sys/dev/usb/net/if_urndis.c

   1 /*      $OpenBSD: if_urndis.c,v 1.46 2013/12/09 15:45:29 pirofti Exp $ */
   2
   3 /*
   4  * Copyright (c) 2010 Jonathan Armani <armani@openbsd.org>
   5  * Copyright (c) 2010 Fabien Romano <fabien@openbsd.org>
   6  * Copyright (c) 2010 Michael Knudsen <mk@openbsd.org>
   7  * Copyright (c) 2014 Hans Petter Selasky <hselasky@freebsd.org>
   8  * All rights reserved.
   9  *
  10  * Permission to use, copy, modify, and distribute this software for any
  11  * purpose with or without fee is hereby granted, provided that the above
  12  * copyright notice and this permission notice appear in all copies.
  13  *
  14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  21  */
  22
  23 #include <sys/cdefs.h>
  24 __FBSDID("$FreeBSD$");
  25
  26 #include <sys/stdint.h>
  27 #include <sys/stddef.h>
  28 #include <sys/param.h>
  29 #include <sys/queue.h>
  30 #include <sys/types.h>
  31 #include <sys/systm.h>
  32 #include <sys/socket.h>
  33 #include <sys/kernel.h>
  34 #include <sys/bus.h>
  35 #include <sys/module.h>
  36 #include <sys/lock.h>
  37 #include <sys/mutex.h>
  38 #include <sys/condvar.h>
  39 #include <sys/sysctl.h>
  40 #include <sys/sx.h>
  41 #include <sys/unistd.h>
  42 #include <sys/callout.h>
  43 #include <sys/malloc.h>
  44 #include <sys/priv.h>
  45
  46 #include <net/if.h>
  47 #include <net/if_var.h>
  48
  49 #include <dev/usb/usb.h>
  50 #include <dev/usb/usbdi.h>
  51 #include <dev/usb/usbdi_util.h>
  52 #include "usbdevs.h"
  53
  54 #define USB_DEBUG_VAR urndis_debug
  55 #include <dev/usb/usb_debug.h>
  56 #include <dev/usb/usb_process.h>
  57 #include "usb_if.h"
  58
  59 #include <dev/usb/net/usb_ethernet.h>
  60 #include <dev/usb/net/if_urndisreg.h>
  61
  62 #include <dev/usb/usb_cdc.h>
  63
  64 static device_probe_t urndis_probe;
  65 static device_attach_t urndis_attach;
  66 static device_detach_t urndis_detach;
  67 static device_suspend_t urndis_suspend;
  68 static device_resume_t urndis_resume;
  69
  70 static usb_callback_t urndis_bulk_write_callback;
  71 static usb_callback_t urndis_bulk_read_callback;
  72 static usb_callback_t urndis_intr_read_callback;
  73
  74 static uether_fn_t urndis_attach_post;
  75 static uether_fn_t urndis_init;
  76 static uether_fn_t urndis_stop;
  77 static uether_fn_t urndis_start;
  78 static uether_fn_t urndis_setmulti;
  79 static uether_fn_t urndis_setpromisc;
  80
  81 static uint32_t urndis_ctrl_query(struct urndis_softc *, uint32_t, const void **, uint16_t *);
  82 static uint32_t urndis_ctrl_set(struct urndis_softc *, uint32_t, struct urndis_set_req *, uint16_t);
  83 static uint32_t urndis_ctrl_handle_init(struct urndis_softc *, const struct urndis_comp_hdr *);
  84 static uint32_t urndis_ctrl_handle_query(struct urndis_softc *, const struct urndis_comp_hdr *, const void **, uint16_t *);
  85 static uint32_t urndis_ctrl_handle_reset(struct urndis_softc *, const struct urndis_comp_hdr *);
  86 static uint32_t urndis_ctrl_init(struct urndis_softc *);
  87
  88 #ifdef USB_DEBUG
  89 static int urndis_debug = 0;
  90 static  SYSCTL_NODE(_hw_usb, OID_AUTO, urndis, CTLFLAG_RW, 0, "USB RNDIS-Ethernet");
  91 SYSCTL_INT(_hw_usb_urndis, OID_AUTO, debug, CTLFLAG_RW, &urndis_debug, 0,
  92     "Debug level");
  93 #endif
  94
  95 static const struct usb_config urndis_config[URNDIS_N_TRANSFER] = {
  96
  97         [URNDIS_BULK_RX] = {
  98                 .type = UE_BULK,
  99                 .endpoint = UE_ADDR_ANY,
 100                 .direction = UE_DIR_RX,
 101                 .if_index = 0,
 102                 .frames = 1,
 103                 .bufsize = RNDIS_RX_MAXLEN,
 104                 .flags = {.short_xfer_ok = 1,},
 105                 .callback = urndis_bulk_read_callback,
 106                 .timeout = 0,           /* no timeout */
 107                 .usb_mode = USB_MODE_HOST,
 108         },
 109
 110         [URNDIS_BULK_TX] = {
 111                 .type = UE_BULK,
 112                 .endpoint = UE_ADDR_ANY,
 113                 .direction = UE_DIR_TX,
 114                 .if_index = 0,
 115                 .frames = RNDIS_TX_FRAMES_MAX,
 116                 .bufsize = (RNDIS_TX_FRAMES_MAX * RNDIS_TX_MAXLEN),
 117                 .flags = {
 118                         .force_short_xfer = 1,
 119                 },
 120                 .callback = urndis_bulk_write_callback,
 121                 .timeout = 10000,       /* 10 seconds */
 122                 .usb_mode = USB_MODE_HOST,
 123         },
 124
 125         [URNDIS_INTR_RX] = {
 126                 .type = UE_INTERRUPT,
 127                 .endpoint = UE_ADDR_ANY,
 128                 .direction = UE_DIR_RX,
 129                 .if_index = 1,
 130                 .bufsize = 0,   /* use wMaxPacketSize */
 131                 .flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
 132                 .callback = urndis_intr_read_callback,
 133                 .timeout = 0,
 134                 .usb_mode = USB_MODE_HOST,
 135         },
 136 };
 137
 138 static device_method_t urndis_methods[] = {
 139         /* Device interface */
 140         DEVMETHOD(device_probe, urndis_probe),
 141         DEVMETHOD(device_attach, urndis_attach),
 142         DEVMETHOD(device_detach, urndis_detach),
 143         DEVMETHOD(device_suspend, urndis_suspend),
 144         DEVMETHOD(device_resume, urndis_resume),
 145
 146         DEVMETHOD_END
 147 };
 148
 149 static driver_t urndis_driver = {
 150         .name = "urndis",
 151         .methods = urndis_methods,
 152         .size = sizeof(struct urndis_softc),
 153 };
 154
 155 static devclass_t urndis_devclass;
 156
 157 DRIVER_MODULE(urndis, uhub, urndis_driver, urndis_devclass, NULL, 0);
 158 MODULE_VERSION(urndis, 1);
 159 MODULE_DEPEND(urndis, uether, 1, 1, 1);
 160 MODULE_DEPEND(urndis, usb, 1, 1, 1);
 161 MODULE_DEPEND(urndis, ether, 1, 1, 1);
 162
 163 static const struct usb_ether_methods urndis_ue_methods = {
 164         .ue_attach_post = urndis_attach_post,
 165         .ue_start = urndis_start,
 166         .ue_init = urndis_init,
 167         .ue_stop = urndis_stop,
 168         .ue_setmulti = urndis_setmulti,
 169         .ue_setpromisc = urndis_setpromisc,
 170 };
 171
 172 static const STRUCT_USB_HOST_ID urndis_host_devs[] = {
 173         /* Generic RNDIS class match */
 174         {USB_IFACE_CLASS(UICLASS_WIRELESS), USB_IFACE_SUBCLASS(UISUBCLASS_RF),
 175                 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)},
 176         {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(UISUBCLASS_SYNC),
 177                 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)},
 178         /* HP-WebOS */
 179         {USB_VENDOR(USB_VENDOR_PALM), USB_IFACE_CLASS(UICLASS_CDC),
 180                 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL),
 181                 USB_IFACE_PROTOCOL(0xff)},
 182 };
 183
 184 static int
 185 urndis_probe(device_t dev)
 186 {
 187         struct usb_attach_arg *uaa = device_get_ivars(dev);
 188
 189         return (usbd_lookup_id_by_uaa(urndis_host_devs, sizeof(urndis_host_devs), uaa));
 190 }
 191
 192 static void
 193 urndis_attach_post(struct usb_ether *ue)
 194 {
 195         /* no-op */
 196         return;
 197 }
 198
 199 static int
 200 urndis_attach(device_t dev)
 201 {
 202         struct urndis_softc *sc = device_get_softc(dev);
 203         struct usb_ether *ue = &sc->sc_ue;
 204         struct usb_attach_arg *uaa = device_get_ivars(dev);
 205         struct usb_cdc_cm_descriptor *cmd;
 206         struct {
 207                 struct urndis_set_req hdr;
 208                 uint32_t filter;
 209         } msg_filter;
 210         const void *buf;
 211         uint16_t bufsz;
 212         uint8_t iface_index[2] = { uaa->info.bIfaceIndex + 1, uaa->info.bIfaceIndex };
 213         int error;
 214         uint8_t i;
 215
 216         sc->sc_ue.ue_udev = uaa->device;
 217         sc->sc_ifaceno_ctl = uaa->info.bIfaceNum;
 218
 219         cmd = usbd_find_descriptor(uaa->device, NULL, uaa->info.bIfaceIndex,
 220             UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_CM, 0xFF);
 221         if (cmd != 0) {
 222                 DPRINTF("Call Mode Descriptor found, dataif=%d\n", cmd->bDataInterface);
 223                 iface_index[0] = cmd->bDataInterface;
 224         }
 225
 226         device_set_usb_desc(dev);
 227
 228         mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF);
 229
 230         /* scan the alternate settings looking for a valid one */
 231
 232         for (i = 0; i != 32; i++) {
 233
 234                 error = usbd_set_alt_interface_index(uaa->device,
 235                     iface_index[0], i);
 236
 237                 if (error != 0)
 238                         break;
 239
 240                 error = usbd_transfer_setup(uaa->device,
 241                     iface_index, sc->sc_xfer, urndis_config,
 242                     URNDIS_N_TRANSFER, sc, &sc->sc_mtx);
 243
 244                 if (error == 0)
 245                         break;
 246         }
 247
 248         if ((error != 0) || (i == 32)) {
 249                 device_printf(dev, "No valid alternate "
 250                     "setting found\n");
 251                 goto detach;
 252         }
 253         URNDIS_LOCK(sc);
 254         error = urndis_ctrl_query(sc, OID_802_3_PERMANENT_ADDRESS, &buf, &bufsz);
 255         URNDIS_UNLOCK(sc);
 256
 257         if (error != (int)RNDIS_STATUS_SUCCESS) {
 258                 device_printf(dev, "Unable to get hardware address\n");
 259                 goto detach;
 260         }
 261         if (bufsz != ETHER_ADDR_LEN) {
 262                 device_printf(dev, "Invalid address length: %d bytes\n", bufsz);
 263                 goto detach;
 264         }
 265         memcpy(&sc->sc_ue.ue_eaddr, buf, ETHER_ADDR_LEN);
 266
 267         /* Initialize packet filter */
 268         sc->sc_filter = RNDIS_PACKET_TYPE_BROADCAST |
 269             RNDIS_PACKET_TYPE_ALL_MULTICAST;
 270         msg_filter.filter = htole32(sc->sc_filter);
 271
 272         URNDIS_LOCK(sc);
 273         error = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
 274             &msg_filter.hdr, sizeof(msg_filter));
 275         URNDIS_UNLOCK(sc);
 276
 277         if (error != (int)RNDIS_STATUS_SUCCESS) {
 278                 device_printf(dev, "Unable to set data filters\n");
 279                 goto detach;
 280         }
 281         ue->ue_sc = sc;
 282         ue->ue_dev = dev;
 283         ue->ue_udev = uaa->device;
 284         ue->ue_mtx = &sc->sc_mtx;
 285         ue->ue_methods = &urndis_ue_methods;
 286
 287         error = uether_ifattach(ue);
 288         if (error) {
 289                 device_printf(dev, "Could not attach interface\n");
 290                 goto detach;
 291         }
 292
 293         URNDIS_LOCK(sc);
 294         /* start interrupt endpoint, if any */
 295         usbd_transfer_start(sc->sc_xfer[URNDIS_INTR_RX]);
 296         URNDIS_UNLOCK(sc);
 297
 298         return (0);                     /* success */
 299
 300 detach:
 301         urndis_detach(dev);
 302         return (ENXIO);                 /* failure */
 303 }
 304
 305 static int
 306 urndis_detach(device_t dev)
 307 {
 308         struct urndis_softc *sc = device_get_softc(dev);
 309         struct usb_ether *ue = &sc->sc_ue;
 310
 311         /* stop all USB transfers first */
 312         usbd_transfer_unsetup(sc->sc_xfer, URNDIS_N_TRANSFER);
 313
 314         uether_ifdetach(ue);
 315
 316         mtx_destroy(&sc->sc_mtx);
 317
 318         return (0);
 319 }
 320
 321 static void
 322 urndis_start(struct usb_ether *ue)
 323 {
 324         struct urndis_softc *sc = uether_getsc(ue);
 325
 326         /*
 327          * Start the USB transfers, if not already started:
 328          */
 329         usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_TX]);
 330         usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_RX]);
 331 }
 332
 333 static void
 334 urndis_init(struct usb_ether *ue)
 335 {
 336         struct urndis_softc *sc = uether_getsc(ue);
 337         struct ifnet *ifp = uether_getifp(ue);
 338
 339         URNDIS_LOCK_ASSERT(sc, MA_OWNED);
 340
 341         ifp->if_drv_flags |= IFF_DRV_RUNNING;
 342
 343         urndis_ctrl_init(sc);
 344
 345         /* stall data write direction, which depends on USB mode */
 346         usbd_xfer_set_stall(sc->sc_xfer[URNDIS_BULK_TX]);
 347
 348         /* start data transfers */
 349         urndis_start(ue);
 350 }
 351
 352 static void
 353 urndis_stop(struct usb_ether *ue)
 354 {
 355         struct urndis_softc *sc = uether_getsc(ue);
 356         struct ifnet *ifp = uether_getifp(ue);
 357
 358         URNDIS_LOCK_ASSERT(sc, MA_OWNED);
 359
 360         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
 361
 362         /*
 363          * stop all the transfers, if not already stopped:
 364          */
 365         usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_RX]);
 366         usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_TX]);
 367 }
 368
 369 static void
 370 urndis_setmulti(struct usb_ether *ue)
 371 {
 372         /* no-op */
 373         return;
 374 }
 375
 376 static void
 377 urndis_setpromisc(struct usb_ether *ue)
 378 {
 379         /* no-op */
 380         return;
 381 }
 382
 383 static int
 384 urndis_suspend(device_t dev)
 385 {
 386         device_printf(dev, "Suspending\n");
 387         return (0);
 388 }
 389
 390 static int
 391 urndis_resume(device_t dev)
 392 {
 393         device_printf(dev, "Resuming\n");
 394         return (0);
 395 }
 396
 397 static usb_error_t
 398 urndis_ctrl_msg(struct urndis_softc *sc, uint8_t rt, uint8_t r,
 399     uint16_t index, uint16_t value, void *buf, uint16_t buflen)
 400 {
 401         usb_device_request_t req;
 402
 403         req.bmRequestType = rt;
 404         req.bRequest = r;
 405         USETW(req.wValue, value);
 406         USETW(req.wIndex, index);
 407         USETW(req.wLength, buflen);
 408
 409         return (usbd_do_request_flags(sc->sc_ue.ue_udev,
 410             &sc->sc_mtx, &req, buf, (rt & UT_READ) ?
 411             USB_SHORT_XFER_OK : 0, NULL, 2000 /* ms */ ));
 412 }
 413
 414 static usb_error_t
 415 urndis_ctrl_send(struct urndis_softc *sc, void *buf, uint16_t len)
 416 {
 417         usb_error_t err;
 418
 419         err = urndis_ctrl_msg(sc, UT_WRITE_CLASS_INTERFACE, UR_GET_STATUS,
 420             sc->sc_ifaceno_ctl, 0, buf, len);
 421
 422         DPRINTF("%s\n", usbd_errstr(err));
 423
 424         return (err);
 425 }
 426
 427 static struct urndis_comp_hdr *
 428 urndis_ctrl_recv(struct urndis_softc *sc)
 429 {
 430         struct urndis_comp_hdr *hdr;
 431         usb_error_t err;
 432
 433         err = urndis_ctrl_msg(sc, UT_READ_CLASS_INTERFACE, UR_CLEAR_FEATURE,
 434             sc->sc_ifaceno_ctl, 0, sc->sc_response_buf, RNDIS_RESPONSE_LEN);
 435
 436         if (err != USB_ERR_NORMAL_COMPLETION)
 437                 return (NULL);
 438
 439         hdr = (struct urndis_comp_hdr *)sc->sc_response_buf;
 440
 441         DPRINTF("type 0x%x len %u\n", le32toh(hdr->rm_type),
 442             le32toh(hdr->rm_len));
 443
 444         if (le32toh(hdr->rm_len) > RNDIS_RESPONSE_LEN) {
 445                 DPRINTF("ctrl message error: wrong size %u > %u\n",
 446                     le32toh(hdr->rm_len), RNDIS_RESPONSE_LEN);
 447                 return (NULL);
 448         }
 449         return (hdr);
 450 }
 451
 452 static uint32_t
 453 urndis_ctrl_handle(struct urndis_softc *sc, struct urndis_comp_hdr *hdr,
 454     const void **buf, uint16_t *bufsz)
 455 {
 456         uint32_t rval;
 457
 458         DPRINTF("\n");
 459
 460         if (buf != NULL && bufsz != NULL) {
 461                 *buf = NULL;
 462                 *bufsz = 0;
 463         }
 464         switch (le32toh(hdr->rm_type)) {
 465         case REMOTE_NDIS_INITIALIZE_CMPLT:
 466                 rval = urndis_ctrl_handle_init(sc, hdr);
 467                 break;
 468
 469         case REMOTE_NDIS_QUERY_CMPLT:
 470                 rval = urndis_ctrl_handle_query(sc, hdr, buf, bufsz);
 471                 break;
 472
 473         case REMOTE_NDIS_RESET_CMPLT:
 474                 rval = urndis_ctrl_handle_reset(sc, hdr);
 475                 break;
 476
 477         case REMOTE_NDIS_KEEPALIVE_CMPLT:
 478         case REMOTE_NDIS_SET_CMPLT:
 479                 rval = le32toh(hdr->rm_status);
 480                 break;
 481
 482         default:
 483                 DPRINTF("ctrl message error: unknown event 0x%x\n",
 484                     le32toh(hdr->rm_type));
 485                 rval = RNDIS_STATUS_FAILURE;
 486                 break;
 487         }
 488         return (rval);
 489 }
 490
 491 static uint32_t
 492 urndis_ctrl_handle_init(struct urndis_softc *sc,
 493     const struct urndis_comp_hdr *hdr)
 494 {
 495         const struct urndis_init_comp *msg;
 496
 497         msg = (const struct urndis_init_comp *)hdr;
 498
 499         DPRINTF("len %u rid %u status 0x%x "
 500             "ver_major %u ver_minor %u devflags 0x%x medium 0x%x pktmaxcnt %u "
 501             "pktmaxsz %u align %u aflistoffset %u aflistsz %u\n",
 502             le32toh(msg->rm_len),
 503             le32toh(msg->rm_rid),
 504             le32toh(msg->rm_status),
 505             le32toh(msg->rm_ver_major),
 506             le32toh(msg->rm_ver_minor),
 507             le32toh(msg->rm_devflags),
 508             le32toh(msg->rm_medium),
 509             le32toh(msg->rm_pktmaxcnt),
 510             le32toh(msg->rm_pktmaxsz),
 511             le32toh(msg->rm_align),
 512             le32toh(msg->rm_aflistoffset),
 513             le32toh(msg->rm_aflistsz));
 514
 515         if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
 516                 DPRINTF("init failed 0x%x\n", le32toh(msg->rm_status));
 517                 return (le32toh(msg->rm_status));
 518         }
 519         if (le32toh(msg->rm_devflags) != RNDIS_DF_CONNECTIONLESS) {
 520                 DPRINTF("wrong device type (current type: 0x%x)\n",
 521                     le32toh(msg->rm_devflags));
 522                 return (RNDIS_STATUS_FAILURE);
 523         }
 524         if (le32toh(msg->rm_medium) != RNDIS_MEDIUM_802_3) {
 525                 DPRINTF("medium not 802.3 (current medium: 0x%x)\n",
 526                     le32toh(msg->rm_medium));
 527                 return (RNDIS_STATUS_FAILURE);
 528         }
 529         sc->sc_lim_pktsz = le32toh(msg->rm_pktmaxsz);
 530
 531         return (le32toh(msg->rm_status));
 532 }
 533
 534 static uint32_t
 535 urndis_ctrl_handle_query(struct urndis_softc *sc,
 536     const struct urndis_comp_hdr *hdr, const void **buf, uint16_t *bufsz)
 537 {
 538         const struct urndis_query_comp *msg;
 539         uint64_t limit;
 540
 541         msg = (const struct urndis_query_comp *)hdr;
 542
 543         DPRINTF("len %u rid %u status 0x%x "
 544             "buflen %u bufoff %u\n",
 545             le32toh(msg->rm_len),
 546             le32toh(msg->rm_rid),
 547             le32toh(msg->rm_status),
 548             le32toh(msg->rm_infobuflen),
 549             le32toh(msg->rm_infobufoffset));
 550
 551         if (buf != NULL && bufsz != NULL) {
 552                 *buf = NULL;
 553                 *bufsz = 0;
 554         }
 555         if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
 556                 DPRINTF("query failed 0x%x\n", le32toh(msg->rm_status));
 557                 return (le32toh(msg->rm_status));
 558         }
 559         limit = le32toh(msg->rm_infobuflen);
 560         limit += le32toh(msg->rm_infobufoffset);
 561         limit += RNDIS_HEADER_OFFSET;
 562
 563         if (limit > (uint64_t)le32toh(msg->rm_len)) {
 564                 DPRINTF("ctrl message error: invalid query info "
 565                     "len/offset/end_position(%u/%u/%u) -> "
 566                     "go out of buffer limit %u\n",
 567                     le32toh(msg->rm_infobuflen),
 568                     le32toh(msg->rm_infobufoffset),
 569                     le32toh(msg->rm_infobuflen) +
 570                     le32toh(msg->rm_infobufoffset) + RNDIS_HEADER_OFFSET,
 571                     le32toh(msg->rm_len));
 572                 return (RNDIS_STATUS_FAILURE);
 573         }
 574         if (buf != NULL && bufsz != NULL) {
 575                 *buf = ((const uint8_t *)msg) + RNDIS_HEADER_OFFSET + le32toh(msg->rm_infobufoffset);
 576                 *bufsz = le32toh(msg->rm_infobuflen);
 577         }
 578         return (le32toh(msg->rm_status));
 579 }
 580
 581 static uint32_t
 582 urndis_ctrl_handle_reset(struct urndis_softc *sc,
 583     const struct urndis_comp_hdr *hdr)
 584 {
 585         const struct urndis_reset_comp *msg;
 586         uint32_t rval;
 587
 588         msg = (const struct urndis_reset_comp *)hdr;
 589
 590         rval = le32toh(msg->rm_status);
 591
 592         DPRINTF("len %u status 0x%x "
 593             "adrreset %u\n",
 594             le32toh(msg->rm_len),
 595             rval,
 596             le32toh(msg->rm_adrreset));
 597
 598         if (rval != RNDIS_STATUS_SUCCESS) {
 599                 DPRINTF("reset failed 0x%x\n", rval);
 600                 return (rval);
 601         }
 602         if (msg->rm_adrreset != 0) {
 603                 struct {
 604                         struct urndis_set_req hdr;
 605                         uint32_t filter;
 606                 } msg_filter;
 607
 608                 msg_filter.filter = htole32(sc->sc_filter);
 609
 610                 rval = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
 611                     &msg_filter.hdr, sizeof(msg_filter));
 612
 613                 if (rval != RNDIS_STATUS_SUCCESS) {
 614                         DPRINTF("unable to reset data filters\n");
 615                         return (rval);
 616                 }
 617         }
 618         return (rval);
 619 }
 620
 621 static uint32_t
 622 urndis_ctrl_init(struct urndis_softc *sc)
 623 {
 624         struct urndis_init_req msg;
 625         struct urndis_comp_hdr *hdr;
 626         uint32_t rval;
 627
 628         msg.rm_type = htole32(REMOTE_NDIS_INITIALIZE_MSG);
 629         msg.rm_len = htole32(sizeof(msg));
 630         msg.rm_rid = htole32(0);
 631         msg.rm_ver_major = htole32(1);
 632         msg.rm_ver_minor = htole32(1);
 633         msg.rm_max_xfersz = htole32(RNDIS_RX_MAXLEN);
 634
 635         DPRINTF("type %u len %u rid %u ver_major %u "
 636             "ver_minor %u max_xfersz %u\n",
 637             le32toh(msg.rm_type),
 638             le32toh(msg.rm_len),
 639             le32toh(msg.rm_rid),
 640             le32toh(msg.rm_ver_major),
 641             le32toh(msg.rm_ver_minor),
 642             le32toh(msg.rm_max_xfersz));
 643
 644         rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
 645
 646         if (rval != RNDIS_STATUS_SUCCESS) {
 647                 DPRINTF("init failed\n");
 648                 return (rval);
 649         }
 650         if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
 651                 DPRINTF("unable to get init response\n");
 652                 return (RNDIS_STATUS_FAILURE);
 653         }
 654         rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
 655
 656         return (rval);
 657 }
 658
 659 #if 0
 660 static uint32_t
 661 urndis_ctrl_halt(struct urndis_softc *sc)
 662 {
 663         struct urndis_halt_req msg;
 664         uint32_t rval;
 665
 666         msg.rm_type = htole32(REMOTE_NDIS_HALT_MSG);
 667         msg.rm_len = htole32(sizeof(msg));
 668         msg.rm_rid = 0;
 669
 670         DPRINTF("type %u len %u rid %u\n",
 671             le32toh(msg.rm_type),
 672             le32toh(msg.rm_len),
 673             le32toh(msg.rm_rid));
 674
 675         rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
 676
 677         if (rval != RNDIS_STATUS_SUCCESS)
 678                 printf("halt failed\n");
 679
 680         return (rval);
 681 }
 682
 683 #endif
 684
 685 static uint32_t
 686 urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid, const void **rbuf, uint16_t *rbufsz)
 687 {
 688         struct urndis_query_req msg;
 689         uint32_t rval;
 690         struct urndis_comp_hdr *hdr;
 691
 692         msg.rm_type = htole32(REMOTE_NDIS_QUERY_MSG);
 693         msg.rm_len = htole32(sizeof(msg));
 694         msg.rm_rid = 0;                 /* XXX */
 695         msg.rm_oid = htole32(oid);
 696         msg.rm_infobuflen = htole32(0);
 697         msg.rm_infobufoffset = 0;
 698         msg.rm_devicevchdl = 0;
 699
 700         DPRINTF("type %u len %u rid %u oid 0x%x "
 701             "infobuflen %u infobufoffset %u devicevchdl %u\n",
 702             le32toh(msg.rm_type),
 703             le32toh(msg.rm_len),
 704             le32toh(msg.rm_rid),
 705             le32toh(msg.rm_oid),
 706             le32toh(msg.rm_infobuflen),
 707             le32toh(msg.rm_infobufoffset),
 708             le32toh(msg.rm_devicevchdl));
 709
 710         rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
 711
 712         if (rval != RNDIS_STATUS_SUCCESS) {
 713                 DPRINTF("query failed\n");
 714                 return (rval);
 715         }
 716         if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
 717                 DPRINTF("unable to get query response\n");
 718                 return (RNDIS_STATUS_FAILURE);
 719         }
 720         rval = urndis_ctrl_handle(sc, hdr, rbuf, rbufsz);
 721
 722         return (rval);
 723 }
 724
 725 static uint32_t
 726 urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid, struct urndis_set_req *msg, uint16_t len)
 727 {
 728         struct urndis_comp_hdr *hdr;
 729         uint32_t rval;
 730         uint32_t datalen = len - sizeof(*msg);
 731
 732         msg->rm_type = htole32(REMOTE_NDIS_SET_MSG);
 733         msg->rm_len = htole32(len);
 734         msg->rm_rid = 0;                /* XXX */
 735         msg->rm_oid = htole32(oid);
 736         msg->rm_infobuflen = htole32(datalen);
 737         if (datalen != 0) {
 738                 msg->rm_infobufoffset = htole32(sizeof(*msg) - RNDIS_HEADER_OFFSET);
 739         } else {
 740                 msg->rm_infobufoffset = 0;
 741         }
 742         msg->rm_devicevchdl = 0;
 743
 744         DPRINTF("type %u len %u rid %u oid 0x%x "
 745             "infobuflen %u infobufoffset %u devicevchdl %u\n",
 746             le32toh(msg->rm_type),
 747             le32toh(msg->rm_len),
 748             le32toh(msg->rm_rid),
 749             le32toh(msg->rm_oid),
 750             le32toh(msg->rm_infobuflen),
 751             le32toh(msg->rm_infobufoffset),
 752             le32toh(msg->rm_devicevchdl));
 753
 754         rval = urndis_ctrl_send(sc, msg, len);
 755
 756         if (rval != RNDIS_STATUS_SUCCESS) {
 757                 DPRINTF("set failed\n");
 758                 return (rval);
 759         }
 760         if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
 761                 DPRINTF("unable to get set response\n");
 762                 return (RNDIS_STATUS_FAILURE);
 763         }
 764         rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
 765         if (rval != RNDIS_STATUS_SUCCESS)
 766                 DPRINTF("set failed 0x%x\n", rval);
 767
 768         return (rval);
 769 }
 770
 771 static void
 772 urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
 773 {
 774         struct urndis_softc *sc = usbd_xfer_softc(xfer);
 775         struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, 0);
 776         struct ifnet *ifp = uether_getifp(&sc->sc_ue);
 777         struct urndis_packet_msg msg;
 778         struct mbuf *m;
 779         int actlen;
 780         int aframes;
 781         int offset;
 782
 783         switch (USB_GET_STATE(xfer)) {
 784         case USB_ST_TRANSFERRED:
 785
 786                 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
 787
 788                 DPRINTFN(1, "received %u bytes in %u frames\n", actlen, aframes);
 789
 790                 for (offset = 0; actlen >= (uint32_t)sizeof(msg);) {
 791
 792                         /* copy out header */
 793                         usbd_copy_out(pc, offset, &msg, sizeof(msg));
 794
 795                         if (le32toh(0x1234567U) != 0x1234567U) {
 796                                 /* swap endianness */
 797                                 msg.rm_type = le32toh(msg.rm_type);
 798                                 msg.rm_len = le32toh(msg.rm_len);
 799                                 msg.rm_dataoffset = le32toh(msg.rm_dataoffset);
 800                                 msg.rm_datalen = le32toh(msg.rm_datalen);
 801                                 msg.rm_oobdataoffset = le32toh(msg.rm_oobdataoffset);
 802                                 msg.rm_oobdatalen = le32toh(msg.rm_oobdatalen);
 803                                 msg.rm_oobdataelements = le32toh(msg.rm_oobdataelements);
 804                                 msg.rm_pktinfooffset = le32toh(msg.rm_pktinfooffset);
 805                                 msg.rm_pktinfolen = le32toh(msg.rm_pktinfolen);
 806                                 msg.rm_vchandle = le32toh(msg.rm_vchandle);
 807                                 msg.rm_reserved = le32toh(msg.rm_reserved);
 808                         }
 809
 810                         DPRINTF("len %u data(off:%u len:%u) "
 811                             "oobdata(off:%u len:%u nb:%u) perpacket(off:%u len:%u)\n",
 812                             msg.rm_len, msg.rm_dataoffset, msg.rm_datalen,
 813                             msg.rm_oobdataoffset, msg.rm_oobdatalen,
 814                             msg.rm_oobdataelements, msg.rm_pktinfooffset,
 815                             msg.rm_pktinfooffset);
 816
 817                         /* sanity check the RNDIS header */
 818                         if (msg.rm_type != REMOTE_NDIS_PACKET_MSG) {
 819                                 DPRINTF("invalid type 0x%x != 0x%x\n",
 820                                     msg.rm_type, REMOTE_NDIS_PACKET_MSG);
 821                                 goto tr_setup;
 822                         } else if (msg.rm_len < (uint32_t)sizeof(msg)) {
 823                                 DPRINTF("invalid msg len %u < %u\n",
 824                                     msg.rm_len, (unsigned)sizeof(msg));
 825                                 goto tr_setup;
 826                         } else if (msg.rm_len > (uint32_t)actlen) {
 827                                 DPRINTF("invalid msg len %u > buffer "
 828                                     "len %u\n", msg.rm_len, actlen);
 829                                 goto tr_setup;
 830                         } else if (msg.rm_dataoffset >= (uint32_t)actlen) {
 831                                 DPRINTF("invalid msg dataoffset %u > buffer "
 832                                     "dataoffset %u\n", msg.rm_dataoffset, actlen);
 833                                 goto tr_setup;
 834                         } else if (msg.rm_datalen > (uint32_t)actlen) {
 835                                 DPRINTF("invalid msg datalen %u > buffer "
 836                                     "datalen %u\n", msg.rm_datalen, actlen);
 837                                 goto tr_setup;
 838                         } else if ((msg.rm_dataoffset + msg.rm_datalen +
 839                             (uint32_t)__offsetof(struct urndis_packet_msg,
 840                             rm_dataoffset)) > (uint32_t)actlen) {
 841                                 DPRINTF("invalid dataoffset %u larger than %u\n",
 842                                     msg.rm_dataoffset + msg.rm_datalen +
 843                                     (uint32_t)__offsetof(struct urndis_packet_msg,
 844                                     rm_dataoffset), actlen);
 845                                 goto tr_setup;
 846                         } else if (msg.rm_datalen < (uint32_t)sizeof(struct ether_header)) {
 847                                 ifp->if_ierrors++;
 848                                 DPRINTF("invalid ethernet size "
 849                                     "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header));
 850                                 goto tr_setup;
 851                         } else if (msg.rm_datalen > (uint32_t)MCLBYTES) {
 852                                 ifp->if_ierrors++;
 853                                 DPRINTF("invalid ethernet size "
 854                                     "%u > %u\n",
 855                                     msg.rm_datalen, (unsigned)MCLBYTES);
 856                                 goto tr_setup;
 857                         } else if (msg.rm_datalen > (uint32_t)(MHLEN - ETHER_ALIGN)) {
 858                                 m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
 859                         } else {
 860                                 m = m_gethdr(M_NOWAIT, MT_DATA);
 861                         }
 862
 863                         /* check if we have a buffer */
 864                         if (m != NULL) {
 865                                 m_adj(m, ETHER_ALIGN);
 866
 867                                 usbd_copy_out(pc, offset + msg.rm_dataoffset +
 868                                     __offsetof(struct urndis_packet_msg,
 869                                     rm_dataoffset), m->m_data, msg.rm_datalen);
 870
 871                                 /* enqueue */
 872                                 uether_rxmbuf(&sc->sc_ue, m, msg.rm_datalen);
 873                         } else {
 874                                 ifp->if_ierrors++;
 875                         }
 876                         offset += msg.rm_len;
 877                         actlen -= msg.rm_len;
 878                 }
 879
 880         case USB_ST_SETUP:
 881 tr_setup:
 882                 usbd_xfer_set_frame_len(xfer, 0, RNDIS_RX_MAXLEN);
 883                 usbd_xfer_set_frames(xfer, 1);
 884                 usbd_transfer_submit(xfer);
 885                 uether_rxflush(&sc->sc_ue);     /* must be last */
 886                 break;
 887
 888         default:                        /* Error */
 889                 DPRINTFN(1, "error = %s\n", usbd_errstr(error));
 890
 891                 if (error != USB_ERR_CANCELLED) {
 892                         /* try to clear stall first */
 893                         usbd_xfer_set_stall(xfer);
 894                         usbd_xfer_set_frames(xfer, 0);
 895                         usbd_transfer_submit(xfer);
 896                 }
 897                 break;
 898         }
 899 }
 900
 901 static void
 902 urndis_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
 903 {
 904         struct urndis_packet_msg msg;
 905         struct urndis_softc *sc = usbd_xfer_softc(xfer);
 906         struct ifnet *ifp = uether_getifp(&sc->sc_ue);
 907         struct mbuf *m;
 908         unsigned x;
 909         int actlen;
 910         int aframes;
 911
 912         usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
 913
 914         DPRINTFN(1, "\n");
 915
 916         switch (USB_GET_STATE(xfer)) {
 917         case USB_ST_TRANSFERRED:
 918                 DPRINTFN(11, "%u bytes in %u frames\n", actlen, aframes);
 919
 920                 ifp->if_opackets++;
 921
 922                 /* FALLTHROUGH */
 923         case USB_ST_SETUP:
 924 tr_setup:
 925                 memset(&msg, 0, sizeof(msg));
 926
 927                 for (x = 0; x != RNDIS_TX_FRAMES_MAX; x++) {
 928                         struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, x);
 929
 930                         usbd_xfer_set_frame_offset(xfer, x * RNDIS_TX_MAXLEN, x);
 931
 932         next_pkt:
 933                         IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
 934
 935                         if (m == NULL)
 936                                 break;
 937
 938                         if ((m->m_pkthdr.len + sizeof(msg)) > RNDIS_TX_MAXLEN) {
 939                                 DPRINTF("Too big packet\n");
 940                                 ifp->if_oerrors++;
 941
 942                                 /* Free buffer */
 943                                 m_freem(m);
 944                                 goto next_pkt;
 945                         }
 946                         msg.rm_type = htole32(REMOTE_NDIS_PACKET_MSG);
 947                         msg.rm_len = htole32(sizeof(msg) + m->m_pkthdr.len);
 948
 949                         msg.rm_dataoffset = htole32(RNDIS_DATA_OFFSET);
 950                         msg.rm_datalen = htole32(m->m_pkthdr.len);
 951
 952                         /* copy in all data */
 953                         usbd_copy_in(pc, 0, &msg, sizeof(msg));
 954                         usbd_m_copy_in(pc, sizeof(msg), m, 0, m->m_pkthdr.len);
 955                         usbd_xfer_set_frame_len(xfer, x, sizeof(msg) + m->m_pkthdr.len);
 956
 957                         /*
 958                          * If there's a BPF listener, bounce a copy of
 959                          * this frame to him:
 960                          */
 961                         BPF_MTAP(ifp, m);
 962
 963                         /* Free buffer */
 964                         m_freem(m);
 965                 }
 966                 if (x != 0) {
 967                         usbd_xfer_set_frames(xfer, x);
 968                         usbd_transfer_submit(xfer);
 969                 }
 970                 break;
 971
 972         default:                        /* Error */
 973                 DPRINTFN(11, "transfer error, %s\n", usbd_errstr(error));
 974
 975                 /* count output errors */
 976                 ifp->if_oerrors++;
 977
 978                 if (error != USB_ERR_CANCELLED) {
 979                         /* try to clear stall first */
 980                         usbd_xfer_set_stall(xfer);
 981                         goto tr_setup;
 982                 }
 983                 break;
 984         }
 985 }
 986
 987 static void
 988 urndis_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
 989 {
 990         int actlen;
 991
 992         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
 993
 994         switch (USB_GET_STATE(xfer)) {
 995         case USB_ST_TRANSFERRED:
 996
 997                 DPRINTF("Received %d bytes\n", actlen);
 998
 999                 /* TODO: decode some indications */
1000
1001                 /* FALLTHROUGH */
1002         case USB_ST_SETUP:
1003 tr_setup:
1004                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1005                 usbd_transfer_submit(xfer);
1006                 break;
1007
1008         default:                        /* Error */
1009                 if (error != USB_ERR_CANCELLED) {
1010                         /* start clear stall */
1011                         usbd_xfer_set_stall(xfer);
1012                         goto tr_setup;
1013                 }
1014                 break;
1015         }
1016 }