xref: /freebsd/sys/dev/usb/net/if_usie.c (revision 298cf604ccf133b101c6fad42d1a078a1fac58ca)
1 /*-
2  * Copyright (c) 2011 Anybots Inc
3  * written by Akinori Furukoshi <moonlightakkiy@yahoo.ca>
4  *  - ucom part is based on u3g.c
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  */
27 
28 #include <sys/cdefs.h>
29 __FBSDID("$FreeBSD$");
30 
31 #include <sys/param.h>
32 #include <sys/systm.h>
33 #include <sys/queue.h>
34 #include <sys/systm.h>
35 #include <sys/kernel.h>
36 #include <sys/bus.h>
37 #include <sys/module.h>
38 #include <sys/sockio.h>
39 #include <sys/socket.h>
40 #include <sys/lock.h>
41 #include <sys/mutex.h>
42 #include <sys/condvar.h>
43 #include <sys/sysctl.h>
44 #include <sys/malloc.h>
45 #include <sys/taskqueue.h>
46 
47 #include <machine/bus.h>
48 
49 #include <net/if.h>
50 #include <net/if_types.h>
51 #include <net/netisr.h>
52 #include <net/bpf.h>
53 #include <net/ethernet.h>
54 
55 #include <netinet/in.h>
56 #include <netinet/ip.h>
57 #include <netinet/ip6.h>
58 #include <netinet/udp.h>
59 
60 #include <net80211/ieee80211_ioctl.h>
61 
62 #include <dev/usb/usb.h>
63 #include <dev/usb/usbdi.h>
64 #include <dev/usb/usbdi_util.h>
65 #include <dev/usb/usb_cdc.h>
66 #include "usbdevs.h"
67 
68 #define	USB_DEBUG_VAR usie_debug
69 #include <dev/usb/usb_debug.h>
70 #include <dev/usb/usb_process.h>
71 #include <dev/usb/usb_msctest.h>
72 
73 #include <dev/usb/serial/usb_serial.h>
74 
75 #include <dev/usb/net/if_usievar.h>
76 
77 #ifdef	USB_DEBUG
78 static int usie_debug = 0;
79 
80 static SYSCTL_NODE(_hw_usb, OID_AUTO, usie, CTLFLAG_RW, 0, "sierra USB modem");
81 SYSCTL_INT(_hw_usb_usie, OID_AUTO, debug, CTLFLAG_RW, &usie_debug, 0,
82     "usie debug level");
83 #endif
84 
85 /* Sierra Wireless Direct IP modems */
86 static const STRUCT_USB_HOST_ID usie_devs[] = {
87 #define	USIE_DEV(v, d) {				\
88     USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##d) }
89 	USIE_DEV(SIERRA, MC8700),
90 	USIE_DEV(SIERRA, TRUINSTALL),
91 	USIE_DEV(AIRPRIME, USB308),
92 #undef	USIE_DEV
93 };
94 
95 static device_probe_t usie_probe;
96 static device_attach_t usie_attach;
97 static device_detach_t usie_detach;
98 static void usie_free_softc(struct usie_softc *);
99 
100 static void usie_free(struct ucom_softc *);
101 static void usie_uc_update_line_state(struct ucom_softc *, uint8_t);
102 static void usie_uc_cfg_get_status(struct ucom_softc *, uint8_t *, uint8_t *);
103 static void usie_uc_cfg_set_dtr(struct ucom_softc *, uint8_t);
104 static void usie_uc_cfg_set_rts(struct ucom_softc *, uint8_t);
105 static void usie_uc_cfg_open(struct ucom_softc *);
106 static void usie_uc_cfg_close(struct ucom_softc *);
107 static void usie_uc_start_read(struct ucom_softc *);
108 static void usie_uc_stop_read(struct ucom_softc *);
109 static void usie_uc_start_write(struct ucom_softc *);
110 static void usie_uc_stop_write(struct ucom_softc *);
111 
112 static usb_callback_t usie_uc_tx_callback;
113 static usb_callback_t usie_uc_rx_callback;
114 static usb_callback_t usie_uc_status_callback;
115 static usb_callback_t usie_if_tx_callback;
116 static usb_callback_t usie_if_rx_callback;
117 static usb_callback_t usie_if_status_callback;
118 
119 static void usie_if_sync_to(void *);
120 static void usie_if_sync_cb(void *, int);
121 static void usie_if_status_cb(void *, int);
122 
123 static void usie_if_start(struct ifnet *);
124 static int usie_if_output(struct ifnet *, struct mbuf *, struct sockaddr *, struct route *);
125 static void usie_if_init(void *);
126 static void usie_if_stop(struct usie_softc *);
127 static int usie_if_ioctl(struct ifnet *, u_long, caddr_t);
128 
129 static int usie_do_request(struct usie_softc *, struct usb_device_request *, void *);
130 static int usie_if_cmd(struct usie_softc *, uint8_t);
131 static void usie_cns_req(struct usie_softc *, uint32_t, uint16_t);
132 static void usie_cns_rsp(struct usie_softc *, struct usie_cns *);
133 static void usie_hip_rsp(struct usie_softc *, uint8_t *, uint32_t);
134 static int usie_driver_loaded(struct module *, int, void *);
135 
136 static const struct usb_config usie_uc_config[USIE_UC_N_XFER] = {
137 	[USIE_UC_STATUS] = {
138 		.type = UE_INTERRUPT,
139 		.endpoint = UE_ADDR_ANY,
140 		.direction = UE_DIR_IN,
141 		.bufsize = 0,		/* use wMaxPacketSize */
142 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
143 		.callback = &usie_uc_status_callback,
144 	},
145 	[USIE_UC_RX] = {
146 		.type = UE_BULK,
147 		.endpoint = UE_ADDR_ANY,
148 		.direction = UE_DIR_IN,
149 		.bufsize = USIE_BUFSIZE,
150 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,.proxy_buffer = 1,},
151 		.callback = &usie_uc_rx_callback,
152 	},
153 	[USIE_UC_TX] = {
154 		.type = UE_BULK,
155 		.endpoint = UE_ADDR_ANY,
156 		.direction = UE_DIR_OUT,
157 		.bufsize = USIE_BUFSIZE,
158 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
159 		.callback = &usie_uc_tx_callback,
160 	}
161 };
162 
163 static const struct usb_config usie_if_config[USIE_IF_N_XFER] = {
164 	[USIE_IF_STATUS] = {
165 		.type = UE_INTERRUPT,
166 		.endpoint = UE_ADDR_ANY,
167 		.direction = UE_DIR_IN,
168 		.bufsize = 0,		/* use wMaxPacketSize */
169 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
170 		.callback = &usie_if_status_callback,
171 	},
172 	[USIE_IF_RX] = {
173 		.type = UE_BULK,
174 		.endpoint = UE_ADDR_ANY,
175 		.direction = UE_DIR_IN,
176 		.bufsize = USIE_BUFSIZE,
177 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
178 		.callback = &usie_if_rx_callback,
179 	},
180 	[USIE_IF_TX] = {
181 		.type = UE_BULK,
182 		.endpoint = UE_ADDR_ANY,
183 		.direction = UE_DIR_OUT,
184 		.bufsize = MAX(USIE_BUFSIZE, MCLBYTES),
185 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
186 		.callback = &usie_if_tx_callback,
187 	}
188 };
189 
190 static device_method_t usie_methods[] = {
191 	DEVMETHOD(device_probe, usie_probe),
192 	DEVMETHOD(device_attach, usie_attach),
193 	DEVMETHOD(device_detach, usie_detach),
194 	DEVMETHOD_END
195 };
196 
197 static driver_t usie_driver = {
198 	.name = "usie",
199 	.methods = usie_methods,
200 	.size = sizeof(struct usie_softc),
201 };
202 
203 static devclass_t usie_devclass;
204 static eventhandler_tag usie_etag;
205 
206 DRIVER_MODULE(usie, uhub, usie_driver, usie_devclass, usie_driver_loaded, 0);
207 MODULE_DEPEND(usie, ucom, 1, 1, 1);
208 MODULE_DEPEND(usie, usb, 1, 1, 1);
209 MODULE_VERSION(usie, 1);
210 
211 static const struct ucom_callback usie_uc_callback = {
212 	.ucom_cfg_get_status = &usie_uc_cfg_get_status,
213 	.ucom_cfg_set_dtr = &usie_uc_cfg_set_dtr,
214 	.ucom_cfg_set_rts = &usie_uc_cfg_set_rts,
215 	.ucom_cfg_open = &usie_uc_cfg_open,
216 	.ucom_cfg_close = &usie_uc_cfg_close,
217 	.ucom_start_read = &usie_uc_start_read,
218 	.ucom_stop_read = &usie_uc_stop_read,
219 	.ucom_start_write = &usie_uc_start_write,
220 	.ucom_stop_write = &usie_uc_stop_write,
221 	.ucom_free = &usie_free,
222 };
223 
224 static void
225 usie_autoinst(void *arg, struct usb_device *udev,
226     struct usb_attach_arg *uaa)
227 {
228 	struct usb_interface *iface;
229 	struct usb_interface_descriptor *id;
230 	struct usb_device_request req;
231 	int err;
232 
233 	if (uaa->dev_state != UAA_DEV_READY)
234 		return;
235 
236 	iface = usbd_get_iface(udev, 0);
237 	if (iface == NULL)
238 		return;
239 
240 	id = iface->idesc;
241 	if (id == NULL || id->bInterfaceClass != UICLASS_MASS)
242 		return;
243 
244 	if (usbd_lookup_id_by_uaa(usie_devs, sizeof(usie_devs), uaa) != 0)
245 		return;			/* no device match */
246 
247 	if (bootverbose) {
248 		DPRINTF("Ejecting %s %s\n",
249 		    usb_get_manufacturer(udev),
250 		    usb_get_product(udev));
251 	}
252 	req.bmRequestType = UT_VENDOR;
253 	req.bRequest = UR_SET_INTERFACE;
254 	USETW(req.wValue, UF_DEVICE_REMOTE_WAKEUP);
255 	USETW(req.wIndex, UHF_PORT_CONNECTION);
256 	USETW(req.wLength, 0);
257 
258 	/* at this moment there is no mutex */
259 	err = usbd_do_request_flags(udev, NULL, &req,
260 	    NULL, 0, NULL, 250 /* ms */ );
261 
262 	/* success, mark the udev as disappearing */
263 	if (err == 0)
264 		uaa->dev_state = UAA_DEV_EJECTING;
265 }
266 
267 static int
268 usie_probe(device_t self)
269 {
270 	struct usb_attach_arg *uaa = device_get_ivars(self);
271 
272 	if (uaa->usb_mode != USB_MODE_HOST)
273 		return (ENXIO);
274 	if (uaa->info.bConfigIndex != USIE_CNFG_INDEX)
275 		return (ENXIO);
276 	if (uaa->info.bIfaceIndex != USIE_IFACE_INDEX)
277 		return (ENXIO);
278 	if (uaa->info.bInterfaceClass != UICLASS_VENDOR)
279 		return (ENXIO);
280 
281 	return (usbd_lookup_id_by_uaa(usie_devs, sizeof(usie_devs), uaa));
282 }
283 
284 static int
285 usie_attach(device_t self)
286 {
287 	struct usie_softc *sc = device_get_softc(self);
288 	struct usb_attach_arg *uaa = device_get_ivars(self);
289 	struct ifnet *ifp;
290 	struct usb_interface *iface;
291 	struct usb_interface_descriptor *id;
292 	struct usb_device_request req;
293 	int err;
294 	uint16_t fwattr;
295 	uint8_t iface_index;
296 	uint8_t ifidx;
297 	uint8_t start;
298 
299 	device_set_usb_desc(self);
300 	sc->sc_udev = uaa->device;
301 	sc->sc_dev = self;
302 
303 	mtx_init(&sc->sc_mtx, "usie", MTX_NETWORK_LOCK, MTX_DEF);
304 	ucom_ref(&sc->sc_super_ucom);
305 
306 	TASK_INIT(&sc->sc_if_status_task, 0, usie_if_status_cb, sc);
307 	TASK_INIT(&sc->sc_if_sync_task, 0, usie_if_sync_cb, sc);
308 
309 	usb_callout_init_mtx(&sc->sc_if_sync_ch, &sc->sc_mtx, 0);
310 
311 	mtx_lock(&sc->sc_mtx);
312 
313 	/* set power mode to D0 */
314 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
315 	req.bRequest = USIE_POWER;
316 	USETW(req.wValue, 0);
317 	USETW(req.wIndex, 0);
318 	USETW(req.wLength, 0);
319 	if (usie_do_request(sc, &req, NULL)) {
320 		mtx_unlock(&sc->sc_mtx);
321 		goto detach;
322 	}
323 	/* read fw attr */
324 	fwattr = 0;
325 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
326 	req.bRequest = USIE_FW_ATTR;
327 	USETW(req.wValue, 0);
328 	USETW(req.wIndex, 0);
329 	USETW(req.wLength, sizeof(fwattr));
330 	if (usie_do_request(sc, &req, &fwattr)) {
331 		mtx_unlock(&sc->sc_mtx);
332 		goto detach;
333 	}
334 	mtx_unlock(&sc->sc_mtx);
335 
336 	/* check DHCP supports */
337 	DPRINTF("fwattr=%x\n", fwattr);
338 	if (!(fwattr & USIE_FW_DHCP)) {
339 		device_printf(self, "DHCP is not supported. A firmware upgrade might be needed.\n");
340 	}
341 
342 	/* find available interfaces */
343 	sc->sc_nucom = 0;
344 	for (ifidx = 0; ifidx < USIE_IFACE_MAX; ifidx++) {
345 		iface = usbd_get_iface(uaa->device, ifidx);
346 		if (iface == NULL)
347 			break;
348 
349 		id = usbd_get_interface_descriptor(iface);
350 		if ((id == NULL) || (id->bInterfaceClass != UICLASS_VENDOR))
351 			continue;
352 
353 		/* setup Direct IP transfer */
354 		if (id->bInterfaceNumber >= 7 && id->bNumEndpoints == 3) {
355 			sc->sc_if_ifnum = id->bInterfaceNumber;
356 			iface_index = ifidx;
357 
358 			DPRINTF("ifnum=%d, ifidx=%d\n",
359 			    sc->sc_if_ifnum, ifidx);
360 
361 			err = usbd_transfer_setup(uaa->device,
362 			    &iface_index, sc->sc_if_xfer, usie_if_config,
363 			    USIE_IF_N_XFER, sc, &sc->sc_mtx);
364 
365 			if (err == 0)
366 				continue;
367 
368 			device_printf(self,
369 			    "could not allocate USB transfers on "
370 			    "iface_index=%d, err=%s\n",
371 			    iface_index, usbd_errstr(err));
372 			goto detach;
373 		}
374 
375 		/* setup ucom */
376 		if (sc->sc_nucom >= USIE_UCOM_MAX)
377 			continue;
378 
379 		usbd_set_parent_iface(uaa->device, ifidx,
380 		    uaa->info.bIfaceIndex);
381 
382 		DPRINTF("NumEndpoints=%d bInterfaceNumber=%d\n",
383 		    id->bNumEndpoints, id->bInterfaceNumber);
384 
385 		if (id->bNumEndpoints == 2) {
386 			sc->sc_uc_xfer[sc->sc_nucom][0] = NULL;
387 			start = 1;
388 		} else
389 			start = 0;
390 
391 		err = usbd_transfer_setup(uaa->device, &ifidx,
392 		    sc->sc_uc_xfer[sc->sc_nucom] + start,
393 		    usie_uc_config + start, USIE_UC_N_XFER - start,
394 		    &sc->sc_ucom[sc->sc_nucom], &sc->sc_mtx);
395 
396 		if (err != 0) {
397 			DPRINTF("usbd_transfer_setup error=%s\n", usbd_errstr(err));
398 			continue;
399 		}
400 
401 		mtx_lock(&sc->sc_mtx);
402 		for (; start < USIE_UC_N_XFER; start++)
403 			usbd_xfer_set_stall(sc->sc_uc_xfer[sc->sc_nucom][start]);
404 		mtx_unlock(&sc->sc_mtx);
405 
406 		sc->sc_uc_ifnum[sc->sc_nucom] = id->bInterfaceNumber;
407 
408 		sc->sc_nucom++;		/* found a port */
409 	}
410 
411 	if (sc->sc_nucom == 0) {
412 		device_printf(self, "no comports found\n");
413 		goto detach;
414 	}
415 
416 	err = ucom_attach(&sc->sc_super_ucom, sc->sc_ucom,
417 	    sc->sc_nucom, sc, &usie_uc_callback, &sc->sc_mtx);
418 
419 	if (err != 0) {
420 		DPRINTF("ucom_attach failed\n");
421 		goto detach;
422 	}
423 	DPRINTF("Found %d interfaces.\n", sc->sc_nucom);
424 
425 	/* setup ifnet (Direct IP) */
426 	sc->sc_ifp = ifp = if_alloc(IFT_OTHER);
427 
428 	if (ifp == NULL) {
429 		device_printf(self, "Could not allocate a network interface\n");
430 		goto detach;
431 	}
432 	if_initname(ifp, "usie", device_get_unit(self));
433 
434 	ifp->if_softc = sc;
435 	ifp->if_mtu = USIE_MTU_MAX;
436 	ifp->if_flags |= IFF_NOARP;
437 	ifp->if_init = usie_if_init;
438 	ifp->if_ioctl = usie_if_ioctl;
439 	ifp->if_start = usie_if_start;
440 	ifp->if_output = usie_if_output;
441 	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
442 	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
443 	IFQ_SET_READY(&ifp->if_snd);
444 
445 	if_attach(ifp);
446 	bpfattach(ifp, DLT_RAW, 0);
447 
448 	if (fwattr & USIE_PM_AUTO) {
449 		usbd_set_power_mode(uaa->device, USB_POWER_MODE_SAVE);
450 		DPRINTF("enabling automatic suspend and resume\n");
451 	} else {
452 		usbd_set_power_mode(uaa->device, USB_POWER_MODE_ON);
453 		DPRINTF("USB power is always ON\n");
454 	}
455 
456 	DPRINTF("device attached\n");
457 	return (0);
458 
459 detach:
460 	usie_detach(self);
461 	return (ENOMEM);
462 }
463 
464 static int
465 usie_detach(device_t self)
466 {
467 	struct usie_softc *sc = device_get_softc(self);
468 	uint8_t x;
469 
470 	/* detach ifnet */
471 	if (sc->sc_ifp != NULL) {
472 		usie_if_stop(sc);
473 		usbd_transfer_unsetup(sc->sc_if_xfer, USIE_IF_N_XFER);
474 		bpfdetach(sc->sc_ifp);
475 		if_detach(sc->sc_ifp);
476 		if_free(sc->sc_ifp);
477 		sc->sc_ifp = NULL;
478 	}
479 	/* detach ucom */
480 	if (sc->sc_nucom > 0)
481 		ucom_detach(&sc->sc_super_ucom, sc->sc_ucom);
482 
483 	/* stop all USB transfers */
484 	usbd_transfer_unsetup(sc->sc_if_xfer, USIE_IF_N_XFER);
485 
486 	for (x = 0; x != USIE_UCOM_MAX; x++)
487 		usbd_transfer_unsetup(sc->sc_uc_xfer[x], USIE_UC_N_XFER);
488 
489 
490 	device_claim_softc(self);
491 
492 	usie_free_softc(sc);
493 
494 	return (0);
495 }
496 
497 UCOM_UNLOAD_DRAIN(usie);
498 
499 static void
500 usie_free_softc(struct usie_softc *sc)
501 {
502 	if (ucom_unref(&sc->sc_super_ucom)) {
503 		mtx_destroy(&sc->sc_mtx);
504 		device_free_softc(sc);
505 	}
506 }
507 
508 static void
509 usie_free(struct ucom_softc *ucom)
510 {
511 	usie_free_softc(ucom->sc_parent);
512 }
513 
514 static void
515 usie_uc_update_line_state(struct ucom_softc *ucom, uint8_t ls)
516 {
517 	struct usie_softc *sc = ucom->sc_parent;
518 	struct usb_device_request req;
519 
520 	if (sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_STATUS] == NULL)
521 		return;
522 
523 	req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
524 	req.bRequest = USIE_LINK_STATE;
525 	USETW(req.wValue, ls);
526 	USETW(req.wIndex, sc->sc_uc_ifnum[ucom->sc_subunit]);
527 	USETW(req.wLength, 0);
528 
529 	DPRINTF("sc_uc_ifnum=%d\n", sc->sc_uc_ifnum[ucom->sc_subunit]);
530 
531 	usie_do_request(sc, &req, NULL);
532 }
533 
534 static void
535 usie_uc_cfg_get_status(struct ucom_softc *ucom, uint8_t *lsr, uint8_t *msr)
536 {
537 	struct usie_softc *sc = ucom->sc_parent;
538 
539 	*msr = sc->sc_msr;
540 	*lsr = sc->sc_lsr;
541 }
542 
543 static void
544 usie_uc_cfg_set_dtr(struct ucom_softc *ucom, uint8_t flag)
545 {
546 	uint8_t dtr;
547 
548 	dtr = flag ? USIE_LS_DTR : 0;
549 	usie_uc_update_line_state(ucom, dtr);
550 }
551 
552 static void
553 usie_uc_cfg_set_rts(struct ucom_softc *ucom, uint8_t flag)
554 {
555 	uint8_t rts;
556 
557 	rts = flag ? USIE_LS_RTS : 0;
558 	usie_uc_update_line_state(ucom, rts);
559 }
560 
561 static void
562 usie_uc_cfg_open(struct ucom_softc *ucom)
563 {
564 	struct usie_softc *sc = ucom->sc_parent;
565 
566 	/* usbd_transfer_start() is NULL safe */
567 
568 	usbd_transfer_start(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_STATUS]);
569 }
570 
571 static void
572 usie_uc_cfg_close(struct ucom_softc *ucom)
573 {
574 	struct usie_softc *sc = ucom->sc_parent;
575 
576 	usbd_transfer_stop(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_STATUS]);
577 }
578 
579 static void
580 usie_uc_start_read(struct ucom_softc *ucom)
581 {
582 	struct usie_softc *sc = ucom->sc_parent;
583 
584 	usbd_transfer_start(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_RX]);
585 }
586 
587 static void
588 usie_uc_stop_read(struct ucom_softc *ucom)
589 {
590 	struct usie_softc *sc = ucom->sc_parent;
591 
592 	usbd_transfer_stop(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_RX]);
593 }
594 
595 static void
596 usie_uc_start_write(struct ucom_softc *ucom)
597 {
598 	struct usie_softc *sc = ucom->sc_parent;
599 
600 	usbd_transfer_start(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_TX]);
601 }
602 
603 static void
604 usie_uc_stop_write(struct ucom_softc *ucom)
605 {
606 	struct usie_softc *sc = ucom->sc_parent;
607 
608 	usbd_transfer_stop(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_TX]);
609 }
610 
611 static void
612 usie_uc_rx_callback(struct usb_xfer *xfer, usb_error_t error)
613 {
614 	struct ucom_softc *ucom = usbd_xfer_softc(xfer);
615 	struct usie_softc *sc = ucom->sc_parent;
616 	struct usb_page_cache *pc;
617 	uint32_t actlen;
618 
619 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
620 
621 	switch (USB_GET_STATE(xfer)) {
622 	case USB_ST_TRANSFERRED:
623 		pc = usbd_xfer_get_frame(xfer, 0);
624 
625 		/* handle CnS response */
626 		if (ucom == sc->sc_ucom && actlen >= USIE_HIPCNS_MIN) {
627 
628 			DPRINTF("transferred=%u\n", actlen);
629 
630 			/* check if it is really CnS reply */
631 			usbd_copy_out(pc, 0, sc->sc_resp_temp, 1);
632 
633 			if (sc->sc_resp_temp[0] == USIE_HIP_FRM_CHR) {
634 
635 				/* verify actlen */
636 				if (actlen > USIE_BUFSIZE)
637 					actlen = USIE_BUFSIZE;
638 
639 				/* get complete message */
640 				usbd_copy_out(pc, 0, sc->sc_resp_temp, actlen);
641 				usie_hip_rsp(sc, sc->sc_resp_temp, actlen);
642 
643 				/* need to fall though */
644 				goto tr_setup;
645 			}
646 			/* else call ucom_put_data() */
647 		}
648 		/* standard ucom transfer */
649 		ucom_put_data(ucom, pc, 0, actlen);
650 
651 		/* fall though */
652 	case USB_ST_SETUP:
653 tr_setup:
654 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
655 		usbd_transfer_submit(xfer);
656 		break;
657 
658 	default:			/* Error */
659 		if (error != USB_ERR_CANCELLED) {
660 			usbd_xfer_set_stall(xfer);
661 			goto tr_setup;
662 		}
663 		break;
664 	}
665 }
666 
667 static void
668 usie_uc_tx_callback(struct usb_xfer *xfer, usb_error_t error)
669 {
670 	struct ucom_softc *ucom = usbd_xfer_softc(xfer);
671 	struct usb_page_cache *pc;
672 	uint32_t actlen;
673 
674 	switch (USB_GET_STATE(xfer)) {
675 	case USB_ST_TRANSFERRED:
676 	case USB_ST_SETUP:
677 tr_setup:
678 		pc = usbd_xfer_get_frame(xfer, 0);
679 
680 		/* handle CnS request */
681 		struct mbuf *m = usbd_xfer_get_priv(xfer);
682 
683 		if (m != NULL) {
684 			usbd_m_copy_in(pc, 0, m, 0, m->m_pkthdr.len);
685 			usbd_xfer_set_frame_len(xfer, 0, m->m_pkthdr.len);
686 			usbd_xfer_set_priv(xfer, NULL);
687 			usbd_transfer_submit(xfer);
688 			m_freem(m);
689 			break;
690 		}
691 		/* standard ucom transfer */
692 		if (ucom_get_data(ucom, pc, 0, USIE_BUFSIZE, &actlen)) {
693 			usbd_xfer_set_frame_len(xfer, 0, actlen);
694 			usbd_transfer_submit(xfer);
695 		}
696 		break;
697 
698 	default:			/* Error */
699 		if (error != USB_ERR_CANCELLED) {
700 			usbd_xfer_set_stall(xfer);
701 			goto tr_setup;
702 		}
703 		break;
704 	}
705 }
706 
707 static void
708 usie_uc_status_callback(struct usb_xfer *xfer, usb_error_t error)
709 {
710 	struct usb_page_cache *pc;
711 	struct {
712 		struct usb_device_request req;
713 		uint16_t param;
714 	}      st;
715 	uint32_t actlen;
716 	uint16_t param;
717 
718 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
719 
720 	switch (USB_GET_STATE(xfer)) {
721 	case USB_ST_TRANSFERRED:
722 		DPRINTFN(4, "info received, actlen=%u\n", actlen);
723 
724 		if (actlen < sizeof(st)) {
725 			DPRINTF("data too short actlen=%u\n", actlen);
726 			goto tr_setup;
727 		}
728 		pc = usbd_xfer_get_frame(xfer, 0);
729 		usbd_copy_out(pc, 0, &st, sizeof(st));
730 
731 		if (st.req.bmRequestType == 0xa1 && st.req.bRequest == 0x20) {
732 			struct ucom_softc *ucom = usbd_xfer_softc(xfer);
733 			struct usie_softc *sc = ucom->sc_parent;
734 
735 			param = le16toh(st.param);
736 			DPRINTF("param=%x\n", param);
737 			sc->sc_msr = sc->sc_lsr = 0;
738 			sc->sc_msr |= (param & USIE_DCD) ? SER_DCD : 0;
739 			sc->sc_msr |= (param & USIE_DSR) ? SER_DSR : 0;
740 			sc->sc_msr |= (param & USIE_RI) ? SER_RI : 0;
741 			sc->sc_msr |= (param & USIE_CTS) ? 0 : SER_CTS;
742 			sc->sc_msr |= (param & USIE_RTS) ? SER_RTS : 0;
743 			sc->sc_msr |= (param & USIE_DTR) ? SER_DTR : 0;
744 		}
745 		/* fall though */
746 	case USB_ST_SETUP:
747 tr_setup:
748 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
749 		usbd_transfer_submit(xfer);
750 		break;
751 
752 	default:			/* Error */
753 		DPRINTF("USB transfer error, %s\n",
754 		    usbd_errstr(error));
755 
756 		if (error != USB_ERR_CANCELLED) {
757 			usbd_xfer_set_stall(xfer);
758 			goto tr_setup;
759 		}
760 		break;
761 	}
762 }
763 
764 static void
765 usie_if_rx_callback(struct usb_xfer *xfer, usb_error_t error)
766 {
767 	struct usie_softc *sc = usbd_xfer_softc(xfer);
768 	struct ifnet *ifp = sc->sc_ifp;
769 	struct mbuf *m0;
770 	struct mbuf *m = NULL;
771 	struct usie_desc *rxd;
772 	uint32_t actlen;
773 	uint16_t err;
774 	uint16_t pkt;
775 	uint16_t ipl;
776 	uint16_t len;
777 	uint16_t diff;
778 	uint8_t pad;
779 	uint8_t ipv;
780 
781 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
782 
783 	switch (USB_GET_STATE(xfer)) {
784 	case USB_ST_TRANSFERRED:
785 		DPRINTFN(15, "rx done, actlen=%u\n", actlen);
786 
787 		if (actlen < sizeof(struct usie_hip)) {
788 			DPRINTF("data too short %u\n", actlen);
789 			goto tr_setup;
790 		}
791 		m = sc->sc_rxm;
792 		sc->sc_rxm = NULL;
793 
794 		/* fall though */
795 	case USB_ST_SETUP:
796 tr_setup:
797 
798 		if (sc->sc_rxm == NULL) {
799 			sc->sc_rxm = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR,
800 			    MJUMPAGESIZE /* could be bigger than MCLBYTES */ );
801 		}
802 		if (sc->sc_rxm == NULL) {
803 			DPRINTF("could not allocate Rx mbuf\n");
804 			ifp->if_ierrors++;
805 			usbd_xfer_set_stall(xfer);
806 			usbd_xfer_set_frames(xfer, 0);
807 		} else {
808 			/*
809 			 * Directly loading a mbuf cluster into DMA to
810 			 * save some data copying. This works because
811 			 * there is only one cluster.
812 			 */
813 			usbd_xfer_set_frame_data(xfer, 0,
814 			    mtod(sc->sc_rxm, caddr_t), MIN(MJUMPAGESIZE, USIE_RXSZ_MAX));
815 			usbd_xfer_set_frames(xfer, 1);
816 		}
817 		usbd_transfer_submit(xfer);
818 		break;
819 
820 	default:			/* Error */
821 		DPRINTF("USB transfer error, %s\n", usbd_errstr(error));
822 
823 		if (error != USB_ERR_CANCELLED) {
824 			/* try to clear stall first */
825 			usbd_xfer_set_stall(xfer);
826 			ifp->if_ierrors++;
827 			goto tr_setup;
828 		}
829 		if (sc->sc_rxm != NULL) {
830 			m_freem(sc->sc_rxm);
831 			sc->sc_rxm = NULL;
832 		}
833 		break;
834 	}
835 
836 	if (m == NULL)
837 		return;
838 
839 	mtx_unlock(&sc->sc_mtx);
840 
841 	m->m_pkthdr.len = m->m_len = actlen;
842 
843 	err = pkt = 0;
844 
845 	/* HW can aggregate multiple frames in a single USB xfer */
846 	for (;;) {
847 		rxd = mtod(m, struct usie_desc *);
848 
849 		len = be16toh(rxd->hip.len) & USIE_HIP_IP_LEN_MASK;
850 		pad = (rxd->hip.id & USIE_HIP_PAD) ? 1 : 0;
851 		ipl = (len - pad - ETHER_HDR_LEN);
852 		if (ipl >= len) {
853 			DPRINTF("Corrupt frame\n");
854 			m_freem(m);
855 			break;
856 		}
857 		diff = sizeof(struct usie_desc) + ipl + pad;
858 
859 		if (((rxd->hip.id & USIE_HIP_MASK) != USIE_HIP_IP) ||
860 		    (be16toh(rxd->desc_type) & USIE_TYPE_MASK) != USIE_IP_RX) {
861 			DPRINTF("received wrong type of packet\n");
862 			m->m_data += diff;
863 			m->m_pkthdr.len = (m->m_len -= diff);
864 			err++;
865 			if (m->m_pkthdr.len > 0)
866 				continue;
867 			m_freem(m);
868 			break;
869 		}
870 		switch (be16toh(rxd->ethhdr.ether_type)) {
871 		case ETHERTYPE_IP:
872 			ipv = NETISR_IP;
873 			break;
874 #ifdef INET6
875 		case ETHERTYPE_IPV6:
876 			ipv = NETISR_IPV6;
877 			break;
878 #endif
879 		default:
880 			DPRINTF("unsupported ether type\n");
881 			err++;
882 			break;
883 		}
884 
885 		/* the last packet */
886 		if (m->m_pkthdr.len <= diff) {
887 			m->m_data += (sizeof(struct usie_desc) + pad);
888 			m->m_pkthdr.len = m->m_len = ipl;
889 			m->m_pkthdr.rcvif = ifp;
890 			BPF_MTAP(sc->sc_ifp, m);
891 			netisr_dispatch(ipv, m);
892 			break;
893 		}
894 		/* copy aggregated frames to another mbuf */
895 		m0 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
896 		if (__predict_false(m0 == NULL)) {
897 			DPRINTF("could not allocate mbuf\n");
898 			err++;
899 			m_freem(m);
900 			break;
901 		}
902 		m_copydata(m, sizeof(struct usie_desc) + pad, ipl, mtod(m0, caddr_t));
903 		m0->m_pkthdr.rcvif = ifp;
904 		m0->m_pkthdr.len = m0->m_len = ipl;
905 
906 		BPF_MTAP(sc->sc_ifp, m0);
907 		netisr_dispatch(ipv, m0);
908 
909 		m->m_data += diff;
910 		m->m_pkthdr.len = (m->m_len -= diff);
911 	}
912 
913 	mtx_lock(&sc->sc_mtx);
914 
915 	ifp->if_ierrors += err;
916 	ifp->if_ipackets += pkt;
917 }
918 
919 static void
920 usie_if_tx_callback(struct usb_xfer *xfer, usb_error_t error)
921 {
922 	struct usie_softc *sc = usbd_xfer_softc(xfer);
923 	struct usb_page_cache *pc;
924 	struct ifnet *ifp = sc->sc_ifp;
925 	struct mbuf *m;
926 	uint16_t size;
927 
928 	switch (USB_GET_STATE(xfer)) {
929 	case USB_ST_TRANSFERRED:
930 		DPRINTFN(11, "transfer complete\n");
931 		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
932 		ifp->if_opackets++;
933 
934 		/* fall though */
935 	case USB_ST_SETUP:
936 tr_setup:
937 
938 		if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
939 			break;
940 
941 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
942 		if (m == NULL)
943 			break;
944 
945 		if (m->m_pkthdr.len > (int)(MCLBYTES - ETHER_HDR_LEN +
946 		    ETHER_CRC_LEN - sizeof(sc->sc_txd))) {
947 			DPRINTF("packet len is too big: %d\n",
948 			    m->m_pkthdr.len);
949 			break;
950 		}
951 		pc = usbd_xfer_get_frame(xfer, 0);
952 
953 		sc->sc_txd.hip.len = htobe16(m->m_pkthdr.len +
954 		    ETHER_HDR_LEN + ETHER_CRC_LEN);
955 		size = sizeof(sc->sc_txd);
956 
957 		usbd_copy_in(pc, 0, &sc->sc_txd, size);
958 		usbd_m_copy_in(pc, size, m, 0, m->m_pkthdr.len);
959 		usbd_xfer_set_frame_len(xfer, 0, m->m_pkthdr.len +
960 		    size + ETHER_CRC_LEN);
961 
962 		BPF_MTAP(ifp, m);
963 
964 		m_freem(m);
965 
966 		usbd_transfer_submit(xfer);
967 		break;
968 
969 	default:			/* Error */
970 		DPRINTF("USB transfer error, %s\n",
971 		    usbd_errstr(error));
972 		ifp->if_oerrors++;
973 
974 		if (error != USB_ERR_CANCELLED) {
975 			usbd_xfer_set_stall(xfer);
976 			ifp->if_ierrors++;
977 			goto tr_setup;
978 		}
979 		break;
980 	}
981 }
982 
983 static void
984 usie_if_status_callback(struct usb_xfer *xfer, usb_error_t error)
985 {
986 	struct usie_softc *sc = usbd_xfer_softc(xfer);
987 	struct usb_page_cache *pc;
988 	struct usb_cdc_notification cdc;
989 	uint32_t actlen;
990 
991 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
992 
993 	switch (USB_GET_STATE(xfer)) {
994 	case USB_ST_TRANSFERRED:
995 		DPRINTFN(4, "info received, actlen=%d\n", actlen);
996 
997 		/* usb_cdc_notification - .data[16] */
998 		if (actlen < (sizeof(cdc) - 16)) {
999 			DPRINTF("data too short %d\n", actlen);
1000 			goto tr_setup;
1001 		}
1002 		pc = usbd_xfer_get_frame(xfer, 0);
1003 		usbd_copy_out(pc, 0, &cdc, (sizeof(cdc) - 16));
1004 
1005 		DPRINTFN(4, "bNotification=%x\n", cdc.bNotification);
1006 
1007 		if (cdc.bNotification & UCDC_N_RESPONSE_AVAILABLE) {
1008 			taskqueue_enqueue(taskqueue_thread,
1009 			    &sc->sc_if_status_task);
1010 		}
1011 		/* fall though */
1012 	case USB_ST_SETUP:
1013 tr_setup:
1014 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1015 		usbd_transfer_submit(xfer);
1016 		break;
1017 
1018 	default:			/* Error */
1019 		DPRINTF("USB transfer error, %s\n",
1020 		    usbd_errstr(error));
1021 
1022 		if (error != USB_ERR_CANCELLED) {
1023 			usbd_xfer_set_stall(xfer);
1024 			goto tr_setup;
1025 		}
1026 		break;
1027 	}
1028 }
1029 
1030 static void
1031 usie_if_sync_to(void *arg)
1032 {
1033 	struct usie_softc *sc = arg;
1034 
1035 	taskqueue_enqueue(taskqueue_thread, &sc->sc_if_sync_task);
1036 }
1037 
1038 static void
1039 usie_if_sync_cb(void *arg, int pending)
1040 {
1041 	struct usie_softc *sc = arg;
1042 
1043 	mtx_lock(&sc->sc_mtx);
1044 
1045 	/* call twice */
1046 	usie_if_cmd(sc, USIE_HIP_SYNC2M);
1047 	usie_if_cmd(sc, USIE_HIP_SYNC2M);
1048 
1049 	usb_callout_reset(&sc->sc_if_sync_ch, 2 * hz, usie_if_sync_to, sc);
1050 
1051 	mtx_unlock(&sc->sc_mtx);
1052 }
1053 
1054 static void
1055 usie_if_status_cb(void *arg, int pending)
1056 {
1057 	struct usie_softc *sc = arg;
1058 	struct ifnet *ifp = sc->sc_ifp;
1059 	struct usb_device_request req;
1060 	struct usie_hip *hip;
1061 	struct usie_lsi *lsi;
1062 	uint16_t actlen;
1063 	uint8_t ntries;
1064 	uint8_t pad;
1065 
1066 	mtx_lock(&sc->sc_mtx);
1067 
1068 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
1069 	req.bRequest = UCDC_GET_ENCAPSULATED_RESPONSE;
1070 	USETW(req.wValue, 0);
1071 	USETW(req.wIndex, sc->sc_if_ifnum);
1072 	USETW(req.wLength, sizeof(sc->sc_status_temp));
1073 
1074 	for (ntries = 0; ntries != 10; ntries++) {
1075 		int err;
1076 
1077 		err = usbd_do_request_flags(sc->sc_udev,
1078 		    &sc->sc_mtx, &req, sc->sc_status_temp, USB_SHORT_XFER_OK,
1079 		    &actlen, USB_DEFAULT_TIMEOUT);
1080 
1081 		if (err == 0)
1082 			break;
1083 
1084 		DPRINTF("Control request failed: %s %d/10\n",
1085 		    usbd_errstr(err), ntries);
1086 
1087 		usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(10));
1088 	}
1089 
1090 	if (ntries == 10) {
1091 		mtx_unlock(&sc->sc_mtx);
1092 		DPRINTF("Timeout\n");
1093 		return;
1094 	}
1095 
1096 	hip = (struct usie_hip *)sc->sc_status_temp;
1097 
1098 	pad = (hip->id & USIE_HIP_PAD) ? 1 : 0;
1099 
1100 	DPRINTF("hip.id=%x hip.len=%d actlen=%u pad=%d\n",
1101 	    hip->id, be16toh(hip->len), actlen, pad);
1102 
1103 	switch (hip->id & USIE_HIP_MASK) {
1104 	case USIE_HIP_SYNC2H:
1105 		usie_if_cmd(sc, USIE_HIP_SYNC2M);
1106 		break;
1107 	case USIE_HIP_RESTR:
1108 		usb_callout_stop(&sc->sc_if_sync_ch);
1109 		break;
1110 	case USIE_HIP_UMTS:
1111 		lsi = (struct usie_lsi *)(
1112 		    sc->sc_status_temp + sizeof(struct usie_hip) + pad);
1113 
1114 		DPRINTF("lsi.proto=%x lsi.len=%d\n", lsi->proto,
1115 		    be16toh(lsi->len));
1116 
1117 		if (lsi->proto != USIE_LSI_UMTS)
1118 			break;
1119 
1120 		if (lsi->area == USIE_LSI_AREA_NO ||
1121 		    lsi->area == USIE_LSI_AREA_NODATA) {
1122 			device_printf(sc->sc_dev, "no service available\n");
1123 			break;
1124 		}
1125 		if (lsi->state == USIE_LSI_STATE_IDLE) {
1126 			DPRINTF("lsi.state=%x\n", lsi->state);
1127 			break;
1128 		}
1129 		DPRINTF("ctx=%x\n", hip->param);
1130 		sc->sc_txd.hip.param = hip->param;
1131 
1132 		sc->sc_net.addr_len = lsi->pdp_addr_len;
1133 		memcpy(&sc->sc_net.dns1_addr, &lsi->dns1_addr, 16);
1134 		memcpy(&sc->sc_net.dns2_addr, &lsi->dns2_addr, 16);
1135 		memcpy(sc->sc_net.pdp_addr, lsi->pdp_addr, 16);
1136 		memcpy(sc->sc_net.gw_addr, lsi->gw_addr, 16);
1137 		ifp->if_flags |= IFF_UP;
1138 		ifp->if_drv_flags |= IFF_DRV_RUNNING;
1139 
1140 		device_printf(sc->sc_dev, "IP Addr=%d.%d.%d.%d\n",
1141 		    *lsi->pdp_addr, *(lsi->pdp_addr + 1),
1142 		    *(lsi->pdp_addr + 2), *(lsi->pdp_addr + 3));
1143 		device_printf(sc->sc_dev, "Gateway Addr=%d.%d.%d.%d\n",
1144 		    *lsi->gw_addr, *(lsi->gw_addr + 1),
1145 		    *(lsi->gw_addr + 2), *(lsi->gw_addr + 3));
1146 		device_printf(sc->sc_dev, "Prim NS Addr=%d.%d.%d.%d\n",
1147 		    *lsi->dns1_addr, *(lsi->dns1_addr + 1),
1148 		    *(lsi->dns1_addr + 2), *(lsi->dns1_addr + 3));
1149 		device_printf(sc->sc_dev, "Scnd NS Addr=%d.%d.%d.%d\n",
1150 		    *lsi->dns2_addr, *(lsi->dns2_addr + 1),
1151 		    *(lsi->dns2_addr + 2), *(lsi->dns2_addr + 3));
1152 
1153 		usie_cns_req(sc, USIE_CNS_ID_RSSI, USIE_CNS_OB_RSSI);
1154 		break;
1155 
1156 	case USIE_HIP_RCGI:
1157 		/* ignore, workaround for sloppy windows */
1158 		break;
1159 	default:
1160 		DPRINTF("undefined msgid: %x\n", hip->id);
1161 		break;
1162 	}
1163 
1164 	mtx_unlock(&sc->sc_mtx);
1165 }
1166 
1167 static void
1168 usie_if_start(struct ifnet *ifp)
1169 {
1170 	struct usie_softc *sc = ifp->if_softc;
1171 
1172 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1173 		DPRINTF("Not running\n");
1174 		return;
1175 	}
1176 	mtx_lock(&sc->sc_mtx);
1177 	usbd_transfer_start(sc->sc_if_xfer[USIE_IF_TX]);
1178 	mtx_unlock(&sc->sc_mtx);
1179 
1180 	DPRINTFN(3, "interface started\n");
1181 }
1182 
1183 static int
1184 usie_if_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
1185     struct route *ro)
1186 {
1187 	int err;
1188 
1189 	DPRINTF("proto=%x\n", dst->sa_family);
1190 
1191 	switch (dst->sa_family) {
1192 #ifdef INET6
1193 	case AF_INET6;
1194 	/* fall though */
1195 #endif
1196 	case AF_INET:
1197 		break;
1198 
1199 		/* silently drop dhclient packets */
1200 	case AF_UNSPEC:
1201 		m_freem(m);
1202 		return (0);
1203 
1204 		/* drop other packet types */
1205 	default:
1206 		m_freem(m);
1207 		return (EAFNOSUPPORT);
1208 	}
1209 
1210 	err = (ifp->if_transmit)(ifp, m);
1211 	if (err) {
1212 		ifp->if_oerrors++;
1213 		return (ENOBUFS);
1214 	}
1215 	ifp->if_opackets++;
1216 
1217 	return (0);
1218 }
1219 
1220 static void
1221 usie_if_init(void *arg)
1222 {
1223 	struct usie_softc *sc = arg;
1224 	struct ifnet *ifp = sc->sc_ifp;
1225 	uint8_t i;
1226 
1227 	mtx_lock(&sc->sc_mtx);
1228 
1229 	/* write tx descriptor */
1230 	sc->sc_txd.hip.id = USIE_HIP_CTX;
1231 	sc->sc_txd.hip.param = 0;	/* init value */
1232 	sc->sc_txd.desc_type = htobe16(USIE_IP_TX);
1233 
1234 	for (i = 0; i != USIE_IF_N_XFER; i++)
1235 		usbd_xfer_set_stall(sc->sc_if_xfer[i]);
1236 
1237 	usbd_transfer_start(sc->sc_uc_xfer[USIE_HIP_IF][USIE_UC_RX]);
1238 	usbd_transfer_start(sc->sc_if_xfer[USIE_IF_STATUS]);
1239 	usbd_transfer_start(sc->sc_if_xfer[USIE_IF_RX]);
1240 
1241 	/* if not running, initiate the modem */
1242 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
1243 		usie_cns_req(sc, USIE_CNS_ID_INIT, USIE_CNS_OB_LINK_UPDATE);
1244 
1245 	mtx_unlock(&sc->sc_mtx);
1246 
1247 	DPRINTF("ifnet initialized\n");
1248 }
1249 
1250 static void
1251 usie_if_stop(struct usie_softc *sc)
1252 {
1253 	usb_callout_drain(&sc->sc_if_sync_ch);
1254 
1255 	mtx_lock(&sc->sc_mtx);
1256 
1257 	/* usie_cns_req() clears IFF_* flags */
1258 	usie_cns_req(sc, USIE_CNS_ID_STOP, USIE_CNS_OB_LINK_UPDATE);
1259 
1260 	usbd_transfer_stop(sc->sc_if_xfer[USIE_IF_TX]);
1261 	usbd_transfer_stop(sc->sc_if_xfer[USIE_IF_RX]);
1262 	usbd_transfer_stop(sc->sc_if_xfer[USIE_IF_STATUS]);
1263 
1264 	/* shutdown device */
1265 	usie_if_cmd(sc, USIE_HIP_DOWN);
1266 
1267 	mtx_unlock(&sc->sc_mtx);
1268 }
1269 
1270 static int
1271 usie_if_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1272 {
1273 	struct usie_softc *sc = ifp->if_softc;
1274 	struct ieee80211req *ireq;
1275 	struct ieee80211req_sta_info si;
1276 	struct ifmediareq *ifmr;
1277 
1278 	switch (cmd) {
1279 	case SIOCSIFFLAGS:
1280 		if (ifp->if_flags & IFF_UP) {
1281 			if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
1282 				usie_if_init(sc);
1283 		} else {
1284 			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1285 				usie_if_stop(sc);
1286 		}
1287 		break;
1288 
1289 	case SIOCSIFCAP:
1290 		if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1291 			device_printf(sc->sc_dev,
1292 			    "Connect to the network first.\n");
1293 			break;
1294 		}
1295 		mtx_lock(&sc->sc_mtx);
1296 		usie_cns_req(sc, USIE_CNS_ID_RSSI, USIE_CNS_OB_RSSI);
1297 		mtx_unlock(&sc->sc_mtx);
1298 		break;
1299 
1300 	case SIOCG80211:
1301 		ireq = (struct ieee80211req *)data;
1302 
1303 		if (ireq->i_type != IEEE80211_IOC_STA_INFO)
1304 			break;
1305 
1306 		memset(&si, 0, sizeof(si));
1307 		si.isi_len = sizeof(si);
1308 		/*
1309 		 * ifconfig expects RSSI in 0.5dBm units
1310 		 * relative to the noise floor.
1311 		 */
1312 		si.isi_rssi = 2 * sc->sc_rssi;
1313 		if (copyout(&si, (uint8_t *)ireq->i_data + 8,
1314 		    sizeof(struct ieee80211req_sta_info)))
1315 			DPRINTF("copyout failed\n");
1316 		DPRINTF("80211\n");
1317 		break;
1318 
1319 	case SIOCGIFMEDIA:		/* to fool ifconfig */
1320 		ifmr = (struct ifmediareq *)data;
1321 		ifmr->ifm_count = 1;
1322 		DPRINTF("media\n");
1323 		break;
1324 
1325 	case SIOCSIFADDR:
1326 	case SIOCSIFDSTADDR:
1327 		break;
1328 
1329 	default:
1330 		return (EINVAL);
1331 	}
1332 	return (0);
1333 }
1334 
1335 static int
1336 usie_do_request(struct usie_softc *sc, struct usb_device_request *req,
1337     void *data)
1338 {
1339 	int err = 0;
1340 	int ntries;
1341 
1342 	mtx_assert(&sc->sc_mtx, MA_OWNED);
1343 
1344 	for (ntries = 0; ntries != 10; ntries++) {
1345 		err = usbd_do_request(sc->sc_udev,
1346 		    &sc->sc_mtx, req, data);
1347 		if (err == 0)
1348 			break;
1349 
1350 		DPRINTF("Control request failed: %s %d/10\n",
1351 		    usbd_errstr(err), ntries);
1352 
1353 		usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(10));
1354 	}
1355 	return (err);
1356 }
1357 
1358 static int
1359 usie_if_cmd(struct usie_softc *sc, uint8_t cmd)
1360 {
1361 	struct usb_device_request req;
1362 	struct usie_hip msg;
1363 
1364 	msg.len = 0;
1365 	msg.id = cmd;
1366 	msg.param = 0;
1367 
1368 	req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1369 	req.bRequest = UCDC_SEND_ENCAPSULATED_COMMAND;
1370 	USETW(req.wValue, 0);
1371 	USETW(req.wIndex, sc->sc_if_ifnum);
1372 	USETW(req.wLength, sizeof(msg));
1373 
1374 	DPRINTF("cmd=%x\n", cmd);
1375 
1376 	return (usie_do_request(sc, &req, &msg));
1377 }
1378 
1379 static void
1380 usie_cns_req(struct usie_softc *sc, uint32_t id, uint16_t obj)
1381 {
1382 	struct ifnet *ifp = sc->sc_ifp;
1383 	struct mbuf *m;
1384 	struct usb_xfer *xfer;
1385 	struct usie_hip *hip;
1386 	struct usie_cns *cns;
1387 	uint8_t *param;
1388 	uint8_t *tmp;
1389 	uint8_t cns_len;
1390 
1391 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1392 	if (__predict_false(m == NULL)) {
1393 		DPRINTF("could not allocate mbuf\n");
1394 		ifp->if_ierrors++;
1395 		return;
1396 	}
1397 	/* to align usie_hip{} on 32 bit */
1398 	m->m_data += 3;
1399 	param = mtod(m, uint8_t *);
1400 	*param++ = USIE_HIP_FRM_CHR;
1401 	hip = (struct usie_hip *)param;
1402 	cns = (struct usie_cns *)(hip + 1);
1403 
1404 	tmp = param + USIE_HIPCNS_MIN - 2;
1405 
1406 	switch (obj) {
1407 	case USIE_CNS_OB_LINK_UPDATE:
1408 		cns_len = 2;
1409 		cns->op = USIE_CNS_OP_SET;
1410 		*tmp++ = 1;		/* profile ID, always use 1 for now */
1411 		*tmp++ = id == USIE_CNS_ID_INIT ? 1 : 0;
1412 		break;
1413 
1414 	case USIE_CNS_OB_PROF_WRITE:
1415 		cns_len = 245;
1416 		cns->op = USIE_CNS_OP_SET;
1417 		*tmp++ = 1;		/* profile ID, always use 1 for now */
1418 		*tmp++ = 2;
1419 		memcpy(tmp, &sc->sc_net, 34);
1420 		memset(tmp + 35, 0, 245 - 36);
1421 		tmp += 243;
1422 		break;
1423 
1424 	case USIE_CNS_OB_RSSI:
1425 		cns_len = 0;
1426 		cns->op = USIE_CNS_OP_REQ;
1427 		break;
1428 
1429 	default:
1430 		DPRINTF("unsupported CnS object type\n");
1431 		return;
1432 	}
1433 	*tmp = USIE_HIP_FRM_CHR;
1434 
1435 	hip->len = htobe16(sizeof(struct usie_cns) + cns_len);
1436 	hip->id = USIE_HIP_CNS2M;
1437 	hip->param = 0;			/* none for CnS */
1438 
1439 	cns->obj = htobe16(obj);
1440 	cns->id = htobe32(id);
1441 	cns->len = cns_len;
1442 	cns->rsv0 = cns->rsv1 = 0;	/* always '0' */
1443 
1444 	param = (uint8_t *)(cns + 1);
1445 
1446 	DPRINTF("param: %16D\n", param, ":");
1447 
1448 	m->m_pkthdr.len = m->m_len = USIE_HIPCNS_MIN + cns_len + 2;
1449 
1450 	xfer = sc->sc_uc_xfer[USIE_HIP_IF][USIE_UC_TX];
1451 
1452 	if (usbd_xfer_get_priv(xfer) == NULL) {
1453 		usbd_xfer_set_priv(xfer, m);
1454 		usbd_transfer_start(xfer);
1455 	} else {
1456 		DPRINTF("Dropped CNS event\n");
1457 		m_freem(m);
1458 	}
1459 }
1460 
1461 static void
1462 usie_cns_rsp(struct usie_softc *sc, struct usie_cns *cns)
1463 {
1464 	struct ifnet *ifp = sc->sc_ifp;
1465 
1466 	DPRINTF("received CnS\n");
1467 
1468 	switch (be16toh(cns->obj)) {
1469 	case USIE_CNS_OB_LINK_UPDATE:
1470 		if (be32toh(cns->id) & USIE_CNS_ID_INIT)
1471 			usie_if_sync_to(sc);
1472 		else if (be32toh(cns->id) & USIE_CNS_ID_STOP) {
1473 			ifp->if_flags &= ~IFF_UP;
1474 			ifp->if_drv_flags &=
1475 			    ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
1476 		} else
1477 			DPRINTF("undefined link update\n");
1478 		break;
1479 
1480 	case USIE_CNS_OB_RSSI:
1481 		sc->sc_rssi = be16toh(*(int16_t *)(cns + 1));
1482 		if (sc->sc_rssi <= 0)
1483 			device_printf(sc->sc_dev, "No signal\n");
1484 		else {
1485 			device_printf(sc->sc_dev, "RSSI=%ddBm\n",
1486 			    sc->sc_rssi - 110);
1487 		}
1488 		break;
1489 
1490 	case USIE_CNS_OB_PROF_WRITE:
1491 		break;
1492 
1493 	case USIE_CNS_OB_PDP_READ:
1494 		break;
1495 
1496 	default:
1497 		DPRINTF("undefined CnS\n");
1498 		break;
1499 	}
1500 }
1501 
1502 static void
1503 usie_hip_rsp(struct usie_softc *sc, uint8_t *rsp, uint32_t len)
1504 {
1505 	struct usie_hip *hip;
1506 	struct usie_cns *cns;
1507 	uint32_t i;
1508 	uint32_t j;
1509 	uint32_t off;
1510 	uint8_t tmp[USIE_HIPCNS_MAX] __aligned(4);
1511 
1512 	for (off = 0; (off + USIE_HIPCNS_MIN) <= len; off++) {
1513 
1514 		uint8_t pad;
1515 
1516 		while ((off < len) && (rsp[off] == USIE_HIP_FRM_CHR))
1517 			off++;
1518 
1519 		/* Unstuff the bytes */
1520 		for (i = j = 0; ((i + off) < len) &&
1521 		    (j < USIE_HIPCNS_MAX); i++) {
1522 
1523 			if (rsp[i + off] == USIE_HIP_FRM_CHR)
1524 				break;
1525 
1526 			if (rsp[i + off] == USIE_HIP_ESC_CHR) {
1527 				if ((i + off + 1) >= len)
1528 					break;
1529 				tmp[j++] = rsp[i++ + off + 1] ^ 0x20;
1530 			} else {
1531 				tmp[j++] = rsp[i + off];
1532 			}
1533 		}
1534 
1535 		off += i;
1536 
1537 		DPRINTF("frame len=%d\n", j);
1538 
1539 		if (j < sizeof(struct usie_hip)) {
1540 			DPRINTF("too little data\n");
1541 			break;
1542 		}
1543 		/*
1544 		 * Make sure we are not reading the stack if something
1545 		 * is wrong.
1546 		 */
1547 		memset(tmp + j, 0, sizeof(tmp) - j);
1548 
1549 		hip = (struct usie_hip *)tmp;
1550 
1551 		DPRINTF("hip: len=%d msgID=%02x, param=%02x\n",
1552 		    be16toh(hip->len), hip->id, hip->param);
1553 
1554 		pad = (hip->id & USIE_HIP_PAD) ? 1 : 0;
1555 
1556 		if ((hip->id & USIE_HIP_MASK) == USIE_HIP_CNS2H) {
1557 			cns = (struct usie_cns *)(((uint8_t *)(hip + 1)) + pad);
1558 
1559 			if (j < (sizeof(struct usie_cns) +
1560 			    sizeof(struct usie_hip) + pad)) {
1561 				DPRINTF("too little data\n");
1562 				break;
1563 			}
1564 			DPRINTF("cns: obj=%04x, op=%02x, rsv0=%02x, "
1565 			    "app=%08x, rsv1=%02x, len=%d\n",
1566 			    be16toh(cns->obj), cns->op, cns->rsv0,
1567 			    be32toh(cns->id), cns->rsv1, cns->len);
1568 
1569 			if (cns->op & USIE_CNS_OP_ERR)
1570 				DPRINTF("CnS error response\n");
1571 			else
1572 				usie_cns_rsp(sc, cns);
1573 
1574 			i = sizeof(struct usie_hip) + pad + sizeof(struct usie_cns);
1575 			j = cns->len;
1576 		} else {
1577 			i = sizeof(struct usie_hip) + pad;
1578 			j = be16toh(hip->len);
1579 		}
1580 #ifdef	USB_DEBUG
1581 		if (usie_debug == 0)
1582 			continue;
1583 
1584 		while (i < USIE_HIPCNS_MAX && j > 0) {
1585 			DPRINTF("param[0x%02x] = 0x%02x\n", i, tmp[i]);
1586 			i++;
1587 			j--;
1588 		}
1589 #endif
1590 	}
1591 }
1592 
1593 static int
1594 usie_driver_loaded(struct module *mod, int what, void *arg)
1595 {
1596 	switch (what) {
1597 	case MOD_LOAD:
1598 		/* register autoinstall handler */
1599 		usie_etag = EVENTHANDLER_REGISTER(usb_dev_configured,
1600 		    usie_autoinst, NULL, EVENTHANDLER_PRI_ANY);
1601 		break;
1602 	case MOD_UNLOAD:
1603 		EVENTHANDLER_DEREGISTER(usb_dev_configured, usie_etag);
1604 		break;
1605 	default:
1606 		return (EOPNOTSUPP);
1607 	}
1608 	return (0);
1609 }
1610 
1611