1 /* $OpenBSD: if_urndis.c,v 1.46 2013/12/09 15:45:29 pirofti Exp $ */
2
3 /*
4 * Copyright (c) 2010 Jonathan Armani <armani@openbsd.org>
5 * Copyright (c) 2010 Fabien Romano <fabien@openbsd.org>
6 * Copyright (c) 2010 Michael Knudsen <mk@openbsd.org>
7 * Copyright (c) 2014 Hans Petter Selasky <hselasky@freebsd.org>
8 * All rights reserved.
9 *
10 * Permission to use, copy, modify, and distribute this software for any
11 * purpose with or without fee is hereby granted, provided that the above
12 * copyright notice and this permission notice appear in all copies.
13 *
14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 */
22
23 #include <sys/stdint.h>
24 #include <sys/stddef.h>
25 #include <sys/param.h>
26 #include <sys/queue.h>
27 #include <sys/types.h>
28 #include <sys/systm.h>
29 #include <sys/socket.h>
30 #include <sys/kernel.h>
31 #include <sys/bus.h>
32 #include <sys/module.h>
33 #include <sys/lock.h>
34 #include <sys/mutex.h>
35 #include <sys/condvar.h>
36 #include <sys/sysctl.h>
37 #include <sys/sx.h>
38 #include <sys/unistd.h>
39 #include <sys/callout.h>
40 #include <sys/malloc.h>
41 #include <sys/priv.h>
42
43 #include <net/if.h>
44 #include <net/if_var.h>
45 #include <net/rndis.h>
46
47 #include <dev/usb/usb.h>
48 #include <dev/usb/usbdi.h>
49 #include <dev/usb/usbdi_util.h>
50 #include "usbdevs.h"
51
52 #define USB_DEBUG_VAR urndis_debug
53 #include <dev/usb/usb_debug.h>
54 #include <dev/usb/usb_process.h>
55 #include "usb_if.h"
56
57 #include <dev/usb/net/usb_ethernet.h>
58 #include <dev/usb/net/if_urndisreg.h>
59
60 #include <dev/usb/usb_cdc.h>
61
62 static device_probe_t urndis_probe;
63 static device_attach_t urndis_attach;
64 static device_detach_t urndis_detach;
65 static device_suspend_t urndis_suspend;
66 static device_resume_t urndis_resume;
67
68 static usb_callback_t urndis_bulk_write_callback;
69 static usb_callback_t urndis_bulk_read_callback;
70 static usb_callback_t urndis_intr_read_callback;
71
72 static uether_fn_t urndis_attach_post;
73 static uether_fn_t urndis_init;
74 static uether_fn_t urndis_stop;
75 static uether_fn_t urndis_start;
76 static uether_fn_t urndis_setmulti;
77 static uether_fn_t urndis_setpromisc;
78
79 static uint32_t urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid,
80 struct rndis_query_req *msg, uint16_t len,
81 const void **rbuf, uint16_t *rbufsz);
82 static uint32_t urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid,
83 struct rndis_set_req *msg, uint16_t len);
84 static uint32_t urndis_ctrl_handle_init(struct urndis_softc *sc,
85 const struct rndis_comp_hdr *hdr);
86 static uint32_t urndis_ctrl_handle_query(struct urndis_softc *sc,
87 const struct rndis_comp_hdr *hdr, const void **buf,
88 uint16_t *bufsz);
89 static uint32_t urndis_ctrl_handle_reset(struct urndis_softc *sc,
90 const struct rndis_comp_hdr *hdr);
91 static uint32_t urndis_ctrl_init(struct urndis_softc *sc);
92 static uint32_t urndis_ctrl_halt(struct urndis_softc *sc);
93
94 #ifdef USB_DEBUG
95 static int urndis_debug = 0;
96 static SYSCTL_NODE(_hw_usb, OID_AUTO, urndis, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
97 "USB RNDIS-Ethernet");
98 SYSCTL_INT(_hw_usb_urndis, OID_AUTO, debug, CTLFLAG_RWTUN, &urndis_debug, 0,
99 "Debug level");
100 #endif
101
102 static const struct usb_config urndis_config[URNDIS_N_TRANSFER] = {
103 [URNDIS_BULK_RX] = {
104 .type = UE_BULK,
105 .endpoint = UE_ADDR_ANY,
106 .direction = UE_DIR_RX,
107 .if_index = 0,
108 .frames = 1,
109 .bufsize = RNDIS_RX_MAXLEN,
110 .flags = {.short_xfer_ok = 1,},
111 .callback = urndis_bulk_read_callback,
112 .timeout = 0, /* no timeout */
113 .usb_mode = USB_MODE_HOST,
114 },
115
116 [URNDIS_BULK_TX] = {
117 .type = UE_BULK,
118 .endpoint = UE_ADDR_ANY,
119 .direction = UE_DIR_TX,
120 .if_index = 0,
121 .frames = RNDIS_TX_FRAMES_MAX,
122 .bufsize = (RNDIS_TX_FRAMES_MAX * RNDIS_TX_MAXLEN),
123 .flags = {
124 .force_short_xfer = 1,
125 },
126 .callback = urndis_bulk_write_callback,
127 .timeout = 10000, /* 10 seconds */
128 .usb_mode = USB_MODE_HOST,
129 },
130
131 [URNDIS_INTR_RX] = {
132 .type = UE_INTERRUPT,
133 .endpoint = UE_ADDR_ANY,
134 .direction = UE_DIR_RX,
135 .if_index = 1,
136 .bufsize = 0, /* use wMaxPacketSize */
137 .flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
138 .callback = urndis_intr_read_callback,
139 .timeout = 0,
140 .usb_mode = USB_MODE_HOST,
141 },
142 };
143
144 static device_method_t urndis_methods[] = {
145 /* Device interface */
146 DEVMETHOD(device_probe, urndis_probe),
147 DEVMETHOD(device_attach, urndis_attach),
148 DEVMETHOD(device_detach, urndis_detach),
149 DEVMETHOD(device_suspend, urndis_suspend),
150 DEVMETHOD(device_resume, urndis_resume),
151
152 DEVMETHOD_END
153 };
154
155 static driver_t urndis_driver = {
156 .name = "urndis",
157 .methods = urndis_methods,
158 .size = sizeof(struct urndis_softc),
159 };
160
161 static const STRUCT_USB_HOST_ID urndis_host_devs[] = {
162 /* Generic RNDIS class match */
163 {USB_IFACE_CLASS(UICLASS_CDC),
164 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL),
165 USB_IFACE_PROTOCOL(0xff)},
166 {USB_IFACE_CLASS(UICLASS_WIRELESS), USB_IFACE_SUBCLASS(UISUBCLASS_RF),
167 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)},
168 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(UISUBCLASS_SYNC),
169 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)},
170 /* HP-WebOS */
171 {USB_VENDOR(USB_VENDOR_PALM), USB_IFACE_CLASS(UICLASS_CDC),
172 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL),
173 USB_IFACE_PROTOCOL(0xff)},
174 /* Nokia 7 plus */
175 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(0x4),
176 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)},
177 /* Novatel Wireless 8800/8000/etc */
178 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(0xef),
179 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)},
180 };
181
182 DRIVER_MODULE(urndis, uhub, urndis_driver, NULL, NULL);
183 MODULE_VERSION(urndis, 1);
184 MODULE_DEPEND(urndis, uether, 1, 1, 1);
185 MODULE_DEPEND(urndis, usb, 1, 1, 1);
186 MODULE_DEPEND(urndis, ether, 1, 1, 1);
187 USB_PNP_HOST_INFO(urndis_host_devs);
188
189 static const struct usb_ether_methods urndis_ue_methods = {
190 .ue_attach_post = urndis_attach_post,
191 .ue_start = urndis_start,
192 .ue_init = urndis_init,
193 .ue_stop = urndis_stop,
194 .ue_setmulti = urndis_setmulti,
195 .ue_setpromisc = urndis_setpromisc,
196 };
197
198 static int
urndis_probe(device_t dev)199 urndis_probe(device_t dev)
200 {
201 struct usb_attach_arg *uaa = device_get_ivars(dev);
202
203 return (usbd_lookup_id_by_uaa(urndis_host_devs, sizeof(urndis_host_devs), uaa));
204 }
205
206 static void
urndis_attach_post(struct usb_ether * ue)207 urndis_attach_post(struct usb_ether *ue)
208 {
209
210 /* no-op */
211 }
212
213 static int
urndis_attach(device_t dev)214 urndis_attach(device_t dev)
215 {
216 union {
217 struct {
218 struct rndis_query_req query;
219 uint8_t addr[ETHER_ADDR_LEN];
220 } eaddr;
221 struct {
222 struct rndis_set_req set;
223 uint32_t filter;
224 } filter;
225 } msg;
226 struct urndis_softc *sc = device_get_softc(dev);
227 struct usb_ether *ue = &sc->sc_ue;
228 struct usb_attach_arg *uaa = device_get_ivars(dev);
229 struct usb_cdc_cm_descriptor *cmd;
230 const void *buf;
231 uint16_t bufsz;
232 uint8_t iface_index[2] = { uaa->info.bIfaceIndex + 1, uaa->info.bIfaceIndex };
233 int error;
234 uint8_t i;
235
236 sc->sc_ue.ue_udev = uaa->device;
237 sc->sc_ifaceno_ctl = uaa->info.bIfaceNum;
238
239 cmd = usbd_find_descriptor(uaa->device, NULL, uaa->info.bIfaceIndex,
240 UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_CM, 0xFF);
241 if (cmd != NULL) {
242 DPRINTF("Call Mode Descriptor found, dataif=%d\n", cmd->bDataInterface);
243 iface_index[0] = cmd->bDataInterface;
244 }
245
246 device_set_usb_desc(dev);
247
248 mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF);
249
250 /* scan the alternate settings looking for a valid one */
251 for (i = 0; i != 32; i++) {
252 error = usbd_set_alt_interface_index(uaa->device,
253 iface_index[0], i);
254
255 if (error != 0)
256 break;
257
258 error = usbd_transfer_setup(uaa->device,
259 iface_index, sc->sc_xfer, urndis_config,
260 URNDIS_N_TRANSFER, sc, &sc->sc_mtx);
261
262 if (error == 0)
263 break;
264 }
265 if ((error != 0) || (i == 32)) {
266 device_printf(dev, "No valid alternate setting found\n");
267 goto detach;
268 }
269
270 /* Initialize device - must be done before even querying it */
271 URNDIS_LOCK(sc);
272 error = urndis_ctrl_init(sc);
273 URNDIS_UNLOCK(sc);
274 if (error != (int)RNDIS_STATUS_SUCCESS) {
275 device_printf(dev, "Unable to initialize hardware\n");
276 goto detach;
277 }
278
279 /* Determine MAC address */
280 memset(msg.eaddr.addr, 0, sizeof(msg.eaddr.addr));
281 URNDIS_LOCK(sc);
282 error = urndis_ctrl_query(sc, OID_802_3_PERMANENT_ADDRESS,
283 (struct rndis_query_req *)&msg.eaddr, sizeof(msg.eaddr),
284 &buf, &bufsz);
285 URNDIS_UNLOCK(sc);
286 if (error != (int)RNDIS_STATUS_SUCCESS) {
287 device_printf(dev, "Unable to get hardware address\n");
288 goto detach;
289 }
290 if (bufsz != ETHER_ADDR_LEN) {
291 device_printf(dev, "Invalid address length: %d bytes\n", bufsz);
292 goto detach;
293 }
294 memcpy(&sc->sc_ue.ue_eaddr, buf, ETHER_ADDR_LEN);
295
296 /* Initialize packet filter */
297 sc->sc_filter = NDIS_PACKET_TYPE_BROADCAST |
298 NDIS_PACKET_TYPE_ALL_MULTICAST;
299 msg.filter.filter = htole32(sc->sc_filter);
300 URNDIS_LOCK(sc);
301 error = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
302 (struct rndis_set_req *)&msg.filter, sizeof(msg.filter));
303 URNDIS_UNLOCK(sc);
304 if (error != (int)RNDIS_STATUS_SUCCESS) {
305 device_printf(dev, "Unable to set data filters\n");
306 goto detach;
307 }
308
309 ue->ue_sc = sc;
310 ue->ue_dev = dev;
311 ue->ue_udev = uaa->device;
312 ue->ue_mtx = &sc->sc_mtx;
313 ue->ue_methods = &urndis_ue_methods;
314
315 error = uether_ifattach(ue);
316 if (error) {
317 device_printf(dev, "Could not attach interface\n");
318 goto detach;
319 }
320
321 URNDIS_LOCK(sc);
322 /* start interrupt endpoint, if any */
323 usbd_transfer_start(sc->sc_xfer[URNDIS_INTR_RX]);
324 URNDIS_UNLOCK(sc);
325
326 return (0); /* success */
327
328 detach:
329 (void)urndis_detach(dev);
330 return (ENXIO); /* failure */
331 }
332
333 static int
urndis_detach(device_t dev)334 urndis_detach(device_t dev)
335 {
336 struct urndis_softc *sc = device_get_softc(dev);
337 struct usb_ether *ue = &sc->sc_ue;
338
339 /* stop all USB transfers first */
340 usbd_transfer_unsetup(sc->sc_xfer, URNDIS_N_TRANSFER);
341
342 uether_ifdetach(ue);
343
344 URNDIS_LOCK(sc);
345 (void)urndis_ctrl_halt(sc);
346 URNDIS_UNLOCK(sc);
347
348 mtx_destroy(&sc->sc_mtx);
349
350 return (0);
351 }
352
353 static void
urndis_start(struct usb_ether * ue)354 urndis_start(struct usb_ether *ue)
355 {
356 struct urndis_softc *sc = uether_getsc(ue);
357
358 /*
359 * Start the USB transfers, if not already started:
360 */
361 usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_TX]);
362 usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_RX]);
363 }
364
365 static void
urndis_init(struct usb_ether * ue)366 urndis_init(struct usb_ether *ue)
367 {
368 struct urndis_softc *sc = uether_getsc(ue);
369 if_t ifp = uether_getifp(ue);
370
371 URNDIS_LOCK_ASSERT(sc, MA_OWNED);
372
373 if_setdrvflagbits(ifp, IFF_DRV_RUNNING, 0);
374
375 /* stall data write direction, which depends on USB mode */
376 usbd_xfer_set_stall(sc->sc_xfer[URNDIS_BULK_TX]);
377
378 /* start data transfers */
379 urndis_start(ue);
380 }
381
382 static void
urndis_stop(struct usb_ether * ue)383 urndis_stop(struct usb_ether *ue)
384 {
385 struct urndis_softc *sc = uether_getsc(ue);
386 if_t ifp = uether_getifp(ue);
387
388 URNDIS_LOCK_ASSERT(sc, MA_OWNED);
389
390 if_setdrvflagbits(ifp, 0, IFF_DRV_RUNNING);
391
392 /*
393 * stop all the transfers, if not already stopped:
394 */
395 usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_RX]);
396 usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_TX]);
397 }
398
399 static void
urndis_setmulti(struct usb_ether * ue)400 urndis_setmulti(struct usb_ether *ue)
401 {
402
403 /* no-op */
404 }
405
406 static void
urndis_setpromisc(struct usb_ether * ue)407 urndis_setpromisc(struct usb_ether *ue)
408 {
409
410 /* no-op */
411 }
412
413 static int
urndis_suspend(device_t dev)414 urndis_suspend(device_t dev)
415 {
416
417 device_printf(dev, "Suspending\n");
418 return (0);
419 }
420
421 static int
urndis_resume(device_t dev)422 urndis_resume(device_t dev)
423 {
424
425 device_printf(dev, "Resuming\n");
426 return (0);
427 }
428
429 static usb_error_t
urndis_ctrl_msg(struct urndis_softc * sc,uint8_t rt,uint8_t r,uint16_t index,uint16_t value,void * buf,uint16_t buflen)430 urndis_ctrl_msg(struct urndis_softc *sc, uint8_t rt, uint8_t r,
431 uint16_t index, uint16_t value, void *buf, uint16_t buflen)
432 {
433 usb_device_request_t req;
434
435 req.bmRequestType = rt;
436 req.bRequest = r;
437 USETW(req.wValue, value);
438 USETW(req.wIndex, index);
439 USETW(req.wLength, buflen);
440
441 return (usbd_do_request_flags(sc->sc_ue.ue_udev,
442 &sc->sc_mtx, &req, buf, (rt & UT_READ) ?
443 USB_SHORT_XFER_OK : 0, NULL, 2000 /* ms */ ));
444 }
445
446 static usb_error_t
urndis_ctrl_send(struct urndis_softc * sc,void * buf,uint16_t len)447 urndis_ctrl_send(struct urndis_softc *sc, void *buf, uint16_t len)
448 {
449 usb_error_t err;
450
451 err = urndis_ctrl_msg(sc, UT_WRITE_CLASS_INTERFACE,
452 UCDC_SEND_ENCAPSULATED_COMMAND, sc->sc_ifaceno_ctl, 0, buf, len);
453
454 DPRINTF("%s\n", usbd_errstr(err));
455
456 return (err);
457 }
458
459 static struct rndis_comp_hdr *
urndis_ctrl_recv(struct urndis_softc * sc)460 urndis_ctrl_recv(struct urndis_softc *sc)
461 {
462 struct rndis_comp_hdr *hdr;
463 usb_error_t err;
464
465 err = urndis_ctrl_msg(sc, UT_READ_CLASS_INTERFACE,
466 UCDC_GET_ENCAPSULATED_RESPONSE, sc->sc_ifaceno_ctl, 0,
467 sc->sc_response_buf, RNDIS_RESPONSE_LEN);
468
469 if (err != USB_ERR_NORMAL_COMPLETION)
470 return (NULL);
471
472 hdr = (struct rndis_comp_hdr *)sc->sc_response_buf;
473
474 DPRINTF("type 0x%x len %u\n", le32toh(hdr->rm_type),
475 le32toh(hdr->rm_len));
476
477 if (le32toh(hdr->rm_len) > RNDIS_RESPONSE_LEN) {
478 DPRINTF("ctrl message error: wrong size %u > %u\n",
479 le32toh(hdr->rm_len), RNDIS_RESPONSE_LEN);
480 return (NULL);
481 }
482 return (hdr);
483 }
484
485 static uint32_t
urndis_ctrl_handle(struct urndis_softc * sc,struct rndis_comp_hdr * hdr,const void ** buf,uint16_t * bufsz)486 urndis_ctrl_handle(struct urndis_softc *sc, struct rndis_comp_hdr *hdr,
487 const void **buf, uint16_t *bufsz)
488 {
489 uint32_t rval;
490
491 DPRINTF("\n");
492
493 if (buf != NULL && bufsz != NULL) {
494 *buf = NULL;
495 *bufsz = 0;
496 }
497 switch (le32toh(hdr->rm_type)) {
498 case REMOTE_NDIS_INITIALIZE_CMPLT:
499 rval = urndis_ctrl_handle_init(sc, hdr);
500 break;
501
502 case REMOTE_NDIS_QUERY_CMPLT:
503 rval = urndis_ctrl_handle_query(sc, hdr, buf, bufsz);
504 break;
505
506 case REMOTE_NDIS_RESET_CMPLT:
507 rval = urndis_ctrl_handle_reset(sc, hdr);
508 break;
509
510 case REMOTE_NDIS_KEEPALIVE_CMPLT:
511 case REMOTE_NDIS_SET_CMPLT:
512 rval = le32toh(hdr->rm_status);
513 break;
514
515 default:
516 device_printf(sc->sc_ue.ue_dev,
517 "ctrl message error: unknown event 0x%x\n",
518 le32toh(hdr->rm_type));
519 rval = RNDIS_STATUS_FAILURE;
520 break;
521 }
522 return (rval);
523 }
524
525 static uint32_t
urndis_ctrl_handle_init(struct urndis_softc * sc,const struct rndis_comp_hdr * hdr)526 urndis_ctrl_handle_init(struct urndis_softc *sc,
527 const struct rndis_comp_hdr *hdr)
528 {
529 const struct rndis_init_comp *msg;
530
531 msg = (const struct rndis_init_comp *)hdr;
532
533 DPRINTF("len %u rid %u status 0x%x "
534 "ver_major %u ver_minor %u devflags 0x%x medium 0x%x pktmaxcnt %u "
535 "pktmaxsz %u align %u aflistoffset %u aflistsz %u\n",
536 le32toh(msg->rm_len),
537 le32toh(msg->rm_rid),
538 le32toh(msg->rm_status),
539 le32toh(msg->rm_ver_major),
540 le32toh(msg->rm_ver_minor),
541 le32toh(msg->rm_devflags),
542 le32toh(msg->rm_medium),
543 le32toh(msg->rm_pktmaxcnt),
544 le32toh(msg->rm_pktmaxsz),
545 le32toh(msg->rm_align),
546 le32toh(msg->rm_aflistoffset),
547 le32toh(msg->rm_aflistsz));
548
549 if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
550 DPRINTF("init failed 0x%x\n", le32toh(msg->rm_status));
551 return (le32toh(msg->rm_status));
552 }
553 if (le32toh(msg->rm_devflags) != RNDIS_DF_CONNECTIONLESS) {
554 DPRINTF("wrong device type (current type: 0x%x)\n",
555 le32toh(msg->rm_devflags));
556 return (RNDIS_STATUS_FAILURE);
557 }
558 if (le32toh(msg->rm_medium) != RNDIS_MEDIUM_802_3) {
559 DPRINTF("medium not 802.3 (current medium: 0x%x)\n",
560 le32toh(msg->rm_medium));
561 return (RNDIS_STATUS_FAILURE);
562 }
563 sc->sc_lim_pktsz = le32toh(msg->rm_pktmaxsz);
564
565 return (le32toh(msg->rm_status));
566 }
567
568 static uint32_t
urndis_ctrl_handle_query(struct urndis_softc * sc,const struct rndis_comp_hdr * hdr,const void ** buf,uint16_t * bufsz)569 urndis_ctrl_handle_query(struct urndis_softc *sc,
570 const struct rndis_comp_hdr *hdr, const void **buf, uint16_t *bufsz)
571 {
572 const struct rndis_query_comp *msg;
573 uint64_t limit;
574
575 msg = (const struct rndis_query_comp *)hdr;
576
577 DPRINTF("len %u rid %u status 0x%x "
578 "buflen %u bufoff %u\n",
579 le32toh(msg->rm_len),
580 le32toh(msg->rm_rid),
581 le32toh(msg->rm_status),
582 le32toh(msg->rm_infobuflen),
583 le32toh(msg->rm_infobufoffset));
584
585 *buf = NULL;
586 *bufsz = 0;
587 if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
588 DPRINTF("query failed 0x%x\n", le32toh(msg->rm_status));
589 return (le32toh(msg->rm_status));
590 }
591 limit = le32toh(msg->rm_infobuflen);
592 limit += le32toh(msg->rm_infobufoffset);
593 limit += RNDIS_HEADER_OFFSET;
594
595 if (limit > (uint64_t)le32toh(msg->rm_len)) {
596 DPRINTF("ctrl message error: invalid query info "
597 "len/offset/end_position(%u/%u/%u) -> "
598 "go out of buffer limit %u\n",
599 le32toh(msg->rm_infobuflen),
600 le32toh(msg->rm_infobufoffset),
601 le32toh(msg->rm_infobuflen) +
602 le32toh(msg->rm_infobufoffset) + RNDIS_HEADER_OFFSET,
603 le32toh(msg->rm_len));
604 return (RNDIS_STATUS_FAILURE);
605 }
606 *buf = ((const uint8_t *)msg) + RNDIS_HEADER_OFFSET +
607 le32toh(msg->rm_infobufoffset);
608 *bufsz = le32toh(msg->rm_infobuflen);
609
610 return (le32toh(msg->rm_status));
611 }
612
613 static uint32_t
urndis_ctrl_handle_reset(struct urndis_softc * sc,const struct rndis_comp_hdr * hdr)614 urndis_ctrl_handle_reset(struct urndis_softc *sc,
615 const struct rndis_comp_hdr *hdr)
616 {
617 const struct rndis_reset_comp *msg;
618 uint32_t rval;
619
620 msg = (const struct rndis_reset_comp *)hdr;
621
622 rval = le32toh(msg->rm_status);
623
624 DPRINTF("len %u status 0x%x "
625 "adrreset %u\n",
626 le32toh(msg->rm_len),
627 rval,
628 le32toh(msg->rm_adrreset));
629
630 if (rval != RNDIS_STATUS_SUCCESS) {
631 DPRINTF("reset failed 0x%x\n", rval);
632 return (rval);
633 }
634 if (msg->rm_adrreset != 0) {
635 struct {
636 struct rndis_set_req hdr;
637 uint32_t filter;
638 } msg_filter;
639
640 msg_filter.filter = htole32(sc->sc_filter);
641
642 rval = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
643 (struct rndis_set_req *)&msg_filter, sizeof(msg_filter));
644
645 if (rval != RNDIS_STATUS_SUCCESS) {
646 DPRINTF("unable to reset data filters\n");
647 return (rval);
648 }
649 }
650 return (rval);
651 }
652
653 static uint32_t
urndis_ctrl_init(struct urndis_softc * sc)654 urndis_ctrl_init(struct urndis_softc *sc)
655 {
656 struct rndis_init_req msg;
657 struct rndis_comp_hdr *hdr;
658 uint32_t rval;
659
660 msg.rm_type = htole32(REMOTE_NDIS_INITIALIZE_MSG);
661 msg.rm_len = htole32(sizeof(msg));
662 msg.rm_rid = 0;
663 msg.rm_ver_major = htole32(RNDIS_VERSION_MAJOR);
664 msg.rm_ver_minor = htole32(1);
665 msg.rm_max_xfersz = htole32(RNDIS_RX_MAXLEN);
666
667 DPRINTF("type %u len %u rid %u ver_major %u "
668 "ver_minor %u max_xfersz %u\n",
669 le32toh(msg.rm_type),
670 le32toh(msg.rm_len),
671 le32toh(msg.rm_rid),
672 le32toh(msg.rm_ver_major),
673 le32toh(msg.rm_ver_minor),
674 le32toh(msg.rm_max_xfersz));
675
676 rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
677
678 if (rval != RNDIS_STATUS_SUCCESS) {
679 DPRINTF("init failed\n");
680 return (rval);
681 }
682 if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
683 DPRINTF("unable to get init response\n");
684 return (RNDIS_STATUS_FAILURE);
685 }
686 rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
687
688 return (rval);
689 }
690
691 static uint32_t
urndis_ctrl_halt(struct urndis_softc * sc)692 urndis_ctrl_halt(struct urndis_softc *sc)
693 {
694 struct rndis_halt_req msg;
695 uint32_t rval;
696
697 msg.rm_type = htole32(REMOTE_NDIS_HALT_MSG);
698 msg.rm_len = htole32(sizeof(msg));
699 msg.rm_rid = 0;
700
701 DPRINTF("type %u len %u rid %u\n",
702 le32toh(msg.rm_type),
703 le32toh(msg.rm_len),
704 le32toh(msg.rm_rid));
705
706 rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
707
708 if (rval != RNDIS_STATUS_SUCCESS)
709 DPRINTF("halt failed\n");
710
711 return (rval);
712 }
713
714 /*
715 * NB: Querying a device has the requirement of using an input buffer the size
716 * of the expected reply or larger, except for variably sized replies.
717 */
718 static uint32_t
urndis_ctrl_query(struct urndis_softc * sc,uint32_t oid,struct rndis_query_req * msg,uint16_t len,const void ** rbuf,uint16_t * rbufsz)719 urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid,
720 struct rndis_query_req *msg, uint16_t len, const void **rbuf,
721 uint16_t *rbufsz)
722 {
723 struct rndis_comp_hdr *hdr;
724 uint32_t datalen, rval;
725
726 msg->rm_type = htole32(REMOTE_NDIS_QUERY_MSG);
727 msg->rm_len = htole32(len);
728 msg->rm_rid = 0; /* XXX */
729 msg->rm_oid = htole32(oid);
730 datalen = len - sizeof(*msg);
731 msg->rm_infobuflen = htole32(datalen);
732 if (datalen != 0) {
733 msg->rm_infobufoffset = htole32(sizeof(*msg) -
734 RNDIS_HEADER_OFFSET);
735 } else {
736 msg->rm_infobufoffset = 0;
737 }
738 msg->rm_devicevchdl = 0;
739
740 DPRINTF("type %u len %u rid %u oid 0x%x "
741 "infobuflen %u infobufoffset %u devicevchdl %u\n",
742 le32toh(msg->rm_type),
743 le32toh(msg->rm_len),
744 le32toh(msg->rm_rid),
745 le32toh(msg->rm_oid),
746 le32toh(msg->rm_infobuflen),
747 le32toh(msg->rm_infobufoffset),
748 le32toh(msg->rm_devicevchdl));
749
750 rval = urndis_ctrl_send(sc, msg, len);
751
752 if (rval != RNDIS_STATUS_SUCCESS) {
753 DPRINTF("query failed\n");
754 return (rval);
755 }
756 if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
757 DPRINTF("unable to get query response\n");
758 return (RNDIS_STATUS_FAILURE);
759 }
760 rval = urndis_ctrl_handle(sc, hdr, rbuf, rbufsz);
761
762 return (rval);
763 }
764
765 static uint32_t
urndis_ctrl_set(struct urndis_softc * sc,uint32_t oid,struct rndis_set_req * msg,uint16_t len)766 urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid,
767 struct rndis_set_req *msg, uint16_t len)
768 {
769 struct rndis_comp_hdr *hdr;
770 uint32_t datalen, rval;
771
772 msg->rm_type = htole32(REMOTE_NDIS_SET_MSG);
773 msg->rm_len = htole32(len);
774 msg->rm_rid = 0; /* XXX */
775 msg->rm_oid = htole32(oid);
776 datalen = len - sizeof(*msg);
777 msg->rm_infobuflen = htole32(datalen);
778 if (datalen != 0) {
779 msg->rm_infobufoffset = htole32(sizeof(*msg) -
780 RNDIS_HEADER_OFFSET);
781 } else {
782 msg->rm_infobufoffset = 0;
783 }
784 msg->rm_devicevchdl = 0;
785
786 DPRINTF("type %u len %u rid %u oid 0x%x "
787 "infobuflen %u infobufoffset %u devicevchdl %u\n",
788 le32toh(msg->rm_type),
789 le32toh(msg->rm_len),
790 le32toh(msg->rm_rid),
791 le32toh(msg->rm_oid),
792 le32toh(msg->rm_infobuflen),
793 le32toh(msg->rm_infobufoffset),
794 le32toh(msg->rm_devicevchdl));
795
796 rval = urndis_ctrl_send(sc, msg, len);
797
798 if (rval != RNDIS_STATUS_SUCCESS) {
799 DPRINTF("set failed\n");
800 return (rval);
801 }
802 if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
803 DPRINTF("unable to get set response\n");
804 return (RNDIS_STATUS_FAILURE);
805 }
806 rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
807 if (rval != RNDIS_STATUS_SUCCESS)
808 DPRINTF("set failed 0x%x\n", rval);
809
810 return (rval);
811 }
812
813 static void
urndis_bulk_read_callback(struct usb_xfer * xfer,usb_error_t error)814 urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
815 {
816 struct urndis_softc *sc = usbd_xfer_softc(xfer);
817 struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, 0);
818 if_t ifp = uether_getifp(&sc->sc_ue);
819 struct rndis_packet_msg msg;
820 struct mbuf *m;
821 int actlen;
822 int aframes;
823 int offset;
824
825 switch (USB_GET_STATE(xfer)) {
826 case USB_ST_TRANSFERRED:
827 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
828
829 DPRINTFN(1, "received %u bytes in %u frames\n", actlen, aframes);
830
831 for (offset = 0; actlen >= (uint32_t)sizeof(msg);) {
832 /* copy out header */
833 usbd_copy_out(pc, offset, &msg, sizeof(msg));
834
835 if (le32toh(0x1234567U) != 0x1234567U) {
836 /* swap endianness */
837 msg.rm_type = le32toh(msg.rm_type);
838 msg.rm_len = le32toh(msg.rm_len);
839 msg.rm_dataoffset = le32toh(msg.rm_dataoffset);
840 msg.rm_datalen = le32toh(msg.rm_datalen);
841 msg.rm_oobdataoffset = le32toh(msg.rm_oobdataoffset);
842 msg.rm_oobdatalen = le32toh(msg.rm_oobdatalen);
843 msg.rm_oobdataelements = le32toh(msg.rm_oobdataelements);
844 msg.rm_pktinfooffset = le32toh(msg.rm_pktinfooffset);
845 msg.rm_pktinfolen = le32toh(msg.rm_pktinfolen);
846 msg.rm_vchandle = le32toh(msg.rm_vchandle);
847 msg.rm_reserved = le32toh(msg.rm_reserved);
848 }
849
850 DPRINTF("len %u data(off:%u len:%u) "
851 "oobdata(off:%u len:%u nb:%u) perpacket(off:%u len:%u)\n",
852 msg.rm_len, msg.rm_dataoffset, msg.rm_datalen,
853 msg.rm_oobdataoffset, msg.rm_oobdatalen,
854 msg.rm_oobdataelements, msg.rm_pktinfooffset,
855 msg.rm_pktinfooffset);
856
857 /* sanity check the RNDIS header */
858 if (msg.rm_type != REMOTE_NDIS_PACKET_MSG) {
859 DPRINTF("invalid type 0x%x != 0x%x\n",
860 msg.rm_type, REMOTE_NDIS_PACKET_MSG);
861 goto tr_setup;
862 } else if (msg.rm_len < (uint32_t)sizeof(msg)) {
863 DPRINTF("invalid msg len %u < %u\n",
864 msg.rm_len, (unsigned)sizeof(msg));
865 goto tr_setup;
866 } else if (msg.rm_len > (uint32_t)actlen) {
867 DPRINTF("invalid msg len %u > buffer "
868 "len %u\n", msg.rm_len, actlen);
869 goto tr_setup;
870 } else if (msg.rm_dataoffset >= (uint32_t)actlen) {
871 DPRINTF("invalid msg dataoffset %u > buffer "
872 "dataoffset %u\n", msg.rm_dataoffset, actlen);
873 goto tr_setup;
874 } else if (msg.rm_datalen > (uint32_t)actlen) {
875 DPRINTF("invalid msg datalen %u > buffer "
876 "datalen %u\n", msg.rm_datalen, actlen);
877 goto tr_setup;
878 } else if ((msg.rm_dataoffset + msg.rm_datalen +
879 (uint32_t)__offsetof(struct rndis_packet_msg,
880 rm_dataoffset)) > (uint32_t)actlen) {
881 DPRINTF("invalid dataoffset %u larger than %u\n",
882 msg.rm_dataoffset + msg.rm_datalen +
883 (uint32_t)__offsetof(struct rndis_packet_msg,
884 rm_dataoffset), actlen);
885 goto tr_setup;
886 } else if (msg.rm_datalen < (uint32_t)sizeof(struct ether_header)) {
887 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
888 DPRINTF("invalid ethernet size "
889 "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header));
890 goto tr_setup;
891 } else if (msg.rm_datalen > (uint32_t)(MCLBYTES - ETHER_ALIGN)) {
892 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
893 DPRINTF("invalid ethernet size "
894 "%u > %u\n",
895 msg.rm_datalen, (unsigned)MCLBYTES);
896 goto tr_setup;
897 } else if (msg.rm_datalen > (uint32_t)(MHLEN - ETHER_ALIGN)) {
898 m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
899 } else {
900 m = m_gethdr(M_NOWAIT, MT_DATA);
901 }
902
903 /* check if we have a buffer */
904 if (m != NULL) {
905 m->m_len = m->m_pkthdr.len = msg.rm_datalen + ETHER_ALIGN;
906 m_adj(m, ETHER_ALIGN);
907
908 usbd_copy_out(pc, offset + msg.rm_dataoffset +
909 __offsetof(struct rndis_packet_msg,
910 rm_dataoffset), m->m_data, msg.rm_datalen);
911
912 /* enqueue */
913 uether_rxmbuf(&sc->sc_ue, m, msg.rm_datalen);
914 } else {
915 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
916 }
917 offset += msg.rm_len;
918 actlen -= msg.rm_len;
919 }
920
921 case USB_ST_SETUP:
922 tr_setup:
923 usbd_xfer_set_frame_len(xfer, 0, RNDIS_RX_MAXLEN);
924 usbd_xfer_set_frames(xfer, 1);
925 usbd_transfer_submit(xfer);
926 uether_rxflush(&sc->sc_ue); /* must be last */
927 break;
928
929 default: /* Error */
930 DPRINTFN(1, "error = %s\n", usbd_errstr(error));
931
932 if (error != USB_ERR_CANCELLED) {
933 /* try to clear stall first */
934 usbd_xfer_set_stall(xfer);
935 usbd_xfer_set_frames(xfer, 0);
936 usbd_transfer_submit(xfer);
937 }
938 break;
939 }
940 }
941
942 static void
urndis_bulk_write_callback(struct usb_xfer * xfer,usb_error_t error)943 urndis_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
944 {
945 struct rndis_packet_msg msg;
946 struct urndis_softc *sc = usbd_xfer_softc(xfer);
947 if_t ifp = uether_getifp(&sc->sc_ue);
948 struct mbuf *m;
949 unsigned x;
950 int actlen;
951 int aframes;
952
953 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
954
955 DPRINTFN(1, "\n");
956
957 switch (USB_GET_STATE(xfer)) {
958 case USB_ST_TRANSFERRED:
959 DPRINTFN(11, "%u bytes in %u frames\n", actlen, aframes);
960
961 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
962
963 /* FALLTHROUGH */
964 case USB_ST_SETUP:
965 tr_setup:
966 memset(&msg, 0, sizeof(msg));
967
968 for (x = 0; x != RNDIS_TX_FRAMES_MAX; x++) {
969 struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, x);
970
971 usbd_xfer_set_frame_offset(xfer, x * RNDIS_TX_MAXLEN, x);
972
973 next_pkt:
974 m = if_dequeue(ifp);
975
976 if (m == NULL)
977 break;
978
979 if ((m->m_pkthdr.len + sizeof(msg)) > RNDIS_TX_MAXLEN) {
980 DPRINTF("Too big packet\n");
981 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
982
983 /* Free buffer */
984 m_freem(m);
985 goto next_pkt;
986 }
987 msg.rm_type = htole32(REMOTE_NDIS_PACKET_MSG);
988 msg.rm_len = htole32(sizeof(msg) + m->m_pkthdr.len);
989
990 msg.rm_dataoffset = htole32(RNDIS_DATA_OFFSET);
991 msg.rm_datalen = htole32(m->m_pkthdr.len);
992
993 /* copy in all data */
994 usbd_copy_in(pc, 0, &msg, sizeof(msg));
995 usbd_m_copy_in(pc, sizeof(msg), m, 0, m->m_pkthdr.len);
996 usbd_xfer_set_frame_len(xfer, x, sizeof(msg) + m->m_pkthdr.len);
997
998 /*
999 * If there's a BPF listener, bounce a copy of
1000 * this frame to him:
1001 */
1002 BPF_MTAP(ifp, m);
1003
1004 /* Free buffer */
1005 m_freem(m);
1006 }
1007 if (x != 0) {
1008 usbd_xfer_set_frames(xfer, x);
1009 usbd_transfer_submit(xfer);
1010 }
1011 break;
1012
1013 default: /* Error */
1014 DPRINTFN(11, "transfer error, %s\n", usbd_errstr(error));
1015
1016 /* count output errors */
1017 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1018
1019 if (error != USB_ERR_CANCELLED) {
1020 /* try to clear stall first */
1021 usbd_xfer_set_stall(xfer);
1022 goto tr_setup;
1023 }
1024 break;
1025 }
1026 }
1027
1028 static void
urndis_intr_read_callback(struct usb_xfer * xfer,usb_error_t error)1029 urndis_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
1030 {
1031 int actlen;
1032
1033 usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1034
1035 switch (USB_GET_STATE(xfer)) {
1036 case USB_ST_TRANSFERRED:
1037
1038 DPRINTF("Received %d bytes\n", actlen);
1039
1040 /* TODO: decode some indications */
1041
1042 /* FALLTHROUGH */
1043 case USB_ST_SETUP:
1044 tr_setup:
1045 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1046 usbd_transfer_submit(xfer);
1047 break;
1048
1049 default: /* Error */
1050 if (error != USB_ERR_CANCELLED) {
1051 /* start clear stall */
1052 usbd_xfer_set_stall(xfer);
1053 goto tr_setup;
1054 }
1055 break;
1056 }
1057 }
1058