sys/dev/usb/net/if_urndis.c

   1 /*      $OpenBSD: if_urndis.c,v 1.46 2013/12/09 15:45:29 pirofti Exp $ */
   2
   3 /*
   4  * Copyright (c) 2010 Jonathan Armani <armani@openbsd.org>
   5  * Copyright (c) 2010 Fabien Romano <fabien@openbsd.org>
   6  * Copyright (c) 2010 Michael Knudsen <mk@openbsd.org>
   7  * Copyright (c) 2014 Hans Petter Selasky <hselasky@freebsd.org>
   8  * All rights reserved.
   9  *
  10  * Permission to use, copy, modify, and distribute this software for any
  11  * purpose with or without fee is hereby granted, provided that the above
  12  * copyright notice and this permission notice appear in all copies.
  13  *
  14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  21  */
  22
  23 #include <sys/cdefs.h>
  24 __FBSDID("$FreeBSD$");
  25
  26 #include <sys/stdint.h>
  27 #include <sys/stddef.h>
  28 #include <sys/param.h>
  29 #include <sys/queue.h>
  30 #include <sys/types.h>
  31 #include <sys/systm.h>
  32 #include <sys/socket.h>
  33 #include <sys/kernel.h>
  34 #include <sys/bus.h>
  35 #include <sys/module.h>
  36 #include <sys/lock.h>
  37 #include <sys/mutex.h>
  38 #include <sys/condvar.h>
  39 #include <sys/sysctl.h>
  40 #include <sys/sx.h>
  41 #include <sys/unistd.h>
  42 #include <sys/callout.h>
  43 #include <sys/malloc.h>
  44 #include <sys/priv.h>
  45
  46 #include <net/if.h>
  47 #include <net/if_var.h>
  48
  49 #include <dev/usb/usb.h>
  50 #include <dev/usb/usbdi.h>
  51 #include <dev/usb/usbdi_util.h>
  52 #include "usbdevs.h"
  53
  54 #define USB_DEBUG_VAR urndis_debug
  55 #include <dev/usb/usb_debug.h>
  56 #include <dev/usb/usb_process.h>
  57 #include "usb_if.h"
  58
  59 #include <dev/usb/net/usb_ethernet.h>
  60 #include <dev/usb/net/if_urndisreg.h>
  61
  62 #include <dev/usb/usb_cdc.h>
  63
  64 static device_probe_t urndis_probe;
  65 static device_attach_t urndis_attach;
  66 static device_detach_t urndis_detach;
  67 static device_suspend_t urndis_suspend;
  68 static device_resume_t urndis_resume;
  69
  70 static usb_callback_t urndis_bulk_write_callback;
  71 static usb_callback_t urndis_bulk_read_callback;
  72 static usb_callback_t urndis_intr_read_callback;
  73
  74 static uether_fn_t urndis_attach_post;
  75 static uether_fn_t urndis_init;
  76 static uether_fn_t urndis_stop;
  77 static uether_fn_t urndis_start;
  78 static uether_fn_t urndis_setmulti;
  79 static uether_fn_t urndis_setpromisc;
  80
  81 static uint32_t urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid,
  82                     struct urndis_query_req *msg, uint16_t len,
  83                     const void **rbuf, uint16_t *rbufsz);
  84 static uint32_t urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid,
  85                     struct urndis_set_req *msg, uint16_t len);
  86 static uint32_t urndis_ctrl_handle_init(struct urndis_softc *sc,
  87                     const struct urndis_comp_hdr *hdr);
  88 static uint32_t urndis_ctrl_handle_query(struct urndis_softc *sc,
  89                     const struct urndis_comp_hdr *hdr, const void **buf,
  90                     uint16_t *bufsz);
  91 static uint32_t urndis_ctrl_handle_reset(struct urndis_softc *sc,
  92                     const struct urndis_comp_hdr *hdr);
  93 static uint32_t urndis_ctrl_init(struct urndis_softc *sc);
  94 static uint32_t urndis_ctrl_halt(struct urndis_softc *sc);
  95
  96 #ifdef USB_DEBUG
  97 static int urndis_debug = 0;
  98 static  SYSCTL_NODE(_hw_usb, OID_AUTO, urndis, CTLFLAG_RW, 0, "USB RNDIS-Ethernet");
  99 SYSCTL_INT(_hw_usb_urndis, OID_AUTO, debug, CTLFLAG_RW, &urndis_debug, 0,
 100     "Debug level");
 101 #endif
 102
 103 static const struct usb_config urndis_config[URNDIS_N_TRANSFER] = {
 104         [URNDIS_BULK_RX] = {
 105                 .type = UE_BULK,
 106                 .endpoint = UE_ADDR_ANY,
 107                 .direction = UE_DIR_RX,
 108                 .if_index = 0,
 109                 .frames = 1,
 110                 .bufsize = RNDIS_RX_MAXLEN,
 111                 .flags = {.short_xfer_ok = 1,},
 112                 .callback = urndis_bulk_read_callback,
 113                 .timeout = 0,           /* no timeout */
 114                 .usb_mode = USB_MODE_HOST,
 115         },
 116
 117         [URNDIS_BULK_TX] = {
 118                 .type = UE_BULK,
 119                 .endpoint = UE_ADDR_ANY,
 120                 .direction = UE_DIR_TX,
 121                 .if_index = 0,
 122                 .frames = RNDIS_TX_FRAMES_MAX,
 123                 .bufsize = (RNDIS_TX_FRAMES_MAX * RNDIS_TX_MAXLEN),
 124                 .flags = {
 125                         .force_short_xfer = 1,
 126                 },
 127                 .callback = urndis_bulk_write_callback,
 128                 .timeout = 10000,       /* 10 seconds */
 129                 .usb_mode = USB_MODE_HOST,
 130         },
 131
 132         [URNDIS_INTR_RX] = {
 133                 .type = UE_INTERRUPT,
 134                 .endpoint = UE_ADDR_ANY,
 135                 .direction = UE_DIR_RX,
 136                 .if_index = 1,
 137                 .bufsize = 0,   /* use wMaxPacketSize */
 138                 .flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
 139                 .callback = urndis_intr_read_callback,
 140                 .timeout = 0,
 141                 .usb_mode = USB_MODE_HOST,
 142         },
 143 };
 144
 145 static device_method_t urndis_methods[] = {
 146         /* Device interface */
 147         DEVMETHOD(device_probe, urndis_probe),
 148         DEVMETHOD(device_attach, urndis_attach),
 149         DEVMETHOD(device_detach, urndis_detach),
 150         DEVMETHOD(device_suspend, urndis_suspend),
 151         DEVMETHOD(device_resume, urndis_resume),
 152
 153         DEVMETHOD_END
 154 };
 155
 156 static driver_t urndis_driver = {
 157         .name = "urndis",
 158         .methods = urndis_methods,
 159         .size = sizeof(struct urndis_softc),
 160 };
 161
 162 static devclass_t urndis_devclass;
 163
 164 DRIVER_MODULE(urndis, uhub, urndis_driver, urndis_devclass, NULL, NULL);
 165 MODULE_VERSION(urndis, 1);
 166 MODULE_DEPEND(urndis, uether, 1, 1, 1);
 167 MODULE_DEPEND(urndis, usb, 1, 1, 1);
 168 MODULE_DEPEND(urndis, ether, 1, 1, 1);
 169
 170 static const struct usb_ether_methods urndis_ue_methods = {
 171         .ue_attach_post = urndis_attach_post,
 172         .ue_start = urndis_start,
 173         .ue_init = urndis_init,
 174         .ue_stop = urndis_stop,
 175         .ue_setmulti = urndis_setmulti,
 176         .ue_setpromisc = urndis_setpromisc,
 177 };
 178
 179 static const STRUCT_USB_HOST_ID urndis_host_devs[] = {
 180         /* Generic RNDIS class match */
 181         {USB_IFACE_CLASS(UICLASS_CDC),
 182                 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL),
 183                 USB_IFACE_PROTOCOL(0xff)},
 184         {USB_IFACE_CLASS(UICLASS_WIRELESS), USB_IFACE_SUBCLASS(UISUBCLASS_RF),
 185                 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)},
 186         {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(UISUBCLASS_SYNC),
 187                 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)},
 188         /* HP-WebOS */
 189         {USB_VENDOR(USB_VENDOR_PALM), USB_IFACE_CLASS(UICLASS_CDC),
 190                 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL),
 191                 USB_IFACE_PROTOCOL(0xff)},
 192 };
 193
 194 static int
 195 urndis_probe(device_t dev)
 196 {
 197         struct usb_attach_arg *uaa = device_get_ivars(dev);
 198
 199         return (usbd_lookup_id_by_uaa(urndis_host_devs, sizeof(urndis_host_devs), uaa));
 200 }
 201
 202 static void
 203 urndis_attach_post(struct usb_ether *ue)
 204 {
 205
 206         /* no-op */
 207 }
 208
 209 static int
 210 urndis_attach(device_t dev)
 211 {
 212         static struct {
 213                 union {
 214                         struct urndis_query_req query;
 215                         struct urndis_set_req set;
 216                 } hdr;
 217                 union {
 218                         uint8_t eaddr[ETHER_ADDR_LEN];
 219                         uint32_t filter;
 220                 } ibuf;
 221         } msg;
 222         struct urndis_softc *sc = device_get_softc(dev);
 223         struct usb_ether *ue = &sc->sc_ue;
 224         struct usb_attach_arg *uaa = device_get_ivars(dev);
 225         struct usb_cdc_cm_descriptor *cmd;
 226         const void *buf;
 227         uint16_t bufsz;
 228         uint8_t iface_index[2] = { uaa->info.bIfaceIndex + 1, uaa->info.bIfaceIndex };
 229         int error;
 230         uint8_t i;
 231
 232         sc->sc_ue.ue_udev = uaa->device;
 233         sc->sc_ifaceno_ctl = uaa->info.bIfaceNum;
 234
 235         cmd = usbd_find_descriptor(uaa->device, NULL, uaa->info.bIfaceIndex,
 236             UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_CM, 0xFF);
 237         if (cmd != 0) {
 238                 DPRINTF("Call Mode Descriptor found, dataif=%d\n", cmd->bDataInterface);
 239                 iface_index[0] = cmd->bDataInterface;
 240         }
 241
 242         device_set_usb_desc(dev);
 243
 244         mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF);
 245
 246         /* scan the alternate settings looking for a valid one */
 247         for (i = 0; i != 32; i++) {
 248                 error = usbd_set_alt_interface_index(uaa->device,
 249                     iface_index[0], i);
 250
 251                 if (error != 0)
 252                         break;
 253
 254                 error = usbd_transfer_setup(uaa->device,
 255                     iface_index, sc->sc_xfer, urndis_config,
 256                     URNDIS_N_TRANSFER, sc, &sc->sc_mtx);
 257
 258                 if (error == 0)
 259                         break;
 260         }
 261         if ((error != 0) || (i == 32)) {
 262                 device_printf(dev, "No valid alternate setting found\n");
 263                 goto detach;
 264         }
 265
 266         /* Initialize device - must be done before even querying it */
 267         URNDIS_LOCK(sc);
 268         error = urndis_ctrl_init(sc);
 269         URNDIS_UNLOCK(sc);
 270         if (error != (int)RNDIS_STATUS_SUCCESS) {
 271                 device_printf(dev, "Unable to initialize hardware\n");
 272                 goto detach;
 273         }
 274
 275         /* Determine MAC address */
 276         memset(msg.ibuf.eaddr, 0, sizeof(msg.ibuf.eaddr));
 277         URNDIS_LOCK(sc);
 278         error = urndis_ctrl_query(sc, OID_802_3_PERMANENT_ADDRESS,
 279             &msg.hdr.query, sizeof(msg.hdr.query) + sizeof(msg.ibuf.eaddr),
 280             &buf, &bufsz);
 281         URNDIS_UNLOCK(sc);
 282         if (error != (int)RNDIS_STATUS_SUCCESS) {
 283                 device_printf(dev, "Unable to get hardware address\n");
 284                 goto detach;
 285         }
 286         if (bufsz != ETHER_ADDR_LEN) {
 287                 device_printf(dev, "Invalid address length: %d bytes\n", bufsz);
 288                 goto detach;
 289         }
 290         memcpy(&sc->sc_ue.ue_eaddr, buf, ETHER_ADDR_LEN);
 291
 292         /* Initialize packet filter */
 293         sc->sc_filter = RNDIS_PACKET_TYPE_BROADCAST |
 294             RNDIS_PACKET_TYPE_ALL_MULTICAST;
 295         msg.ibuf.filter = htole32(sc->sc_filter);
 296         URNDIS_LOCK(sc);
 297         error = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
 298             &msg.hdr.set, sizeof(msg.hdr.set) + sizeof(msg.ibuf.filter));
 299         URNDIS_UNLOCK(sc);
 300         if (error != (int)RNDIS_STATUS_SUCCESS) {
 301                 device_printf(dev, "Unable to set data filters\n");
 302                 goto detach;
 303         }
 304
 305         ue->ue_sc = sc;
 306         ue->ue_dev = dev;
 307         ue->ue_udev = uaa->device;
 308         ue->ue_mtx = &sc->sc_mtx;
 309         ue->ue_methods = &urndis_ue_methods;
 310
 311         error = uether_ifattach(ue);
 312         if (error) {
 313                 device_printf(dev, "Could not attach interface\n");
 314                 goto detach;
 315         }
 316
 317         URNDIS_LOCK(sc);
 318         /* start interrupt endpoint, if any */
 319         usbd_transfer_start(sc->sc_xfer[URNDIS_INTR_RX]);
 320         URNDIS_UNLOCK(sc);
 321
 322         return (0);                     /* success */
 323
 324 detach:
 325         (void)urndis_detach(dev);
 326         return (ENXIO);                 /* failure */
 327 }
 328
 329 static int
 330 urndis_detach(device_t dev)
 331 {
 332         struct urndis_softc *sc = device_get_softc(dev);
 333         struct usb_ether *ue = &sc->sc_ue;
 334
 335         /* stop all USB transfers first */
 336         usbd_transfer_unsetup(sc->sc_xfer, URNDIS_N_TRANSFER);
 337
 338         uether_ifdetach(ue);
 339
 340         URNDIS_LOCK(sc);
 341         (void)urndis_ctrl_halt(sc);
 342         URNDIS_UNLOCK(sc);
 343
 344         mtx_destroy(&sc->sc_mtx);
 345
 346         return (0);
 347 }
 348
 349 static void
 350 urndis_start(struct usb_ether *ue)
 351 {
 352         struct urndis_softc *sc = uether_getsc(ue);
 353
 354         /*
 355          * Start the USB transfers, if not already started:
 356          */
 357         usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_TX]);
 358         usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_RX]);
 359 }
 360
 361 static void
 362 urndis_init(struct usb_ether *ue)
 363 {
 364         struct urndis_softc *sc = uether_getsc(ue);
 365         struct ifnet *ifp = uether_getifp(ue);
 366
 367         URNDIS_LOCK_ASSERT(sc, MA_OWNED);
 368
 369         ifp->if_drv_flags |= IFF_DRV_RUNNING;
 370
 371         /* stall data write direction, which depends on USB mode */
 372         usbd_xfer_set_stall(sc->sc_xfer[URNDIS_BULK_TX]);
 373
 374         /* start data transfers */
 375         urndis_start(ue);
 376 }
 377
 378 static void
 379 urndis_stop(struct usb_ether *ue)
 380 {
 381         struct urndis_softc *sc = uether_getsc(ue);
 382         struct ifnet *ifp = uether_getifp(ue);
 383
 384         URNDIS_LOCK_ASSERT(sc, MA_OWNED);
 385
 386         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
 387
 388         /*
 389          * stop all the transfers, if not already stopped:
 390          */
 391         usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_RX]);
 392         usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_TX]);
 393 }
 394
 395 static void
 396 urndis_setmulti(struct usb_ether *ue)
 397 {
 398
 399         /* no-op */
 400 }
 401
 402 static void
 403 urndis_setpromisc(struct usb_ether *ue)
 404 {
 405
 406         /* no-op */
 407 }
 408
 409 static int
 410 urndis_suspend(device_t dev)
 411 {
 412
 413         device_printf(dev, "Suspending\n");
 414         return (0);
 415 }
 416
 417 static int
 418 urndis_resume(device_t dev)
 419 {
 420
 421         device_printf(dev, "Resuming\n");
 422         return (0);
 423 }
 424
 425 static usb_error_t
 426 urndis_ctrl_msg(struct urndis_softc *sc, uint8_t rt, uint8_t r,
 427     uint16_t index, uint16_t value, void *buf, uint16_t buflen)
 428 {
 429         usb_device_request_t req;
 430
 431         req.bmRequestType = rt;
 432         req.bRequest = r;
 433         USETW(req.wValue, value);
 434         USETW(req.wIndex, index);
 435         USETW(req.wLength, buflen);
 436
 437         return (usbd_do_request_flags(sc->sc_ue.ue_udev,
 438             &sc->sc_mtx, &req, buf, (rt & UT_READ) ?
 439             USB_SHORT_XFER_OK : 0, NULL, 2000 /* ms */ ));
 440 }
 441
 442 static usb_error_t
 443 urndis_ctrl_send(struct urndis_softc *sc, void *buf, uint16_t len)
 444 {
 445         usb_error_t err;
 446
 447         err = urndis_ctrl_msg(sc, UT_WRITE_CLASS_INTERFACE,
 448             UCDC_SEND_ENCAPSULATED_COMMAND, sc->sc_ifaceno_ctl, 0, buf, len);
 449
 450         DPRINTF("%s\n", usbd_errstr(err));
 451
 452         return (err);
 453 }
 454
 455 static struct urndis_comp_hdr *
 456 urndis_ctrl_recv(struct urndis_softc *sc)
 457 {
 458         struct urndis_comp_hdr *hdr;
 459         usb_error_t err;
 460
 461         err = urndis_ctrl_msg(sc, UT_READ_CLASS_INTERFACE,
 462             UCDC_GET_ENCAPSULATED_RESPONSE, sc->sc_ifaceno_ctl, 0,
 463             sc->sc_response_buf, RNDIS_RESPONSE_LEN);
 464
 465         if (err != USB_ERR_NORMAL_COMPLETION)
 466                 return (NULL);
 467
 468         hdr = (struct urndis_comp_hdr *)sc->sc_response_buf;
 469
 470         DPRINTF("type 0x%x len %u\n", le32toh(hdr->rm_type),
 471             le32toh(hdr->rm_len));
 472
 473         if (le32toh(hdr->rm_len) > RNDIS_RESPONSE_LEN) {
 474                 DPRINTF("ctrl message error: wrong size %u > %u\n",
 475                     le32toh(hdr->rm_len), RNDIS_RESPONSE_LEN);
 476                 return (NULL);
 477         }
 478         return (hdr);
 479 }
 480
 481 static uint32_t
 482 urndis_ctrl_handle(struct urndis_softc *sc, struct urndis_comp_hdr *hdr,
 483     const void **buf, uint16_t *bufsz)
 484 {
 485         uint32_t rval;
 486
 487         DPRINTF("\n");
 488
 489         if (buf != NULL && bufsz != NULL) {
 490                 *buf = NULL;
 491                 *bufsz = 0;
 492         }
 493         switch (le32toh(hdr->rm_type)) {
 494         case REMOTE_NDIS_INITIALIZE_CMPLT:
 495                 rval = urndis_ctrl_handle_init(sc, hdr);
 496                 break;
 497
 498         case REMOTE_NDIS_QUERY_CMPLT:
 499                 rval = urndis_ctrl_handle_query(sc, hdr, buf, bufsz);
 500                 break;
 501
 502         case REMOTE_NDIS_RESET_CMPLT:
 503                 rval = urndis_ctrl_handle_reset(sc, hdr);
 504                 break;
 505
 506         case REMOTE_NDIS_KEEPALIVE_CMPLT:
 507         case REMOTE_NDIS_SET_CMPLT:
 508                 rval = le32toh(hdr->rm_status);
 509                 break;
 510
 511         default:
 512                 device_printf(sc->sc_ue.ue_dev,
 513                     "ctrl message error: unknown event 0x%x\n",
 514                     le32toh(hdr->rm_type));
 515                 rval = RNDIS_STATUS_FAILURE;
 516                 break;
 517         }
 518         return (rval);
 519 }
 520
 521 static uint32_t
 522 urndis_ctrl_handle_init(struct urndis_softc *sc,
 523     const struct urndis_comp_hdr *hdr)
 524 {
 525         const struct urndis_init_comp *msg;
 526
 527         msg = (const struct urndis_init_comp *)hdr;
 528
 529         DPRINTF("len %u rid %u status 0x%x "
 530             "ver_major %u ver_minor %u devflags 0x%x medium 0x%x pktmaxcnt %u "
 531             "pktmaxsz %u align %u aflistoffset %u aflistsz %u\n",
 532             le32toh(msg->rm_len),
 533             le32toh(msg->rm_rid),
 534             le32toh(msg->rm_status),
 535             le32toh(msg->rm_ver_major),
 536             le32toh(msg->rm_ver_minor),
 537             le32toh(msg->rm_devflags),
 538             le32toh(msg->rm_medium),
 539             le32toh(msg->rm_pktmaxcnt),
 540             le32toh(msg->rm_pktmaxsz),
 541             le32toh(msg->rm_align),
 542             le32toh(msg->rm_aflistoffset),
 543             le32toh(msg->rm_aflistsz));
 544
 545         if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
 546                 DPRINTF("init failed 0x%x\n", le32toh(msg->rm_status));
 547                 return (le32toh(msg->rm_status));
 548         }
 549         if (le32toh(msg->rm_devflags) != RNDIS_DF_CONNECTIONLESS) {
 550                 DPRINTF("wrong device type (current type: 0x%x)\n",
 551                     le32toh(msg->rm_devflags));
 552                 return (RNDIS_STATUS_FAILURE);
 553         }
 554         if (le32toh(msg->rm_medium) != RNDIS_MEDIUM_802_3) {
 555                 DPRINTF("medium not 802.3 (current medium: 0x%x)\n",
 556                     le32toh(msg->rm_medium));
 557                 return (RNDIS_STATUS_FAILURE);
 558         }
 559         sc->sc_lim_pktsz = le32toh(msg->rm_pktmaxsz);
 560
 561         return (le32toh(msg->rm_status));
 562 }
 563
 564 static uint32_t
 565 urndis_ctrl_handle_query(struct urndis_softc *sc,
 566     const struct urndis_comp_hdr *hdr, const void **buf, uint16_t *bufsz)
 567 {
 568         const struct urndis_query_comp *msg;
 569         uint64_t limit;
 570
 571         msg = (const struct urndis_query_comp *)hdr;
 572
 573         DPRINTF("len %u rid %u status 0x%x "
 574             "buflen %u bufoff %u\n",
 575             le32toh(msg->rm_len),
 576             le32toh(msg->rm_rid),
 577             le32toh(msg->rm_status),
 578             le32toh(msg->rm_infobuflen),
 579             le32toh(msg->rm_infobufoffset));
 580
 581         *buf = NULL;
 582         *bufsz = 0;
 583         if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
 584                 DPRINTF("query failed 0x%x\n", le32toh(msg->rm_status));
 585                 return (le32toh(msg->rm_status));
 586         }
 587         limit = le32toh(msg->rm_infobuflen);
 588         limit += le32toh(msg->rm_infobufoffset);
 589         limit += RNDIS_HEADER_OFFSET;
 590
 591         if (limit > (uint64_t)le32toh(msg->rm_len)) {
 592                 DPRINTF("ctrl message error: invalid query info "
 593                     "len/offset/end_position(%u/%u/%u) -> "
 594                     "go out of buffer limit %u\n",
 595                     le32toh(msg->rm_infobuflen),
 596                     le32toh(msg->rm_infobufoffset),
 597                     le32toh(msg->rm_infobuflen) +
 598                     le32toh(msg->rm_infobufoffset) + RNDIS_HEADER_OFFSET,
 599                     le32toh(msg->rm_len));
 600                 return (RNDIS_STATUS_FAILURE);
 601         }
 602         *buf = ((const uint8_t *)msg) + RNDIS_HEADER_OFFSET +
 603             le32toh(msg->rm_infobufoffset);
 604         *bufsz = le32toh(msg->rm_infobuflen);
 605
 606         return (le32toh(msg->rm_status));
 607 }
 608
 609 static uint32_t
 610 urndis_ctrl_handle_reset(struct urndis_softc *sc,
 611     const struct urndis_comp_hdr *hdr)
 612 {
 613         const struct urndis_reset_comp *msg;
 614         uint32_t rval;
 615
 616         msg = (const struct urndis_reset_comp *)hdr;
 617
 618         rval = le32toh(msg->rm_status);
 619
 620         DPRINTF("len %u status 0x%x "
 621             "adrreset %u\n",
 622             le32toh(msg->rm_len),
 623             rval,
 624             le32toh(msg->rm_adrreset));
 625
 626         if (rval != RNDIS_STATUS_SUCCESS) {
 627                 DPRINTF("reset failed 0x%x\n", rval);
 628                 return (rval);
 629         }
 630         if (msg->rm_adrreset != 0) {
 631                 struct {
 632                         struct urndis_set_req hdr;
 633                         uint32_t filter;
 634                 } msg_filter;
 635
 636                 msg_filter.filter = htole32(sc->sc_filter);
 637
 638                 rval = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
 639                     &msg_filter.hdr, sizeof(msg_filter));
 640
 641                 if (rval != RNDIS_STATUS_SUCCESS) {
 642                         DPRINTF("unable to reset data filters\n");
 643                         return (rval);
 644                 }
 645         }
 646         return (rval);
 647 }
 648
 649 static uint32_t
 650 urndis_ctrl_init(struct urndis_softc *sc)
 651 {
 652         struct urndis_init_req msg;
 653         struct urndis_comp_hdr *hdr;
 654         uint32_t rval;
 655
 656         msg.rm_type = htole32(REMOTE_NDIS_INITIALIZE_MSG);
 657         msg.rm_len = htole32(sizeof(msg));
 658         msg.rm_rid = 0;
 659         msg.rm_ver_major = htole32(1);
 660         msg.rm_ver_minor = htole32(1);
 661         msg.rm_max_xfersz = htole32(RNDIS_RX_MAXLEN);
 662
 663         DPRINTF("type %u len %u rid %u ver_major %u "
 664             "ver_minor %u max_xfersz %u\n",
 665             le32toh(msg.rm_type),
 666             le32toh(msg.rm_len),
 667             le32toh(msg.rm_rid),
 668             le32toh(msg.rm_ver_major),
 669             le32toh(msg.rm_ver_minor),
 670             le32toh(msg.rm_max_xfersz));
 671
 672         rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
 673
 674         if (rval != RNDIS_STATUS_SUCCESS) {
 675                 DPRINTF("init failed\n");
 676                 return (rval);
 677         }
 678         if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
 679                 DPRINTF("unable to get init response\n");
 680                 return (RNDIS_STATUS_FAILURE);
 681         }
 682         rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
 683
 684         return (rval);
 685 }
 686
 687 static uint32_t
 688 urndis_ctrl_halt(struct urndis_softc *sc)
 689 {
 690         struct urndis_halt_req msg;
 691         uint32_t rval;
 692
 693         msg.rm_type = htole32(REMOTE_NDIS_HALT_MSG);
 694         msg.rm_len = htole32(sizeof(msg));
 695         msg.rm_rid = 0;
 696
 697         DPRINTF("type %u len %u rid %u\n",
 698             le32toh(msg.rm_type),
 699             le32toh(msg.rm_len),
 700             le32toh(msg.rm_rid));
 701
 702         rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
 703
 704         if (rval != RNDIS_STATUS_SUCCESS)
 705                 DPRINTF("halt failed\n");
 706
 707         return (rval);
 708 }
 709
 710 /*
 711  * NB: Querying a device has the requirment of using an input buffer the size
 712  *     of the expected reply or larger, except for variably sized replies.
 713  */
 714 static uint32_t
 715 urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid,
 716     struct urndis_query_req *msg, uint16_t len, const void **rbuf,
 717     uint16_t *rbufsz)
 718 {
 719         struct urndis_comp_hdr *hdr;
 720         uint32_t datalen, rval;
 721
 722         msg->rm_type = htole32(REMOTE_NDIS_QUERY_MSG);
 723         msg->rm_len = htole32(len);
 724         msg->rm_rid = 0;                /* XXX */
 725         msg->rm_oid = htole32(oid);
 726         datalen = len - sizeof(*msg);
 727         msg->rm_infobuflen = htole32(datalen);
 728         if (datalen != 0) {
 729                 msg->rm_infobufoffset = htole32(sizeof(*msg) -
 730                     RNDIS_HEADER_OFFSET);
 731         } else {
 732                 msg->rm_infobufoffset = 0;
 733         }
 734         msg->rm_devicevchdl = 0;
 735
 736         DPRINTF("type %u len %u rid %u oid 0x%x "
 737             "infobuflen %u infobufoffset %u devicevchdl %u\n",
 738             le32toh(msg->rm_type),
 739             le32toh(msg->rm_len),
 740             le32toh(msg->rm_rid),
 741             le32toh(msg->rm_oid),
 742             le32toh(msg->rm_infobuflen),
 743             le32toh(msg->rm_infobufoffset),
 744             le32toh(msg->rm_devicevchdl));
 745
 746         rval = urndis_ctrl_send(sc, msg, len);
 747
 748         if (rval != RNDIS_STATUS_SUCCESS) {
 749                 DPRINTF("query failed\n");
 750                 return (rval);
 751         }
 752         if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
 753                 DPRINTF("unable to get query response\n");
 754                 return (RNDIS_STATUS_FAILURE);
 755         }
 756         rval = urndis_ctrl_handle(sc, hdr, rbuf, rbufsz);
 757
 758         return (rval);
 759 }
 760
 761 static uint32_t
 762 urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid,
 763     struct urndis_set_req *msg, uint16_t len)
 764 {
 765         struct urndis_comp_hdr *hdr;
 766         uint32_t datalen, rval;
 767
 768         msg->rm_type = htole32(REMOTE_NDIS_SET_MSG);
 769         msg->rm_len = htole32(len);
 770         msg->rm_rid = 0;                /* XXX */
 771         msg->rm_oid = htole32(oid);
 772         datalen = len - sizeof(*msg);
 773         msg->rm_infobuflen = htole32(datalen);
 774         if (datalen != 0) {
 775                 msg->rm_infobufoffset = htole32(sizeof(*msg) -
 776                     RNDIS_HEADER_OFFSET);
 777         } else {
 778                 msg->rm_infobufoffset = 0;
 779         }
 780         msg->rm_devicevchdl = 0;
 781
 782         DPRINTF("type %u len %u rid %u oid 0x%x "
 783             "infobuflen %u infobufoffset %u devicevchdl %u\n",
 784             le32toh(msg->rm_type),
 785             le32toh(msg->rm_len),
 786             le32toh(msg->rm_rid),
 787             le32toh(msg->rm_oid),
 788             le32toh(msg->rm_infobuflen),
 789             le32toh(msg->rm_infobufoffset),
 790             le32toh(msg->rm_devicevchdl));
 791
 792         rval = urndis_ctrl_send(sc, msg, len);
 793
 794         if (rval != RNDIS_STATUS_SUCCESS) {
 795                 DPRINTF("set failed\n");
 796                 return (rval);
 797         }
 798         if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
 799                 DPRINTF("unable to get set response\n");
 800                 return (RNDIS_STATUS_FAILURE);
 801         }
 802         rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
 803         if (rval != RNDIS_STATUS_SUCCESS)
 804                 DPRINTF("set failed 0x%x\n", rval);
 805
 806         return (rval);
 807 }
 808
 809 static void
 810 urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
 811 {
 812         struct urndis_softc *sc = usbd_xfer_softc(xfer);
 813         struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, 0);
 814         struct ifnet *ifp = uether_getifp(&sc->sc_ue);
 815         struct urndis_packet_msg msg;
 816         struct mbuf *m;
 817         int actlen;
 818         int aframes;
 819         int offset;
 820
 821         switch (USB_GET_STATE(xfer)) {
 822         case USB_ST_TRANSFERRED:
 823                 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
 824
 825                 DPRINTFN(1, "received %u bytes in %u frames\n", actlen, aframes);
 826
 827                 for (offset = 0; actlen >= (uint32_t)sizeof(msg);) {
 828                         /* copy out header */
 829                         usbd_copy_out(pc, offset, &msg, sizeof(msg));
 830
 831                         if (le32toh(0x1234567U) != 0x1234567U) {
 832                                 /* swap endianness */
 833                                 msg.rm_type = le32toh(msg.rm_type);
 834                                 msg.rm_len = le32toh(msg.rm_len);
 835                                 msg.rm_dataoffset = le32toh(msg.rm_dataoffset);
 836                                 msg.rm_datalen = le32toh(msg.rm_datalen);
 837                                 msg.rm_oobdataoffset = le32toh(msg.rm_oobdataoffset);
 838                                 msg.rm_oobdatalen = le32toh(msg.rm_oobdatalen);
 839                                 msg.rm_oobdataelements = le32toh(msg.rm_oobdataelements);
 840                                 msg.rm_pktinfooffset = le32toh(msg.rm_pktinfooffset);
 841                                 msg.rm_pktinfolen = le32toh(msg.rm_pktinfolen);
 842                                 msg.rm_vchandle = le32toh(msg.rm_vchandle);
 843                                 msg.rm_reserved = le32toh(msg.rm_reserved);
 844                         }
 845
 846                         DPRINTF("len %u data(off:%u len:%u) "
 847                             "oobdata(off:%u len:%u nb:%u) perpacket(off:%u len:%u)\n",
 848                             msg.rm_len, msg.rm_dataoffset, msg.rm_datalen,
 849                             msg.rm_oobdataoffset, msg.rm_oobdatalen,
 850                             msg.rm_oobdataelements, msg.rm_pktinfooffset,
 851                             msg.rm_pktinfooffset);
 852
 853                         /* sanity check the RNDIS header */
 854                         if (msg.rm_type != REMOTE_NDIS_PACKET_MSG) {
 855                                 DPRINTF("invalid type 0x%x != 0x%x\n",
 856                                     msg.rm_type, REMOTE_NDIS_PACKET_MSG);
 857                                 goto tr_setup;
 858                         } else if (msg.rm_len < (uint32_t)sizeof(msg)) {
 859                                 DPRINTF("invalid msg len %u < %u\n",
 860                                     msg.rm_len, (unsigned)sizeof(msg));
 861                                 goto tr_setup;
 862                         } else if (msg.rm_len > (uint32_t)actlen) {
 863                                 DPRINTF("invalid msg len %u > buffer "
 864                                     "len %u\n", msg.rm_len, actlen);
 865                                 goto tr_setup;
 866                         } else if (msg.rm_dataoffset >= (uint32_t)actlen) {
 867                                 DPRINTF("invalid msg dataoffset %u > buffer "
 868                                     "dataoffset %u\n", msg.rm_dataoffset, actlen);
 869                                 goto tr_setup;
 870                         } else if (msg.rm_datalen > (uint32_t)actlen) {
 871                                 DPRINTF("invalid msg datalen %u > buffer "
 872                                     "datalen %u\n", msg.rm_datalen, actlen);
 873                                 goto tr_setup;
 874                         } else if ((msg.rm_dataoffset + msg.rm_datalen +
 875                             (uint32_t)__offsetof(struct urndis_packet_msg,
 876                             rm_dataoffset)) > (uint32_t)actlen) {
 877                                 DPRINTF("invalid dataoffset %u larger than %u\n",
 878                                     msg.rm_dataoffset + msg.rm_datalen +
 879                                     (uint32_t)__offsetof(struct urndis_packet_msg,
 880                                     rm_dataoffset), actlen);
 881                                 goto tr_setup;
 882                         } else if (msg.rm_datalen < (uint32_t)sizeof(struct ether_header)) {
 883                                 ifp->if_ierrors++;
 884                                 DPRINTF("invalid ethernet size "
 885                                     "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header));
 886                                 goto tr_setup;
 887                         } else if (msg.rm_datalen > (uint32_t)(MCLBYTES - ETHER_ALIGN)) {
 888                                 ifp->if_ierrors++;
 889                                 DPRINTF("invalid ethernet size "
 890                                     "%u > %u\n",
 891                                     msg.rm_datalen, (unsigned)MCLBYTES);
 892                                 goto tr_setup;
 893                         } else if (msg.rm_datalen > (uint32_t)(MHLEN - ETHER_ALIGN)) {
 894                                 m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
 895                         } else {
 896                                 m = m_gethdr(M_NOWAIT, MT_DATA);
 897                         }
 898
 899                         /* check if we have a buffer */
 900                         if (m != NULL) {
 901                                 m->m_len = m->m_pkthdr.len = msg.rm_datalen + ETHER_ALIGN;
 902                                 m_adj(m, ETHER_ALIGN);
 903
 904                                 usbd_copy_out(pc, offset + msg.rm_dataoffset +
 905                                     __offsetof(struct urndis_packet_msg,
 906                                     rm_dataoffset), m->m_data, msg.rm_datalen);
 907
 908                                 /* enqueue */
 909                                 uether_rxmbuf(&sc->sc_ue, m, msg.rm_datalen);
 910                         } else {
 911                                 ifp->if_ierrors++;
 912                         }
 913                         offset += msg.rm_len;
 914                         actlen -= msg.rm_len;
 915                 }
 916
 917         case USB_ST_SETUP:
 918 tr_setup:
 919                 usbd_xfer_set_frame_len(xfer, 0, RNDIS_RX_MAXLEN);
 920                 usbd_xfer_set_frames(xfer, 1);
 921                 usbd_transfer_submit(xfer);
 922                 uether_rxflush(&sc->sc_ue);     /* must be last */
 923                 break;
 924
 925         default:                        /* Error */
 926                 DPRINTFN(1, "error = %s\n", usbd_errstr(error));
 927
 928                 if (error != USB_ERR_CANCELLED) {
 929                         /* try to clear stall first */
 930                         usbd_xfer_set_stall(xfer);
 931                         usbd_xfer_set_frames(xfer, 0);
 932                         usbd_transfer_submit(xfer);
 933                 }
 934                 break;
 935         }
 936 }
 937
 938 static void
 939 urndis_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
 940 {
 941         struct urndis_packet_msg msg;
 942         struct urndis_softc *sc = usbd_xfer_softc(xfer);
 943         struct ifnet *ifp = uether_getifp(&sc->sc_ue);
 944         struct mbuf *m;
 945         unsigned x;
 946         int actlen;
 947         int aframes;
 948
 949         usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
 950
 951         DPRINTFN(1, "\n");
 952
 953         switch (USB_GET_STATE(xfer)) {
 954         case USB_ST_TRANSFERRED:
 955                 DPRINTFN(11, "%u bytes in %u frames\n", actlen, aframes);
 956
 957                 ifp->if_opackets++;
 958
 959                 /* FALLTHROUGH */
 960         case USB_ST_SETUP:
 961 tr_setup:
 962                 memset(&msg, 0, sizeof(msg));
 963
 964                 for (x = 0; x != RNDIS_TX_FRAMES_MAX; x++) {
 965                         struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, x);
 966
 967                         usbd_xfer_set_frame_offset(xfer, x * RNDIS_TX_MAXLEN, x);
 968
 969 next_pkt:
 970                         IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
 971
 972                         if (m == NULL)
 973                                 break;
 974
 975                         if ((m->m_pkthdr.len + sizeof(msg)) > RNDIS_TX_MAXLEN) {
 976                                 DPRINTF("Too big packet\n");
 977                                 ifp->if_oerrors++;
 978
 979                                 /* Free buffer */
 980                                 m_freem(m);
 981                                 goto next_pkt;
 982                         }
 983                         msg.rm_type = htole32(REMOTE_NDIS_PACKET_MSG);
 984                         msg.rm_len = htole32(sizeof(msg) + m->m_pkthdr.len);
 985
 986                         msg.rm_dataoffset = htole32(RNDIS_DATA_OFFSET);
 987                         msg.rm_datalen = htole32(m->m_pkthdr.len);
 988
 989                         /* copy in all data */
 990                         usbd_copy_in(pc, 0, &msg, sizeof(msg));
 991                         usbd_m_copy_in(pc, sizeof(msg), m, 0, m->m_pkthdr.len);
 992                         usbd_xfer_set_frame_len(xfer, x, sizeof(msg) + m->m_pkthdr.len);
 993
 994                         /*
 995                          * If there's a BPF listener, bounce a copy of
 996                          * this frame to him:
 997                          */
 998                         BPF_MTAP(ifp, m);
 999
1000                         /* Free buffer */
1001                         m_freem(m);
1002                 }
1003                 if (x != 0) {
1004                         usbd_xfer_set_frames(xfer, x);
1005                         usbd_transfer_submit(xfer);
1006                 }
1007                 break;
1008
1009         default:                        /* Error */
1010                 DPRINTFN(11, "transfer error, %s\n", usbd_errstr(error));
1011
1012                 /* count output errors */
1013                 ifp->if_oerrors++;
1014
1015                 if (error != USB_ERR_CANCELLED) {
1016                         /* try to clear stall first */
1017                         usbd_xfer_set_stall(xfer);
1018                         goto tr_setup;
1019                 }
1020                 break;
1021         }
1022 }
1023
1024 static void
1025 urndis_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
1026 {
1027         int actlen;
1028
1029         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1030
1031         switch (USB_GET_STATE(xfer)) {
1032         case USB_ST_TRANSFERRED:
1033
1034                 DPRINTF("Received %d bytes\n", actlen);
1035
1036                 /* TODO: decode some indications */
1037
1038                 /* FALLTHROUGH */
1039         case USB_ST_SETUP:
1040 tr_setup:
1041                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1042                 usbd_transfer_submit(xfer);
1043                 break;
1044
1045         default:                        /* Error */
1046                 if (error != USB_ERR_CANCELLED) {
1047                         /* start clear stall */
1048                         usbd_xfer_set_stall(xfer);
1049                         goto tr_setup;
1050                 }
1051                 break;
1052         }
1053 }