]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/blob - sys/dev/usb/net/if_ure.c
Fix ure device driver susceptible to packet-in-packet attack.
[FreeBSD/FreeBSD.git] / sys / dev / usb / net / if_ure.c
1 /*-
2  * Copyright (c) 2015 Kevin Lo <kevlo@FreeBSD.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/bus.h>
33 #include <sys/condvar.h>
34 #include <sys/kernel.h>
35 #include <sys/lock.h>
36 #include <sys/module.h>
37 #include <sys/mutex.h>
38 #include <sys/socket.h>
39 #include <sys/sysctl.h>
40 #include <sys/unistd.h>
41
42 #include <net/if.h>
43 #include <net/if_var.h>
44
45 #include <dev/usb/usb.h>
46 #include <dev/usb/usbdi.h>
47 #include <dev/usb/usbdi_util.h>
48 #include "usbdevs.h"
49
50 #define USB_DEBUG_VAR   ure_debug
51 #include <dev/usb/usb_debug.h>
52 #include <dev/usb/usb_process.h>
53
54 #include <dev/usb/net/usb_ethernet.h>
55 #include <dev/usb/net/if_urereg.h>
56
57 #ifdef USB_DEBUG
58 static int ure_debug = 0;
59
60 static SYSCTL_NODE(_hw_usb, OID_AUTO, ure, CTLFLAG_RW, 0, "USB ure");
61 SYSCTL_INT(_hw_usb_ure, OID_AUTO, debug, CTLFLAG_RWTUN, &ure_debug, 0,
62     "Debug level");
63 #endif
64
65 /*
66  * Various supported device vendors/products.
67  */
68 static const STRUCT_USB_HOST_ID ure_devs[] = {
69 #define URE_DEV(v,p)    { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
70         URE_DEV(REALTEK, RTL8152),
71 #undef URE_DEV
72 };
73
74 static device_probe_t ure_probe;
75 static device_attach_t ure_attach;
76 static device_detach_t ure_detach;
77
78 static usb_callback_t ure_bulk_read_callback;
79 static usb_callback_t ure_bulk_write_callback;
80
81 static miibus_readreg_t ure_miibus_readreg;
82 static miibus_writereg_t ure_miibus_writereg;
83 static miibus_statchg_t ure_miibus_statchg;
84
85 static uether_fn_t ure_attach_post;
86 static uether_fn_t ure_init;
87 static uether_fn_t ure_stop;
88 static uether_fn_t ure_start;
89 static uether_fn_t ure_tick;
90 static uether_fn_t ure_setmulti;
91 static uether_fn_t ure_setpromisc;
92
93 static int      ure_ctl(struct ure_softc *, uint8_t, uint16_t, uint16_t,
94                     void *, int);
95 static int      ure_read_mem(struct ure_softc *, uint16_t, uint16_t, void *,
96                     int);
97 static int      ure_write_mem(struct ure_softc *, uint16_t, uint16_t, void *,
98                     int);
99 static uint8_t  ure_read_1(struct ure_softc *, uint16_t, uint16_t);
100 static uint16_t ure_read_2(struct ure_softc *, uint16_t, uint16_t);
101 static uint32_t ure_read_4(struct ure_softc *, uint16_t, uint16_t);
102 static int      ure_write_1(struct ure_softc *, uint16_t, uint16_t, uint32_t);
103 static int      ure_write_2(struct ure_softc *, uint16_t, uint16_t, uint32_t);
104 static int      ure_write_4(struct ure_softc *, uint16_t, uint16_t, uint32_t);
105 static uint16_t ure_ocp_reg_read(struct ure_softc *, uint16_t);
106 static void     ure_ocp_reg_write(struct ure_softc *, uint16_t, uint16_t);
107
108 static void     ure_read_chipver(struct ure_softc *);
109 static int      ure_attach_post_sub(struct usb_ether *);
110 static void     ure_reset(struct ure_softc *);
111 static int      ure_ifmedia_upd(struct ifnet *);
112 static void     ure_ifmedia_sts(struct ifnet *, struct ifmediareq *);
113 static int      ure_ioctl(struct ifnet *, u_long, caddr_t);
114 static void     ure_rtl8152_init(struct ure_softc *);
115 static void     ure_disable_teredo(struct ure_softc *);
116 static void     ure_init_fifo(struct ure_softc *);
117
118 static const struct usb_config ure_config[URE_N_TRANSFER] = {
119         [URE_BULK_DT_WR] = {
120                 .type = UE_BULK,
121                 .endpoint = UE_ADDR_ANY,
122                 .direction = UE_DIR_OUT,
123                 .bufsize = MCLBYTES,
124                 .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
125                 .callback = ure_bulk_write_callback,
126                 .timeout = 10000,       /* 10 seconds */
127         },
128         [URE_BULK_DT_RD] = {
129                 .type = UE_BULK,
130                 .endpoint = UE_ADDR_ANY,
131                 .direction = UE_DIR_IN,
132                 .bufsize = MCLBYTES,
133                 .flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
134                 .callback = ure_bulk_read_callback,
135                 .timeout = 0,   /* no timeout */
136         },
137 };
138
139 static device_method_t ure_methods[] = {
140         /* Device interface. */
141         DEVMETHOD(device_probe, ure_probe),
142         DEVMETHOD(device_attach, ure_attach),
143         DEVMETHOD(device_detach, ure_detach),
144
145         /* MII interface. */
146         DEVMETHOD(miibus_readreg, ure_miibus_readreg),
147         DEVMETHOD(miibus_writereg, ure_miibus_writereg),
148         DEVMETHOD(miibus_statchg, ure_miibus_statchg),
149
150         DEVMETHOD_END
151 };
152
153 static driver_t ure_driver = {
154         .name = "ure",
155         .methods = ure_methods,
156         .size = sizeof(struct ure_softc),
157 };
158
159 static devclass_t ure_devclass;
160
161 DRIVER_MODULE(ure, uhub, ure_driver, ure_devclass, NULL, NULL);
162 DRIVER_MODULE(miibus, ure, miibus_driver, miibus_devclass, NULL, NULL);
163 MODULE_DEPEND(ure, uether, 1, 1, 1);
164 MODULE_DEPEND(ure, usb, 1, 1, 1);
165 MODULE_DEPEND(ure, ether, 1, 1, 1);
166 MODULE_DEPEND(ure, miibus, 1, 1, 1);
167 MODULE_VERSION(ure, 1);
168
169 static const struct usb_ether_methods ure_ue_methods = {
170         .ue_attach_post = ure_attach_post,
171         .ue_attach_post_sub = ure_attach_post_sub,
172         .ue_start = ure_start,
173         .ue_init = ure_init,
174         .ue_stop = ure_stop,
175         .ue_tick = ure_tick,
176         .ue_setmulti = ure_setmulti,
177         .ue_setpromisc = ure_setpromisc,
178         .ue_mii_upd = ure_ifmedia_upd,
179         .ue_mii_sts = ure_ifmedia_sts,
180 };
181
182 static int
183 ure_ctl(struct ure_softc *sc, uint8_t rw, uint16_t val, uint16_t index,
184     void *buf, int len)
185 {
186         struct usb_device_request req;
187
188         URE_LOCK_ASSERT(sc, MA_OWNED);
189
190         if (rw == URE_CTL_WRITE)
191                 req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
192         else
193                 req.bmRequestType = UT_READ_VENDOR_DEVICE;
194         req.bRequest = UR_SET_ADDRESS;
195         USETW(req.wValue, val);
196         USETW(req.wIndex, index);
197         USETW(req.wLength, len);
198
199         return (uether_do_request(&sc->sc_ue, &req, buf, 1000));
200 }
201
202 static int
203 ure_read_mem(struct ure_softc *sc, uint16_t addr, uint16_t index,
204     void *buf, int len)
205 {
206
207         return (ure_ctl(sc, URE_CTL_READ, addr, index, buf, len));
208 }
209
210 static int
211 ure_write_mem(struct ure_softc *sc, uint16_t addr, uint16_t index,
212     void *buf, int len)
213 {
214
215         return (ure_ctl(sc, URE_CTL_WRITE, addr, index, buf, len));
216 }
217
218 static uint8_t
219 ure_read_1(struct ure_softc *sc, uint16_t reg, uint16_t index)
220 {
221         uint32_t val;
222         uint8_t temp[4];
223         uint8_t shift;
224
225         shift = (reg & 3) << 3;
226         reg &= ~3;
227         
228         ure_read_mem(sc, reg, index, &temp, 4);
229         val = UGETDW(temp);
230         val >>= shift;
231
232         return (val & 0xff);
233 }
234
235 static uint16_t
236 ure_read_2(struct ure_softc *sc, uint16_t reg, uint16_t index)
237 {
238         uint32_t val;
239         uint8_t temp[4];
240         uint8_t shift;
241
242         shift = (reg & 2) << 3;
243         reg &= ~3;
244
245         ure_read_mem(sc, reg, index, &temp, 4);
246         val = UGETDW(temp);
247         val >>= shift;
248
249         return (val & 0xffff);
250 }
251
252 static uint32_t
253 ure_read_4(struct ure_softc *sc, uint16_t reg, uint16_t index)
254 {
255         uint8_t temp[4];
256
257         ure_read_mem(sc, reg, index, &temp, 4);
258         return (UGETDW(temp));
259 }
260
261 static int
262 ure_write_1(struct ure_softc *sc, uint16_t reg, uint16_t index, uint32_t val)
263 {
264         uint16_t byen;
265         uint8_t temp[4];
266         uint8_t shift;
267
268         byen = URE_BYTE_EN_BYTE;
269         shift = reg & 3;
270         val &= 0xff;
271
272         if (reg & 3) {
273                 byen <<= shift;
274                 val <<= (shift << 3);
275                 reg &= ~3;
276         }
277
278         USETDW(temp, val);
279         return (ure_write_mem(sc, reg, index | byen, &temp, 4));
280 }
281
282 static int
283 ure_write_2(struct ure_softc *sc, uint16_t reg, uint16_t index, uint32_t val)
284 {
285         uint16_t byen;
286         uint8_t temp[4];
287         uint8_t shift;
288
289         byen = URE_BYTE_EN_WORD;
290         shift = reg & 2;
291         val &= 0xffff;
292
293         if (reg & 2) {
294                 byen <<= shift;
295                 val <<= (shift << 3);
296                 reg &= ~3;
297         }
298
299         USETDW(temp, val);
300         return (ure_write_mem(sc, reg, index | byen, &temp, 4));
301 }
302
303 static int
304 ure_write_4(struct ure_softc *sc, uint16_t reg, uint16_t index, uint32_t val)
305 {
306         uint8_t temp[4];
307
308         USETDW(temp, val);
309         return (ure_write_mem(sc, reg, index | URE_BYTE_EN_DWORD, &temp, 4));
310 }
311
312 static uint16_t
313 ure_ocp_reg_read(struct ure_softc *sc, uint16_t addr)
314 {
315         uint16_t reg;
316
317         ure_write_2(sc, URE_PLA_OCP_GPHY_BASE, URE_MCU_TYPE_PLA, addr & 0xf000);
318         reg = (addr & 0x0fff) | 0xb000;
319
320         return (ure_read_2(sc, reg, URE_MCU_TYPE_PLA));
321 }
322
323 static void
324 ure_ocp_reg_write(struct ure_softc *sc, uint16_t addr, uint16_t data)
325 {
326         uint16_t reg;
327
328         ure_write_2(sc, URE_PLA_OCP_GPHY_BASE, URE_MCU_TYPE_PLA, addr & 0xf000);
329         reg = (addr & 0x0fff) | 0xb000;
330
331         ure_write_2(sc, reg, URE_MCU_TYPE_PLA, data);
332 }
333
334 static int
335 ure_miibus_readreg(device_t dev, int phy, int reg)
336 {
337         struct ure_softc *sc;
338         uint16_t val;
339         int locked;
340
341         sc = device_get_softc(dev);
342         locked = mtx_owned(&sc->sc_mtx);
343         if (!locked)
344                 URE_LOCK(sc);
345
346         val = ure_ocp_reg_read(sc, URE_OCP_BASE_MII + reg * 2);
347
348         if (!locked)
349                 URE_UNLOCK(sc);
350         return (val);
351 }
352
353 static int
354 ure_miibus_writereg(device_t dev, int phy, int reg, int val)
355 {
356         struct ure_softc *sc;
357         int locked;
358
359         sc = device_get_softc(dev);
360         if (sc->sc_phyno != phy)
361                 return (0);
362
363         locked = mtx_owned(&sc->sc_mtx);
364         if (!locked)
365                 URE_LOCK(sc);
366         
367         ure_ocp_reg_write(sc, URE_OCP_BASE_MII + reg * 2, val);
368
369         if (!locked)
370                 URE_UNLOCK(sc);
371         return (0);
372 }
373
374 static void
375 ure_miibus_statchg(device_t dev)
376 {
377         struct ure_softc *sc;
378         struct mii_data *mii;
379         struct ifnet *ifp;
380         int locked;
381
382         sc = device_get_softc(dev);
383         mii = GET_MII(sc);
384         locked = mtx_owned(&sc->sc_mtx);
385         if (!locked)
386                 URE_LOCK(sc);
387
388         ifp = uether_getifp(&sc->sc_ue);
389         if (mii == NULL || ifp == NULL ||
390             (ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
391                 goto done;
392
393         sc->sc_flags &= ~URE_FLAG_LINK;
394         if ((mii->mii_media_status & (IFM_ACTIVE | IFM_AVALID)) ==
395             (IFM_ACTIVE | IFM_AVALID)) {
396                 switch (IFM_SUBTYPE(mii->mii_media_active)) {
397                 case IFM_10_T:
398                 case IFM_100_TX:
399                         sc->sc_flags |= URE_FLAG_LINK;
400                         break;
401                 default:
402                         break;
403                 }
404         }
405
406         /* Lost link, do nothing. */
407         if ((sc->sc_flags & URE_FLAG_LINK) == 0)
408                 goto done;
409 done:
410         if (!locked)
411                 URE_UNLOCK(sc);
412 }
413
414 /*
415  * Probe for a RTL8152 chip.
416  */
417 static int
418 ure_probe(device_t dev)
419 {
420         struct usb_attach_arg *uaa;
421
422         uaa = device_get_ivars(dev);
423         if (uaa->usb_mode != USB_MODE_HOST)
424                 return (ENXIO);
425         if (uaa->info.bConfigIndex != URE_CONFIG_IDX)
426                 return (ENXIO);
427         if (uaa->info.bIfaceIndex != URE_IFACE_IDX)
428                 return (ENXIO);
429
430         return (usbd_lookup_id_by_uaa(ure_devs, sizeof(ure_devs), uaa));
431 }
432
433 /*
434  * Attach the interface. Allocate softc structures, do ifmedia
435  * setup and ethernet/BPF attach.
436  */
437 static int
438 ure_attach(device_t dev)
439 {
440         struct usb_attach_arg *uaa = device_get_ivars(dev);
441         struct ure_softc *sc = device_get_softc(dev);
442         struct usb_ether *ue = &sc->sc_ue;
443         uint8_t iface_index;
444         int error;
445
446         device_set_usb_desc(dev);
447         mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF);
448
449         iface_index = URE_IFACE_IDX;
450         error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
451             ure_config, URE_N_TRANSFER, sc, &sc->sc_mtx);
452         if (error != 0) {
453                 device_printf(dev, "allocating USB transfers failed\n");
454                 goto detach;
455         }
456
457         ue->ue_sc = sc;
458         ue->ue_dev = dev;
459         ue->ue_udev = uaa->device;
460         ue->ue_mtx = &sc->sc_mtx;
461         ue->ue_methods = &ure_ue_methods;
462
463         error = uether_ifattach(ue);
464         if (error != 0) {
465                 device_printf(dev, "could not attach interface\n");
466                 goto detach;
467         }
468         return (0);                     /* success */
469
470 detach:
471         ure_detach(dev);
472         return (ENXIO);                 /* failure */
473 }
474
475 static int
476 ure_detach(device_t dev)
477 {
478         struct ure_softc *sc = device_get_softc(dev);
479         struct usb_ether *ue = &sc->sc_ue;
480
481         usbd_transfer_unsetup(sc->sc_xfer, URE_N_TRANSFER);
482         uether_ifdetach(ue);
483         mtx_destroy(&sc->sc_mtx);
484
485         return (0);
486 }
487
488 static void
489 ure_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
490 {
491         struct ure_softc *sc = usbd_xfer_softc(xfer);
492         struct usb_ether *ue = &sc->sc_ue;
493         struct ifnet *ifp = uether_getifp(ue);
494         struct usb_page_cache *pc;
495         struct ure_rxpkt pkt;
496         int actlen, len;
497
498         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
499
500         switch (USB_GET_STATE(xfer)) {
501         case USB_ST_TRANSFERRED:
502                 if (actlen < (int)(sizeof(pkt))) {
503                         if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
504                         goto tr_setup;
505                 }
506                 pc = usbd_xfer_get_frame(xfer, 0);
507                 usbd_copy_out(pc, 0, &pkt, sizeof(pkt));
508                 len = le32toh(pkt.ure_pktlen) & URE_RXPKT_LEN_MASK;
509                 len -= ETHER_CRC_LEN;
510                 if (actlen < (int)(len + sizeof(pkt))) {
511                         if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
512                         goto tr_setup;
513                 }
514
515                 uether_rxbuf(ue, pc, sizeof(pkt), len);
516                 /* FALLTHROUGH */
517         case USB_ST_SETUP:
518 tr_setup:
519                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
520                 usbd_transfer_submit(xfer);
521                 uether_rxflush(ue);
522                 return;
523
524         default:                        /* Error */
525                 DPRINTF("bulk read error, %s\n",
526                     usbd_errstr(error));
527
528                 if (error != USB_ERR_CANCELLED) {
529                         /* try to clear stall first */
530                         usbd_xfer_set_stall(xfer);
531                         goto tr_setup;
532                 }
533                 return;
534         }
535 }
536
537 static void
538 ure_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
539 {
540         struct ure_softc *sc = usbd_xfer_softc(xfer);
541         struct ifnet *ifp = uether_getifp(&sc->sc_ue);
542         struct usb_page_cache *pc;
543         struct mbuf *m;
544         struct ure_txpkt txpkt;
545         int len, pos;
546
547         switch (USB_GET_STATE(xfer)) {
548         case USB_ST_TRANSFERRED:
549                 DPRINTFN(11, "transfer complete\n");
550                 ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
551                 /* FALLTHROUGH */
552         case USB_ST_SETUP:
553 tr_setup:
554                 if ((sc->sc_flags & URE_FLAG_LINK) == 0 ||
555                     (ifp->if_drv_flags & IFF_DRV_OACTIVE) != 0) {
556                         /*
557                          * don't send anything if there is no link !
558                          */
559                         return;
560                 }
561                 IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
562                 if (m == NULL)
563                         break;
564                 pos = 0;
565                 len = m->m_pkthdr.len;
566                 pc = usbd_xfer_get_frame(xfer, 0);
567                 memset(&txpkt, 0, sizeof(txpkt));
568                 txpkt.ure_pktlen = htole32((len & URE_TXPKT_LEN_MASK) |
569                     URE_TKPKT_TX_FS | URE_TKPKT_TX_LS);
570                 usbd_copy_in(pc, pos, &txpkt, sizeof(txpkt));
571                 pos += sizeof(txpkt);
572                 usbd_m_copy_in(pc, pos, m, 0, m->m_pkthdr.len);
573                 pos += m->m_pkthdr.len;
574
575                 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
576
577                 /*
578                  * If there's a BPF listener, bounce a copy
579                  * of this frame to him.
580                  */
581                 BPF_MTAP(ifp, m);
582
583                 m_freem(m);
584
585                 /* Set frame length. */
586                 usbd_xfer_set_frame_len(xfer, 0, pos);
587
588                 usbd_transfer_submit(xfer);
589                 ifp->if_drv_flags |= IFF_DRV_OACTIVE;
590                 return;
591         default:                        /* Error */
592                 DPRINTFN(11, "transfer error, %s\n",
593                     usbd_errstr(error));
594
595                 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
596                 ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
597
598                 if (error != USB_ERR_CANCELLED) {
599                         /* try to clear stall first */
600                         usbd_xfer_set_stall(xfer);
601                         goto tr_setup;
602                 }
603                 return;
604         }
605 }
606
607 static void
608 ure_read_chipver(struct ure_softc *sc)
609 {
610         uint16_t ver;
611
612         ver = ure_read_2(sc, URE_PLA_TCR1, URE_MCU_TYPE_PLA) & URE_VERSION_MASK;
613         switch (ver) {
614         case 0x4c00:
615                 sc->sc_chip |= URE_CHIP_VER_4C00;
616                 break;
617         case 0x4c10:
618                 sc->sc_chip |= URE_CHIP_VER_4C10;
619                 break;
620         default:
621                 device_printf(sc->sc_ue.ue_dev,
622                     "unknown version 0x%04x\n", ver);
623                 break;
624         }
625 }
626
627 static void
628 ure_attach_post(struct usb_ether *ue)
629 {
630         struct ure_softc *sc = uether_getsc(ue);
631
632         sc->sc_phyno = 0;
633
634         /* Determine the chip version. */
635         ure_read_chipver(sc);
636
637         /* Initialize controller and get station address. */
638         ure_rtl8152_init(sc);
639
640         if (sc->sc_chip & URE_CHIP_VER_4C00)
641                 ure_read_mem(sc, URE_PLA_IDR, URE_MCU_TYPE_PLA,
642                     ue->ue_eaddr, 8);
643         else
644                 ure_read_mem(sc, URE_PLA_BACKUP, URE_MCU_TYPE_PLA,
645                     ue->ue_eaddr, 8);
646 }
647
648 static int
649 ure_attach_post_sub(struct usb_ether *ue)
650 {
651         struct ure_softc *sc;
652         struct ifnet *ifp;
653         int error;
654
655         sc = uether_getsc(ue);
656         ifp = ue->ue_ifp;
657         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
658         ifp->if_start = uether_start;
659         ifp->if_ioctl = ure_ioctl;
660         ifp->if_init = uether_init;
661         IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
662         ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
663         IFQ_SET_READY(&ifp->if_snd);
664
665         mtx_lock(&Giant);
666         error = mii_attach(ue->ue_dev, &ue->ue_miibus, ifp,
667             uether_ifmedia_upd, ue->ue_methods->ue_mii_sts,
668             BMSR_DEFCAPMASK, sc->sc_phyno, MII_OFFSET_ANY, 0);
669         mtx_unlock(&Giant);
670
671         return (error);
672 }
673
674 static void
675 ure_init(struct usb_ether *ue)
676 {
677         struct ure_softc *sc = uether_getsc(ue);
678         struct ifnet *ifp = uether_getifp(ue);
679         uint32_t rxmode;
680
681         URE_LOCK_ASSERT(sc, MA_OWNED);
682
683         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) != 0)
684                 return;
685
686         /* Cancel pending I/O. */
687         ure_stop(ue);
688
689         ure_reset(sc);
690
691         /* Set MAC address. */
692         ure_write_mem(sc, URE_PLA_IDR, URE_MCU_TYPE_PLA | URE_BYTE_EN_SIX_BYTES,
693             IF_LLADDR(ifp), 8);
694
695         /* Reset the packet filter. */
696         ure_write_2(sc, URE_PLA_FMC, URE_MCU_TYPE_PLA,
697             ure_read_2(sc, URE_PLA_FMC, URE_MCU_TYPE_PLA) &
698             ~URE_FMC_FCR_MCU_EN);
699         ure_write_2(sc, URE_PLA_FMC, URE_MCU_TYPE_PLA,
700             ure_read_2(sc, URE_PLA_FMC, URE_MCU_TYPE_PLA) |
701             URE_FMC_FCR_MCU_EN);
702             
703         /* Enable transmit and receive. */
704         ure_write_1(sc, URE_PLA_CR, URE_MCU_TYPE_PLA,
705             ure_read_1(sc, URE_PLA_CR, URE_MCU_TYPE_PLA) | URE_CR_RE |
706             URE_CR_TE);
707
708         ure_write_2(sc, URE_PLA_MISC_1, URE_MCU_TYPE_PLA,
709             ure_read_2(sc, URE_PLA_MISC_1, URE_MCU_TYPE_PLA) &
710             ~URE_RXDY_GATED_EN);
711
712         /* Set Rx mode. */
713         rxmode = ure_read_4(sc, URE_PLA_RCR, URE_MCU_TYPE_PLA);
714         rxmode &= ~URE_RCR_ACPT_ALL;
715         rxmode |= URE_RCR_APM;
716
717         /* If we want promiscuous mode, set the allframes bit. */
718         if (ifp->if_flags & IFF_PROMISC)
719                 rxmode |= URE_RCR_AAP;
720
721         if (ifp->if_flags & IFF_BROADCAST)
722                 rxmode |= URE_RCR_AB;
723
724         ure_write_4(sc, URE_PLA_RCR, URE_MCU_TYPE_PLA, rxmode);
725
726         /* Load the multicast filter. */
727         ure_setmulti(ue);
728
729         usbd_xfer_set_stall(sc->sc_xfer[URE_BULK_DT_WR]);
730
731         /* Indicate we are up and running. */
732         ifp->if_drv_flags |= IFF_DRV_RUNNING;
733
734         /* Switch to selected media. */
735         ure_ifmedia_upd(ifp);
736 }
737
738 static void
739 ure_tick(struct usb_ether *ue)
740 {
741         struct ure_softc *sc = uether_getsc(ue);
742         struct mii_data *mii = GET_MII(sc);
743
744         URE_LOCK_ASSERT(sc, MA_OWNED);
745
746         mii_tick(mii);
747         if ((sc->sc_flags & URE_FLAG_LINK) == 0
748             && mii->mii_media_status & IFM_ACTIVE &&
749             IFM_SUBTYPE(mii->mii_media_active) != IFM_NONE) {
750                 sc->sc_flags |= URE_FLAG_LINK;
751                 ure_start(ue);
752         }
753 }
754
755 static void
756 ure_setpromisc(struct usb_ether *ue)
757 {
758         struct ure_softc *sc = uether_getsc(ue);
759         struct ifnet *ifp = uether_getifp(ue);
760         uint32_t rxmode;
761
762         rxmode = ure_read_4(sc, URE_PLA_RCR, URE_MCU_TYPE_PLA);
763
764         if (ifp->if_flags & IFF_PROMISC)
765                 rxmode |= URE_RCR_AAP;
766         else
767                 rxmode &= ~URE_RCR_AAP;
768
769         ure_write_4(sc, URE_PLA_RCR, URE_MCU_TYPE_PLA, rxmode);
770
771         ure_setmulti(ue);
772 }
773
774 /*
775  * Program the 64-bit multicast hash filter.
776  */
777 static void
778 ure_setmulti(struct usb_ether *ue)
779 {
780         struct ure_softc *sc = uether_getsc(ue);
781         struct ifnet *ifp = uether_getifp(ue);
782         struct ifmultiaddr *ifma;
783         uint32_t h, rxmode;
784         uint32_t hashes[2] = { 0, 0 };
785
786         URE_LOCK_ASSERT(sc, MA_OWNED);
787
788         rxmode = ure_read_4(sc, URE_PLA_RCR, URE_MCU_TYPE_PLA);
789         if (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC)) {
790                 if (ifp->if_flags & IFF_PROMISC)
791                         rxmode |= URE_RCR_AAP;
792                 rxmode |= URE_RCR_AM;
793                 hashes[0] = hashes[1] = 0xffffffff;
794                 goto done;
795         }
796
797         if_maddr_rlock(ifp);
798         TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
799                 if (ifma->ifma_addr->sa_family != AF_LINK)
800                         continue;
801                 h = ether_crc32_be(LLADDR((struct sockaddr_dl *)
802                 ifma->ifma_addr), ETHER_ADDR_LEN) >> 26;
803                 if (h < 32)
804                         hashes[0] |= (1 << h);
805                 else
806                         hashes[1] |= (1 << (h - 32));
807         }
808         if_maddr_runlock(ifp);
809
810         h = bswap32(hashes[0]);
811         hashes[0] = bswap32(hashes[1]);
812         hashes[1] = h;
813         rxmode |= URE_RCR_AM;
814
815 done:
816         ure_write_4(sc, URE_PLA_MAR0, URE_MCU_TYPE_PLA, hashes[0]);
817         ure_write_4(sc, URE_PLA_MAR4, URE_MCU_TYPE_PLA, hashes[1]);
818         ure_write_4(sc, URE_PLA_RCR, URE_MCU_TYPE_PLA, rxmode);
819 }
820
821 static void
822 ure_start(struct usb_ether *ue)
823 {
824         struct ure_softc *sc = uether_getsc(ue);
825
826         /*
827          * start the USB transfers, if not already started:
828          */
829         usbd_transfer_start(sc->sc_xfer[URE_BULK_DT_RD]);
830         usbd_transfer_start(sc->sc_xfer[URE_BULK_DT_WR]);
831 }
832
833 static void
834 ure_reset(struct ure_softc *sc)
835 {
836         int i;
837
838         ure_write_1(sc, URE_PLA_CR, URE_MCU_TYPE_PLA, URE_CR_RST);
839
840         for (i = 0; i < URE_TIMEOUT; i++) {
841                 if (!(ure_read_1(sc, URE_PLA_CR, URE_MCU_TYPE_PLA) &
842                     URE_CR_RST))
843                         break;
844                 uether_pause(&sc->sc_ue, hz / 100);
845         }
846         if (i == URE_TIMEOUT)
847                 device_printf(sc->sc_ue.ue_dev, "reset never completed\n");
848 }
849
850 /*
851  * Set media options.
852  */
853 static int
854 ure_ifmedia_upd(struct ifnet *ifp)
855 {
856         struct ure_softc *sc = ifp->if_softc;
857         struct mii_data *mii = GET_MII(sc);
858         struct mii_softc *miisc;
859         int error;
860
861         URE_LOCK_ASSERT(sc, MA_OWNED);
862
863         LIST_FOREACH(miisc, &mii->mii_phys, mii_list)
864                 PHY_RESET(miisc);
865         error = mii_mediachg(mii);
866         return (error);
867 }
868
869 /*
870  * Report current media status.
871  */
872 static void
873 ure_ifmedia_sts(struct ifnet *ifp, struct ifmediareq *ifmr)
874 {
875         struct ure_softc *sc;
876         struct mii_data *mii;
877
878         sc = ifp->if_softc;
879         mii = GET_MII(sc);
880
881         URE_LOCK(sc);
882         mii_pollstat(mii);
883         ifmr->ifm_active = mii->mii_media_active;
884         ifmr->ifm_status = mii->mii_media_status;
885         URE_UNLOCK(sc);
886 }
887
888 static int
889 ure_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
890 {
891         struct usb_ether *ue = ifp->if_softc;
892         struct ure_softc *sc;
893         struct ifreq *ifr;
894         int error, mask, reinit;
895
896         sc = uether_getsc(ue);
897         ifr = (struct ifreq *)data;
898         error = 0;
899         reinit = 0;
900         if (cmd == SIOCSIFCAP) {
901                 URE_LOCK(sc);
902                 mask = ifr->ifr_reqcap ^ ifp->if_capenable;
903                 if (reinit > 0 && ifp->if_drv_flags & IFF_DRV_RUNNING)
904                         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
905                 else
906                         reinit = 0;
907                 URE_UNLOCK(sc);
908                 if (reinit > 0)
909                         uether_init(ue);
910         } else
911                 error = uether_ioctl(ifp, cmd, data);
912
913         return (error);
914 }
915
916 static void
917 ure_rtl8152_init(struct ure_softc *sc)
918 {
919         uint32_t pwrctrl;
920
921         /* Disable ALDPS. */
922         ure_ocp_reg_write(sc, URE_OCP_ALDPS_CONFIG, URE_ENPDNPS | URE_LINKENA |
923             URE_DIS_SDSAVE);
924         uether_pause(&sc->sc_ue, hz / 50);
925
926         if (sc->sc_chip & URE_CHIP_VER_4C00) {
927                 ure_write_2(sc, URE_PLA_LED_FEATURE, URE_MCU_TYPE_PLA,
928                     ure_read_2(sc, URE_PLA_LED_FEATURE, URE_MCU_TYPE_PLA) &
929                     ~URE_LED_MODE_MASK);
930         }
931
932         ure_write_2(sc, URE_USB_UPS_CTRL, URE_MCU_TYPE_USB,
933             ure_read_2(sc, URE_USB_UPS_CTRL, URE_MCU_TYPE_USB) &
934             ~URE_POWER_CUT);
935         ure_write_2(sc, URE_USB_PM_CTRL_STATUS, URE_MCU_TYPE_USB,
936             ure_read_2(sc, URE_USB_PM_CTRL_STATUS, URE_MCU_TYPE_USB) &
937             ~URE_RESUME_INDICATE);
938
939         ure_write_2(sc, URE_PLA_PHY_PWR, URE_MCU_TYPE_PLA,
940             ure_read_2(sc, URE_PLA_PHY_PWR, URE_MCU_TYPE_PLA) |
941             URE_TX_10M_IDLE_EN | URE_PFM_PWM_SWITCH);
942         pwrctrl = ure_read_4(sc, URE_PLA_MAC_PWR_CTRL, URE_MCU_TYPE_PLA);
943         pwrctrl &= ~URE_MCU_CLK_RATIO_MASK;
944         pwrctrl |= URE_MCU_CLK_RATIO | URE_D3_CLK_GATED_EN;
945         ure_write_4(sc, URE_PLA_MAC_PWR_CTRL, URE_MCU_TYPE_PLA, pwrctrl);
946         ure_write_2(sc, URE_PLA_GPHY_INTR_IMR, URE_MCU_TYPE_PLA,
947             URE_GPHY_STS_MSK | URE_SPEED_DOWN_MSK | URE_SPDWN_RXDV_MSK |
948             URE_SPDWN_LINKCHG_MSK);
949
950         /* Disable Rx aggregation. */
951         ure_write_2(sc, URE_USB_USB_CTRL, URE_MCU_TYPE_USB,
952             ure_read_2(sc, URE_USB_USB_CTRL, URE_MCU_TYPE_USB) |
953             URE_RX_AGG_DISABLE);
954
955         /* Disable ALDPS. */
956         ure_ocp_reg_write(sc, URE_OCP_ALDPS_CONFIG, URE_ENPDNPS | URE_LINKENA |
957             URE_DIS_SDSAVE);
958         uether_pause(&sc->sc_ue, hz / 50);
959
960         ure_init_fifo(sc);
961
962         ure_write_1(sc, URE_USB_TX_AGG, URE_MCU_TYPE_USB,
963             URE_TX_AGG_MAX_THRESHOLD);
964         ure_write_4(sc, URE_USB_RX_BUF_TH, URE_MCU_TYPE_USB, URE_RX_THR_HIGH);
965         ure_write_4(sc, URE_USB_TX_DMA, URE_MCU_TYPE_USB,
966             URE_TEST_MODE_DISABLE | URE_TX_SIZE_ADJUST1);
967 }
968
969 static void
970 ure_stop(struct usb_ether *ue)
971 {
972         struct ure_softc *sc = uether_getsc(ue);
973         struct ifnet *ifp = uether_getifp(ue);
974
975         URE_LOCK_ASSERT(sc, MA_OWNED);
976
977         ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
978         sc->sc_flags &= ~URE_FLAG_LINK;
979
980         /*
981          * stop all the transfers, if not already stopped:
982          */
983         usbd_transfer_stop(sc->sc_xfer[URE_BULK_DT_WR]);
984         usbd_transfer_stop(sc->sc_xfer[URE_BULK_DT_RD]);
985 }
986
987 static void
988 ure_disable_teredo(struct ure_softc *sc)
989 {
990
991         ure_write_4(sc, URE_PLA_TEREDO_CFG, URE_MCU_TYPE_PLA,
992             ure_read_4(sc, URE_PLA_TEREDO_CFG, URE_MCU_TYPE_PLA) & 
993             ~(URE_TEREDO_SEL | URE_TEREDO_RS_EVENT_MASK | URE_OOB_TEREDO_EN));
994         ure_write_2(sc, URE_PLA_WDT6_CTRL, URE_MCU_TYPE_PLA,
995             URE_WDT6_SET_MODE);
996         ure_write_2(sc, URE_PLA_REALWOW_TIMER, URE_MCU_TYPE_PLA, 0);
997         ure_write_4(sc, URE_PLA_TEREDO_TIMER, URE_MCU_TYPE_PLA, 0);
998 }
999
1000 static void
1001 ure_init_fifo(struct ure_softc *sc)
1002 {
1003         uint32_t rx_fifo1, rx_fifo2;
1004         int i;
1005
1006         ure_write_2(sc, URE_PLA_MISC_1, URE_MCU_TYPE_PLA,
1007             ure_read_2(sc, URE_PLA_MISC_1, URE_MCU_TYPE_PLA) |
1008             URE_RXDY_GATED_EN);
1009
1010         ure_disable_teredo(sc);
1011
1012         ure_write_4(sc, URE_PLA_RCR, URE_MCU_TYPE_PLA,
1013             ure_read_4(sc, URE_PLA_RCR, URE_MCU_TYPE_PLA) &
1014             ~URE_RCR_ACPT_ALL);
1015
1016         ure_reset(sc);
1017
1018         ure_write_1(sc, URE_PLA_CR, URE_MCU_TYPE_PLA, 0);
1019
1020         ure_write_1(sc, URE_PLA_OOB_CTRL, URE_MCU_TYPE_PLA,
1021             ure_read_1(sc, URE_PLA_OOB_CTRL, URE_MCU_TYPE_PLA) &
1022             ~URE_NOW_IS_OOB);
1023
1024         ure_write_2(sc, URE_PLA_SFF_STS_7, URE_MCU_TYPE_PLA,
1025             ure_read_2(sc, URE_PLA_SFF_STS_7, URE_MCU_TYPE_PLA) &
1026             ~URE_MCU_BORW_EN);
1027         for (i = 0; i < URE_TIMEOUT; i++) {
1028                 if (ure_read_1(sc, URE_PLA_OOB_CTRL, URE_MCU_TYPE_PLA) &
1029                     URE_LINK_LIST_READY)
1030                         break;
1031                 uether_pause(&sc->sc_ue, hz / 100);
1032         }
1033         if (i == URE_TIMEOUT)
1034                 device_printf(sc->sc_ue.ue_dev,
1035                     "timeout waiting for OOB control\n");
1036         ure_write_2(sc, URE_PLA_SFF_STS_7, URE_MCU_TYPE_PLA,
1037             ure_read_2(sc, URE_PLA_SFF_STS_7, URE_MCU_TYPE_PLA) |
1038             URE_RE_INIT_LL);
1039         for (i = 0; i < URE_TIMEOUT; i++) {
1040                 if (ure_read_1(sc, URE_PLA_OOB_CTRL, URE_MCU_TYPE_PLA) &
1041                     URE_LINK_LIST_READY)
1042                         break;
1043                 uether_pause(&sc->sc_ue, hz / 100);
1044         }
1045         if (i == URE_TIMEOUT)
1046                 device_printf(sc->sc_ue.ue_dev,
1047                     "timeout waiting for OOB control\n");
1048
1049         ure_write_2(sc, URE_PLA_CPCR, URE_MCU_TYPE_PLA,
1050             ure_read_2(sc, URE_PLA_CPCR, URE_MCU_TYPE_PLA) &
1051             ~URE_CPCR_RX_VLAN);
1052         ure_write_2(sc, URE_PLA_TCR0, URE_MCU_TYPE_PLA,
1053             ure_read_2(sc, URE_PLA_TCR0, URE_MCU_TYPE_PLA) |
1054             URE_TCR0_AUTO_FIFO);
1055
1056         /* Configure Rx FIFO threshold. */
1057         ure_write_4(sc, URE_PLA_RXFIFO_CTRL0, URE_MCU_TYPE_PLA,
1058             URE_RXFIFO_THR1_NORMAL);
1059         if (usbd_get_speed(sc->sc_ue.ue_udev) == USB_SPEED_FULL) {
1060                 rx_fifo1 = URE_RXFIFO_THR2_FULL;
1061                 rx_fifo2 = URE_RXFIFO_THR3_FULL;
1062         } else {
1063                 rx_fifo1 = URE_RXFIFO_THR2_HIGH;
1064                 rx_fifo2 = URE_RXFIFO_THR3_HIGH;
1065         }
1066         ure_write_4(sc, URE_PLA_RXFIFO_CTRL1, URE_MCU_TYPE_PLA, rx_fifo1);
1067         ure_write_4(sc, URE_PLA_RXFIFO_CTRL2, URE_MCU_TYPE_PLA, rx_fifo2);
1068
1069         /* Configure Tx FIFO threshold. */
1070         ure_write_4(sc, URE_PLA_TXFIFO_CTRL, URE_MCU_TYPE_PLA,
1071             URE_TXFIFO_THR_NORMAL);
1072 }