xref: /freebsd/sys/dev/usb/net/if_usie.c (revision 72ae04c7334743c0fec2e8c99ac13fd8ca63f51b)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2011 Anybots Inc
5  * written by Akinori Furukoshi <moonlightakkiy@yahoo.ca>
6  *  - ucom part is based on u3g.c
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include "opt_inet6.h"
31 
32 #include <sys/param.h>
33 #include <sys/eventhandler.h>
34 #include <sys/systm.h>
35 #include <sys/queue.h>
36 #include <sys/systm.h>
37 #include <sys/socket.h>
38 #include <sys/kernel.h>
39 #include <sys/bus.h>
40 #include <sys/module.h>
41 #include <sys/sockio.h>
42 #include <sys/socket.h>
43 #include <sys/lock.h>
44 #include <sys/mutex.h>
45 #include <sys/condvar.h>
46 #include <sys/sysctl.h>
47 #include <sys/malloc.h>
48 #include <sys/taskqueue.h>
49 
50 #include <net/if.h>
51 #include <net/if_var.h>
52 
53 #include <machine/bus.h>
54 
55 #include <net/if.h>
56 #include <net/if_types.h>
57 #include <net/netisr.h>
58 #include <net/bpf.h>
59 #include <net/ethernet.h>
60 
61 #include <netinet/in.h>
62 #include <netinet/ip.h>
63 #include <netinet/ip6.h>
64 #include <netinet/udp.h>
65 
66 #include <net80211/ieee80211_ioctl.h>
67 
68 #include <dev/usb/usb.h>
69 #include <dev/usb/usbdi.h>
70 #include <dev/usb/usbdi_util.h>
71 #include <dev/usb/usb_cdc.h>
72 #include "usbdevs.h"
73 
74 #define	USB_DEBUG_VAR usie_debug
75 #include <dev/usb/usb_debug.h>
76 #include <dev/usb/usb_process.h>
77 #include <dev/usb/usb_msctest.h>
78 
79 #include <dev/usb/serial/usb_serial.h>
80 
81 #include <dev/usb/net/if_usievar.h>
82 
83 #ifdef	USB_DEBUG
84 static int usie_debug = 0;
85 
86 static SYSCTL_NODE(_hw_usb, OID_AUTO, usie, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
87     "sierra USB modem");
88 SYSCTL_INT(_hw_usb_usie, OID_AUTO, debug, CTLFLAG_RWTUN, &usie_debug, 0,
89     "usie debug level");
90 #endif
91 
92 /* Sierra Wireless Direct IP modems */
93 static const STRUCT_USB_HOST_ID usie_devs[] = {
94 #define	USIE_DEV(v, d) {				\
95     USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##d) }
96 	USIE_DEV(SIERRA, MC8700),
97 	USIE_DEV(SIERRA, TRUINSTALL),
98 	USIE_DEV(AIRPRIME, USB308),
99 #undef	USIE_DEV
100 };
101 
102 static device_probe_t usie_probe;
103 static device_attach_t usie_attach;
104 static device_detach_t usie_detach;
105 static void usie_free_softc(struct usie_softc *);
106 
107 static void usie_free(struct ucom_softc *);
108 static void usie_uc_update_line_state(struct ucom_softc *, uint8_t);
109 static void usie_uc_cfg_get_status(struct ucom_softc *, uint8_t *, uint8_t *);
110 static void usie_uc_cfg_set_dtr(struct ucom_softc *, uint8_t);
111 static void usie_uc_cfg_set_rts(struct ucom_softc *, uint8_t);
112 static void usie_uc_cfg_open(struct ucom_softc *);
113 static void usie_uc_cfg_close(struct ucom_softc *);
114 static void usie_uc_start_read(struct ucom_softc *);
115 static void usie_uc_stop_read(struct ucom_softc *);
116 static void usie_uc_start_write(struct ucom_softc *);
117 static void usie_uc_stop_write(struct ucom_softc *);
118 
119 static usb_callback_t usie_uc_tx_callback;
120 static usb_callback_t usie_uc_rx_callback;
121 static usb_callback_t usie_uc_status_callback;
122 static usb_callback_t usie_if_tx_callback;
123 static usb_callback_t usie_if_rx_callback;
124 static usb_callback_t usie_if_status_callback;
125 
126 static void usie_if_sync_to(void *);
127 static void usie_if_sync_cb(void *, int);
128 static void usie_if_status_cb(void *, int);
129 
130 static void usie_if_start(if_t);
131 static int usie_if_output(if_t, struct mbuf *,
132 	const struct sockaddr *, struct route *);
133 static void usie_if_init(void *);
134 static void usie_if_stop(struct usie_softc *);
135 static int usie_if_ioctl(if_t, u_long, caddr_t);
136 
137 static int usie_do_request(struct usie_softc *, struct usb_device_request *, void *);
138 static int usie_if_cmd(struct usie_softc *, uint8_t);
139 static void usie_cns_req(struct usie_softc *, uint32_t, uint16_t);
140 static void usie_cns_rsp(struct usie_softc *, struct usie_cns *);
141 static void usie_hip_rsp(struct usie_softc *, uint8_t *, uint32_t);
142 static int usie_driver_loaded(struct module *, int, void *);
143 
144 static const struct usb_config usie_uc_config[USIE_UC_N_XFER] = {
145 	[USIE_UC_STATUS] = {
146 		.type = UE_INTERRUPT,
147 		.endpoint = UE_ADDR_ANY,
148 		.direction = UE_DIR_IN,
149 		.bufsize = 0,		/* use wMaxPacketSize */
150 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
151 		.callback = &usie_uc_status_callback,
152 	},
153 	[USIE_UC_RX] = {
154 		.type = UE_BULK,
155 		.endpoint = UE_ADDR_ANY,
156 		.direction = UE_DIR_IN,
157 		.bufsize = USIE_BUFSIZE,
158 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,.proxy_buffer = 1,},
159 		.callback = &usie_uc_rx_callback,
160 	},
161 	[USIE_UC_TX] = {
162 		.type = UE_BULK,
163 		.endpoint = UE_ADDR_ANY,
164 		.direction = UE_DIR_OUT,
165 		.bufsize = USIE_BUFSIZE,
166 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
167 		.callback = &usie_uc_tx_callback,
168 	}
169 };
170 
171 static const struct usb_config usie_if_config[USIE_IF_N_XFER] = {
172 	[USIE_IF_STATUS] = {
173 		.type = UE_INTERRUPT,
174 		.endpoint = UE_ADDR_ANY,
175 		.direction = UE_DIR_IN,
176 		.bufsize = 0,		/* use wMaxPacketSize */
177 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
178 		.callback = &usie_if_status_callback,
179 	},
180 	[USIE_IF_RX] = {
181 		.type = UE_BULK,
182 		.endpoint = UE_ADDR_ANY,
183 		.direction = UE_DIR_IN,
184 		.bufsize = USIE_BUFSIZE,
185 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
186 		.callback = &usie_if_rx_callback,
187 	},
188 	[USIE_IF_TX] = {
189 		.type = UE_BULK,
190 		.endpoint = UE_ADDR_ANY,
191 		.direction = UE_DIR_OUT,
192 		.bufsize = MAX(USIE_BUFSIZE, MCLBYTES),
193 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
194 		.callback = &usie_if_tx_callback,
195 	}
196 };
197 
198 static device_method_t usie_methods[] = {
199 	DEVMETHOD(device_probe, usie_probe),
200 	DEVMETHOD(device_attach, usie_attach),
201 	DEVMETHOD(device_detach, usie_detach),
202 	DEVMETHOD_END
203 };
204 
205 static driver_t usie_driver = {
206 	.name = "usie",
207 	.methods = usie_methods,
208 	.size = sizeof(struct usie_softc),
209 };
210 
211 static eventhandler_tag usie_etag;
212 
213 DRIVER_MODULE(usie, uhub, usie_driver, usie_driver_loaded, NULL);
214 MODULE_DEPEND(usie, ucom, 1, 1, 1);
215 MODULE_DEPEND(usie, usb, 1, 1, 1);
216 MODULE_VERSION(usie, 1);
217 USB_PNP_HOST_INFO(usie_devs);
218 
219 static const struct ucom_callback usie_uc_callback = {
220 	.ucom_cfg_get_status = &usie_uc_cfg_get_status,
221 	.ucom_cfg_set_dtr = &usie_uc_cfg_set_dtr,
222 	.ucom_cfg_set_rts = &usie_uc_cfg_set_rts,
223 	.ucom_cfg_open = &usie_uc_cfg_open,
224 	.ucom_cfg_close = &usie_uc_cfg_close,
225 	.ucom_start_read = &usie_uc_start_read,
226 	.ucom_stop_read = &usie_uc_stop_read,
227 	.ucom_start_write = &usie_uc_start_write,
228 	.ucom_stop_write = &usie_uc_stop_write,
229 	.ucom_free = &usie_free,
230 };
231 
232 static void
233 usie_autoinst(void *arg, struct usb_device *udev,
234     struct usb_attach_arg *uaa)
235 {
236 	struct usb_interface *iface;
237 	struct usb_interface_descriptor *id;
238 	struct usb_device_request req;
239 	int err;
240 
241 	if (uaa->dev_state != UAA_DEV_READY)
242 		return;
243 
244 	iface = usbd_get_iface(udev, 0);
245 	if (iface == NULL)
246 		return;
247 
248 	id = iface->idesc;
249 	if (id == NULL || id->bInterfaceClass != UICLASS_MASS)
250 		return;
251 
252 	if (usbd_lookup_id_by_uaa(usie_devs, sizeof(usie_devs), uaa) != 0)
253 		return;			/* no device match */
254 
255 	if (bootverbose) {
256 		DPRINTF("Ejecting %s %s\n",
257 		    usb_get_manufacturer(udev),
258 		    usb_get_product(udev));
259 	}
260 	req.bmRequestType = UT_VENDOR;
261 	req.bRequest = UR_SET_INTERFACE;
262 	USETW(req.wValue, UF_DEVICE_REMOTE_WAKEUP);
263 	USETW(req.wIndex, UHF_PORT_CONNECTION);
264 	USETW(req.wLength, 0);
265 
266 	/* at this moment there is no mutex */
267 	err = usbd_do_request_flags(udev, NULL, &req,
268 	    NULL, 0, NULL, 250 /* ms */ );
269 
270 	/* success, mark the udev as disappearing */
271 	if (err == 0)
272 		uaa->dev_state = UAA_DEV_EJECTING;
273 }
274 
275 static int
276 usie_probe(device_t self)
277 {
278 	struct usb_attach_arg *uaa = device_get_ivars(self);
279 
280 	if (uaa->usb_mode != USB_MODE_HOST)
281 		return (ENXIO);
282 	if (uaa->info.bConfigIndex != USIE_CNFG_INDEX)
283 		return (ENXIO);
284 	if (uaa->info.bIfaceIndex != USIE_IFACE_INDEX)
285 		return (ENXIO);
286 	if (uaa->info.bInterfaceClass != UICLASS_VENDOR)
287 		return (ENXIO);
288 
289 	return (usbd_lookup_id_by_uaa(usie_devs, sizeof(usie_devs), uaa));
290 }
291 
292 static int
293 usie_attach(device_t self)
294 {
295 	struct usie_softc *sc = device_get_softc(self);
296 	struct usb_attach_arg *uaa = device_get_ivars(self);
297 	if_t ifp;
298 	struct usb_interface *iface;
299 	struct usb_interface_descriptor *id;
300 	struct usb_device_request req;
301 	int err;
302 	uint16_t fwattr;
303 	uint8_t iface_index;
304 	uint8_t ifidx;
305 	uint8_t start;
306 
307 	device_set_usb_desc(self);
308 	sc->sc_udev = uaa->device;
309 	sc->sc_dev = self;
310 
311 	mtx_init(&sc->sc_mtx, "usie", MTX_NETWORK_LOCK, MTX_DEF);
312 	ucom_ref(&sc->sc_super_ucom);
313 
314 	TASK_INIT(&sc->sc_if_status_task, 0, usie_if_status_cb, sc);
315 	TASK_INIT(&sc->sc_if_sync_task, 0, usie_if_sync_cb, sc);
316 
317 	usb_callout_init_mtx(&sc->sc_if_sync_ch, &sc->sc_mtx, 0);
318 
319 	mtx_lock(&sc->sc_mtx);
320 
321 	/* set power mode to D0 */
322 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
323 	req.bRequest = USIE_POWER;
324 	USETW(req.wValue, 0);
325 	USETW(req.wIndex, 0);
326 	USETW(req.wLength, 0);
327 	if (usie_do_request(sc, &req, NULL)) {
328 		mtx_unlock(&sc->sc_mtx);
329 		goto detach;
330 	}
331 	/* read fw attr */
332 	fwattr = 0;
333 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
334 	req.bRequest = USIE_FW_ATTR;
335 	USETW(req.wValue, 0);
336 	USETW(req.wIndex, 0);
337 	USETW(req.wLength, sizeof(fwattr));
338 	if (usie_do_request(sc, &req, &fwattr)) {
339 		mtx_unlock(&sc->sc_mtx);
340 		goto detach;
341 	}
342 	mtx_unlock(&sc->sc_mtx);
343 
344 	/* check DHCP supports */
345 	DPRINTF("fwattr=%x\n", fwattr);
346 	if (!(fwattr & USIE_FW_DHCP)) {
347 		device_printf(self, "DHCP is not supported. A firmware upgrade might be needed.\n");
348 	}
349 
350 	/* find available interfaces */
351 	sc->sc_nucom = 0;
352 	for (ifidx = 0; ifidx < USIE_IFACE_MAX; ifidx++) {
353 		iface = usbd_get_iface(uaa->device, ifidx);
354 		if (iface == NULL)
355 			break;
356 
357 		id = usbd_get_interface_descriptor(iface);
358 		if ((id == NULL) || (id->bInterfaceClass != UICLASS_VENDOR))
359 			continue;
360 
361 		/* setup Direct IP transfer */
362 		if (id->bInterfaceNumber >= 7 && id->bNumEndpoints == 3) {
363 			sc->sc_if_ifnum = id->bInterfaceNumber;
364 			iface_index = ifidx;
365 
366 			DPRINTF("ifnum=%d, ifidx=%d\n",
367 			    sc->sc_if_ifnum, ifidx);
368 
369 			err = usbd_transfer_setup(uaa->device,
370 			    &iface_index, sc->sc_if_xfer, usie_if_config,
371 			    USIE_IF_N_XFER, sc, &sc->sc_mtx);
372 
373 			if (err == 0)
374 				continue;
375 
376 			device_printf(self,
377 			    "could not allocate USB transfers on "
378 			    "iface_index=%d, err=%s\n",
379 			    iface_index, usbd_errstr(err));
380 			goto detach;
381 		}
382 
383 		/* setup ucom */
384 		if (sc->sc_nucom >= USIE_UCOM_MAX)
385 			continue;
386 
387 		usbd_set_parent_iface(uaa->device, ifidx,
388 		    uaa->info.bIfaceIndex);
389 
390 		DPRINTF("NumEndpoints=%d bInterfaceNumber=%d\n",
391 		    id->bNumEndpoints, id->bInterfaceNumber);
392 
393 		if (id->bNumEndpoints == 2) {
394 			sc->sc_uc_xfer[sc->sc_nucom][0] = NULL;
395 			start = 1;
396 		} else
397 			start = 0;
398 
399 		err = usbd_transfer_setup(uaa->device, &ifidx,
400 		    sc->sc_uc_xfer[sc->sc_nucom] + start,
401 		    usie_uc_config + start, USIE_UC_N_XFER - start,
402 		    &sc->sc_ucom[sc->sc_nucom], &sc->sc_mtx);
403 
404 		if (err != 0) {
405 			DPRINTF("usbd_transfer_setup error=%s\n", usbd_errstr(err));
406 			continue;
407 		}
408 
409 		mtx_lock(&sc->sc_mtx);
410 		for (; start < USIE_UC_N_XFER; start++)
411 			usbd_xfer_set_stall(sc->sc_uc_xfer[sc->sc_nucom][start]);
412 		mtx_unlock(&sc->sc_mtx);
413 
414 		sc->sc_uc_ifnum[sc->sc_nucom] = id->bInterfaceNumber;
415 
416 		sc->sc_nucom++;		/* found a port */
417 	}
418 
419 	if (sc->sc_nucom == 0) {
420 		device_printf(self, "no comports found\n");
421 		goto detach;
422 	}
423 
424 	err = ucom_attach(&sc->sc_super_ucom, sc->sc_ucom,
425 	    sc->sc_nucom, sc, &usie_uc_callback, &sc->sc_mtx);
426 
427 	if (err != 0) {
428 		DPRINTF("ucom_attach failed\n");
429 		goto detach;
430 	}
431 	DPRINTF("Found %d interfaces.\n", sc->sc_nucom);
432 
433 	/* setup ifnet (Direct IP) */
434 	sc->sc_ifp = ifp = if_alloc(IFT_OTHER);
435 	if_initname(ifp, "usie", device_get_unit(self));
436 
437 	if_setsoftc(ifp, sc);
438 	if_setmtu(ifp, USIE_MTU_MAX);
439 	if_setflagbits(ifp, IFF_NOARP, 0);
440 	if_setinitfn(ifp, usie_if_init);
441 	if_setioctlfn(ifp, usie_if_ioctl);
442 	if_setstartfn(ifp, usie_if_start);
443 	if_setoutputfn(ifp, usie_if_output);
444 	if_setsendqlen(ifp, ifqmaxlen);
445 	if_setsendqready(ifp);
446 
447 	if_attach(ifp);
448 	bpfattach(ifp, DLT_RAW, 0);
449 
450 	if (fwattr & USIE_PM_AUTO) {
451 		usbd_set_power_mode(uaa->device, USB_POWER_MODE_SAVE);
452 		DPRINTF("enabling automatic suspend and resume\n");
453 	} else {
454 		usbd_set_power_mode(uaa->device, USB_POWER_MODE_ON);
455 		DPRINTF("USB power is always ON\n");
456 	}
457 
458 	DPRINTF("device attached\n");
459 	return (0);
460 
461 detach:
462 	usie_detach(self);
463 	return (ENOMEM);
464 }
465 
466 static int
467 usie_detach(device_t self)
468 {
469 	struct usie_softc *sc = device_get_softc(self);
470 	uint8_t x;
471 
472 	/* detach ifnet */
473 	if (sc->sc_ifp != NULL) {
474 		usie_if_stop(sc);
475 		usbd_transfer_unsetup(sc->sc_if_xfer, USIE_IF_N_XFER);
476 		bpfdetach(sc->sc_ifp);
477 		if_detach(sc->sc_ifp);
478 		if_free(sc->sc_ifp);
479 		sc->sc_ifp = NULL;
480 	}
481 	/* detach ucom */
482 	if (sc->sc_nucom > 0)
483 		ucom_detach(&sc->sc_super_ucom, sc->sc_ucom);
484 
485 	/* stop all USB transfers */
486 	usbd_transfer_unsetup(sc->sc_if_xfer, USIE_IF_N_XFER);
487 
488 	for (x = 0; x != USIE_UCOM_MAX; x++)
489 		usbd_transfer_unsetup(sc->sc_uc_xfer[x], USIE_UC_N_XFER);
490 
491 	device_claim_softc(self);
492 
493 	usie_free_softc(sc);
494 
495 	return (0);
496 }
497 
498 UCOM_UNLOAD_DRAIN(usie);
499 
500 static void
501 usie_free_softc(struct usie_softc *sc)
502 {
503 	if (ucom_unref(&sc->sc_super_ucom)) {
504 		mtx_destroy(&sc->sc_mtx);
505 		device_free_softc(sc);
506 	}
507 }
508 
509 static void
510 usie_free(struct ucom_softc *ucom)
511 {
512 	usie_free_softc(ucom->sc_parent);
513 }
514 
515 static void
516 usie_uc_update_line_state(struct ucom_softc *ucom, uint8_t ls)
517 {
518 	struct usie_softc *sc = ucom->sc_parent;
519 	struct usb_device_request req;
520 
521 	if (sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_STATUS] == NULL)
522 		return;
523 
524 	req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
525 	req.bRequest = USIE_LINK_STATE;
526 	USETW(req.wValue, ls);
527 	USETW(req.wIndex, sc->sc_uc_ifnum[ucom->sc_subunit]);
528 	USETW(req.wLength, 0);
529 
530 	DPRINTF("sc_uc_ifnum=%d\n", sc->sc_uc_ifnum[ucom->sc_subunit]);
531 
532 	usie_do_request(sc, &req, NULL);
533 }
534 
535 static void
536 usie_uc_cfg_get_status(struct ucom_softc *ucom, uint8_t *lsr, uint8_t *msr)
537 {
538 	struct usie_softc *sc = ucom->sc_parent;
539 
540 	*msr = sc->sc_msr;
541 	*lsr = sc->sc_lsr;
542 }
543 
544 static void
545 usie_uc_cfg_set_dtr(struct ucom_softc *ucom, uint8_t flag)
546 {
547 	uint8_t dtr;
548 
549 	dtr = flag ? USIE_LS_DTR : 0;
550 	usie_uc_update_line_state(ucom, dtr);
551 }
552 
553 static void
554 usie_uc_cfg_set_rts(struct ucom_softc *ucom, uint8_t flag)
555 {
556 	uint8_t rts;
557 
558 	rts = flag ? USIE_LS_RTS : 0;
559 	usie_uc_update_line_state(ucom, rts);
560 }
561 
562 static void
563 usie_uc_cfg_open(struct ucom_softc *ucom)
564 {
565 	struct usie_softc *sc = ucom->sc_parent;
566 
567 	/* usbd_transfer_start() is NULL safe */
568 
569 	usbd_transfer_start(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_STATUS]);
570 }
571 
572 static void
573 usie_uc_cfg_close(struct ucom_softc *ucom)
574 {
575 	struct usie_softc *sc = ucom->sc_parent;
576 
577 	usbd_transfer_stop(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_STATUS]);
578 }
579 
580 static void
581 usie_uc_start_read(struct ucom_softc *ucom)
582 {
583 	struct usie_softc *sc = ucom->sc_parent;
584 
585 	usbd_transfer_start(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_RX]);
586 }
587 
588 static void
589 usie_uc_stop_read(struct ucom_softc *ucom)
590 {
591 	struct usie_softc *sc = ucom->sc_parent;
592 
593 	usbd_transfer_stop(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_RX]);
594 }
595 
596 static void
597 usie_uc_start_write(struct ucom_softc *ucom)
598 {
599 	struct usie_softc *sc = ucom->sc_parent;
600 
601 	usbd_transfer_start(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_TX]);
602 }
603 
604 static void
605 usie_uc_stop_write(struct ucom_softc *ucom)
606 {
607 	struct usie_softc *sc = ucom->sc_parent;
608 
609 	usbd_transfer_stop(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_TX]);
610 }
611 
612 static void
613 usie_uc_rx_callback(struct usb_xfer *xfer, usb_error_t error)
614 {
615 	struct ucom_softc *ucom = usbd_xfer_softc(xfer);
616 	struct usie_softc *sc = ucom->sc_parent;
617 	struct usb_page_cache *pc;
618 	uint32_t actlen;
619 
620 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
621 
622 	switch (USB_GET_STATE(xfer)) {
623 	case USB_ST_TRANSFERRED:
624 		pc = usbd_xfer_get_frame(xfer, 0);
625 
626 		/* handle CnS response */
627 		if (ucom == sc->sc_ucom && actlen >= USIE_HIPCNS_MIN) {
628 			DPRINTF("transferred=%u\n", actlen);
629 
630 			/* check if it is really CnS reply */
631 			usbd_copy_out(pc, 0, sc->sc_resp_temp, 1);
632 
633 			if (sc->sc_resp_temp[0] == USIE_HIP_FRM_CHR) {
634 				/* verify actlen */
635 				if (actlen > USIE_BUFSIZE)
636 					actlen = USIE_BUFSIZE;
637 
638 				/* get complete message */
639 				usbd_copy_out(pc, 0, sc->sc_resp_temp, actlen);
640 				usie_hip_rsp(sc, sc->sc_resp_temp, actlen);
641 
642 				/* need to fall though */
643 				goto tr_setup;
644 			}
645 			/* else call ucom_put_data() */
646 		}
647 		/* standard ucom transfer */
648 		ucom_put_data(ucom, pc, 0, actlen);
649 
650 		/* fall though */
651 	case USB_ST_SETUP:
652 tr_setup:
653 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
654 		usbd_transfer_submit(xfer);
655 		break;
656 
657 	default:			/* Error */
658 		if (error != USB_ERR_CANCELLED) {
659 			usbd_xfer_set_stall(xfer);
660 			goto tr_setup;
661 		}
662 		break;
663 	}
664 }
665 
666 static void
667 usie_uc_tx_callback(struct usb_xfer *xfer, usb_error_t error)
668 {
669 	struct ucom_softc *ucom = usbd_xfer_softc(xfer);
670 	struct usb_page_cache *pc;
671 	uint32_t actlen;
672 
673 	switch (USB_GET_STATE(xfer)) {
674 	case USB_ST_TRANSFERRED:
675 	case USB_ST_SETUP:
676 tr_setup:
677 		pc = usbd_xfer_get_frame(xfer, 0);
678 
679 		/* handle CnS request */
680 		struct mbuf *m = usbd_xfer_get_priv(xfer);
681 
682 		if (m != NULL) {
683 			usbd_m_copy_in(pc, 0, m, 0, m->m_pkthdr.len);
684 			usbd_xfer_set_frame_len(xfer, 0, m->m_pkthdr.len);
685 			usbd_xfer_set_priv(xfer, NULL);
686 			usbd_transfer_submit(xfer);
687 			m_freem(m);
688 			break;
689 		}
690 		/* standard ucom transfer */
691 		if (ucom_get_data(ucom, pc, 0, USIE_BUFSIZE, &actlen)) {
692 			usbd_xfer_set_frame_len(xfer, 0, actlen);
693 			usbd_transfer_submit(xfer);
694 		}
695 		break;
696 
697 	default:			/* Error */
698 		if (error != USB_ERR_CANCELLED) {
699 			usbd_xfer_set_stall(xfer);
700 			goto tr_setup;
701 		}
702 		break;
703 	}
704 }
705 
706 static void
707 usie_uc_status_callback(struct usb_xfer *xfer, usb_error_t error)
708 {
709 	struct usb_page_cache *pc;
710 	struct {
711 		struct usb_device_request req;
712 		uint16_t param;
713 	}      st;
714 	uint32_t actlen;
715 	uint16_t param;
716 
717 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
718 
719 	switch (USB_GET_STATE(xfer)) {
720 	case USB_ST_TRANSFERRED:
721 		DPRINTFN(4, "info received, actlen=%u\n", actlen);
722 
723 		if (actlen < sizeof(st)) {
724 			DPRINTF("data too short actlen=%u\n", actlen);
725 			goto tr_setup;
726 		}
727 		pc = usbd_xfer_get_frame(xfer, 0);
728 		usbd_copy_out(pc, 0, &st, sizeof(st));
729 
730 		if (st.req.bmRequestType == 0xa1 && st.req.bRequest == 0x20) {
731 			struct ucom_softc *ucom = usbd_xfer_softc(xfer);
732 			struct usie_softc *sc = ucom->sc_parent;
733 
734 			param = le16toh(st.param);
735 			DPRINTF("param=%x\n", param);
736 			sc->sc_msr = sc->sc_lsr = 0;
737 			sc->sc_msr |= (param & USIE_DCD) ? SER_DCD : 0;
738 			sc->sc_msr |= (param & USIE_DSR) ? SER_DSR : 0;
739 			sc->sc_msr |= (param & USIE_RI) ? SER_RI : 0;
740 			sc->sc_msr |= (param & USIE_CTS) ? 0 : SER_CTS;
741 			sc->sc_msr |= (param & USIE_RTS) ? SER_RTS : 0;
742 			sc->sc_msr |= (param & USIE_DTR) ? SER_DTR : 0;
743 		}
744 		/* fall though */
745 	case USB_ST_SETUP:
746 tr_setup:
747 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
748 		usbd_transfer_submit(xfer);
749 		break;
750 
751 	default:			/* Error */
752 		DPRINTF("USB transfer error, %s\n",
753 		    usbd_errstr(error));
754 
755 		if (error != USB_ERR_CANCELLED) {
756 			usbd_xfer_set_stall(xfer);
757 			goto tr_setup;
758 		}
759 		break;
760 	}
761 }
762 
763 static void
764 usie_if_rx_callback(struct usb_xfer *xfer, usb_error_t error)
765 {
766 	struct epoch_tracker et;
767 	struct usie_softc *sc = usbd_xfer_softc(xfer);
768 	if_t ifp = sc->sc_ifp;
769 	struct mbuf *m0;
770 	struct mbuf *m = NULL;
771 	struct usie_desc *rxd;
772 	uint32_t actlen;
773 	uint16_t err;
774 	uint16_t pkt;
775 	uint16_t ipl;
776 	uint16_t len;
777 	uint16_t diff;
778 	uint8_t pad;
779 	uint8_t ipv;
780 
781 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
782 
783 	switch (USB_GET_STATE(xfer)) {
784 	case USB_ST_TRANSFERRED:
785 		DPRINTFN(15, "rx done, actlen=%u\n", actlen);
786 
787 		if (actlen < sizeof(struct usie_hip)) {
788 			DPRINTF("data too short %u\n", actlen);
789 			goto tr_setup;
790 		}
791 		m = sc->sc_rxm;
792 		sc->sc_rxm = NULL;
793 
794 		/* fall though */
795 	case USB_ST_SETUP:
796 tr_setup:
797 
798 		if (sc->sc_rxm == NULL) {
799 			sc->sc_rxm = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR,
800 			    MJUMPAGESIZE /* could be bigger than MCLBYTES */ );
801 		}
802 		if (sc->sc_rxm == NULL) {
803 			DPRINTF("could not allocate Rx mbuf\n");
804 			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
805 			usbd_xfer_set_stall(xfer);
806 			usbd_xfer_set_frames(xfer, 0);
807 		} else {
808 			/*
809 			 * Directly loading a mbuf cluster into DMA to
810 			 * save some data copying. This works because
811 			 * there is only one cluster.
812 			 */
813 			usbd_xfer_set_frame_data(xfer, 0,
814 			    mtod(sc->sc_rxm, caddr_t), MIN(MJUMPAGESIZE, USIE_RXSZ_MAX));
815 			usbd_xfer_set_frames(xfer, 1);
816 		}
817 		usbd_transfer_submit(xfer);
818 		break;
819 
820 	default:			/* Error */
821 		DPRINTF("USB transfer error, %s\n", usbd_errstr(error));
822 
823 		if (error != USB_ERR_CANCELLED) {
824 			/* try to clear stall first */
825 			usbd_xfer_set_stall(xfer);
826 			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
827 			goto tr_setup;
828 		}
829 		if (sc->sc_rxm != NULL) {
830 			m_freem(sc->sc_rxm);
831 			sc->sc_rxm = NULL;
832 		}
833 		break;
834 	}
835 
836 	if (m == NULL)
837 		return;
838 
839 	mtx_unlock(&sc->sc_mtx);
840 
841 	m->m_pkthdr.len = m->m_len = actlen;
842 
843 	err = pkt = 0;
844 
845 	/* HW can aggregate multiple frames in a single USB xfer */
846 	NET_EPOCH_ENTER(et);
847 	for (;;) {
848 		rxd = mtod(m, struct usie_desc *);
849 
850 		len = be16toh(rxd->hip.len) & USIE_HIP_IP_LEN_MASK;
851 		pad = (rxd->hip.id & USIE_HIP_PAD) ? 1 : 0;
852 		ipl = (len - pad - ETHER_HDR_LEN);
853 		if (ipl >= len) {
854 			DPRINTF("Corrupt frame\n");
855 			m_freem(m);
856 			break;
857 		}
858 		diff = sizeof(struct usie_desc) + ipl + pad;
859 
860 		if (((rxd->hip.id & USIE_HIP_MASK) != USIE_HIP_IP) ||
861 		    (be16toh(rxd->desc_type) & USIE_TYPE_MASK) != USIE_IP_RX) {
862 			DPRINTF("received wrong type of packet\n");
863 			m->m_data += diff;
864 			m->m_pkthdr.len = (m->m_len -= diff);
865 			err++;
866 			if (m->m_pkthdr.len > 0)
867 				continue;
868 			m_freem(m);
869 			break;
870 		}
871 		switch (be16toh(rxd->ethhdr.ether_type)) {
872 		case ETHERTYPE_IP:
873 			ipv = NETISR_IP;
874 			break;
875 #ifdef INET6
876 		case ETHERTYPE_IPV6:
877 			ipv = NETISR_IPV6;
878 			break;
879 #endif
880 		default:
881 			DPRINTF("unsupported ether type\n");
882 			err++;
883 			break;
884 		}
885 
886 		/* the last packet */
887 		if (m->m_pkthdr.len <= diff) {
888 			m->m_data += (sizeof(struct usie_desc) + pad);
889 			m->m_pkthdr.len = m->m_len = ipl;
890 			m->m_pkthdr.rcvif = ifp;
891 			BPF_MTAP(sc->sc_ifp, m);
892 			netisr_dispatch(ipv, m);
893 			break;
894 		}
895 		/* copy aggregated frames to another mbuf */
896 		m0 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
897 		if (__predict_false(m0 == NULL)) {
898 			DPRINTF("could not allocate mbuf\n");
899 			err++;
900 			m_freem(m);
901 			break;
902 		}
903 		m_copydata(m, sizeof(struct usie_desc) + pad, ipl, mtod(m0, caddr_t));
904 		m0->m_pkthdr.rcvif = ifp;
905 		m0->m_pkthdr.len = m0->m_len = ipl;
906 
907 		BPF_MTAP(sc->sc_ifp, m0);
908 		netisr_dispatch(ipv, m0);
909 
910 		m->m_data += diff;
911 		m->m_pkthdr.len = (m->m_len -= diff);
912 	}
913 	NET_EPOCH_EXIT(et);
914 
915 	mtx_lock(&sc->sc_mtx);
916 
917 	if_inc_counter(ifp, IFCOUNTER_IERRORS, err);
918 	if_inc_counter(ifp, IFCOUNTER_IPACKETS, pkt);
919 }
920 
921 static void
922 usie_if_tx_callback(struct usb_xfer *xfer, usb_error_t error)
923 {
924 	struct usie_softc *sc = usbd_xfer_softc(xfer);
925 	struct usb_page_cache *pc;
926 	if_t ifp = sc->sc_ifp;
927 	struct mbuf *m;
928 	uint16_t size;
929 
930 	switch (USB_GET_STATE(xfer)) {
931 	case USB_ST_TRANSFERRED:
932 		DPRINTFN(11, "transfer complete\n");
933 		if_setdrvflagbits(ifp, 0, IFF_DRV_OACTIVE);
934 		if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
935 
936 		/* fall though */
937 	case USB_ST_SETUP:
938 tr_setup:
939 
940 		if ((if_getdrvflags(ifp) & IFF_DRV_RUNNING) == 0)
941 			break;
942 
943 		m = if_dequeue(ifp);
944 		if (m == NULL)
945 			break;
946 
947 		if (m->m_pkthdr.len > (int)(MCLBYTES - ETHER_HDR_LEN +
948 		    ETHER_CRC_LEN - sizeof(sc->sc_txd))) {
949 			DPRINTF("packet len is too big: %d\n",
950 			    m->m_pkthdr.len);
951 			break;
952 		}
953 		pc = usbd_xfer_get_frame(xfer, 0);
954 
955 		sc->sc_txd.hip.len = htobe16(m->m_pkthdr.len +
956 		    ETHER_HDR_LEN + ETHER_CRC_LEN);
957 		size = sizeof(sc->sc_txd);
958 
959 		usbd_copy_in(pc, 0, &sc->sc_txd, size);
960 		usbd_m_copy_in(pc, size, m, 0, m->m_pkthdr.len);
961 		usbd_xfer_set_frame_len(xfer, 0, m->m_pkthdr.len +
962 		    size + ETHER_CRC_LEN);
963 
964 		BPF_MTAP(ifp, m);
965 
966 		m_freem(m);
967 
968 		usbd_transfer_submit(xfer);
969 		break;
970 
971 	default:			/* Error */
972 		DPRINTF("USB transfer error, %s\n",
973 		    usbd_errstr(error));
974 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
975 
976 		if (error != USB_ERR_CANCELLED) {
977 			usbd_xfer_set_stall(xfer);
978 			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
979 			goto tr_setup;
980 		}
981 		break;
982 	}
983 }
984 
985 static void
986 usie_if_status_callback(struct usb_xfer *xfer, usb_error_t error)
987 {
988 	struct usie_softc *sc = usbd_xfer_softc(xfer);
989 	struct usb_page_cache *pc;
990 	struct usb_cdc_notification cdc;
991 	uint32_t actlen;
992 
993 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
994 
995 	switch (USB_GET_STATE(xfer)) {
996 	case USB_ST_TRANSFERRED:
997 		DPRINTFN(4, "info received, actlen=%d\n", actlen);
998 
999 		/* usb_cdc_notification - .data[16] */
1000 		if (actlen < (sizeof(cdc) - 16)) {
1001 			DPRINTF("data too short %d\n", actlen);
1002 			goto tr_setup;
1003 		}
1004 		pc = usbd_xfer_get_frame(xfer, 0);
1005 		usbd_copy_out(pc, 0, &cdc, (sizeof(cdc) - 16));
1006 
1007 		DPRINTFN(4, "bNotification=%x\n", cdc.bNotification);
1008 
1009 		if (cdc.bNotification & UCDC_N_RESPONSE_AVAILABLE) {
1010 			taskqueue_enqueue(taskqueue_thread,
1011 			    &sc->sc_if_status_task);
1012 		}
1013 		/* fall though */
1014 	case USB_ST_SETUP:
1015 tr_setup:
1016 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1017 		usbd_transfer_submit(xfer);
1018 		break;
1019 
1020 	default:			/* Error */
1021 		DPRINTF("USB transfer error, %s\n",
1022 		    usbd_errstr(error));
1023 
1024 		if (error != USB_ERR_CANCELLED) {
1025 			usbd_xfer_set_stall(xfer);
1026 			goto tr_setup;
1027 		}
1028 		break;
1029 	}
1030 }
1031 
1032 static void
1033 usie_if_sync_to(void *arg)
1034 {
1035 	struct usie_softc *sc = arg;
1036 
1037 	taskqueue_enqueue(taskqueue_thread, &sc->sc_if_sync_task);
1038 }
1039 
1040 static void
1041 usie_if_sync_cb(void *arg, int pending)
1042 {
1043 	struct usie_softc *sc = arg;
1044 
1045 	mtx_lock(&sc->sc_mtx);
1046 
1047 	/* call twice */
1048 	usie_if_cmd(sc, USIE_HIP_SYNC2M);
1049 	usie_if_cmd(sc, USIE_HIP_SYNC2M);
1050 
1051 	usb_callout_reset(&sc->sc_if_sync_ch, 2 * hz, usie_if_sync_to, sc);
1052 
1053 	mtx_unlock(&sc->sc_mtx);
1054 }
1055 
1056 static void
1057 usie_if_status_cb(void *arg, int pending)
1058 {
1059 	struct usie_softc *sc = arg;
1060 	if_t ifp = sc->sc_ifp;
1061 	struct usb_device_request req;
1062 	struct usie_hip *hip;
1063 	struct usie_lsi *lsi;
1064 	uint16_t actlen;
1065 	uint8_t ntries;
1066 	uint8_t pad;
1067 
1068 	mtx_lock(&sc->sc_mtx);
1069 
1070 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
1071 	req.bRequest = UCDC_GET_ENCAPSULATED_RESPONSE;
1072 	USETW(req.wValue, 0);
1073 	USETW(req.wIndex, sc->sc_if_ifnum);
1074 	USETW(req.wLength, sizeof(sc->sc_status_temp));
1075 
1076 	for (ntries = 0; ntries != 10; ntries++) {
1077 		int err;
1078 
1079 		err = usbd_do_request_flags(sc->sc_udev,
1080 		    &sc->sc_mtx, &req, sc->sc_status_temp, USB_SHORT_XFER_OK,
1081 		    &actlen, USB_DEFAULT_TIMEOUT);
1082 
1083 		if (err == 0)
1084 			break;
1085 
1086 		DPRINTF("Control request failed: %s %d/10\n",
1087 		    usbd_errstr(err), ntries);
1088 
1089 		usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(10));
1090 	}
1091 
1092 	if (ntries == 10) {
1093 		mtx_unlock(&sc->sc_mtx);
1094 		DPRINTF("Timeout\n");
1095 		return;
1096 	}
1097 
1098 	hip = (struct usie_hip *)sc->sc_status_temp;
1099 
1100 	pad = (hip->id & USIE_HIP_PAD) ? 1 : 0;
1101 
1102 	DPRINTF("hip.id=%x hip.len=%d actlen=%u pad=%d\n",
1103 	    hip->id, be16toh(hip->len), actlen, pad);
1104 
1105 	switch (hip->id & USIE_HIP_MASK) {
1106 	case USIE_HIP_SYNC2H:
1107 		usie_if_cmd(sc, USIE_HIP_SYNC2M);
1108 		break;
1109 	case USIE_HIP_RESTR:
1110 		usb_callout_stop(&sc->sc_if_sync_ch);
1111 		break;
1112 	case USIE_HIP_UMTS:
1113 		lsi = (struct usie_lsi *)(
1114 		    sc->sc_status_temp + sizeof(struct usie_hip) + pad);
1115 
1116 		DPRINTF("lsi.proto=%x lsi.len=%d\n", lsi->proto,
1117 		    be16toh(lsi->len));
1118 
1119 		if (lsi->proto != USIE_LSI_UMTS)
1120 			break;
1121 
1122 		if (lsi->area == USIE_LSI_AREA_NO ||
1123 		    lsi->area == USIE_LSI_AREA_NODATA) {
1124 			device_printf(sc->sc_dev, "no service available\n");
1125 			break;
1126 		}
1127 		if (lsi->state == USIE_LSI_STATE_IDLE) {
1128 			DPRINTF("lsi.state=%x\n", lsi->state);
1129 			break;
1130 		}
1131 		DPRINTF("ctx=%x\n", hip->param);
1132 		sc->sc_txd.hip.param = hip->param;
1133 
1134 		sc->sc_net.addr_len = lsi->pdp_addr_len;
1135 		memcpy(&sc->sc_net.dns1_addr, &lsi->dns1_addr, 16);
1136 		memcpy(&sc->sc_net.dns2_addr, &lsi->dns2_addr, 16);
1137 		memcpy(sc->sc_net.pdp_addr, lsi->pdp_addr, 16);
1138 		memcpy(sc->sc_net.gw_addr, lsi->gw_addr, 16);
1139 		if_setflagbits(ifp, IFF_UP, 0);
1140 		if_setdrvflagbits(ifp, IFF_DRV_RUNNING, 0);
1141 
1142 		device_printf(sc->sc_dev, "IP Addr=%d.%d.%d.%d\n",
1143 		    *lsi->pdp_addr, *(lsi->pdp_addr + 1),
1144 		    *(lsi->pdp_addr + 2), *(lsi->pdp_addr + 3));
1145 		device_printf(sc->sc_dev, "Gateway Addr=%d.%d.%d.%d\n",
1146 		    *lsi->gw_addr, *(lsi->gw_addr + 1),
1147 		    *(lsi->gw_addr + 2), *(lsi->gw_addr + 3));
1148 		device_printf(sc->sc_dev, "Prim NS Addr=%d.%d.%d.%d\n",
1149 		    *lsi->dns1_addr, *(lsi->dns1_addr + 1),
1150 		    *(lsi->dns1_addr + 2), *(lsi->dns1_addr + 3));
1151 		device_printf(sc->sc_dev, "Scnd NS Addr=%d.%d.%d.%d\n",
1152 		    *lsi->dns2_addr, *(lsi->dns2_addr + 1),
1153 		    *(lsi->dns2_addr + 2), *(lsi->dns2_addr + 3));
1154 
1155 		usie_cns_req(sc, USIE_CNS_ID_RSSI, USIE_CNS_OB_RSSI);
1156 		break;
1157 
1158 	case USIE_HIP_RCGI:
1159 		/* ignore, workaround for sloppy windows */
1160 		break;
1161 	default:
1162 		DPRINTF("undefined msgid: %x\n", hip->id);
1163 		break;
1164 	}
1165 
1166 	mtx_unlock(&sc->sc_mtx);
1167 }
1168 
1169 static void
1170 usie_if_start(if_t ifp)
1171 {
1172 	struct usie_softc *sc = if_getsoftc(ifp);
1173 
1174 	if (!(if_getdrvflags(ifp) & IFF_DRV_RUNNING)) {
1175 		DPRINTF("Not running\n");
1176 		return;
1177 	}
1178 	mtx_lock(&sc->sc_mtx);
1179 	usbd_transfer_start(sc->sc_if_xfer[USIE_IF_TX]);
1180 	mtx_unlock(&sc->sc_mtx);
1181 
1182 	DPRINTFN(3, "interface started\n");
1183 }
1184 
1185 static int
1186 usie_if_output(if_t ifp, struct mbuf *m, const struct sockaddr *dst,
1187     struct route *ro)
1188 {
1189 	int err;
1190 
1191 	DPRINTF("proto=%x\n", dst->sa_family);
1192 
1193 	switch (dst->sa_family) {
1194 #ifdef INET6
1195 	case AF_INET6:
1196 	/* fall though */
1197 #endif
1198 	case AF_INET:
1199 		break;
1200 
1201 		/* silently drop dhclient packets */
1202 	case AF_UNSPEC:
1203 		m_freem(m);
1204 		return (0);
1205 
1206 		/* drop other packet types */
1207 	default:
1208 		m_freem(m);
1209 		return (EAFNOSUPPORT);
1210 	}
1211 
1212 	err = if_transmit(ifp, m);
1213 	if (err) {
1214 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1215 		return (ENOBUFS);
1216 	}
1217 	if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
1218 
1219 	return (0);
1220 }
1221 
1222 static void
1223 usie_if_init(void *arg)
1224 {
1225 	struct usie_softc *sc = arg;
1226 	if_t ifp = sc->sc_ifp;
1227 	uint8_t i;
1228 
1229 	mtx_lock(&sc->sc_mtx);
1230 
1231 	/* write tx descriptor */
1232 	sc->sc_txd.hip.id = USIE_HIP_CTX;
1233 	sc->sc_txd.hip.param = 0;	/* init value */
1234 	sc->sc_txd.desc_type = htobe16(USIE_IP_TX);
1235 
1236 	for (i = 0; i != USIE_IF_N_XFER; i++)
1237 		usbd_xfer_set_stall(sc->sc_if_xfer[i]);
1238 
1239 	usbd_transfer_start(sc->sc_uc_xfer[USIE_HIP_IF][USIE_UC_RX]);
1240 	usbd_transfer_start(sc->sc_if_xfer[USIE_IF_STATUS]);
1241 	usbd_transfer_start(sc->sc_if_xfer[USIE_IF_RX]);
1242 
1243 	/* if not running, initiate the modem */
1244 	if (!(if_getdrvflags(ifp) & IFF_DRV_RUNNING))
1245 		usie_cns_req(sc, USIE_CNS_ID_INIT, USIE_CNS_OB_LINK_UPDATE);
1246 
1247 	mtx_unlock(&sc->sc_mtx);
1248 
1249 	DPRINTF("ifnet initialized\n");
1250 }
1251 
1252 static void
1253 usie_if_stop(struct usie_softc *sc)
1254 {
1255 	usb_callout_drain(&sc->sc_if_sync_ch);
1256 
1257 	mtx_lock(&sc->sc_mtx);
1258 
1259 	/* usie_cns_req() clears IFF_* flags */
1260 	usie_cns_req(sc, USIE_CNS_ID_STOP, USIE_CNS_OB_LINK_UPDATE);
1261 
1262 	usbd_transfer_stop(sc->sc_if_xfer[USIE_IF_TX]);
1263 	usbd_transfer_stop(sc->sc_if_xfer[USIE_IF_RX]);
1264 	usbd_transfer_stop(sc->sc_if_xfer[USIE_IF_STATUS]);
1265 
1266 	/* shutdown device */
1267 	usie_if_cmd(sc, USIE_HIP_DOWN);
1268 
1269 	mtx_unlock(&sc->sc_mtx);
1270 }
1271 
1272 static int
1273 usie_if_ioctl(if_t ifp, u_long cmd, caddr_t data)
1274 {
1275 	struct usie_softc *sc = if_getsoftc(ifp);
1276 	struct ieee80211req *ireq;
1277 	struct ieee80211req_sta_info si;
1278 	struct ifmediareq *ifmr;
1279 
1280 	switch (cmd) {
1281 	case SIOCSIFFLAGS:
1282 		if (if_getflags(ifp) & IFF_UP) {
1283 			if (!(if_getdrvflags(ifp) & IFF_DRV_RUNNING))
1284 				usie_if_init(sc);
1285 		} else {
1286 			if (if_getdrvflags(ifp) & IFF_DRV_RUNNING)
1287 				usie_if_stop(sc);
1288 		}
1289 		break;
1290 
1291 	case SIOCSIFCAP:
1292 		if (!(if_getdrvflags(ifp) & IFF_DRV_RUNNING)) {
1293 			device_printf(sc->sc_dev,
1294 			    "Connect to the network first.\n");
1295 			break;
1296 		}
1297 		mtx_lock(&sc->sc_mtx);
1298 		usie_cns_req(sc, USIE_CNS_ID_RSSI, USIE_CNS_OB_RSSI);
1299 		mtx_unlock(&sc->sc_mtx);
1300 		break;
1301 
1302 	case SIOCG80211:
1303 		ireq = (struct ieee80211req *)data;
1304 
1305 		if (ireq->i_type != IEEE80211_IOC_STA_INFO)
1306 			break;
1307 
1308 		memset(&si, 0, sizeof(si));
1309 		si.isi_len = sizeof(si);
1310 		/*
1311 		 * ifconfig expects RSSI in 0.5dBm units
1312 		 * relative to the noise floor.
1313 		 */
1314 		si.isi_rssi = 2 * sc->sc_rssi;
1315 		if (copyout(&si, (uint8_t *)ireq->i_data + 8,
1316 		    sizeof(struct ieee80211req_sta_info)))
1317 			DPRINTF("copyout failed\n");
1318 		DPRINTF("80211\n");
1319 		break;
1320 
1321 	case SIOCGIFMEDIA:		/* to fool ifconfig */
1322 		ifmr = (struct ifmediareq *)data;
1323 		ifmr->ifm_count = 1;
1324 		DPRINTF("media\n");
1325 		break;
1326 
1327 	case SIOCSIFADDR:
1328 		break;
1329 
1330 	default:
1331 		return (EINVAL);
1332 	}
1333 	return (0);
1334 }
1335 
1336 static int
1337 usie_do_request(struct usie_softc *sc, struct usb_device_request *req,
1338     void *data)
1339 {
1340 	int err = 0;
1341 	int ntries;
1342 
1343 	mtx_assert(&sc->sc_mtx, MA_OWNED);
1344 
1345 	for (ntries = 0; ntries != 10; ntries++) {
1346 		err = usbd_do_request(sc->sc_udev,
1347 		    &sc->sc_mtx, req, data);
1348 		if (err == 0)
1349 			break;
1350 
1351 		DPRINTF("Control request failed: %s %d/10\n",
1352 		    usbd_errstr(err), ntries);
1353 
1354 		usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(10));
1355 	}
1356 	return (err);
1357 }
1358 
1359 static int
1360 usie_if_cmd(struct usie_softc *sc, uint8_t cmd)
1361 {
1362 	struct usb_device_request req;
1363 	struct usie_hip msg;
1364 
1365 	msg.len = 0;
1366 	msg.id = cmd;
1367 	msg.param = 0;
1368 
1369 	req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1370 	req.bRequest = UCDC_SEND_ENCAPSULATED_COMMAND;
1371 	USETW(req.wValue, 0);
1372 	USETW(req.wIndex, sc->sc_if_ifnum);
1373 	USETW(req.wLength, sizeof(msg));
1374 
1375 	DPRINTF("cmd=%x\n", cmd);
1376 
1377 	return (usie_do_request(sc, &req, &msg));
1378 }
1379 
1380 static void
1381 usie_cns_req(struct usie_softc *sc, uint32_t id, uint16_t obj)
1382 {
1383 	if_t ifp = sc->sc_ifp;
1384 	struct mbuf *m;
1385 	struct usb_xfer *xfer;
1386 	struct usie_hip *hip;
1387 	struct usie_cns *cns;
1388 	uint8_t *param;
1389 	uint8_t *tmp;
1390 	uint8_t cns_len;
1391 
1392 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1393 	if (__predict_false(m == NULL)) {
1394 		DPRINTF("could not allocate mbuf\n");
1395 		if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1396 		return;
1397 	}
1398 	/* to align usie_hip{} on 32 bit */
1399 	m->m_data += 3;
1400 	param = mtod(m, uint8_t *);
1401 	*param++ = USIE_HIP_FRM_CHR;
1402 	hip = (struct usie_hip *)param;
1403 	cns = (struct usie_cns *)(hip + 1);
1404 
1405 	tmp = param + USIE_HIPCNS_MIN - 2;
1406 
1407 	switch (obj) {
1408 	case USIE_CNS_OB_LINK_UPDATE:
1409 		cns_len = 2;
1410 		cns->op = USIE_CNS_OP_SET;
1411 		*tmp++ = 1;		/* profile ID, always use 1 for now */
1412 		*tmp++ = id == USIE_CNS_ID_INIT ? 1 : 0;
1413 		break;
1414 
1415 	case USIE_CNS_OB_PROF_WRITE:
1416 		cns_len = 245;
1417 		cns->op = USIE_CNS_OP_SET;
1418 		*tmp++ = 1;		/* profile ID, always use 1 for now */
1419 		*tmp++ = 2;
1420 		memcpy(tmp, &sc->sc_net, 34);
1421 		memset(tmp + 35, 0, 245 - 36);
1422 		tmp += 243;
1423 		break;
1424 
1425 	case USIE_CNS_OB_RSSI:
1426 		cns_len = 0;
1427 		cns->op = USIE_CNS_OP_REQ;
1428 		break;
1429 
1430 	default:
1431 		DPRINTF("unsupported CnS object type\n");
1432 		return;
1433 	}
1434 	*tmp = USIE_HIP_FRM_CHR;
1435 
1436 	hip->len = htobe16(sizeof(struct usie_cns) + cns_len);
1437 	hip->id = USIE_HIP_CNS2M;
1438 	hip->param = 0;			/* none for CnS */
1439 
1440 	cns->obj = htobe16(obj);
1441 	cns->id = htobe32(id);
1442 	cns->len = cns_len;
1443 	cns->rsv0 = cns->rsv1 = 0;	/* always '0' */
1444 
1445 	param = (uint8_t *)(cns + 1);
1446 
1447 	DPRINTF("param: %16D\n", param, ":");
1448 
1449 	m->m_pkthdr.len = m->m_len = USIE_HIPCNS_MIN + cns_len + 2;
1450 
1451 	xfer = sc->sc_uc_xfer[USIE_HIP_IF][USIE_UC_TX];
1452 
1453 	if (usbd_xfer_get_priv(xfer) == NULL) {
1454 		usbd_xfer_set_priv(xfer, m);
1455 		usbd_transfer_start(xfer);
1456 	} else {
1457 		DPRINTF("Dropped CNS event\n");
1458 		m_freem(m);
1459 	}
1460 }
1461 
1462 static void
1463 usie_cns_rsp(struct usie_softc *sc, struct usie_cns *cns)
1464 {
1465 	if_t ifp = sc->sc_ifp;
1466 
1467 	DPRINTF("received CnS\n");
1468 
1469 	switch (be16toh(cns->obj)) {
1470 	case USIE_CNS_OB_LINK_UPDATE:
1471 		if (be32toh(cns->id) & USIE_CNS_ID_INIT)
1472 			usie_if_sync_to(sc);
1473 		else if (be32toh(cns->id) & USIE_CNS_ID_STOP) {
1474 			if_setflagbits(ifp, 0, IFF_UP);
1475 			if_setdrvflagbits(ifp, 0,
1476 			    IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
1477 		} else
1478 			DPRINTF("undefined link update\n");
1479 		break;
1480 
1481 	case USIE_CNS_OB_RSSI:
1482 		sc->sc_rssi = be16toh(*(int16_t *)(cns + 1));
1483 		if (sc->sc_rssi <= 0)
1484 			device_printf(sc->sc_dev, "No signal\n");
1485 		else {
1486 			device_printf(sc->sc_dev, "RSSI=%ddBm\n",
1487 			    sc->sc_rssi - 110);
1488 		}
1489 		break;
1490 
1491 	case USIE_CNS_OB_PROF_WRITE:
1492 		break;
1493 
1494 	case USIE_CNS_OB_PDP_READ:
1495 		break;
1496 
1497 	default:
1498 		DPRINTF("undefined CnS\n");
1499 		break;
1500 	}
1501 }
1502 
1503 static void
1504 usie_hip_rsp(struct usie_softc *sc, uint8_t *rsp, uint32_t len)
1505 {
1506 	struct usie_hip *hip;
1507 	struct usie_cns *cns;
1508 	uint32_t i;
1509 	uint32_t j;
1510 	uint32_t off;
1511 	uint8_t tmp[USIE_HIPCNS_MAX] __aligned(4);
1512 
1513 	for (off = 0; (off + USIE_HIPCNS_MIN) <= len; off++) {
1514 		uint8_t pad;
1515 
1516 		while ((off < len) && (rsp[off] == USIE_HIP_FRM_CHR))
1517 			off++;
1518 
1519 		/* Unstuff the bytes */
1520 		for (i = j = 0; ((i + off) < len) &&
1521 		    (j < USIE_HIPCNS_MAX); i++) {
1522 			if (rsp[i + off] == USIE_HIP_FRM_CHR)
1523 				break;
1524 
1525 			if (rsp[i + off] == USIE_HIP_ESC_CHR) {
1526 				if ((i + off + 1) >= len)
1527 					break;
1528 				tmp[j++] = rsp[i++ + off + 1] ^ 0x20;
1529 			} else {
1530 				tmp[j++] = rsp[i + off];
1531 			}
1532 		}
1533 
1534 		off += i;
1535 
1536 		DPRINTF("frame len=%d\n", j);
1537 
1538 		if (j < sizeof(struct usie_hip)) {
1539 			DPRINTF("too little data\n");
1540 			break;
1541 		}
1542 		/*
1543 		 * Make sure we are not reading the stack if something
1544 		 * is wrong.
1545 		 */
1546 		memset(tmp + j, 0, sizeof(tmp) - j);
1547 
1548 		hip = (struct usie_hip *)tmp;
1549 
1550 		DPRINTF("hip: len=%d msgID=%02x, param=%02x\n",
1551 		    be16toh(hip->len), hip->id, hip->param);
1552 
1553 		pad = (hip->id & USIE_HIP_PAD) ? 1 : 0;
1554 
1555 		if ((hip->id & USIE_HIP_MASK) == USIE_HIP_CNS2H) {
1556 			cns = (struct usie_cns *)(((uint8_t *)(hip + 1)) + pad);
1557 
1558 			if (j < (sizeof(struct usie_cns) +
1559 			    sizeof(struct usie_hip) + pad)) {
1560 				DPRINTF("too little data\n");
1561 				break;
1562 			}
1563 			DPRINTF("cns: obj=%04x, op=%02x, rsv0=%02x, "
1564 			    "app=%08x, rsv1=%02x, len=%d\n",
1565 			    be16toh(cns->obj), cns->op, cns->rsv0,
1566 			    be32toh(cns->id), cns->rsv1, cns->len);
1567 
1568 			if (cns->op & USIE_CNS_OP_ERR)
1569 				DPRINTF("CnS error response\n");
1570 			else
1571 				usie_cns_rsp(sc, cns);
1572 
1573 			i = sizeof(struct usie_hip) + pad + sizeof(struct usie_cns);
1574 			j = cns->len;
1575 		} else {
1576 			i = sizeof(struct usie_hip) + pad;
1577 			j = be16toh(hip->len);
1578 		}
1579 #ifdef	USB_DEBUG
1580 		if (usie_debug == 0)
1581 			continue;
1582 
1583 		while (i < USIE_HIPCNS_MAX && j > 0) {
1584 			DPRINTF("param[0x%02x] = 0x%02x\n", i, tmp[i]);
1585 			i++;
1586 			j--;
1587 		}
1588 #endif
1589 	}
1590 }
1591 
1592 static int
1593 usie_driver_loaded(struct module *mod, int what, void *arg)
1594 {
1595 	switch (what) {
1596 	case MOD_LOAD:
1597 		/* register autoinstall handler */
1598 		usie_etag = EVENTHANDLER_REGISTER(usb_dev_configured,
1599 		    usie_autoinst, NULL, EVENTHANDLER_PRI_ANY);
1600 		break;
1601 	case MOD_UNLOAD:
1602 		EVENTHANDLER_DEREGISTER(usb_dev_configured, usie_etag);
1603 		break;
1604 	default:
1605 		return (EOPNOTSUPP);
1606 	}
1607 	return (0);
1608 }
1609