1 /* $OpenBSD: if_urndis.c,v 1.46 2013/12/09 15:45:29 pirofti Exp $ */ 2 3 /* 4 * Copyright (c) 2010 Jonathan Armani <armani@openbsd.org> 5 * Copyright (c) 2010 Fabien Romano <fabien@openbsd.org> 6 * Copyright (c) 2010 Michael Knudsen <mk@openbsd.org> 7 * Copyright (c) 2014 Hans Petter Selasky <hselasky@freebsd.org> 8 * All rights reserved. 9 * 10 * Permission to use, copy, modify, and distribute this software for any 11 * purpose with or without fee is hereby granted, provided that the above 12 * copyright notice and this permission notice appear in all copies. 13 * 14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 21 */ 22 23 #include <sys/cdefs.h> 24 __FBSDID("$FreeBSD$"); 25 26 #include <sys/stdint.h> 27 #include <sys/stddef.h> 28 #include <sys/param.h> 29 #include <sys/queue.h> 30 #include <sys/types.h> 31 #include <sys/systm.h> 32 #include <sys/socket.h> 33 #include <sys/kernel.h> 34 #include <sys/bus.h> 35 #include <sys/module.h> 36 #include <sys/lock.h> 37 #include <sys/mutex.h> 38 #include <sys/condvar.h> 39 #include <sys/sysctl.h> 40 #include <sys/sx.h> 41 #include <sys/unistd.h> 42 #include <sys/callout.h> 43 #include <sys/malloc.h> 44 #include <sys/priv.h> 45 46 #include <net/if.h> 47 #include <net/if_var.h> 48 49 #include <dev/usb/usb.h> 50 #include <dev/usb/usbdi.h> 51 #include <dev/usb/usbdi_util.h> 52 #include "usbdevs.h" 53 54 #define USB_DEBUG_VAR urndis_debug 55 #include <dev/usb/usb_debug.h> 56 #include <dev/usb/usb_process.h> 57 #include "usb_if.h" 58 59 #include <dev/usb/net/usb_ethernet.h> 60 #include <dev/usb/net/if_urndisreg.h> 61 62 #include <dev/usb/usb_cdc.h> 63 64 static device_probe_t urndis_probe; 65 static device_attach_t urndis_attach; 66 static device_detach_t urndis_detach; 67 static device_suspend_t urndis_suspend; 68 static device_resume_t urndis_resume; 69 70 static usb_callback_t urndis_bulk_write_callback; 71 static usb_callback_t urndis_bulk_read_callback; 72 static usb_callback_t urndis_intr_read_callback; 73 74 static uether_fn_t urndis_attach_post; 75 static uether_fn_t urndis_init; 76 static uether_fn_t urndis_stop; 77 static uether_fn_t urndis_start; 78 static uether_fn_t urndis_setmulti; 79 static uether_fn_t urndis_setpromisc; 80 81 static uint32_t urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid, 82 struct urndis_query_req *msg, uint16_t len, 83 const void **rbuf, uint16_t *rbufsz); 84 static uint32_t urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid, 85 struct urndis_set_req *msg, uint16_t len); 86 static uint32_t urndis_ctrl_handle_init(struct urndis_softc *sc, 87 const struct urndis_comp_hdr *hdr); 88 static uint32_t urndis_ctrl_handle_query(struct urndis_softc *sc, 89 const struct urndis_comp_hdr *hdr, const void **buf, 90 uint16_t *bufsz); 91 static uint32_t urndis_ctrl_handle_reset(struct urndis_softc *sc, 92 const struct urndis_comp_hdr *hdr); 93 static uint32_t urndis_ctrl_init(struct urndis_softc *sc); 94 static uint32_t urndis_ctrl_halt(struct urndis_softc *sc); 95 96 #ifdef USB_DEBUG 97 static int urndis_debug = 0; 98 static SYSCTL_NODE(_hw_usb, OID_AUTO, urndis, CTLFLAG_RW, 0, "USB RNDIS-Ethernet"); 99 SYSCTL_INT(_hw_usb_urndis, OID_AUTO, debug, CTLFLAG_RWTUN, &urndis_debug, 0, 100 "Debug level"); 101 #endif 102 103 static const struct usb_config urndis_config[URNDIS_N_TRANSFER] = { 104 [URNDIS_BULK_RX] = { 105 .type = UE_BULK, 106 .endpoint = UE_ADDR_ANY, 107 .direction = UE_DIR_RX, 108 .if_index = 0, 109 .frames = 1, 110 .bufsize = RNDIS_RX_MAXLEN, 111 .flags = {.short_xfer_ok = 1,}, 112 .callback = urndis_bulk_read_callback, 113 .timeout = 0, /* no timeout */ 114 .usb_mode = USB_MODE_HOST, 115 }, 116 117 [URNDIS_BULK_TX] = { 118 .type = UE_BULK, 119 .endpoint = UE_ADDR_ANY, 120 .direction = UE_DIR_TX, 121 .if_index = 0, 122 .frames = RNDIS_TX_FRAMES_MAX, 123 .bufsize = (RNDIS_TX_FRAMES_MAX * RNDIS_TX_MAXLEN), 124 .flags = { 125 .force_short_xfer = 1, 126 }, 127 .callback = urndis_bulk_write_callback, 128 .timeout = 10000, /* 10 seconds */ 129 .usb_mode = USB_MODE_HOST, 130 }, 131 132 [URNDIS_INTR_RX] = { 133 .type = UE_INTERRUPT, 134 .endpoint = UE_ADDR_ANY, 135 .direction = UE_DIR_RX, 136 .if_index = 1, 137 .bufsize = 0, /* use wMaxPacketSize */ 138 .flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,}, 139 .callback = urndis_intr_read_callback, 140 .timeout = 0, 141 .usb_mode = USB_MODE_HOST, 142 }, 143 }; 144 145 static device_method_t urndis_methods[] = { 146 /* Device interface */ 147 DEVMETHOD(device_probe, urndis_probe), 148 DEVMETHOD(device_attach, urndis_attach), 149 DEVMETHOD(device_detach, urndis_detach), 150 DEVMETHOD(device_suspend, urndis_suspend), 151 DEVMETHOD(device_resume, urndis_resume), 152 153 DEVMETHOD_END 154 }; 155 156 static driver_t urndis_driver = { 157 .name = "urndis", 158 .methods = urndis_methods, 159 .size = sizeof(struct urndis_softc), 160 }; 161 162 static devclass_t urndis_devclass; 163 164 static const STRUCT_USB_HOST_ID urndis_host_devs[] = { 165 /* Generic RNDIS class match */ 166 {USB_IFACE_CLASS(UICLASS_CDC), 167 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL), 168 USB_IFACE_PROTOCOL(0xff)}, 169 {USB_IFACE_CLASS(UICLASS_WIRELESS), USB_IFACE_SUBCLASS(UISUBCLASS_RF), 170 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)}, 171 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(UISUBCLASS_SYNC), 172 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)}, 173 /* HP-WebOS */ 174 {USB_VENDOR(USB_VENDOR_PALM), USB_IFACE_CLASS(UICLASS_CDC), 175 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL), 176 USB_IFACE_PROTOCOL(0xff)}, 177 }; 178 179 DRIVER_MODULE(urndis, uhub, urndis_driver, urndis_devclass, NULL, NULL); 180 MODULE_VERSION(urndis, 1); 181 MODULE_DEPEND(urndis, uether, 1, 1, 1); 182 MODULE_DEPEND(urndis, usb, 1, 1, 1); 183 MODULE_DEPEND(urndis, ether, 1, 1, 1); 184 USB_PNP_HOST_INFO(urndis_host_devs); 185 186 static const struct usb_ether_methods urndis_ue_methods = { 187 .ue_attach_post = urndis_attach_post, 188 .ue_start = urndis_start, 189 .ue_init = urndis_init, 190 .ue_stop = urndis_stop, 191 .ue_setmulti = urndis_setmulti, 192 .ue_setpromisc = urndis_setpromisc, 193 }; 194 195 static int 196 urndis_probe(device_t dev) 197 { 198 struct usb_attach_arg *uaa = device_get_ivars(dev); 199 200 return (usbd_lookup_id_by_uaa(urndis_host_devs, sizeof(urndis_host_devs), uaa)); 201 } 202 203 static void 204 urndis_attach_post(struct usb_ether *ue) 205 { 206 207 /* no-op */ 208 } 209 210 static int 211 urndis_attach(device_t dev) 212 { 213 static struct { 214 union { 215 struct urndis_query_req query; 216 struct urndis_set_req set; 217 } hdr; 218 union { 219 uint8_t eaddr[ETHER_ADDR_LEN]; 220 uint32_t filter; 221 } ibuf; 222 } msg; 223 struct urndis_softc *sc = device_get_softc(dev); 224 struct usb_ether *ue = &sc->sc_ue; 225 struct usb_attach_arg *uaa = device_get_ivars(dev); 226 struct usb_cdc_cm_descriptor *cmd; 227 const void *buf; 228 uint16_t bufsz; 229 uint8_t iface_index[2] = { uaa->info.bIfaceIndex + 1, uaa->info.bIfaceIndex }; 230 int error; 231 uint8_t i; 232 233 sc->sc_ue.ue_udev = uaa->device; 234 sc->sc_ifaceno_ctl = uaa->info.bIfaceNum; 235 236 cmd = usbd_find_descriptor(uaa->device, NULL, uaa->info.bIfaceIndex, 237 UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_CM, 0xFF); 238 if (cmd != 0) { 239 DPRINTF("Call Mode Descriptor found, dataif=%d\n", cmd->bDataInterface); 240 iface_index[0] = cmd->bDataInterface; 241 } 242 243 device_set_usb_desc(dev); 244 245 mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF); 246 247 /* scan the alternate settings looking for a valid one */ 248 for (i = 0; i != 32; i++) { 249 error = usbd_set_alt_interface_index(uaa->device, 250 iface_index[0], i); 251 252 if (error != 0) 253 break; 254 255 error = usbd_transfer_setup(uaa->device, 256 iface_index, sc->sc_xfer, urndis_config, 257 URNDIS_N_TRANSFER, sc, &sc->sc_mtx); 258 259 if (error == 0) 260 break; 261 } 262 if ((error != 0) || (i == 32)) { 263 device_printf(dev, "No valid alternate setting found\n"); 264 goto detach; 265 } 266 267 /* Initialize device - must be done before even querying it */ 268 URNDIS_LOCK(sc); 269 error = urndis_ctrl_init(sc); 270 URNDIS_UNLOCK(sc); 271 if (error != (int)RNDIS_STATUS_SUCCESS) { 272 device_printf(dev, "Unable to initialize hardware\n"); 273 goto detach; 274 } 275 276 /* Determine MAC address */ 277 memset(msg.ibuf.eaddr, 0, sizeof(msg.ibuf.eaddr)); 278 URNDIS_LOCK(sc); 279 error = urndis_ctrl_query(sc, OID_802_3_PERMANENT_ADDRESS, 280 &msg.hdr.query, sizeof(msg.hdr.query) + sizeof(msg.ibuf.eaddr), 281 &buf, &bufsz); 282 URNDIS_UNLOCK(sc); 283 if (error != (int)RNDIS_STATUS_SUCCESS) { 284 device_printf(dev, "Unable to get hardware address\n"); 285 goto detach; 286 } 287 if (bufsz != ETHER_ADDR_LEN) { 288 device_printf(dev, "Invalid address length: %d bytes\n", bufsz); 289 goto detach; 290 } 291 memcpy(&sc->sc_ue.ue_eaddr, buf, ETHER_ADDR_LEN); 292 293 /* Initialize packet filter */ 294 sc->sc_filter = RNDIS_PACKET_TYPE_BROADCAST | 295 RNDIS_PACKET_TYPE_ALL_MULTICAST; 296 msg.ibuf.filter = htole32(sc->sc_filter); 297 URNDIS_LOCK(sc); 298 error = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER, 299 &msg.hdr.set, sizeof(msg.hdr.set) + sizeof(msg.ibuf.filter)); 300 URNDIS_UNLOCK(sc); 301 if (error != (int)RNDIS_STATUS_SUCCESS) { 302 device_printf(dev, "Unable to set data filters\n"); 303 goto detach; 304 } 305 306 ue->ue_sc = sc; 307 ue->ue_dev = dev; 308 ue->ue_udev = uaa->device; 309 ue->ue_mtx = &sc->sc_mtx; 310 ue->ue_methods = &urndis_ue_methods; 311 312 error = uether_ifattach(ue); 313 if (error) { 314 device_printf(dev, "Could not attach interface\n"); 315 goto detach; 316 } 317 318 URNDIS_LOCK(sc); 319 /* start interrupt endpoint, if any */ 320 usbd_transfer_start(sc->sc_xfer[URNDIS_INTR_RX]); 321 URNDIS_UNLOCK(sc); 322 323 return (0); /* success */ 324 325 detach: 326 (void)urndis_detach(dev); 327 return (ENXIO); /* failure */ 328 } 329 330 static int 331 urndis_detach(device_t dev) 332 { 333 struct urndis_softc *sc = device_get_softc(dev); 334 struct usb_ether *ue = &sc->sc_ue; 335 336 /* stop all USB transfers first */ 337 usbd_transfer_unsetup(sc->sc_xfer, URNDIS_N_TRANSFER); 338 339 uether_ifdetach(ue); 340 341 URNDIS_LOCK(sc); 342 (void)urndis_ctrl_halt(sc); 343 URNDIS_UNLOCK(sc); 344 345 mtx_destroy(&sc->sc_mtx); 346 347 return (0); 348 } 349 350 static void 351 urndis_start(struct usb_ether *ue) 352 { 353 struct urndis_softc *sc = uether_getsc(ue); 354 355 /* 356 * Start the USB transfers, if not already started: 357 */ 358 usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_TX]); 359 usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_RX]); 360 } 361 362 static void 363 urndis_init(struct usb_ether *ue) 364 { 365 struct urndis_softc *sc = uether_getsc(ue); 366 struct ifnet *ifp = uether_getifp(ue); 367 368 URNDIS_LOCK_ASSERT(sc, MA_OWNED); 369 370 ifp->if_drv_flags |= IFF_DRV_RUNNING; 371 372 /* stall data write direction, which depends on USB mode */ 373 usbd_xfer_set_stall(sc->sc_xfer[URNDIS_BULK_TX]); 374 375 /* start data transfers */ 376 urndis_start(ue); 377 } 378 379 static void 380 urndis_stop(struct usb_ether *ue) 381 { 382 struct urndis_softc *sc = uether_getsc(ue); 383 struct ifnet *ifp = uether_getifp(ue); 384 385 URNDIS_LOCK_ASSERT(sc, MA_OWNED); 386 387 ifp->if_drv_flags &= ~IFF_DRV_RUNNING; 388 389 /* 390 * stop all the transfers, if not already stopped: 391 */ 392 usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_RX]); 393 usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_TX]); 394 } 395 396 static void 397 urndis_setmulti(struct usb_ether *ue) 398 { 399 400 /* no-op */ 401 } 402 403 static void 404 urndis_setpromisc(struct usb_ether *ue) 405 { 406 407 /* no-op */ 408 } 409 410 static int 411 urndis_suspend(device_t dev) 412 { 413 414 device_printf(dev, "Suspending\n"); 415 return (0); 416 } 417 418 static int 419 urndis_resume(device_t dev) 420 { 421 422 device_printf(dev, "Resuming\n"); 423 return (0); 424 } 425 426 static usb_error_t 427 urndis_ctrl_msg(struct urndis_softc *sc, uint8_t rt, uint8_t r, 428 uint16_t index, uint16_t value, void *buf, uint16_t buflen) 429 { 430 usb_device_request_t req; 431 432 req.bmRequestType = rt; 433 req.bRequest = r; 434 USETW(req.wValue, value); 435 USETW(req.wIndex, index); 436 USETW(req.wLength, buflen); 437 438 return (usbd_do_request_flags(sc->sc_ue.ue_udev, 439 &sc->sc_mtx, &req, buf, (rt & UT_READ) ? 440 USB_SHORT_XFER_OK : 0, NULL, 2000 /* ms */ )); 441 } 442 443 static usb_error_t 444 urndis_ctrl_send(struct urndis_softc *sc, void *buf, uint16_t len) 445 { 446 usb_error_t err; 447 448 err = urndis_ctrl_msg(sc, UT_WRITE_CLASS_INTERFACE, 449 UCDC_SEND_ENCAPSULATED_COMMAND, sc->sc_ifaceno_ctl, 0, buf, len); 450 451 DPRINTF("%s\n", usbd_errstr(err)); 452 453 return (err); 454 } 455 456 static struct urndis_comp_hdr * 457 urndis_ctrl_recv(struct urndis_softc *sc) 458 { 459 struct urndis_comp_hdr *hdr; 460 usb_error_t err; 461 462 err = urndis_ctrl_msg(sc, UT_READ_CLASS_INTERFACE, 463 UCDC_GET_ENCAPSULATED_RESPONSE, sc->sc_ifaceno_ctl, 0, 464 sc->sc_response_buf, RNDIS_RESPONSE_LEN); 465 466 if (err != USB_ERR_NORMAL_COMPLETION) 467 return (NULL); 468 469 hdr = (struct urndis_comp_hdr *)sc->sc_response_buf; 470 471 DPRINTF("type 0x%x len %u\n", le32toh(hdr->rm_type), 472 le32toh(hdr->rm_len)); 473 474 if (le32toh(hdr->rm_len) > RNDIS_RESPONSE_LEN) { 475 DPRINTF("ctrl message error: wrong size %u > %u\n", 476 le32toh(hdr->rm_len), RNDIS_RESPONSE_LEN); 477 return (NULL); 478 } 479 return (hdr); 480 } 481 482 static uint32_t 483 urndis_ctrl_handle(struct urndis_softc *sc, struct urndis_comp_hdr *hdr, 484 const void **buf, uint16_t *bufsz) 485 { 486 uint32_t rval; 487 488 DPRINTF("\n"); 489 490 if (buf != NULL && bufsz != NULL) { 491 *buf = NULL; 492 *bufsz = 0; 493 } 494 switch (le32toh(hdr->rm_type)) { 495 case REMOTE_NDIS_INITIALIZE_CMPLT: 496 rval = urndis_ctrl_handle_init(sc, hdr); 497 break; 498 499 case REMOTE_NDIS_QUERY_CMPLT: 500 rval = urndis_ctrl_handle_query(sc, hdr, buf, bufsz); 501 break; 502 503 case REMOTE_NDIS_RESET_CMPLT: 504 rval = urndis_ctrl_handle_reset(sc, hdr); 505 break; 506 507 case REMOTE_NDIS_KEEPALIVE_CMPLT: 508 case REMOTE_NDIS_SET_CMPLT: 509 rval = le32toh(hdr->rm_status); 510 break; 511 512 default: 513 device_printf(sc->sc_ue.ue_dev, 514 "ctrl message error: unknown event 0x%x\n", 515 le32toh(hdr->rm_type)); 516 rval = RNDIS_STATUS_FAILURE; 517 break; 518 } 519 return (rval); 520 } 521 522 static uint32_t 523 urndis_ctrl_handle_init(struct urndis_softc *sc, 524 const struct urndis_comp_hdr *hdr) 525 { 526 const struct urndis_init_comp *msg; 527 528 msg = (const struct urndis_init_comp *)hdr; 529 530 DPRINTF("len %u rid %u status 0x%x " 531 "ver_major %u ver_minor %u devflags 0x%x medium 0x%x pktmaxcnt %u " 532 "pktmaxsz %u align %u aflistoffset %u aflistsz %u\n", 533 le32toh(msg->rm_len), 534 le32toh(msg->rm_rid), 535 le32toh(msg->rm_status), 536 le32toh(msg->rm_ver_major), 537 le32toh(msg->rm_ver_minor), 538 le32toh(msg->rm_devflags), 539 le32toh(msg->rm_medium), 540 le32toh(msg->rm_pktmaxcnt), 541 le32toh(msg->rm_pktmaxsz), 542 le32toh(msg->rm_align), 543 le32toh(msg->rm_aflistoffset), 544 le32toh(msg->rm_aflistsz)); 545 546 if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) { 547 DPRINTF("init failed 0x%x\n", le32toh(msg->rm_status)); 548 return (le32toh(msg->rm_status)); 549 } 550 if (le32toh(msg->rm_devflags) != RNDIS_DF_CONNECTIONLESS) { 551 DPRINTF("wrong device type (current type: 0x%x)\n", 552 le32toh(msg->rm_devflags)); 553 return (RNDIS_STATUS_FAILURE); 554 } 555 if (le32toh(msg->rm_medium) != RNDIS_MEDIUM_802_3) { 556 DPRINTF("medium not 802.3 (current medium: 0x%x)\n", 557 le32toh(msg->rm_medium)); 558 return (RNDIS_STATUS_FAILURE); 559 } 560 sc->sc_lim_pktsz = le32toh(msg->rm_pktmaxsz); 561 562 return (le32toh(msg->rm_status)); 563 } 564 565 static uint32_t 566 urndis_ctrl_handle_query(struct urndis_softc *sc, 567 const struct urndis_comp_hdr *hdr, const void **buf, uint16_t *bufsz) 568 { 569 const struct urndis_query_comp *msg; 570 uint64_t limit; 571 572 msg = (const struct urndis_query_comp *)hdr; 573 574 DPRINTF("len %u rid %u status 0x%x " 575 "buflen %u bufoff %u\n", 576 le32toh(msg->rm_len), 577 le32toh(msg->rm_rid), 578 le32toh(msg->rm_status), 579 le32toh(msg->rm_infobuflen), 580 le32toh(msg->rm_infobufoffset)); 581 582 *buf = NULL; 583 *bufsz = 0; 584 if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) { 585 DPRINTF("query failed 0x%x\n", le32toh(msg->rm_status)); 586 return (le32toh(msg->rm_status)); 587 } 588 limit = le32toh(msg->rm_infobuflen); 589 limit += le32toh(msg->rm_infobufoffset); 590 limit += RNDIS_HEADER_OFFSET; 591 592 if (limit > (uint64_t)le32toh(msg->rm_len)) { 593 DPRINTF("ctrl message error: invalid query info " 594 "len/offset/end_position(%u/%u/%u) -> " 595 "go out of buffer limit %u\n", 596 le32toh(msg->rm_infobuflen), 597 le32toh(msg->rm_infobufoffset), 598 le32toh(msg->rm_infobuflen) + 599 le32toh(msg->rm_infobufoffset) + RNDIS_HEADER_OFFSET, 600 le32toh(msg->rm_len)); 601 return (RNDIS_STATUS_FAILURE); 602 } 603 *buf = ((const uint8_t *)msg) + RNDIS_HEADER_OFFSET + 604 le32toh(msg->rm_infobufoffset); 605 *bufsz = le32toh(msg->rm_infobuflen); 606 607 return (le32toh(msg->rm_status)); 608 } 609 610 static uint32_t 611 urndis_ctrl_handle_reset(struct urndis_softc *sc, 612 const struct urndis_comp_hdr *hdr) 613 { 614 const struct urndis_reset_comp *msg; 615 uint32_t rval; 616 617 msg = (const struct urndis_reset_comp *)hdr; 618 619 rval = le32toh(msg->rm_status); 620 621 DPRINTF("len %u status 0x%x " 622 "adrreset %u\n", 623 le32toh(msg->rm_len), 624 rval, 625 le32toh(msg->rm_adrreset)); 626 627 if (rval != RNDIS_STATUS_SUCCESS) { 628 DPRINTF("reset failed 0x%x\n", rval); 629 return (rval); 630 } 631 if (msg->rm_adrreset != 0) { 632 struct { 633 struct urndis_set_req hdr; 634 uint32_t filter; 635 } msg_filter; 636 637 msg_filter.filter = htole32(sc->sc_filter); 638 639 rval = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER, 640 &msg_filter.hdr, sizeof(msg_filter)); 641 642 if (rval != RNDIS_STATUS_SUCCESS) { 643 DPRINTF("unable to reset data filters\n"); 644 return (rval); 645 } 646 } 647 return (rval); 648 } 649 650 static uint32_t 651 urndis_ctrl_init(struct urndis_softc *sc) 652 { 653 struct urndis_init_req msg; 654 struct urndis_comp_hdr *hdr; 655 uint32_t rval; 656 657 msg.rm_type = htole32(REMOTE_NDIS_INITIALIZE_MSG); 658 msg.rm_len = htole32(sizeof(msg)); 659 msg.rm_rid = 0; 660 msg.rm_ver_major = htole32(1); 661 msg.rm_ver_minor = htole32(1); 662 msg.rm_max_xfersz = htole32(RNDIS_RX_MAXLEN); 663 664 DPRINTF("type %u len %u rid %u ver_major %u " 665 "ver_minor %u max_xfersz %u\n", 666 le32toh(msg.rm_type), 667 le32toh(msg.rm_len), 668 le32toh(msg.rm_rid), 669 le32toh(msg.rm_ver_major), 670 le32toh(msg.rm_ver_minor), 671 le32toh(msg.rm_max_xfersz)); 672 673 rval = urndis_ctrl_send(sc, &msg, sizeof(msg)); 674 675 if (rval != RNDIS_STATUS_SUCCESS) { 676 DPRINTF("init failed\n"); 677 return (rval); 678 } 679 if ((hdr = urndis_ctrl_recv(sc)) == NULL) { 680 DPRINTF("unable to get init response\n"); 681 return (RNDIS_STATUS_FAILURE); 682 } 683 rval = urndis_ctrl_handle(sc, hdr, NULL, NULL); 684 685 return (rval); 686 } 687 688 static uint32_t 689 urndis_ctrl_halt(struct urndis_softc *sc) 690 { 691 struct urndis_halt_req msg; 692 uint32_t rval; 693 694 msg.rm_type = htole32(REMOTE_NDIS_HALT_MSG); 695 msg.rm_len = htole32(sizeof(msg)); 696 msg.rm_rid = 0; 697 698 DPRINTF("type %u len %u rid %u\n", 699 le32toh(msg.rm_type), 700 le32toh(msg.rm_len), 701 le32toh(msg.rm_rid)); 702 703 rval = urndis_ctrl_send(sc, &msg, sizeof(msg)); 704 705 if (rval != RNDIS_STATUS_SUCCESS) 706 DPRINTF("halt failed\n"); 707 708 return (rval); 709 } 710 711 /* 712 * NB: Querying a device has the requirment of using an input buffer the size 713 * of the expected reply or larger, except for variably sized replies. 714 */ 715 static uint32_t 716 urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid, 717 struct urndis_query_req *msg, uint16_t len, const void **rbuf, 718 uint16_t *rbufsz) 719 { 720 struct urndis_comp_hdr *hdr; 721 uint32_t datalen, rval; 722 723 msg->rm_type = htole32(REMOTE_NDIS_QUERY_MSG); 724 msg->rm_len = htole32(len); 725 msg->rm_rid = 0; /* XXX */ 726 msg->rm_oid = htole32(oid); 727 datalen = len - sizeof(*msg); 728 msg->rm_infobuflen = htole32(datalen); 729 if (datalen != 0) { 730 msg->rm_infobufoffset = htole32(sizeof(*msg) - 731 RNDIS_HEADER_OFFSET); 732 } else { 733 msg->rm_infobufoffset = 0; 734 } 735 msg->rm_devicevchdl = 0; 736 737 DPRINTF("type %u len %u rid %u oid 0x%x " 738 "infobuflen %u infobufoffset %u devicevchdl %u\n", 739 le32toh(msg->rm_type), 740 le32toh(msg->rm_len), 741 le32toh(msg->rm_rid), 742 le32toh(msg->rm_oid), 743 le32toh(msg->rm_infobuflen), 744 le32toh(msg->rm_infobufoffset), 745 le32toh(msg->rm_devicevchdl)); 746 747 rval = urndis_ctrl_send(sc, msg, len); 748 749 if (rval != RNDIS_STATUS_SUCCESS) { 750 DPRINTF("query failed\n"); 751 return (rval); 752 } 753 if ((hdr = urndis_ctrl_recv(sc)) == NULL) { 754 DPRINTF("unable to get query response\n"); 755 return (RNDIS_STATUS_FAILURE); 756 } 757 rval = urndis_ctrl_handle(sc, hdr, rbuf, rbufsz); 758 759 return (rval); 760 } 761 762 static uint32_t 763 urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid, 764 struct urndis_set_req *msg, uint16_t len) 765 { 766 struct urndis_comp_hdr *hdr; 767 uint32_t datalen, rval; 768 769 msg->rm_type = htole32(REMOTE_NDIS_SET_MSG); 770 msg->rm_len = htole32(len); 771 msg->rm_rid = 0; /* XXX */ 772 msg->rm_oid = htole32(oid); 773 datalen = len - sizeof(*msg); 774 msg->rm_infobuflen = htole32(datalen); 775 if (datalen != 0) { 776 msg->rm_infobufoffset = htole32(sizeof(*msg) - 777 RNDIS_HEADER_OFFSET); 778 } else { 779 msg->rm_infobufoffset = 0; 780 } 781 msg->rm_devicevchdl = 0; 782 783 DPRINTF("type %u len %u rid %u oid 0x%x " 784 "infobuflen %u infobufoffset %u devicevchdl %u\n", 785 le32toh(msg->rm_type), 786 le32toh(msg->rm_len), 787 le32toh(msg->rm_rid), 788 le32toh(msg->rm_oid), 789 le32toh(msg->rm_infobuflen), 790 le32toh(msg->rm_infobufoffset), 791 le32toh(msg->rm_devicevchdl)); 792 793 rval = urndis_ctrl_send(sc, msg, len); 794 795 if (rval != RNDIS_STATUS_SUCCESS) { 796 DPRINTF("set failed\n"); 797 return (rval); 798 } 799 if ((hdr = urndis_ctrl_recv(sc)) == NULL) { 800 DPRINTF("unable to get set response\n"); 801 return (RNDIS_STATUS_FAILURE); 802 } 803 rval = urndis_ctrl_handle(sc, hdr, NULL, NULL); 804 if (rval != RNDIS_STATUS_SUCCESS) 805 DPRINTF("set failed 0x%x\n", rval); 806 807 return (rval); 808 } 809 810 static void 811 urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error) 812 { 813 struct urndis_softc *sc = usbd_xfer_softc(xfer); 814 struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, 0); 815 struct ifnet *ifp = uether_getifp(&sc->sc_ue); 816 struct urndis_packet_msg msg; 817 struct mbuf *m; 818 int actlen; 819 int aframes; 820 int offset; 821 822 switch (USB_GET_STATE(xfer)) { 823 case USB_ST_TRANSFERRED: 824 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL); 825 826 DPRINTFN(1, "received %u bytes in %u frames\n", actlen, aframes); 827 828 for (offset = 0; actlen >= (uint32_t)sizeof(msg);) { 829 /* copy out header */ 830 usbd_copy_out(pc, offset, &msg, sizeof(msg)); 831 832 if (le32toh(0x1234567U) != 0x1234567U) { 833 /* swap endianness */ 834 msg.rm_type = le32toh(msg.rm_type); 835 msg.rm_len = le32toh(msg.rm_len); 836 msg.rm_dataoffset = le32toh(msg.rm_dataoffset); 837 msg.rm_datalen = le32toh(msg.rm_datalen); 838 msg.rm_oobdataoffset = le32toh(msg.rm_oobdataoffset); 839 msg.rm_oobdatalen = le32toh(msg.rm_oobdatalen); 840 msg.rm_oobdataelements = le32toh(msg.rm_oobdataelements); 841 msg.rm_pktinfooffset = le32toh(msg.rm_pktinfooffset); 842 msg.rm_pktinfolen = le32toh(msg.rm_pktinfolen); 843 msg.rm_vchandle = le32toh(msg.rm_vchandle); 844 msg.rm_reserved = le32toh(msg.rm_reserved); 845 } 846 847 DPRINTF("len %u data(off:%u len:%u) " 848 "oobdata(off:%u len:%u nb:%u) perpacket(off:%u len:%u)\n", 849 msg.rm_len, msg.rm_dataoffset, msg.rm_datalen, 850 msg.rm_oobdataoffset, msg.rm_oobdatalen, 851 msg.rm_oobdataelements, msg.rm_pktinfooffset, 852 msg.rm_pktinfooffset); 853 854 /* sanity check the RNDIS header */ 855 if (msg.rm_type != REMOTE_NDIS_PACKET_MSG) { 856 DPRINTF("invalid type 0x%x != 0x%x\n", 857 msg.rm_type, REMOTE_NDIS_PACKET_MSG); 858 goto tr_setup; 859 } else if (msg.rm_len < (uint32_t)sizeof(msg)) { 860 DPRINTF("invalid msg len %u < %u\n", 861 msg.rm_len, (unsigned)sizeof(msg)); 862 goto tr_setup; 863 } else if (msg.rm_len > (uint32_t)actlen) { 864 DPRINTF("invalid msg len %u > buffer " 865 "len %u\n", msg.rm_len, actlen); 866 goto tr_setup; 867 } else if (msg.rm_dataoffset >= (uint32_t)actlen) { 868 DPRINTF("invalid msg dataoffset %u > buffer " 869 "dataoffset %u\n", msg.rm_dataoffset, actlen); 870 goto tr_setup; 871 } else if (msg.rm_datalen > (uint32_t)actlen) { 872 DPRINTF("invalid msg datalen %u > buffer " 873 "datalen %u\n", msg.rm_datalen, actlen); 874 goto tr_setup; 875 } else if ((msg.rm_dataoffset + msg.rm_datalen + 876 (uint32_t)__offsetof(struct urndis_packet_msg, 877 rm_dataoffset)) > (uint32_t)actlen) { 878 DPRINTF("invalid dataoffset %u larger than %u\n", 879 msg.rm_dataoffset + msg.rm_datalen + 880 (uint32_t)__offsetof(struct urndis_packet_msg, 881 rm_dataoffset), actlen); 882 goto tr_setup; 883 } else if (msg.rm_datalen < (uint32_t)sizeof(struct ether_header)) { 884 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1); 885 DPRINTF("invalid ethernet size " 886 "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header)); 887 goto tr_setup; 888 } else if (msg.rm_datalen > (uint32_t)(MCLBYTES - ETHER_ALIGN)) { 889 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1); 890 DPRINTF("invalid ethernet size " 891 "%u > %u\n", 892 msg.rm_datalen, (unsigned)MCLBYTES); 893 goto tr_setup; 894 } else if (msg.rm_datalen > (uint32_t)(MHLEN - ETHER_ALIGN)) { 895 m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR); 896 } else { 897 m = m_gethdr(M_NOWAIT, MT_DATA); 898 } 899 900 /* check if we have a buffer */ 901 if (m != NULL) { 902 m->m_len = m->m_pkthdr.len = msg.rm_datalen + ETHER_ALIGN; 903 m_adj(m, ETHER_ALIGN); 904 905 usbd_copy_out(pc, offset + msg.rm_dataoffset + 906 __offsetof(struct urndis_packet_msg, 907 rm_dataoffset), m->m_data, msg.rm_datalen); 908 909 /* enqueue */ 910 uether_rxmbuf(&sc->sc_ue, m, msg.rm_datalen); 911 } else { 912 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1); 913 } 914 offset += msg.rm_len; 915 actlen -= msg.rm_len; 916 } 917 918 case USB_ST_SETUP: 919 tr_setup: 920 usbd_xfer_set_frame_len(xfer, 0, RNDIS_RX_MAXLEN); 921 usbd_xfer_set_frames(xfer, 1); 922 usbd_transfer_submit(xfer); 923 uether_rxflush(&sc->sc_ue); /* must be last */ 924 break; 925 926 default: /* Error */ 927 DPRINTFN(1, "error = %s\n", usbd_errstr(error)); 928 929 if (error != USB_ERR_CANCELLED) { 930 /* try to clear stall first */ 931 usbd_xfer_set_stall(xfer); 932 usbd_xfer_set_frames(xfer, 0); 933 usbd_transfer_submit(xfer); 934 } 935 break; 936 } 937 } 938 939 static void 940 urndis_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error) 941 { 942 struct urndis_packet_msg msg; 943 struct urndis_softc *sc = usbd_xfer_softc(xfer); 944 struct ifnet *ifp = uether_getifp(&sc->sc_ue); 945 struct mbuf *m; 946 unsigned x; 947 int actlen; 948 int aframes; 949 950 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL); 951 952 DPRINTFN(1, "\n"); 953 954 switch (USB_GET_STATE(xfer)) { 955 case USB_ST_TRANSFERRED: 956 DPRINTFN(11, "%u bytes in %u frames\n", actlen, aframes); 957 958 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1); 959 960 /* FALLTHROUGH */ 961 case USB_ST_SETUP: 962 tr_setup: 963 memset(&msg, 0, sizeof(msg)); 964 965 for (x = 0; x != RNDIS_TX_FRAMES_MAX; x++) { 966 struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, x); 967 968 usbd_xfer_set_frame_offset(xfer, x * RNDIS_TX_MAXLEN, x); 969 970 next_pkt: 971 IFQ_DRV_DEQUEUE(&ifp->if_snd, m); 972 973 if (m == NULL) 974 break; 975 976 if ((m->m_pkthdr.len + sizeof(msg)) > RNDIS_TX_MAXLEN) { 977 DPRINTF("Too big packet\n"); 978 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1); 979 980 /* Free buffer */ 981 m_freem(m); 982 goto next_pkt; 983 } 984 msg.rm_type = htole32(REMOTE_NDIS_PACKET_MSG); 985 msg.rm_len = htole32(sizeof(msg) + m->m_pkthdr.len); 986 987 msg.rm_dataoffset = htole32(RNDIS_DATA_OFFSET); 988 msg.rm_datalen = htole32(m->m_pkthdr.len); 989 990 /* copy in all data */ 991 usbd_copy_in(pc, 0, &msg, sizeof(msg)); 992 usbd_m_copy_in(pc, sizeof(msg), m, 0, m->m_pkthdr.len); 993 usbd_xfer_set_frame_len(xfer, x, sizeof(msg) + m->m_pkthdr.len); 994 995 /* 996 * If there's a BPF listener, bounce a copy of 997 * this frame to him: 998 */ 999 BPF_MTAP(ifp, m); 1000 1001 /* Free buffer */ 1002 m_freem(m); 1003 } 1004 if (x != 0) { 1005 usbd_xfer_set_frames(xfer, x); 1006 usbd_transfer_submit(xfer); 1007 } 1008 break; 1009 1010 default: /* Error */ 1011 DPRINTFN(11, "transfer error, %s\n", usbd_errstr(error)); 1012 1013 /* count output errors */ 1014 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1); 1015 1016 if (error != USB_ERR_CANCELLED) { 1017 /* try to clear stall first */ 1018 usbd_xfer_set_stall(xfer); 1019 goto tr_setup; 1020 } 1021 break; 1022 } 1023 } 1024 1025 static void 1026 urndis_intr_read_callback(struct usb_xfer *xfer, usb_error_t error) 1027 { 1028 int actlen; 1029 1030 usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL); 1031 1032 switch (USB_GET_STATE(xfer)) { 1033 case USB_ST_TRANSFERRED: 1034 1035 DPRINTF("Received %d bytes\n", actlen); 1036 1037 /* TODO: decode some indications */ 1038 1039 /* FALLTHROUGH */ 1040 case USB_ST_SETUP: 1041 tr_setup: 1042 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer)); 1043 usbd_transfer_submit(xfer); 1044 break; 1045 1046 default: /* Error */ 1047 if (error != USB_ERR_CANCELLED) { 1048 /* start clear stall */ 1049 usbd_xfer_set_stall(xfer); 1050 goto tr_setup; 1051 } 1052 break; 1053 } 1054 } 1055