xref: /freebsd/sys/dev/usb/net/if_usie.c (revision ce6a89e27cd190313be39bb479880aeda4778436)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2011 Anybots Inc
5  * written by Akinori Furukoshi <moonlightakkiy@yahoo.ca>
6  *  - ucom part is based on u3g.c
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
32 
33 #include <sys/param.h>
34 #include <sys/eventhandler.h>
35 #include <sys/systm.h>
36 #include <sys/queue.h>
37 #include <sys/systm.h>
38 #include <sys/socket.h>
39 #include <sys/kernel.h>
40 #include <sys/bus.h>
41 #include <sys/module.h>
42 #include <sys/sockio.h>
43 #include <sys/socket.h>
44 #include <sys/lock.h>
45 #include <sys/mutex.h>
46 #include <sys/condvar.h>
47 #include <sys/sysctl.h>
48 #include <sys/malloc.h>
49 #include <sys/taskqueue.h>
50 
51 #include <net/if.h>
52 #include <net/if_var.h>
53 
54 #include <machine/bus.h>
55 
56 #include <net/if.h>
57 #include <net/if_types.h>
58 #include <net/netisr.h>
59 #include <net/bpf.h>
60 #include <net/ethernet.h>
61 
62 #include <netinet/in.h>
63 #include <netinet/ip.h>
64 #include <netinet/ip6.h>
65 #include <netinet/udp.h>
66 
67 #include <net80211/ieee80211_ioctl.h>
68 
69 #include <dev/usb/usb.h>
70 #include <dev/usb/usbdi.h>
71 #include <dev/usb/usbdi_util.h>
72 #include <dev/usb/usb_cdc.h>
73 #include "usbdevs.h"
74 
75 #define	USB_DEBUG_VAR usie_debug
76 #include <dev/usb/usb_debug.h>
77 #include <dev/usb/usb_process.h>
78 #include <dev/usb/usb_msctest.h>
79 
80 #include <dev/usb/serial/usb_serial.h>
81 
82 #include <dev/usb/net/if_usievar.h>
83 
84 #ifdef	USB_DEBUG
85 static int usie_debug = 0;
86 
87 static SYSCTL_NODE(_hw_usb, OID_AUTO, usie, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
88     "sierra USB modem");
89 SYSCTL_INT(_hw_usb_usie, OID_AUTO, debug, CTLFLAG_RWTUN, &usie_debug, 0,
90     "usie debug level");
91 #endif
92 
93 /* Sierra Wireless Direct IP modems */
94 static const STRUCT_USB_HOST_ID usie_devs[] = {
95 #define	USIE_DEV(v, d) {				\
96     USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##d) }
97 	USIE_DEV(SIERRA, MC8700),
98 	USIE_DEV(SIERRA, TRUINSTALL),
99 	USIE_DEV(AIRPRIME, USB308),
100 #undef	USIE_DEV
101 };
102 
103 static device_probe_t usie_probe;
104 static device_attach_t usie_attach;
105 static device_detach_t usie_detach;
106 static void usie_free_softc(struct usie_softc *);
107 
108 static void usie_free(struct ucom_softc *);
109 static void usie_uc_update_line_state(struct ucom_softc *, uint8_t);
110 static void usie_uc_cfg_get_status(struct ucom_softc *, uint8_t *, uint8_t *);
111 static void usie_uc_cfg_set_dtr(struct ucom_softc *, uint8_t);
112 static void usie_uc_cfg_set_rts(struct ucom_softc *, uint8_t);
113 static void usie_uc_cfg_open(struct ucom_softc *);
114 static void usie_uc_cfg_close(struct ucom_softc *);
115 static void usie_uc_start_read(struct ucom_softc *);
116 static void usie_uc_stop_read(struct ucom_softc *);
117 static void usie_uc_start_write(struct ucom_softc *);
118 static void usie_uc_stop_write(struct ucom_softc *);
119 
120 static usb_callback_t usie_uc_tx_callback;
121 static usb_callback_t usie_uc_rx_callback;
122 static usb_callback_t usie_uc_status_callback;
123 static usb_callback_t usie_if_tx_callback;
124 static usb_callback_t usie_if_rx_callback;
125 static usb_callback_t usie_if_status_callback;
126 
127 static void usie_if_sync_to(void *);
128 static void usie_if_sync_cb(void *, int);
129 static void usie_if_status_cb(void *, int);
130 
131 static void usie_if_start(struct ifnet *);
132 static int usie_if_output(struct ifnet *, struct mbuf *,
133 	const struct sockaddr *, struct route *);
134 static void usie_if_init(void *);
135 static void usie_if_stop(struct usie_softc *);
136 static int usie_if_ioctl(struct ifnet *, u_long, caddr_t);
137 
138 static int usie_do_request(struct usie_softc *, struct usb_device_request *, void *);
139 static int usie_if_cmd(struct usie_softc *, uint8_t);
140 static void usie_cns_req(struct usie_softc *, uint32_t, uint16_t);
141 static void usie_cns_rsp(struct usie_softc *, struct usie_cns *);
142 static void usie_hip_rsp(struct usie_softc *, uint8_t *, uint32_t);
143 static int usie_driver_loaded(struct module *, int, void *);
144 
145 static const struct usb_config usie_uc_config[USIE_UC_N_XFER] = {
146 	[USIE_UC_STATUS] = {
147 		.type = UE_INTERRUPT,
148 		.endpoint = UE_ADDR_ANY,
149 		.direction = UE_DIR_IN,
150 		.bufsize = 0,		/* use wMaxPacketSize */
151 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
152 		.callback = &usie_uc_status_callback,
153 	},
154 	[USIE_UC_RX] = {
155 		.type = UE_BULK,
156 		.endpoint = UE_ADDR_ANY,
157 		.direction = UE_DIR_IN,
158 		.bufsize = USIE_BUFSIZE,
159 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,.proxy_buffer = 1,},
160 		.callback = &usie_uc_rx_callback,
161 	},
162 	[USIE_UC_TX] = {
163 		.type = UE_BULK,
164 		.endpoint = UE_ADDR_ANY,
165 		.direction = UE_DIR_OUT,
166 		.bufsize = USIE_BUFSIZE,
167 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
168 		.callback = &usie_uc_tx_callback,
169 	}
170 };
171 
172 static const struct usb_config usie_if_config[USIE_IF_N_XFER] = {
173 	[USIE_IF_STATUS] = {
174 		.type = UE_INTERRUPT,
175 		.endpoint = UE_ADDR_ANY,
176 		.direction = UE_DIR_IN,
177 		.bufsize = 0,		/* use wMaxPacketSize */
178 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
179 		.callback = &usie_if_status_callback,
180 	},
181 	[USIE_IF_RX] = {
182 		.type = UE_BULK,
183 		.endpoint = UE_ADDR_ANY,
184 		.direction = UE_DIR_IN,
185 		.bufsize = USIE_BUFSIZE,
186 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
187 		.callback = &usie_if_rx_callback,
188 	},
189 	[USIE_IF_TX] = {
190 		.type = UE_BULK,
191 		.endpoint = UE_ADDR_ANY,
192 		.direction = UE_DIR_OUT,
193 		.bufsize = MAX(USIE_BUFSIZE, MCLBYTES),
194 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
195 		.callback = &usie_if_tx_callback,
196 	}
197 };
198 
199 static device_method_t usie_methods[] = {
200 	DEVMETHOD(device_probe, usie_probe),
201 	DEVMETHOD(device_attach, usie_attach),
202 	DEVMETHOD(device_detach, usie_detach),
203 	DEVMETHOD_END
204 };
205 
206 static driver_t usie_driver = {
207 	.name = "usie",
208 	.methods = usie_methods,
209 	.size = sizeof(struct usie_softc),
210 };
211 
212 static devclass_t usie_devclass;
213 static eventhandler_tag usie_etag;
214 
215 DRIVER_MODULE(usie, uhub, usie_driver, usie_devclass, usie_driver_loaded, 0);
216 MODULE_DEPEND(usie, ucom, 1, 1, 1);
217 MODULE_DEPEND(usie, usb, 1, 1, 1);
218 MODULE_VERSION(usie, 1);
219 USB_PNP_HOST_INFO(usie_devs);
220 
221 static const struct ucom_callback usie_uc_callback = {
222 	.ucom_cfg_get_status = &usie_uc_cfg_get_status,
223 	.ucom_cfg_set_dtr = &usie_uc_cfg_set_dtr,
224 	.ucom_cfg_set_rts = &usie_uc_cfg_set_rts,
225 	.ucom_cfg_open = &usie_uc_cfg_open,
226 	.ucom_cfg_close = &usie_uc_cfg_close,
227 	.ucom_start_read = &usie_uc_start_read,
228 	.ucom_stop_read = &usie_uc_stop_read,
229 	.ucom_start_write = &usie_uc_start_write,
230 	.ucom_stop_write = &usie_uc_stop_write,
231 	.ucom_free = &usie_free,
232 };
233 
234 static void
235 usie_autoinst(void *arg, struct usb_device *udev,
236     struct usb_attach_arg *uaa)
237 {
238 	struct usb_interface *iface;
239 	struct usb_interface_descriptor *id;
240 	struct usb_device_request req;
241 	int err;
242 
243 	if (uaa->dev_state != UAA_DEV_READY)
244 		return;
245 
246 	iface = usbd_get_iface(udev, 0);
247 	if (iface == NULL)
248 		return;
249 
250 	id = iface->idesc;
251 	if (id == NULL || id->bInterfaceClass != UICLASS_MASS)
252 		return;
253 
254 	if (usbd_lookup_id_by_uaa(usie_devs, sizeof(usie_devs), uaa) != 0)
255 		return;			/* no device match */
256 
257 	if (bootverbose) {
258 		DPRINTF("Ejecting %s %s\n",
259 		    usb_get_manufacturer(udev),
260 		    usb_get_product(udev));
261 	}
262 	req.bmRequestType = UT_VENDOR;
263 	req.bRequest = UR_SET_INTERFACE;
264 	USETW(req.wValue, UF_DEVICE_REMOTE_WAKEUP);
265 	USETW(req.wIndex, UHF_PORT_CONNECTION);
266 	USETW(req.wLength, 0);
267 
268 	/* at this moment there is no mutex */
269 	err = usbd_do_request_flags(udev, NULL, &req,
270 	    NULL, 0, NULL, 250 /* ms */ );
271 
272 	/* success, mark the udev as disappearing */
273 	if (err == 0)
274 		uaa->dev_state = UAA_DEV_EJECTING;
275 }
276 
277 static int
278 usie_probe(device_t self)
279 {
280 	struct usb_attach_arg *uaa = device_get_ivars(self);
281 
282 	if (uaa->usb_mode != USB_MODE_HOST)
283 		return (ENXIO);
284 	if (uaa->info.bConfigIndex != USIE_CNFG_INDEX)
285 		return (ENXIO);
286 	if (uaa->info.bIfaceIndex != USIE_IFACE_INDEX)
287 		return (ENXIO);
288 	if (uaa->info.bInterfaceClass != UICLASS_VENDOR)
289 		return (ENXIO);
290 
291 	return (usbd_lookup_id_by_uaa(usie_devs, sizeof(usie_devs), uaa));
292 }
293 
294 static int
295 usie_attach(device_t self)
296 {
297 	struct usie_softc *sc = device_get_softc(self);
298 	struct usb_attach_arg *uaa = device_get_ivars(self);
299 	struct ifnet *ifp;
300 	struct usb_interface *iface;
301 	struct usb_interface_descriptor *id;
302 	struct usb_device_request req;
303 	int err;
304 	uint16_t fwattr;
305 	uint8_t iface_index;
306 	uint8_t ifidx;
307 	uint8_t start;
308 
309 	device_set_usb_desc(self);
310 	sc->sc_udev = uaa->device;
311 	sc->sc_dev = self;
312 
313 	mtx_init(&sc->sc_mtx, "usie", MTX_NETWORK_LOCK, MTX_DEF);
314 	ucom_ref(&sc->sc_super_ucom);
315 
316 	TASK_INIT(&sc->sc_if_status_task, 0, usie_if_status_cb, sc);
317 	TASK_INIT(&sc->sc_if_sync_task, 0, usie_if_sync_cb, sc);
318 
319 	usb_callout_init_mtx(&sc->sc_if_sync_ch, &sc->sc_mtx, 0);
320 
321 	mtx_lock(&sc->sc_mtx);
322 
323 	/* set power mode to D0 */
324 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
325 	req.bRequest = USIE_POWER;
326 	USETW(req.wValue, 0);
327 	USETW(req.wIndex, 0);
328 	USETW(req.wLength, 0);
329 	if (usie_do_request(sc, &req, NULL)) {
330 		mtx_unlock(&sc->sc_mtx);
331 		goto detach;
332 	}
333 	/* read fw attr */
334 	fwattr = 0;
335 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
336 	req.bRequest = USIE_FW_ATTR;
337 	USETW(req.wValue, 0);
338 	USETW(req.wIndex, 0);
339 	USETW(req.wLength, sizeof(fwattr));
340 	if (usie_do_request(sc, &req, &fwattr)) {
341 		mtx_unlock(&sc->sc_mtx);
342 		goto detach;
343 	}
344 	mtx_unlock(&sc->sc_mtx);
345 
346 	/* check DHCP supports */
347 	DPRINTF("fwattr=%x\n", fwattr);
348 	if (!(fwattr & USIE_FW_DHCP)) {
349 		device_printf(self, "DHCP is not supported. A firmware upgrade might be needed.\n");
350 	}
351 
352 	/* find available interfaces */
353 	sc->sc_nucom = 0;
354 	for (ifidx = 0; ifidx < USIE_IFACE_MAX; ifidx++) {
355 		iface = usbd_get_iface(uaa->device, ifidx);
356 		if (iface == NULL)
357 			break;
358 
359 		id = usbd_get_interface_descriptor(iface);
360 		if ((id == NULL) || (id->bInterfaceClass != UICLASS_VENDOR))
361 			continue;
362 
363 		/* setup Direct IP transfer */
364 		if (id->bInterfaceNumber >= 7 && id->bNumEndpoints == 3) {
365 			sc->sc_if_ifnum = id->bInterfaceNumber;
366 			iface_index = ifidx;
367 
368 			DPRINTF("ifnum=%d, ifidx=%d\n",
369 			    sc->sc_if_ifnum, ifidx);
370 
371 			err = usbd_transfer_setup(uaa->device,
372 			    &iface_index, sc->sc_if_xfer, usie_if_config,
373 			    USIE_IF_N_XFER, sc, &sc->sc_mtx);
374 
375 			if (err == 0)
376 				continue;
377 
378 			device_printf(self,
379 			    "could not allocate USB transfers on "
380 			    "iface_index=%d, err=%s\n",
381 			    iface_index, usbd_errstr(err));
382 			goto detach;
383 		}
384 
385 		/* setup ucom */
386 		if (sc->sc_nucom >= USIE_UCOM_MAX)
387 			continue;
388 
389 		usbd_set_parent_iface(uaa->device, ifidx,
390 		    uaa->info.bIfaceIndex);
391 
392 		DPRINTF("NumEndpoints=%d bInterfaceNumber=%d\n",
393 		    id->bNumEndpoints, id->bInterfaceNumber);
394 
395 		if (id->bNumEndpoints == 2) {
396 			sc->sc_uc_xfer[sc->sc_nucom][0] = NULL;
397 			start = 1;
398 		} else
399 			start = 0;
400 
401 		err = usbd_transfer_setup(uaa->device, &ifidx,
402 		    sc->sc_uc_xfer[sc->sc_nucom] + start,
403 		    usie_uc_config + start, USIE_UC_N_XFER - start,
404 		    &sc->sc_ucom[sc->sc_nucom], &sc->sc_mtx);
405 
406 		if (err != 0) {
407 			DPRINTF("usbd_transfer_setup error=%s\n", usbd_errstr(err));
408 			continue;
409 		}
410 
411 		mtx_lock(&sc->sc_mtx);
412 		for (; start < USIE_UC_N_XFER; start++)
413 			usbd_xfer_set_stall(sc->sc_uc_xfer[sc->sc_nucom][start]);
414 		mtx_unlock(&sc->sc_mtx);
415 
416 		sc->sc_uc_ifnum[sc->sc_nucom] = id->bInterfaceNumber;
417 
418 		sc->sc_nucom++;		/* found a port */
419 	}
420 
421 	if (sc->sc_nucom == 0) {
422 		device_printf(self, "no comports found\n");
423 		goto detach;
424 	}
425 
426 	err = ucom_attach(&sc->sc_super_ucom, sc->sc_ucom,
427 	    sc->sc_nucom, sc, &usie_uc_callback, &sc->sc_mtx);
428 
429 	if (err != 0) {
430 		DPRINTF("ucom_attach failed\n");
431 		goto detach;
432 	}
433 	DPRINTF("Found %d interfaces.\n", sc->sc_nucom);
434 
435 	/* setup ifnet (Direct IP) */
436 	sc->sc_ifp = ifp = if_alloc(IFT_OTHER);
437 
438 	if (ifp == NULL) {
439 		device_printf(self, "Could not allocate a network interface\n");
440 		goto detach;
441 	}
442 	if_initname(ifp, "usie", device_get_unit(self));
443 
444 	ifp->if_softc = sc;
445 	ifp->if_mtu = USIE_MTU_MAX;
446 	ifp->if_flags |= IFF_NOARP;
447 	ifp->if_init = usie_if_init;
448 	ifp->if_ioctl = usie_if_ioctl;
449 	ifp->if_start = usie_if_start;
450 	ifp->if_output = usie_if_output;
451 	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
452 	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
453 	IFQ_SET_READY(&ifp->if_snd);
454 
455 	if_attach(ifp);
456 	bpfattach(ifp, DLT_RAW, 0);
457 
458 	if (fwattr & USIE_PM_AUTO) {
459 		usbd_set_power_mode(uaa->device, USB_POWER_MODE_SAVE);
460 		DPRINTF("enabling automatic suspend and resume\n");
461 	} else {
462 		usbd_set_power_mode(uaa->device, USB_POWER_MODE_ON);
463 		DPRINTF("USB power is always ON\n");
464 	}
465 
466 	DPRINTF("device attached\n");
467 	return (0);
468 
469 detach:
470 	usie_detach(self);
471 	return (ENOMEM);
472 }
473 
474 static int
475 usie_detach(device_t self)
476 {
477 	struct usie_softc *sc = device_get_softc(self);
478 	uint8_t x;
479 
480 	/* detach ifnet */
481 	if (sc->sc_ifp != NULL) {
482 		usie_if_stop(sc);
483 		usbd_transfer_unsetup(sc->sc_if_xfer, USIE_IF_N_XFER);
484 		bpfdetach(sc->sc_ifp);
485 		if_detach(sc->sc_ifp);
486 		if_free(sc->sc_ifp);
487 		sc->sc_ifp = NULL;
488 	}
489 	/* detach ucom */
490 	if (sc->sc_nucom > 0)
491 		ucom_detach(&sc->sc_super_ucom, sc->sc_ucom);
492 
493 	/* stop all USB transfers */
494 	usbd_transfer_unsetup(sc->sc_if_xfer, USIE_IF_N_XFER);
495 
496 	for (x = 0; x != USIE_UCOM_MAX; x++)
497 		usbd_transfer_unsetup(sc->sc_uc_xfer[x], USIE_UC_N_XFER);
498 
499 
500 	device_claim_softc(self);
501 
502 	usie_free_softc(sc);
503 
504 	return (0);
505 }
506 
507 UCOM_UNLOAD_DRAIN(usie);
508 
509 static void
510 usie_free_softc(struct usie_softc *sc)
511 {
512 	if (ucom_unref(&sc->sc_super_ucom)) {
513 		mtx_destroy(&sc->sc_mtx);
514 		device_free_softc(sc);
515 	}
516 }
517 
518 static void
519 usie_free(struct ucom_softc *ucom)
520 {
521 	usie_free_softc(ucom->sc_parent);
522 }
523 
524 static void
525 usie_uc_update_line_state(struct ucom_softc *ucom, uint8_t ls)
526 {
527 	struct usie_softc *sc = ucom->sc_parent;
528 	struct usb_device_request req;
529 
530 	if (sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_STATUS] == NULL)
531 		return;
532 
533 	req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
534 	req.bRequest = USIE_LINK_STATE;
535 	USETW(req.wValue, ls);
536 	USETW(req.wIndex, sc->sc_uc_ifnum[ucom->sc_subunit]);
537 	USETW(req.wLength, 0);
538 
539 	DPRINTF("sc_uc_ifnum=%d\n", sc->sc_uc_ifnum[ucom->sc_subunit]);
540 
541 	usie_do_request(sc, &req, NULL);
542 }
543 
544 static void
545 usie_uc_cfg_get_status(struct ucom_softc *ucom, uint8_t *lsr, uint8_t *msr)
546 {
547 	struct usie_softc *sc = ucom->sc_parent;
548 
549 	*msr = sc->sc_msr;
550 	*lsr = sc->sc_lsr;
551 }
552 
553 static void
554 usie_uc_cfg_set_dtr(struct ucom_softc *ucom, uint8_t flag)
555 {
556 	uint8_t dtr;
557 
558 	dtr = flag ? USIE_LS_DTR : 0;
559 	usie_uc_update_line_state(ucom, dtr);
560 }
561 
562 static void
563 usie_uc_cfg_set_rts(struct ucom_softc *ucom, uint8_t flag)
564 {
565 	uint8_t rts;
566 
567 	rts = flag ? USIE_LS_RTS : 0;
568 	usie_uc_update_line_state(ucom, rts);
569 }
570 
571 static void
572 usie_uc_cfg_open(struct ucom_softc *ucom)
573 {
574 	struct usie_softc *sc = ucom->sc_parent;
575 
576 	/* usbd_transfer_start() is NULL safe */
577 
578 	usbd_transfer_start(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_STATUS]);
579 }
580 
581 static void
582 usie_uc_cfg_close(struct ucom_softc *ucom)
583 {
584 	struct usie_softc *sc = ucom->sc_parent;
585 
586 	usbd_transfer_stop(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_STATUS]);
587 }
588 
589 static void
590 usie_uc_start_read(struct ucom_softc *ucom)
591 {
592 	struct usie_softc *sc = ucom->sc_parent;
593 
594 	usbd_transfer_start(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_RX]);
595 }
596 
597 static void
598 usie_uc_stop_read(struct ucom_softc *ucom)
599 {
600 	struct usie_softc *sc = ucom->sc_parent;
601 
602 	usbd_transfer_stop(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_RX]);
603 }
604 
605 static void
606 usie_uc_start_write(struct ucom_softc *ucom)
607 {
608 	struct usie_softc *sc = ucom->sc_parent;
609 
610 	usbd_transfer_start(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_TX]);
611 }
612 
613 static void
614 usie_uc_stop_write(struct ucom_softc *ucom)
615 {
616 	struct usie_softc *sc = ucom->sc_parent;
617 
618 	usbd_transfer_stop(sc->sc_uc_xfer[ucom->sc_subunit][USIE_UC_TX]);
619 }
620 
621 static void
622 usie_uc_rx_callback(struct usb_xfer *xfer, usb_error_t error)
623 {
624 	struct ucom_softc *ucom = usbd_xfer_softc(xfer);
625 	struct usie_softc *sc = ucom->sc_parent;
626 	struct usb_page_cache *pc;
627 	uint32_t actlen;
628 
629 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
630 
631 	switch (USB_GET_STATE(xfer)) {
632 	case USB_ST_TRANSFERRED:
633 		pc = usbd_xfer_get_frame(xfer, 0);
634 
635 		/* handle CnS response */
636 		if (ucom == sc->sc_ucom && actlen >= USIE_HIPCNS_MIN) {
637 
638 			DPRINTF("transferred=%u\n", actlen);
639 
640 			/* check if it is really CnS reply */
641 			usbd_copy_out(pc, 0, sc->sc_resp_temp, 1);
642 
643 			if (sc->sc_resp_temp[0] == USIE_HIP_FRM_CHR) {
644 
645 				/* verify actlen */
646 				if (actlen > USIE_BUFSIZE)
647 					actlen = USIE_BUFSIZE;
648 
649 				/* get complete message */
650 				usbd_copy_out(pc, 0, sc->sc_resp_temp, actlen);
651 				usie_hip_rsp(sc, sc->sc_resp_temp, actlen);
652 
653 				/* need to fall though */
654 				goto tr_setup;
655 			}
656 			/* else call ucom_put_data() */
657 		}
658 		/* standard ucom transfer */
659 		ucom_put_data(ucom, pc, 0, actlen);
660 
661 		/* fall though */
662 	case USB_ST_SETUP:
663 tr_setup:
664 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
665 		usbd_transfer_submit(xfer);
666 		break;
667 
668 	default:			/* Error */
669 		if (error != USB_ERR_CANCELLED) {
670 			usbd_xfer_set_stall(xfer);
671 			goto tr_setup;
672 		}
673 		break;
674 	}
675 }
676 
677 static void
678 usie_uc_tx_callback(struct usb_xfer *xfer, usb_error_t error)
679 {
680 	struct ucom_softc *ucom = usbd_xfer_softc(xfer);
681 	struct usb_page_cache *pc;
682 	uint32_t actlen;
683 
684 	switch (USB_GET_STATE(xfer)) {
685 	case USB_ST_TRANSFERRED:
686 	case USB_ST_SETUP:
687 tr_setup:
688 		pc = usbd_xfer_get_frame(xfer, 0);
689 
690 		/* handle CnS request */
691 		struct mbuf *m = usbd_xfer_get_priv(xfer);
692 
693 		if (m != NULL) {
694 			usbd_m_copy_in(pc, 0, m, 0, m->m_pkthdr.len);
695 			usbd_xfer_set_frame_len(xfer, 0, m->m_pkthdr.len);
696 			usbd_xfer_set_priv(xfer, NULL);
697 			usbd_transfer_submit(xfer);
698 			m_freem(m);
699 			break;
700 		}
701 		/* standard ucom transfer */
702 		if (ucom_get_data(ucom, pc, 0, USIE_BUFSIZE, &actlen)) {
703 			usbd_xfer_set_frame_len(xfer, 0, actlen);
704 			usbd_transfer_submit(xfer);
705 		}
706 		break;
707 
708 	default:			/* Error */
709 		if (error != USB_ERR_CANCELLED) {
710 			usbd_xfer_set_stall(xfer);
711 			goto tr_setup;
712 		}
713 		break;
714 	}
715 }
716 
717 static void
718 usie_uc_status_callback(struct usb_xfer *xfer, usb_error_t error)
719 {
720 	struct usb_page_cache *pc;
721 	struct {
722 		struct usb_device_request req;
723 		uint16_t param;
724 	}      st;
725 	uint32_t actlen;
726 	uint16_t param;
727 
728 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
729 
730 	switch (USB_GET_STATE(xfer)) {
731 	case USB_ST_TRANSFERRED:
732 		DPRINTFN(4, "info received, actlen=%u\n", actlen);
733 
734 		if (actlen < sizeof(st)) {
735 			DPRINTF("data too short actlen=%u\n", actlen);
736 			goto tr_setup;
737 		}
738 		pc = usbd_xfer_get_frame(xfer, 0);
739 		usbd_copy_out(pc, 0, &st, sizeof(st));
740 
741 		if (st.req.bmRequestType == 0xa1 && st.req.bRequest == 0x20) {
742 			struct ucom_softc *ucom = usbd_xfer_softc(xfer);
743 			struct usie_softc *sc = ucom->sc_parent;
744 
745 			param = le16toh(st.param);
746 			DPRINTF("param=%x\n", param);
747 			sc->sc_msr = sc->sc_lsr = 0;
748 			sc->sc_msr |= (param & USIE_DCD) ? SER_DCD : 0;
749 			sc->sc_msr |= (param & USIE_DSR) ? SER_DSR : 0;
750 			sc->sc_msr |= (param & USIE_RI) ? SER_RI : 0;
751 			sc->sc_msr |= (param & USIE_CTS) ? 0 : SER_CTS;
752 			sc->sc_msr |= (param & USIE_RTS) ? SER_RTS : 0;
753 			sc->sc_msr |= (param & USIE_DTR) ? SER_DTR : 0;
754 		}
755 		/* fall though */
756 	case USB_ST_SETUP:
757 tr_setup:
758 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
759 		usbd_transfer_submit(xfer);
760 		break;
761 
762 	default:			/* Error */
763 		DPRINTF("USB transfer error, %s\n",
764 		    usbd_errstr(error));
765 
766 		if (error != USB_ERR_CANCELLED) {
767 			usbd_xfer_set_stall(xfer);
768 			goto tr_setup;
769 		}
770 		break;
771 	}
772 }
773 
774 static void
775 usie_if_rx_callback(struct usb_xfer *xfer, usb_error_t error)
776 {
777 	struct epoch_tracker et;
778 	struct usie_softc *sc = usbd_xfer_softc(xfer);
779 	struct ifnet *ifp = sc->sc_ifp;
780 	struct mbuf *m0;
781 	struct mbuf *m = NULL;
782 	struct usie_desc *rxd;
783 	uint32_t actlen;
784 	uint16_t err;
785 	uint16_t pkt;
786 	uint16_t ipl;
787 	uint16_t len;
788 	uint16_t diff;
789 	uint8_t pad;
790 	uint8_t ipv;
791 
792 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
793 
794 	switch (USB_GET_STATE(xfer)) {
795 	case USB_ST_TRANSFERRED:
796 		DPRINTFN(15, "rx done, actlen=%u\n", actlen);
797 
798 		if (actlen < sizeof(struct usie_hip)) {
799 			DPRINTF("data too short %u\n", actlen);
800 			goto tr_setup;
801 		}
802 		m = sc->sc_rxm;
803 		sc->sc_rxm = NULL;
804 
805 		/* fall though */
806 	case USB_ST_SETUP:
807 tr_setup:
808 
809 		if (sc->sc_rxm == NULL) {
810 			sc->sc_rxm = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR,
811 			    MJUMPAGESIZE /* could be bigger than MCLBYTES */ );
812 		}
813 		if (sc->sc_rxm == NULL) {
814 			DPRINTF("could not allocate Rx mbuf\n");
815 			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
816 			usbd_xfer_set_stall(xfer);
817 			usbd_xfer_set_frames(xfer, 0);
818 		} else {
819 			/*
820 			 * Directly loading a mbuf cluster into DMA to
821 			 * save some data copying. This works because
822 			 * there is only one cluster.
823 			 */
824 			usbd_xfer_set_frame_data(xfer, 0,
825 			    mtod(sc->sc_rxm, caddr_t), MIN(MJUMPAGESIZE, USIE_RXSZ_MAX));
826 			usbd_xfer_set_frames(xfer, 1);
827 		}
828 		usbd_transfer_submit(xfer);
829 		break;
830 
831 	default:			/* Error */
832 		DPRINTF("USB transfer error, %s\n", usbd_errstr(error));
833 
834 		if (error != USB_ERR_CANCELLED) {
835 			/* try to clear stall first */
836 			usbd_xfer_set_stall(xfer);
837 			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
838 			goto tr_setup;
839 		}
840 		if (sc->sc_rxm != NULL) {
841 			m_freem(sc->sc_rxm);
842 			sc->sc_rxm = NULL;
843 		}
844 		break;
845 	}
846 
847 	if (m == NULL)
848 		return;
849 
850 	mtx_unlock(&sc->sc_mtx);
851 
852 	m->m_pkthdr.len = m->m_len = actlen;
853 
854 	err = pkt = 0;
855 
856 	/* HW can aggregate multiple frames in a single USB xfer */
857 	NET_EPOCH_ENTER(et);
858 	for (;;) {
859 		rxd = mtod(m, struct usie_desc *);
860 
861 		len = be16toh(rxd->hip.len) & USIE_HIP_IP_LEN_MASK;
862 		pad = (rxd->hip.id & USIE_HIP_PAD) ? 1 : 0;
863 		ipl = (len - pad - ETHER_HDR_LEN);
864 		if (ipl >= len) {
865 			DPRINTF("Corrupt frame\n");
866 			m_freem(m);
867 			break;
868 		}
869 		diff = sizeof(struct usie_desc) + ipl + pad;
870 
871 		if (((rxd->hip.id & USIE_HIP_MASK) != USIE_HIP_IP) ||
872 		    (be16toh(rxd->desc_type) & USIE_TYPE_MASK) != USIE_IP_RX) {
873 			DPRINTF("received wrong type of packet\n");
874 			m->m_data += diff;
875 			m->m_pkthdr.len = (m->m_len -= diff);
876 			err++;
877 			if (m->m_pkthdr.len > 0)
878 				continue;
879 			m_freem(m);
880 			break;
881 		}
882 		switch (be16toh(rxd->ethhdr.ether_type)) {
883 		case ETHERTYPE_IP:
884 			ipv = NETISR_IP;
885 			break;
886 #ifdef INET6
887 		case ETHERTYPE_IPV6:
888 			ipv = NETISR_IPV6;
889 			break;
890 #endif
891 		default:
892 			DPRINTF("unsupported ether type\n");
893 			err++;
894 			break;
895 		}
896 
897 		/* the last packet */
898 		if (m->m_pkthdr.len <= diff) {
899 			m->m_data += (sizeof(struct usie_desc) + pad);
900 			m->m_pkthdr.len = m->m_len = ipl;
901 			m->m_pkthdr.rcvif = ifp;
902 			BPF_MTAP(sc->sc_ifp, m);
903 			netisr_dispatch(ipv, m);
904 			break;
905 		}
906 		/* copy aggregated frames to another mbuf */
907 		m0 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
908 		if (__predict_false(m0 == NULL)) {
909 			DPRINTF("could not allocate mbuf\n");
910 			err++;
911 			m_freem(m);
912 			break;
913 		}
914 		m_copydata(m, sizeof(struct usie_desc) + pad, ipl, mtod(m0, caddr_t));
915 		m0->m_pkthdr.rcvif = ifp;
916 		m0->m_pkthdr.len = m0->m_len = ipl;
917 
918 		BPF_MTAP(sc->sc_ifp, m0);
919 		netisr_dispatch(ipv, m0);
920 
921 		m->m_data += diff;
922 		m->m_pkthdr.len = (m->m_len -= diff);
923 	}
924 	NET_EPOCH_EXIT(et);
925 
926 	mtx_lock(&sc->sc_mtx);
927 
928 	if_inc_counter(ifp, IFCOUNTER_IERRORS, err);
929 	if_inc_counter(ifp, IFCOUNTER_IPACKETS, pkt);
930 }
931 
932 static void
933 usie_if_tx_callback(struct usb_xfer *xfer, usb_error_t error)
934 {
935 	struct usie_softc *sc = usbd_xfer_softc(xfer);
936 	struct usb_page_cache *pc;
937 	struct ifnet *ifp = sc->sc_ifp;
938 	struct mbuf *m;
939 	uint16_t size;
940 
941 	switch (USB_GET_STATE(xfer)) {
942 	case USB_ST_TRANSFERRED:
943 		DPRINTFN(11, "transfer complete\n");
944 		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
945 		if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
946 
947 		/* fall though */
948 	case USB_ST_SETUP:
949 tr_setup:
950 
951 		if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
952 			break;
953 
954 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
955 		if (m == NULL)
956 			break;
957 
958 		if (m->m_pkthdr.len > (int)(MCLBYTES - ETHER_HDR_LEN +
959 		    ETHER_CRC_LEN - sizeof(sc->sc_txd))) {
960 			DPRINTF("packet len is too big: %d\n",
961 			    m->m_pkthdr.len);
962 			break;
963 		}
964 		pc = usbd_xfer_get_frame(xfer, 0);
965 
966 		sc->sc_txd.hip.len = htobe16(m->m_pkthdr.len +
967 		    ETHER_HDR_LEN + ETHER_CRC_LEN);
968 		size = sizeof(sc->sc_txd);
969 
970 		usbd_copy_in(pc, 0, &sc->sc_txd, size);
971 		usbd_m_copy_in(pc, size, m, 0, m->m_pkthdr.len);
972 		usbd_xfer_set_frame_len(xfer, 0, m->m_pkthdr.len +
973 		    size + ETHER_CRC_LEN);
974 
975 		BPF_MTAP(ifp, m);
976 
977 		m_freem(m);
978 
979 		usbd_transfer_submit(xfer);
980 		break;
981 
982 	default:			/* Error */
983 		DPRINTF("USB transfer error, %s\n",
984 		    usbd_errstr(error));
985 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
986 
987 		if (error != USB_ERR_CANCELLED) {
988 			usbd_xfer_set_stall(xfer);
989 			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
990 			goto tr_setup;
991 		}
992 		break;
993 	}
994 }
995 
996 static void
997 usie_if_status_callback(struct usb_xfer *xfer, usb_error_t error)
998 {
999 	struct usie_softc *sc = usbd_xfer_softc(xfer);
1000 	struct usb_page_cache *pc;
1001 	struct usb_cdc_notification cdc;
1002 	uint32_t actlen;
1003 
1004 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1005 
1006 	switch (USB_GET_STATE(xfer)) {
1007 	case USB_ST_TRANSFERRED:
1008 		DPRINTFN(4, "info received, actlen=%d\n", actlen);
1009 
1010 		/* usb_cdc_notification - .data[16] */
1011 		if (actlen < (sizeof(cdc) - 16)) {
1012 			DPRINTF("data too short %d\n", actlen);
1013 			goto tr_setup;
1014 		}
1015 		pc = usbd_xfer_get_frame(xfer, 0);
1016 		usbd_copy_out(pc, 0, &cdc, (sizeof(cdc) - 16));
1017 
1018 		DPRINTFN(4, "bNotification=%x\n", cdc.bNotification);
1019 
1020 		if (cdc.bNotification & UCDC_N_RESPONSE_AVAILABLE) {
1021 			taskqueue_enqueue(taskqueue_thread,
1022 			    &sc->sc_if_status_task);
1023 		}
1024 		/* fall though */
1025 	case USB_ST_SETUP:
1026 tr_setup:
1027 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1028 		usbd_transfer_submit(xfer);
1029 		break;
1030 
1031 	default:			/* Error */
1032 		DPRINTF("USB transfer error, %s\n",
1033 		    usbd_errstr(error));
1034 
1035 		if (error != USB_ERR_CANCELLED) {
1036 			usbd_xfer_set_stall(xfer);
1037 			goto tr_setup;
1038 		}
1039 		break;
1040 	}
1041 }
1042 
1043 static void
1044 usie_if_sync_to(void *arg)
1045 {
1046 	struct usie_softc *sc = arg;
1047 
1048 	taskqueue_enqueue(taskqueue_thread, &sc->sc_if_sync_task);
1049 }
1050 
1051 static void
1052 usie_if_sync_cb(void *arg, int pending)
1053 {
1054 	struct usie_softc *sc = arg;
1055 
1056 	mtx_lock(&sc->sc_mtx);
1057 
1058 	/* call twice */
1059 	usie_if_cmd(sc, USIE_HIP_SYNC2M);
1060 	usie_if_cmd(sc, USIE_HIP_SYNC2M);
1061 
1062 	usb_callout_reset(&sc->sc_if_sync_ch, 2 * hz, usie_if_sync_to, sc);
1063 
1064 	mtx_unlock(&sc->sc_mtx);
1065 }
1066 
1067 static void
1068 usie_if_status_cb(void *arg, int pending)
1069 {
1070 	struct usie_softc *sc = arg;
1071 	struct ifnet *ifp = sc->sc_ifp;
1072 	struct usb_device_request req;
1073 	struct usie_hip *hip;
1074 	struct usie_lsi *lsi;
1075 	uint16_t actlen;
1076 	uint8_t ntries;
1077 	uint8_t pad;
1078 
1079 	mtx_lock(&sc->sc_mtx);
1080 
1081 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
1082 	req.bRequest = UCDC_GET_ENCAPSULATED_RESPONSE;
1083 	USETW(req.wValue, 0);
1084 	USETW(req.wIndex, sc->sc_if_ifnum);
1085 	USETW(req.wLength, sizeof(sc->sc_status_temp));
1086 
1087 	for (ntries = 0; ntries != 10; ntries++) {
1088 		int err;
1089 
1090 		err = usbd_do_request_flags(sc->sc_udev,
1091 		    &sc->sc_mtx, &req, sc->sc_status_temp, USB_SHORT_XFER_OK,
1092 		    &actlen, USB_DEFAULT_TIMEOUT);
1093 
1094 		if (err == 0)
1095 			break;
1096 
1097 		DPRINTF("Control request failed: %s %d/10\n",
1098 		    usbd_errstr(err), ntries);
1099 
1100 		usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(10));
1101 	}
1102 
1103 	if (ntries == 10) {
1104 		mtx_unlock(&sc->sc_mtx);
1105 		DPRINTF("Timeout\n");
1106 		return;
1107 	}
1108 
1109 	hip = (struct usie_hip *)sc->sc_status_temp;
1110 
1111 	pad = (hip->id & USIE_HIP_PAD) ? 1 : 0;
1112 
1113 	DPRINTF("hip.id=%x hip.len=%d actlen=%u pad=%d\n",
1114 	    hip->id, be16toh(hip->len), actlen, pad);
1115 
1116 	switch (hip->id & USIE_HIP_MASK) {
1117 	case USIE_HIP_SYNC2H:
1118 		usie_if_cmd(sc, USIE_HIP_SYNC2M);
1119 		break;
1120 	case USIE_HIP_RESTR:
1121 		usb_callout_stop(&sc->sc_if_sync_ch);
1122 		break;
1123 	case USIE_HIP_UMTS:
1124 		lsi = (struct usie_lsi *)(
1125 		    sc->sc_status_temp + sizeof(struct usie_hip) + pad);
1126 
1127 		DPRINTF("lsi.proto=%x lsi.len=%d\n", lsi->proto,
1128 		    be16toh(lsi->len));
1129 
1130 		if (lsi->proto != USIE_LSI_UMTS)
1131 			break;
1132 
1133 		if (lsi->area == USIE_LSI_AREA_NO ||
1134 		    lsi->area == USIE_LSI_AREA_NODATA) {
1135 			device_printf(sc->sc_dev, "no service available\n");
1136 			break;
1137 		}
1138 		if (lsi->state == USIE_LSI_STATE_IDLE) {
1139 			DPRINTF("lsi.state=%x\n", lsi->state);
1140 			break;
1141 		}
1142 		DPRINTF("ctx=%x\n", hip->param);
1143 		sc->sc_txd.hip.param = hip->param;
1144 
1145 		sc->sc_net.addr_len = lsi->pdp_addr_len;
1146 		memcpy(&sc->sc_net.dns1_addr, &lsi->dns1_addr, 16);
1147 		memcpy(&sc->sc_net.dns2_addr, &lsi->dns2_addr, 16);
1148 		memcpy(sc->sc_net.pdp_addr, lsi->pdp_addr, 16);
1149 		memcpy(sc->sc_net.gw_addr, lsi->gw_addr, 16);
1150 		ifp->if_flags |= IFF_UP;
1151 		ifp->if_drv_flags |= IFF_DRV_RUNNING;
1152 
1153 		device_printf(sc->sc_dev, "IP Addr=%d.%d.%d.%d\n",
1154 		    *lsi->pdp_addr, *(lsi->pdp_addr + 1),
1155 		    *(lsi->pdp_addr + 2), *(lsi->pdp_addr + 3));
1156 		device_printf(sc->sc_dev, "Gateway Addr=%d.%d.%d.%d\n",
1157 		    *lsi->gw_addr, *(lsi->gw_addr + 1),
1158 		    *(lsi->gw_addr + 2), *(lsi->gw_addr + 3));
1159 		device_printf(sc->sc_dev, "Prim NS Addr=%d.%d.%d.%d\n",
1160 		    *lsi->dns1_addr, *(lsi->dns1_addr + 1),
1161 		    *(lsi->dns1_addr + 2), *(lsi->dns1_addr + 3));
1162 		device_printf(sc->sc_dev, "Scnd NS Addr=%d.%d.%d.%d\n",
1163 		    *lsi->dns2_addr, *(lsi->dns2_addr + 1),
1164 		    *(lsi->dns2_addr + 2), *(lsi->dns2_addr + 3));
1165 
1166 		usie_cns_req(sc, USIE_CNS_ID_RSSI, USIE_CNS_OB_RSSI);
1167 		break;
1168 
1169 	case USIE_HIP_RCGI:
1170 		/* ignore, workaround for sloppy windows */
1171 		break;
1172 	default:
1173 		DPRINTF("undefined msgid: %x\n", hip->id);
1174 		break;
1175 	}
1176 
1177 	mtx_unlock(&sc->sc_mtx);
1178 }
1179 
1180 static void
1181 usie_if_start(struct ifnet *ifp)
1182 {
1183 	struct usie_softc *sc = ifp->if_softc;
1184 
1185 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1186 		DPRINTF("Not running\n");
1187 		return;
1188 	}
1189 	mtx_lock(&sc->sc_mtx);
1190 	usbd_transfer_start(sc->sc_if_xfer[USIE_IF_TX]);
1191 	mtx_unlock(&sc->sc_mtx);
1192 
1193 	DPRINTFN(3, "interface started\n");
1194 }
1195 
1196 static int
1197 usie_if_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
1198     struct route *ro)
1199 {
1200 	int err;
1201 
1202 	DPRINTF("proto=%x\n", dst->sa_family);
1203 
1204 	switch (dst->sa_family) {
1205 #ifdef INET6
1206 	case AF_INET6;
1207 	/* fall though */
1208 #endif
1209 	case AF_INET:
1210 		break;
1211 
1212 		/* silently drop dhclient packets */
1213 	case AF_UNSPEC:
1214 		m_freem(m);
1215 		return (0);
1216 
1217 		/* drop other packet types */
1218 	default:
1219 		m_freem(m);
1220 		return (EAFNOSUPPORT);
1221 	}
1222 
1223 	err = (ifp->if_transmit)(ifp, m);
1224 	if (err) {
1225 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1226 		return (ENOBUFS);
1227 	}
1228 	if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
1229 
1230 	return (0);
1231 }
1232 
1233 static void
1234 usie_if_init(void *arg)
1235 {
1236 	struct usie_softc *sc = arg;
1237 	struct ifnet *ifp = sc->sc_ifp;
1238 	uint8_t i;
1239 
1240 	mtx_lock(&sc->sc_mtx);
1241 
1242 	/* write tx descriptor */
1243 	sc->sc_txd.hip.id = USIE_HIP_CTX;
1244 	sc->sc_txd.hip.param = 0;	/* init value */
1245 	sc->sc_txd.desc_type = htobe16(USIE_IP_TX);
1246 
1247 	for (i = 0; i != USIE_IF_N_XFER; i++)
1248 		usbd_xfer_set_stall(sc->sc_if_xfer[i]);
1249 
1250 	usbd_transfer_start(sc->sc_uc_xfer[USIE_HIP_IF][USIE_UC_RX]);
1251 	usbd_transfer_start(sc->sc_if_xfer[USIE_IF_STATUS]);
1252 	usbd_transfer_start(sc->sc_if_xfer[USIE_IF_RX]);
1253 
1254 	/* if not running, initiate the modem */
1255 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
1256 		usie_cns_req(sc, USIE_CNS_ID_INIT, USIE_CNS_OB_LINK_UPDATE);
1257 
1258 	mtx_unlock(&sc->sc_mtx);
1259 
1260 	DPRINTF("ifnet initialized\n");
1261 }
1262 
1263 static void
1264 usie_if_stop(struct usie_softc *sc)
1265 {
1266 	usb_callout_drain(&sc->sc_if_sync_ch);
1267 
1268 	mtx_lock(&sc->sc_mtx);
1269 
1270 	/* usie_cns_req() clears IFF_* flags */
1271 	usie_cns_req(sc, USIE_CNS_ID_STOP, USIE_CNS_OB_LINK_UPDATE);
1272 
1273 	usbd_transfer_stop(sc->sc_if_xfer[USIE_IF_TX]);
1274 	usbd_transfer_stop(sc->sc_if_xfer[USIE_IF_RX]);
1275 	usbd_transfer_stop(sc->sc_if_xfer[USIE_IF_STATUS]);
1276 
1277 	/* shutdown device */
1278 	usie_if_cmd(sc, USIE_HIP_DOWN);
1279 
1280 	mtx_unlock(&sc->sc_mtx);
1281 }
1282 
1283 static int
1284 usie_if_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1285 {
1286 	struct usie_softc *sc = ifp->if_softc;
1287 	struct ieee80211req *ireq;
1288 	struct ieee80211req_sta_info si;
1289 	struct ifmediareq *ifmr;
1290 
1291 	switch (cmd) {
1292 	case SIOCSIFFLAGS:
1293 		if (ifp->if_flags & IFF_UP) {
1294 			if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
1295 				usie_if_init(sc);
1296 		} else {
1297 			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1298 				usie_if_stop(sc);
1299 		}
1300 		break;
1301 
1302 	case SIOCSIFCAP:
1303 		if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1304 			device_printf(sc->sc_dev,
1305 			    "Connect to the network first.\n");
1306 			break;
1307 		}
1308 		mtx_lock(&sc->sc_mtx);
1309 		usie_cns_req(sc, USIE_CNS_ID_RSSI, USIE_CNS_OB_RSSI);
1310 		mtx_unlock(&sc->sc_mtx);
1311 		break;
1312 
1313 	case SIOCG80211:
1314 		ireq = (struct ieee80211req *)data;
1315 
1316 		if (ireq->i_type != IEEE80211_IOC_STA_INFO)
1317 			break;
1318 
1319 		memset(&si, 0, sizeof(si));
1320 		si.isi_len = sizeof(si);
1321 		/*
1322 		 * ifconfig expects RSSI in 0.5dBm units
1323 		 * relative to the noise floor.
1324 		 */
1325 		si.isi_rssi = 2 * sc->sc_rssi;
1326 		if (copyout(&si, (uint8_t *)ireq->i_data + 8,
1327 		    sizeof(struct ieee80211req_sta_info)))
1328 			DPRINTF("copyout failed\n");
1329 		DPRINTF("80211\n");
1330 		break;
1331 
1332 	case SIOCGIFMEDIA:		/* to fool ifconfig */
1333 		ifmr = (struct ifmediareq *)data;
1334 		ifmr->ifm_count = 1;
1335 		DPRINTF("media\n");
1336 		break;
1337 
1338 	case SIOCSIFADDR:
1339 		break;
1340 
1341 	default:
1342 		return (EINVAL);
1343 	}
1344 	return (0);
1345 }
1346 
1347 static int
1348 usie_do_request(struct usie_softc *sc, struct usb_device_request *req,
1349     void *data)
1350 {
1351 	int err = 0;
1352 	int ntries;
1353 
1354 	mtx_assert(&sc->sc_mtx, MA_OWNED);
1355 
1356 	for (ntries = 0; ntries != 10; ntries++) {
1357 		err = usbd_do_request(sc->sc_udev,
1358 		    &sc->sc_mtx, req, data);
1359 		if (err == 0)
1360 			break;
1361 
1362 		DPRINTF("Control request failed: %s %d/10\n",
1363 		    usbd_errstr(err), ntries);
1364 
1365 		usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(10));
1366 	}
1367 	return (err);
1368 }
1369 
1370 static int
1371 usie_if_cmd(struct usie_softc *sc, uint8_t cmd)
1372 {
1373 	struct usb_device_request req;
1374 	struct usie_hip msg;
1375 
1376 	msg.len = 0;
1377 	msg.id = cmd;
1378 	msg.param = 0;
1379 
1380 	req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1381 	req.bRequest = UCDC_SEND_ENCAPSULATED_COMMAND;
1382 	USETW(req.wValue, 0);
1383 	USETW(req.wIndex, sc->sc_if_ifnum);
1384 	USETW(req.wLength, sizeof(msg));
1385 
1386 	DPRINTF("cmd=%x\n", cmd);
1387 
1388 	return (usie_do_request(sc, &req, &msg));
1389 }
1390 
1391 static void
1392 usie_cns_req(struct usie_softc *sc, uint32_t id, uint16_t obj)
1393 {
1394 	struct ifnet *ifp = sc->sc_ifp;
1395 	struct mbuf *m;
1396 	struct usb_xfer *xfer;
1397 	struct usie_hip *hip;
1398 	struct usie_cns *cns;
1399 	uint8_t *param;
1400 	uint8_t *tmp;
1401 	uint8_t cns_len;
1402 
1403 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1404 	if (__predict_false(m == NULL)) {
1405 		DPRINTF("could not allocate mbuf\n");
1406 		if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1407 		return;
1408 	}
1409 	/* to align usie_hip{} on 32 bit */
1410 	m->m_data += 3;
1411 	param = mtod(m, uint8_t *);
1412 	*param++ = USIE_HIP_FRM_CHR;
1413 	hip = (struct usie_hip *)param;
1414 	cns = (struct usie_cns *)(hip + 1);
1415 
1416 	tmp = param + USIE_HIPCNS_MIN - 2;
1417 
1418 	switch (obj) {
1419 	case USIE_CNS_OB_LINK_UPDATE:
1420 		cns_len = 2;
1421 		cns->op = USIE_CNS_OP_SET;
1422 		*tmp++ = 1;		/* profile ID, always use 1 for now */
1423 		*tmp++ = id == USIE_CNS_ID_INIT ? 1 : 0;
1424 		break;
1425 
1426 	case USIE_CNS_OB_PROF_WRITE:
1427 		cns_len = 245;
1428 		cns->op = USIE_CNS_OP_SET;
1429 		*tmp++ = 1;		/* profile ID, always use 1 for now */
1430 		*tmp++ = 2;
1431 		memcpy(tmp, &sc->sc_net, 34);
1432 		memset(tmp + 35, 0, 245 - 36);
1433 		tmp += 243;
1434 		break;
1435 
1436 	case USIE_CNS_OB_RSSI:
1437 		cns_len = 0;
1438 		cns->op = USIE_CNS_OP_REQ;
1439 		break;
1440 
1441 	default:
1442 		DPRINTF("unsupported CnS object type\n");
1443 		return;
1444 	}
1445 	*tmp = USIE_HIP_FRM_CHR;
1446 
1447 	hip->len = htobe16(sizeof(struct usie_cns) + cns_len);
1448 	hip->id = USIE_HIP_CNS2M;
1449 	hip->param = 0;			/* none for CnS */
1450 
1451 	cns->obj = htobe16(obj);
1452 	cns->id = htobe32(id);
1453 	cns->len = cns_len;
1454 	cns->rsv0 = cns->rsv1 = 0;	/* always '0' */
1455 
1456 	param = (uint8_t *)(cns + 1);
1457 
1458 	DPRINTF("param: %16D\n", param, ":");
1459 
1460 	m->m_pkthdr.len = m->m_len = USIE_HIPCNS_MIN + cns_len + 2;
1461 
1462 	xfer = sc->sc_uc_xfer[USIE_HIP_IF][USIE_UC_TX];
1463 
1464 	if (usbd_xfer_get_priv(xfer) == NULL) {
1465 		usbd_xfer_set_priv(xfer, m);
1466 		usbd_transfer_start(xfer);
1467 	} else {
1468 		DPRINTF("Dropped CNS event\n");
1469 		m_freem(m);
1470 	}
1471 }
1472 
1473 static void
1474 usie_cns_rsp(struct usie_softc *sc, struct usie_cns *cns)
1475 {
1476 	struct ifnet *ifp = sc->sc_ifp;
1477 
1478 	DPRINTF("received CnS\n");
1479 
1480 	switch (be16toh(cns->obj)) {
1481 	case USIE_CNS_OB_LINK_UPDATE:
1482 		if (be32toh(cns->id) & USIE_CNS_ID_INIT)
1483 			usie_if_sync_to(sc);
1484 		else if (be32toh(cns->id) & USIE_CNS_ID_STOP) {
1485 			ifp->if_flags &= ~IFF_UP;
1486 			ifp->if_drv_flags &=
1487 			    ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
1488 		} else
1489 			DPRINTF("undefined link update\n");
1490 		break;
1491 
1492 	case USIE_CNS_OB_RSSI:
1493 		sc->sc_rssi = be16toh(*(int16_t *)(cns + 1));
1494 		if (sc->sc_rssi <= 0)
1495 			device_printf(sc->sc_dev, "No signal\n");
1496 		else {
1497 			device_printf(sc->sc_dev, "RSSI=%ddBm\n",
1498 			    sc->sc_rssi - 110);
1499 		}
1500 		break;
1501 
1502 	case USIE_CNS_OB_PROF_WRITE:
1503 		break;
1504 
1505 	case USIE_CNS_OB_PDP_READ:
1506 		break;
1507 
1508 	default:
1509 		DPRINTF("undefined CnS\n");
1510 		break;
1511 	}
1512 }
1513 
1514 static void
1515 usie_hip_rsp(struct usie_softc *sc, uint8_t *rsp, uint32_t len)
1516 {
1517 	struct usie_hip *hip;
1518 	struct usie_cns *cns;
1519 	uint32_t i;
1520 	uint32_t j;
1521 	uint32_t off;
1522 	uint8_t tmp[USIE_HIPCNS_MAX] __aligned(4);
1523 
1524 	for (off = 0; (off + USIE_HIPCNS_MIN) <= len; off++) {
1525 
1526 		uint8_t pad;
1527 
1528 		while ((off < len) && (rsp[off] == USIE_HIP_FRM_CHR))
1529 			off++;
1530 
1531 		/* Unstuff the bytes */
1532 		for (i = j = 0; ((i + off) < len) &&
1533 		    (j < USIE_HIPCNS_MAX); i++) {
1534 
1535 			if (rsp[i + off] == USIE_HIP_FRM_CHR)
1536 				break;
1537 
1538 			if (rsp[i + off] == USIE_HIP_ESC_CHR) {
1539 				if ((i + off + 1) >= len)
1540 					break;
1541 				tmp[j++] = rsp[i++ + off + 1] ^ 0x20;
1542 			} else {
1543 				tmp[j++] = rsp[i + off];
1544 			}
1545 		}
1546 
1547 		off += i;
1548 
1549 		DPRINTF("frame len=%d\n", j);
1550 
1551 		if (j < sizeof(struct usie_hip)) {
1552 			DPRINTF("too little data\n");
1553 			break;
1554 		}
1555 		/*
1556 		 * Make sure we are not reading the stack if something
1557 		 * is wrong.
1558 		 */
1559 		memset(tmp + j, 0, sizeof(tmp) - j);
1560 
1561 		hip = (struct usie_hip *)tmp;
1562 
1563 		DPRINTF("hip: len=%d msgID=%02x, param=%02x\n",
1564 		    be16toh(hip->len), hip->id, hip->param);
1565 
1566 		pad = (hip->id & USIE_HIP_PAD) ? 1 : 0;
1567 
1568 		if ((hip->id & USIE_HIP_MASK) == USIE_HIP_CNS2H) {
1569 			cns = (struct usie_cns *)(((uint8_t *)(hip + 1)) + pad);
1570 
1571 			if (j < (sizeof(struct usie_cns) +
1572 			    sizeof(struct usie_hip) + pad)) {
1573 				DPRINTF("too little data\n");
1574 				break;
1575 			}
1576 			DPRINTF("cns: obj=%04x, op=%02x, rsv0=%02x, "
1577 			    "app=%08x, rsv1=%02x, len=%d\n",
1578 			    be16toh(cns->obj), cns->op, cns->rsv0,
1579 			    be32toh(cns->id), cns->rsv1, cns->len);
1580 
1581 			if (cns->op & USIE_CNS_OP_ERR)
1582 				DPRINTF("CnS error response\n");
1583 			else
1584 				usie_cns_rsp(sc, cns);
1585 
1586 			i = sizeof(struct usie_hip) + pad + sizeof(struct usie_cns);
1587 			j = cns->len;
1588 		} else {
1589 			i = sizeof(struct usie_hip) + pad;
1590 			j = be16toh(hip->len);
1591 		}
1592 #ifdef	USB_DEBUG
1593 		if (usie_debug == 0)
1594 			continue;
1595 
1596 		while (i < USIE_HIPCNS_MAX && j > 0) {
1597 			DPRINTF("param[0x%02x] = 0x%02x\n", i, tmp[i]);
1598 			i++;
1599 			j--;
1600 		}
1601 #endif
1602 	}
1603 }
1604 
1605 static int
1606 usie_driver_loaded(struct module *mod, int what, void *arg)
1607 {
1608 	switch (what) {
1609 	case MOD_LOAD:
1610 		/* register autoinstall handler */
1611 		usie_etag = EVENTHANDLER_REGISTER(usb_dev_configured,
1612 		    usie_autoinst, NULL, EVENTHANDLER_PRI_ANY);
1613 		break;
1614 	case MOD_UNLOAD:
1615 		EVENTHANDLER_DEREGISTER(usb_dev_configured, usie_etag);
1616 		break;
1617 	default:
1618 		return (EOPNOTSUPP);
1619 	}
1620 	return (0);
1621 }
1622 
1623