xref: /freebsd/sys/dev/usb/net/if_kue.c (revision 830940567b49bb0c08dfaed40418999e76616909)
1 /*-
2  * Copyright (c) 1997, 1998, 1999, 2000
3  *	Bill Paul <wpaul@ee.columbia.edu>.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by Bill Paul.
16  * 4. Neither the name of the author nor the names of any co-contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
30  * THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 /*
37  * Kawasaki LSI KL5KUSB101B USB to ethernet adapter driver.
38  *
39  * Written by Bill Paul <wpaul@ee.columbia.edu>
40  * Electrical Engineering Department
41  * Columbia University, New York City
42  */
43 
44 /*
45  * The KLSI USB to ethernet adapter chip contains an USB serial interface,
46  * ethernet MAC and embedded microcontroller (called the QT Engine).
47  * The chip must have firmware loaded into it before it will operate.
48  * Packets are passed between the chip and host via bulk transfers.
49  * There is an interrupt endpoint mentioned in the software spec, however
50  * it's currently unused. This device is 10Mbps half-duplex only, hence
51  * there is no media selection logic. The MAC supports a 128 entry
52  * multicast filter, though the exact size of the filter can depend
53  * on the firmware. Curiously, while the software spec describes various
54  * ethernet statistics counters, my sample adapter and firmware combination
55  * claims not to support any statistics counters at all.
56  *
57  * Note that once we load the firmware in the device, we have to be
58  * careful not to load it again: if you restart your computer but
59  * leave the adapter attached to the USB controller, it may remain
60  * powered on and retain its firmware. In this case, we don't need
61  * to load the firmware a second time.
62  *
63  * Special thanks to Rob Furr for providing an ADS Technologies
64  * adapter for development and testing. No monkeys were harmed during
65  * the development of this driver.
66  */
67 
68 #include <sys/stdint.h>
69 #include <sys/stddef.h>
70 #include <sys/param.h>
71 #include <sys/queue.h>
72 #include <sys/types.h>
73 #include <sys/systm.h>
74 #include <sys/kernel.h>
75 #include <sys/bus.h>
76 #include <sys/linker_set.h>
77 #include <sys/module.h>
78 #include <sys/lock.h>
79 #include <sys/mutex.h>
80 #include <sys/condvar.h>
81 #include <sys/sysctl.h>
82 #include <sys/sx.h>
83 #include <sys/unistd.h>
84 #include <sys/callout.h>
85 #include <sys/malloc.h>
86 #include <sys/priv.h>
87 
88 #include <dev/usb/usb.h>
89 #include <dev/usb/usbdi.h>
90 #include <dev/usb/usbdi_util.h>
91 #include "usbdevs.h"
92 
93 #define	USB_DEBUG_VAR kue_debug
94 #include <dev/usb/usb_debug.h>
95 #include <dev/usb/usb_process.h>
96 
97 #include <dev/usb/net/usb_ethernet.h>
98 #include <dev/usb/net/if_kuereg.h>
99 #include <dev/usb/net/if_kuefw.h>
100 
101 /*
102  * Various supported device vendors/products.
103  */
104 static const struct usb_device_id kue_devs[] = {
105 	{USB_VPI(USB_VENDOR_3COM, USB_PRODUCT_3COM_3C19250, 0)},
106 	{USB_VPI(USB_VENDOR_3COM, USB_PRODUCT_3COM_3C460, 0)},
107 	{USB_VPI(USB_VENDOR_ABOCOM, USB_PRODUCT_ABOCOM_URE450, 0)},
108 	{USB_VPI(USB_VENDOR_ADS, USB_PRODUCT_ADS_UBS10BT, 0)},
109 	{USB_VPI(USB_VENDOR_ADS, USB_PRODUCT_ADS_UBS10BTX, 0)},
110 	{USB_VPI(USB_VENDOR_AOX, USB_PRODUCT_AOX_USB101, 0)},
111 	{USB_VPI(USB_VENDOR_ASANTE, USB_PRODUCT_ASANTE_EA, 0)},
112 	{USB_VPI(USB_VENDOR_ATEN, USB_PRODUCT_ATEN_DSB650C, 0)},
113 	{USB_VPI(USB_VENDOR_ATEN, USB_PRODUCT_ATEN_UC10T, 0)},
114 	{USB_VPI(USB_VENDOR_COREGA, USB_PRODUCT_COREGA_ETHER_USB_T, 0)},
115 	{USB_VPI(USB_VENDOR_DLINK, USB_PRODUCT_DLINK_DSB650C, 0)},
116 	{USB_VPI(USB_VENDOR_ENTREGA, USB_PRODUCT_ENTREGA_E45, 0)},
117 	{USB_VPI(USB_VENDOR_ENTREGA, USB_PRODUCT_ENTREGA_XX1, 0)},
118 	{USB_VPI(USB_VENDOR_ENTREGA, USB_PRODUCT_ENTREGA_XX2, 0)},
119 	{USB_VPI(USB_VENDOR_IODATA, USB_PRODUCT_IODATA_USBETT, 0)},
120 	{USB_VPI(USB_VENDOR_JATON, USB_PRODUCT_JATON_EDA, 0)},
121 	{USB_VPI(USB_VENDOR_KINGSTON, USB_PRODUCT_KINGSTON_XX1, 0)},
122 	{USB_VPI(USB_VENDOR_KLSI, USB_PRODUCT_AOX_USB101, 0)},
123 	{USB_VPI(USB_VENDOR_KLSI, USB_PRODUCT_KLSI_DUH3E10BT, 0)},
124 	{USB_VPI(USB_VENDOR_KLSI, USB_PRODUCT_KLSI_DUH3E10BTN, 0)},
125 	{USB_VPI(USB_VENDOR_LINKSYS, USB_PRODUCT_LINKSYS_USB10T, 0)},
126 	{USB_VPI(USB_VENDOR_MOBILITY, USB_PRODUCT_MOBILITY_EA, 0)},
127 	{USB_VPI(USB_VENDOR_NETGEAR, USB_PRODUCT_NETGEAR_EA101, 0)},
128 	{USB_VPI(USB_VENDOR_NETGEAR, USB_PRODUCT_NETGEAR_EA101X, 0)},
129 	{USB_VPI(USB_VENDOR_PERACOM, USB_PRODUCT_PERACOM_ENET, 0)},
130 	{USB_VPI(USB_VENDOR_PERACOM, USB_PRODUCT_PERACOM_ENET2, 0)},
131 	{USB_VPI(USB_VENDOR_PERACOM, USB_PRODUCT_PERACOM_ENET3, 0)},
132 	{USB_VPI(USB_VENDOR_PORTGEAR, USB_PRODUCT_PORTGEAR_EA8, 0)},
133 	{USB_VPI(USB_VENDOR_PORTGEAR, USB_PRODUCT_PORTGEAR_EA9, 0)},
134 	{USB_VPI(USB_VENDOR_PORTSMITH, USB_PRODUCT_PORTSMITH_EEA, 0)},
135 	{USB_VPI(USB_VENDOR_SHARK, USB_PRODUCT_SHARK_PA, 0)},
136 	{USB_VPI(USB_VENDOR_SILICOM, USB_PRODUCT_SILICOM_GPE, 0)},
137 	{USB_VPI(USB_VENDOR_SILICOM, USB_PRODUCT_SILICOM_U2E, 0)},
138 	{USB_VPI(USB_VENDOR_SMC, USB_PRODUCT_SMC_2102USB, 0)},
139 };
140 
141 /* prototypes */
142 
143 static device_probe_t kue_probe;
144 static device_attach_t kue_attach;
145 static device_detach_t kue_detach;
146 
147 static usb_callback_t kue_bulk_read_callback;
148 static usb_callback_t kue_bulk_write_callback;
149 
150 static uether_fn_t kue_attach_post;
151 static uether_fn_t kue_init;
152 static uether_fn_t kue_stop;
153 static uether_fn_t kue_start;
154 static uether_fn_t kue_setmulti;
155 static uether_fn_t kue_setpromisc;
156 
157 static int	kue_do_request(struct kue_softc *,
158 		    struct usb_device_request *, void *);
159 static int	kue_setword(struct kue_softc *, uint8_t, uint16_t);
160 static int	kue_ctl(struct kue_softc *, uint8_t, uint8_t, uint16_t,
161 		    void *, int);
162 static int	kue_load_fw(struct kue_softc *);
163 static void	kue_reset(struct kue_softc *);
164 
165 #if USB_DEBUG
166 static int kue_debug = 0;
167 
168 SYSCTL_NODE(_hw_usb, OID_AUTO, kue, CTLFLAG_RW, 0, "USB kue");
169 SYSCTL_INT(_hw_usb_kue, OID_AUTO, debug, CTLFLAG_RW, &kue_debug, 0,
170     "Debug level");
171 #endif
172 
173 static const struct usb_config kue_config[KUE_N_TRANSFER] = {
174 
175 	[KUE_BULK_DT_WR] = {
176 		.type = UE_BULK,
177 		.endpoint = UE_ADDR_ANY,
178 		.direction = UE_DIR_OUT,
179 		.bufsize = (MCLBYTES + 2 + 64),
180 		.flags = {.pipe_bof = 1,},
181 		.callback = kue_bulk_write_callback,
182 		.timeout = 10000,	/* 10 seconds */
183 	},
184 
185 	[KUE_BULK_DT_RD] = {
186 		.type = UE_BULK,
187 		.endpoint = UE_ADDR_ANY,
188 		.direction = UE_DIR_IN,
189 		.bufsize = (MCLBYTES + 2),
190 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
191 		.callback = kue_bulk_read_callback,
192 		.timeout = 0,	/* no timeout */
193 	},
194 };
195 
196 static device_method_t kue_methods[] = {
197 	/* Device interface */
198 	DEVMETHOD(device_probe, kue_probe),
199 	DEVMETHOD(device_attach, kue_attach),
200 	DEVMETHOD(device_detach, kue_detach),
201 
202 	{0, 0}
203 };
204 
205 static driver_t kue_driver = {
206 	.name = "kue",
207 	.methods = kue_methods,
208 	.size = sizeof(struct kue_softc),
209 };
210 
211 static devclass_t kue_devclass;
212 
213 DRIVER_MODULE(kue, uhub, kue_driver, kue_devclass, NULL, 0);
214 MODULE_DEPEND(kue, uether, 1, 1, 1);
215 MODULE_DEPEND(kue, usb, 1, 1, 1);
216 MODULE_DEPEND(kue, ether, 1, 1, 1);
217 
218 static const struct usb_ether_methods kue_ue_methods = {
219 	.ue_attach_post = kue_attach_post,
220 	.ue_start = kue_start,
221 	.ue_init = kue_init,
222 	.ue_stop = kue_stop,
223 	.ue_setmulti = kue_setmulti,
224 	.ue_setpromisc = kue_setpromisc,
225 };
226 
227 /*
228  * We have a custom do_request function which is almost like the
229  * regular do_request function, except it has a much longer timeout.
230  * Why? Because we need to make requests over the control endpoint
231  * to download the firmware to the device, which can take longer
232  * than the default timeout.
233  */
234 static int
235 kue_do_request(struct kue_softc *sc, struct usb_device_request *req,
236     void *data)
237 {
238 	usb_error_t err;
239 
240 	err = uether_do_request(&sc->sc_ue, req, data, 60000);
241 
242 	return (err);
243 }
244 
245 static int
246 kue_setword(struct kue_softc *sc, uint8_t breq, uint16_t word)
247 {
248 	struct usb_device_request req;
249 
250 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
251 	req.bRequest = breq;
252 	USETW(req.wValue, word);
253 	USETW(req.wIndex, 0);
254 	USETW(req.wLength, 0);
255 
256 	return (kue_do_request(sc, &req, NULL));
257 }
258 
259 static int
260 kue_ctl(struct kue_softc *sc, uint8_t rw, uint8_t breq,
261     uint16_t val, void *data, int len)
262 {
263 	struct usb_device_request req;
264 
265 	if (rw == KUE_CTL_WRITE)
266 		req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
267 	else
268 		req.bmRequestType = UT_READ_VENDOR_DEVICE;
269 
270 
271 	req.bRequest = breq;
272 	USETW(req.wValue, val);
273 	USETW(req.wIndex, 0);
274 	USETW(req.wLength, len);
275 
276 	return (kue_do_request(sc, &req, data));
277 }
278 
279 static int
280 kue_load_fw(struct kue_softc *sc)
281 {
282 	struct usb_device_descriptor *dd;
283 	uint16_t hwrev;
284 	usb_error_t err;
285 
286 	dd = usbd_get_device_descriptor(sc->sc_ue.ue_udev);
287 	hwrev = UGETW(dd->bcdDevice);
288 
289 	/*
290 	 * First, check if we even need to load the firmware.
291 	 * If the device was still attached when the system was
292 	 * rebooted, it may already have firmware loaded in it.
293 	 * If this is the case, we don't need to do it again.
294 	 * And in fact, if we try to load it again, we'll hang,
295 	 * so we have to avoid this condition if we don't want
296 	 * to look stupid.
297 	 *
298 	 * We can test this quickly by checking the bcdRevision
299 	 * code. The NIC will return a different revision code if
300 	 * it's probed while the firmware is still loaded and
301 	 * running.
302 	 */
303 	if (hwrev == 0x0202)
304 		return(0);
305 
306 	/* Load code segment */
307 	err = kue_ctl(sc, KUE_CTL_WRITE, KUE_CMD_SEND_SCAN,
308 	    0, kue_code_seg, sizeof(kue_code_seg));
309 	if (err) {
310 		device_printf(sc->sc_ue.ue_dev, "failed to load code segment: %s\n",
311 		    usbd_errstr(err));
312 		return(ENXIO);
313 	}
314 
315 	/* Load fixup segment */
316 	err = kue_ctl(sc, KUE_CTL_WRITE, KUE_CMD_SEND_SCAN,
317 	    0, kue_fix_seg, sizeof(kue_fix_seg));
318 	if (err) {
319 		device_printf(sc->sc_ue.ue_dev, "failed to load fixup segment: %s\n",
320 		    usbd_errstr(err));
321 		return(ENXIO);
322 	}
323 
324 	/* Send trigger command. */
325 	err = kue_ctl(sc, KUE_CTL_WRITE, KUE_CMD_SEND_SCAN,
326 	    0, kue_trig_seg, sizeof(kue_trig_seg));
327 	if (err) {
328 		device_printf(sc->sc_ue.ue_dev, "failed to load trigger segment: %s\n",
329 		    usbd_errstr(err));
330 		return(ENXIO);
331 	}
332 
333 	return (0);
334 }
335 
336 static void
337 kue_setpromisc(struct usb_ether *ue)
338 {
339 	struct kue_softc *sc = uether_getsc(ue);
340 	struct ifnet *ifp = uether_getifp(ue);
341 
342 	KUE_LOCK_ASSERT(sc, MA_OWNED);
343 
344 	if (ifp->if_flags & IFF_PROMISC)
345 		sc->sc_rxfilt |= KUE_RXFILT_PROMISC;
346 	else
347 		sc->sc_rxfilt &= ~KUE_RXFILT_PROMISC;
348 
349 	kue_setword(sc, KUE_CMD_SET_PKT_FILTER, sc->sc_rxfilt);
350 }
351 
352 static void
353 kue_setmulti(struct usb_ether *ue)
354 {
355 	struct kue_softc *sc = uether_getsc(ue);
356 	struct ifnet *ifp = uether_getifp(ue);
357 	struct ifmultiaddr *ifma;
358 	int i = 0;
359 
360 	KUE_LOCK_ASSERT(sc, MA_OWNED);
361 
362 	if (ifp->if_flags & IFF_ALLMULTI || ifp->if_flags & IFF_PROMISC) {
363 		sc->sc_rxfilt |= KUE_RXFILT_ALLMULTI;
364 		sc->sc_rxfilt &= ~KUE_RXFILT_MULTICAST;
365 		kue_setword(sc, KUE_CMD_SET_PKT_FILTER, sc->sc_rxfilt);
366 		return;
367 	}
368 
369 	sc->sc_rxfilt &= ~KUE_RXFILT_ALLMULTI;
370 
371 	if_maddr_rlock(ifp);
372 	TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link)
373 	{
374 		if (ifma->ifma_addr->sa_family != AF_LINK)
375 			continue;
376 		/*
377 		 * If there are too many addresses for the
378 		 * internal filter, switch over to allmulti mode.
379 		 */
380 		if (i == KUE_MCFILTCNT(sc))
381 			break;
382 		bcopy(LLADDR((struct sockaddr_dl *)ifma->ifma_addr),
383 		    KUE_MCFILT(sc, i), ETHER_ADDR_LEN);
384 		i++;
385 	}
386 	if_maddr_runlock(ifp);
387 
388 	if (i == KUE_MCFILTCNT(sc))
389 		sc->sc_rxfilt |= KUE_RXFILT_ALLMULTI;
390 	else {
391 		sc->sc_rxfilt |= KUE_RXFILT_MULTICAST;
392 		kue_ctl(sc, KUE_CTL_WRITE, KUE_CMD_SET_MCAST_FILTERS,
393 		    i, sc->sc_mcfilters, i * ETHER_ADDR_LEN);
394 	}
395 
396 	kue_setword(sc, KUE_CMD_SET_PKT_FILTER, sc->sc_rxfilt);
397 }
398 
399 /*
400  * Issue a SET_CONFIGURATION command to reset the MAC. This should be
401  * done after the firmware is loaded into the adapter in order to
402  * bring it into proper operation.
403  */
404 static void
405 kue_reset(struct kue_softc *sc)
406 {
407 	struct usb_config_descriptor *cd;
408 	usb_error_t err;
409 
410 	cd = usbd_get_config_descriptor(sc->sc_ue.ue_udev);
411 
412 	err = usbd_req_set_config(sc->sc_ue.ue_udev, &sc->sc_mtx,
413 	    cd->bConfigurationValue);
414 	if (err)
415 		DPRINTF("reset failed (ignored)\n");
416 
417 	/* wait a little while for the chip to get its brains in order */
418 	uether_pause(&sc->sc_ue, hz / 100);
419 }
420 
421 static void
422 kue_attach_post(struct usb_ether *ue)
423 {
424 	struct kue_softc *sc = uether_getsc(ue);
425 	int error;
426 
427 	/* load the firmware into the NIC */
428 	error = kue_load_fw(sc);
429 	if (error) {
430 		device_printf(sc->sc_ue.ue_dev, "could not load firmware\n");
431 		/* ignore the error */
432 	}
433 
434 	/* reset the adapter */
435 	kue_reset(sc);
436 
437 	/* read ethernet descriptor */
438 	kue_ctl(sc, KUE_CTL_READ, KUE_CMD_GET_ETHER_DESCRIPTOR,
439 	    0, &sc->sc_desc, sizeof(sc->sc_desc));
440 
441 	/* copy in ethernet address */
442 	memcpy(ue->ue_eaddr, sc->sc_desc.kue_macaddr, sizeof(ue->ue_eaddr));
443 }
444 
445 /*
446  * Probe for a KLSI chip.
447  */
448 static int
449 kue_probe(device_t dev)
450 {
451 	struct usb_attach_arg *uaa = device_get_ivars(dev);
452 
453 	if (uaa->usb_mode != USB_MODE_HOST)
454 		return (ENXIO);
455 	if (uaa->info.bConfigIndex != KUE_CONFIG_IDX)
456 		return (ENXIO);
457 	if (uaa->info.bIfaceIndex != KUE_IFACE_IDX)
458 		return (ENXIO);
459 
460 	return (usbd_lookup_id_by_uaa(kue_devs, sizeof(kue_devs), uaa));
461 }
462 
463 /*
464  * Attach the interface. Allocate softc structures, do
465  * setup and ethernet/BPF attach.
466  */
467 static int
468 kue_attach(device_t dev)
469 {
470 	struct usb_attach_arg *uaa = device_get_ivars(dev);
471 	struct kue_softc *sc = device_get_softc(dev);
472 	struct usb_ether *ue = &sc->sc_ue;
473 	uint8_t iface_index;
474 	int error;
475 
476 	device_set_usb_desc(dev);
477 	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF);
478 
479 	iface_index = KUE_IFACE_IDX;
480 	error = usbd_transfer_setup(uaa->device, &iface_index,
481 	    sc->sc_xfer, kue_config, KUE_N_TRANSFER, sc, &sc->sc_mtx);
482 	if (error) {
483 		device_printf(dev, "allocating USB transfers failed!\n");
484 		goto detach;
485 	}
486 
487 	sc->sc_mcfilters = malloc(KUE_MCFILTCNT(sc) * ETHER_ADDR_LEN,
488 	    M_USBDEV, M_WAITOK);
489 	if (sc->sc_mcfilters == NULL) {
490 		device_printf(dev, "failed allocating USB memory!\n");
491 		goto detach;
492 	}
493 
494 	ue->ue_sc = sc;
495 	ue->ue_dev = dev;
496 	ue->ue_udev = uaa->device;
497 	ue->ue_mtx = &sc->sc_mtx;
498 	ue->ue_methods = &kue_ue_methods;
499 
500 	error = uether_ifattach(ue);
501 	if (error) {
502 		device_printf(dev, "could not attach interface\n");
503 		goto detach;
504 	}
505 	return (0);			/* success */
506 
507 detach:
508 	kue_detach(dev);
509 	return (ENXIO);			/* failure */
510 }
511 
512 static int
513 kue_detach(device_t dev)
514 {
515 	struct kue_softc *sc = device_get_softc(dev);
516 	struct usb_ether *ue = &sc->sc_ue;
517 
518 	usbd_transfer_unsetup(sc->sc_xfer, KUE_N_TRANSFER);
519 	uether_ifdetach(ue);
520 	mtx_destroy(&sc->sc_mtx);
521 	free(sc->sc_mcfilters, M_USBDEV);
522 
523 	return (0);
524 }
525 
526 /*
527  * A frame has been uploaded: pass the resulting mbuf chain up to
528  * the higher level protocols.
529  */
530 static void
531 kue_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
532 {
533 	struct kue_softc *sc = usbd_xfer_softc(xfer);
534 	struct usb_ether *ue = &sc->sc_ue;
535 	struct ifnet *ifp = uether_getifp(ue);
536 	struct usb_page_cache *pc;
537 	uint8_t buf[2];
538 	int len;
539 	int actlen;
540 
541 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
542 
543 	switch (USB_GET_STATE(xfer)) {
544 	case USB_ST_TRANSFERRED:
545 
546 		if (actlen <= (2 + sizeof(struct ether_header))) {
547 			ifp->if_ierrors++;
548 			goto tr_setup;
549 		}
550 		pc = usbd_xfer_get_frame(xfer, 0);
551 		usbd_copy_out(pc, 0, buf, 2);
552 		actlen -= 2;
553 		len = buf[0] | (buf[1] << 8);
554 		len = min(actlen, len);
555 
556 		uether_rxbuf(ue, pc, 2, len);
557 		/* FALLTHROUGH */
558 	case USB_ST_SETUP:
559 tr_setup:
560 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
561 		usbd_transfer_submit(xfer);
562 		uether_rxflush(ue);
563 		return;
564 
565 	default:			/* Error */
566 		DPRINTF("bulk read error, %s\n",
567 		    usbd_errstr(error));
568 
569 		if (error != USB_ERR_CANCELLED) {
570 			/* try to clear stall first */
571 			usbd_xfer_set_stall(xfer);
572 			goto tr_setup;
573 		}
574 		return;
575 
576 	}
577 }
578 
579 static void
580 kue_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
581 {
582 	struct kue_softc *sc = usbd_xfer_softc(xfer);
583 	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
584 	struct usb_page_cache *pc;
585 	struct mbuf *m;
586 	int total_len;
587 	int temp_len;
588 	uint8_t buf[2];
589 
590 	switch (USB_GET_STATE(xfer)) {
591 	case USB_ST_TRANSFERRED:
592 		DPRINTFN(11, "transfer complete\n");
593 		ifp->if_opackets++;
594 
595 		/* FALLTHROUGH */
596 	case USB_ST_SETUP:
597 tr_setup:
598 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
599 
600 		if (m == NULL)
601 			return;
602 		if (m->m_pkthdr.len > MCLBYTES)
603 			m->m_pkthdr.len = MCLBYTES;
604 		temp_len = (m->m_pkthdr.len + 2);
605 		total_len = (temp_len + (64 - (temp_len % 64)));
606 
607 		/* the first two bytes are the frame length */
608 
609 		buf[0] = (uint8_t)(m->m_pkthdr.len);
610 		buf[1] = (uint8_t)(m->m_pkthdr.len >> 8);
611 
612 		pc = usbd_xfer_get_frame(xfer, 0);
613 		usbd_copy_in(pc, 0, buf, 2);
614 		usbd_m_copy_in(pc, 2, m, 0, m->m_pkthdr.len);
615 
616 		usbd_frame_zero(pc, temp_len, total_len - temp_len);
617 		usbd_xfer_set_frame_len(xfer, 0, total_len);
618 
619 		/*
620 		 * if there's a BPF listener, bounce a copy
621 		 * of this frame to him:
622 		 */
623 		BPF_MTAP(ifp, m);
624 
625 		m_freem(m);
626 
627 		usbd_transfer_submit(xfer);
628 
629 		return;
630 
631 	default:			/* Error */
632 		DPRINTFN(11, "transfer error, %s\n",
633 		    usbd_errstr(error));
634 
635 		ifp->if_oerrors++;
636 
637 		if (error != USB_ERR_CANCELLED) {
638 			/* try to clear stall first */
639 			usbd_xfer_set_stall(xfer);
640 			goto tr_setup;
641 		}
642 		return;
643 
644 	}
645 }
646 
647 static void
648 kue_start(struct usb_ether *ue)
649 {
650 	struct kue_softc *sc = uether_getsc(ue);
651 
652 	/*
653 	 * start the USB transfers, if not already started:
654 	 */
655 	usbd_transfer_start(sc->sc_xfer[KUE_BULK_DT_RD]);
656 	usbd_transfer_start(sc->sc_xfer[KUE_BULK_DT_WR]);
657 }
658 
659 static void
660 kue_init(struct usb_ether *ue)
661 {
662 	struct kue_softc *sc = uether_getsc(ue);
663 	struct ifnet *ifp = uether_getifp(ue);
664 
665 	KUE_LOCK_ASSERT(sc, MA_OWNED);
666 
667 	/* set MAC address */
668 	kue_ctl(sc, KUE_CTL_WRITE, KUE_CMD_SET_MAC,
669 	    0, IF_LLADDR(ifp), ETHER_ADDR_LEN);
670 
671 	/* I'm not sure how to tune these. */
672 #if 0
673 	/*
674 	 * Leave this one alone for now; setting it
675 	 * wrong causes lockups on some machines/controllers.
676 	 */
677 	kue_setword(sc, KUE_CMD_SET_SOFS, 1);
678 #endif
679 	kue_setword(sc, KUE_CMD_SET_URB_SIZE, 64);
680 
681 	/* load the multicast filter */
682 	kue_setpromisc(ue);
683 
684 	usbd_xfer_set_stall(sc->sc_xfer[KUE_BULK_DT_WR]);
685 
686 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
687 	kue_start(ue);
688 }
689 
690 static void
691 kue_stop(struct usb_ether *ue)
692 {
693 	struct kue_softc *sc = uether_getsc(ue);
694 	struct ifnet *ifp = uether_getifp(ue);
695 
696 	KUE_LOCK_ASSERT(sc, MA_OWNED);
697 
698 	ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
699 
700 	/*
701 	 * stop all the transfers, if not already stopped:
702 	 */
703 	usbd_transfer_stop(sc->sc_xfer[KUE_BULK_DT_WR]);
704 	usbd_transfer_stop(sc->sc_xfer[KUE_BULK_DT_RD]);
705 }
706