sys/dev/usb/net/if_urndis.c

   1 /*      $OpenBSD: if_urndis.c,v 1.46 2013/12/09 15:45:29 pirofti Exp $ */
   2
   3 /*
   4  * Copyright (c) 2010 Jonathan Armani <armani@openbsd.org>
   5  * Copyright (c) 2010 Fabien Romano <fabien@openbsd.org>
   6  * Copyright (c) 2010 Michael Knudsen <mk@openbsd.org>
   7  * Copyright (c) 2014 Hans Petter Selasky <hselasky@freebsd.org>
   8  * All rights reserved.
   9  *
  10  * Permission to use, copy, modify, and distribute this software for any
  11  * purpose with or without fee is hereby granted, provided that the above
  12  * copyright notice and this permission notice appear in all copies.
  13  *
  14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  21  */
  22
  23 #include <sys/cdefs.h>
  24 __FBSDID("$FreeBSD$");
  25
  26 #include <sys/stdint.h>
  27 #include <sys/stddef.h>
  28 #include <sys/param.h>
  29 #include <sys/queue.h>
  30 #include <sys/types.h>
  31 #include <sys/systm.h>
  32 #include <sys/socket.h>
  33 #include <sys/kernel.h>
  34 #include <sys/bus.h>
  35 #include <sys/module.h>
  36 #include <sys/lock.h>
  37 #include <sys/mutex.h>
  38 #include <sys/condvar.h>
  39 #include <sys/sysctl.h>
  40 #include <sys/sx.h>
  41 #include <sys/unistd.h>
  42 #include <sys/callout.h>
  43 #include <sys/malloc.h>
  44 #include <sys/priv.h>
  45
  46 #include <net/if.h>
  47 #include <net/if_var.h>
  48 #include <net/rndis.h>
  49
  50 #include <dev/usb/usb.h>
  51 #include <dev/usb/usbdi.h>
  52 #include <dev/usb/usbdi_util.h>
  53 #include "usbdevs.h"
  54
  55 #define USB_DEBUG_VAR urndis_debug
  56 #include <dev/usb/usb_debug.h>
  57 #include <dev/usb/usb_process.h>
  58 #include "usb_if.h"
  59
  60 #include <dev/usb/net/usb_ethernet.h>
  61 #include <dev/usb/net/if_urndisreg.h>
  62
  63 #include <dev/usb/usb_cdc.h>
  64
  65 static device_probe_t urndis_probe;
  66 static device_attach_t urndis_attach;
  67 static device_detach_t urndis_detach;
  68 static device_suspend_t urndis_suspend;
  69 static device_resume_t urndis_resume;
  70
  71 static usb_callback_t urndis_bulk_write_callback;
  72 static usb_callback_t urndis_bulk_read_callback;
  73 static usb_callback_t urndis_intr_read_callback;
  74
  75 static uether_fn_t urndis_attach_post;
  76 static uether_fn_t urndis_init;
  77 static uether_fn_t urndis_stop;
  78 static uether_fn_t urndis_start;
  79 static uether_fn_t urndis_setmulti;
  80 static uether_fn_t urndis_setpromisc;
  81
  82 static uint32_t urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid,
  83                     struct rndis_query_req *msg, uint16_t len,
  84                     const void **rbuf, uint16_t *rbufsz);
  85 static uint32_t urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid,
  86                     struct rndis_set_req *msg, uint16_t len);
  87 static uint32_t urndis_ctrl_handle_init(struct urndis_softc *sc,
  88                     const struct rndis_comp_hdr *hdr);
  89 static uint32_t urndis_ctrl_handle_query(struct urndis_softc *sc,
  90                     const struct rndis_comp_hdr *hdr, const void **buf,
  91                     uint16_t *bufsz);
  92 static uint32_t urndis_ctrl_handle_reset(struct urndis_softc *sc,
  93                     const struct rndis_comp_hdr *hdr);
  94 static uint32_t urndis_ctrl_init(struct urndis_softc *sc);
  95 static uint32_t urndis_ctrl_halt(struct urndis_softc *sc);
  96
  97 #ifdef USB_DEBUG
  98 static int urndis_debug = 0;
  99 static  SYSCTL_NODE(_hw_usb, OID_AUTO, urndis, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
 100     "USB RNDIS-Ethernet");
 101 SYSCTL_INT(_hw_usb_urndis, OID_AUTO, debug, CTLFLAG_RWTUN, &urndis_debug, 0,
 102     "Debug level");
 103 #endif
 104
 105 static const struct usb_config urndis_config[URNDIS_N_TRANSFER] = {
 106         [URNDIS_BULK_RX] = {
 107                 .type = UE_BULK,
 108                 .endpoint = UE_ADDR_ANY,
 109                 .direction = UE_DIR_RX,
 110                 .if_index = 0,
 111                 .frames = 1,
 112                 .bufsize = RNDIS_RX_MAXLEN,
 113                 .flags = {.short_xfer_ok = 1,},
 114                 .callback = urndis_bulk_read_callback,
 115                 .timeout = 0,           /* no timeout */
 116                 .usb_mode = USB_MODE_HOST,
 117         },
 118
 119         [URNDIS_BULK_TX] = {
 120                 .type = UE_BULK,
 121                 .endpoint = UE_ADDR_ANY,
 122                 .direction = UE_DIR_TX,
 123                 .if_index = 0,
 124                 .frames = RNDIS_TX_FRAMES_MAX,
 125                 .bufsize = (RNDIS_TX_FRAMES_MAX * RNDIS_TX_MAXLEN),
 126                 .flags = {
 127                         .force_short_xfer = 1,
 128                 },
 129                 .callback = urndis_bulk_write_callback,
 130                 .timeout = 10000,       /* 10 seconds */
 131                 .usb_mode = USB_MODE_HOST,
 132         },
 133
 134         [URNDIS_INTR_RX] = {
 135                 .type = UE_INTERRUPT,
 136                 .endpoint = UE_ADDR_ANY,
 137                 .direction = UE_DIR_RX,
 138                 .if_index = 1,
 139                 .bufsize = 0,   /* use wMaxPacketSize */
 140                 .flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
 141                 .callback = urndis_intr_read_callback,
 142                 .timeout = 0,
 143                 .usb_mode = USB_MODE_HOST,
 144         },
 145 };
 146
 147 static device_method_t urndis_methods[] = {
 148         /* Device interface */
 149         DEVMETHOD(device_probe, urndis_probe),
 150         DEVMETHOD(device_attach, urndis_attach),
 151         DEVMETHOD(device_detach, urndis_detach),
 152         DEVMETHOD(device_suspend, urndis_suspend),
 153         DEVMETHOD(device_resume, urndis_resume),
 154
 155         DEVMETHOD_END
 156 };
 157
 158 static driver_t urndis_driver = {
 159         .name = "urndis",
 160         .methods = urndis_methods,
 161         .size = sizeof(struct urndis_softc),
 162 };
 163
 164 static devclass_t urndis_devclass;
 165
 166 static const STRUCT_USB_HOST_ID urndis_host_devs[] = {
 167         /* Generic RNDIS class match */
 168         {USB_IFACE_CLASS(UICLASS_CDC),
 169                 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL),
 170                 USB_IFACE_PROTOCOL(0xff)},
 171         {USB_IFACE_CLASS(UICLASS_WIRELESS), USB_IFACE_SUBCLASS(UISUBCLASS_RF),
 172                 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)},
 173         {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(UISUBCLASS_SYNC),
 174                 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)},
 175         /* HP-WebOS */
 176         {USB_VENDOR(USB_VENDOR_PALM), USB_IFACE_CLASS(UICLASS_CDC),
 177                 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL),
 178                 USB_IFACE_PROTOCOL(0xff)},
 179         /* Nokia 7 plus */
 180         {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(0x4),
 181                 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)},
 182         /* Novatel Wireless 8800/8000/etc */
 183         {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(0xef),
 184                 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)},
 185 };
 186
 187 DRIVER_MODULE(urndis, uhub, urndis_driver, urndis_devclass, NULL, NULL);
 188 MODULE_VERSION(urndis, 1);
 189 MODULE_DEPEND(urndis, uether, 1, 1, 1);
 190 MODULE_DEPEND(urndis, usb, 1, 1, 1);
 191 MODULE_DEPEND(urndis, ether, 1, 1, 1);
 192 USB_PNP_HOST_INFO(urndis_host_devs);
 193
 194 static const struct usb_ether_methods urndis_ue_methods = {
 195         .ue_attach_post = urndis_attach_post,
 196         .ue_start = urndis_start,
 197         .ue_init = urndis_init,
 198         .ue_stop = urndis_stop,
 199         .ue_setmulti = urndis_setmulti,
 200         .ue_setpromisc = urndis_setpromisc,
 201 };
 202
 203 static int
 204 urndis_probe(device_t dev)
 205 {
 206         struct usb_attach_arg *uaa = device_get_ivars(dev);
 207
 208         return (usbd_lookup_id_by_uaa(urndis_host_devs, sizeof(urndis_host_devs), uaa));
 209 }
 210
 211 static void
 212 urndis_attach_post(struct usb_ether *ue)
 213 {
 214
 215         /* no-op */
 216 }
 217
 218 static int
 219 urndis_attach(device_t dev)
 220 {
 221         static struct {
 222                 union {
 223                         struct rndis_query_req query;
 224                         struct rndis_set_req set;
 225                 } hdr;
 226                 union {
 227                         uint8_t eaddr[ETHER_ADDR_LEN];
 228                         uint32_t filter;
 229                 } ibuf;
 230         } msg;
 231         struct urndis_softc *sc = device_get_softc(dev);
 232         struct usb_ether *ue = &sc->sc_ue;
 233         struct usb_attach_arg *uaa = device_get_ivars(dev);
 234         struct usb_cdc_cm_descriptor *cmd;
 235         const void *buf;
 236         uint16_t bufsz;
 237         uint8_t iface_index[2] = { uaa->info.bIfaceIndex + 1, uaa->info.bIfaceIndex };
 238         int error;
 239         uint8_t i;
 240
 241         sc->sc_ue.ue_udev = uaa->device;
 242         sc->sc_ifaceno_ctl = uaa->info.bIfaceNum;
 243
 244         cmd = usbd_find_descriptor(uaa->device, NULL, uaa->info.bIfaceIndex,
 245             UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_CM, 0xFF);
 246         if (cmd != NULL) {
 247                 DPRINTF("Call Mode Descriptor found, dataif=%d\n", cmd->bDataInterface);
 248                 iface_index[0] = cmd->bDataInterface;
 249         }
 250
 251         device_set_usb_desc(dev);
 252
 253         mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF);
 254
 255         /* scan the alternate settings looking for a valid one */
 256         for (i = 0; i != 32; i++) {
 257                 error = usbd_set_alt_interface_index(uaa->device,
 258                     iface_index[0], i);
 259
 260                 if (error != 0)
 261                         break;
 262
 263                 error = usbd_transfer_setup(uaa->device,
 264                     iface_index, sc->sc_xfer, urndis_config,
 265                     URNDIS_N_TRANSFER, sc, &sc->sc_mtx);
 266
 267                 if (error == 0)
 268                         break;
 269         }
 270         if ((error != 0) || (i == 32)) {
 271                 device_printf(dev, "No valid alternate setting found\n");
 272                 goto detach;
 273         }
 274
 275         /* Initialize device - must be done before even querying it */
 276         URNDIS_LOCK(sc);
 277         error = urndis_ctrl_init(sc);
 278         URNDIS_UNLOCK(sc);
 279         if (error != (int)RNDIS_STATUS_SUCCESS) {
 280                 device_printf(dev, "Unable to initialize hardware\n");
 281                 goto detach;
 282         }
 283
 284         /* Determine MAC address */
 285         memset(msg.ibuf.eaddr, 0, sizeof(msg.ibuf.eaddr));
 286         URNDIS_LOCK(sc);
 287         error = urndis_ctrl_query(sc, OID_802_3_PERMANENT_ADDRESS,
 288             &msg.hdr.query, sizeof(msg.hdr.query) + sizeof(msg.ibuf.eaddr),
 289             &buf, &bufsz);
 290         URNDIS_UNLOCK(sc);
 291         if (error != (int)RNDIS_STATUS_SUCCESS) {
 292                 device_printf(dev, "Unable to get hardware address\n");
 293                 goto detach;
 294         }
 295         if (bufsz != ETHER_ADDR_LEN) {
 296                 device_printf(dev, "Invalid address length: %d bytes\n", bufsz);
 297                 goto detach;
 298         }
 299         memcpy(&sc->sc_ue.ue_eaddr, buf, ETHER_ADDR_LEN);
 300
 301         /* Initialize packet filter */
 302         sc->sc_filter = NDIS_PACKET_TYPE_BROADCAST |
 303             NDIS_PACKET_TYPE_ALL_MULTICAST;
 304         msg.ibuf.filter = htole32(sc->sc_filter);
 305         URNDIS_LOCK(sc);
 306         error = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
 307             &msg.hdr.set, sizeof(msg.hdr.set) + sizeof(msg.ibuf.filter));
 308         URNDIS_UNLOCK(sc);
 309         if (error != (int)RNDIS_STATUS_SUCCESS) {
 310                 device_printf(dev, "Unable to set data filters\n");
 311                 goto detach;
 312         }
 313
 314         ue->ue_sc = sc;
 315         ue->ue_dev = dev;
 316         ue->ue_udev = uaa->device;
 317         ue->ue_mtx = &sc->sc_mtx;
 318         ue->ue_methods = &urndis_ue_methods;
 319
 320         error = uether_ifattach(ue);
 321         if (error) {
 322                 device_printf(dev, "Could not attach interface\n");
 323                 goto detach;
 324         }
 325
 326         URNDIS_LOCK(sc);
 327         /* start interrupt endpoint, if any */
 328         usbd_transfer_start(sc->sc_xfer[URNDIS_INTR_RX]);
 329         URNDIS_UNLOCK(sc);
 330
 331         return (0);                     /* success */
 332
 333 detach:
 334         (void)urndis_detach(dev);
 335         return (ENXIO);                 /* failure */
 336 }
 337
 338 static int
 339 urndis_detach(device_t dev)
 340 {
 341         struct urndis_softc *sc = device_get_softc(dev);
 342         struct usb_ether *ue = &sc->sc_ue;
 343
 344         /* stop all USB transfers first */
 345         usbd_transfer_unsetup(sc->sc_xfer, URNDIS_N_TRANSFER);
 346
 347         uether_ifdetach(ue);
 348
 349         URNDIS_LOCK(sc);
 350         (void)urndis_ctrl_halt(sc);
 351         URNDIS_UNLOCK(sc);
 352
 353         mtx_destroy(&sc->sc_mtx);
 354
 355         return (0);
 356 }
 357
 358 static void
 359 urndis_start(struct usb_ether *ue)
 360 {
 361         struct urndis_softc *sc = uether_getsc(ue);
 362
 363         /*
 364          * Start the USB transfers, if not already started:
 365          */
 366         usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_TX]);
 367         usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_RX]);
 368 }
 369
 370 static void
 371 urndis_init(struct usb_ether *ue)
 372 {
 373         struct urndis_softc *sc = uether_getsc(ue);
 374         struct ifnet *ifp = uether_getifp(ue);
 375
 376         URNDIS_LOCK_ASSERT(sc, MA_OWNED);
 377
 378         ifp->if_drv_flags |= IFF_DRV_RUNNING;
 379
 380         /* stall data write direction, which depends on USB mode */
 381         usbd_xfer_set_stall(sc->sc_xfer[URNDIS_BULK_TX]);
 382
 383         /* start data transfers */
 384         urndis_start(ue);
 385 }
 386
 387 static void
 388 urndis_stop(struct usb_ether *ue)
 389 {
 390         struct urndis_softc *sc = uether_getsc(ue);
 391         struct ifnet *ifp = uether_getifp(ue);
 392
 393         URNDIS_LOCK_ASSERT(sc, MA_OWNED);
 394
 395         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
 396
 397         /*
 398          * stop all the transfers, if not already stopped:
 399          */
 400         usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_RX]);
 401         usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_TX]);
 402 }
 403
 404 static void
 405 urndis_setmulti(struct usb_ether *ue)
 406 {
 407
 408         /* no-op */
 409 }
 410
 411 static void
 412 urndis_setpromisc(struct usb_ether *ue)
 413 {
 414
 415         /* no-op */
 416 }
 417
 418 static int
 419 urndis_suspend(device_t dev)
 420 {
 421
 422         device_printf(dev, "Suspending\n");
 423         return (0);
 424 }
 425
 426 static int
 427 urndis_resume(device_t dev)
 428 {
 429
 430         device_printf(dev, "Resuming\n");
 431         return (0);
 432 }
 433
 434 static usb_error_t
 435 urndis_ctrl_msg(struct urndis_softc *sc, uint8_t rt, uint8_t r,
 436     uint16_t index, uint16_t value, void *buf, uint16_t buflen)
 437 {
 438         usb_device_request_t req;
 439
 440         req.bmRequestType = rt;
 441         req.bRequest = r;
 442         USETW(req.wValue, value);
 443         USETW(req.wIndex, index);
 444         USETW(req.wLength, buflen);
 445
 446         return (usbd_do_request_flags(sc->sc_ue.ue_udev,
 447             &sc->sc_mtx, &req, buf, (rt & UT_READ) ?
 448             USB_SHORT_XFER_OK : 0, NULL, 2000 /* ms */ ));
 449 }
 450
 451 static usb_error_t
 452 urndis_ctrl_send(struct urndis_softc *sc, void *buf, uint16_t len)
 453 {
 454         usb_error_t err;
 455
 456         err = urndis_ctrl_msg(sc, UT_WRITE_CLASS_INTERFACE,
 457             UCDC_SEND_ENCAPSULATED_COMMAND, sc->sc_ifaceno_ctl, 0, buf, len);
 458
 459         DPRINTF("%s\n", usbd_errstr(err));
 460
 461         return (err);
 462 }
 463
 464 static struct rndis_comp_hdr *
 465 urndis_ctrl_recv(struct urndis_softc *sc)
 466 {
 467         struct rndis_comp_hdr *hdr;
 468         usb_error_t err;
 469
 470         err = urndis_ctrl_msg(sc, UT_READ_CLASS_INTERFACE,
 471             UCDC_GET_ENCAPSULATED_RESPONSE, sc->sc_ifaceno_ctl, 0,
 472             sc->sc_response_buf, RNDIS_RESPONSE_LEN);
 473
 474         if (err != USB_ERR_NORMAL_COMPLETION)
 475                 return (NULL);
 476
 477         hdr = (struct rndis_comp_hdr *)sc->sc_response_buf;
 478
 479         DPRINTF("type 0x%x len %u\n", le32toh(hdr->rm_type),
 480             le32toh(hdr->rm_len));
 481
 482         if (le32toh(hdr->rm_len) > RNDIS_RESPONSE_LEN) {
 483                 DPRINTF("ctrl message error: wrong size %u > %u\n",
 484                     le32toh(hdr->rm_len), RNDIS_RESPONSE_LEN);
 485                 return (NULL);
 486         }
 487         return (hdr);
 488 }
 489
 490 static uint32_t
 491 urndis_ctrl_handle(struct urndis_softc *sc, struct rndis_comp_hdr *hdr,
 492     const void **buf, uint16_t *bufsz)
 493 {
 494         uint32_t rval;
 495
 496         DPRINTF("\n");
 497
 498         if (buf != NULL && bufsz != NULL) {
 499                 *buf = NULL;
 500                 *bufsz = 0;
 501         }
 502         switch (le32toh(hdr->rm_type)) {
 503         case REMOTE_NDIS_INITIALIZE_CMPLT:
 504                 rval = urndis_ctrl_handle_init(sc, hdr);
 505                 break;
 506
 507         case REMOTE_NDIS_QUERY_CMPLT:
 508                 rval = urndis_ctrl_handle_query(sc, hdr, buf, bufsz);
 509                 break;
 510
 511         case REMOTE_NDIS_RESET_CMPLT:
 512                 rval = urndis_ctrl_handle_reset(sc, hdr);
 513                 break;
 514
 515         case REMOTE_NDIS_KEEPALIVE_CMPLT:
 516         case REMOTE_NDIS_SET_CMPLT:
 517                 rval = le32toh(hdr->rm_status);
 518                 break;
 519
 520         default:
 521                 device_printf(sc->sc_ue.ue_dev,
 522                     "ctrl message error: unknown event 0x%x\n",
 523                     le32toh(hdr->rm_type));
 524                 rval = RNDIS_STATUS_FAILURE;
 525                 break;
 526         }
 527         return (rval);
 528 }
 529
 530 static uint32_t
 531 urndis_ctrl_handle_init(struct urndis_softc *sc,
 532     const struct rndis_comp_hdr *hdr)
 533 {
 534         const struct rndis_init_comp *msg;
 535
 536         msg = (const struct rndis_init_comp *)hdr;
 537
 538         DPRINTF("len %u rid %u status 0x%x "
 539             "ver_major %u ver_minor %u devflags 0x%x medium 0x%x pktmaxcnt %u "
 540             "pktmaxsz %u align %u aflistoffset %u aflistsz %u\n",
 541             le32toh(msg->rm_len),
 542             le32toh(msg->rm_rid),
 543             le32toh(msg->rm_status),
 544             le32toh(msg->rm_ver_major),
 545             le32toh(msg->rm_ver_minor),
 546             le32toh(msg->rm_devflags),
 547             le32toh(msg->rm_medium),
 548             le32toh(msg->rm_pktmaxcnt),
 549             le32toh(msg->rm_pktmaxsz),
 550             le32toh(msg->rm_align),
 551             le32toh(msg->rm_aflistoffset),
 552             le32toh(msg->rm_aflistsz));
 553
 554         if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
 555                 DPRINTF("init failed 0x%x\n", le32toh(msg->rm_status));
 556                 return (le32toh(msg->rm_status));
 557         }
 558         if (le32toh(msg->rm_devflags) != RNDIS_DF_CONNECTIONLESS) {
 559                 DPRINTF("wrong device type (current type: 0x%x)\n",
 560                     le32toh(msg->rm_devflags));
 561                 return (RNDIS_STATUS_FAILURE);
 562         }
 563         if (le32toh(msg->rm_medium) != RNDIS_MEDIUM_802_3) {
 564                 DPRINTF("medium not 802.3 (current medium: 0x%x)\n",
 565                     le32toh(msg->rm_medium));
 566                 return (RNDIS_STATUS_FAILURE);
 567         }
 568         sc->sc_lim_pktsz = le32toh(msg->rm_pktmaxsz);
 569
 570         return (le32toh(msg->rm_status));
 571 }
 572
 573 static uint32_t
 574 urndis_ctrl_handle_query(struct urndis_softc *sc,
 575     const struct rndis_comp_hdr *hdr, const void **buf, uint16_t *bufsz)
 576 {
 577         const struct rndis_query_comp *msg;
 578         uint64_t limit;
 579
 580         msg = (const struct rndis_query_comp *)hdr;
 581
 582         DPRINTF("len %u rid %u status 0x%x "
 583             "buflen %u bufoff %u\n",
 584             le32toh(msg->rm_len),
 585             le32toh(msg->rm_rid),
 586             le32toh(msg->rm_status),
 587             le32toh(msg->rm_infobuflen),
 588             le32toh(msg->rm_infobufoffset));
 589
 590         *buf = NULL;
 591         *bufsz = 0;
 592         if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
 593                 DPRINTF("query failed 0x%x\n", le32toh(msg->rm_status));
 594                 return (le32toh(msg->rm_status));
 595         }
 596         limit = le32toh(msg->rm_infobuflen);
 597         limit += le32toh(msg->rm_infobufoffset);
 598         limit += RNDIS_HEADER_OFFSET;
 599
 600         if (limit > (uint64_t)le32toh(msg->rm_len)) {
 601                 DPRINTF("ctrl message error: invalid query info "
 602                     "len/offset/end_position(%u/%u/%u) -> "
 603                     "go out of buffer limit %u\n",
 604                     le32toh(msg->rm_infobuflen),
 605                     le32toh(msg->rm_infobufoffset),
 606                     le32toh(msg->rm_infobuflen) +
 607                     le32toh(msg->rm_infobufoffset) + RNDIS_HEADER_OFFSET,
 608                     le32toh(msg->rm_len));
 609                 return (RNDIS_STATUS_FAILURE);
 610         }
 611         *buf = ((const uint8_t *)msg) + RNDIS_HEADER_OFFSET +
 612             le32toh(msg->rm_infobufoffset);
 613         *bufsz = le32toh(msg->rm_infobuflen);
 614
 615         return (le32toh(msg->rm_status));
 616 }
 617
 618 static uint32_t
 619 urndis_ctrl_handle_reset(struct urndis_softc *sc,
 620     const struct rndis_comp_hdr *hdr)
 621 {
 622         const struct rndis_reset_comp *msg;
 623         uint32_t rval;
 624
 625         msg = (const struct rndis_reset_comp *)hdr;
 626
 627         rval = le32toh(msg->rm_status);
 628
 629         DPRINTF("len %u status 0x%x "
 630             "adrreset %u\n",
 631             le32toh(msg->rm_len),
 632             rval,
 633             le32toh(msg->rm_adrreset));
 634
 635         if (rval != RNDIS_STATUS_SUCCESS) {
 636                 DPRINTF("reset failed 0x%x\n", rval);
 637                 return (rval);
 638         }
 639         if (msg->rm_adrreset != 0) {
 640                 struct {
 641                         struct rndis_set_req hdr;
 642                         uint32_t filter;
 643                 } msg_filter;
 644
 645                 msg_filter.filter = htole32(sc->sc_filter);
 646
 647                 rval = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
 648                     &msg_filter.hdr, sizeof(msg_filter));
 649
 650                 if (rval != RNDIS_STATUS_SUCCESS) {
 651                         DPRINTF("unable to reset data filters\n");
 652                         return (rval);
 653                 }
 654         }
 655         return (rval);
 656 }
 657
 658 static uint32_t
 659 urndis_ctrl_init(struct urndis_softc *sc)
 660 {
 661         struct rndis_init_req msg;
 662         struct rndis_comp_hdr *hdr;
 663         uint32_t rval;
 664
 665         msg.rm_type = htole32(REMOTE_NDIS_INITIALIZE_MSG);
 666         msg.rm_len = htole32(sizeof(msg));
 667         msg.rm_rid = 0;
 668         msg.rm_ver_major = htole32(RNDIS_VERSION_MAJOR);
 669         msg.rm_ver_minor = htole32(1);
 670         msg.rm_max_xfersz = htole32(RNDIS_RX_MAXLEN);
 671
 672         DPRINTF("type %u len %u rid %u ver_major %u "
 673             "ver_minor %u max_xfersz %u\n",
 674             le32toh(msg.rm_type),
 675             le32toh(msg.rm_len),
 676             le32toh(msg.rm_rid),
 677             le32toh(msg.rm_ver_major),
 678             le32toh(msg.rm_ver_minor),
 679             le32toh(msg.rm_max_xfersz));
 680
 681         rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
 682
 683         if (rval != RNDIS_STATUS_SUCCESS) {
 684                 DPRINTF("init failed\n");
 685                 return (rval);
 686         }
 687         if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
 688                 DPRINTF("unable to get init response\n");
 689                 return (RNDIS_STATUS_FAILURE);
 690         }
 691         rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
 692
 693         return (rval);
 694 }
 695
 696 static uint32_t
 697 urndis_ctrl_halt(struct urndis_softc *sc)
 698 {
 699         struct rndis_halt_req msg;
 700         uint32_t rval;
 701
 702         msg.rm_type = htole32(REMOTE_NDIS_HALT_MSG);
 703         msg.rm_len = htole32(sizeof(msg));
 704         msg.rm_rid = 0;
 705
 706         DPRINTF("type %u len %u rid %u\n",
 707             le32toh(msg.rm_type),
 708             le32toh(msg.rm_len),
 709             le32toh(msg.rm_rid));
 710
 711         rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
 712
 713         if (rval != RNDIS_STATUS_SUCCESS)
 714                 DPRINTF("halt failed\n");
 715
 716         return (rval);
 717 }
 718
 719 /*
 720  * NB: Querying a device has the requirement of using an input buffer the size
 721  *     of the expected reply or larger, except for variably sized replies.
 722  */
 723 static uint32_t
 724 urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid,
 725     struct rndis_query_req *msg, uint16_t len, const void **rbuf,
 726     uint16_t *rbufsz)
 727 {
 728         struct rndis_comp_hdr *hdr;
 729         uint32_t datalen, rval;
 730
 731         msg->rm_type = htole32(REMOTE_NDIS_QUERY_MSG);
 732         msg->rm_len = htole32(len);
 733         msg->rm_rid = 0;                /* XXX */
 734         msg->rm_oid = htole32(oid);
 735         datalen = len - sizeof(*msg);
 736         msg->rm_infobuflen = htole32(datalen);
 737         if (datalen != 0) {
 738                 msg->rm_infobufoffset = htole32(sizeof(*msg) -
 739                     RNDIS_HEADER_OFFSET);
 740         } else {
 741                 msg->rm_infobufoffset = 0;
 742         }
 743         msg->rm_devicevchdl = 0;
 744
 745         DPRINTF("type %u len %u rid %u oid 0x%x "
 746             "infobuflen %u infobufoffset %u devicevchdl %u\n",
 747             le32toh(msg->rm_type),
 748             le32toh(msg->rm_len),
 749             le32toh(msg->rm_rid),
 750             le32toh(msg->rm_oid),
 751             le32toh(msg->rm_infobuflen),
 752             le32toh(msg->rm_infobufoffset),
 753             le32toh(msg->rm_devicevchdl));
 754
 755         rval = urndis_ctrl_send(sc, msg, len);
 756
 757         if (rval != RNDIS_STATUS_SUCCESS) {
 758                 DPRINTF("query failed\n");
 759                 return (rval);
 760         }
 761         if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
 762                 DPRINTF("unable to get query response\n");
 763                 return (RNDIS_STATUS_FAILURE);
 764         }
 765         rval = urndis_ctrl_handle(sc, hdr, rbuf, rbufsz);
 766
 767         return (rval);
 768 }
 769
 770 static uint32_t
 771 urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid,
 772     struct rndis_set_req *msg, uint16_t len)
 773 {
 774         struct rndis_comp_hdr *hdr;
 775         uint32_t datalen, rval;
 776
 777         msg->rm_type = htole32(REMOTE_NDIS_SET_MSG);
 778         msg->rm_len = htole32(len);
 779         msg->rm_rid = 0;                /* XXX */
 780         msg->rm_oid = htole32(oid);
 781         datalen = len - sizeof(*msg);
 782         msg->rm_infobuflen = htole32(datalen);
 783         if (datalen != 0) {
 784                 msg->rm_infobufoffset = htole32(sizeof(*msg) -
 785                     RNDIS_HEADER_OFFSET);
 786         } else {
 787                 msg->rm_infobufoffset = 0;
 788         }
 789         msg->rm_devicevchdl = 0;
 790
 791         DPRINTF("type %u len %u rid %u oid 0x%x "
 792             "infobuflen %u infobufoffset %u devicevchdl %u\n",
 793             le32toh(msg->rm_type),
 794             le32toh(msg->rm_len),
 795             le32toh(msg->rm_rid),
 796             le32toh(msg->rm_oid),
 797             le32toh(msg->rm_infobuflen),
 798             le32toh(msg->rm_infobufoffset),
 799             le32toh(msg->rm_devicevchdl));
 800
 801         rval = urndis_ctrl_send(sc, msg, len);
 802
 803         if (rval != RNDIS_STATUS_SUCCESS) {
 804                 DPRINTF("set failed\n");
 805                 return (rval);
 806         }
 807         if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
 808                 DPRINTF("unable to get set response\n");
 809                 return (RNDIS_STATUS_FAILURE);
 810         }
 811         rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
 812         if (rval != RNDIS_STATUS_SUCCESS)
 813                 DPRINTF("set failed 0x%x\n", rval);
 814
 815         return (rval);
 816 }
 817
 818 static void
 819 urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
 820 {
 821         struct urndis_softc *sc = usbd_xfer_softc(xfer);
 822         struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, 0);
 823         struct ifnet *ifp = uether_getifp(&sc->sc_ue);
 824         struct rndis_packet_msg msg;
 825         struct mbuf *m;
 826         int actlen;
 827         int aframes;
 828         int offset;
 829
 830         switch (USB_GET_STATE(xfer)) {
 831         case USB_ST_TRANSFERRED:
 832                 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
 833
 834                 DPRINTFN(1, "received %u bytes in %u frames\n", actlen, aframes);
 835
 836                 for (offset = 0; actlen >= (uint32_t)sizeof(msg);) {
 837                         /* copy out header */
 838                         usbd_copy_out(pc, offset, &msg, sizeof(msg));
 839
 840                         if (le32toh(0x1234567U) != 0x1234567U) {
 841                                 /* swap endianness */
 842                                 msg.rm_type = le32toh(msg.rm_type);
 843                                 msg.rm_len = le32toh(msg.rm_len);
 844                                 msg.rm_dataoffset = le32toh(msg.rm_dataoffset);
 845                                 msg.rm_datalen = le32toh(msg.rm_datalen);
 846                                 msg.rm_oobdataoffset = le32toh(msg.rm_oobdataoffset);
 847                                 msg.rm_oobdatalen = le32toh(msg.rm_oobdatalen);
 848                                 msg.rm_oobdataelements = le32toh(msg.rm_oobdataelements);
 849                                 msg.rm_pktinfooffset = le32toh(msg.rm_pktinfooffset);
 850                                 msg.rm_pktinfolen = le32toh(msg.rm_pktinfolen);
 851                                 msg.rm_vchandle = le32toh(msg.rm_vchandle);
 852                                 msg.rm_reserved = le32toh(msg.rm_reserved);
 853                         }
 854
 855                         DPRINTF("len %u data(off:%u len:%u) "
 856                             "oobdata(off:%u len:%u nb:%u) perpacket(off:%u len:%u)\n",
 857                             msg.rm_len, msg.rm_dataoffset, msg.rm_datalen,
 858                             msg.rm_oobdataoffset, msg.rm_oobdatalen,
 859                             msg.rm_oobdataelements, msg.rm_pktinfooffset,
 860                             msg.rm_pktinfooffset);
 861
 862                         /* sanity check the RNDIS header */
 863                         if (msg.rm_type != REMOTE_NDIS_PACKET_MSG) {
 864                                 DPRINTF("invalid type 0x%x != 0x%x\n",
 865                                     msg.rm_type, REMOTE_NDIS_PACKET_MSG);
 866                                 goto tr_setup;
 867                         } else if (msg.rm_len < (uint32_t)sizeof(msg)) {
 868                                 DPRINTF("invalid msg len %u < %u\n",
 869                                     msg.rm_len, (unsigned)sizeof(msg));
 870                                 goto tr_setup;
 871                         } else if (msg.rm_len > (uint32_t)actlen) {
 872                                 DPRINTF("invalid msg len %u > buffer "
 873                                     "len %u\n", msg.rm_len, actlen);
 874                                 goto tr_setup;
 875                         } else if (msg.rm_dataoffset >= (uint32_t)actlen) {
 876                                 DPRINTF("invalid msg dataoffset %u > buffer "
 877                                     "dataoffset %u\n", msg.rm_dataoffset, actlen);
 878                                 goto tr_setup;
 879                         } else if (msg.rm_datalen > (uint32_t)actlen) {
 880                                 DPRINTF("invalid msg datalen %u > buffer "
 881                                     "datalen %u\n", msg.rm_datalen, actlen);
 882                                 goto tr_setup;
 883                         } else if ((msg.rm_dataoffset + msg.rm_datalen +
 884                             (uint32_t)__offsetof(struct rndis_packet_msg,
 885                             rm_dataoffset)) > (uint32_t)actlen) {
 886                                 DPRINTF("invalid dataoffset %u larger than %u\n",
 887                                     msg.rm_dataoffset + msg.rm_datalen +
 888                                     (uint32_t)__offsetof(struct rndis_packet_msg,
 889                                     rm_dataoffset), actlen);
 890                                 goto tr_setup;
 891                         } else if (msg.rm_datalen < (uint32_t)sizeof(struct ether_header)) {
 892                                 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
 893                                 DPRINTF("invalid ethernet size "
 894                                     "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header));
 895                                 goto tr_setup;
 896                         } else if (msg.rm_datalen > (uint32_t)(MCLBYTES - ETHER_ALIGN)) {
 897                                 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
 898                                 DPRINTF("invalid ethernet size "
 899                                     "%u > %u\n",
 900                                     msg.rm_datalen, (unsigned)MCLBYTES);
 901                                 goto tr_setup;
 902                         } else if (msg.rm_datalen > (uint32_t)(MHLEN - ETHER_ALIGN)) {
 903                                 m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
 904                         } else {
 905                                 m = m_gethdr(M_NOWAIT, MT_DATA);
 906                         }
 907
 908                         /* check if we have a buffer */
 909                         if (m != NULL) {
 910                                 m->m_len = m->m_pkthdr.len = msg.rm_datalen + ETHER_ALIGN;
 911                                 m_adj(m, ETHER_ALIGN);
 912
 913                                 usbd_copy_out(pc, offset + msg.rm_dataoffset +
 914                                     __offsetof(struct rndis_packet_msg,
 915                                     rm_dataoffset), m->m_data, msg.rm_datalen);
 916
 917                                 /* enqueue */
 918                                 uether_rxmbuf(&sc->sc_ue, m, msg.rm_datalen);
 919                         } else {
 920                                 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
 921                         }
 922                         offset += msg.rm_len;
 923                         actlen -= msg.rm_len;
 924                 }
 925
 926         case USB_ST_SETUP:
 927 tr_setup:
 928                 usbd_xfer_set_frame_len(xfer, 0, RNDIS_RX_MAXLEN);
 929                 usbd_xfer_set_frames(xfer, 1);
 930                 usbd_transfer_submit(xfer);
 931                 uether_rxflush(&sc->sc_ue);     /* must be last */
 932                 break;
 933
 934         default:                        /* Error */
 935                 DPRINTFN(1, "error = %s\n", usbd_errstr(error));
 936
 937                 if (error != USB_ERR_CANCELLED) {
 938                         /* try to clear stall first */
 939                         usbd_xfer_set_stall(xfer);
 940                         usbd_xfer_set_frames(xfer, 0);
 941                         usbd_transfer_submit(xfer);
 942                 }
 943                 break;
 944         }
 945 }
 946
 947 static void
 948 urndis_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
 949 {
 950         struct rndis_packet_msg msg;
 951         struct urndis_softc *sc = usbd_xfer_softc(xfer);
 952         struct ifnet *ifp = uether_getifp(&sc->sc_ue);
 953         struct mbuf *m;
 954         unsigned x;
 955         int actlen;
 956         int aframes;
 957
 958         usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
 959
 960         DPRINTFN(1, "\n");
 961
 962         switch (USB_GET_STATE(xfer)) {
 963         case USB_ST_TRANSFERRED:
 964                 DPRINTFN(11, "%u bytes in %u frames\n", actlen, aframes);
 965
 966                 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
 967
 968                 /* FALLTHROUGH */
 969         case USB_ST_SETUP:
 970 tr_setup:
 971                 memset(&msg, 0, sizeof(msg));
 972
 973                 for (x = 0; x != RNDIS_TX_FRAMES_MAX; x++) {
 974                         struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, x);
 975
 976                         usbd_xfer_set_frame_offset(xfer, x * RNDIS_TX_MAXLEN, x);
 977
 978 next_pkt:
 979                         IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
 980
 981                         if (m == NULL)
 982                                 break;
 983
 984                         if ((m->m_pkthdr.len + sizeof(msg)) > RNDIS_TX_MAXLEN) {
 985                                 DPRINTF("Too big packet\n");
 986                                 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
 987
 988                                 /* Free buffer */
 989                                 m_freem(m);
 990                                 goto next_pkt;
 991                         }
 992                         msg.rm_type = htole32(REMOTE_NDIS_PACKET_MSG);
 993                         msg.rm_len = htole32(sizeof(msg) + m->m_pkthdr.len);
 994
 995                         msg.rm_dataoffset = htole32(RNDIS_DATA_OFFSET);
 996                         msg.rm_datalen = htole32(m->m_pkthdr.len);
 997
 998                         /* copy in all data */
 999                         usbd_copy_in(pc, 0, &msg, sizeof(msg));
1000                         usbd_m_copy_in(pc, sizeof(msg), m, 0, m->m_pkthdr.len);
1001                         usbd_xfer_set_frame_len(xfer, x, sizeof(msg) + m->m_pkthdr.len);
1002
1003                         /*
1004                          * If there's a BPF listener, bounce a copy of
1005                          * this frame to him:
1006                          */
1007                         BPF_MTAP(ifp, m);
1008
1009                         /* Free buffer */
1010                         m_freem(m);
1011                 }
1012                 if (x != 0) {
1013                         usbd_xfer_set_frames(xfer, x);
1014                         usbd_transfer_submit(xfer);
1015                 }
1016                 break;
1017
1018         default:                        /* Error */
1019                 DPRINTFN(11, "transfer error, %s\n", usbd_errstr(error));
1020
1021                 /* count output errors */
1022                 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1023
1024                 if (error != USB_ERR_CANCELLED) {
1025                         /* try to clear stall first */
1026                         usbd_xfer_set_stall(xfer);
1027                         goto tr_setup;
1028                 }
1029                 break;
1030         }
1031 }
1032
1033 static void
1034 urndis_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
1035 {
1036         int actlen;
1037
1038         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1039
1040         switch (USB_GET_STATE(xfer)) {
1041         case USB_ST_TRANSFERRED:
1042
1043                 DPRINTF("Received %d bytes\n", actlen);
1044
1045                 /* TODO: decode some indications */
1046
1047                 /* FALLTHROUGH */
1048         case USB_ST_SETUP:
1049 tr_setup:
1050                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1051                 usbd_transfer_submit(xfer);
1052                 break;
1053
1054         default:                        /* Error */
1055                 if (error != USB_ERR_CANCELLED) {
1056                         /* start clear stall */
1057                         usbd_xfer_set_stall(xfer);
1058                         goto tr_setup;
1059                 }
1060                 break;
1061         }
1062 }