1/* $OpenBSD: if_urndis.c,v 1.46 2013/12/09 15:45:29 pirofti Exp $ */ 2 3/* 4 * Copyright (c) 2010 Jonathan Armani <armani@openbsd.org> 5 * Copyright (c) 2010 Fabien Romano <fabien@openbsd.org> 6 * Copyright (c) 2010 Michael Knudsen <mk@openbsd.org> 7 * Copyright (c) 2014 Hans Petter Selasky <hselasky@freebsd.org> 8 * All rights reserved. 9 * 10 * Permission to use, copy, modify, and distribute this software for any 11 * purpose with or without fee is hereby granted, provided that the above 12 * copyright notice and this permission notice appear in all copies. 13 * 14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 21 */ 22 23#include <sys/cdefs.h> 24__FBSDID("$FreeBSD: stable/10/sys/dev/usb/net/if_urndis.c 351017 2019-08-14 09:42:26Z hselasky $"); 25 26#include <sys/stdint.h> 27#include <sys/stddef.h> 28#include <sys/param.h> 29#include <sys/queue.h> 30#include <sys/types.h> 31#include <sys/systm.h> 32#include <sys/socket.h> 33#include <sys/kernel.h> 34#include <sys/bus.h> 35#include <sys/module.h> 36#include <sys/lock.h> 37#include <sys/mutex.h> 38#include <sys/condvar.h> 39#include <sys/sysctl.h> 40#include <sys/sx.h> 41#include <sys/unistd.h> 42#include <sys/callout.h> 43#include <sys/malloc.h> 44#include <sys/priv.h> 45 46#include <net/if.h> 47#include <net/if_var.h> 48#include <net/rndis.h> 49 50#include <dev/usb/usb.h> 51#include <dev/usb/usbdi.h> 52#include <dev/usb/usbdi_util.h> 53#include "usbdevs.h" 54 55#define USB_DEBUG_VAR urndis_debug 56#include <dev/usb/usb_debug.h> 57#include <dev/usb/usb_process.h> 58#include "usb_if.h" 59 60#include <dev/usb/net/usb_ethernet.h> 61#include <dev/usb/net/if_urndisreg.h> 62 63#include <dev/usb/usb_cdc.h> 64 65static device_probe_t urndis_probe; 66static device_attach_t urndis_attach; 67static device_detach_t urndis_detach; 68static device_suspend_t urndis_suspend; 69static device_resume_t urndis_resume; 70 71static usb_callback_t urndis_bulk_write_callback; 72static usb_callback_t urndis_bulk_read_callback; 73static usb_callback_t urndis_intr_read_callback; 74 75static uether_fn_t urndis_attach_post; 76static uether_fn_t urndis_init; 77static uether_fn_t urndis_stop; 78static uether_fn_t urndis_start; 79static uether_fn_t urndis_setmulti; 80static uether_fn_t urndis_setpromisc; 81 82static uint32_t urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid, 83 struct rndis_query_req *msg, uint16_t len, 84 const void **rbuf, uint16_t *rbufsz); 85static uint32_t urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid, 86 struct rndis_set_req *msg, uint16_t len); 87static uint32_t urndis_ctrl_handle_init(struct urndis_softc *sc, 88 const struct rndis_comp_hdr *hdr); 89static uint32_t urndis_ctrl_handle_query(struct urndis_softc *sc, 90 const struct rndis_comp_hdr *hdr, const void **buf, 91 uint16_t *bufsz); 92static uint32_t urndis_ctrl_handle_reset(struct urndis_softc *sc, 93 const struct rndis_comp_hdr *hdr); 94static uint32_t urndis_ctrl_init(struct urndis_softc *sc); 95static uint32_t urndis_ctrl_halt(struct urndis_softc *sc); 96 97#ifdef USB_DEBUG 98static int urndis_debug = 0; 99static SYSCTL_NODE(_hw_usb, OID_AUTO, urndis, CTLFLAG_RW, 0, "USB RNDIS-Ethernet"); 100SYSCTL_INT(_hw_usb_urndis, OID_AUTO, debug, CTLFLAG_RW, &urndis_debug, 0, 101 "Debug level"); 102#endif 103 104static const struct usb_config urndis_config[URNDIS_N_TRANSFER] = { 105 [URNDIS_BULK_RX] = { 106 .type = UE_BULK, 107 .endpoint = UE_ADDR_ANY, 108 .direction = UE_DIR_RX, 109 .if_index = 0, 110 .frames = 1, 111 .bufsize = RNDIS_RX_MAXLEN, 112 .flags = {.short_xfer_ok = 1,}, 113 .callback = urndis_bulk_read_callback, 114 .timeout = 0, /* no timeout */ 115 .usb_mode = USB_MODE_HOST, 116 }, 117 118 [URNDIS_BULK_TX] = { 119 .type = UE_BULK, 120 .endpoint = UE_ADDR_ANY, 121 .direction = UE_DIR_TX, 122 .if_index = 0, 123 .frames = RNDIS_TX_FRAMES_MAX, 124 .bufsize = (RNDIS_TX_FRAMES_MAX * RNDIS_TX_MAXLEN), 125 .flags = { 126 .force_short_xfer = 1, 127 }, 128 .callback = urndis_bulk_write_callback, 129 .timeout = 10000, /* 10 seconds */ 130 .usb_mode = USB_MODE_HOST, 131 }, 132 133 [URNDIS_INTR_RX] = { 134 .type = UE_INTERRUPT, 135 .endpoint = UE_ADDR_ANY, 136 .direction = UE_DIR_RX, 137 .if_index = 1, 138 .bufsize = 0, /* use wMaxPacketSize */ 139 .flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,}, 140 .callback = urndis_intr_read_callback, 141 .timeout = 0, 142 .usb_mode = USB_MODE_HOST, 143 }, 144}; 145 146static device_method_t urndis_methods[] = { 147 /* Device interface */ 148 DEVMETHOD(device_probe, urndis_probe), 149 DEVMETHOD(device_attach, urndis_attach), 150 DEVMETHOD(device_detach, urndis_detach), 151 DEVMETHOD(device_suspend, urndis_suspend), 152 DEVMETHOD(device_resume, urndis_resume), 153 154 DEVMETHOD_END 155}; 156 157static driver_t urndis_driver = { 158 .name = "urndis", 159 .methods = urndis_methods, 160 .size = sizeof(struct urndis_softc), 161}; 162 163static devclass_t urndis_devclass; 164 165DRIVER_MODULE(urndis, uhub, urndis_driver, urndis_devclass, NULL, NULL); 166MODULE_VERSION(urndis, 1); 167MODULE_DEPEND(urndis, uether, 1, 1, 1); 168MODULE_DEPEND(urndis, usb, 1, 1, 1); 169MODULE_DEPEND(urndis, ether, 1, 1, 1); 170 171static const struct usb_ether_methods urndis_ue_methods = { 172 .ue_attach_post = urndis_attach_post, 173 .ue_start = urndis_start, 174 .ue_init = urndis_init, 175 .ue_stop = urndis_stop, 176 .ue_setmulti = urndis_setmulti, 177 .ue_setpromisc = urndis_setpromisc, 178}; 179 180static const STRUCT_USB_HOST_ID urndis_host_devs[] = { 181 /* Generic RNDIS class match */ 182 {USB_IFACE_CLASS(UICLASS_CDC), 183 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL), 184 USB_IFACE_PROTOCOL(0xff)}, 185 {USB_IFACE_CLASS(UICLASS_WIRELESS), USB_IFACE_SUBCLASS(UISUBCLASS_RF), 186 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)}, 187 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(UISUBCLASS_SYNC), 188 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)}, 189 /* HP-WebOS */ 190 {USB_VENDOR(USB_VENDOR_PALM), USB_IFACE_CLASS(UICLASS_CDC), 191 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL), 192 USB_IFACE_PROTOCOL(0xff)}, 193 /* Nokia 7 plus */ 194 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(0x4), 195 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)}, 196}; 197 198static int 199urndis_probe(device_t dev) 200{ 201 struct usb_attach_arg *uaa = device_get_ivars(dev); 202 203 return (usbd_lookup_id_by_uaa(urndis_host_devs, sizeof(urndis_host_devs), uaa)); 204} 205 206static void 207urndis_attach_post(struct usb_ether *ue) 208{ 209 210 /* no-op */ 211} 212 213static int 214urndis_attach(device_t dev) 215{ 216 static struct { 217 union { 218 struct rndis_query_req query; 219 struct rndis_set_req set; 220 } hdr; 221 union { 222 uint8_t eaddr[ETHER_ADDR_LEN]; 223 uint32_t filter; 224 } ibuf; 225 } msg; 226 struct urndis_softc *sc = device_get_softc(dev); 227 struct usb_ether *ue = &sc->sc_ue; 228 struct usb_attach_arg *uaa = device_get_ivars(dev); 229 struct usb_cdc_cm_descriptor *cmd; 230 const void *buf; 231 uint16_t bufsz; 232 uint8_t iface_index[2] = { uaa->info.bIfaceIndex + 1, uaa->info.bIfaceIndex }; 233 int error; 234 uint8_t i; 235 236 sc->sc_ue.ue_udev = uaa->device; 237 sc->sc_ifaceno_ctl = uaa->info.bIfaceNum; 238 239 cmd = usbd_find_descriptor(uaa->device, NULL, uaa->info.bIfaceIndex, 240 UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_CM, 0xFF); 241 if (cmd != 0) { 242 DPRINTF("Call Mode Descriptor found, dataif=%d\n", cmd->bDataInterface); 243 iface_index[0] = cmd->bDataInterface; 244 } 245 246 device_set_usb_desc(dev); 247 248 mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF); 249 250 /* scan the alternate settings looking for a valid one */ 251 for (i = 0; i != 32; i++) { 252 error = usbd_set_alt_interface_index(uaa->device, 253 iface_index[0], i); 254 255 if (error != 0) 256 break; 257 258 error = usbd_transfer_setup(uaa->device, 259 iface_index, sc->sc_xfer, urndis_config, 260 URNDIS_N_TRANSFER, sc, &sc->sc_mtx); 261 262 if (error == 0) 263 break; 264 } 265 if ((error != 0) || (i == 32)) { 266 device_printf(dev, "No valid alternate setting found\n"); 267 goto detach; 268 } 269 270 /* Initialize device - must be done before even querying it */ 271 URNDIS_LOCK(sc); 272 error = urndis_ctrl_init(sc); 273 URNDIS_UNLOCK(sc); 274 if (error != (int)RNDIS_STATUS_SUCCESS) { 275 device_printf(dev, "Unable to initialize hardware\n"); 276 goto detach; 277 } 278 279 /* Determine MAC address */ 280 memset(msg.ibuf.eaddr, 0, sizeof(msg.ibuf.eaddr)); 281 URNDIS_LOCK(sc); 282 error = urndis_ctrl_query(sc, OID_802_3_PERMANENT_ADDRESS, 283 &msg.hdr.query, sizeof(msg.hdr.query) + sizeof(msg.ibuf.eaddr), 284 &buf, &bufsz); 285 URNDIS_UNLOCK(sc); 286 if (error != (int)RNDIS_STATUS_SUCCESS) { 287 device_printf(dev, "Unable to get hardware address\n"); 288 goto detach; 289 } 290 if (bufsz != ETHER_ADDR_LEN) { 291 device_printf(dev, "Invalid address length: %d bytes\n", bufsz); 292 goto detach; 293 } 294 memcpy(&sc->sc_ue.ue_eaddr, buf, ETHER_ADDR_LEN); 295 296 /* Initialize packet filter */ 297 sc->sc_filter = NDIS_PACKET_TYPE_BROADCAST | 298 NDIS_PACKET_TYPE_ALL_MULTICAST; 299 msg.ibuf.filter = htole32(sc->sc_filter); 300 URNDIS_LOCK(sc); 301 error = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER, 302 &msg.hdr.set, sizeof(msg.hdr.set) + sizeof(msg.ibuf.filter)); 303 URNDIS_UNLOCK(sc); 304 if (error != (int)RNDIS_STATUS_SUCCESS) { 305 device_printf(dev, "Unable to set data filters\n"); 306 goto detach; 307 } 308 309 ue->ue_sc = sc; 310 ue->ue_dev = dev; 311 ue->ue_udev = uaa->device; 312 ue->ue_mtx = &sc->sc_mtx; 313 ue->ue_methods = &urndis_ue_methods; 314 315 error = uether_ifattach(ue); 316 if (error) { 317 device_printf(dev, "Could not attach interface\n"); 318 goto detach; 319 } 320 321 URNDIS_LOCK(sc); 322 /* start interrupt endpoint, if any */ 323 usbd_transfer_start(sc->sc_xfer[URNDIS_INTR_RX]); 324 URNDIS_UNLOCK(sc); 325 326 return (0); /* success */ 327 328detach: 329 (void)urndis_detach(dev); 330 return (ENXIO); /* failure */ 331} 332 333static int 334urndis_detach(device_t dev) 335{ 336 struct urndis_softc *sc = device_get_softc(dev); 337 struct usb_ether *ue = &sc->sc_ue; 338 339 /* stop all USB transfers first */ 340 usbd_transfer_unsetup(sc->sc_xfer, URNDIS_N_TRANSFER); 341 342 uether_ifdetach(ue); 343 344 URNDIS_LOCK(sc); 345 (void)urndis_ctrl_halt(sc); 346 URNDIS_UNLOCK(sc); 347 348 mtx_destroy(&sc->sc_mtx); 349 350 return (0); 351} 352 353static void 354urndis_start(struct usb_ether *ue) 355{ 356 struct urndis_softc *sc = uether_getsc(ue); 357 358 /* 359 * Start the USB transfers, if not already started: 360 */ 361 usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_TX]); 362 usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_RX]); 363} 364 365static void 366urndis_init(struct usb_ether *ue) 367{ 368 struct urndis_softc *sc = uether_getsc(ue); 369 struct ifnet *ifp = uether_getifp(ue); 370 371 URNDIS_LOCK_ASSERT(sc, MA_OWNED); 372 373 ifp->if_drv_flags |= IFF_DRV_RUNNING; 374 375 /* stall data write direction, which depends on USB mode */ 376 usbd_xfer_set_stall(sc->sc_xfer[URNDIS_BULK_TX]); 377 378 /* start data transfers */ 379 urndis_start(ue); 380} 381 382static void 383urndis_stop(struct usb_ether *ue) 384{ 385 struct urndis_softc *sc = uether_getsc(ue); 386 struct ifnet *ifp = uether_getifp(ue); 387 388 URNDIS_LOCK_ASSERT(sc, MA_OWNED); 389 390 ifp->if_drv_flags &= ~IFF_DRV_RUNNING; 391 392 /* 393 * stop all the transfers, if not already stopped: 394 */ 395 usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_RX]); 396 usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_TX]); 397} 398 399static void 400urndis_setmulti(struct usb_ether *ue) 401{ 402 403 /* no-op */ 404} 405 406static void 407urndis_setpromisc(struct usb_ether *ue) 408{ 409 410 /* no-op */ 411} 412 413static int 414urndis_suspend(device_t dev) 415{ 416 417 device_printf(dev, "Suspending\n"); 418 return (0); 419} 420 421static int 422urndis_resume(device_t dev) 423{ 424 425 device_printf(dev, "Resuming\n"); 426 return (0); 427} 428 429static usb_error_t 430urndis_ctrl_msg(struct urndis_softc *sc, uint8_t rt, uint8_t r, 431 uint16_t index, uint16_t value, void *buf, uint16_t buflen) 432{ 433 usb_device_request_t req; 434 435 req.bmRequestType = rt; 436 req.bRequest = r; 437 USETW(req.wValue, value); 438 USETW(req.wIndex, index); 439 USETW(req.wLength, buflen); 440 441 return (usbd_do_request_flags(sc->sc_ue.ue_udev, 442 &sc->sc_mtx, &req, buf, (rt & UT_READ) ? 443 USB_SHORT_XFER_OK : 0, NULL, 2000 /* ms */ )); 444} 445 446static usb_error_t 447urndis_ctrl_send(struct urndis_softc *sc, void *buf, uint16_t len) 448{ 449 usb_error_t err; 450 451 err = urndis_ctrl_msg(sc, UT_WRITE_CLASS_INTERFACE, 452 UCDC_SEND_ENCAPSULATED_COMMAND, sc->sc_ifaceno_ctl, 0, buf, len); 453 454 DPRINTF("%s\n", usbd_errstr(err)); 455 456 return (err); 457} 458 459static struct rndis_comp_hdr * 460urndis_ctrl_recv(struct urndis_softc *sc) 461{ 462 struct rndis_comp_hdr *hdr; 463 usb_error_t err; 464 465 err = urndis_ctrl_msg(sc, UT_READ_CLASS_INTERFACE, 466 UCDC_GET_ENCAPSULATED_RESPONSE, sc->sc_ifaceno_ctl, 0, 467 sc->sc_response_buf, RNDIS_RESPONSE_LEN); 468 469 if (err != USB_ERR_NORMAL_COMPLETION) 470 return (NULL); 471 472 hdr = (struct rndis_comp_hdr *)sc->sc_response_buf; 473 474 DPRINTF("type 0x%x len %u\n", le32toh(hdr->rm_type), 475 le32toh(hdr->rm_len)); 476 477 if (le32toh(hdr->rm_len) > RNDIS_RESPONSE_LEN) { 478 DPRINTF("ctrl message error: wrong size %u > %u\n", 479 le32toh(hdr->rm_len), RNDIS_RESPONSE_LEN); 480 return (NULL); 481 } 482 return (hdr); 483} 484 485static uint32_t 486urndis_ctrl_handle(struct urndis_softc *sc, struct rndis_comp_hdr *hdr, 487 const void **buf, uint16_t *bufsz) 488{ 489 uint32_t rval; 490 491 DPRINTF("\n"); 492 493 if (buf != NULL && bufsz != NULL) { 494 *buf = NULL; 495 *bufsz = 0; 496 } 497 switch (le32toh(hdr->rm_type)) { 498 case REMOTE_NDIS_INITIALIZE_CMPLT: 499 rval = urndis_ctrl_handle_init(sc, hdr); 500 break; 501 502 case REMOTE_NDIS_QUERY_CMPLT: 503 rval = urndis_ctrl_handle_query(sc, hdr, buf, bufsz); 504 break; 505 506 case REMOTE_NDIS_RESET_CMPLT: 507 rval = urndis_ctrl_handle_reset(sc, hdr); 508 break; 509 510 case REMOTE_NDIS_KEEPALIVE_CMPLT: 511 case REMOTE_NDIS_SET_CMPLT: 512 rval = le32toh(hdr->rm_status); 513 break; 514 515 default: 516 device_printf(sc->sc_ue.ue_dev, 517 "ctrl message error: unknown event 0x%x\n", 518 le32toh(hdr->rm_type)); 519 rval = RNDIS_STATUS_FAILURE; 520 break; 521 } 522 return (rval); 523} 524 525static uint32_t 526urndis_ctrl_handle_init(struct urndis_softc *sc, 527 const struct rndis_comp_hdr *hdr) 528{ 529 const struct rndis_init_comp *msg; 530 531 msg = (const struct rndis_init_comp *)hdr; 532 533 DPRINTF("len %u rid %u status 0x%x " 534 "ver_major %u ver_minor %u devflags 0x%x medium 0x%x pktmaxcnt %u " 535 "pktmaxsz %u align %u aflistoffset %u aflistsz %u\n", 536 le32toh(msg->rm_len), 537 le32toh(msg->rm_rid), 538 le32toh(msg->rm_status), 539 le32toh(msg->rm_ver_major), 540 le32toh(msg->rm_ver_minor), 541 le32toh(msg->rm_devflags), 542 le32toh(msg->rm_medium), 543 le32toh(msg->rm_pktmaxcnt), 544 le32toh(msg->rm_pktmaxsz), 545 le32toh(msg->rm_align), 546 le32toh(msg->rm_aflistoffset), 547 le32toh(msg->rm_aflistsz)); 548 549 if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) { 550 DPRINTF("init failed 0x%x\n", le32toh(msg->rm_status)); 551 return (le32toh(msg->rm_status)); 552 } 553 if (le32toh(msg->rm_devflags) != RNDIS_DF_CONNECTIONLESS) { 554 DPRINTF("wrong device type (current type: 0x%x)\n", 555 le32toh(msg->rm_devflags)); 556 return (RNDIS_STATUS_FAILURE); 557 } 558 if (le32toh(msg->rm_medium) != RNDIS_MEDIUM_802_3) { 559 DPRINTF("medium not 802.3 (current medium: 0x%x)\n", 560 le32toh(msg->rm_medium)); 561 return (RNDIS_STATUS_FAILURE); 562 } 563 sc->sc_lim_pktsz = le32toh(msg->rm_pktmaxsz); 564 565 return (le32toh(msg->rm_status)); 566} 567 568static uint32_t 569urndis_ctrl_handle_query(struct urndis_softc *sc, 570 const struct rndis_comp_hdr *hdr, const void **buf, uint16_t *bufsz) 571{ 572 const struct rndis_query_comp *msg; 573 uint64_t limit; 574 575 msg = (const struct rndis_query_comp *)hdr; 576 577 DPRINTF("len %u rid %u status 0x%x " 578 "buflen %u bufoff %u\n", 579 le32toh(msg->rm_len), 580 le32toh(msg->rm_rid), 581 le32toh(msg->rm_status), 582 le32toh(msg->rm_infobuflen), 583 le32toh(msg->rm_infobufoffset)); 584 585 *buf = NULL; 586 *bufsz = 0; 587 if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) { 588 DPRINTF("query failed 0x%x\n", le32toh(msg->rm_status)); 589 return (le32toh(msg->rm_status)); 590 } 591 limit = le32toh(msg->rm_infobuflen); 592 limit += le32toh(msg->rm_infobufoffset); 593 limit += RNDIS_HEADER_OFFSET; 594 595 if (limit > (uint64_t)le32toh(msg->rm_len)) { 596 DPRINTF("ctrl message error: invalid query info " 597 "len/offset/end_position(%u/%u/%u) -> " 598 "go out of buffer limit %u\n", 599 le32toh(msg->rm_infobuflen), 600 le32toh(msg->rm_infobufoffset), 601 le32toh(msg->rm_infobuflen) + 602 le32toh(msg->rm_infobufoffset) + RNDIS_HEADER_OFFSET, 603 le32toh(msg->rm_len)); 604 return (RNDIS_STATUS_FAILURE); 605 } 606 *buf = ((const uint8_t *)msg) + RNDIS_HEADER_OFFSET + 607 le32toh(msg->rm_infobufoffset); 608 *bufsz = le32toh(msg->rm_infobuflen); 609 610 return (le32toh(msg->rm_status)); 611} 612 613static uint32_t 614urndis_ctrl_handle_reset(struct urndis_softc *sc, 615 const struct rndis_comp_hdr *hdr) 616{ 617 const struct rndis_reset_comp *msg; 618 uint32_t rval; 619 620 msg = (const struct rndis_reset_comp *)hdr; 621 622 rval = le32toh(msg->rm_status); 623 624 DPRINTF("len %u status 0x%x " 625 "adrreset %u\n", 626 le32toh(msg->rm_len), 627 rval, 628 le32toh(msg->rm_adrreset)); 629 630 if (rval != RNDIS_STATUS_SUCCESS) { 631 DPRINTF("reset failed 0x%x\n", rval); 632 return (rval); 633 } 634 if (msg->rm_adrreset != 0) { 635 struct { 636 struct rndis_set_req hdr; 637 uint32_t filter; 638 } msg_filter; 639 640 msg_filter.filter = htole32(sc->sc_filter); 641 642 rval = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER, 643 &msg_filter.hdr, sizeof(msg_filter)); 644 645 if (rval != RNDIS_STATUS_SUCCESS) { 646 DPRINTF("unable to reset data filters\n"); 647 return (rval); 648 } 649 } 650 return (rval); 651} 652 653static uint32_t 654urndis_ctrl_init(struct urndis_softc *sc) 655{ 656 struct rndis_init_req msg; 657 struct rndis_comp_hdr *hdr; 658 uint32_t rval; 659 660 msg.rm_type = htole32(REMOTE_NDIS_INITIALIZE_MSG); 661 msg.rm_len = htole32(sizeof(msg)); 662 msg.rm_rid = 0; 663 msg.rm_ver_major = htole32(RNDIS_VERSION_MAJOR); 664 msg.rm_ver_minor = htole32(1); 665 msg.rm_max_xfersz = htole32(RNDIS_RX_MAXLEN); 666 667 DPRINTF("type %u len %u rid %u ver_major %u " 668 "ver_minor %u max_xfersz %u\n", 669 le32toh(msg.rm_type), 670 le32toh(msg.rm_len), 671 le32toh(msg.rm_rid), 672 le32toh(msg.rm_ver_major), 673 le32toh(msg.rm_ver_minor), 674 le32toh(msg.rm_max_xfersz)); 675 676 rval = urndis_ctrl_send(sc, &msg, sizeof(msg)); 677 678 if (rval != RNDIS_STATUS_SUCCESS) { 679 DPRINTF("init failed\n"); 680 return (rval); 681 } 682 if ((hdr = urndis_ctrl_recv(sc)) == NULL) { 683 DPRINTF("unable to get init response\n"); 684 return (RNDIS_STATUS_FAILURE); 685 } 686 rval = urndis_ctrl_handle(sc, hdr, NULL, NULL); 687 688 return (rval); 689} 690 691static uint32_t 692urndis_ctrl_halt(struct urndis_softc *sc) 693{ 694 struct rndis_halt_req msg; 695 uint32_t rval; 696 697 msg.rm_type = htole32(REMOTE_NDIS_HALT_MSG); 698 msg.rm_len = htole32(sizeof(msg)); 699 msg.rm_rid = 0; 700 701 DPRINTF("type %u len %u rid %u\n", 702 le32toh(msg.rm_type), 703 le32toh(msg.rm_len), 704 le32toh(msg.rm_rid)); 705 706 rval = urndis_ctrl_send(sc, &msg, sizeof(msg)); 707 708 if (rval != RNDIS_STATUS_SUCCESS) 709 DPRINTF("halt failed\n"); 710 711 return (rval); 712} 713 714/* 715 * NB: Querying a device has the requirment of using an input buffer the size 716 * of the expected reply or larger, except for variably sized replies. 717 */ 718static uint32_t 719urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid, 720 struct rndis_query_req *msg, uint16_t len, const void **rbuf, 721 uint16_t *rbufsz) 722{ 723 struct rndis_comp_hdr *hdr; 724 uint32_t datalen, rval; 725 726 msg->rm_type = htole32(REMOTE_NDIS_QUERY_MSG); 727 msg->rm_len = htole32(len); 728 msg->rm_rid = 0; /* XXX */ 729 msg->rm_oid = htole32(oid); 730 datalen = len - sizeof(*msg); 731 msg->rm_infobuflen = htole32(datalen); 732 if (datalen != 0) { 733 msg->rm_infobufoffset = htole32(sizeof(*msg) - 734 RNDIS_HEADER_OFFSET); 735 } else { 736 msg->rm_infobufoffset = 0; 737 } 738 msg->rm_devicevchdl = 0; 739 740 DPRINTF("type %u len %u rid %u oid 0x%x " 741 "infobuflen %u infobufoffset %u devicevchdl %u\n", 742 le32toh(msg->rm_type), 743 le32toh(msg->rm_len), 744 le32toh(msg->rm_rid), 745 le32toh(msg->rm_oid), 746 le32toh(msg->rm_infobuflen), 747 le32toh(msg->rm_infobufoffset), 748 le32toh(msg->rm_devicevchdl)); 749 750 rval = urndis_ctrl_send(sc, msg, len); 751 752 if (rval != RNDIS_STATUS_SUCCESS) { 753 DPRINTF("query failed\n"); 754 return (rval); 755 } 756 if ((hdr = urndis_ctrl_recv(sc)) == NULL) { 757 DPRINTF("unable to get query response\n"); 758 return (RNDIS_STATUS_FAILURE); 759 } 760 rval = urndis_ctrl_handle(sc, hdr, rbuf, rbufsz); 761 762 return (rval); 763} 764 765static uint32_t 766urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid, 767 struct rndis_set_req *msg, uint16_t len) 768{ 769 struct rndis_comp_hdr *hdr; 770 uint32_t datalen, rval; 771 772 msg->rm_type = htole32(REMOTE_NDIS_SET_MSG); 773 msg->rm_len = htole32(len); 774 msg->rm_rid = 0; /* XXX */ 775 msg->rm_oid = htole32(oid); 776 datalen = len - sizeof(*msg); 777 msg->rm_infobuflen = htole32(datalen); 778 if (datalen != 0) { 779 msg->rm_infobufoffset = htole32(sizeof(*msg) - 780 RNDIS_HEADER_OFFSET); 781 } else { 782 msg->rm_infobufoffset = 0; 783 } 784 msg->rm_devicevchdl = 0; 785 786 DPRINTF("type %u len %u rid %u oid 0x%x " 787 "infobuflen %u infobufoffset %u devicevchdl %u\n", 788 le32toh(msg->rm_type), 789 le32toh(msg->rm_len), 790 le32toh(msg->rm_rid), 791 le32toh(msg->rm_oid), 792 le32toh(msg->rm_infobuflen), 793 le32toh(msg->rm_infobufoffset), 794 le32toh(msg->rm_devicevchdl)); 795 796 rval = urndis_ctrl_send(sc, msg, len); 797 798 if (rval != RNDIS_STATUS_SUCCESS) { 799 DPRINTF("set failed\n"); 800 return (rval); 801 } 802 if ((hdr = urndis_ctrl_recv(sc)) == NULL) { 803 DPRINTF("unable to get set response\n"); 804 return (RNDIS_STATUS_FAILURE); 805 } 806 rval = urndis_ctrl_handle(sc, hdr, NULL, NULL); 807 if (rval != RNDIS_STATUS_SUCCESS) 808 DPRINTF("set failed 0x%x\n", rval); 809 810 return (rval); 811} 812 813static void 814urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error) 815{ 816 struct urndis_softc *sc = usbd_xfer_softc(xfer); 817 struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, 0); 818 struct ifnet *ifp = uether_getifp(&sc->sc_ue); 819 struct rndis_packet_msg msg; 820 struct mbuf *m; 821 int actlen; 822 int aframes; 823 int offset; 824 825 switch (USB_GET_STATE(xfer)) { 826 case USB_ST_TRANSFERRED: 827 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL); 828 829 DPRINTFN(1, "received %u bytes in %u frames\n", actlen, aframes); 830 831 for (offset = 0; actlen >= (uint32_t)sizeof(msg);) { 832 /* copy out header */ 833 usbd_copy_out(pc, offset, &msg, sizeof(msg)); 834 835 if (le32toh(0x1234567U) != 0x1234567U) { 836 /* swap endianness */ 837 msg.rm_type = le32toh(msg.rm_type); 838 msg.rm_len = le32toh(msg.rm_len); 839 msg.rm_dataoffset = le32toh(msg.rm_dataoffset); 840 msg.rm_datalen = le32toh(msg.rm_datalen); 841 msg.rm_oobdataoffset = le32toh(msg.rm_oobdataoffset); 842 msg.rm_oobdatalen = le32toh(msg.rm_oobdatalen); 843 msg.rm_oobdataelements = le32toh(msg.rm_oobdataelements); 844 msg.rm_pktinfooffset = le32toh(msg.rm_pktinfooffset); 845 msg.rm_pktinfolen = le32toh(msg.rm_pktinfolen); 846 msg.rm_vchandle = le32toh(msg.rm_vchandle); 847 msg.rm_reserved = le32toh(msg.rm_reserved); 848 } 849 850 DPRINTF("len %u data(off:%u len:%u) " 851 "oobdata(off:%u len:%u nb:%u) perpacket(off:%u len:%u)\n", 852 msg.rm_len, msg.rm_dataoffset, msg.rm_datalen, 853 msg.rm_oobdataoffset, msg.rm_oobdatalen, 854 msg.rm_oobdataelements, msg.rm_pktinfooffset, 855 msg.rm_pktinfooffset); 856 857 /* sanity check the RNDIS header */ 858 if (msg.rm_type != REMOTE_NDIS_PACKET_MSG) { 859 DPRINTF("invalid type 0x%x != 0x%x\n", 860 msg.rm_type, REMOTE_NDIS_PACKET_MSG); 861 goto tr_setup; 862 } else if (msg.rm_len < (uint32_t)sizeof(msg)) { 863 DPRINTF("invalid msg len %u < %u\n", 864 msg.rm_len, (unsigned)sizeof(msg)); 865 goto tr_setup; 866 } else if (msg.rm_len > (uint32_t)actlen) { 867 DPRINTF("invalid msg len %u > buffer " 868 "len %u\n", msg.rm_len, actlen); 869 goto tr_setup; 870 } else if (msg.rm_dataoffset >= (uint32_t)actlen) { 871 DPRINTF("invalid msg dataoffset %u > buffer " 872 "dataoffset %u\n", msg.rm_dataoffset, actlen); 873 goto tr_setup; 874 } else if (msg.rm_datalen > (uint32_t)actlen) { 875 DPRINTF("invalid msg datalen %u > buffer " 876 "datalen %u\n", msg.rm_datalen, actlen); 877 goto tr_setup; 878 } else if ((msg.rm_dataoffset + msg.rm_datalen + 879 (uint32_t)__offsetof(struct rndis_packet_msg, 880 rm_dataoffset)) > (uint32_t)actlen) { 881 DPRINTF("invalid dataoffset %u larger than %u\n", 882 msg.rm_dataoffset + msg.rm_datalen + 883 (uint32_t)__offsetof(struct rndis_packet_msg, 884 rm_dataoffset), actlen); 885 goto tr_setup; 886 } else if (msg.rm_datalen < (uint32_t)sizeof(struct ether_header)) { 887 ifp->if_ierrors++; 888 DPRINTF("invalid ethernet size " 889 "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header)); 890 goto tr_setup; 891 } else if (msg.rm_datalen > (uint32_t)(MCLBYTES - ETHER_ALIGN)) { 892 ifp->if_ierrors++; 893 DPRINTF("invalid ethernet size " 894 "%u > %u\n", 895 msg.rm_datalen, (unsigned)MCLBYTES); 896 goto tr_setup; 897 } else if (msg.rm_datalen > (uint32_t)(MHLEN - ETHER_ALIGN)) { 898 m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR); 899 } else { 900 m = m_gethdr(M_NOWAIT, MT_DATA); 901 } 902 903 /* check if we have a buffer */ 904 if (m != NULL) { 905 m->m_len = m->m_pkthdr.len = msg.rm_datalen + ETHER_ALIGN; 906 m_adj(m, ETHER_ALIGN); 907 908 usbd_copy_out(pc, offset + msg.rm_dataoffset + 909 __offsetof(struct rndis_packet_msg, 910 rm_dataoffset), m->m_data, msg.rm_datalen); 911 912 /* enqueue */ 913 uether_rxmbuf(&sc->sc_ue, m, msg.rm_datalen); 914 } else { 915 ifp->if_ierrors++; 916 } 917 offset += msg.rm_len; 918 actlen -= msg.rm_len; 919 } 920 921 case USB_ST_SETUP: 922tr_setup: 923 usbd_xfer_set_frame_len(xfer, 0, RNDIS_RX_MAXLEN); 924 usbd_xfer_set_frames(xfer, 1); 925 usbd_transfer_submit(xfer); 926 uether_rxflush(&sc->sc_ue); /* must be last */ 927 break; 928 929 default: /* Error */ 930 DPRINTFN(1, "error = %s\n", usbd_errstr(error)); 931 932 if (error != USB_ERR_CANCELLED) { 933 /* try to clear stall first */ 934 usbd_xfer_set_stall(xfer); 935 usbd_xfer_set_frames(xfer, 0); 936 usbd_transfer_submit(xfer); 937 } 938 break; 939 } 940} 941 942static void 943urndis_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error) 944{ 945 struct rndis_packet_msg msg; 946 struct urndis_softc *sc = usbd_xfer_softc(xfer); 947 struct ifnet *ifp = uether_getifp(&sc->sc_ue); 948 struct mbuf *m; 949 unsigned x; 950 int actlen; 951 int aframes; 952 953 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL); 954 955 DPRINTFN(1, "\n"); 956 957 switch (USB_GET_STATE(xfer)) { 958 case USB_ST_TRANSFERRED: 959 DPRINTFN(11, "%u bytes in %u frames\n", actlen, aframes); 960 961 ifp->if_opackets++; 962 963 /* FALLTHROUGH */ 964 case USB_ST_SETUP: 965tr_setup: 966 memset(&msg, 0, sizeof(msg)); 967 968 for (x = 0; x != RNDIS_TX_FRAMES_MAX; x++) { 969 struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, x); 970 971 usbd_xfer_set_frame_offset(xfer, x * RNDIS_TX_MAXLEN, x); 972 973next_pkt: 974 IFQ_DRV_DEQUEUE(&ifp->if_snd, m); 975 976 if (m == NULL) 977 break; 978 979 if ((m->m_pkthdr.len + sizeof(msg)) > RNDIS_TX_MAXLEN) { 980 DPRINTF("Too big packet\n"); 981 ifp->if_oerrors++; 982 983 /* Free buffer */ 984 m_freem(m); 985 goto next_pkt; 986 } 987 msg.rm_type = htole32(REMOTE_NDIS_PACKET_MSG); 988 msg.rm_len = htole32(sizeof(msg) + m->m_pkthdr.len); 989 990 msg.rm_dataoffset = htole32(RNDIS_DATA_OFFSET); 991 msg.rm_datalen = htole32(m->m_pkthdr.len); 992 993 /* copy in all data */ 994 usbd_copy_in(pc, 0, &msg, sizeof(msg)); 995 usbd_m_copy_in(pc, sizeof(msg), m, 0, m->m_pkthdr.len); 996 usbd_xfer_set_frame_len(xfer, x, sizeof(msg) + m->m_pkthdr.len); 997 998 /* 999 * If there's a BPF listener, bounce a copy of 1000 * this frame to him: 1001 */ 1002 BPF_MTAP(ifp, m); 1003 1004 /* Free buffer */ 1005 m_freem(m); 1006 } 1007 if (x != 0) { 1008 usbd_xfer_set_frames(xfer, x); 1009 usbd_transfer_submit(xfer); 1010 } 1011 break; 1012 1013 default: /* Error */ 1014 DPRINTFN(11, "transfer error, %s\n", usbd_errstr(error)); 1015 1016 /* count output errors */ 1017 ifp->if_oerrors++; 1018 1019 if (error != USB_ERR_CANCELLED) { 1020 /* try to clear stall first */ 1021 usbd_xfer_set_stall(xfer); 1022 goto tr_setup; 1023 } 1024 break; 1025 } 1026} 1027 1028static void 1029urndis_intr_read_callback(struct usb_xfer *xfer, usb_error_t error) 1030{ 1031 int actlen; 1032 1033 usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL); 1034 1035 switch (USB_GET_STATE(xfer)) { 1036 case USB_ST_TRANSFERRED: 1037 1038 DPRINTF("Received %d bytes\n", actlen); 1039 1040 /* TODO: decode some indications */ 1041 1042 /* FALLTHROUGH */ 1043 case USB_ST_SETUP: 1044tr_setup: 1045 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer)); 1046 usbd_transfer_submit(xfer); 1047 break; 1048 1049 default: /* Error */ 1050 if (error != USB_ERR_CANCELLED) { 1051 /* start clear stall */ 1052 usbd_xfer_set_stall(xfer); 1053 goto tr_setup; 1054 } 1055 break; 1056 } 1057} 1058