1 /* $OpenBSD: if_urndis.c,v 1.46 2013/12/09 15:45:29 pirofti Exp $ */ 2 3 /* 4 * Copyright (c) 2010 Jonathan Armani <armani@openbsd.org> 5 * Copyright (c) 2010 Fabien Romano <fabien@openbsd.org> 6 * Copyright (c) 2010 Michael Knudsen <mk@openbsd.org> 7 * Copyright (c) 2014 Hans Petter Selasky <hselasky@freebsd.org> 8 * All rights reserved. 9 * 10 * Permission to use, copy, modify, and distribute this software for any 11 * purpose with or without fee is hereby granted, provided that the above 12 * copyright notice and this permission notice appear in all copies. 13 * 14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 21 */ 22 23 #include <sys/cdefs.h> 24 #include <sys/stdint.h> 25 #include <sys/stddef.h> 26 #include <sys/param.h> 27 #include <sys/queue.h> 28 #include <sys/types.h> 29 #include <sys/systm.h> 30 #include <sys/socket.h> 31 #include <sys/kernel.h> 32 #include <sys/bus.h> 33 #include <sys/module.h> 34 #include <sys/lock.h> 35 #include <sys/mutex.h> 36 #include <sys/condvar.h> 37 #include <sys/sysctl.h> 38 #include <sys/sx.h> 39 #include <sys/unistd.h> 40 #include <sys/callout.h> 41 #include <sys/malloc.h> 42 #include <sys/priv.h> 43 44 #include <net/if.h> 45 #include <net/if_var.h> 46 #include <net/rndis.h> 47 48 #include <dev/usb/usb.h> 49 #include <dev/usb/usbdi.h> 50 #include <dev/usb/usbdi_util.h> 51 #include "usbdevs.h" 52 53 #define USB_DEBUG_VAR urndis_debug 54 #include <dev/usb/usb_debug.h> 55 #include <dev/usb/usb_process.h> 56 #include "usb_if.h" 57 58 #include <dev/usb/net/usb_ethernet.h> 59 #include <dev/usb/net/if_urndisreg.h> 60 61 #include <dev/usb/usb_cdc.h> 62 63 static device_probe_t urndis_probe; 64 static device_attach_t urndis_attach; 65 static device_detach_t urndis_detach; 66 static device_suspend_t urndis_suspend; 67 static device_resume_t urndis_resume; 68 69 static usb_callback_t urndis_bulk_write_callback; 70 static usb_callback_t urndis_bulk_read_callback; 71 static usb_callback_t urndis_intr_read_callback; 72 73 static uether_fn_t urndis_attach_post; 74 static uether_fn_t urndis_init; 75 static uether_fn_t urndis_stop; 76 static uether_fn_t urndis_start; 77 static uether_fn_t urndis_setmulti; 78 static uether_fn_t urndis_setpromisc; 79 80 static uint32_t urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid, 81 struct rndis_query_req *msg, uint16_t len, 82 const void **rbuf, uint16_t *rbufsz); 83 static uint32_t urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid, 84 struct rndis_set_req *msg, uint16_t len); 85 static uint32_t urndis_ctrl_handle_init(struct urndis_softc *sc, 86 const struct rndis_comp_hdr *hdr); 87 static uint32_t urndis_ctrl_handle_query(struct urndis_softc *sc, 88 const struct rndis_comp_hdr *hdr, const void **buf, 89 uint16_t *bufsz); 90 static uint32_t urndis_ctrl_handle_reset(struct urndis_softc *sc, 91 const struct rndis_comp_hdr *hdr); 92 static uint32_t urndis_ctrl_init(struct urndis_softc *sc); 93 static uint32_t urndis_ctrl_halt(struct urndis_softc *sc); 94 95 #ifdef USB_DEBUG 96 static int urndis_debug = 0; 97 static SYSCTL_NODE(_hw_usb, OID_AUTO, urndis, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 98 "USB RNDIS-Ethernet"); 99 SYSCTL_INT(_hw_usb_urndis, OID_AUTO, debug, CTLFLAG_RWTUN, &urndis_debug, 0, 100 "Debug level"); 101 #endif 102 103 static const struct usb_config urndis_config[URNDIS_N_TRANSFER] = { 104 [URNDIS_BULK_RX] = { 105 .type = UE_BULK, 106 .endpoint = UE_ADDR_ANY, 107 .direction = UE_DIR_RX, 108 .if_index = 0, 109 .frames = 1, 110 .bufsize = RNDIS_RX_MAXLEN, 111 .flags = {.short_xfer_ok = 1,}, 112 .callback = urndis_bulk_read_callback, 113 .timeout = 0, /* no timeout */ 114 .usb_mode = USB_MODE_HOST, 115 }, 116 117 [URNDIS_BULK_TX] = { 118 .type = UE_BULK, 119 .endpoint = UE_ADDR_ANY, 120 .direction = UE_DIR_TX, 121 .if_index = 0, 122 .frames = RNDIS_TX_FRAMES_MAX, 123 .bufsize = (RNDIS_TX_FRAMES_MAX * RNDIS_TX_MAXLEN), 124 .flags = { 125 .force_short_xfer = 1, 126 }, 127 .callback = urndis_bulk_write_callback, 128 .timeout = 10000, /* 10 seconds */ 129 .usb_mode = USB_MODE_HOST, 130 }, 131 132 [URNDIS_INTR_RX] = { 133 .type = UE_INTERRUPT, 134 .endpoint = UE_ADDR_ANY, 135 .direction = UE_DIR_RX, 136 .if_index = 1, 137 .bufsize = 0, /* use wMaxPacketSize */ 138 .flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,}, 139 .callback = urndis_intr_read_callback, 140 .timeout = 0, 141 .usb_mode = USB_MODE_HOST, 142 }, 143 }; 144 145 static device_method_t urndis_methods[] = { 146 /* Device interface */ 147 DEVMETHOD(device_probe, urndis_probe), 148 DEVMETHOD(device_attach, urndis_attach), 149 DEVMETHOD(device_detach, urndis_detach), 150 DEVMETHOD(device_suspend, urndis_suspend), 151 DEVMETHOD(device_resume, urndis_resume), 152 153 DEVMETHOD_END 154 }; 155 156 static driver_t urndis_driver = { 157 .name = "urndis", 158 .methods = urndis_methods, 159 .size = sizeof(struct urndis_softc), 160 }; 161 162 static const STRUCT_USB_HOST_ID urndis_host_devs[] = { 163 /* Generic RNDIS class match */ 164 {USB_IFACE_CLASS(UICLASS_CDC), 165 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL), 166 USB_IFACE_PROTOCOL(0xff)}, 167 {USB_IFACE_CLASS(UICLASS_WIRELESS), USB_IFACE_SUBCLASS(UISUBCLASS_RF), 168 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)}, 169 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(UISUBCLASS_SYNC), 170 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)}, 171 /* HP-WebOS */ 172 {USB_VENDOR(USB_VENDOR_PALM), USB_IFACE_CLASS(UICLASS_CDC), 173 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL), 174 USB_IFACE_PROTOCOL(0xff)}, 175 /* Nokia 7 plus */ 176 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(0x4), 177 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)}, 178 /* Novatel Wireless 8800/8000/etc */ 179 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(0xef), 180 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)}, 181 }; 182 183 DRIVER_MODULE(urndis, uhub, urndis_driver, NULL, NULL); 184 MODULE_VERSION(urndis, 1); 185 MODULE_DEPEND(urndis, uether, 1, 1, 1); 186 MODULE_DEPEND(urndis, usb, 1, 1, 1); 187 MODULE_DEPEND(urndis, ether, 1, 1, 1); 188 USB_PNP_HOST_INFO(urndis_host_devs); 189 190 static const struct usb_ether_methods urndis_ue_methods = { 191 .ue_attach_post = urndis_attach_post, 192 .ue_start = urndis_start, 193 .ue_init = urndis_init, 194 .ue_stop = urndis_stop, 195 .ue_setmulti = urndis_setmulti, 196 .ue_setpromisc = urndis_setpromisc, 197 }; 198 199 static int 200 urndis_probe(device_t dev) 201 { 202 struct usb_attach_arg *uaa = device_get_ivars(dev); 203 204 return (usbd_lookup_id_by_uaa(urndis_host_devs, sizeof(urndis_host_devs), uaa)); 205 } 206 207 static void 208 urndis_attach_post(struct usb_ether *ue) 209 { 210 211 /* no-op */ 212 } 213 214 static int 215 urndis_attach(device_t dev) 216 { 217 union { 218 struct { 219 struct rndis_query_req query; 220 uint8_t addr[ETHER_ADDR_LEN]; 221 } eaddr; 222 struct { 223 struct rndis_set_req set; 224 uint32_t filter; 225 } filter; 226 } msg; 227 struct urndis_softc *sc = device_get_softc(dev); 228 struct usb_ether *ue = &sc->sc_ue; 229 struct usb_attach_arg *uaa = device_get_ivars(dev); 230 struct usb_cdc_cm_descriptor *cmd; 231 const void *buf; 232 uint16_t bufsz; 233 uint8_t iface_index[2] = { uaa->info.bIfaceIndex + 1, uaa->info.bIfaceIndex }; 234 int error; 235 uint8_t i; 236 237 sc->sc_ue.ue_udev = uaa->device; 238 sc->sc_ifaceno_ctl = uaa->info.bIfaceNum; 239 240 cmd = usbd_find_descriptor(uaa->device, NULL, uaa->info.bIfaceIndex, 241 UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_CM, 0xFF); 242 if (cmd != NULL) { 243 DPRINTF("Call Mode Descriptor found, dataif=%d\n", cmd->bDataInterface); 244 iface_index[0] = cmd->bDataInterface; 245 } 246 247 device_set_usb_desc(dev); 248 249 mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF); 250 251 /* scan the alternate settings looking for a valid one */ 252 for (i = 0; i != 32; i++) { 253 error = usbd_set_alt_interface_index(uaa->device, 254 iface_index[0], i); 255 256 if (error != 0) 257 break; 258 259 error = usbd_transfer_setup(uaa->device, 260 iface_index, sc->sc_xfer, urndis_config, 261 URNDIS_N_TRANSFER, sc, &sc->sc_mtx); 262 263 if (error == 0) 264 break; 265 } 266 if ((error != 0) || (i == 32)) { 267 device_printf(dev, "No valid alternate setting found\n"); 268 goto detach; 269 } 270 271 /* Initialize device - must be done before even querying it */ 272 URNDIS_LOCK(sc); 273 error = urndis_ctrl_init(sc); 274 URNDIS_UNLOCK(sc); 275 if (error != (int)RNDIS_STATUS_SUCCESS) { 276 device_printf(dev, "Unable to initialize hardware\n"); 277 goto detach; 278 } 279 280 /* Determine MAC address */ 281 memset(msg.eaddr.addr, 0, sizeof(msg.eaddr.addr)); 282 URNDIS_LOCK(sc); 283 error = urndis_ctrl_query(sc, OID_802_3_PERMANENT_ADDRESS, 284 (struct rndis_query_req *)&msg.eaddr, sizeof(msg.eaddr), 285 &buf, &bufsz); 286 URNDIS_UNLOCK(sc); 287 if (error != (int)RNDIS_STATUS_SUCCESS) { 288 device_printf(dev, "Unable to get hardware address\n"); 289 goto detach; 290 } 291 if (bufsz != ETHER_ADDR_LEN) { 292 device_printf(dev, "Invalid address length: %d bytes\n", bufsz); 293 goto detach; 294 } 295 memcpy(&sc->sc_ue.ue_eaddr, buf, ETHER_ADDR_LEN); 296 297 /* Initialize packet filter */ 298 sc->sc_filter = NDIS_PACKET_TYPE_BROADCAST | 299 NDIS_PACKET_TYPE_ALL_MULTICAST; 300 msg.filter.filter = htole32(sc->sc_filter); 301 URNDIS_LOCK(sc); 302 error = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER, 303 (struct rndis_set_req *)&msg.filter, sizeof(msg.filter)); 304 URNDIS_UNLOCK(sc); 305 if (error != (int)RNDIS_STATUS_SUCCESS) { 306 device_printf(dev, "Unable to set data filters\n"); 307 goto detach; 308 } 309 310 ue->ue_sc = sc; 311 ue->ue_dev = dev; 312 ue->ue_udev = uaa->device; 313 ue->ue_mtx = &sc->sc_mtx; 314 ue->ue_methods = &urndis_ue_methods; 315 316 error = uether_ifattach(ue); 317 if (error) { 318 device_printf(dev, "Could not attach interface\n"); 319 goto detach; 320 } 321 322 URNDIS_LOCK(sc); 323 /* start interrupt endpoint, if any */ 324 usbd_transfer_start(sc->sc_xfer[URNDIS_INTR_RX]); 325 URNDIS_UNLOCK(sc); 326 327 return (0); /* success */ 328 329 detach: 330 (void)urndis_detach(dev); 331 return (ENXIO); /* failure */ 332 } 333 334 static int 335 urndis_detach(device_t dev) 336 { 337 struct urndis_softc *sc = device_get_softc(dev); 338 struct usb_ether *ue = &sc->sc_ue; 339 340 /* stop all USB transfers first */ 341 usbd_transfer_unsetup(sc->sc_xfer, URNDIS_N_TRANSFER); 342 343 uether_ifdetach(ue); 344 345 URNDIS_LOCK(sc); 346 (void)urndis_ctrl_halt(sc); 347 URNDIS_UNLOCK(sc); 348 349 mtx_destroy(&sc->sc_mtx); 350 351 return (0); 352 } 353 354 static void 355 urndis_start(struct usb_ether *ue) 356 { 357 struct urndis_softc *sc = uether_getsc(ue); 358 359 /* 360 * Start the USB transfers, if not already started: 361 */ 362 usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_TX]); 363 usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_RX]); 364 } 365 366 static void 367 urndis_init(struct usb_ether *ue) 368 { 369 struct urndis_softc *sc = uether_getsc(ue); 370 if_t ifp = uether_getifp(ue); 371 372 URNDIS_LOCK_ASSERT(sc, MA_OWNED); 373 374 if_setdrvflagbits(ifp, IFF_DRV_RUNNING, 0); 375 376 /* stall data write direction, which depends on USB mode */ 377 usbd_xfer_set_stall(sc->sc_xfer[URNDIS_BULK_TX]); 378 379 /* start data transfers */ 380 urndis_start(ue); 381 } 382 383 static void 384 urndis_stop(struct usb_ether *ue) 385 { 386 struct urndis_softc *sc = uether_getsc(ue); 387 if_t ifp = uether_getifp(ue); 388 389 URNDIS_LOCK_ASSERT(sc, MA_OWNED); 390 391 if_setdrvflagbits(ifp, 0, IFF_DRV_RUNNING); 392 393 /* 394 * stop all the transfers, if not already stopped: 395 */ 396 usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_RX]); 397 usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_TX]); 398 } 399 400 static void 401 urndis_setmulti(struct usb_ether *ue) 402 { 403 404 /* no-op */ 405 } 406 407 static void 408 urndis_setpromisc(struct usb_ether *ue) 409 { 410 411 /* no-op */ 412 } 413 414 static int 415 urndis_suspend(device_t dev) 416 { 417 418 device_printf(dev, "Suspending\n"); 419 return (0); 420 } 421 422 static int 423 urndis_resume(device_t dev) 424 { 425 426 device_printf(dev, "Resuming\n"); 427 return (0); 428 } 429 430 static usb_error_t 431 urndis_ctrl_msg(struct urndis_softc *sc, uint8_t rt, uint8_t r, 432 uint16_t index, uint16_t value, void *buf, uint16_t buflen) 433 { 434 usb_device_request_t req; 435 436 req.bmRequestType = rt; 437 req.bRequest = r; 438 USETW(req.wValue, value); 439 USETW(req.wIndex, index); 440 USETW(req.wLength, buflen); 441 442 return (usbd_do_request_flags(sc->sc_ue.ue_udev, 443 &sc->sc_mtx, &req, buf, (rt & UT_READ) ? 444 USB_SHORT_XFER_OK : 0, NULL, 2000 /* ms */ )); 445 } 446 447 static usb_error_t 448 urndis_ctrl_send(struct urndis_softc *sc, void *buf, uint16_t len) 449 { 450 usb_error_t err; 451 452 err = urndis_ctrl_msg(sc, UT_WRITE_CLASS_INTERFACE, 453 UCDC_SEND_ENCAPSULATED_COMMAND, sc->sc_ifaceno_ctl, 0, buf, len); 454 455 DPRINTF("%s\n", usbd_errstr(err)); 456 457 return (err); 458 } 459 460 static struct rndis_comp_hdr * 461 urndis_ctrl_recv(struct urndis_softc *sc) 462 { 463 struct rndis_comp_hdr *hdr; 464 usb_error_t err; 465 466 err = urndis_ctrl_msg(sc, UT_READ_CLASS_INTERFACE, 467 UCDC_GET_ENCAPSULATED_RESPONSE, sc->sc_ifaceno_ctl, 0, 468 sc->sc_response_buf, RNDIS_RESPONSE_LEN); 469 470 if (err != USB_ERR_NORMAL_COMPLETION) 471 return (NULL); 472 473 hdr = (struct rndis_comp_hdr *)sc->sc_response_buf; 474 475 DPRINTF("type 0x%x len %u\n", le32toh(hdr->rm_type), 476 le32toh(hdr->rm_len)); 477 478 if (le32toh(hdr->rm_len) > RNDIS_RESPONSE_LEN) { 479 DPRINTF("ctrl message error: wrong size %u > %u\n", 480 le32toh(hdr->rm_len), RNDIS_RESPONSE_LEN); 481 return (NULL); 482 } 483 return (hdr); 484 } 485 486 static uint32_t 487 urndis_ctrl_handle(struct urndis_softc *sc, struct rndis_comp_hdr *hdr, 488 const void **buf, uint16_t *bufsz) 489 { 490 uint32_t rval; 491 492 DPRINTF("\n"); 493 494 if (buf != NULL && bufsz != NULL) { 495 *buf = NULL; 496 *bufsz = 0; 497 } 498 switch (le32toh(hdr->rm_type)) { 499 case REMOTE_NDIS_INITIALIZE_CMPLT: 500 rval = urndis_ctrl_handle_init(sc, hdr); 501 break; 502 503 case REMOTE_NDIS_QUERY_CMPLT: 504 rval = urndis_ctrl_handle_query(sc, hdr, buf, bufsz); 505 break; 506 507 case REMOTE_NDIS_RESET_CMPLT: 508 rval = urndis_ctrl_handle_reset(sc, hdr); 509 break; 510 511 case REMOTE_NDIS_KEEPALIVE_CMPLT: 512 case REMOTE_NDIS_SET_CMPLT: 513 rval = le32toh(hdr->rm_status); 514 break; 515 516 default: 517 device_printf(sc->sc_ue.ue_dev, 518 "ctrl message error: unknown event 0x%x\n", 519 le32toh(hdr->rm_type)); 520 rval = RNDIS_STATUS_FAILURE; 521 break; 522 } 523 return (rval); 524 } 525 526 static uint32_t 527 urndis_ctrl_handle_init(struct urndis_softc *sc, 528 const struct rndis_comp_hdr *hdr) 529 { 530 const struct rndis_init_comp *msg; 531 532 msg = (const struct rndis_init_comp *)hdr; 533 534 DPRINTF("len %u rid %u status 0x%x " 535 "ver_major %u ver_minor %u devflags 0x%x medium 0x%x pktmaxcnt %u " 536 "pktmaxsz %u align %u aflistoffset %u aflistsz %u\n", 537 le32toh(msg->rm_len), 538 le32toh(msg->rm_rid), 539 le32toh(msg->rm_status), 540 le32toh(msg->rm_ver_major), 541 le32toh(msg->rm_ver_minor), 542 le32toh(msg->rm_devflags), 543 le32toh(msg->rm_medium), 544 le32toh(msg->rm_pktmaxcnt), 545 le32toh(msg->rm_pktmaxsz), 546 le32toh(msg->rm_align), 547 le32toh(msg->rm_aflistoffset), 548 le32toh(msg->rm_aflistsz)); 549 550 if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) { 551 DPRINTF("init failed 0x%x\n", le32toh(msg->rm_status)); 552 return (le32toh(msg->rm_status)); 553 } 554 if (le32toh(msg->rm_devflags) != RNDIS_DF_CONNECTIONLESS) { 555 DPRINTF("wrong device type (current type: 0x%x)\n", 556 le32toh(msg->rm_devflags)); 557 return (RNDIS_STATUS_FAILURE); 558 } 559 if (le32toh(msg->rm_medium) != RNDIS_MEDIUM_802_3) { 560 DPRINTF("medium not 802.3 (current medium: 0x%x)\n", 561 le32toh(msg->rm_medium)); 562 return (RNDIS_STATUS_FAILURE); 563 } 564 sc->sc_lim_pktsz = le32toh(msg->rm_pktmaxsz); 565 566 return (le32toh(msg->rm_status)); 567 } 568 569 static uint32_t 570 urndis_ctrl_handle_query(struct urndis_softc *sc, 571 const struct rndis_comp_hdr *hdr, const void **buf, uint16_t *bufsz) 572 { 573 const struct rndis_query_comp *msg; 574 uint64_t limit; 575 576 msg = (const struct rndis_query_comp *)hdr; 577 578 DPRINTF("len %u rid %u status 0x%x " 579 "buflen %u bufoff %u\n", 580 le32toh(msg->rm_len), 581 le32toh(msg->rm_rid), 582 le32toh(msg->rm_status), 583 le32toh(msg->rm_infobuflen), 584 le32toh(msg->rm_infobufoffset)); 585 586 *buf = NULL; 587 *bufsz = 0; 588 if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) { 589 DPRINTF("query failed 0x%x\n", le32toh(msg->rm_status)); 590 return (le32toh(msg->rm_status)); 591 } 592 limit = le32toh(msg->rm_infobuflen); 593 limit += le32toh(msg->rm_infobufoffset); 594 limit += RNDIS_HEADER_OFFSET; 595 596 if (limit > (uint64_t)le32toh(msg->rm_len)) { 597 DPRINTF("ctrl message error: invalid query info " 598 "len/offset/end_position(%u/%u/%u) -> " 599 "go out of buffer limit %u\n", 600 le32toh(msg->rm_infobuflen), 601 le32toh(msg->rm_infobufoffset), 602 le32toh(msg->rm_infobuflen) + 603 le32toh(msg->rm_infobufoffset) + RNDIS_HEADER_OFFSET, 604 le32toh(msg->rm_len)); 605 return (RNDIS_STATUS_FAILURE); 606 } 607 *buf = ((const uint8_t *)msg) + RNDIS_HEADER_OFFSET + 608 le32toh(msg->rm_infobufoffset); 609 *bufsz = le32toh(msg->rm_infobuflen); 610 611 return (le32toh(msg->rm_status)); 612 } 613 614 static uint32_t 615 urndis_ctrl_handle_reset(struct urndis_softc *sc, 616 const struct rndis_comp_hdr *hdr) 617 { 618 const struct rndis_reset_comp *msg; 619 uint32_t rval; 620 621 msg = (const struct rndis_reset_comp *)hdr; 622 623 rval = le32toh(msg->rm_status); 624 625 DPRINTF("len %u status 0x%x " 626 "adrreset %u\n", 627 le32toh(msg->rm_len), 628 rval, 629 le32toh(msg->rm_adrreset)); 630 631 if (rval != RNDIS_STATUS_SUCCESS) { 632 DPRINTF("reset failed 0x%x\n", rval); 633 return (rval); 634 } 635 if (msg->rm_adrreset != 0) { 636 struct { 637 struct rndis_set_req hdr; 638 uint32_t filter; 639 } msg_filter; 640 641 msg_filter.filter = htole32(sc->sc_filter); 642 643 rval = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER, 644 (struct rndis_set_req *)&msg_filter, sizeof(msg_filter)); 645 646 if (rval != RNDIS_STATUS_SUCCESS) { 647 DPRINTF("unable to reset data filters\n"); 648 return (rval); 649 } 650 } 651 return (rval); 652 } 653 654 static uint32_t 655 urndis_ctrl_init(struct urndis_softc *sc) 656 { 657 struct rndis_init_req msg; 658 struct rndis_comp_hdr *hdr; 659 uint32_t rval; 660 661 msg.rm_type = htole32(REMOTE_NDIS_INITIALIZE_MSG); 662 msg.rm_len = htole32(sizeof(msg)); 663 msg.rm_rid = 0; 664 msg.rm_ver_major = htole32(RNDIS_VERSION_MAJOR); 665 msg.rm_ver_minor = htole32(1); 666 msg.rm_max_xfersz = htole32(RNDIS_RX_MAXLEN); 667 668 DPRINTF("type %u len %u rid %u ver_major %u " 669 "ver_minor %u max_xfersz %u\n", 670 le32toh(msg.rm_type), 671 le32toh(msg.rm_len), 672 le32toh(msg.rm_rid), 673 le32toh(msg.rm_ver_major), 674 le32toh(msg.rm_ver_minor), 675 le32toh(msg.rm_max_xfersz)); 676 677 rval = urndis_ctrl_send(sc, &msg, sizeof(msg)); 678 679 if (rval != RNDIS_STATUS_SUCCESS) { 680 DPRINTF("init failed\n"); 681 return (rval); 682 } 683 if ((hdr = urndis_ctrl_recv(sc)) == NULL) { 684 DPRINTF("unable to get init response\n"); 685 return (RNDIS_STATUS_FAILURE); 686 } 687 rval = urndis_ctrl_handle(sc, hdr, NULL, NULL); 688 689 return (rval); 690 } 691 692 static uint32_t 693 urndis_ctrl_halt(struct urndis_softc *sc) 694 { 695 struct rndis_halt_req msg; 696 uint32_t rval; 697 698 msg.rm_type = htole32(REMOTE_NDIS_HALT_MSG); 699 msg.rm_len = htole32(sizeof(msg)); 700 msg.rm_rid = 0; 701 702 DPRINTF("type %u len %u rid %u\n", 703 le32toh(msg.rm_type), 704 le32toh(msg.rm_len), 705 le32toh(msg.rm_rid)); 706 707 rval = urndis_ctrl_send(sc, &msg, sizeof(msg)); 708 709 if (rval != RNDIS_STATUS_SUCCESS) 710 DPRINTF("halt failed\n"); 711 712 return (rval); 713 } 714 715 /* 716 * NB: Querying a device has the requirement of using an input buffer the size 717 * of the expected reply or larger, except for variably sized replies. 718 */ 719 static uint32_t 720 urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid, 721 struct rndis_query_req *msg, uint16_t len, const void **rbuf, 722 uint16_t *rbufsz) 723 { 724 struct rndis_comp_hdr *hdr; 725 uint32_t datalen, rval; 726 727 msg->rm_type = htole32(REMOTE_NDIS_QUERY_MSG); 728 msg->rm_len = htole32(len); 729 msg->rm_rid = 0; /* XXX */ 730 msg->rm_oid = htole32(oid); 731 datalen = len - sizeof(*msg); 732 msg->rm_infobuflen = htole32(datalen); 733 if (datalen != 0) { 734 msg->rm_infobufoffset = htole32(sizeof(*msg) - 735 RNDIS_HEADER_OFFSET); 736 } else { 737 msg->rm_infobufoffset = 0; 738 } 739 msg->rm_devicevchdl = 0; 740 741 DPRINTF("type %u len %u rid %u oid 0x%x " 742 "infobuflen %u infobufoffset %u devicevchdl %u\n", 743 le32toh(msg->rm_type), 744 le32toh(msg->rm_len), 745 le32toh(msg->rm_rid), 746 le32toh(msg->rm_oid), 747 le32toh(msg->rm_infobuflen), 748 le32toh(msg->rm_infobufoffset), 749 le32toh(msg->rm_devicevchdl)); 750 751 rval = urndis_ctrl_send(sc, msg, len); 752 753 if (rval != RNDIS_STATUS_SUCCESS) { 754 DPRINTF("query failed\n"); 755 return (rval); 756 } 757 if ((hdr = urndis_ctrl_recv(sc)) == NULL) { 758 DPRINTF("unable to get query response\n"); 759 return (RNDIS_STATUS_FAILURE); 760 } 761 rval = urndis_ctrl_handle(sc, hdr, rbuf, rbufsz); 762 763 return (rval); 764 } 765 766 static uint32_t 767 urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid, 768 struct rndis_set_req *msg, uint16_t len) 769 { 770 struct rndis_comp_hdr *hdr; 771 uint32_t datalen, rval; 772 773 msg->rm_type = htole32(REMOTE_NDIS_SET_MSG); 774 msg->rm_len = htole32(len); 775 msg->rm_rid = 0; /* XXX */ 776 msg->rm_oid = htole32(oid); 777 datalen = len - sizeof(*msg); 778 msg->rm_infobuflen = htole32(datalen); 779 if (datalen != 0) { 780 msg->rm_infobufoffset = htole32(sizeof(*msg) - 781 RNDIS_HEADER_OFFSET); 782 } else { 783 msg->rm_infobufoffset = 0; 784 } 785 msg->rm_devicevchdl = 0; 786 787 DPRINTF("type %u len %u rid %u oid 0x%x " 788 "infobuflen %u infobufoffset %u devicevchdl %u\n", 789 le32toh(msg->rm_type), 790 le32toh(msg->rm_len), 791 le32toh(msg->rm_rid), 792 le32toh(msg->rm_oid), 793 le32toh(msg->rm_infobuflen), 794 le32toh(msg->rm_infobufoffset), 795 le32toh(msg->rm_devicevchdl)); 796 797 rval = urndis_ctrl_send(sc, msg, len); 798 799 if (rval != RNDIS_STATUS_SUCCESS) { 800 DPRINTF("set failed\n"); 801 return (rval); 802 } 803 if ((hdr = urndis_ctrl_recv(sc)) == NULL) { 804 DPRINTF("unable to get set response\n"); 805 return (RNDIS_STATUS_FAILURE); 806 } 807 rval = urndis_ctrl_handle(sc, hdr, NULL, NULL); 808 if (rval != RNDIS_STATUS_SUCCESS) 809 DPRINTF("set failed 0x%x\n", rval); 810 811 return (rval); 812 } 813 814 static void 815 urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error) 816 { 817 struct urndis_softc *sc = usbd_xfer_softc(xfer); 818 struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, 0); 819 if_t ifp = uether_getifp(&sc->sc_ue); 820 struct rndis_packet_msg msg; 821 struct mbuf *m; 822 int actlen; 823 int aframes; 824 int offset; 825 826 switch (USB_GET_STATE(xfer)) { 827 case USB_ST_TRANSFERRED: 828 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL); 829 830 DPRINTFN(1, "received %u bytes in %u frames\n", actlen, aframes); 831 832 for (offset = 0; actlen >= (uint32_t)sizeof(msg);) { 833 /* copy out header */ 834 usbd_copy_out(pc, offset, &msg, sizeof(msg)); 835 836 if (le32toh(0x1234567U) != 0x1234567U) { 837 /* swap endianness */ 838 msg.rm_type = le32toh(msg.rm_type); 839 msg.rm_len = le32toh(msg.rm_len); 840 msg.rm_dataoffset = le32toh(msg.rm_dataoffset); 841 msg.rm_datalen = le32toh(msg.rm_datalen); 842 msg.rm_oobdataoffset = le32toh(msg.rm_oobdataoffset); 843 msg.rm_oobdatalen = le32toh(msg.rm_oobdatalen); 844 msg.rm_oobdataelements = le32toh(msg.rm_oobdataelements); 845 msg.rm_pktinfooffset = le32toh(msg.rm_pktinfooffset); 846 msg.rm_pktinfolen = le32toh(msg.rm_pktinfolen); 847 msg.rm_vchandle = le32toh(msg.rm_vchandle); 848 msg.rm_reserved = le32toh(msg.rm_reserved); 849 } 850 851 DPRINTF("len %u data(off:%u len:%u) " 852 "oobdata(off:%u len:%u nb:%u) perpacket(off:%u len:%u)\n", 853 msg.rm_len, msg.rm_dataoffset, msg.rm_datalen, 854 msg.rm_oobdataoffset, msg.rm_oobdatalen, 855 msg.rm_oobdataelements, msg.rm_pktinfooffset, 856 msg.rm_pktinfooffset); 857 858 /* sanity check the RNDIS header */ 859 if (msg.rm_type != REMOTE_NDIS_PACKET_MSG) { 860 DPRINTF("invalid type 0x%x != 0x%x\n", 861 msg.rm_type, REMOTE_NDIS_PACKET_MSG); 862 goto tr_setup; 863 } else if (msg.rm_len < (uint32_t)sizeof(msg)) { 864 DPRINTF("invalid msg len %u < %u\n", 865 msg.rm_len, (unsigned)sizeof(msg)); 866 goto tr_setup; 867 } else if (msg.rm_len > (uint32_t)actlen) { 868 DPRINTF("invalid msg len %u > buffer " 869 "len %u\n", msg.rm_len, actlen); 870 goto tr_setup; 871 } else if (msg.rm_dataoffset >= (uint32_t)actlen) { 872 DPRINTF("invalid msg dataoffset %u > buffer " 873 "dataoffset %u\n", msg.rm_dataoffset, actlen); 874 goto tr_setup; 875 } else if (msg.rm_datalen > (uint32_t)actlen) { 876 DPRINTF("invalid msg datalen %u > buffer " 877 "datalen %u\n", msg.rm_datalen, actlen); 878 goto tr_setup; 879 } else if ((msg.rm_dataoffset + msg.rm_datalen + 880 (uint32_t)__offsetof(struct rndis_packet_msg, 881 rm_dataoffset)) > (uint32_t)actlen) { 882 DPRINTF("invalid dataoffset %u larger than %u\n", 883 msg.rm_dataoffset + msg.rm_datalen + 884 (uint32_t)__offsetof(struct rndis_packet_msg, 885 rm_dataoffset), actlen); 886 goto tr_setup; 887 } else if (msg.rm_datalen < (uint32_t)sizeof(struct ether_header)) { 888 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1); 889 DPRINTF("invalid ethernet size " 890 "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header)); 891 goto tr_setup; 892 } else if (msg.rm_datalen > (uint32_t)(MCLBYTES - ETHER_ALIGN)) { 893 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1); 894 DPRINTF("invalid ethernet size " 895 "%u > %u\n", 896 msg.rm_datalen, (unsigned)MCLBYTES); 897 goto tr_setup; 898 } else if (msg.rm_datalen > (uint32_t)(MHLEN - ETHER_ALIGN)) { 899 m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR); 900 } else { 901 m = m_gethdr(M_NOWAIT, MT_DATA); 902 } 903 904 /* check if we have a buffer */ 905 if (m != NULL) { 906 m->m_len = m->m_pkthdr.len = msg.rm_datalen + ETHER_ALIGN; 907 m_adj(m, ETHER_ALIGN); 908 909 usbd_copy_out(pc, offset + msg.rm_dataoffset + 910 __offsetof(struct rndis_packet_msg, 911 rm_dataoffset), m->m_data, msg.rm_datalen); 912 913 /* enqueue */ 914 uether_rxmbuf(&sc->sc_ue, m, msg.rm_datalen); 915 } else { 916 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1); 917 } 918 offset += msg.rm_len; 919 actlen -= msg.rm_len; 920 } 921 922 case USB_ST_SETUP: 923 tr_setup: 924 usbd_xfer_set_frame_len(xfer, 0, RNDIS_RX_MAXLEN); 925 usbd_xfer_set_frames(xfer, 1); 926 usbd_transfer_submit(xfer); 927 uether_rxflush(&sc->sc_ue); /* must be last */ 928 break; 929 930 default: /* Error */ 931 DPRINTFN(1, "error = %s\n", usbd_errstr(error)); 932 933 if (error != USB_ERR_CANCELLED) { 934 /* try to clear stall first */ 935 usbd_xfer_set_stall(xfer); 936 usbd_xfer_set_frames(xfer, 0); 937 usbd_transfer_submit(xfer); 938 } 939 break; 940 } 941 } 942 943 static void 944 urndis_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error) 945 { 946 struct rndis_packet_msg msg; 947 struct urndis_softc *sc = usbd_xfer_softc(xfer); 948 if_t ifp = uether_getifp(&sc->sc_ue); 949 struct mbuf *m; 950 unsigned x; 951 int actlen; 952 int aframes; 953 954 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL); 955 956 DPRINTFN(1, "\n"); 957 958 switch (USB_GET_STATE(xfer)) { 959 case USB_ST_TRANSFERRED: 960 DPRINTFN(11, "%u bytes in %u frames\n", actlen, aframes); 961 962 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1); 963 964 /* FALLTHROUGH */ 965 case USB_ST_SETUP: 966 tr_setup: 967 memset(&msg, 0, sizeof(msg)); 968 969 for (x = 0; x != RNDIS_TX_FRAMES_MAX; x++) { 970 struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, x); 971 972 usbd_xfer_set_frame_offset(xfer, x * RNDIS_TX_MAXLEN, x); 973 974 next_pkt: 975 m = if_dequeue(ifp); 976 977 if (m == NULL) 978 break; 979 980 if ((m->m_pkthdr.len + sizeof(msg)) > RNDIS_TX_MAXLEN) { 981 DPRINTF("Too big packet\n"); 982 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1); 983 984 /* Free buffer */ 985 m_freem(m); 986 goto next_pkt; 987 } 988 msg.rm_type = htole32(REMOTE_NDIS_PACKET_MSG); 989 msg.rm_len = htole32(sizeof(msg) + m->m_pkthdr.len); 990 991 msg.rm_dataoffset = htole32(RNDIS_DATA_OFFSET); 992 msg.rm_datalen = htole32(m->m_pkthdr.len); 993 994 /* copy in all data */ 995 usbd_copy_in(pc, 0, &msg, sizeof(msg)); 996 usbd_m_copy_in(pc, sizeof(msg), m, 0, m->m_pkthdr.len); 997 usbd_xfer_set_frame_len(xfer, x, sizeof(msg) + m->m_pkthdr.len); 998 999 /* 1000 * If there's a BPF listener, bounce a copy of 1001 * this frame to him: 1002 */ 1003 BPF_MTAP(ifp, m); 1004 1005 /* Free buffer */ 1006 m_freem(m); 1007 } 1008 if (x != 0) { 1009 usbd_xfer_set_frames(xfer, x); 1010 usbd_transfer_submit(xfer); 1011 } 1012 break; 1013 1014 default: /* Error */ 1015 DPRINTFN(11, "transfer error, %s\n", usbd_errstr(error)); 1016 1017 /* count output errors */ 1018 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1); 1019 1020 if (error != USB_ERR_CANCELLED) { 1021 /* try to clear stall first */ 1022 usbd_xfer_set_stall(xfer); 1023 goto tr_setup; 1024 } 1025 break; 1026 } 1027 } 1028 1029 static void 1030 urndis_intr_read_callback(struct usb_xfer *xfer, usb_error_t error) 1031 { 1032 int actlen; 1033 1034 usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL); 1035 1036 switch (USB_GET_STATE(xfer)) { 1037 case USB_ST_TRANSFERRED: 1038 1039 DPRINTF("Received %d bytes\n", actlen); 1040 1041 /* TODO: decode some indications */ 1042 1043 /* FALLTHROUGH */ 1044 case USB_ST_SETUP: 1045 tr_setup: 1046 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer)); 1047 usbd_transfer_submit(xfer); 1048 break; 1049 1050 default: /* Error */ 1051 if (error != USB_ERR_CANCELLED) { 1052 /* start clear stall */ 1053 usbd_xfer_set_stall(xfer); 1054 goto tr_setup; 1055 } 1056 break; 1057 } 1058 } 1059