sys/dev/usb/net/if_urndis.c

   1 /*      $OpenBSD: if_urndis.c,v 1.46 2013/12/09 15:45:29 pirofti Exp $ */
   2
   3 /*
   4  * Copyright (c) 2010 Jonathan Armani <armani@openbsd.org>
   5  * Copyright (c) 2010 Fabien Romano <fabien@openbsd.org>
   6  * Copyright (c) 2010 Michael Knudsen <mk@openbsd.org>
   7  * Copyright (c) 2014 Hans Petter Selasky <hselasky@freebsd.org>
   8  * All rights reserved.
   9  *
  10  * Permission to use, copy, modify, and distribute this software for any
  11  * purpose with or without fee is hereby granted, provided that the above
  12  * copyright notice and this permission notice appear in all copies.
  13  *
  14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  21  */
  22
  23 #include <sys/cdefs.h>
  24 __FBSDID("$FreeBSD$");
  25
  26 #include <sys/stdint.h>
  27 #include <sys/stddef.h>
  28 #include <sys/param.h>
  29 #include <sys/queue.h>
  30 #include <sys/types.h>
  31 #include <sys/systm.h>
  32 #include <sys/socket.h>
  33 #include <sys/kernel.h>
  34 #include <sys/bus.h>
  35 #include <sys/module.h>
  36 #include <sys/lock.h>
  37 #include <sys/mutex.h>
  38 #include <sys/condvar.h>
  39 #include <sys/sysctl.h>
  40 #include <sys/sx.h>
  41 #include <sys/unistd.h>
  42 #include <sys/callout.h>
  43 #include <sys/malloc.h>
  44 #include <sys/priv.h>
  45
  46 #include <net/if.h>
  47 #include <net/if_var.h>
  48 #include <net/rndis.h>
  49
  50 #include <dev/usb/usb.h>
  51 #include <dev/usb/usbdi.h>
  52 #include <dev/usb/usbdi_util.h>
  53 #include "usbdevs.h"
  54
  55 #define USB_DEBUG_VAR urndis_debug
  56 #include <dev/usb/usb_debug.h>
  57 #include <dev/usb/usb_process.h>
  58 #include "usb_if.h"
  59
  60 #include <dev/usb/net/usb_ethernet.h>
  61 #include <dev/usb/net/if_urndisreg.h>
  62
  63 #include <dev/usb/usb_cdc.h>
  64
  65 static device_probe_t urndis_probe;
  66 static device_attach_t urndis_attach;
  67 static device_detach_t urndis_detach;
  68 static device_suspend_t urndis_suspend;
  69 static device_resume_t urndis_resume;
  70
  71 static usb_callback_t urndis_bulk_write_callback;
  72 static usb_callback_t urndis_bulk_read_callback;
  73 static usb_callback_t urndis_intr_read_callback;
  74
  75 static uether_fn_t urndis_attach_post;
  76 static uether_fn_t urndis_init;
  77 static uether_fn_t urndis_stop;
  78 static uether_fn_t urndis_start;
  79 static uether_fn_t urndis_setmulti;
  80 static uether_fn_t urndis_setpromisc;
  81
  82 static uint32_t urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid,
  83                     struct rndis_query_req *msg, uint16_t len,
  84                     const void **rbuf, uint16_t *rbufsz);
  85 static uint32_t urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid,
  86                     struct rndis_set_req *msg, uint16_t len);
  87 static uint32_t urndis_ctrl_handle_init(struct urndis_softc *sc,
  88                     const struct rndis_comp_hdr *hdr);
  89 static uint32_t urndis_ctrl_handle_query(struct urndis_softc *sc,
  90                     const struct rndis_comp_hdr *hdr, const void **buf,
  91                     uint16_t *bufsz);
  92 static uint32_t urndis_ctrl_handle_reset(struct urndis_softc *sc,
  93                     const struct rndis_comp_hdr *hdr);
  94 static uint32_t urndis_ctrl_init(struct urndis_softc *sc);
  95 static uint32_t urndis_ctrl_halt(struct urndis_softc *sc);
  96
  97 #ifdef USB_DEBUG
  98 static int urndis_debug = 0;
  99 static  SYSCTL_NODE(_hw_usb, OID_AUTO, urndis, CTLFLAG_RW, 0, "USB RNDIS-Ethernet");
 100 SYSCTL_INT(_hw_usb_urndis, OID_AUTO, debug, CTLFLAG_RWTUN, &urndis_debug, 0,
 101     "Debug level");
 102 #endif
 103
 104 static const struct usb_config urndis_config[URNDIS_N_TRANSFER] = {
 105         [URNDIS_BULK_RX] = {
 106                 .type = UE_BULK,
 107                 .endpoint = UE_ADDR_ANY,
 108                 .direction = UE_DIR_RX,
 109                 .if_index = 0,
 110                 .frames = 1,
 111                 .bufsize = RNDIS_RX_MAXLEN,
 112                 .flags = {.short_xfer_ok = 1,},
 113                 .callback = urndis_bulk_read_callback,
 114                 .timeout = 0,           /* no timeout */
 115                 .usb_mode = USB_MODE_HOST,
 116         },
 117
 118         [URNDIS_BULK_TX] = {
 119                 .type = UE_BULK,
 120                 .endpoint = UE_ADDR_ANY,
 121                 .direction = UE_DIR_TX,
 122                 .if_index = 0,
 123                 .frames = RNDIS_TX_FRAMES_MAX,
 124                 .bufsize = (RNDIS_TX_FRAMES_MAX * RNDIS_TX_MAXLEN),
 125                 .flags = {
 126                         .force_short_xfer = 1,
 127                 },
 128                 .callback = urndis_bulk_write_callback,
 129                 .timeout = 10000,       /* 10 seconds */
 130                 .usb_mode = USB_MODE_HOST,
 131         },
 132
 133         [URNDIS_INTR_RX] = {
 134                 .type = UE_INTERRUPT,
 135                 .endpoint = UE_ADDR_ANY,
 136                 .direction = UE_DIR_RX,
 137                 .if_index = 1,
 138                 .bufsize = 0,   /* use wMaxPacketSize */
 139                 .flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
 140                 .callback = urndis_intr_read_callback,
 141                 .timeout = 0,
 142                 .usb_mode = USB_MODE_HOST,
 143         },
 144 };
 145
 146 static device_method_t urndis_methods[] = {
 147         /* Device interface */
 148         DEVMETHOD(device_probe, urndis_probe),
 149         DEVMETHOD(device_attach, urndis_attach),
 150         DEVMETHOD(device_detach, urndis_detach),
 151         DEVMETHOD(device_suspend, urndis_suspend),
 152         DEVMETHOD(device_resume, urndis_resume),
 153
 154         DEVMETHOD_END
 155 };
 156
 157 static driver_t urndis_driver = {
 158         .name = "urndis",
 159         .methods = urndis_methods,
 160         .size = sizeof(struct urndis_softc),
 161 };
 162
 163 static devclass_t urndis_devclass;
 164
 165 static const STRUCT_USB_HOST_ID urndis_host_devs[] = {
 166         /* Generic RNDIS class match */
 167         {USB_IFACE_CLASS(UICLASS_CDC),
 168                 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL),
 169                 USB_IFACE_PROTOCOL(0xff)},
 170         {USB_IFACE_CLASS(UICLASS_WIRELESS), USB_IFACE_SUBCLASS(UISUBCLASS_RF),
 171                 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)},
 172         {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(UISUBCLASS_SYNC),
 173                 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)},
 174         /* HP-WebOS */
 175         {USB_VENDOR(USB_VENDOR_PALM), USB_IFACE_CLASS(UICLASS_CDC),
 176                 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL),
 177                 USB_IFACE_PROTOCOL(0xff)},
 178 };
 179
 180 DRIVER_MODULE(urndis, uhub, urndis_driver, urndis_devclass, NULL, NULL);
 181 MODULE_VERSION(urndis, 1);
 182 MODULE_DEPEND(urndis, uether, 1, 1, 1);
 183 MODULE_DEPEND(urndis, usb, 1, 1, 1);
 184 MODULE_DEPEND(urndis, ether, 1, 1, 1);
 185 USB_PNP_HOST_INFO(urndis_host_devs);
 186
 187 static const struct usb_ether_methods urndis_ue_methods = {
 188         .ue_attach_post = urndis_attach_post,
 189         .ue_start = urndis_start,
 190         .ue_init = urndis_init,
 191         .ue_stop = urndis_stop,
 192         .ue_setmulti = urndis_setmulti,
 193         .ue_setpromisc = urndis_setpromisc,
 194 };
 195
 196 static int
 197 urndis_probe(device_t dev)
 198 {
 199         struct usb_attach_arg *uaa = device_get_ivars(dev);
 200
 201         return (usbd_lookup_id_by_uaa(urndis_host_devs, sizeof(urndis_host_devs), uaa));
 202 }
 203
 204 static void
 205 urndis_attach_post(struct usb_ether *ue)
 206 {
 207
 208         /* no-op */
 209 }
 210
 211 static int
 212 urndis_attach(device_t dev)
 213 {
 214         static struct {
 215                 union {
 216                         struct rndis_query_req query;
 217                         struct rndis_set_req set;
 218                 } hdr;
 219                 union {
 220                         uint8_t eaddr[ETHER_ADDR_LEN];
 221                         uint32_t filter;
 222                 } ibuf;
 223         } msg;
 224         struct urndis_softc *sc = device_get_softc(dev);
 225         struct usb_ether *ue = &sc->sc_ue;
 226         struct usb_attach_arg *uaa = device_get_ivars(dev);
 227         struct usb_cdc_cm_descriptor *cmd;
 228         const void *buf;
 229         uint16_t bufsz;
 230         uint8_t iface_index[2] = { uaa->info.bIfaceIndex + 1, uaa->info.bIfaceIndex };
 231         int error;
 232         uint8_t i;
 233
 234         sc->sc_ue.ue_udev = uaa->device;
 235         sc->sc_ifaceno_ctl = uaa->info.bIfaceNum;
 236
 237         cmd = usbd_find_descriptor(uaa->device, NULL, uaa->info.bIfaceIndex,
 238             UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_CM, 0xFF);
 239         if (cmd != NULL) {
 240                 DPRINTF("Call Mode Descriptor found, dataif=%d\n", cmd->bDataInterface);
 241                 iface_index[0] = cmd->bDataInterface;
 242         }
 243
 244         device_set_usb_desc(dev);
 245
 246         mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF);
 247
 248         /* scan the alternate settings looking for a valid one */
 249         for (i = 0; i != 32; i++) {
 250                 error = usbd_set_alt_interface_index(uaa->device,
 251                     iface_index[0], i);
 252
 253                 if (error != 0)
 254                         break;
 255
 256                 error = usbd_transfer_setup(uaa->device,
 257                     iface_index, sc->sc_xfer, urndis_config,
 258                     URNDIS_N_TRANSFER, sc, &sc->sc_mtx);
 259
 260                 if (error == 0)
 261                         break;
 262         }
 263         if ((error != 0) || (i == 32)) {
 264                 device_printf(dev, "No valid alternate setting found\n");
 265                 goto detach;
 266         }
 267
 268         /* Initialize device - must be done before even querying it */
 269         URNDIS_LOCK(sc);
 270         error = urndis_ctrl_init(sc);
 271         URNDIS_UNLOCK(sc);
 272         if (error != (int)RNDIS_STATUS_SUCCESS) {
 273                 device_printf(dev, "Unable to initialize hardware\n");
 274                 goto detach;
 275         }
 276
 277         /* Determine MAC address */
 278         memset(msg.ibuf.eaddr, 0, sizeof(msg.ibuf.eaddr));
 279         URNDIS_LOCK(sc);
 280         error = urndis_ctrl_query(sc, OID_802_3_PERMANENT_ADDRESS,
 281             &msg.hdr.query, sizeof(msg.hdr.query) + sizeof(msg.ibuf.eaddr),
 282             &buf, &bufsz);
 283         URNDIS_UNLOCK(sc);
 284         if (error != (int)RNDIS_STATUS_SUCCESS) {
 285                 device_printf(dev, "Unable to get hardware address\n");
 286                 goto detach;
 287         }
 288         if (bufsz != ETHER_ADDR_LEN) {
 289                 device_printf(dev, "Invalid address length: %d bytes\n", bufsz);
 290                 goto detach;
 291         }
 292         memcpy(&sc->sc_ue.ue_eaddr, buf, ETHER_ADDR_LEN);
 293
 294         /* Initialize packet filter */
 295         sc->sc_filter = NDIS_PACKET_TYPE_BROADCAST |
 296             NDIS_PACKET_TYPE_ALL_MULTICAST;
 297         msg.ibuf.filter = htole32(sc->sc_filter);
 298         URNDIS_LOCK(sc);
 299         error = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
 300             &msg.hdr.set, sizeof(msg.hdr.set) + sizeof(msg.ibuf.filter));
 301         URNDIS_UNLOCK(sc);
 302         if (error != (int)RNDIS_STATUS_SUCCESS) {
 303                 device_printf(dev, "Unable to set data filters\n");
 304                 goto detach;
 305         }
 306
 307         ue->ue_sc = sc;
 308         ue->ue_dev = dev;
 309         ue->ue_udev = uaa->device;
 310         ue->ue_mtx = &sc->sc_mtx;
 311         ue->ue_methods = &urndis_ue_methods;
 312
 313         error = uether_ifattach(ue);
 314         if (error) {
 315                 device_printf(dev, "Could not attach interface\n");
 316                 goto detach;
 317         }
 318
 319         URNDIS_LOCK(sc);
 320         /* start interrupt endpoint, if any */
 321         usbd_transfer_start(sc->sc_xfer[URNDIS_INTR_RX]);
 322         URNDIS_UNLOCK(sc);
 323
 324         return (0);                     /* success */
 325
 326 detach:
 327         (void)urndis_detach(dev);
 328         return (ENXIO);                 /* failure */
 329 }
 330
 331 static int
 332 urndis_detach(device_t dev)
 333 {
 334         struct urndis_softc *sc = device_get_softc(dev);
 335         struct usb_ether *ue = &sc->sc_ue;
 336
 337         /* stop all USB transfers first */
 338         usbd_transfer_unsetup(sc->sc_xfer, URNDIS_N_TRANSFER);
 339
 340         uether_ifdetach(ue);
 341
 342         URNDIS_LOCK(sc);
 343         (void)urndis_ctrl_halt(sc);
 344         URNDIS_UNLOCK(sc);
 345
 346         mtx_destroy(&sc->sc_mtx);
 347
 348         return (0);
 349 }
 350
 351 static void
 352 urndis_start(struct usb_ether *ue)
 353 {
 354         struct urndis_softc *sc = uether_getsc(ue);
 355
 356         /*
 357          * Start the USB transfers, if not already started:
 358          */
 359         usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_TX]);
 360         usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_RX]);
 361 }
 362
 363 static void
 364 urndis_init(struct usb_ether *ue)
 365 {
 366         struct urndis_softc *sc = uether_getsc(ue);
 367         struct ifnet *ifp = uether_getifp(ue);
 368
 369         URNDIS_LOCK_ASSERT(sc, MA_OWNED);
 370
 371         ifp->if_drv_flags |= IFF_DRV_RUNNING;
 372
 373         /* stall data write direction, which depends on USB mode */
 374         usbd_xfer_set_stall(sc->sc_xfer[URNDIS_BULK_TX]);
 375
 376         /* start data transfers */
 377         urndis_start(ue);
 378 }
 379
 380 static void
 381 urndis_stop(struct usb_ether *ue)
 382 {
 383         struct urndis_softc *sc = uether_getsc(ue);
 384         struct ifnet *ifp = uether_getifp(ue);
 385
 386         URNDIS_LOCK_ASSERT(sc, MA_OWNED);
 387
 388         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
 389
 390         /*
 391          * stop all the transfers, if not already stopped:
 392          */
 393         usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_RX]);
 394         usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_TX]);
 395 }
 396
 397 static void
 398 urndis_setmulti(struct usb_ether *ue)
 399 {
 400
 401         /* no-op */
 402 }
 403
 404 static void
 405 urndis_setpromisc(struct usb_ether *ue)
 406 {
 407
 408         /* no-op */
 409 }
 410
 411 static int
 412 urndis_suspend(device_t dev)
 413 {
 414
 415         device_printf(dev, "Suspending\n");
 416         return (0);
 417 }
 418
 419 static int
 420 urndis_resume(device_t dev)
 421 {
 422
 423         device_printf(dev, "Resuming\n");
 424         return (0);
 425 }
 426
 427 static usb_error_t
 428 urndis_ctrl_msg(struct urndis_softc *sc, uint8_t rt, uint8_t r,
 429     uint16_t index, uint16_t value, void *buf, uint16_t buflen)
 430 {
 431         usb_device_request_t req;
 432
 433         req.bmRequestType = rt;
 434         req.bRequest = r;
 435         USETW(req.wValue, value);
 436         USETW(req.wIndex, index);
 437         USETW(req.wLength, buflen);
 438
 439         return (usbd_do_request_flags(sc->sc_ue.ue_udev,
 440             &sc->sc_mtx, &req, buf, (rt & UT_READ) ?
 441             USB_SHORT_XFER_OK : 0, NULL, 2000 /* ms */ ));
 442 }
 443
 444 static usb_error_t
 445 urndis_ctrl_send(struct urndis_softc *sc, void *buf, uint16_t len)
 446 {
 447         usb_error_t err;
 448
 449         err = urndis_ctrl_msg(sc, UT_WRITE_CLASS_INTERFACE,
 450             UCDC_SEND_ENCAPSULATED_COMMAND, sc->sc_ifaceno_ctl, 0, buf, len);
 451
 452         DPRINTF("%s\n", usbd_errstr(err));
 453
 454         return (err);
 455 }
 456
 457 static struct rndis_comp_hdr *
 458 urndis_ctrl_recv(struct urndis_softc *sc)
 459 {
 460         struct rndis_comp_hdr *hdr;
 461         usb_error_t err;
 462
 463         err = urndis_ctrl_msg(sc, UT_READ_CLASS_INTERFACE,
 464             UCDC_GET_ENCAPSULATED_RESPONSE, sc->sc_ifaceno_ctl, 0,
 465             sc->sc_response_buf, RNDIS_RESPONSE_LEN);
 466
 467         if (err != USB_ERR_NORMAL_COMPLETION)
 468                 return (NULL);
 469
 470         hdr = (struct rndis_comp_hdr *)sc->sc_response_buf;
 471
 472         DPRINTF("type 0x%x len %u\n", le32toh(hdr->rm_type),
 473             le32toh(hdr->rm_len));
 474
 475         if (le32toh(hdr->rm_len) > RNDIS_RESPONSE_LEN) {
 476                 DPRINTF("ctrl message error: wrong size %u > %u\n",
 477                     le32toh(hdr->rm_len), RNDIS_RESPONSE_LEN);
 478                 return (NULL);
 479         }
 480         return (hdr);
 481 }
 482
 483 static uint32_t
 484 urndis_ctrl_handle(struct urndis_softc *sc, struct rndis_comp_hdr *hdr,
 485     const void **buf, uint16_t *bufsz)
 486 {
 487         uint32_t rval;
 488
 489         DPRINTF("\n");
 490
 491         if (buf != NULL && bufsz != NULL) {
 492                 *buf = NULL;
 493                 *bufsz = 0;
 494         }
 495         switch (le32toh(hdr->rm_type)) {
 496         case REMOTE_NDIS_INITIALIZE_CMPLT:
 497                 rval = urndis_ctrl_handle_init(sc, hdr);
 498                 break;
 499
 500         case REMOTE_NDIS_QUERY_CMPLT:
 501                 rval = urndis_ctrl_handle_query(sc, hdr, buf, bufsz);
 502                 break;
 503
 504         case REMOTE_NDIS_RESET_CMPLT:
 505                 rval = urndis_ctrl_handle_reset(sc, hdr);
 506                 break;
 507
 508         case REMOTE_NDIS_KEEPALIVE_CMPLT:
 509         case REMOTE_NDIS_SET_CMPLT:
 510                 rval = le32toh(hdr->rm_status);
 511                 break;
 512
 513         default:
 514                 device_printf(sc->sc_ue.ue_dev,
 515                     "ctrl message error: unknown event 0x%x\n",
 516                     le32toh(hdr->rm_type));
 517                 rval = RNDIS_STATUS_FAILURE;
 518                 break;
 519         }
 520         return (rval);
 521 }
 522
 523 static uint32_t
 524 urndis_ctrl_handle_init(struct urndis_softc *sc,
 525     const struct rndis_comp_hdr *hdr)
 526 {
 527         const struct rndis_init_comp *msg;
 528
 529         msg = (const struct rndis_init_comp *)hdr;
 530
 531         DPRINTF("len %u rid %u status 0x%x "
 532             "ver_major %u ver_minor %u devflags 0x%x medium 0x%x pktmaxcnt %u "
 533             "pktmaxsz %u align %u aflistoffset %u aflistsz %u\n",
 534             le32toh(msg->rm_len),
 535             le32toh(msg->rm_rid),
 536             le32toh(msg->rm_status),
 537             le32toh(msg->rm_ver_major),
 538             le32toh(msg->rm_ver_minor),
 539             le32toh(msg->rm_devflags),
 540             le32toh(msg->rm_medium),
 541             le32toh(msg->rm_pktmaxcnt),
 542             le32toh(msg->rm_pktmaxsz),
 543             le32toh(msg->rm_align),
 544             le32toh(msg->rm_aflistoffset),
 545             le32toh(msg->rm_aflistsz));
 546
 547         if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
 548                 DPRINTF("init failed 0x%x\n", le32toh(msg->rm_status));
 549                 return (le32toh(msg->rm_status));
 550         }
 551         if (le32toh(msg->rm_devflags) != RNDIS_DF_CONNECTIONLESS) {
 552                 DPRINTF("wrong device type (current type: 0x%x)\n",
 553                     le32toh(msg->rm_devflags));
 554                 return (RNDIS_STATUS_FAILURE);
 555         }
 556         if (le32toh(msg->rm_medium) != RNDIS_MEDIUM_802_3) {
 557                 DPRINTF("medium not 802.3 (current medium: 0x%x)\n",
 558                     le32toh(msg->rm_medium));
 559                 return (RNDIS_STATUS_FAILURE);
 560         }
 561         sc->sc_lim_pktsz = le32toh(msg->rm_pktmaxsz);
 562
 563         return (le32toh(msg->rm_status));
 564 }
 565
 566 static uint32_t
 567 urndis_ctrl_handle_query(struct urndis_softc *sc,
 568     const struct rndis_comp_hdr *hdr, const void **buf, uint16_t *bufsz)
 569 {
 570         const struct rndis_query_comp *msg;
 571         uint64_t limit;
 572
 573         msg = (const struct rndis_query_comp *)hdr;
 574
 575         DPRINTF("len %u rid %u status 0x%x "
 576             "buflen %u bufoff %u\n",
 577             le32toh(msg->rm_len),
 578             le32toh(msg->rm_rid),
 579             le32toh(msg->rm_status),
 580             le32toh(msg->rm_infobuflen),
 581             le32toh(msg->rm_infobufoffset));
 582
 583         *buf = NULL;
 584         *bufsz = 0;
 585         if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
 586                 DPRINTF("query failed 0x%x\n", le32toh(msg->rm_status));
 587                 return (le32toh(msg->rm_status));
 588         }
 589         limit = le32toh(msg->rm_infobuflen);
 590         limit += le32toh(msg->rm_infobufoffset);
 591         limit += RNDIS_HEADER_OFFSET;
 592
 593         if (limit > (uint64_t)le32toh(msg->rm_len)) {
 594                 DPRINTF("ctrl message error: invalid query info "
 595                     "len/offset/end_position(%u/%u/%u) -> "
 596                     "go out of buffer limit %u\n",
 597                     le32toh(msg->rm_infobuflen),
 598                     le32toh(msg->rm_infobufoffset),
 599                     le32toh(msg->rm_infobuflen) +
 600                     le32toh(msg->rm_infobufoffset) + RNDIS_HEADER_OFFSET,
 601                     le32toh(msg->rm_len));
 602                 return (RNDIS_STATUS_FAILURE);
 603         }
 604         *buf = ((const uint8_t *)msg) + RNDIS_HEADER_OFFSET +
 605             le32toh(msg->rm_infobufoffset);
 606         *bufsz = le32toh(msg->rm_infobuflen);
 607
 608         return (le32toh(msg->rm_status));
 609 }
 610
 611 static uint32_t
 612 urndis_ctrl_handle_reset(struct urndis_softc *sc,
 613     const struct rndis_comp_hdr *hdr)
 614 {
 615         const struct rndis_reset_comp *msg;
 616         uint32_t rval;
 617
 618         msg = (const struct rndis_reset_comp *)hdr;
 619
 620         rval = le32toh(msg->rm_status);
 621
 622         DPRINTF("len %u status 0x%x "
 623             "adrreset %u\n",
 624             le32toh(msg->rm_len),
 625             rval,
 626             le32toh(msg->rm_adrreset));
 627
 628         if (rval != RNDIS_STATUS_SUCCESS) {
 629                 DPRINTF("reset failed 0x%x\n", rval);
 630                 return (rval);
 631         }
 632         if (msg->rm_adrreset != 0) {
 633                 struct {
 634                         struct rndis_set_req hdr;
 635                         uint32_t filter;
 636                 } msg_filter;
 637
 638                 msg_filter.filter = htole32(sc->sc_filter);
 639
 640                 rval = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
 641                     &msg_filter.hdr, sizeof(msg_filter));
 642
 643                 if (rval != RNDIS_STATUS_SUCCESS) {
 644                         DPRINTF("unable to reset data filters\n");
 645                         return (rval);
 646                 }
 647         }
 648         return (rval);
 649 }
 650
 651 static uint32_t
 652 urndis_ctrl_init(struct urndis_softc *sc)
 653 {
 654         struct rndis_init_req msg;
 655         struct rndis_comp_hdr *hdr;
 656         uint32_t rval;
 657
 658         msg.rm_type = htole32(REMOTE_NDIS_INITIALIZE_MSG);
 659         msg.rm_len = htole32(sizeof(msg));
 660         msg.rm_rid = 0;
 661         msg.rm_ver_major = htole32(RNDIS_VERSION_MAJOR);
 662         msg.rm_ver_minor = htole32(1);
 663         msg.rm_max_xfersz = htole32(RNDIS_RX_MAXLEN);
 664
 665         DPRINTF("type %u len %u rid %u ver_major %u "
 666             "ver_minor %u max_xfersz %u\n",
 667             le32toh(msg.rm_type),
 668             le32toh(msg.rm_len),
 669             le32toh(msg.rm_rid),
 670             le32toh(msg.rm_ver_major),
 671             le32toh(msg.rm_ver_minor),
 672             le32toh(msg.rm_max_xfersz));
 673
 674         rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
 675
 676         if (rval != RNDIS_STATUS_SUCCESS) {
 677                 DPRINTF("init failed\n");
 678                 return (rval);
 679         }
 680         if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
 681                 DPRINTF("unable to get init response\n");
 682                 return (RNDIS_STATUS_FAILURE);
 683         }
 684         rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
 685
 686         return (rval);
 687 }
 688
 689 static uint32_t
 690 urndis_ctrl_halt(struct urndis_softc *sc)
 691 {
 692         struct rndis_halt_req msg;
 693         uint32_t rval;
 694
 695         msg.rm_type = htole32(REMOTE_NDIS_HALT_MSG);
 696         msg.rm_len = htole32(sizeof(msg));
 697         msg.rm_rid = 0;
 698
 699         DPRINTF("type %u len %u rid %u\n",
 700             le32toh(msg.rm_type),
 701             le32toh(msg.rm_len),
 702             le32toh(msg.rm_rid));
 703
 704         rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
 705
 706         if (rval != RNDIS_STATUS_SUCCESS)
 707                 DPRINTF("halt failed\n");
 708
 709         return (rval);
 710 }
 711
 712 /*
 713  * NB: Querying a device has the requirement of using an input buffer the size
 714  *     of the expected reply or larger, except for variably sized replies.
 715  */
 716 static uint32_t
 717 urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid,
 718     struct rndis_query_req *msg, uint16_t len, const void **rbuf,
 719     uint16_t *rbufsz)
 720 {
 721         struct rndis_comp_hdr *hdr;
 722         uint32_t datalen, rval;
 723
 724         msg->rm_type = htole32(REMOTE_NDIS_QUERY_MSG);
 725         msg->rm_len = htole32(len);
 726         msg->rm_rid = 0;                /* XXX */
 727         msg->rm_oid = htole32(oid);
 728         datalen = len - sizeof(*msg);
 729         msg->rm_infobuflen = htole32(datalen);
 730         if (datalen != 0) {
 731                 msg->rm_infobufoffset = htole32(sizeof(*msg) -
 732                     RNDIS_HEADER_OFFSET);
 733         } else {
 734                 msg->rm_infobufoffset = 0;
 735         }
 736         msg->rm_devicevchdl = 0;
 737
 738         DPRINTF("type %u len %u rid %u oid 0x%x "
 739             "infobuflen %u infobufoffset %u devicevchdl %u\n",
 740             le32toh(msg->rm_type),
 741             le32toh(msg->rm_len),
 742             le32toh(msg->rm_rid),
 743             le32toh(msg->rm_oid),
 744             le32toh(msg->rm_infobuflen),
 745             le32toh(msg->rm_infobufoffset),
 746             le32toh(msg->rm_devicevchdl));
 747
 748         rval = urndis_ctrl_send(sc, msg, len);
 749
 750         if (rval != RNDIS_STATUS_SUCCESS) {
 751                 DPRINTF("query failed\n");
 752                 return (rval);
 753         }
 754         if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
 755                 DPRINTF("unable to get query response\n");
 756                 return (RNDIS_STATUS_FAILURE);
 757         }
 758         rval = urndis_ctrl_handle(sc, hdr, rbuf, rbufsz);
 759
 760         return (rval);
 761 }
 762
 763 static uint32_t
 764 urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid,
 765     struct rndis_set_req *msg, uint16_t len)
 766 {
 767         struct rndis_comp_hdr *hdr;
 768         uint32_t datalen, rval;
 769
 770         msg->rm_type = htole32(REMOTE_NDIS_SET_MSG);
 771         msg->rm_len = htole32(len);
 772         msg->rm_rid = 0;                /* XXX */
 773         msg->rm_oid = htole32(oid);
 774         datalen = len - sizeof(*msg);
 775         msg->rm_infobuflen = htole32(datalen);
 776         if (datalen != 0) {
 777                 msg->rm_infobufoffset = htole32(sizeof(*msg) -
 778                     RNDIS_HEADER_OFFSET);
 779         } else {
 780                 msg->rm_infobufoffset = 0;
 781         }
 782         msg->rm_devicevchdl = 0;
 783
 784         DPRINTF("type %u len %u rid %u oid 0x%x "
 785             "infobuflen %u infobufoffset %u devicevchdl %u\n",
 786             le32toh(msg->rm_type),
 787             le32toh(msg->rm_len),
 788             le32toh(msg->rm_rid),
 789             le32toh(msg->rm_oid),
 790             le32toh(msg->rm_infobuflen),
 791             le32toh(msg->rm_infobufoffset),
 792             le32toh(msg->rm_devicevchdl));
 793
 794         rval = urndis_ctrl_send(sc, msg, len);
 795
 796         if (rval != RNDIS_STATUS_SUCCESS) {
 797                 DPRINTF("set failed\n");
 798                 return (rval);
 799         }
 800         if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
 801                 DPRINTF("unable to get set response\n");
 802                 return (RNDIS_STATUS_FAILURE);
 803         }
 804         rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
 805         if (rval != RNDIS_STATUS_SUCCESS)
 806                 DPRINTF("set failed 0x%x\n", rval);
 807
 808         return (rval);
 809 }
 810
 811 static void
 812 urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
 813 {
 814         struct urndis_softc *sc = usbd_xfer_softc(xfer);
 815         struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, 0);
 816         struct ifnet *ifp = uether_getifp(&sc->sc_ue);
 817         struct rndis_packet_msg msg;
 818         struct mbuf *m;
 819         int actlen;
 820         int aframes;
 821         int offset;
 822
 823         switch (USB_GET_STATE(xfer)) {
 824         case USB_ST_TRANSFERRED:
 825                 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
 826
 827                 DPRINTFN(1, "received %u bytes in %u frames\n", actlen, aframes);
 828
 829                 for (offset = 0; actlen >= (uint32_t)sizeof(msg);) {
 830                         /* copy out header */
 831                         usbd_copy_out(pc, offset, &msg, sizeof(msg));
 832
 833                         if (le32toh(0x1234567U) != 0x1234567U) {
 834                                 /* swap endianness */
 835                                 msg.rm_type = le32toh(msg.rm_type);
 836                                 msg.rm_len = le32toh(msg.rm_len);
 837                                 msg.rm_dataoffset = le32toh(msg.rm_dataoffset);
 838                                 msg.rm_datalen = le32toh(msg.rm_datalen);
 839                                 msg.rm_oobdataoffset = le32toh(msg.rm_oobdataoffset);
 840                                 msg.rm_oobdatalen = le32toh(msg.rm_oobdatalen);
 841                                 msg.rm_oobdataelements = le32toh(msg.rm_oobdataelements);
 842                                 msg.rm_pktinfooffset = le32toh(msg.rm_pktinfooffset);
 843                                 msg.rm_pktinfolen = le32toh(msg.rm_pktinfolen);
 844                                 msg.rm_vchandle = le32toh(msg.rm_vchandle);
 845                                 msg.rm_reserved = le32toh(msg.rm_reserved);
 846                         }
 847
 848                         DPRINTF("len %u data(off:%u len:%u) "
 849                             "oobdata(off:%u len:%u nb:%u) perpacket(off:%u len:%u)\n",
 850                             msg.rm_len, msg.rm_dataoffset, msg.rm_datalen,
 851                             msg.rm_oobdataoffset, msg.rm_oobdatalen,
 852                             msg.rm_oobdataelements, msg.rm_pktinfooffset,
 853                             msg.rm_pktinfooffset);
 854
 855                         /* sanity check the RNDIS header */
 856                         if (msg.rm_type != REMOTE_NDIS_PACKET_MSG) {
 857                                 DPRINTF("invalid type 0x%x != 0x%x\n",
 858                                     msg.rm_type, REMOTE_NDIS_PACKET_MSG);
 859                                 goto tr_setup;
 860                         } else if (msg.rm_len < (uint32_t)sizeof(msg)) {
 861                                 DPRINTF("invalid msg len %u < %u\n",
 862                                     msg.rm_len, (unsigned)sizeof(msg));
 863                                 goto tr_setup;
 864                         } else if (msg.rm_len > (uint32_t)actlen) {
 865                                 DPRINTF("invalid msg len %u > buffer "
 866                                     "len %u\n", msg.rm_len, actlen);
 867                                 goto tr_setup;
 868                         } else if (msg.rm_dataoffset >= (uint32_t)actlen) {
 869                                 DPRINTF("invalid msg dataoffset %u > buffer "
 870                                     "dataoffset %u\n", msg.rm_dataoffset, actlen);
 871                                 goto tr_setup;
 872                         } else if (msg.rm_datalen > (uint32_t)actlen) {
 873                                 DPRINTF("invalid msg datalen %u > buffer "
 874                                     "datalen %u\n", msg.rm_datalen, actlen);
 875                                 goto tr_setup;
 876                         } else if ((msg.rm_dataoffset + msg.rm_datalen +
 877                             (uint32_t)__offsetof(struct rndis_packet_msg,
 878                             rm_dataoffset)) > (uint32_t)actlen) {
 879                                 DPRINTF("invalid dataoffset %u larger than %u\n",
 880                                     msg.rm_dataoffset + msg.rm_datalen +
 881                                     (uint32_t)__offsetof(struct rndis_packet_msg,
 882                                     rm_dataoffset), actlen);
 883                                 goto tr_setup;
 884                         } else if (msg.rm_datalen < (uint32_t)sizeof(struct ether_header)) {
 885                                 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
 886                                 DPRINTF("invalid ethernet size "
 887                                     "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header));
 888                                 goto tr_setup;
 889                         } else if (msg.rm_datalen > (uint32_t)(MCLBYTES - ETHER_ALIGN)) {
 890                                 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
 891                                 DPRINTF("invalid ethernet size "
 892                                     "%u > %u\n",
 893                                     msg.rm_datalen, (unsigned)MCLBYTES);
 894                                 goto tr_setup;
 895                         } else if (msg.rm_datalen > (uint32_t)(MHLEN - ETHER_ALIGN)) {
 896                                 m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
 897                         } else {
 898                                 m = m_gethdr(M_NOWAIT, MT_DATA);
 899                         }
 900
 901                         /* check if we have a buffer */
 902                         if (m != NULL) {
 903                                 m->m_len = m->m_pkthdr.len = msg.rm_datalen + ETHER_ALIGN;
 904                                 m_adj(m, ETHER_ALIGN);
 905
 906                                 usbd_copy_out(pc, offset + msg.rm_dataoffset +
 907                                     __offsetof(struct rndis_packet_msg,
 908                                     rm_dataoffset), m->m_data, msg.rm_datalen);
 909
 910                                 /* enqueue */
 911                                 uether_rxmbuf(&sc->sc_ue, m, msg.rm_datalen);
 912                         } else {
 913                                 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
 914                         }
 915                         offset += msg.rm_len;
 916                         actlen -= msg.rm_len;
 917                 }
 918
 919         case USB_ST_SETUP:
 920 tr_setup:
 921                 usbd_xfer_set_frame_len(xfer, 0, RNDIS_RX_MAXLEN);
 922                 usbd_xfer_set_frames(xfer, 1);
 923                 usbd_transfer_submit(xfer);
 924                 uether_rxflush(&sc->sc_ue);     /* must be last */
 925                 break;
 926
 927         default:                        /* Error */
 928                 DPRINTFN(1, "error = %s\n", usbd_errstr(error));
 929
 930                 if (error != USB_ERR_CANCELLED) {
 931                         /* try to clear stall first */
 932                         usbd_xfer_set_stall(xfer);
 933                         usbd_xfer_set_frames(xfer, 0);
 934                         usbd_transfer_submit(xfer);
 935                 }
 936                 break;
 937         }
 938 }
 939
 940 static void
 941 urndis_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
 942 {
 943         struct rndis_packet_msg msg;
 944         struct urndis_softc *sc = usbd_xfer_softc(xfer);
 945         struct ifnet *ifp = uether_getifp(&sc->sc_ue);
 946         struct mbuf *m;
 947         unsigned x;
 948         int actlen;
 949         int aframes;
 950
 951         usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
 952
 953         DPRINTFN(1, "\n");
 954
 955         switch (USB_GET_STATE(xfer)) {
 956         case USB_ST_TRANSFERRED:
 957                 DPRINTFN(11, "%u bytes in %u frames\n", actlen, aframes);
 958
 959                 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
 960
 961                 /* FALLTHROUGH */
 962         case USB_ST_SETUP:
 963 tr_setup:
 964                 memset(&msg, 0, sizeof(msg));
 965
 966                 for (x = 0; x != RNDIS_TX_FRAMES_MAX; x++) {
 967                         struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, x);
 968
 969                         usbd_xfer_set_frame_offset(xfer, x * RNDIS_TX_MAXLEN, x);
 970
 971 next_pkt:
 972                         IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
 973
 974                         if (m == NULL)
 975                                 break;
 976
 977                         if ((m->m_pkthdr.len + sizeof(msg)) > RNDIS_TX_MAXLEN) {
 978                                 DPRINTF("Too big packet\n");
 979                                 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
 980
 981                                 /* Free buffer */
 982                                 m_freem(m);
 983                                 goto next_pkt;
 984                         }
 985                         msg.rm_type = htole32(REMOTE_NDIS_PACKET_MSG);
 986                         msg.rm_len = htole32(sizeof(msg) + m->m_pkthdr.len);
 987
 988                         msg.rm_dataoffset = htole32(RNDIS_DATA_OFFSET);
 989                         msg.rm_datalen = htole32(m->m_pkthdr.len);
 990
 991                         /* copy in all data */
 992                         usbd_copy_in(pc, 0, &msg, sizeof(msg));
 993                         usbd_m_copy_in(pc, sizeof(msg), m, 0, m->m_pkthdr.len);
 994                         usbd_xfer_set_frame_len(xfer, x, sizeof(msg) + m->m_pkthdr.len);
 995
 996                         /*
 997                          * If there's a BPF listener, bounce a copy of
 998                          * this frame to him:
 999                          */
1000                         BPF_MTAP(ifp, m);
1001
1002                         /* Free buffer */
1003                         m_freem(m);
1004                 }
1005                 if (x != 0) {
1006                         usbd_xfer_set_frames(xfer, x);
1007                         usbd_transfer_submit(xfer);
1008                 }
1009                 break;
1010
1011         default:                        /* Error */
1012                 DPRINTFN(11, "transfer error, %s\n", usbd_errstr(error));
1013
1014                 /* count output errors */
1015                 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1016
1017                 if (error != USB_ERR_CANCELLED) {
1018                         /* try to clear stall first */
1019                         usbd_xfer_set_stall(xfer);
1020                         goto tr_setup;
1021                 }
1022                 break;
1023         }
1024 }
1025
1026 static void
1027 urndis_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
1028 {
1029         int actlen;
1030
1031         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1032
1033         switch (USB_GET_STATE(xfer)) {
1034         case USB_ST_TRANSFERRED:
1035
1036                 DPRINTF("Received %d bytes\n", actlen);
1037
1038                 /* TODO: decode some indications */
1039
1040                 /* FALLTHROUGH */
1041         case USB_ST_SETUP:
1042 tr_setup:
1043                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1044                 usbd_transfer_submit(xfer);
1045                 break;
1046
1047         default:                        /* Error */
1048                 if (error != USB_ERR_CANCELLED) {
1049                         /* start clear stall */
1050                         usbd_xfer_set_stall(xfer);
1051                         goto tr_setup;
1052                 }
1053                 break;
1054         }
1055 }