xref: /freebsd/sys/dev/usb/net/uhso.c (revision 96190b4fef3b4a0cc3ca0606b0c4e3e69a5e6717)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2010 Fredrik Lindberg <fli@shapeshifter.se>
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26  *
27  */
28 
29 #include <sys/param.h>
30 #include <sys/eventhandler.h>
31 #include <sys/sockio.h>
32 #include <sys/mbuf.h>
33 #include <sys/malloc.h>
34 #include <sys/kernel.h>
35 #include <sys/module.h>
36 #include <sys/socket.h>
37 #include <sys/tty.h>
38 #include <sys/sysctl.h>
39 #include <sys/condvar.h>
40 #include <sys/sx.h>
41 #include <sys/proc.h>
42 #include <sys/conf.h>
43 #include <sys/bus.h>
44 #include <sys/systm.h>
45 #include <sys/limits.h>
46 
47 #include <machine/bus.h>
48 
49 #include <net/if.h>
50 #include <net/if_var.h>
51 #include <net/if_types.h>
52 #include <net/netisr.h>
53 #include <net/bpf.h>
54 #include <netinet/in.h>
55 #include <netinet/ip.h>
56 #include <netinet/ip6.h>
57 
58 #include <dev/usb/usb.h>
59 #include <dev/usb/usbdi.h>
60 #include <dev/usb/usbdi_util.h>
61 #include <dev/usb/usb_cdc.h>
62 #include "usbdevs.h"
63 #define USB_DEBUG_VAR uhso_debug
64 #include <dev/usb/usb_debug.h>
65 #include <dev/usb/usb_process.h>
66 #include <dev/usb/usb_busdma.h>
67 #include <dev/usb/usb_msctest.h>
68 
69 #include <dev/usb/serial/usb_serial.h>
70 
71 struct uhso_tty {
72 	struct uhso_softc *ht_sc;
73 	struct usb_xfer	*ht_xfer[3];
74 	int		ht_muxport; /* Mux. port no */
75 	int		ht_open;
76 	char		ht_name[32];
77 };
78 
79 struct uhso_softc {
80 	device_t		sc_dev;
81 	struct usb_device	*sc_udev;
82 	struct mtx		sc_mtx;
83 	uint32_t		sc_type;	/* Interface definition */
84 	int			sc_radio;
85 
86 	struct usb_xfer		*sc_xfer[3];
87 	uint8_t			sc_iface_no;
88 	uint8_t			sc_iface_index;
89 
90 	/* Control pipe */
91 	struct usb_xfer	*	sc_ctrl_xfer[2];
92 	uint8_t			sc_ctrl_iface_no;
93 
94 	/* Network */
95 	struct usb_xfer		*sc_if_xfer[2];
96 	if_t			sc_ifp;
97 	struct mbuf		*sc_mwait;	/* Partial packet */
98 	size_t			sc_waitlen;	/* No. of outstanding bytes */
99 	struct mbufq		sc_rxq;
100 	struct callout		sc_c;
101 
102 	/* TTY related structures */
103 	struct ucom_super_softc sc_super_ucom;
104 	int			sc_ttys;
105 	struct uhso_tty		*sc_tty;
106 	struct ucom_softc	*sc_ucom;
107 	int			sc_msr;
108 	int			sc_lsr;
109 	int			sc_line;
110 };
111 
112 #define UHSO_MAX_MTU		2048
113 
114 /*
115  * There are mainly two type of cards floating around.
116  * The first one has 2,3 or 4 interfaces with a multiplexed serial port
117  * and packet interface on the first interface and bulk serial ports
118  * on the others.
119  * The second type of card has several other interfaces, their purpose
120  * can be detected during run-time.
121  */
122 #define UHSO_IFACE_SPEC(usb_type, port, port_type) \
123 	(((usb_type) << 24) | ((port) << 16) | (port_type))
124 
125 #define UHSO_IFACE_USB_TYPE(x) ((x >> 24) & 0xff)
126 #define UHSO_IFACE_PORT(x) ((x >> 16) & 0xff)
127 #define UHSO_IFACE_PORT_TYPE(x) (x & 0xff)
128 
129 /*
130  * USB interface types
131  */
132 #define UHSO_IF_NET		0x01	/* Network packet interface */
133 #define UHSO_IF_MUX		0x02	/* Multiplexed serial port */
134 #define UHSO_IF_BULK		0x04	/* Bulk interface */
135 
136 /*
137  * Port types
138  */
139 #define UHSO_PORT_UNKNOWN	0x00
140 #define UHSO_PORT_SERIAL	0x01	/* Serial port */
141 #define UHSO_PORT_NETWORK	0x02	/* Network packet interface */
142 
143 /*
144  * Multiplexed serial port destination sub-port names
145  */
146 #define UHSO_MPORT_TYPE_CTL	0x00	/* Control port */
147 #define UHSO_MPORT_TYPE_APP	0x01	/* Application */
148 #define UHSO_MPORT_TYPE_PCSC	0x02
149 #define UHSO_MPORT_TYPE_GPS	0x03
150 #define UHSO_MPORT_TYPE_APP2	0x04	/* Secondary application */
151 #define UHSO_MPORT_TYPE_MAX	UHSO_MPORT_TYPE_APP2
152 #define UHSO_MPORT_TYPE_NOMAX	8	/* Max number of mux ports */
153 
154 /*
155  * Port definitions
156  * Note that these definitions are arbitrary and do not match the values
157  * returned by the auto config descriptor.
158  */
159 #define UHSO_PORT_TYPE_UNKNOWN	0x00
160 #define UHSO_PORT_TYPE_CTL	0x01
161 #define UHSO_PORT_TYPE_APP	0x02
162 #define UHSO_PORT_TYPE_APP2	0x03
163 #define UHSO_PORT_TYPE_MODEM	0x04
164 #define UHSO_PORT_TYPE_NETWORK	0x05
165 #define UHSO_PORT_TYPE_DIAG	0x06
166 #define UHSO_PORT_TYPE_DIAG2	0x07
167 #define UHSO_PORT_TYPE_GPS	0x08
168 #define UHSO_PORT_TYPE_GPSCTL	0x09
169 #define UHSO_PORT_TYPE_PCSC	0x0a
170 #define UHSO_PORT_TYPE_MSD	0x0b
171 #define UHSO_PORT_TYPE_VOICE	0x0c
172 #define UHSO_PORT_TYPE_MAX	0x0c
173 
174 static eventhandler_tag uhso_etag;
175 
176 /* Overall port type */
177 static char *uhso_port[] = {
178 	"Unknown",
179 	"Serial",
180 	"Network",
181 	"Network/Serial"
182 };
183 
184 /*
185  * Map between interface port type read from device and description type.
186  * The position in this array is a direct map to the auto config
187  * descriptor values.
188  */
189 static unsigned char uhso_port_map[] = {
190 	UHSO_PORT_TYPE_UNKNOWN,
191 	UHSO_PORT_TYPE_DIAG,
192 	UHSO_PORT_TYPE_GPS,
193 	UHSO_PORT_TYPE_GPSCTL,
194 	UHSO_PORT_TYPE_APP,
195 	UHSO_PORT_TYPE_APP2,
196 	UHSO_PORT_TYPE_CTL,
197 	UHSO_PORT_TYPE_NETWORK,
198 	UHSO_PORT_TYPE_MODEM,
199 	UHSO_PORT_TYPE_MSD,
200 	UHSO_PORT_TYPE_PCSC,
201 	UHSO_PORT_TYPE_VOICE
202 };
203 static char uhso_port_map_max = sizeof(uhso_port_map) / sizeof(char);
204 
205 static unsigned char uhso_mux_port_map[] = {
206 	UHSO_PORT_TYPE_CTL,
207 	UHSO_PORT_TYPE_APP,
208 	UHSO_PORT_TYPE_PCSC,
209 	UHSO_PORT_TYPE_GPS,
210 	UHSO_PORT_TYPE_APP2
211 };
212 
213 static char *uhso_port_type[] = {
214 	"Unknown",  /* Not a valid port */
215 	"Control",
216 	"Application",
217 	"Application (Secondary)",
218 	"Modem",
219 	"Network",
220 	"Diagnostic",
221 	"Diagnostic (Secondary)",
222 	"GPS",
223 	"GPS Control",
224 	"PC Smartcard",
225 	"MSD",
226 	"Voice",
227 };
228 
229 static char *uhso_port_type_sysctl[] = {
230 	"unknown",
231 	"control",
232 	"application",
233 	"application",
234 	"modem",
235 	"network",
236 	"diagnostic",
237 	"diagnostic",
238 	"gps",
239 	"gps_control",
240 	"pcsc",
241 	"msd",
242 	"voice",
243 };
244 
245 #define UHSO_STATIC_IFACE	0x01
246 #define UHSO_AUTO_IFACE		0x02
247 
248 /* ifnet device unit allocations */
249 static struct unrhdr *uhso_ifnet_unit = NULL;
250 
251 static const STRUCT_USB_HOST_ID uhso_devs[] = {
252 #define	UHSO_DEV(v,p,i) { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, i) }
253 	/* Option GlobeTrotter MAX 7.2 with upgraded firmware */
254 	UHSO_DEV(OPTION, GTMAX72, UHSO_STATIC_IFACE),
255 	/* Option GlobeSurfer iCON 7.2 */
256 	UHSO_DEV(OPTION, GSICON72, UHSO_STATIC_IFACE),
257 	/* Option iCON 225 */
258 	UHSO_DEV(OPTION, GTHSDPA, UHSO_STATIC_IFACE),
259 	/* Option GlobeSurfer iCON HSUPA */
260 	UHSO_DEV(OPTION, GSICONHSUPA, UHSO_STATIC_IFACE),
261 	/* Option GlobeTrotter HSUPA */
262 	UHSO_DEV(OPTION, GTHSUPA, UHSO_STATIC_IFACE),
263 	/* GE40x */
264 	UHSO_DEV(OPTION, GE40X, UHSO_AUTO_IFACE),
265 	UHSO_DEV(OPTION, GE40X_1, UHSO_AUTO_IFACE),
266 	UHSO_DEV(OPTION, GE40X_2, UHSO_AUTO_IFACE),
267 	UHSO_DEV(OPTION, GE40X_3, UHSO_AUTO_IFACE),
268 	/* Option GlobeSurfer iCON 401 */
269 	UHSO_DEV(OPTION, ICON401, UHSO_AUTO_IFACE),
270 	/* Option GlobeTrotter Module 382 */
271 	UHSO_DEV(OPTION, GMT382, UHSO_AUTO_IFACE),
272 	/* Option GTM661W */
273 	UHSO_DEV(OPTION, GTM661W, UHSO_AUTO_IFACE),
274 	/* Option iCON EDGE */
275 	UHSO_DEV(OPTION, ICONEDGE, UHSO_STATIC_IFACE),
276 	/* Option Module HSxPA */
277 	UHSO_DEV(OPTION, MODHSXPA, UHSO_STATIC_IFACE),
278 	/* Option iCON 321 */
279 	UHSO_DEV(OPTION, ICON321, UHSO_STATIC_IFACE),
280 	/* Option iCON 322 */
281 	UHSO_DEV(OPTION, GTICON322, UHSO_STATIC_IFACE),
282 	/* Option iCON 505 */
283 	UHSO_DEV(OPTION, ICON505, UHSO_AUTO_IFACE),
284 	/* Option iCON 452 */
285 	UHSO_DEV(OPTION, ICON505, UHSO_AUTO_IFACE),
286 #undef UHSO_DEV
287 };
288 
289 static SYSCTL_NODE(_hw_usb, OID_AUTO, uhso, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
290     "USB uhso");
291 static int uhso_autoswitch = 1;
292 SYSCTL_INT(_hw_usb_uhso, OID_AUTO, auto_switch, CTLFLAG_RWTUN,
293     &uhso_autoswitch, 0, "Automatically switch to modem mode");
294 
295 #ifdef USB_DEBUG
296 #ifdef UHSO_DEBUG
297 static int uhso_debug = UHSO_DEBUG;
298 #else
299 static int uhso_debug = -1;
300 #endif
301 
302 SYSCTL_INT(_hw_usb_uhso, OID_AUTO, debug, CTLFLAG_RWTUN,
303     &uhso_debug, 0, "Debug level");
304 
305 #define UHSO_DPRINTF(n, x, ...) {\
306 	if (uhso_debug >= n) {\
307 		printf("%s: " x, __func__, ##__VA_ARGS__);\
308 	}\
309 }
310 #else
311 #define UHSO_DPRINTF(n, x, ...)
312 #endif
313 
314 #ifdef UHSO_DEBUG_HEXDUMP
315 # define UHSO_HEXDUMP(_buf, _len) do { \
316   { \
317         size_t __tmp; \
318         const char *__buf = (const char *)_buf; \
319         for (__tmp = 0; __tmp < _len; __tmp++) \
320                 printf("%02hhx ", *__buf++); \
321     printf("\n"); \
322   } \
323 } while(0)
324 #else
325 # define UHSO_HEXDUMP(_buf, _len)
326 #endif
327 
328 enum {
329 	UHSO_MUX_ENDPT_INTR = 0,
330 	UHSO_MUX_ENDPT_MAX
331 };
332 
333 enum {
334 	UHSO_CTRL_READ = 0,
335 	UHSO_CTRL_WRITE,
336 	UHSO_CTRL_MAX
337 };
338 
339 enum {
340 	UHSO_IFNET_READ = 0,
341 	UHSO_IFNET_WRITE,
342 	UHSO_IFNET_MAX
343 };
344 
345 enum {
346 	UHSO_BULK_ENDPT_READ = 0,
347 	UHSO_BULK_ENDPT_WRITE,
348 	UHSO_BULK_ENDPT_INTR,
349 	UHSO_BULK_ENDPT_MAX
350 };
351 
352 static usb_callback_t uhso_mux_intr_callback;
353 static usb_callback_t uhso_mux_read_callback;
354 static usb_callback_t uhso_mux_write_callback;
355 static usb_callback_t uhso_bs_read_callback;
356 static usb_callback_t uhso_bs_write_callback;
357 static usb_callback_t uhso_bs_intr_callback;
358 static usb_callback_t uhso_ifnet_read_callback;
359 static usb_callback_t uhso_ifnet_write_callback;
360 
361 /* Config used for the default control pipes */
362 static const struct usb_config uhso_ctrl_config[UHSO_CTRL_MAX] = {
363 	[UHSO_CTRL_READ] = {
364 		.type = UE_CONTROL,
365 		.endpoint = 0x00,
366 		.direction = UE_DIR_ANY,
367 		.flags = { .pipe_bof = 1, .short_xfer_ok = 1 },
368 		.bufsize = sizeof(struct usb_device_request) + 1024,
369 		.callback = &uhso_mux_read_callback
370 	},
371 
372 	[UHSO_CTRL_WRITE] = {
373 		.type = UE_CONTROL,
374 		.endpoint = 0x00,
375 		.direction = UE_DIR_ANY,
376 		.flags = { .pipe_bof = 1, .force_short_xfer = 1 },
377 		.bufsize = sizeof(struct usb_device_request) + 1024,
378 		.timeout = 1000,
379 		.callback = &uhso_mux_write_callback
380 	}
381 };
382 
383 /* Config for the multiplexed serial ports */
384 static const struct usb_config uhso_mux_config[UHSO_MUX_ENDPT_MAX] = {
385 	[UHSO_MUX_ENDPT_INTR] = {
386 		.type = UE_INTERRUPT,
387 		.endpoint = UE_ADDR_ANY,
388 		.direction = UE_DIR_IN,
389 		.flags = { .short_xfer_ok = 1 },
390 		.bufsize = 0,
391 		.callback = &uhso_mux_intr_callback,
392 	}
393 };
394 
395 /* Config for the raw IP-packet interface */
396 static const struct usb_config uhso_ifnet_config[UHSO_IFNET_MAX] = {
397 	[UHSO_IFNET_READ] = {
398 		.type = UE_BULK,
399 		.endpoint = UE_ADDR_ANY,
400 		.direction = UE_DIR_IN,
401 		.flags = { .pipe_bof = 1, .short_xfer_ok = 1 },
402 		.bufsize = MCLBYTES,
403 		.callback = &uhso_ifnet_read_callback
404 	},
405 	[UHSO_IFNET_WRITE] = {
406 		.type = UE_BULK,
407 		.endpoint = UE_ADDR_ANY,
408 		.direction = UE_DIR_OUT,
409 		.flags = { .pipe_bof = 1, .force_short_xfer = 1 },
410 		.bufsize = MCLBYTES,
411 		.timeout = 5 * USB_MS_HZ,
412 		.callback = &uhso_ifnet_write_callback
413 	}
414 };
415 
416 /* Config for interfaces with normal bulk serial ports */
417 static const struct usb_config uhso_bs_config[UHSO_BULK_ENDPT_MAX] = {
418 	[UHSO_BULK_ENDPT_READ] = {
419 		.type = UE_BULK,
420 		.endpoint = UE_ADDR_ANY,
421 		.direction = UE_DIR_IN,
422 		.flags = { .pipe_bof = 1, .short_xfer_ok = 1 },
423 		.bufsize = 4096,
424 		.callback = &uhso_bs_read_callback
425 	},
426 
427 	[UHSO_BULK_ENDPT_WRITE] = {
428 		.type = UE_BULK,
429 		.endpoint = UE_ADDR_ANY,
430 		.direction = UE_DIR_OUT,
431 		.flags = { .pipe_bof = 1, .force_short_xfer = 1 },
432 		.bufsize = 8192,
433 		.callback = &uhso_bs_write_callback
434 	},
435 
436 	[UHSO_BULK_ENDPT_INTR] = {
437 		.type = UE_INTERRUPT,
438 		.endpoint = UE_ADDR_ANY,
439 		.direction = UE_DIR_IN,
440 		.flags = { .short_xfer_ok = 1 },
441 		.bufsize = 0,
442 		.callback = &uhso_bs_intr_callback,
443 	}
444 };
445 
446 static int  uhso_probe_iface(struct uhso_softc *, int,
447     int (*probe)(struct usb_device *, int));
448 static int  uhso_probe_iface_auto(struct usb_device *, int);
449 static int  uhso_probe_iface_static(struct usb_device *, int);
450 static int  uhso_attach_muxserial(struct uhso_softc *, struct usb_interface *,
451     int type);
452 static int  uhso_attach_bulkserial(struct uhso_softc *, struct usb_interface *,
453     int type);
454 static int  uhso_attach_ifnet(struct uhso_softc *, struct usb_interface *,
455     int type);
456 static void uhso_test_autoinst(void *, struct usb_device *,
457 		struct usb_attach_arg *);
458 static int  uhso_driver_loaded(struct module *, int, void *);
459 static int uhso_radio_sysctl(SYSCTL_HANDLER_ARGS);
460 static int uhso_radio_ctrl(struct uhso_softc *, int);
461 
462 static void uhso_free(struct ucom_softc *);
463 static void uhso_ucom_start_read(struct ucom_softc *);
464 static void uhso_ucom_stop_read(struct ucom_softc *);
465 static void uhso_ucom_start_write(struct ucom_softc *);
466 static void uhso_ucom_stop_write(struct ucom_softc *);
467 static void uhso_ucom_cfg_get_status(struct ucom_softc *, uint8_t *, uint8_t *);
468 static void uhso_ucom_cfg_set_dtr(struct ucom_softc *, uint8_t);
469 static void uhso_ucom_cfg_set_rts(struct ucom_softc *, uint8_t);
470 static void uhso_if_init(void *);
471 static void uhso_if_start(if_t);
472 static void uhso_if_stop(struct uhso_softc *);
473 static int  uhso_if_ioctl(if_t, u_long, caddr_t);
474 static int  uhso_if_output(if_t, struct mbuf *,
475     const struct sockaddr *, struct route *);
476 static void uhso_if_rxflush(void *);
477 
478 static device_probe_t uhso_probe;
479 static device_attach_t uhso_attach;
480 static device_detach_t uhso_detach;
481 static void uhso_free_softc(struct uhso_softc *);
482 
483 static device_method_t uhso_methods[] = {
484 	DEVMETHOD(device_probe,		uhso_probe),
485 	DEVMETHOD(device_attach,	uhso_attach),
486 	DEVMETHOD(device_detach,	uhso_detach),
487 	{ 0, 0 }
488 };
489 
490 static driver_t uhso_driver = {
491 	.name = "uhso",
492 	.methods = uhso_methods,
493 	.size = sizeof(struct uhso_softc)
494 };
495 
496 DRIVER_MODULE(uhso, uhub, uhso_driver, uhso_driver_loaded, NULL);
497 MODULE_DEPEND(uhso, ucom, 1, 1, 1);
498 MODULE_DEPEND(uhso, usb, 1, 1, 1);
499 MODULE_VERSION(uhso, 1);
500 USB_PNP_HOST_INFO(uhso_devs);
501 
502 static struct ucom_callback uhso_ucom_callback = {
503 	.ucom_cfg_get_status = &uhso_ucom_cfg_get_status,
504 	.ucom_cfg_set_dtr = &uhso_ucom_cfg_set_dtr,
505 	.ucom_cfg_set_rts = &uhso_ucom_cfg_set_rts,
506 	.ucom_start_read = uhso_ucom_start_read,
507 	.ucom_stop_read = uhso_ucom_stop_read,
508 	.ucom_start_write = uhso_ucom_start_write,
509 	.ucom_stop_write = uhso_ucom_stop_write,
510 	.ucom_free = &uhso_free,
511 };
512 
513 static int
514 uhso_probe(device_t self)
515 {
516 	struct usb_attach_arg *uaa = device_get_ivars(self);
517 	int error;
518 
519 	if (uaa->usb_mode != USB_MODE_HOST)
520 		return (ENXIO);
521 	if (uaa->info.bConfigIndex != 0)
522 		return (ENXIO);
523 	if (uaa->info.bDeviceClass != 0xff)
524 		return (ENXIO);
525 
526 	error = usbd_lookup_id_by_uaa(uhso_devs, sizeof(uhso_devs), uaa);
527 	if (error != 0)
528 		return (error);
529 
530 	/*
531 	 * Probe device to see if we are able to attach
532 	 * to this interface or not.
533 	 */
534 	if (USB_GET_DRIVER_INFO(uaa) == UHSO_AUTO_IFACE) {
535 		if (uhso_probe_iface_auto(uaa->device,
536 		    uaa->info.bIfaceNum) == 0)
537 			return (ENXIO);
538 	}
539 	return (error);
540 }
541 
542 static int
543 uhso_attach(device_t self)
544 {
545 	struct uhso_softc *sc = device_get_softc(self);
546 	struct usb_attach_arg *uaa = device_get_ivars(self);
547 	struct usb_interface_descriptor *id;
548 	struct sysctl_ctx_list *sctx;
549 	struct sysctl_oid *soid;
550 	struct sysctl_oid *tree = NULL, *tty_node;
551 	struct ucom_softc *ucom;
552 	struct uhso_tty *ht;
553 	int i, error, port;
554 	void *probe_f;
555 	usb_error_t uerr;
556 	char *desc;
557 
558 	sc->sc_dev = self;
559 	sc->sc_udev = uaa->device;
560 	mtx_init(&sc->sc_mtx, "uhso", NULL, MTX_DEF);
561 	mbufq_init(&sc->sc_rxq, INT_MAX);	/* XXXGL: sane maximum */
562 	ucom_ref(&sc->sc_super_ucom);
563 
564 	sc->sc_radio = 1;
565 
566 	id = usbd_get_interface_descriptor(uaa->iface);
567 	sc->sc_ctrl_iface_no = id->bInterfaceNumber;
568 
569 	sc->sc_iface_no = uaa->info.bIfaceNum;
570 	sc->sc_iface_index = uaa->info.bIfaceIndex;
571 
572 	/* Setup control pipe */
573 	uerr = usbd_transfer_setup(uaa->device,
574 	    &sc->sc_iface_index, sc->sc_ctrl_xfer,
575 	    uhso_ctrl_config, UHSO_CTRL_MAX, sc, &sc->sc_mtx);
576 	if (uerr) {
577 		device_printf(self, "Failed to setup control pipe: %s\n",
578 		    usbd_errstr(uerr));
579 		goto out;
580 	}
581 
582 	if (USB_GET_DRIVER_INFO(uaa) == UHSO_STATIC_IFACE)
583 		probe_f = uhso_probe_iface_static;
584 	else if (USB_GET_DRIVER_INFO(uaa) == UHSO_AUTO_IFACE)
585 		probe_f = uhso_probe_iface_auto;
586 	else
587 		goto out;
588 
589 	error = uhso_probe_iface(sc, uaa->info.bIfaceNum, probe_f);
590 	if (error != 0)
591 		goto out;
592 
593 	sctx = device_get_sysctl_ctx(sc->sc_dev);
594 	soid = device_get_sysctl_tree(sc->sc_dev);
595 
596 	SYSCTL_ADD_STRING(sctx, SYSCTL_CHILDREN(soid), OID_AUTO, "type",
597 	    CTLFLAG_RD, uhso_port[UHSO_IFACE_PORT(sc->sc_type)], 0,
598 	    "Port available at this interface");
599 	SYSCTL_ADD_PROC(sctx, SYSCTL_CHILDREN(soid), OID_AUTO, "radio",
600 	    CTLTYPE_INT | CTLFLAG_RWTUN | CTLFLAG_MPSAFE, sc, 0,
601 	    uhso_radio_sysctl, "I", "Enable radio");
602 
603 	/*
604 	 * The default interface description on most Option devices isn't
605 	 * very helpful. So we skip device_set_usb_desc and set the
606 	 * device description manually.
607 	 */
608 	device_set_desc_copy(self, uhso_port_type[UHSO_IFACE_PORT_TYPE(sc->sc_type)]);
609 	/* Announce device */
610 	device_printf(self, "<%s port> at <%s %s> on %s\n",
611 	    uhso_port_type[UHSO_IFACE_PORT_TYPE(sc->sc_type)],
612 	    usb_get_manufacturer(uaa->device),
613 	    usb_get_product(uaa->device),
614 	    device_get_nameunit(device_get_parent(self)));
615 
616 	if (sc->sc_ttys > 0) {
617 		SYSCTL_ADD_INT(sctx, SYSCTL_CHILDREN(soid), OID_AUTO, "ports",
618 		    CTLFLAG_RD, &sc->sc_ttys, 0, "Number of attached serial ports");
619 
620 		tree = SYSCTL_ADD_NODE(sctx, SYSCTL_CHILDREN(soid), OID_AUTO,
621 		    "port", CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "Serial ports");
622 	}
623 
624 	/*
625 	 * Loop through the number of found TTYs and create sysctl
626 	 * nodes for them.
627 	 */
628 	for (i = 0; i < sc->sc_ttys; i++) {
629 		ht = &sc->sc_tty[i];
630 		ucom = &sc->sc_ucom[i];
631 
632 		if (UHSO_IFACE_USB_TYPE(sc->sc_type) & UHSO_IF_MUX)
633 			port = uhso_mux_port_map[ht->ht_muxport];
634 		else
635 			port = UHSO_IFACE_PORT_TYPE(sc->sc_type);
636 
637 		desc = uhso_port_type_sysctl[port];
638 
639 		tty_node = SYSCTL_ADD_NODE(sctx, SYSCTL_CHILDREN(tree), OID_AUTO,
640 		    desc, CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, "");
641 
642 		ht->ht_name[0] = 0;
643 		if (sc->sc_ttys == 1)
644 			snprintf(ht->ht_name, 32, "cuaU%d", ucom->sc_super->sc_unit);
645 		else {
646 			snprintf(ht->ht_name, 32, "cuaU%d.%d",
647 			    ucom->sc_super->sc_unit, ucom->sc_subunit);
648 		}
649 
650 		desc = uhso_port_type[port];
651 		SYSCTL_ADD_STRING(sctx, SYSCTL_CHILDREN(tty_node), OID_AUTO,
652 		    "tty", CTLFLAG_RD, ht->ht_name, 0, "");
653 		SYSCTL_ADD_STRING(sctx, SYSCTL_CHILDREN(tty_node), OID_AUTO,
654 		    "desc", CTLFLAG_RD, desc, 0, "");
655 
656 		if (bootverbose)
657 			device_printf(sc->sc_dev,
658 			    "\"%s\" port at %s\n", desc, ht->ht_name);
659 	}
660 
661 	return (0);
662 out:
663 	uhso_detach(sc->sc_dev);
664 	return (ENXIO);
665 }
666 
667 static int
668 uhso_detach(device_t self)
669 {
670 	struct uhso_softc *sc = device_get_softc(self);
671 	int i;
672 
673 	usbd_transfer_unsetup(sc->sc_xfer, 3);
674 	usbd_transfer_unsetup(sc->sc_ctrl_xfer, UHSO_CTRL_MAX);
675 	if (sc->sc_ttys > 0) {
676 		ucom_detach(&sc->sc_super_ucom, sc->sc_ucom);
677 
678 		for (i = 0; i < sc->sc_ttys; i++) {
679 			if (sc->sc_tty[i].ht_muxport != -1) {
680 				usbd_transfer_unsetup(sc->sc_tty[i].ht_xfer,
681 				    UHSO_CTRL_MAX);
682 			}
683 		}
684 	}
685 
686 	if (sc->sc_ifp != NULL) {
687 		callout_drain(&sc->sc_c);
688 		free_unr(uhso_ifnet_unit, if_getdunit(sc->sc_ifp));
689 		mtx_lock(&sc->sc_mtx);
690 		uhso_if_stop(sc);
691 		mtx_unlock(&sc->sc_mtx);
692 		bpfdetach(sc->sc_ifp);
693 		if_detach(sc->sc_ifp);
694 		if_free(sc->sc_ifp);
695 		usbd_transfer_unsetup(sc->sc_if_xfer, UHSO_IFNET_MAX);
696 	}
697 
698 	device_claim_softc(self);
699 
700 	uhso_free_softc(sc);
701 
702 	return (0);
703 }
704 
705 UCOM_UNLOAD_DRAIN(uhso);
706 
707 static void
708 uhso_free_softc(struct uhso_softc *sc)
709 {
710 	if (ucom_unref(&sc->sc_super_ucom)) {
711 		free(sc->sc_tty, M_USBDEV);
712 		free(sc->sc_ucom, M_USBDEV);
713 		mtx_destroy(&sc->sc_mtx);
714 		device_free_softc(sc);
715 	}
716 }
717 
718 static void
719 uhso_free(struct ucom_softc *ucom)
720 {
721 	uhso_free_softc(ucom->sc_parent);
722 }
723 
724 static void
725 uhso_test_autoinst(void *arg, struct usb_device *udev,
726     struct usb_attach_arg *uaa)
727 {
728 	struct usb_interface *iface;
729 	struct usb_interface_descriptor *id;
730 
731 	if (uaa->dev_state != UAA_DEV_READY || !uhso_autoswitch)
732 		return;
733 
734 	iface = usbd_get_iface(udev, 0);
735 	if (iface == NULL)
736 		return;
737 	id = iface->idesc;
738 	if (id == NULL || id->bInterfaceClass != UICLASS_MASS)
739 		return;
740 	if (usbd_lookup_id_by_uaa(uhso_devs, sizeof(uhso_devs), uaa))
741 		return;		/* no device match */
742 
743 	if (usb_msc_eject(udev, 0, MSC_EJECT_REZERO) == 0) {
744 		/* success, mark the udev as disappearing */
745 		uaa->dev_state = UAA_DEV_EJECTING;
746 	}
747 }
748 
749 static int
750 uhso_driver_loaded(struct module *mod, int what, void *arg)
751 {
752 	switch (what) {
753 	case MOD_LOAD:
754 		/* register our autoinstall handler */
755 		uhso_etag = EVENTHANDLER_REGISTER(usb_dev_configured,
756 		    uhso_test_autoinst, NULL, EVENTHANDLER_PRI_ANY);
757 		/* create our unit allocator for inet devs */
758 		uhso_ifnet_unit = new_unrhdr(0, INT_MAX, NULL);
759 		break;
760 	case MOD_UNLOAD:
761 		EVENTHANDLER_DEREGISTER(usb_dev_configured, uhso_etag);
762 		delete_unrhdr(uhso_ifnet_unit);
763 		break;
764 	default:
765 		return (EOPNOTSUPP);
766 	}
767 	return (0);
768 }
769 
770 /*
771  * Probe the interface type by querying the device. The elements
772  * of an array indicates the capabilities of a particular interface.
773  * Returns a bit mask with the interface capabilities.
774  */
775 static int
776 uhso_probe_iface_auto(struct usb_device *udev, int index)
777 {
778 	struct usb_device_request req;
779 	usb_error_t uerr;
780 	uint16_t actlen = 0;
781 	char port;
782 	char buf[17] = {0};
783 
784 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
785 	req.bRequest = 0x86;
786 	USETW(req.wValue, 0);
787 	USETW(req.wIndex, 0);
788 	USETW(req.wLength, 17);
789 
790 	uerr = usbd_do_request_flags(udev, NULL, &req, buf,
791 	    0, &actlen, USB_MS_HZ);
792 	if (uerr != 0) {
793 		printf("%s: usbd_do_request_flags failed, %s\n",
794 		    __func__, usbd_errstr(uerr));
795 		return (0);
796 	}
797 
798 	UHSO_DPRINTF(1, "actlen=%d\n", actlen);
799 	UHSO_HEXDUMP(buf, 17);
800 
801 	if (index < 0 || index > 16) {
802 		UHSO_DPRINTF(0, "Index %d out of range\n", index);
803 		return (0);
804 	}
805 
806 	UHSO_DPRINTF(1, "index=%d, type=%x[%s]\n", index, buf[index],
807 	    uhso_port_type[(int)uhso_port_map[(int)buf[index]]]);
808 
809 	if (buf[index] >= uhso_port_map_max)
810 		port = 0;
811 	else
812 		port = uhso_port_map[(int)buf[index]];
813 
814 	switch (port) {
815 	case UHSO_PORT_TYPE_NETWORK:
816 		return (UHSO_IFACE_SPEC(UHSO_IF_NET | UHSO_IF_MUX,
817 		    UHSO_PORT_SERIAL | UHSO_PORT_NETWORK, port));
818 	case UHSO_PORT_TYPE_DIAG:
819 	case UHSO_PORT_TYPE_DIAG2:
820 	case UHSO_PORT_TYPE_GPS:
821 	case UHSO_PORT_TYPE_GPSCTL:
822 	case UHSO_PORT_TYPE_CTL:
823 	case UHSO_PORT_TYPE_APP:
824 	case UHSO_PORT_TYPE_APP2:
825 	case UHSO_PORT_TYPE_MODEM:
826 		return (UHSO_IFACE_SPEC(UHSO_IF_BULK,
827 		    UHSO_PORT_SERIAL, port));
828 	case UHSO_PORT_TYPE_MSD:
829 		return (0);
830 	case UHSO_PORT_TYPE_UNKNOWN:
831 	default:
832 		return (0);
833 	}
834 
835 	return (0);
836 }
837 
838 /*
839  * Returns the capabilities of interfaces for devices that don't
840  * support the automatic query.
841  * Returns a bit mask with the interface capabilities.
842  */
843 static int
844 uhso_probe_iface_static(struct usb_device *udev, int index)
845 {
846 	struct usb_config_descriptor *cd;
847 
848 	cd = usbd_get_config_descriptor(udev);
849 	if (cd->bNumInterface <= 3) {
850 		/* Cards with 3 or less interfaces */
851 		switch (index) {
852 		case 0:
853 			return UHSO_IFACE_SPEC(UHSO_IF_NET | UHSO_IF_MUX,
854 			    UHSO_PORT_SERIAL | UHSO_PORT_NETWORK,
855 			    UHSO_PORT_TYPE_NETWORK);
856 		case 1:
857 			return UHSO_IFACE_SPEC(UHSO_IF_BULK,
858 			    UHSO_PORT_SERIAL, UHSO_PORT_TYPE_DIAG);
859 		case 2:
860 			return UHSO_IFACE_SPEC(UHSO_IF_BULK,
861 			    UHSO_PORT_SERIAL, UHSO_PORT_TYPE_MODEM);
862 		}
863 	} else {
864 		/* Cards with 4 interfaces */
865 		switch (index) {
866 		case 0:
867 			return UHSO_IFACE_SPEC(UHSO_IF_NET | UHSO_IF_MUX,
868 			    UHSO_PORT_SERIAL | UHSO_PORT_NETWORK,
869 			    UHSO_PORT_TYPE_NETWORK);
870 		case 1:
871 			return UHSO_IFACE_SPEC(UHSO_IF_BULK,
872 			    UHSO_PORT_SERIAL, UHSO_PORT_TYPE_DIAG2);
873 		case 2:
874 			return UHSO_IFACE_SPEC(UHSO_IF_BULK,
875 			    UHSO_PORT_SERIAL, UHSO_PORT_TYPE_MODEM);
876 		case 3:
877 			return UHSO_IFACE_SPEC(UHSO_IF_BULK,
878 			    UHSO_PORT_SERIAL, UHSO_PORT_TYPE_DIAG);
879 		}
880 	}
881 	return (0);
882 }
883 
884 /*
885  * Probes an interface for its particular capabilities and attaches if
886  * it's a supported interface.
887  */
888 static int
889 uhso_probe_iface(struct uhso_softc *sc, int index,
890     int (*probe)(struct usb_device *, int))
891 {
892 	struct usb_interface *iface;
893 	int type, error;
894 
895 	UHSO_DPRINTF(1, "Probing for interface %d, probe_func=%p\n", index, probe);
896 
897 	type = probe(sc->sc_udev, index);
898 	UHSO_DPRINTF(1, "Probe result %x\n", type);
899 	if (type <= 0)
900 		return (ENXIO);
901 
902 	sc->sc_type = type;
903 	iface = usbd_get_iface(sc->sc_udev, index);
904 
905 	if (UHSO_IFACE_PORT_TYPE(type) == UHSO_PORT_TYPE_NETWORK) {
906 		error = uhso_attach_ifnet(sc, iface, type);
907 		if (error) {
908 			UHSO_DPRINTF(1, "uhso_attach_ifnet failed");
909 			return (ENXIO);
910 		}
911 
912 		/*
913 		 * If there is an additional interrupt endpoint on this
914 		 * interface then we most likely have a multiplexed serial port
915 		 * available.
916 		 */
917 		if (iface->idesc->bNumEndpoints < 3) {
918 			sc->sc_type = UHSO_IFACE_SPEC(
919 			    UHSO_IFACE_USB_TYPE(type) & ~UHSO_IF_MUX,
920 			    UHSO_IFACE_PORT(type) & ~UHSO_PORT_SERIAL,
921 			    UHSO_IFACE_PORT_TYPE(type));
922 			return (0);
923 		}
924 
925 		UHSO_DPRINTF(1, "Trying to attach mux. serial\n");
926 		error = uhso_attach_muxserial(sc, iface, type);
927 		if (error == 0 && sc->sc_ttys > 0) {
928 			error = ucom_attach(&sc->sc_super_ucom, sc->sc_ucom,
929 			    sc->sc_ttys, sc, &uhso_ucom_callback, &sc->sc_mtx);
930 			if (error) {
931 				device_printf(sc->sc_dev, "ucom_attach failed\n");
932 				return (ENXIO);
933 			}
934 			ucom_set_pnpinfo_usb(&sc->sc_super_ucom, sc->sc_dev);
935 
936 			mtx_lock(&sc->sc_mtx);
937 			usbd_transfer_start(sc->sc_xfer[UHSO_MUX_ENDPT_INTR]);
938 			mtx_unlock(&sc->sc_mtx);
939 		}
940 	} else if ((UHSO_IFACE_USB_TYPE(type) & UHSO_IF_BULK) &&
941 	    UHSO_IFACE_PORT(type) & UHSO_PORT_SERIAL) {
942 		error = uhso_attach_bulkserial(sc, iface, type);
943 		if (error)
944 			return (ENXIO);
945 
946 		error = ucom_attach(&sc->sc_super_ucom, sc->sc_ucom,
947 		    sc->sc_ttys, sc, &uhso_ucom_callback, &sc->sc_mtx);
948 		if (error) {
949 			device_printf(sc->sc_dev, "ucom_attach failed\n");
950 			return (ENXIO);
951 		}
952 		ucom_set_pnpinfo_usb(&sc->sc_super_ucom, sc->sc_dev);
953 	}
954 	else {
955 		UHSO_DPRINTF(0, "Unknown type %x\n", type);
956 		return (ENXIO);
957 	}
958 
959 	return (0);
960 }
961 
962 static int
963 uhso_radio_ctrl(struct uhso_softc *sc, int onoff)
964 {
965 	struct usb_device_request req;
966 	usb_error_t uerr;
967 
968 	req.bmRequestType = UT_VENDOR;
969 	req.bRequest = onoff ? 0x82 : 0x81;
970 	USETW(req.wValue, 0);
971 	USETW(req.wIndex, 0);
972 	USETW(req.wLength, 0);
973 
974 	uerr = usbd_do_request(sc->sc_udev, NULL, &req, NULL);
975 	if (uerr != 0) {
976 		device_printf(sc->sc_dev, "usbd_do_request_flags failed: %s\n",
977 		    usbd_errstr(uerr));
978 		return (-1);
979 	}
980 	return (onoff);
981 }
982 
983 static int
984 uhso_radio_sysctl(SYSCTL_HANDLER_ARGS)
985 {
986 	struct uhso_softc *sc = arg1;
987 	int error, radio;
988 
989 	radio = sc->sc_radio;
990 	error = sysctl_handle_int(oidp, &radio, 0, req);
991 	if (error)
992 		return (error);
993 	if (radio != sc->sc_radio) {
994 		radio = radio != 0 ? 1 : 0;
995 		error = uhso_radio_ctrl(sc, radio);
996 		if (error != -1)
997 			sc->sc_radio = radio;
998 
999 	}
1000 	return (0);
1001 }
1002 
1003 /*
1004  * Expands allocated memory to fit an additional TTY.
1005  * Two arrays are kept with matching indexes, one for ucom and one
1006  * for our private data.
1007  */
1008 static int
1009 uhso_alloc_tty(struct uhso_softc *sc)
1010 {
1011 
1012 	sc->sc_ttys++;
1013 	sc->sc_tty = reallocf(sc->sc_tty, sizeof(struct uhso_tty) * sc->sc_ttys,
1014 	    M_USBDEV, M_WAITOK | M_ZERO);
1015 	if (sc->sc_tty == NULL)
1016 		return (-1);
1017 
1018 	sc->sc_ucom = reallocf(sc->sc_ucom,
1019 	    sizeof(struct ucom_softc) * sc->sc_ttys, M_USBDEV, M_WAITOK | M_ZERO);
1020 	if (sc->sc_ucom == NULL)
1021 		return (-1);
1022 
1023 	sc->sc_tty[sc->sc_ttys - 1].ht_sc = sc;
1024 
1025 	UHSO_DPRINTF(1, "Allocated TTY %d\n", sc->sc_ttys - 1);
1026 	return (sc->sc_ttys - 1);
1027 }
1028 
1029 /*
1030  * Attach a multiplexed serial port
1031  * Data is read/written with requests on the default control pipe. An interrupt
1032  * endpoint returns when there is new data to be read.
1033  */
1034 static int
1035 uhso_attach_muxserial(struct uhso_softc *sc, struct usb_interface *iface,
1036     int type)
1037 {
1038 	struct usb_descriptor *desc;
1039 	int i, port, tty;
1040 	usb_error_t uerr;
1041 
1042 	/*
1043 	 * The class specific interface (type 0x24) descriptor subtype field
1044 	 * contains a bitmask that specifies which (and how many) ports that
1045 	 * are available through this multiplexed serial port.
1046  	 */
1047 	desc = usbd_find_descriptor(sc->sc_udev, NULL,
1048 	    iface->idesc->bInterfaceNumber, UDESC_CS_INTERFACE, 0xff, 0, 0);
1049 	if (desc == NULL) {
1050 		UHSO_DPRINTF(0, "Failed to find UDESC_CS_INTERFACE\n");
1051 		return (ENXIO);
1052 	}
1053 
1054 	UHSO_DPRINTF(1, "Mux port mask %x\n", desc->bDescriptorSubtype);
1055 	if (desc->bDescriptorSubtype == 0)
1056 		return (ENXIO);
1057 
1058 	/*
1059 	 * The bitmask is one octet, loop through the number of
1060 	 * bits that are set and create a TTY for each.
1061 	 */
1062 	for (i = 0; i < 8; i++) {
1063 		port = (1 << i);
1064 		if ((port & desc->bDescriptorSubtype) == port) {
1065 			UHSO_DPRINTF(2, "Found mux port %x (%d)\n", port, i);
1066 			tty = uhso_alloc_tty(sc);
1067 			if (tty < 0)
1068 				return (ENOMEM);
1069 			sc->sc_tty[tty].ht_muxport = i;
1070 			uerr = usbd_transfer_setup(sc->sc_udev,
1071 			    &sc->sc_iface_index, sc->sc_tty[tty].ht_xfer,
1072 			    uhso_ctrl_config, UHSO_CTRL_MAX, sc, &sc->sc_mtx);
1073 			if (uerr) {
1074 				device_printf(sc->sc_dev,
1075 				    "Failed to setup control pipe: %s\n",
1076 				    usbd_errstr(uerr));
1077 				return (ENXIO);
1078 			}
1079 		}
1080 	}
1081 
1082 	/* Setup the intr. endpoint */
1083 	uerr = usbd_transfer_setup(sc->sc_udev,
1084 	    &iface->idesc->bInterfaceNumber, sc->sc_xfer,
1085 	    uhso_mux_config, 1, sc, &sc->sc_mtx);
1086 	if (uerr)
1087 		return (ENXIO);
1088 
1089 	return (0);
1090 }
1091 
1092 /*
1093  * Interrupt callback for the multiplexed serial port. Indicates
1094  * which serial port has data waiting.
1095  */
1096 static void
1097 uhso_mux_intr_callback(struct usb_xfer *xfer, usb_error_t error)
1098 {
1099 	struct usb_page_cache *pc;
1100 	struct usb_page_search res;
1101 	struct uhso_softc *sc = usbd_xfer_softc(xfer);
1102 	unsigned i, mux;
1103 
1104 	UHSO_DPRINTF(3, "status %d\n", USB_GET_STATE(xfer));
1105 
1106 	switch (USB_GET_STATE(xfer)) {
1107 	case USB_ST_TRANSFERRED:
1108 		/*
1109 		 * The multiplexed port number can be found at the first byte.
1110 		 * It contains a bit mask, we transform this in to an integer.
1111 		 */
1112 		pc = usbd_xfer_get_frame(xfer, 0);
1113 		usbd_get_page(pc, 0, &res);
1114 
1115 		i = *((unsigned char *)res.buffer);
1116 		mux = 0;
1117 		while (i >>= 1) {
1118 			mux++;
1119 		}
1120 
1121 		UHSO_DPRINTF(3, "mux port %d (%d)\n", mux, i);
1122 		if (mux > UHSO_MPORT_TYPE_NOMAX)
1123 			break;
1124 
1125 		/* Issue a read for this serial port */
1126 		usbd_xfer_set_priv(
1127 		    sc->sc_tty[mux].ht_xfer[UHSO_CTRL_READ],
1128 		    &sc->sc_tty[mux]);
1129 		usbd_transfer_start(sc->sc_tty[mux].ht_xfer[UHSO_CTRL_READ]);
1130 
1131 		break;
1132 	case USB_ST_SETUP:
1133 tr_setup:
1134 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1135 		usbd_transfer_submit(xfer);
1136 		break;
1137 	default:
1138 		UHSO_DPRINTF(0, "error: %s\n", usbd_errstr(error));
1139 		if (error == USB_ERR_CANCELLED)
1140 			break;
1141 
1142 		usbd_xfer_set_stall(xfer);
1143 		goto tr_setup;
1144 	}
1145 }
1146 
1147 static void
1148 uhso_mux_read_callback(struct usb_xfer *xfer, usb_error_t error)
1149 {
1150 	struct uhso_softc *sc = usbd_xfer_softc(xfer);
1151 	struct usb_page_cache *pc;
1152 	struct usb_device_request req;
1153 	struct uhso_tty *ht;
1154 	int actlen, len;
1155 
1156 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1157 
1158 	UHSO_DPRINTF(3, "status %d\n", USB_GET_STATE(xfer));
1159 
1160 	ht = usbd_xfer_get_priv(xfer);
1161 	UHSO_DPRINTF(3, "ht=%p open=%d\n", ht, ht->ht_open);
1162 
1163 	switch (USB_GET_STATE(xfer)) {
1164 	case USB_ST_TRANSFERRED:
1165 		/* Got data, send to ucom */
1166 		pc = usbd_xfer_get_frame(xfer, 1);
1167 		len = usbd_xfer_frame_len(xfer, 1);
1168 
1169 		UHSO_DPRINTF(3, "got %d bytes on mux port %d\n", len,
1170 		    ht->ht_muxport);
1171 		if (len <= 0) {
1172 			usbd_transfer_start(sc->sc_xfer[UHSO_MUX_ENDPT_INTR]);
1173 			break;
1174 		}
1175 
1176 		/* Deliver data if the TTY is open, discard otherwise */
1177 		if (ht->ht_open)
1178 			ucom_put_data(&sc->sc_ucom[ht->ht_muxport], pc, 0, len);
1179 		/* FALLTHROUGH */
1180 	case USB_ST_SETUP:
1181 tr_setup:
1182 		memset(&req, 0, sizeof(struct usb_device_request));
1183 		req.bmRequestType = UT_READ_CLASS_INTERFACE;
1184 		req.bRequest = UCDC_GET_ENCAPSULATED_RESPONSE;
1185 		USETW(req.wValue, 0);
1186 		USETW(req.wIndex, ht->ht_muxport);
1187 		USETW(req.wLength, 1024);
1188 
1189 		pc = usbd_xfer_get_frame(xfer, 0);
1190 		usbd_copy_in(pc, 0, &req, sizeof(req));
1191 
1192 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1193 		usbd_xfer_set_frame_len(xfer, 1, 1024);
1194 		usbd_xfer_set_frames(xfer, 2);
1195 		usbd_transfer_submit(xfer);
1196 		break;
1197 	default:
1198 		UHSO_DPRINTF(0, "error: %s\n", usbd_errstr(error));
1199 		if (error == USB_ERR_CANCELLED)
1200 			break;
1201 		usbd_xfer_set_stall(xfer);
1202 		goto tr_setup;
1203 	}
1204 }
1205 
1206 static void
1207 uhso_mux_write_callback(struct usb_xfer *xfer, usb_error_t error)
1208 {
1209 	struct uhso_softc *sc = usbd_xfer_softc(xfer);
1210 	struct uhso_tty *ht;
1211 	struct usb_page_cache *pc;
1212 	struct usb_device_request req;
1213 	int actlen;
1214 	struct usb_page_search res;
1215 
1216 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1217 
1218 	ht = usbd_xfer_get_priv(xfer);
1219 	UHSO_DPRINTF(3, "status=%d, using mux port %d\n",
1220 	    USB_GET_STATE(xfer), ht->ht_muxport);
1221 
1222 	switch (USB_GET_STATE(xfer)) {
1223 	case USB_ST_TRANSFERRED:
1224 		UHSO_DPRINTF(3, "wrote %zd data bytes to muxport %d\n",
1225 		    actlen - sizeof(struct usb_device_request) ,
1226 		    ht->ht_muxport);
1227 		/* FALLTHROUGH */
1228 	case USB_ST_SETUP:
1229 tr_setup:
1230 		pc = usbd_xfer_get_frame(xfer, 1);
1231 		if (ucom_get_data(&sc->sc_ucom[ht->ht_muxport], pc,
1232 		    0, 32, &actlen)) {
1233 			usbd_get_page(pc, 0, &res);
1234 
1235 			memset(&req, 0, sizeof(struct usb_device_request));
1236 			req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1237 			req.bRequest = UCDC_SEND_ENCAPSULATED_COMMAND;
1238 			USETW(req.wValue, 0);
1239 			USETW(req.wIndex, ht->ht_muxport);
1240 			USETW(req.wLength, actlen);
1241 
1242 			pc = usbd_xfer_get_frame(xfer, 0);
1243 			usbd_copy_in(pc, 0, &req, sizeof(req));
1244 
1245 			usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1246 			usbd_xfer_set_frame_len(xfer, 1, actlen);
1247 			usbd_xfer_set_frames(xfer, 2);
1248 
1249 			UHSO_DPRINTF(3, "Prepared %d bytes for transmit "
1250 			    "on muxport %d\n", actlen, ht->ht_muxport);
1251 
1252 			usbd_transfer_submit(xfer);
1253 		}
1254 		break;
1255 	default:
1256 		UHSO_DPRINTF(0, "error: %s\n", usbd_errstr(error));
1257 		if (error == USB_ERR_CANCELLED)
1258 			break;
1259 		usbd_xfer_set_stall(xfer);
1260 		goto tr_setup;
1261 	}
1262 }
1263 
1264 static int
1265 uhso_attach_bulkserial(struct uhso_softc *sc, struct usb_interface *iface,
1266     int type)
1267 {
1268 	usb_error_t uerr;
1269 	int tty;
1270 
1271 	/* Try attaching RD/WR/INTR first */
1272 	uerr = usbd_transfer_setup(sc->sc_udev,
1273 	    &iface->idesc->bInterfaceNumber, sc->sc_xfer,
1274 	    uhso_bs_config, UHSO_BULK_ENDPT_MAX, sc, &sc->sc_mtx);
1275 	if (uerr) {
1276 		/* Try only RD/WR */
1277 		uerr = usbd_transfer_setup(sc->sc_udev,
1278 		    &iface->idesc->bInterfaceNumber, sc->sc_xfer,
1279 		    uhso_bs_config, UHSO_BULK_ENDPT_MAX - 1, sc, &sc->sc_mtx);
1280 	}
1281 	if (uerr) {
1282 		UHSO_DPRINTF(0, "usbd_transfer_setup failed");
1283 		return (-1);
1284 	}
1285 
1286 	tty = uhso_alloc_tty(sc);
1287 	if (tty < 0) {
1288 		usbd_transfer_unsetup(sc->sc_xfer, UHSO_BULK_ENDPT_MAX);
1289 		return (ENOMEM);
1290 	}
1291 
1292 	sc->sc_tty[tty].ht_muxport = -1;
1293 	return (0);
1294 }
1295 
1296 static void
1297 uhso_bs_read_callback(struct usb_xfer *xfer, usb_error_t error)
1298 {
1299 	struct uhso_softc *sc = usbd_xfer_softc(xfer);
1300 	struct usb_page_cache *pc;
1301 	int actlen;
1302 
1303 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1304 
1305 	UHSO_DPRINTF(3, "status %d, actlen=%d\n", USB_GET_STATE(xfer), actlen);
1306 
1307 	switch (USB_GET_STATE(xfer)) {
1308 	case USB_ST_TRANSFERRED:
1309 		pc = usbd_xfer_get_frame(xfer, 0);
1310 		ucom_put_data(&sc->sc_ucom[0], pc, 0, actlen);
1311 		/* FALLTHROUGH */
1312 	case USB_ST_SETUP:
1313 tr_setup:
1314 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1315 		usbd_transfer_submit(xfer);
1316 	break;
1317 	default:
1318 		UHSO_DPRINTF(0, "error: %s\n", usbd_errstr(error));
1319 		if (error == USB_ERR_CANCELLED)
1320 			break;
1321 		usbd_xfer_set_stall(xfer);
1322 		goto tr_setup;
1323 	}
1324 }
1325 
1326 static void
1327 uhso_bs_write_callback(struct usb_xfer *xfer, usb_error_t error)
1328 {
1329 	struct uhso_softc *sc = usbd_xfer_softc(xfer);
1330 	struct usb_page_cache *pc;
1331 	int actlen;
1332 
1333 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1334 
1335 	UHSO_DPRINTF(3, "status %d, actlen=%d\n", USB_GET_STATE(xfer), actlen);
1336 
1337 	switch (USB_GET_STATE(xfer)) {
1338 	case USB_ST_TRANSFERRED:
1339 	case USB_ST_SETUP:
1340 tr_setup:
1341 		pc = usbd_xfer_get_frame(xfer, 0);
1342 		if (ucom_get_data(&sc->sc_ucom[0], pc, 0, 8192, &actlen)) {
1343 			usbd_xfer_set_frame_len(xfer, 0, actlen);
1344 			usbd_transfer_submit(xfer);
1345 		}
1346 		break;
1347 	break;
1348 	default:
1349 		UHSO_DPRINTF(0, "error: %s\n", usbd_errstr(error));
1350 		if (error == USB_ERR_CANCELLED)
1351 			break;
1352 		usbd_xfer_set_stall(xfer);
1353 		goto tr_setup;
1354 	}
1355 }
1356 
1357 static void
1358 uhso_bs_cfg(struct uhso_softc *sc)
1359 {
1360 	struct usb_device_request req;
1361 	usb_error_t uerr;
1362 
1363 	if (!(UHSO_IFACE_USB_TYPE(sc->sc_type) & UHSO_IF_BULK))
1364 		return;
1365 
1366 	req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1367 	req.bRequest = UCDC_SET_CONTROL_LINE_STATE;
1368 	USETW(req.wValue, sc->sc_line);
1369 	USETW(req.wIndex, sc->sc_iface_no);
1370 	USETW(req.wLength, 0);
1371 
1372 	uerr = ucom_cfg_do_request(sc->sc_udev, &sc->sc_ucom[0], &req, NULL, 0, 1000);
1373 	if (uerr != 0) {
1374 		device_printf(sc->sc_dev, "failed to set ctrl line state to "
1375 		    "0x%02x: %s\n", sc->sc_line, usbd_errstr(uerr));
1376 	}
1377 }
1378 
1379 static void
1380 uhso_bs_intr_callback(struct usb_xfer *xfer, usb_error_t error)
1381 {
1382 	struct uhso_softc *sc = usbd_xfer_softc(xfer);
1383 	struct usb_page_cache *pc;
1384 	int actlen;
1385 	struct usb_cdc_notification cdc;
1386 
1387 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1388 	UHSO_DPRINTF(3, "status %d, actlen=%d\n", USB_GET_STATE(xfer), actlen);
1389 
1390 	switch (USB_GET_STATE(xfer)) {
1391 	case USB_ST_TRANSFERRED:
1392 		if (actlen < UCDC_NOTIFICATION_LENGTH) {
1393 			UHSO_DPRINTF(0, "UCDC notification too short: %d\n", actlen);
1394 			goto tr_setup;
1395 		}
1396 		else if (actlen > (int)sizeof(struct usb_cdc_notification)) {
1397 			UHSO_DPRINTF(0, "UCDC notification too large: %d\n", actlen);
1398 			actlen = sizeof(struct usb_cdc_notification);
1399 		}
1400 
1401 		pc = usbd_xfer_get_frame(xfer, 0);
1402 		usbd_copy_out(pc, 0, &cdc, actlen);
1403 
1404 		if (UGETW(cdc.wIndex) != sc->sc_iface_no) {
1405 			UHSO_DPRINTF(0, "Interface mismatch, got %d expected %d\n",
1406 			    UGETW(cdc.wIndex), sc->sc_iface_no);
1407 			goto tr_setup;
1408 		}
1409 
1410 		if (cdc.bmRequestType == UCDC_NOTIFICATION &&
1411 		    cdc.bNotification == UCDC_N_SERIAL_STATE) {
1412 			UHSO_DPRINTF(2, "notify = 0x%02x\n", cdc.data[0]);
1413 
1414 			sc->sc_msr = 0;
1415 			sc->sc_lsr = 0;
1416 			if (cdc.data[0] & UCDC_N_SERIAL_RI)
1417 				sc->sc_msr |= SER_RI;
1418 			if (cdc.data[0] & UCDC_N_SERIAL_DSR)
1419 				sc->sc_msr |= SER_DSR;
1420 			if (cdc.data[0] & UCDC_N_SERIAL_DCD)
1421 				sc->sc_msr |= SER_DCD;
1422 
1423 			ucom_status_change(&sc->sc_ucom[0]);
1424 		}
1425 	case USB_ST_SETUP:
1426 tr_setup:
1427 	default:
1428 		if (error == USB_ERR_CANCELLED)
1429 			break;
1430 		usbd_xfer_set_stall(xfer);
1431 		goto tr_setup;
1432 	}
1433 }
1434 
1435 static void
1436 uhso_ucom_cfg_get_status(struct ucom_softc *ucom, uint8_t *lsr, uint8_t *msr)
1437 {
1438 	struct uhso_softc *sc = ucom->sc_parent;
1439 
1440 	*lsr = sc->sc_lsr;
1441 	*msr = sc->sc_msr;
1442 }
1443 
1444 static void
1445 uhso_ucom_cfg_set_dtr(struct ucom_softc *ucom, uint8_t onoff)
1446 {
1447 	struct uhso_softc *sc = ucom->sc_parent;
1448 
1449 	if (!(UHSO_IFACE_USB_TYPE(sc->sc_type) & UHSO_IF_BULK))
1450 		return;
1451 
1452 	if (onoff)
1453 		sc->sc_line |= UCDC_LINE_DTR;
1454 	else
1455 		sc->sc_line &= ~UCDC_LINE_DTR;
1456 
1457 	uhso_bs_cfg(sc);
1458 }
1459 
1460 static void
1461 uhso_ucom_cfg_set_rts(struct ucom_softc *ucom, uint8_t onoff)
1462 {
1463 	struct uhso_softc *sc = ucom->sc_parent;
1464 
1465 	if (!(UHSO_IFACE_USB_TYPE(sc->sc_type) & UHSO_IF_BULK))
1466 		return;
1467 
1468 	if (onoff)
1469 		sc->sc_line |= UCDC_LINE_RTS;
1470 	else
1471 		sc->sc_line &= ~UCDC_LINE_RTS;
1472 
1473 	uhso_bs_cfg(sc);
1474 }
1475 
1476 static void
1477 uhso_ucom_start_read(struct ucom_softc *ucom)
1478 {
1479 	struct uhso_softc *sc = ucom->sc_parent;
1480 
1481 	UHSO_DPRINTF(3, "unit=%d, subunit=%d\n",
1482 	    ucom->sc_super->sc_unit, ucom->sc_subunit);
1483 
1484 	if (UHSO_IFACE_USB_TYPE(sc->sc_type) & UHSO_IF_MUX) {
1485 		sc->sc_tty[ucom->sc_subunit].ht_open = 1;
1486 		usbd_transfer_start(sc->sc_xfer[UHSO_MUX_ENDPT_INTR]);
1487 	}
1488 	else if (UHSO_IFACE_USB_TYPE(sc->sc_type) & UHSO_IF_BULK) {
1489 		sc->sc_tty[0].ht_open = 1;
1490 		usbd_transfer_start(sc->sc_xfer[UHSO_BULK_ENDPT_READ]);
1491 		if (sc->sc_xfer[UHSO_BULK_ENDPT_INTR] != NULL)
1492 			usbd_transfer_start(sc->sc_xfer[UHSO_BULK_ENDPT_INTR]);
1493 	}
1494 }
1495 
1496 static void
1497 uhso_ucom_stop_read(struct ucom_softc *ucom)
1498 {
1499 
1500 	struct uhso_softc *sc = ucom->sc_parent;
1501 
1502 	if (UHSO_IFACE_USB_TYPE(sc->sc_type) & UHSO_IF_MUX) {
1503 		sc->sc_tty[ucom->sc_subunit].ht_open = 0;
1504 		usbd_transfer_stop(
1505 		    sc->sc_tty[ucom->sc_subunit].ht_xfer[UHSO_CTRL_READ]);
1506 	}
1507 	else if (UHSO_IFACE_USB_TYPE(sc->sc_type) & UHSO_IF_BULK) {
1508 		sc->sc_tty[0].ht_open = 0;
1509 		usbd_transfer_start(sc->sc_xfer[UHSO_BULK_ENDPT_READ]);
1510 		if (sc->sc_xfer[UHSO_BULK_ENDPT_INTR] != NULL)
1511 			usbd_transfer_stop(sc->sc_xfer[UHSO_BULK_ENDPT_INTR]);
1512 	}
1513 }
1514 
1515 static void
1516 uhso_ucom_start_write(struct ucom_softc *ucom)
1517 {
1518 	struct uhso_softc *sc = ucom->sc_parent;
1519 
1520 	if (UHSO_IFACE_USB_TYPE(sc->sc_type) & UHSO_IF_MUX) {
1521 		UHSO_DPRINTF(3, "local unit %d\n", ucom->sc_subunit);
1522 
1523 		usbd_transfer_start(sc->sc_xfer[UHSO_MUX_ENDPT_INTR]);
1524 
1525 		usbd_xfer_set_priv(
1526 		    sc->sc_tty[ucom->sc_subunit].ht_xfer[UHSO_CTRL_WRITE],
1527 		    &sc->sc_tty[ucom->sc_subunit]);
1528 		usbd_transfer_start(
1529 		    sc->sc_tty[ucom->sc_subunit].ht_xfer[UHSO_CTRL_WRITE]);
1530 	}
1531 	else if (UHSO_IFACE_USB_TYPE(sc->sc_type) & UHSO_IF_BULK) {
1532 		usbd_transfer_start(sc->sc_xfer[UHSO_BULK_ENDPT_WRITE]);
1533 	}
1534 }
1535 
1536 static void
1537 uhso_ucom_stop_write(struct ucom_softc *ucom)
1538 {
1539 	struct uhso_softc *sc = ucom->sc_parent;
1540 
1541 	if (UHSO_IFACE_USB_TYPE(sc->sc_type) & UHSO_IF_MUX) {
1542 		usbd_transfer_stop(
1543 		    sc->sc_tty[ucom->sc_subunit].ht_xfer[UHSO_CTRL_WRITE]);
1544 	}
1545 	else if (UHSO_IFACE_USB_TYPE(sc->sc_type) & UHSO_IF_BULK) {
1546 		usbd_transfer_stop(sc->sc_xfer[UHSO_BULK_ENDPT_WRITE]);
1547 	}
1548 }
1549 
1550 static int
1551 uhso_attach_ifnet(struct uhso_softc *sc, struct usb_interface *iface, int type)
1552 {
1553 	if_t ifp;
1554 	usb_error_t uerr;
1555 	struct sysctl_ctx_list *sctx;
1556 	struct sysctl_oid *soid;
1557 	unsigned devunit;
1558 
1559 	uerr = usbd_transfer_setup(sc->sc_udev,
1560 	    &iface->idesc->bInterfaceNumber, sc->sc_if_xfer,
1561 	    uhso_ifnet_config, UHSO_IFNET_MAX, sc, &sc->sc_mtx);
1562 	if (uerr) {
1563 		UHSO_DPRINTF(0, "usbd_transfer_setup failed: %s\n",
1564 		    usbd_errstr(uerr));
1565 		return (-1);
1566 	}
1567 
1568 	sc->sc_ifp = ifp = if_alloc(IFT_OTHER);
1569 
1570 	callout_init_mtx(&sc->sc_c, &sc->sc_mtx, 0);
1571 	mtx_lock(&sc->sc_mtx);
1572 	callout_reset(&sc->sc_c, 1, uhso_if_rxflush, sc);
1573 	mtx_unlock(&sc->sc_mtx);
1574 
1575 	/*
1576 	 * We create our own unit numbers for ifnet devices because the
1577 	 * USB interface unit numbers can be at arbitrary positions yielding
1578 	 * odd looking device names.
1579 	 */
1580 	devunit = alloc_unr(uhso_ifnet_unit);
1581 
1582 	if_initname(ifp, device_get_name(sc->sc_dev), devunit);
1583 	if_setmtu(ifp, UHSO_MAX_MTU);
1584 	if_setioctlfn(ifp, uhso_if_ioctl);
1585 	if_setinitfn(ifp, uhso_if_init);
1586 	if_setstartfn(ifp, uhso_if_start);
1587 	if_setoutputfn(ifp, uhso_if_output);
1588 	if_setflags(ifp, IFF_BROADCAST | IFF_MULTICAST | IFF_NOARP);
1589 	if_setsoftc(ifp, sc);
1590 	if_setsendqlen(ifp, ifqmaxlen);
1591 	if_setsendqready(ifp);
1592 
1593 	if_attach(ifp);
1594 	bpfattach(ifp, DLT_RAW, 0);
1595 
1596 	sctx = device_get_sysctl_ctx(sc->sc_dev);
1597 	soid = device_get_sysctl_tree(sc->sc_dev);
1598 	/* Unlocked read... */
1599 	SYSCTL_ADD_CONST_STRING(sctx, SYSCTL_CHILDREN(soid), OID_AUTO, "netif",
1600 	    CTLFLAG_RD, if_name(ifp), "Attached network interface");
1601 
1602 	return (0);
1603 }
1604 
1605 static void
1606 uhso_ifnet_read_callback(struct usb_xfer *xfer, usb_error_t error)
1607 {
1608 	struct uhso_softc *sc = usbd_xfer_softc(xfer);
1609 	struct mbuf *m;
1610 	struct usb_page_cache *pc;
1611 	int actlen;
1612 
1613 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1614 
1615 	UHSO_DPRINTF(3, "status=%d, actlen=%d\n", USB_GET_STATE(xfer), actlen);
1616 
1617 	switch (USB_GET_STATE(xfer)) {
1618 	case USB_ST_TRANSFERRED:
1619 		if (actlen > 0 && (if_getdrvflags(sc->sc_ifp) & IFF_DRV_RUNNING)) {
1620 			pc = usbd_xfer_get_frame(xfer, 0);
1621 			if (mbufq_full(&sc->sc_rxq))
1622 				break;
1623 			m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1624 			usbd_copy_out(pc, 0, mtod(m, uint8_t *), actlen);
1625 			m->m_pkthdr.len = m->m_len = actlen;
1626 			/* Enqueue frame for further processing */
1627 			mbufq_enqueue(&sc->sc_rxq, m);
1628 			if (!callout_pending(&sc->sc_c) ||
1629 			    !callout_active(&sc->sc_c)) {
1630 				callout_schedule(&sc->sc_c, 1);
1631 			}
1632 		}
1633 	/* FALLTHROUGH */
1634 	case USB_ST_SETUP:
1635 tr_setup:
1636 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1637 		usbd_transfer_submit(xfer);
1638 		break;
1639 	default:
1640 		UHSO_DPRINTF(0, "error: %s\n", usbd_errstr(error));
1641 		if (error == USB_ERR_CANCELLED)
1642 			break;
1643 		usbd_xfer_set_stall(xfer);
1644 		goto tr_setup;
1645 	}
1646 }
1647 
1648 /*
1649  * Deferred RX processing, called with mutex locked.
1650  *
1651  * Each frame we receive might contain several small ip-packets as well
1652  * as partial ip-packets. We need to separate/assemble them into individual
1653  * packets before sending them to the ip-layer.
1654  */
1655 static void
1656 uhso_if_rxflush(void *arg)
1657 {
1658 	struct epoch_tracker et;
1659 	struct uhso_softc *sc = arg;
1660 	if_t ifp = sc->sc_ifp;
1661 	uint8_t *cp;
1662 	struct mbuf *m, *m0, *mwait;
1663 	struct ip *ip;
1664 #ifdef INET6
1665 	struct ip6_hdr *ip6;
1666 #endif
1667 	uint16_t iplen;
1668 	int isr;
1669 
1670 	m = NULL;
1671 	mwait = sc->sc_mwait;
1672 	NET_EPOCH_ENTER(et);
1673 	for (;;) {
1674 		if (m == NULL) {
1675 			if ((m = mbufq_dequeue(&sc->sc_rxq)) == NULL)
1676 				break;
1677 			UHSO_DPRINTF(3, "dequeue m=%p, len=%d\n", m, m->m_len);
1678 		}
1679 		mtx_unlock(&sc->sc_mtx);
1680 
1681 		/* Do we have a partial packet waiting? */
1682 		if (mwait != NULL) {
1683 			m0 = mwait;
1684 			mwait = NULL;
1685 
1686 			UHSO_DPRINTF(3, "partial m0=%p(%d), concat w/ m=%p(%d)\n",
1687 			    m0, m0->m_len, m, m->m_len);
1688 
1689 			m_catpkt(m0, m);
1690 			m = m_pullup(m0, sizeof(struct ip));
1691 			if (m == NULL) {
1692 				if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1693 				UHSO_DPRINTF(0, "m_pullup failed\n");
1694 				mtx_lock(&sc->sc_mtx);
1695 				continue;
1696 			}
1697 			UHSO_DPRINTF(3, "Constructed mbuf=%p, len=%d\n",
1698 			    m, m->m_pkthdr.len);
1699 		}
1700 
1701 		cp = mtod(m, uint8_t *);
1702 		ip = (struct ip *)cp;
1703 #ifdef INET6
1704 		ip6 = (struct ip6_hdr *)cp;
1705 #endif
1706 
1707 		/* Check for IPv4 */
1708 		if (ip->ip_v == IPVERSION) {
1709 			iplen = htons(ip->ip_len);
1710 			isr = NETISR_IP;
1711 		}
1712 #ifdef INET6
1713 		/* Check for IPv6 */
1714 		else if ((ip6->ip6_vfc & IPV6_VERSION_MASK) == IPV6_VERSION) {
1715 			iplen = htons(ip6->ip6_plen);
1716 			isr = NETISR_IPV6;
1717 		}
1718 #endif
1719 		else {
1720 			UHSO_DPRINTF(0, "got unexpected ip version %d, "
1721 			    "m=%p, len=%d\n", (*cp & 0xf0) >> 4, m, m->m_len);
1722 			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1723 			UHSO_HEXDUMP(cp, 4);
1724 			m_freem(m);
1725 			m = NULL;
1726 			mtx_lock(&sc->sc_mtx);
1727 			continue;
1728 		}
1729 
1730 		if (iplen == 0) {
1731 			UHSO_DPRINTF(0, "Zero IP length\n");
1732 			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1733 			m_freem(m);
1734 			m = NULL;
1735 			mtx_lock(&sc->sc_mtx);
1736 			continue;
1737 		}
1738 
1739 		UHSO_DPRINTF(3, "m=%p, len=%d, cp=%p, iplen=%d\n",
1740 		    m, m->m_pkthdr.len, cp, iplen);
1741 
1742 		m0 = NULL;
1743 
1744 		/* More IP packets in this mbuf */
1745 		if (iplen < m->m_pkthdr.len) {
1746 			m0 = m;
1747 
1748 			/*
1749 			 * Allocate a new mbuf for this IP packet and
1750 			 * copy the IP-packet into it.
1751 			 */
1752 			m = m_getcl(M_WAITOK, MT_DATA, M_PKTHDR);
1753 			memcpy(mtod(m, uint8_t *), mtod(m0, uint8_t *), iplen);
1754 			m->m_pkthdr.len = m->m_len = iplen;
1755 
1756 			/* Adjust the size of the original mbuf */
1757 			m_adj(m0, iplen);
1758 			m0 = m_defrag(m0, M_WAITOK);
1759 
1760 			UHSO_DPRINTF(3, "New mbuf=%p, len=%d/%d, m0=%p, "
1761 			    "m0_len=%d/%d\n", m, m->m_pkthdr.len, m->m_len,
1762 			    m0, m0->m_pkthdr.len, m0->m_len);
1763 		}
1764 		else if (iplen > m->m_pkthdr.len) {
1765 			UHSO_DPRINTF(3, "Deferred mbuf=%p, len=%d\n",
1766 			    m, m->m_pkthdr.len);
1767 			mwait = m;
1768 			m = NULL;
1769 			mtx_lock(&sc->sc_mtx);
1770 			continue;
1771 		}
1772 
1773 		if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
1774 		m->m_pkthdr.rcvif = ifp;
1775 
1776 		/* Dispatch to IP layer */
1777 		BPF_MTAP(sc->sc_ifp, m);
1778 		M_SETFIB(m, if_getfib(ifp));
1779 		netisr_dispatch(isr, m);
1780 		m = m0 != NULL ? m0 : NULL;
1781 		mtx_lock(&sc->sc_mtx);
1782 	}
1783 	NET_EPOCH_EXIT(et);
1784 	sc->sc_mwait = mwait;
1785 }
1786 
1787 static void
1788 uhso_ifnet_write_callback(struct usb_xfer *xfer, usb_error_t error)
1789 {
1790 	struct uhso_softc *sc = usbd_xfer_softc(xfer);
1791 	if_t ifp = sc->sc_ifp;
1792 	struct usb_page_cache *pc;
1793 	struct mbuf *m;
1794 	int actlen;
1795 
1796 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1797 
1798 	UHSO_DPRINTF(3, "status %d, actlen=%d\n", USB_GET_STATE(xfer), actlen);
1799 
1800 	switch (USB_GET_STATE(xfer)) {
1801 	case USB_ST_TRANSFERRED:
1802 		if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
1803 		if_setdrvflagbits(ifp, 0, IFF_DRV_OACTIVE);
1804 	case USB_ST_SETUP:
1805 tr_setup:
1806 		m = if_dequeue(ifp);
1807 		if (m == NULL)
1808 			break;
1809 
1810 		if_setdrvflagbits(ifp, IFF_DRV_OACTIVE, 0);
1811 
1812 		if (m->m_pkthdr.len > MCLBYTES)
1813 			m->m_pkthdr.len = MCLBYTES;
1814 
1815 		usbd_xfer_set_frame_len(xfer, 0, m->m_pkthdr.len);
1816 		pc = usbd_xfer_get_frame(xfer, 0);
1817 		usbd_m_copy_in(pc, 0, m, 0, m->m_pkthdr.len);
1818 		usbd_transfer_submit(xfer);
1819 
1820 		BPF_MTAP(ifp, m);
1821 		m_freem(m);
1822 		break;
1823 	default:
1824 		UHSO_DPRINTF(0, "error: %s\n", usbd_errstr(error));
1825 		if (error == USB_ERR_CANCELLED)
1826 			break;
1827 		usbd_xfer_set_stall(xfer);
1828 		goto tr_setup;
1829 	}
1830 }
1831 
1832 static int
1833 uhso_if_ioctl(if_t ifp, u_long cmd, caddr_t data)
1834 {
1835 	struct uhso_softc *sc;
1836 
1837 	sc = if_getsoftc(ifp);
1838 
1839 	switch (cmd) {
1840 	case SIOCSIFFLAGS:
1841 		if (if_getflags(ifp) & IFF_UP) {
1842 			if (!(if_getdrvflags(ifp) & IFF_DRV_RUNNING)) {
1843 				uhso_if_init(sc);
1844 			}
1845 		}
1846 		else {
1847 			if (if_getdrvflags(ifp) & IFF_DRV_RUNNING) {
1848 				mtx_lock(&sc->sc_mtx);
1849 				uhso_if_stop(sc);
1850 				mtx_unlock(&sc->sc_mtx);
1851 			}
1852 		}
1853 		break;
1854 	case SIOCSIFADDR:
1855 	case SIOCADDMULTI:
1856 	case SIOCDELMULTI:
1857 		break;
1858 	default:
1859 		return (EINVAL);
1860 	}
1861 	return (0);
1862 }
1863 
1864 static void
1865 uhso_if_init(void *priv)
1866 {
1867 	struct uhso_softc *sc = priv;
1868 	if_t ifp = sc->sc_ifp;
1869 
1870 	mtx_lock(&sc->sc_mtx);
1871 	uhso_if_stop(sc);
1872 	ifp = sc->sc_ifp;
1873 	if_setflagbits(ifp, IFF_UP, 0);
1874 	if_setdrvflagbits(ifp, IFF_DRV_RUNNING, 0);
1875 	mtx_unlock(&sc->sc_mtx);
1876 
1877 	UHSO_DPRINTF(2, "ifnet initialized\n");
1878 }
1879 
1880 static int
1881 uhso_if_output(if_t ifp, struct mbuf *m0, const struct sockaddr *dst,
1882     struct route *ro)
1883 {
1884 	int error;
1885 
1886 	/* Only IPv4/6 support */
1887 	if (dst->sa_family != AF_INET
1888 #ifdef INET6
1889 	   && dst->sa_family != AF_INET6
1890 #endif
1891 	 ) {
1892 		return (EAFNOSUPPORT);
1893 	}
1894 
1895 	error = if_transmit(ifp, m0);
1896 	if (error) {
1897 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1898 		return (ENOBUFS);
1899 	}
1900 	if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
1901 	return (0);
1902 }
1903 
1904 static void
1905 uhso_if_start(if_t ifp)
1906 {
1907 	struct uhso_softc *sc = if_getsoftc(ifp);
1908 
1909 	if ((if_getdrvflags(ifp) & IFF_DRV_RUNNING) == 0) {
1910 		UHSO_DPRINTF(1, "Not running\n");
1911 		return;
1912 	}
1913 
1914 	mtx_lock(&sc->sc_mtx);
1915 	usbd_transfer_start(sc->sc_if_xfer[UHSO_IFNET_READ]);
1916 	usbd_transfer_start(sc->sc_if_xfer[UHSO_IFNET_WRITE]);
1917 	mtx_unlock(&sc->sc_mtx);
1918 	UHSO_DPRINTF(3, "interface started\n");
1919 }
1920 
1921 static void
1922 uhso_if_stop(struct uhso_softc *sc)
1923 {
1924 
1925 	usbd_transfer_stop(sc->sc_if_xfer[UHSO_IFNET_READ]);
1926 	usbd_transfer_stop(sc->sc_if_xfer[UHSO_IFNET_WRITE]);
1927 	if_setdrvflagbits(sc->sc_ifp, 0, (IFF_DRV_RUNNING | IFF_DRV_OACTIVE));
1928 }
1929