce_intr_read_callback,
219 		.timeout = 0,
220 		.usb_mode = USB_MODE_HOST,
221 	},
222 
223 	[CDCE_INTR_TX] = {
224 		.type = UE_INTERRUPT,
225 		.endpoint = UE_ADDR_ANY,
226 		.direction = UE_DIR_TX,
227 		.if_index = 1,
228 		.bufsize = CDCE_IND_SIZE_MAX,
229 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,.no_pipe_ok = 1,},
230 		.callback = cdce_intr_write_callback,
231 		.timeout = 10000,	/* 10 seconds */
232 		.usb_mode = USB_MODE_DEVICE,
233 	},
234 };
235 #endif
236 
237 static device_method_t cdce_methods[] = {
238 	/* USB interface */
239 	DEVMETHOD(usb_handle_request, cdce_handle_request),
240 
241 	/* Device interface */
242 	DEVMETHOD(device_probe, cdce_probe),
243 	DEVMETHOD(device_attach, cdce_attach),
244 	DEVMETHOD(device_detach, cdce_detach),
245 	DEVMETHOD(device_suspend, cdce_suspend),
246 	DEVMETHOD(device_resume, cdce_resume),
247 
248 	DEVMETHOD_END
249 };
250 
251 static driver_t cdce_driver = {
252 	.name = "cdce",
253 	.methods = cdce_methods,
254 	.size = sizeof(struct cdce_softc),
255 };
256 
257 static devclass_t cdce_devclass;
258 static eventhandler_tag cdce_etag;
259 
260 static int  cdce_driver_loaded(struct module *, int, void *);
261 
262 static const STRUCT_USB_HOST_ID cdce_switch_devs[] = {
263 	{USB_VPI(USB_VENDOR_HUAWEI, USB_PRODUCT_HUAWEI_E3272_INIT, MSC_EJECT_HUAWEI2)},
264 };
265 
266 static const STRUCT_USB_HOST_ID cdce_host_devs[] = {
267 	{USB_VPI(USB_VENDOR_ACERLABS, USB_PRODUCT_ACERLABS_M5632, CDCE_FLAG_NO_UNION)},
268 	{USB_VPI(USB_VENDOR_AMBIT, USB_PRODUCT_AMBIT_NTL_250, CDCE_FLAG_NO_UNION)},
269 	{USB_VPI(USB_VENDOR_COMPAQ, USB_PRODUCT_COMPAQ_IPAQLINUX, CDCE_FLAG_NO_UNION)},
270 	{USB_VPI(USB_VENDOR_GMATE, USB_PRODUCT_GMATE_YP3X00, CDCE_FLAG_NO_UNION)},
271 	{USB_VPI(USB_VENDOR_MOTOROLA2, USB_PRODUCT_MOTOROLA2_USBLAN, CDCE_FLAG_ZAURUS | CDCE_FLAG_NO_UNION)},
272 	{USB_VPI(USB_VENDOR_MOTOROLA2, USB_PRODUCT_MOTOROLA2_USBLAN2, CDCE_FLAG_ZAURUS | CDCE_FLAG_NO_UNION)},
273 	{USB_VPI(USB_VENDOR_NETCHIP, USB_PRODUCT_NETCHIP_ETHERNETGADGET, CDCE_FLAG_NO_UNION)},
274 	{USB_VPI(USB_VENDOR_PROLIFIC, USB_PRODUCT_PROLIFIC_PL2501, CDCE_FLAG_NO_UNION)},
275 	{USB_VPI(USB_VENDOR_SHARP, USB_PRODUCT_SHARP_SL5500, CDCE_FLAG_ZAURUS)},
276 	{USB_VPI(USB_VENDOR_SHARP, USB_PRODUCT_SHARP_SL5600, CDCE_FLAG_ZAURUS | CDCE_FLAG_NO_UNION)},
277 	{USB_VPI(USB_VENDOR_SHARP, USB_PRODUCT_SHARP_SLA300, CDCE_FLAG_ZAURUS | CDCE_FLAG_NO_UNION)},
278 	{USB_VPI(USB_VENDOR_SHARP, USB_PRODUCT_SHARP_SLC700, CDCE_FLAG_ZAURUS | CDCE_FLAG_NO_UNION)},
279 	{USB_VPI(USB_VENDOR_SHARP, USB_PRODUCT_SHARP_SLC750, CDCE_FLAG_ZAURUS | CDCE_FLAG_NO_UNION)},
280 	{USB_VPI(USB_VENDOR_REALTEK, USB_PRODUCT_REALTEK_RTL8156, 0)},
281 
282 	{USB_VENDOR(USB_VENDOR_HUAWEI), USB_IFACE_CLASS(UICLASS_VENDOR),
283 		USB_IFACE_SUBCLASS(0x02), USB_IFACE_PROTOCOL(0x16),
284 		USB_DRIVER_INFO(0)},
285 	{USB_VENDOR(USB_VENDOR_HUAWEI), USB_IFACE_CLASS(UICLASS_VENDOR),
286 		USB_IFACE_SUBCLASS(0x02), USB_IFACE_PROTOCOL(0x46),
287 		USB_DRIVER_INFO(0)},
288 	{USB_VENDOR(USB_VENDOR_HUAWEI), USB_IFACE_CLASS(UICLASS_VENDOR),
289 		USB_IFACE_SUBCLASS(0x02), USB_IFACE_PROTOCOL(0x76),
290 		USB_DRIVER_INFO(0)},
291 	{USB_VENDOR(USB_VENDOR_HUAWEI), USB_IFACE_CLASS(UICLASS_VENDOR),
292 		USB_IFACE_SUBCLASS(0x03), USB_IFACE_PROTOCOL(0x16),
293 		USB_DRIVER_INFO(0)},
294 };
295 
296 static const STRUCT_USB_DUAL_ID cdce_dual_devs[] = {
297 	{USB_IF_CSI(UICLASS_CDC, UISUBCLASS_ETHERNET_NETWORKING_CONTROL_MODEL, 0)},
298 	{USB_IF_CSI(UICLASS_CDC, UISUBCLASS_MOBILE_DIRECT_LINE_MODEL, 0)},
299 	{USB_IF_CSI(UICLASS_CDC, UISUBCLASS_NETWORK_CONTROL_MODEL, 0)},
300 };
301 
302 DRIVER_MODULE(cdce, uhub, cdce_driver, cdce_devclass, cdce_driver_loaded, 0);
303 MODULE_VERSION(cdce, 1);
304 MODULE_DEPEND(cdce, uether, 1, 1, 1);
305 MODULE_DEPEND(cdce, usb, 1, 1, 1);
306 MODULE_DEPEND(cdce, ether, 1, 1, 1);
307 USB_PNP_DEVICE_INFO(cdce_switch_devs);
308 USB_PNP_HOST_INFO(cdce_host_devs);
309 USB_PNP_DUAL_INFO(cdce_dual_devs);
310 
311 static const struct usb_ether_methods cdce_ue_methods = {
312 	.ue_attach_post = cdce_attach_post,
313 	.ue_start = cdce_start,
314 	.ue_init = cdce_init,
315 	.ue_stop = cdce_stop,
316 	.ue_setmulti = cdce_setmulti,
317 	.ue_setpromisc = cdce_setpromisc,
318 };
319 
320 #if CDCE_HAVE_NCM
321 /*------------------------------------------------------------------------*
322  *	cdce_ncm_init
323  *
324  * Return values:
325  * 0: Success
326  * Else: Failure
327  *------------------------------------------------------------------------*/
328 static uint8_t
329 cdce_ncm_init(struct cdce_softc *sc)
330 {
331 	struct usb_ncm_parameters temp;
332 	struct usb_device_request req;
333 	struct usb_ncm_func_descriptor *ufd;
334 	uint8_t value[8];
335 	int err;
336 
337 	ufd = usbd_find_descriptor(sc->sc_ue.ue_udev, NULL,
338 	    sc->sc_ifaces_index[1], UDESC_CS_INTERFACE, 0xFF,
339 	    UCDC_NCM_FUNC_DESC_SUBTYPE, 0xFF);
340 
341 	/* verify length of NCM functional descriptor */
342 	if (ufd != NULL) {
343 		if (ufd->bLength < sizeof(*ufd))
344 			ufd = NULL;
345 		else
346 			DPRINTFN(1, "Found NCM functional descriptor.\n");
347 	}
348 
349 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
350 	req.bRequest = UCDC_NCM_GET_NTB_PARAMETERS;
351 	USETW(req.wValue, 0);
352 	req.wIndex[0] = sc->sc_ifaces_index[1];
353 	req.wIndex[1] = 0;
354 	USETW(req.wLength, sizeof(temp));
355 
356 	err = usbd_do_request_flags(sc->sc_ue.ue_udev, NULL, &req,
357 	    &temp, 0, NULL, 1000 /* ms */);
358 	if (err)
359 		return (1);
360 
361 	/* Read correct set of parameters according to device mode */
362 
363 	if (usbd_get_mode(sc->sc_ue.ue_udev) == USB_MODE_HOST) {
364 		sc->sc_ncm.rx_max = UGETDW(temp.dwNtbInMaxSize);
365 		sc->sc_ncm.tx_max = UGETDW(temp.dwNtbOutMaxSize);
366 		sc->sc_ncm.tx_remainder = UGETW(temp.wNdpOutPayloadRemainder);
367 		sc->sc_ncm.tx_modulus = UGETW(temp.wNdpOutDivisor);
368 		sc->sc_ncm.tx_struct_align = UGETW(temp.wNdpOutAlignment);
369 		sc->sc_ncm.tx_nframe = UGETW(temp.wNtbOutMaxDatagrams);
370 	} else {
371 		sc->sc_ncm.rx_max = UGETDW(temp.dwNtbOutMaxSize);
372 		sc->sc_ncm.tx_max = UGETDW(temp.dwNtbInMaxSize);
373 		sc->sc_ncm.tx_remainder = UGETW(temp.wNdpInPayloadRemainder);
374 		sc->sc_ncm.tx_modulus = UGETW(temp.wNdpInDivisor);
375 		sc->sc_ncm.tx_struct_align = UGETW(temp.wNdpInAlignment);
376 		sc->sc_ncm.tx_nframe = UGETW(temp.wNtbOutMaxDatagrams);
377 	}
378 
379 	/* Verify maximum receive length */
380 
381 	if ((sc->sc_ncm.rx_max < 32) ||
382 	    (sc->sc_ncm.rx_max > CDCE_NCM_RX_MAXLEN)) {
383 		DPRINTFN(1, "Using default maximum receive length\n");
384 		sc->sc_ncm.rx_max = CDCE_NCM_RX_MAXLEN;
385 	}
386 
387 	/* Verify maximum transmit length */
388 
389 	if ((sc->sc_ncm.tx_max < 32) ||
390 	    (sc->sc_ncm.tx_max > CDCE_NCM_TX_MAXLEN)) {
391 		DPRINTFN(1, "Using default maximum transmit length\n");
392 		sc->sc_ncm.tx_max = CDCE_NCM_TX_MAXLEN;
393 	}
394 
395 	/*
396 	 * Verify that the structure alignment is:
397 	 * - power of two
398 	 * - not greater than the maximum transmit length
399 	 * - not less than four bytes
400 	 */
401 	if ((sc->sc_ncm.tx_struct_align < 4) ||
402 	    (sc->sc_ncm.tx_struct_align !=
403 	     ((-sc->sc_ncm.tx_struct_align) & sc->sc_ncm.tx_struct_align)) ||
404 	    (sc->sc_ncm.tx_struct_align >= sc->sc_ncm.tx_max)) {
405 		DPRINTFN(1, "Using default other alignment: 4 bytes\n");
406 		sc->sc_ncm.tx_struct_align = 4;
407 	}
408 
409 	/*
410 	 * Verify that the payload alignment is:
411 	 * - power of two
412 	 * - not greater than the maximum transmit length
413 	 * - not less than four bytes
414 	 */
415 	if ((sc->sc_ncm.tx_modulus < 4) ||
416 	    (sc->sc_ncm.tx_modulus !=
417 	     ((-sc->sc_ncm.tx_modulus) & sc->sc_ncm.tx_modulus)) ||
418 	    (sc->sc_ncm.tx_modulus >= sc->sc_ncm.tx_max)) {
419 		DPRINTFN(1, "Using default transmit modulus: 4 bytes\n");
420 		sc->sc_ncm.tx_modulus = 4;
421 	}
422 
423 	/* Verify that the payload remainder */
424 
425 	if ((sc->sc_ncm.tx_remainder >= sc->sc_ncm.tx_modulus)) {
426 		DPRINTFN(1, "Using default transmit remainder: 0 bytes\n");
427 		sc->sc_ncm.tx_remainder = 0;
428 	}
429 
430 	/*
431 	 * Offset the TX remainder so that IP packet payload starts at
432 	 * the tx_modulus. This is not too clear in the specification.
433 	 */
434 
435 	sc->sc_ncm.tx_remainder =
436 	    (sc->sc_ncm.tx_remainder - ETHER_HDR_LEN) &
437 	    (sc->sc_ncm.tx_modulus - 1);
438 
439 	/* Verify max datagrams */
440 
441 	if (sc->sc_ncm.tx_nframe == 0 ||
442 	    sc->sc_ncm.tx_nframe > (CDCE_NCM_SUBFRAMES_MAX - 1)) {
443 		DPRINTFN(1, "Using default max "
444 		    "subframes: %u units\n", CDCE_NCM_SUBFRAMES_MAX - 1);
445 		/* need to reserve one entry for zero padding */
446 		sc->sc_ncm.tx_nframe = (CDCE_NCM_SUBFRAMES_MAX - 1);
447 	}
448 
449 	/* Additional configuration, will fail in device side mode, which is OK. */
450 
451 	req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
452 	req.bRequest = UCDC_NCM_SET_NTB_INPUT_SIZE;
453 	USETW(req.wValue, 0);
454 	req.wIndex[0] = sc->sc_ifaces_index[1];
455 	req.wIndex[1] = 0;
456 
457 	if (ufd != NULL &&
458 	    (ufd->bmNetworkCapabilities & UCDC_NCM_CAP_MAX_DGRAM)) {
459 		USETW(req.wLength, 8);
460 		USETDW(value, sc->sc_ncm.rx_max);
461 		USETW(value + 4, (CDCE_NCM_SUBFRAMES_MAX - 1));
462 		USETW(value + 6, 0);
463 	} else {
464 		USETW(req.wLength, 4);
465 		USETDW(value, sc->sc_ncm.rx_max);
466  	}
467 
468 	err = usbd_do_request_flags(sc->sc_ue.ue_udev, NULL, &req,
469 	    &value, 0, NULL, 1000 /* ms */);
470 	if (err) {
471 		DPRINTFN(1, "Setting input size "
472 		    "to %u failed.\n", sc->sc_ncm.rx_max);
473 	}
474 
475 	req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
476 	req.bRequest = UCDC_NCM_SET_CRC_MODE;
477 	USETW(req.wValue, 0);	/* no CRC */
478 	req.wIndex[0] = sc->sc_ifaces_index[1];
479 	req.wIndex[1] = 0;
480 	USETW(req.wLength, 0);
481 
482 	err = usbd_do_request_flags(sc->sc_ue.ue_udev, NULL, &req,
483 	    NULL, 0, NULL, 1000 /* ms */);
484 	if (err) {
485 		DPRINTFN(1, "Setting CRC mode to off failed.\n");
486 	}
487 
488 	req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
489 	req.bRequest = UCDC_NCM_SET_NTB_FORMAT;
490 	USETW(req.wValue, 0);	/* NTB-16 */
491 	req.wIndex[0] = sc->sc_ifaces_index[1];
492 	req.wIndex[1] = 0;
493 	USETW(req.wLength, 0);
494 
495 	err = usbd_do_request_flags(sc->sc_ue.ue_udev, NULL, &req,
496 	    NULL, 0, NULL, 1000 /* ms */);
497 	if (err) {
498 		DPRINTFN(1, "Setting NTB format to 16-bit failed.\n");
499 	}
500 
501 	return (0);		/* success */
502 }
503 #endif
504 
505 static void
506 cdce_test_autoinst(void *arg, struct usb_device *udev,
507     struct usb_attach_arg *uaa)
508 {
509 	struct usb_interface *iface;
510 	struct usb_interface_descriptor *id;
511 
512 	if (uaa->dev_state != UAA_DEV_READY)
513 		return;
514 
515 	iface = usbd_get_iface(udev, 0);
516 	if (iface == NULL)
517 		return;
518 	id = iface->idesc;
519 	if (id == NULL || id->bInterfaceClass != UICLASS_MASS)
520 		return;
521 	if (usbd_lookup_id_by_uaa(cdce_switch_devs, sizeof(cdce_switch_devs), uaa))
522 		return;		/* no device match */
523 
524 	if (usb_msc_eject(udev, 0, USB_GET_DRIVER_INFO(uaa)) == 0) {
525 		/* success, mark the udev as disappearing */
526 		uaa->dev_state = UAA_DEV_EJECTING;
527 	}
528 }
529 
530 static int
531 cdce_driver_loaded(struct module *mod, int what, void *arg)
532 {
533 	switch (what) {
534 	case MOD_LOAD:
535 		/* register our autoinstall handler */
536 		cdce_etag = EVENTHANDLER_REGISTER(usb_dev_configured,
537 		    cdce_test_autoinst, NULL, EVENTHANDLER_PRI_ANY);
538 		return (0);
539 	case MOD_UNLOAD:
540 		EVENTHANDLER_DEREGISTER(usb_dev_configured, cdce_etag);
541 		return (0);
542 	default:
543 		return (EOPNOTSUPP);
544 	}
545 }
546 
547 static int
548 cdce_probe(device_t dev)
549 {
550 	struct usb_attach_arg *uaa = device_get_ivars(dev);
551 	int error;
552 
553 	error = usbd_lookup_id_by_uaa(cdce_host_devs, sizeof(cdce_host_devs), uaa);
554 	if (error)
555 		error = usbd_lookup_id_by_uaa(cdce_dual_devs, sizeof(cdce_dual_devs), uaa);
556 	return (error);
557 }
558 
559 static void
560 cdce_attach_post(struct usb_ether *ue)
561 {
562 	/* no-op */
563 	return;
564 }
565 
566 static int
567 cdce_attach(device_t dev)
568 {
569 	struct cdce_softc *sc = device_get_softc(dev);
570 	struct usb_ether *ue = &sc->sc_ue;
571 	struct usb_attach_arg *uaa = device_get_ivars(dev);
572 	struct usb_interface *iface;
573 	const struct usb_cdc_union_descriptor *ud;
574 	const struct usb_interface_descriptor *id;
575 	const struct usb_cdc_ethernet_descriptor *ued;
576 	const struct usb_config *pcfg;
577 	uint32_t seed;
578 	int error;
579 	uint8_t i;
580 	uint8_t data_iface_no;
581 	char eaddr_str[5 * ETHER_ADDR_LEN];	/* approx */
582 
583 	sc->sc_flags = USB_GET_DRIVER_INFO(uaa);
584 	sc->sc_ue.ue_udev = uaa->device;
585 
586 	device_set_usb_desc(dev);
587 
588 	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF);
589 
590 	ud = usbd_find_descriptor
591 	    (uaa->device, NULL, uaa->info.bIfaceIndex,
592 	    UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_UNION, 0xFF);
593 
594 	if ((ud == NULL) || (ud->bLength < sizeof(*ud)) ||
595 	    (sc->sc_flags & CDCE_FLAG_NO_UNION)) {
596 		DPRINTFN(1, "No union descriptor!\n");
597 		sc->sc_ifaces_index[0] = uaa->info.bIfaceIndex;
598 		sc->sc_ifaces_index[1] = uaa->info.bIfaceIndex;
599 		goto alloc_transfers;
600 	}
601 	data_iface_no = ud->bSlaveInterface[0];
602 
603 	for (i = 0;; i++) {
604 
605 		iface = usbd_get_iface(uaa->device, i);
606 
607 		if (iface) {
608 
609 			id = usbd_get_interface_descriptor(iface);
610 
611 			if (id && (id->bInterfaceNumber == data_iface_no)) {
612 				sc->sc_ifaces_index[0] = i;
613 				sc->sc_ifaces_index[1] = uaa->info.bIfaceIndex;
614 				usbd_set_parent_iface(uaa->device, i, uaa->info.bIfaceIndex);
615 				break;
616 			}
617 		} else {
618 			device_printf(dev, "no data interface found\n");
619 			goto detach;
620 		}
621 	}
622 
623 	/*
624 	 * <quote>
625 	 *
626 	 *  The Data Class interface of a networking device shall have
627 	 *  a minimum of two interface settings. The first setting
628 	 *  (the default interface setting) includes no endpoints and
629 	 *  therefore no networking traffic is exchanged whenever the
630 	 *  default interface setting is selected. One or more
631 	 *  additional interface settings are used for normal
632 	 *  operation, and therefore each includes a pair of endpoints
633 	 *  (one IN, and one OUT) to exchange network traffic. Select
634 	 *  an alternate interface setting to initialize the network
635 	 *  aspects of the device and to enable the exchange of
636 	 *  network traffic.
637 	 *
638 	 * </quote>
639 	 *
640 	 * Some devices, most notably cable modems, include interface
641 	 * settings that have no IN or OUT endpoint, therefore loop
642 	 * through the list of all available interface settings
643 	 * looking for one with both IN and OUT endpoints.
644 	 */
645 
646 alloc_transfers:
647 
648 	pcfg = cdce_config;	/* Default Configuration */
649 
650 	for (i = 0; i != 32; i++) {
651 
652 		error = usbd_set_alt_interface_index(uaa->device,
653 		    sc->sc_ifaces_index[0], i);
654 		if (error)
655 			break;
656 #if CDCE_HAVE_NCM
657 		if ((i == 0) && (cdce_ncm_init(sc) == 0))
658 			pcfg = cdce_ncm_config;
659 #endif
660 		error = usbd_transfer_setup(uaa->device,
661 		    sc->sc_ifaces_index, sc->sc_xfer,
662 		    pcfg, CDCE_N_TRANSFER, sc, &sc->sc_mtx);
663 
664 		if (error == 0)
665 			break;
666 	}
667 
668 	if (error || (i == 32)) {
669 		device_printf(dev, "No valid alternate "
670 		    "setting found\n");
671 		goto detach;
672 	}
673 
674 	ued = usbd_find_descriptor
675 	    (uaa->device, NULL, uaa->info.bIfaceIndex,
676 	    UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_ENF, 0xFF);
677 
678 	if ((ued == NULL) || (ued->bLength < sizeof(*ued))) {
679 		error = USB_ERR_INVAL;
680 	} else {
681 		error = usbd_req_get_string_any(uaa->device, NULL,
682 		    eaddr_str, sizeof(eaddr_str), ued->iMacAddress);
683 	}
684 
685 	if (error) {
686 
687 		/* fake MAC address */
688 
689 		device_printf(dev, "faking MAC address\n");
690 		seed = ticks;
691 		sc->sc_ue.ue_eaddr[0] = 0x2a;
692 		memcpy(&sc->sc_ue.ue_eaddr[1], &seed, sizeof(uint32_t));
693 		sc->sc_ue.ue_eaddr[5] = device_get_unit(dev);
694 
695 	} else {
696 
697 		memset(sc->sc_ue.ue_eaddr, 0, sizeof(sc->sc_ue.ue_eaddr));
698 
699 		for (i = 0; i != (ETHER_ADDR_LEN * 2); i++) {
700 
701 			char c = eaddr_str[i];
702 
703 			if ('0' <= c && c <= '9')
704 				c -= '0';
705 			else if (c != 0)
706 				c -= 'A' - 10;
707 			else
708 				break;
709 
710 			c &= 0xf;
711 
712 			if ((i & 1) == 0)
713 				c <<= 4;
714 			sc->sc_ue.ue_eaddr[i / 2] |= c;
715 		}
716 
717 		if (uaa->usb_mode == USB_MODE_DEVICE) {
718 			/*
719 			 * Do not use the same MAC address like the peer !
720 			 */
721 			sc->sc_ue.ue_eaddr[5] ^= 0xFF;
722 		}
723 	}
724 
725 	ue->ue_sc = sc;
726 	ue->ue_dev = dev;
727 	ue->ue_udev = uaa->device;
728 	ue->ue_mtx = &sc->sc_mtx;
729 	ue->ue_methods = &cdce_ue_methods;
730 
731 	error = uether_ifattach(ue);
732 	if (error) {
733 		device_printf(dev, "could not attach interface\n");
734 		goto detach;
735 	}
736 	return (0);			/* success */
737 
738 detach:
739 	cdce_detach(dev);
740 	return (ENXIO);			/* failure */
741 }
742 
743 static int
744 cdce_detach(device_t dev)
745 {
746 	struct cdce_softc *sc = device_get_softc(dev);
747 	struct usb_ether *ue = &sc->sc_ue;
748 
749 	/* stop all USB transfers first */
750 	usbd_transfer_unsetup(sc->sc_xfer, CDCE_N_TRANSFER);
751 	uether_ifdetach(ue);
752 	mtx_destroy(&sc->sc_mtx);
753 
754 	return (0);
755 }
756 
757 static void
758 cdce_start(struct usb_ether *ue)
759 {
760 	struct cdce_softc *sc = uether_getsc(ue);
761 
762 	/*
763 	 * Start the USB transfers, if not already started:
764 	 */
765 	usbd_transfer_start(sc->sc_xfer[CDCE_BULK_TX]);
766 	usbd_transfer_start(sc->sc_xfer[CDCE_BULK_RX]);
767 }
768 
769 static void
770 cdce_free_queue(struct mbuf **ppm, uint8_t n)
771 {
772 	uint8_t x;
773 	for (x = 0; x != n; x++) {
774 		if (ppm[x] != NULL) {
775 			m_freem(ppm[x]);
776 			ppm[x] = NULL;
777 		}
778 	}
779 }
780 
781 static void
782 cdce_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
783 {
784 	struct cdce_softc *sc = usbd_xfer_softc(xfer);
785 	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
786 	struct mbuf *m;
787 	struct mbuf *mt;
788 	uint32_t crc;
789 	uint8_t x;
790 	int actlen, aframes;
791 
792 	usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
793 
794 	DPRINTFN(1, "\n");
795 
796 	switch (USB_GET_STATE(xfer)) {
797 	case USB_ST_TRANSFERRED:
798 		DPRINTFN(11, "transfer complete: %u bytes in %u frames\n",
799 		    actlen, aframes);
800 
801 		if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
802 
803 		/* free all previous TX buffers */
804 		cdce_free_queue(sc->sc_tx_buf, CDCE_FRAMES_MAX);
805 
806 		/* FALLTHROUGH */
807 	case USB_ST_SETUP:
808 tr_setup:
809 		for (x = 0; x != CDCE_FRAMES_MAX; x++) {
810 
811 			IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
812 
813 			if (m == NULL)
814 				break;
815 
816 			if (sc->sc_flags & CDCE_FLAG_ZAURUS) {
817 				/*
818 				 * Zaurus wants a 32-bit CRC appended
819 				 * to every frame
820 				 */
821 
822 				crc = cdce_m_crc32(m, 0, m->m_pkthdr.len);
823 				crc = htole32(crc);
824 
825 				if (!m_append(m, 4, (void *)&crc)) {
826 					m_freem(m);
827 					if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
828 					continue;
829 				}
830 			}
831 			if (m->m_len != m->m_pkthdr.len) {
832 				mt = m_defrag(m, M_NOWAIT);
833 				if (mt == NULL) {
834 					m_freem(m);
835 					if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
836 					continue;
837 				}
838 				m = mt;
839 			}
840 			if (m->m_pkthdr.len > MCLBYTES) {
841 				m->m_pkthdr.len = MCLBYTES;
842 			}
843 			sc->sc_tx_buf[x] = m;
844 			usbd_xfer_set_frame_data(xfer, x, m->m_data, m->m_len);
845 
846 			/*
847 			 * If there's a BPF listener, bounce a copy of
848 			 * this frame to him:
849 			 */
850 			BPF_MTAP(ifp, m);
851 		}
852 		if (x != 0) {
853 			usbd_xfer_set_frames(xfer, x);
854 
855 			usbd_transfer_submit(xfer);
856 		}
857 		break;
858 
859 	default:			/* Error */
860 		DPRINTFN(11, "transfer error, %s\n",
861 		    usbd_errstr(error));
862 
863 		/* free all previous TX buffers */
864 		cdce_free_queue(sc->sc_tx_buf, CDCE_FRAMES_MAX);
865 
866 		/* count output errors */
867 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
868 
869 		if (error != USB_ERR_CANCELLED) {
870 			if (usbd_get_mode(sc->sc_ue.ue_udev) == USB_MODE_HOST) {
871 				/* try to clear stall first */
872 				usbd_xfer_set_stall(xfer);
873 			}
874 			goto tr_setup;
875 		}
876 		break;
877 	}
878 }
879 
880 static int32_t
881 cdce_m_crc32_cb(void *arg, void *src, uint32_t count)
882 {
883 	uint32_t *p_crc = arg;
884 
885 	*p_crc = crc32_raw(src, count, *p_crc);
886 	return (0);
887 }
888 
889 static uint32_t
890 cdce_m_crc32(struct mbuf *m, uint32_t src_offset, uint32_t src_len)
891 {
892 	uint32_t crc = 0xFFFFFFFF;
893 	int error;
894 
895 	error = m_apply(m, src_offset, src_len, cdce_m_crc32_cb, &crc);
896 	return (crc ^ 0xFFFFFFFF);
897 }
898 
899 static void
900 cdce_init(struct usb_ether *ue)
901 {
902 	struct cdce_softc *sc = uether_getsc(ue);
903 	struct ifnet *ifp = uether_getifp(ue);
904 
905 	CDCE_LOCK_ASSERT(sc, MA_OWNED);
906 
907 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
908 
909 	/* start interrupt transfer */
910 	usbd_transfer_start(sc->sc_xfer[CDCE_INTR_RX]);
911 	usbd_transfer_start(sc->sc_xfer[CDCE_INTR_TX]);
912 
913 	/*
914 	 * Stall data write direction, which depends on USB mode.
915 	 *
916 	 * Some USB host stacks (e.g. Mac OS X) don't clears stall
917 	 * bit as it should, so set it in our host mode only.
918 	 */
919 	if (usbd_get_mode(sc->sc_ue.ue_udev) == USB_MODE_HOST)
920 		usbd_xfer_set_stall(sc->sc_xfer[CDCE_BULK_TX]);
921 
922 	/* start data transfers */
923 	cdce_start(ue);
924 }
925 
926 static void
927 cdce_stop(struct usb_ether *ue)
928 {
929 	struct cdce_softc *sc = uether_getsc(ue);
930 	struct ifnet *ifp = uether_getifp(ue);
931 
932 	CDCE_LOCK_ASSERT(sc, MA_OWNED);
933 
934 	ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
935 
936 	/*
937 	 * stop all the transfers, if not already stopped:
938 	 */
939 	usbd_transfer_stop(sc->sc_xfer[CDCE_BULK_RX]);
940 	usbd_transfer_stop(sc->sc_xfer[CDCE_BULK_TX]);
941 	usbd_transfer_stop(sc->sc_xfer[CDCE_INTR_RX]);
942 	usbd_transfer_stop(sc->sc_xfer[CDCE_INTR_TX]);
943 }
944 
945 static void
946 cdce_setmulti(struct usb_ether *ue)
947 {
948 	/* no-op */
949 	return;
950 }
951 
952 static void
953 cdce_setpromisc(struct usb_ether *ue)
954 {
955 	/* no-op */
956 	return;
957 }
958 
959 static int
960 cdce_suspend(device_t dev)
961 {
962 	device_printf(dev, "Suspending\n");
963 	return (0);
964 }
965 
966 static int
967 cdce_resume(device_t dev)
968 {
969 	device_printf(dev, "Resuming\n");
970 	return (0);
971 }
972 
973 static void
974 cdce_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
975 {
976 	struct cdce_softc *sc = usbd_xfer_softc(xfer);
977 	struct mbuf *m;
978 	uint8_t x;
979 	int actlen;
980 	int aframes;
981 	int len;
982 
983 	usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
984 
985 	switch (USB_GET_STATE(xfer)) {
986 	case USB_ST_TRANSFERRED:
987 
988 		DPRINTF("received %u bytes in %u frames\n", actlen, aframes);
989 
990 		for (x = 0; x != aframes; x++) {
991 
992 			m = sc->sc_rx_buf[x];
993 			sc->sc_rx_buf[x] = NULL;
994 			len = usbd_xfer_frame_len(xfer, x);
995 
996 			/* Strip off CRC added by Zaurus, if any */
997 			if ((sc->sc_flags & CDCE_FLAG_ZAURUS) && len >= 14)
998 				len -= 4;
999 
1000 			if (len < (int)sizeof(struct ether_header)) {
1001 				m_freem(m);
1002 				continue;
1003 			}
1004 			/* queue up mbuf */
1005 			uether_rxmbuf(&sc->sc_ue, m, len);
1006 		}
1007 
1008 		/* FALLTHROUGH */
1009 	case USB_ST_SETUP:
1010 		/*
1011 		 * TODO: Implement support for multi frame transfers,
1012 		 * when the USB hardware supports it.
1013 		 */
1014 		for (x = 0; x != 1; x++) {
1015 			if (sc->sc_rx_buf[x] == NULL) {
1016 				m = uether_newbuf();
1017 				if (m == NULL)
1018 					goto tr_stall;
1019 				sc->sc_rx_buf[x] = m;
1020 			} else {
1021 				m = sc->sc_rx_buf[x];
1022 			}
1023 
1024 			usbd_xfer_set_frame_data(xfer, x, m->m_data, m->m_len);
1025 		}
1026 		/* set number of frames and start hardware */
1027 		usbd_xfer_set_frames(xfer, x);
1028 		usbd_transfer_submit(xfer);
1029 		/* flush any received frames */
1030 		uether_rxflush(&sc->sc_ue);
1031 		break;
1032 
1033 	default:			/* Error */
1034 		DPRINTF("error = %s\n",
1035 		    usbd_errstr(error));
1036 
1037 		if (error != USB_ERR_CANCELLED) {
1038 tr_stall:
1039 			if (usbd_get_mode(sc->sc_ue.ue_udev) == USB_MODE_HOST) {
1040 				/* try to clear stall first */
1041 				usbd_xfer_set_stall(xfer);
1042 				usbd_xfer_set_frames(xfer, 0);
1043 				usbd_transfer_submit(xfer);
1044 			}
1045 			break;
1046 		}
1047 
1048 		/* need to free the RX-mbufs when we are cancelled */
1049 		cdce_free_queue(sc->sc_rx_buf, CDCE_FRAMES_MAX);
1050 		break;
1051 	}
1052 }
1053 
1054 static void
1055 cdce_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
1056 {
1057 	struct cdce_softc *sc = usbd_xfer_softc(xfer);
1058 	int actlen;
1059 
1060 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1061 
1062 	switch (USB_GET_STATE(xfer)) {
1063 	case USB_ST_TRANSFERRED:
1064 
1065 		DPRINTF("Received %d bytes\n", actlen);
1066 
1067 		/* TODO: decode some indications */
1068 
1069 		/* FALLTHROUGH */
1070 	case USB_ST_SETUP:
1071 tr_setup:
1072 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1073 		usbd_transfer_submit(xfer);
1074 		break;
1075 
1076 	default:			/* Error */
1077 		if (error != USB_ERR_CANCELLED) {
1078 			/* start clear stall */
1079 			if (usbd_get_mode(sc->sc_ue.ue_udev) == USB_MODE_HOST)
1080 				usbd_xfer_set_stall(xfer);
1081 			goto tr_setup;
1082 		}
1083 		break;
1084 	}
1085 }
1086 
1087 static void
1088 cdce_intr_write_callback(struct usb_xfer *xfer, usb_error_t error)
1089 {
1090 	struct cdce_softc *sc = usbd_xfer_softc(xfer);
1091 	struct usb_cdc_notification req;
1092 	struct usb_page_cache *pc;
1093 	uint32_t speed;
1094 	int actlen;
1095 
1096 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1097 
1098 	switch (USB_GET_STATE(xfer)) {
1099 	case USB_ST_TRANSFERRED:
1100 
1101 		DPRINTF("Transferred %d bytes\n", actlen);
1102 
1103 		switch (sc->sc_notify_state) {
1104 		case CDCE_NOTIFY_NETWORK_CONNECTION:
1105 			sc->sc_notify_state = CDCE_NOTIFY_SPEED_CHANGE;
1106 			break;
1107 		case CDCE_NOTIFY_SPEED_CHANGE:
1108 			sc->sc_notify_state = CDCE_NOTIFY_DONE;
1109 			break;
1110 		default:
1111 			break;
1112 		}
1113 
1114 		/* FALLTHROUGH */
1115 	case USB_ST_SETUP:
1116 tr_setup:
1117 		/*
1118 		 * Inform host about connection. Required according to USB CDC
1119 		 * specification and communicating to Mac OS X USB host stack.
1120 		 * Some of the values seems ignored by Mac OS X though.
1121 		 */
1122 		if (sc->sc_notify_state == CDCE_NOTIFY_NETWORK_CONNECTION) {
1123 			req.bmRequestType = UCDC_NOTIFICATION;
1124 			req.bNotification = UCDC_N_NETWORK_CONNECTION;
1125 			req.wIndex[0] = sc->sc_ifaces_index[1];
1126 			req.wIndex[1] = 0;
1127 			USETW(req.wValue, 1); /* Connected */
1128 			USETW(req.wLength, 0);
1129 
1130 			pc = usbd_xfer_get_frame(xfer, 0);
1131 			usbd_copy_in(pc, 0, &req, sizeof(req));
1132 			usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1133 			usbd_xfer_set_frames(xfer, 1);
1134 			usbd_transfer_submit(xfer);
1135 
1136 		} else if (sc->sc_notify_state == CDCE_NOTIFY_SPEED_CHANGE) {
1137 			req.bmRequestType = UCDC_NOTIFICATION;
1138 			req.bNotification = UCDC_N_CONNECTION_SPEED_CHANGE;
1139 			req.wIndex[0] = sc->sc_ifaces_index[1];
1140 			req.wIndex[1] = 0;
1141 			USETW(req.wValue, 0);
1142 			USETW(req.wLength, 8);
1143 
1144 			/* Peak theoretical bulk trasfer rate in bits/s */
1145 			if (usbd_get_speed(sc->sc_ue.ue_udev) != USB_SPEED_FULL)
1146 				speed = (13 * 512 * 8 * 1000 * 8);
1147 			else
1148 				speed = (19 * 64 * 1 * 1000 * 8);
1149 
1150 			USETDW(req.data + 0, speed); /* Upstream bit rate */
1151 			USETDW(req.data + 4, speed); /* Downstream bit rate */
1152 
1153 			pc = usbd_xfer_get_frame(xfer, 0);
1154 			usbd_copy_in(pc, 0, &req, sizeof(req));
1155 			usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1156 			usbd_xfer_set_frames(xfer, 1);
1157 			usbd_transfer_submit(xfer);
1158 		}
1159 		break;
1160 
1161 	default:			/* Error */
1162 		if (error != USB_ERR_CANCELLED) {
1163 			if (usbd_get_mode(sc->sc_ue.ue_udev) == USB_MODE_HOST) {
1164 				/* start clear stall */
1165 				usbd_xfer_set_stall(xfer);
1166 			}
1167 			goto tr_setup;
1168 		}
1169 		break;
1170 	}
1171 }
1172 
1173 static int
1174 cdce_handle_request(device_t dev,
1175     const void *preq, void **pptr, uint16_t *plen,
1176     uint16_t offset, uint8_t *pstate)
1177 {
1178 	struct cdce_softc *sc = device_get_softc(dev);
1179 	const struct usb_device_request *req = preq;
1180 	uint8_t is_complete = *pstate;
1181 
1182 	/*
1183 	 * When Mac OS X resumes after suspending it expects
1184 	 * to be notified again after this request.
1185 	 */
1186 	if (req->bmRequestType == UT_WRITE_CLASS_INTERFACE && \
1187 	    req->bRequest == UCDC_NCM_SET_ETHERNET_PACKET_FILTER) {
1188 
1189 		if (is_complete == 1) {
1190 			mtx_lock(&sc->sc_mtx);
1191 			sc->sc_notify_state = CDCE_NOTIFY_SPEED_CHANGE;
1192 			usbd_transfer_start(sc->sc_xfer[CDCE_INTR_TX]);
1193 			mtx_unlock(&sc->sc_mtx);
1194 		}
1195 
1196 		return (0);
1197 	}
1198 
1199 	return (ENXIO);			/* use builtin handler */
1200 }
1201 
1202 #if CDCE_HAVE_NCM
1203 static void
1204 cdce_ncm_tx_zero(struct usb_page_cache *pc,
1205     uint32_t start, uint32_t end)
1206 {
1207 	if (start >= CDCE_NCM_TX_MAXLEN)
1208 		return;
1209 	if (end > CDCE_NCM_TX_MAXLEN)
1210 		end = CDCE_NCM_TX_MAXLEN;
1211 
1212 	usbd_frame_zero(pc, start, end - start);
1213 }
1214 
1215 static uint8_t
1216 cdce_ncm_fill_tx_frames(struct usb_xfer *xfer, uint8_t index)
1217 {
1218 	struct cdce_softc *sc = usbd_xfer_softc(xfer);
1219 	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
1220 	struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, index);
1221 	struct mbuf *m;
1222 	uint32_t rem;
1223 	uint32_t offset;
1224 	uint32_t last_offset;
1225 	uint16_t n;
1226 	uint8_t retval;
1227 
1228 	usbd_xfer_set_frame_offset(xfer, index * CDCE_NCM_TX_MAXLEN, index);
1229 
1230 	offset = sizeof(sc->sc_ncm.hdr) +
1231 	    sizeof(sc->sc_ncm.dpt) + sizeof(sc->sc_ncm.dp);
1232 
1233 	/* Store last valid offset before alignment */
1234 	last_offset = offset;
1235 
1236 	/* Align offset */
1237 	offset = CDCE_NCM_ALIGN(sc->sc_ncm.tx_remainder,
1238 	    offset, sc->sc_ncm.tx_modulus);
1239 
1240 	/* Zero pad */
1241 	cdce_ncm_tx_zero(pc, last_offset, offset);
1242 
1243 	/* buffer full */
1244 	retval = 2;
1245 
1246 	for (n = 0; n != sc->sc_ncm.tx_nframe; n++) {
1247 
1248 		/* check if end of transmit buffer is reached */
1249 
1250 		if (offset >= sc->sc_ncm.tx_max)
1251 			break;
1252 
1253 		/* compute maximum buffer size */
1254 
1255 		rem = sc->sc_ncm.tx_max - offset;
1256 
1257 		IFQ_DRV_DEQUEUE(&(ifp->if_snd), m);
1258 
1259 		if (m == NULL) {
1260 			/* buffer not full */
1261 			retval = 1;
1262 			break;
1263 		}
1264 
1265 		if (m->m_pkthdr.len > (int)rem) {
1266 			if (n == 0) {
1267 				/* The frame won't fit in our buffer */
1268 				DPRINTFN(1, "Frame too big to be transmitted!\n");
1269 				m_freem(m);
1270 				if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1271 				n--;
1272 				continue;
1273 			}
1274 			/* Wait till next buffer becomes ready */
1275 			IFQ_DRV_PREPEND(&(ifp->if_snd), m);
1276 			break;
1277 		}
1278 		usbd_m_copy_in(pc, offset, m, 0, m->m_pkthdr.len);
1279 
1280 		USETW(sc->sc_ncm.dp[n].wFrameLength, m->m_pkthdr.len);
1281 		USETW(sc->sc_ncm.dp[n].wFrameIndex, offset);
1282 
1283 		/* Update offset */
1284 		offset += m->m_pkthdr.len;
1285 
1286 		/* Store last valid offset before alignment */
1287 		last_offset = offset;
1288 
1289 		/* Align offset */
1290 		offset = CDCE_NCM_ALIGN(sc->sc_ncm.tx_remainder,
1291 		    offset, sc->sc_ncm.tx_modulus);
1292 
1293 		/* Zero pad */
1294 		cdce_ncm_tx_zero(pc, last_offset, offset);
1295 
1296 		/*
1297 		 * If there's a BPF listener, bounce a copy
1298 		 * of this frame to him:
1299 		 */
1300 		BPF_MTAP(ifp, m);
1301 
1302 		/* Free mbuf */
1303 
1304 		m_freem(m);
1305 
1306 		/* Pre-increment interface counter */
1307 
1308 		if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
1309 	}
1310 
1311 	if (n == 0)
1312 		return (0);
1313 
1314 	rem = (sizeof(sc->sc_ncm.dpt) + (4 * n) + 4);
1315 
1316 	USETW(sc->sc_ncm.dpt.wLength, rem);
1317 
1318 	/* zero the rest of the data pointer entries */
1319 	for (; n != CDCE_NCM_SUBFRAMES_MAX; n++) {
1320 		USETW(sc->sc_ncm.dp[n].wFrameLength, 0);
1321 		USETW(sc->sc_ncm.dp[n].wFrameIndex, 0);
1322 	}
1323 
1324 	offset = last_offset;
1325 
1326 	/* Align offset */
1327 	offset = CDCE_NCM_ALIGN(0, offset, CDCE_NCM_TX_MINLEN);
1328 
1329 	/* Optimise, save bandwidth and force short termination */
1330 	if (offset >= sc->sc_ncm.tx_max)
1331 		offset = sc->sc_ncm.tx_max;
1332 	else
1333 		offset ++;
1334 
1335 	/* Zero pad */
1336 	cdce_ncm_tx_zero(pc, last_offset, offset);
1337 
1338 	/* set frame length */
1339 	usbd_xfer_set_frame_len(xfer, index, offset);
1340 
1341 	/* Fill out 16-bit header */
1342 	sc->sc_ncm.hdr.dwSignature[0] = 'N';
1343 	sc->sc_ncm.hdr.dwSignature[1] = 'C';
1344 	sc->sc_ncm.hdr.dwSignature[2] = 'M';
1345 	sc->sc_ncm.hdr.dwSignature[3] = 'H';
1346 	USETW(sc->sc_ncm.hdr.wHeaderLength, sizeof(sc->sc_ncm.hdr));
1347 	USETW(sc->sc_ncm.hdr.wBlockLength, offset);
1348 	USETW(sc->sc_ncm.hdr.wSequence, sc->sc_ncm.tx_seq);
1349 	USETW(sc->sc_ncm.hdr.wDptIndex, sizeof(sc->sc_ncm.hdr));
1350 
1351 	sc->sc_ncm.tx_seq++;
1352 
1353 	/* Fill out 16-bit frame table header */
1354 	sc->sc_ncm.dpt.dwSignature[0] = 'N';
1355 	sc->sc_ncm.dpt.dwSignature[1] = 'C';
1356 	sc->sc_ncm.dpt.dwSignature[2] = 'M';
1357 	sc->sc_ncm.dpt.dwSignature[3] = '0';
1358 	USETW(sc->sc_ncm.dpt.wNextNdpIndex, 0);		/* reserved */
1359 
1360 	usbd_copy_in(pc, 0, &(sc->sc_ncm.hdr), sizeof(sc->sc_ncm.hdr));
1361 	usbd_copy_in(pc, sizeof(sc->sc_ncm.hdr), &(sc->sc_ncm.dpt),
1362 	    sizeof(sc->sc_ncm.dpt));
1363 	usbd_copy_in(pc, sizeof(sc->sc_ncm.hdr) + sizeof(sc->sc_ncm.dpt),
1364 	    &(sc->sc_ncm.dp), sizeof(sc->sc_ncm.dp));
1365 	return (retval);
1366 }
1367 
1368 static void
1369 cdce_ncm_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
1370 {
1371 	struct cdce_softc *sc = usbd_xfer_softc(xfer);
1372 	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
1373 	uint16_t x;
1374 	uint8_t temp;
1375 	int actlen;
1376 	int aframes;
1377 
1378 	switch (USB_GET_STATE(xfer)) {
1379 	case USB_ST_TRANSFERRED:
1380 
1381 		usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
1382 
1383 		DPRINTFN(10, "transfer complete: "
1384 		    "%u bytes in %u frames\n", actlen, aframes);
1385 
1386 	case USB_ST_SETUP:
1387 		for (x = 0; x != CDCE_NCM_TX_FRAMES_MAX; x++) {
1388 			temp = cdce_ncm_fill_tx_frames(xfer, x);
1389 			if (temp == 0)
1390 				break;
1391 			if (temp == 1) {
1392 				x++;
1393 				break;
1394 			}
1395 		}
1396 
1397 		if (x != 0) {
1398 #ifdef USB_DEBUG
1399 			usbd_xfer_set_interval(xfer, cdce_tx_interval);
1400 #endif
1401 			usbd_xfer_set_frames(xfer, x);
1402 			usbd_transfer_submit(xfer);
1403 		}
1404 		break;
1405 
1406 	default:			/* Error */
1407 		DPRINTFN(10, "Transfer error: %s\n",
1408 		    usbd_errstr(error));
1409 
1410 		/* update error counter */
1411 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1412 
1413 		if (error != USB_ERR_CANCELLED) {
1414 			if (usbd_get_mode(sc->sc_ue.ue_udev) == USB_MODE_HOST) {
1415 				/* try to clear stall first */
1416 				usbd_xfer_set_stall(xfer);
1417 				usbd_xfer_set_frames(xfer, 0);
1418 				usbd_transfer_submit(xfer);
1419 			}
1420 		}
1421 		break;
1422 	}
1423 }
1424 
1425 static void
1426 cdce_ncm_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
1427 {
1428 	struct cdce_softc *sc = usbd_xfer_softc(xfer);
1429 	struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, 0);
1430 	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
1431 	struct mbuf *m;
1432 	int sumdata;
1433 	int sumlen;
1434 	int actlen;
1435 	int aframes;
1436 	int temp;
1437 	int nframes;
1438 	int x;
1439 	int offset;
1440 
1441 	switch (USB_GET_STATE(xfer)) {
1442 	case USB_ST_TRANSFERRED:
1443 
1444 		usbd_xfer_status(xfer, &actlen, &sumlen, &aframes, NULL);
1445 
1446 		DPRINTFN(1, "received %u bytes in %u frames\n",
1447 		    actlen, aframes);
1448 
1449 		if (actlen < (int)(sizeof(sc->sc_ncm.hdr) +
1450 		    sizeof(sc->sc_ncm.dpt))) {
1451 			DPRINTFN(1, "frame too short\n");
1452 			goto tr_setup;
1453 		}
1454 		usbd_copy_out(pc, 0, &(sc->sc_ncm.hdr),
1455 		    sizeof(sc->sc_ncm.hdr));
1456 
1457 		if ((sc->sc_ncm.hdr.dwSignature[0] != 'N') ||
1458 		    (sc->sc_ncm.hdr.dwSignature[1] != 'C') ||
1459 		    (sc->sc_ncm.hdr.dwSignature[2] != 'M') ||
1460 		    (sc->sc_ncm.hdr.dwSignature[3] != 'H')) {
1461 			DPRINTFN(1, "invalid HDR signature: "
1462 			    "0x%02x:0x%02x:0x%02x:0x%02x\n",
1463 			    sc->sc_ncm.hdr.dwSignature[0],
1464 			    sc->sc_ncm.hdr.dwSignature[1],
1465 			    sc->sc_ncm.hdr.dwSignature[2],
1466 			    sc->sc_ncm.hdr.dwSignature[3]);
1467 			goto tr_stall;
1468 		}
1469 		temp = UGETW(sc->sc_ncm.hdr.wBlockLength);
1470 		if (temp > sumlen) {
1471 			DPRINTFN(1, "unsupported block length %u/%u\n",
1472 			    temp, sumlen);
1473 			goto tr_stall;
1474 		}
1475 		temp = UGETW(sc->sc_ncm.hdr.wDptIndex);
1476 		if ((int)(temp + sizeof(sc->sc_ncm.dpt)) > actlen) {
1477 			DPRINTFN(1, "invalid DPT index: 0x%04x\n", temp);
1478 			goto tr_stall;
1479 		}
1480 		usbd_copy_out(pc, temp, &(sc->sc_ncm.dpt),
1481 		    sizeof(sc->sc_ncm.dpt));
1482 
1483 		if ((sc->sc_ncm.dpt.dwSignature[0] != 'N') ||
1484 		    (sc->sc_ncm.dpt.dwSignature[1] != 'C') ||
1485 		    (sc->sc_ncm.dpt.dwSignature[2] != 'M') ||
1486 		    (sc->sc_ncm.dpt.dwSignature[3] != '0')) {
1487 			DPRINTFN(1, "invalid DPT signature"
1488 			    "0x%02x:0x%02x:0x%02x:0x%02x\n",
1489 			    sc->sc_ncm.dpt.dwSignature[0],
1490 			    sc->sc_ncm.dpt.dwSignature[1],
1491 			    sc->sc_ncm.dpt.dwSignature[2],
1492 			    sc->sc_ncm.dpt.dwSignature[3]);
1493 			goto tr_stall;
1494 		}
1495 		nframes = UGETW(sc->sc_ncm.dpt.wLength) / 4;
1496 
1497 		/* Subtract size of header and last zero padded entry */
1498 		if (nframes >= (2 + 1))
1499 			nframes -= (2 + 1);
1500 		else
1501 			nframes = 0;
1502 
1503 		DPRINTFN(1, "nframes = %u\n", nframes);
1504 
1505 		temp += sizeof(sc->sc_ncm.dpt);
1506 
1507 		if ((temp + (4 * nframes)) > actlen)
1508 			goto tr_stall;
1509 
1510 		if (nframes > CDCE_NCM_SUBFRAMES_MAX) {
1511 			DPRINTFN(1, "Truncating number of frames from %u to %u\n",
1512 			    nframes, CDCE_NCM_SUBFRAMES_MAX);
1513 			nframes = CDCE_NCM_SUBFRAMES_MAX;
1514 		}
1515 		usbd_copy_out(pc, temp, &(sc->sc_ncm.dp), (4 * nframes));
1516 
1517 		sumdata = 0;
1518 
1519 		for (x = 0; x != nframes; x++) {
1520 
1521 			offset = UGETW(sc->sc_ncm.dp[x].wFrameIndex);
1522 			temp = UGETW(sc->sc_ncm.dp[x].wFrameLength);
1523 
1524 			if ((offset == 0) ||
1525 			    (temp < (int)sizeof(struct ether_header)) ||
1526 			    (temp > (MCLBYTES - ETHER_ALIGN))) {
1527 				DPRINTFN(1, "NULL frame detected at %d\n", x);
1528 				m = NULL;
1529 				/* silently ignore this frame */
1530 				continue;
1531 			} else if ((offset + temp) > actlen) {
1532 				DPRINTFN(1, "invalid frame "
1533 				    "detected at %d\n", x);
1534 				m = NULL;
1535 				/* silently ignore this frame */
1536 				continue;
1537 			} else if (temp > (int)(MHLEN - ETHER_ALIGN)) {
1538 				m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1539 			} else {
1540 				m = m_gethdr(M_NOWAIT, MT_DATA);
1541 			}
1542 
1543 			DPRINTFN(16, "frame %u, offset = %u, length = %u \n",
1544 			    x, offset, temp);
1545 
1546 			/* check if we have a buffer */
1547 			if (m) {
1548 				m->m_len = m->m_pkthdr.len = temp + ETHER_ALIGN;
1549 				m_adj(m, ETHER_ALIGN);
1550 
1551 				usbd_copy_out(pc, offset, m->m_data, temp);
1552 
1553 				/* enqueue */
1554 				uether_rxmbuf(&sc->sc_ue, m, temp);
1555 
1556 				sumdata += temp;
1557 			} else {
1558 				if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1559 			}
1560 		}
1561 
1562 		DPRINTFN(1, "Efficiency: %u/%u bytes\n", sumdata, actlen);
1563 
1564 	case USB_ST_SETUP:
1565 tr_setup:
1566 		usbd_xfer_set_frame_len(xfer, 0, sc->sc_ncm.rx_max);
1567 		usbd_xfer_set_frames(xfer, 1);
1568 		usbd_transfer_submit(xfer);
1569 		uether_rxflush(&sc->sc_ue);	/* must be last */
1570 		break;
1571 
1572 	default:			/* Error */
1573 		DPRINTFN(1, "error = %s\n",
1574 		    usbd_errstr(error));
1575 
1576 		if (error != USB_ERR_CANCELLED) {
1577 tr_stall:
1578 			if (usbd_get_mode(sc->sc_ue.ue_udev) == USB_MODE_HOST) {
1579 				/* try to clear stall first */
1580 				usbd_xfer_set_stall(xfer);
1581 				usbd_xfer_set_frames(xfer, 0);
1582 				usbd_transfer_submit(xfer);
1583 			}
1584 		}
1585 		break;
1586 	}
1587 }
1588 #endif
1589