1 /* $OpenBSD: if_urndis.c,v 1.46 2013/12/09 15:45:29 pirofti Exp $ */ 2 3 /* 4 * Copyright (c) 2010 Jonathan Armani <armani@openbsd.org> 5 * Copyright (c) 2010 Fabien Romano <fabien@openbsd.org> 6 * Copyright (c) 2010 Michael Knudsen <mk@openbsd.org> 7 * Copyright (c) 2014 Hans Petter Selasky <hselasky@freebsd.org> 8 * All rights reserved. 9 * 10 * Permission to use, copy, modify, and distribute this software for any 11 * purpose with or without fee is hereby granted, provided that the above 12 * copyright notice and this permission notice appear in all copies. 13 * 14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 21 */ 22 23 #include <sys/cdefs.h> 24 __FBSDID("$FreeBSD$"); 25 26 #include <sys/stdint.h> 27 #include <sys/stddef.h> 28 #include <sys/param.h> 29 #include <sys/queue.h> 30 #include <sys/types.h> 31 #include <sys/systm.h> 32 #include <sys/socket.h> 33 #include <sys/kernel.h> 34 #include <sys/bus.h> 35 #include <sys/module.h> 36 #include <sys/lock.h> 37 #include <sys/mutex.h> 38 #include <sys/condvar.h> 39 #include <sys/sysctl.h> 40 #include <sys/sx.h> 41 #include <sys/unistd.h> 42 #include <sys/callout.h> 43 #include <sys/malloc.h> 44 #include <sys/priv.h> 45 46 #include <net/if.h> 47 #include <net/if_var.h> 48 #include <net/rndis.h> 49 50 #include <dev/usb/usb.h> 51 #include <dev/usb/usbdi.h> 52 #include <dev/usb/usbdi_util.h> 53 #include "usbdevs.h" 54 55 #define USB_DEBUG_VAR urndis_debug 56 #include <dev/usb/usb_debug.h> 57 #include <dev/usb/usb_process.h> 58 #include "usb_if.h" 59 60 #include <dev/usb/net/usb_ethernet.h> 61 #include <dev/usb/net/if_urndisreg.h> 62 63 #include <dev/usb/usb_cdc.h> 64 65 static device_probe_t urndis_probe; 66 static device_attach_t urndis_attach; 67 static device_detach_t urndis_detach; 68 static device_suspend_t urndis_suspend; 69 static device_resume_t urndis_resume; 70 71 static usb_callback_t urndis_bulk_write_callback; 72 static usb_callback_t urndis_bulk_read_callback; 73 static usb_callback_t urndis_intr_read_callback; 74 75 static uether_fn_t urndis_attach_post; 76 static uether_fn_t urndis_init; 77 static uether_fn_t urndis_stop; 78 static uether_fn_t urndis_start; 79 static uether_fn_t urndis_setmulti; 80 static uether_fn_t urndis_setpromisc; 81 82 static uint32_t urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid, 83 struct rndis_query_req *msg, uint16_t len, 84 const void **rbuf, uint16_t *rbufsz); 85 static uint32_t urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid, 86 struct rndis_set_req *msg, uint16_t len); 87 static uint32_t urndis_ctrl_handle_init(struct urndis_softc *sc, 88 const struct rndis_comp_hdr *hdr); 89 static uint32_t urndis_ctrl_handle_query(struct urndis_softc *sc, 90 const struct rndis_comp_hdr *hdr, const void **buf, 91 uint16_t *bufsz); 92 static uint32_t urndis_ctrl_handle_reset(struct urndis_softc *sc, 93 const struct rndis_comp_hdr *hdr); 94 static uint32_t urndis_ctrl_init(struct urndis_softc *sc); 95 static uint32_t urndis_ctrl_halt(struct urndis_softc *sc); 96 97 #ifdef USB_DEBUG 98 static int urndis_debug = 0; 99 static SYSCTL_NODE(_hw_usb, OID_AUTO, urndis, CTLFLAG_RW, 0, "USB RNDIS-Ethernet"); 100 SYSCTL_INT(_hw_usb_urndis, OID_AUTO, debug, CTLFLAG_RWTUN, &urndis_debug, 0, 101 "Debug level"); 102 #endif 103 104 static const struct usb_config urndis_config[URNDIS_N_TRANSFER] = { 105 [URNDIS_BULK_RX] = { 106 .type = UE_BULK, 107 .endpoint = UE_ADDR_ANY, 108 .direction = UE_DIR_RX, 109 .if_index = 0, 110 .frames = 1, 111 .bufsize = RNDIS_RX_MAXLEN, 112 .flags = {.short_xfer_ok = 1,}, 113 .callback = urndis_bulk_read_callback, 114 .timeout = 0, /* no timeout */ 115 .usb_mode = USB_MODE_HOST, 116 }, 117 118 [URNDIS_BULK_TX] = { 119 .type = UE_BULK, 120 .endpoint = UE_ADDR_ANY, 121 .direction = UE_DIR_TX, 122 .if_index = 0, 123 .frames = RNDIS_TX_FRAMES_MAX, 124 .bufsize = (RNDIS_TX_FRAMES_MAX * RNDIS_TX_MAXLEN), 125 .flags = { 126 .force_short_xfer = 1, 127 }, 128 .callback = urndis_bulk_write_callback, 129 .timeout = 10000, /* 10 seconds */ 130 .usb_mode = USB_MODE_HOST, 131 }, 132 133 [URNDIS_INTR_RX] = { 134 .type = UE_INTERRUPT, 135 .endpoint = UE_ADDR_ANY, 136 .direction = UE_DIR_RX, 137 .if_index = 1, 138 .bufsize = 0, /* use wMaxPacketSize */ 139 .flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,}, 140 .callback = urndis_intr_read_callback, 141 .timeout = 0, 142 .usb_mode = USB_MODE_HOST, 143 }, 144 }; 145 146 static device_method_t urndis_methods[] = { 147 /* Device interface */ 148 DEVMETHOD(device_probe, urndis_probe), 149 DEVMETHOD(device_attach, urndis_attach), 150 DEVMETHOD(device_detach, urndis_detach), 151 DEVMETHOD(device_suspend, urndis_suspend), 152 DEVMETHOD(device_resume, urndis_resume), 153 154 DEVMETHOD_END 155 }; 156 157 static driver_t urndis_driver = { 158 .name = "urndis", 159 .methods = urndis_methods, 160 .size = sizeof(struct urndis_softc), 161 }; 162 163 static devclass_t urndis_devclass; 164 165 static const STRUCT_USB_HOST_ID urndis_host_devs[] = { 166 /* Generic RNDIS class match */ 167 {USB_IFACE_CLASS(UICLASS_CDC), 168 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL), 169 USB_IFACE_PROTOCOL(0xff)}, 170 {USB_IFACE_CLASS(UICLASS_WIRELESS), USB_IFACE_SUBCLASS(UISUBCLASS_RF), 171 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)}, 172 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(UISUBCLASS_SYNC), 173 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)}, 174 /* HP-WebOS */ 175 {USB_VENDOR(USB_VENDOR_PALM), USB_IFACE_CLASS(UICLASS_CDC), 176 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL), 177 USB_IFACE_PROTOCOL(0xff)}, 178 }; 179 180 DRIVER_MODULE(urndis, uhub, urndis_driver, urndis_devclass, NULL, NULL); 181 MODULE_VERSION(urndis, 1); 182 MODULE_DEPEND(urndis, uether, 1, 1, 1); 183 MODULE_DEPEND(urndis, usb, 1, 1, 1); 184 MODULE_DEPEND(urndis, ether, 1, 1, 1); 185 USB_PNP_HOST_INFO(urndis_host_devs); 186 187 static const struct usb_ether_methods urndis_ue_methods = { 188 .ue_attach_post = urndis_attach_post, 189 .ue_start = urndis_start, 190 .ue_init = urndis_init, 191 .ue_stop = urndis_stop, 192 .ue_setmulti = urndis_setmulti, 193 .ue_setpromisc = urndis_setpromisc, 194 }; 195 196 static int 197 urndis_probe(device_t dev) 198 { 199 struct usb_attach_arg *uaa = device_get_ivars(dev); 200 201 return (usbd_lookup_id_by_uaa(urndis_host_devs, sizeof(urndis_host_devs), uaa)); 202 } 203 204 static void 205 urndis_attach_post(struct usb_ether *ue) 206 { 207 208 /* no-op */ 209 } 210 211 static int 212 urndis_attach(device_t dev) 213 { 214 static struct { 215 union { 216 struct rndis_query_req query; 217 struct rndis_set_req set; 218 } hdr; 219 union { 220 uint8_t eaddr[ETHER_ADDR_LEN]; 221 uint32_t filter; 222 } ibuf; 223 } msg; 224 struct urndis_softc *sc = device_get_softc(dev); 225 struct usb_ether *ue = &sc->sc_ue; 226 struct usb_attach_arg *uaa = device_get_ivars(dev); 227 struct usb_cdc_cm_descriptor *cmd; 228 const void *buf; 229 uint16_t bufsz; 230 uint8_t iface_index[2] = { uaa->info.bIfaceIndex + 1, uaa->info.bIfaceIndex }; 231 int error; 232 uint8_t i; 233 234 sc->sc_ue.ue_udev = uaa->device; 235 sc->sc_ifaceno_ctl = uaa->info.bIfaceNum; 236 237 cmd = usbd_find_descriptor(uaa->device, NULL, uaa->info.bIfaceIndex, 238 UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_CM, 0xFF); 239 if (cmd != NULL) { 240 DPRINTF("Call Mode Descriptor found, dataif=%d\n", cmd->bDataInterface); 241 iface_index[0] = cmd->bDataInterface; 242 } 243 244 device_set_usb_desc(dev); 245 246 mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF); 247 248 /* scan the alternate settings looking for a valid one */ 249 for (i = 0; i != 32; i++) { 250 error = usbd_set_alt_interface_index(uaa->device, 251 iface_index[0], i); 252 253 if (error != 0) 254 break; 255 256 error = usbd_transfer_setup(uaa->device, 257 iface_index, sc->sc_xfer, urndis_config, 258 URNDIS_N_TRANSFER, sc, &sc->sc_mtx); 259 260 if (error == 0) 261 break; 262 } 263 if ((error != 0) || (i == 32)) { 264 device_printf(dev, "No valid alternate setting found\n"); 265 goto detach; 266 } 267 268 /* Initialize device - must be done before even querying it */ 269 URNDIS_LOCK(sc); 270 error = urndis_ctrl_init(sc); 271 URNDIS_UNLOCK(sc); 272 if (error != (int)RNDIS_STATUS_SUCCESS) { 273 device_printf(dev, "Unable to initialize hardware\n"); 274 goto detach; 275 } 276 277 /* Determine MAC address */ 278 memset(msg.ibuf.eaddr, 0, sizeof(msg.ibuf.eaddr)); 279 URNDIS_LOCK(sc); 280 error = urndis_ctrl_query(sc, OID_802_3_PERMANENT_ADDRESS, 281 &msg.hdr.query, sizeof(msg.hdr.query) + sizeof(msg.ibuf.eaddr), 282 &buf, &bufsz); 283 URNDIS_UNLOCK(sc); 284 if (error != (int)RNDIS_STATUS_SUCCESS) { 285 device_printf(dev, "Unable to get hardware address\n"); 286 goto detach; 287 } 288 if (bufsz != ETHER_ADDR_LEN) { 289 device_printf(dev, "Invalid address length: %d bytes\n", bufsz); 290 goto detach; 291 } 292 memcpy(&sc->sc_ue.ue_eaddr, buf, ETHER_ADDR_LEN); 293 294 /* Initialize packet filter */ 295 sc->sc_filter = NDIS_PACKET_TYPE_BROADCAST | 296 NDIS_PACKET_TYPE_ALL_MULTICAST; 297 msg.ibuf.filter = htole32(sc->sc_filter); 298 URNDIS_LOCK(sc); 299 error = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER, 300 &msg.hdr.set, sizeof(msg.hdr.set) + sizeof(msg.ibuf.filter)); 301 URNDIS_UNLOCK(sc); 302 if (error != (int)RNDIS_STATUS_SUCCESS) { 303 device_printf(dev, "Unable to set data filters\n"); 304 goto detach; 305 } 306 307 ue->ue_sc = sc; 308 ue->ue_dev = dev; 309 ue->ue_udev = uaa->device; 310 ue->ue_mtx = &sc->sc_mtx; 311 ue->ue_methods = &urndis_ue_methods; 312 313 error = uether_ifattach(ue); 314 if (error) { 315 device_printf(dev, "Could not attach interface\n"); 316 goto detach; 317 } 318 319 URNDIS_LOCK(sc); 320 /* start interrupt endpoint, if any */ 321 usbd_transfer_start(sc->sc_xfer[URNDIS_INTR_RX]); 322 URNDIS_UNLOCK(sc); 323 324 return (0); /* success */ 325 326 detach: 327 (void)urndis_detach(dev); 328 return (ENXIO); /* failure */ 329 } 330 331 static int 332 urndis_detach(device_t dev) 333 { 334 struct urndis_softc *sc = device_get_softc(dev); 335 struct usb_ether *ue = &sc->sc_ue; 336 337 /* stop all USB transfers first */ 338 usbd_transfer_unsetup(sc->sc_xfer, URNDIS_N_TRANSFER); 339 340 uether_ifdetach(ue); 341 342 URNDIS_LOCK(sc); 343 (void)urndis_ctrl_halt(sc); 344 URNDIS_UNLOCK(sc); 345 346 mtx_destroy(&sc->sc_mtx); 347 348 return (0); 349 } 350 351 static void 352 urndis_start(struct usb_ether *ue) 353 { 354 struct urndis_softc *sc = uether_getsc(ue); 355 356 /* 357 * Start the USB transfers, if not already started: 358 */ 359 usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_TX]); 360 usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_RX]); 361 } 362 363 static void 364 urndis_init(struct usb_ether *ue) 365 { 366 struct urndis_softc *sc = uether_getsc(ue); 367 struct ifnet *ifp = uether_getifp(ue); 368 369 URNDIS_LOCK_ASSERT(sc, MA_OWNED); 370 371 ifp->if_drv_flags |= IFF_DRV_RUNNING; 372 373 /* stall data write direction, which depends on USB mode */ 374 usbd_xfer_set_stall(sc->sc_xfer[URNDIS_BULK_TX]); 375 376 /* start data transfers */ 377 urndis_start(ue); 378 } 379 380 static void 381 urndis_stop(struct usb_ether *ue) 382 { 383 struct urndis_softc *sc = uether_getsc(ue); 384 struct ifnet *ifp = uether_getifp(ue); 385 386 URNDIS_LOCK_ASSERT(sc, MA_OWNED); 387 388 ifp->if_drv_flags &= ~IFF_DRV_RUNNING; 389 390 /* 391 * stop all the transfers, if not already stopped: 392 */ 393 usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_RX]); 394 usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_TX]); 395 } 396 397 static void 398 urndis_setmulti(struct usb_ether *ue) 399 { 400 401 /* no-op */ 402 } 403 404 static void 405 urndis_setpromisc(struct usb_ether *ue) 406 { 407 408 /* no-op */ 409 } 410 411 static int 412 urndis_suspend(device_t dev) 413 { 414 415 device_printf(dev, "Suspending\n"); 416 return (0); 417 } 418 419 static int 420 urndis_resume(device_t dev) 421 { 422 423 device_printf(dev, "Resuming\n"); 424 return (0); 425 } 426 427 static usb_error_t 428 urndis_ctrl_msg(struct urndis_softc *sc, uint8_t rt, uint8_t r, 429 uint16_t index, uint16_t value, void *buf, uint16_t buflen) 430 { 431 usb_device_request_t req; 432 433 req.bmRequestType = rt; 434 req.bRequest = r; 435 USETW(req.wValue, value); 436 USETW(req.wIndex, index); 437 USETW(req.wLength, buflen); 438 439 return (usbd_do_request_flags(sc->sc_ue.ue_udev, 440 &sc->sc_mtx, &req, buf, (rt & UT_READ) ? 441 USB_SHORT_XFER_OK : 0, NULL, 2000 /* ms */ )); 442 } 443 444 static usb_error_t 445 urndis_ctrl_send(struct urndis_softc *sc, void *buf, uint16_t len) 446 { 447 usb_error_t err; 448 449 err = urndis_ctrl_msg(sc, UT_WRITE_CLASS_INTERFACE, 450 UCDC_SEND_ENCAPSULATED_COMMAND, sc->sc_ifaceno_ctl, 0, buf, len); 451 452 DPRINTF("%s\n", usbd_errstr(err)); 453 454 return (err); 455 } 456 457 static struct rndis_comp_hdr * 458 urndis_ctrl_recv(struct urndis_softc *sc) 459 { 460 struct rndis_comp_hdr *hdr; 461 usb_error_t err; 462 463 err = urndis_ctrl_msg(sc, UT_READ_CLASS_INTERFACE, 464 UCDC_GET_ENCAPSULATED_RESPONSE, sc->sc_ifaceno_ctl, 0, 465 sc->sc_response_buf, RNDIS_RESPONSE_LEN); 466 467 if (err != USB_ERR_NORMAL_COMPLETION) 468 return (NULL); 469 470 hdr = (struct rndis_comp_hdr *)sc->sc_response_buf; 471 472 DPRINTF("type 0x%x len %u\n", le32toh(hdr->rm_type), 473 le32toh(hdr->rm_len)); 474 475 if (le32toh(hdr->rm_len) > RNDIS_RESPONSE_LEN) { 476 DPRINTF("ctrl message error: wrong size %u > %u\n", 477 le32toh(hdr->rm_len), RNDIS_RESPONSE_LEN); 478 return (NULL); 479 } 480 return (hdr); 481 } 482 483 static uint32_t 484 urndis_ctrl_handle(struct urndis_softc *sc, struct rndis_comp_hdr *hdr, 485 const void **buf, uint16_t *bufsz) 486 { 487 uint32_t rval; 488 489 DPRINTF("\n"); 490 491 if (buf != NULL && bufsz != NULL) { 492 *buf = NULL; 493 *bufsz = 0; 494 } 495 switch (le32toh(hdr->rm_type)) { 496 case REMOTE_NDIS_INITIALIZE_CMPLT: 497 rval = urndis_ctrl_handle_init(sc, hdr); 498 break; 499 500 case REMOTE_NDIS_QUERY_CMPLT: 501 rval = urndis_ctrl_handle_query(sc, hdr, buf, bufsz); 502 break; 503 504 case REMOTE_NDIS_RESET_CMPLT: 505 rval = urndis_ctrl_handle_reset(sc, hdr); 506 break; 507 508 case REMOTE_NDIS_KEEPALIVE_CMPLT: 509 case REMOTE_NDIS_SET_CMPLT: 510 rval = le32toh(hdr->rm_status); 511 break; 512 513 default: 514 device_printf(sc->sc_ue.ue_dev, 515 "ctrl message error: unknown event 0x%x\n", 516 le32toh(hdr->rm_type)); 517 rval = RNDIS_STATUS_FAILURE; 518 break; 519 } 520 return (rval); 521 } 522 523 static uint32_t 524 urndis_ctrl_handle_init(struct urndis_softc *sc, 525 const struct rndis_comp_hdr *hdr) 526 { 527 const struct rndis_init_comp *msg; 528 529 msg = (const struct rndis_init_comp *)hdr; 530 531 DPRINTF("len %u rid %u status 0x%x " 532 "ver_major %u ver_minor %u devflags 0x%x medium 0x%x pktmaxcnt %u " 533 "pktmaxsz %u align %u aflistoffset %u aflistsz %u\n", 534 le32toh(msg->rm_len), 535 le32toh(msg->rm_rid), 536 le32toh(msg->rm_status), 537 le32toh(msg->rm_ver_major), 538 le32toh(msg->rm_ver_minor), 539 le32toh(msg->rm_devflags), 540 le32toh(msg->rm_medium), 541 le32toh(msg->rm_pktmaxcnt), 542 le32toh(msg->rm_pktmaxsz), 543 le32toh(msg->rm_align), 544 le32toh(msg->rm_aflistoffset), 545 le32toh(msg->rm_aflistsz)); 546 547 if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) { 548 DPRINTF("init failed 0x%x\n", le32toh(msg->rm_status)); 549 return (le32toh(msg->rm_status)); 550 } 551 if (le32toh(msg->rm_devflags) != RNDIS_DF_CONNECTIONLESS) { 552 DPRINTF("wrong device type (current type: 0x%x)\n", 553 le32toh(msg->rm_devflags)); 554 return (RNDIS_STATUS_FAILURE); 555 } 556 if (le32toh(msg->rm_medium) != RNDIS_MEDIUM_802_3) { 557 DPRINTF("medium not 802.3 (current medium: 0x%x)\n", 558 le32toh(msg->rm_medium)); 559 return (RNDIS_STATUS_FAILURE); 560 } 561 sc->sc_lim_pktsz = le32toh(msg->rm_pktmaxsz); 562 563 return (le32toh(msg->rm_status)); 564 } 565 566 static uint32_t 567 urndis_ctrl_handle_query(struct urndis_softc *sc, 568 const struct rndis_comp_hdr *hdr, const void **buf, uint16_t *bufsz) 569 { 570 const struct rndis_query_comp *msg; 571 uint64_t limit; 572 573 msg = (const struct rndis_query_comp *)hdr; 574 575 DPRINTF("len %u rid %u status 0x%x " 576 "buflen %u bufoff %u\n", 577 le32toh(msg->rm_len), 578 le32toh(msg->rm_rid), 579 le32toh(msg->rm_status), 580 le32toh(msg->rm_infobuflen), 581 le32toh(msg->rm_infobufoffset)); 582 583 *buf = NULL; 584 *bufsz = 0; 585 if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) { 586 DPRINTF("query failed 0x%x\n", le32toh(msg->rm_status)); 587 return (le32toh(msg->rm_status)); 588 } 589 limit = le32toh(msg->rm_infobuflen); 590 limit += le32toh(msg->rm_infobufoffset); 591 limit += RNDIS_HEADER_OFFSET; 592 593 if (limit > (uint64_t)le32toh(msg->rm_len)) { 594 DPRINTF("ctrl message error: invalid query info " 595 "len/offset/end_position(%u/%u/%u) -> " 596 "go out of buffer limit %u\n", 597 le32toh(msg->rm_infobuflen), 598 le32toh(msg->rm_infobufoffset), 599 le32toh(msg->rm_infobuflen) + 600 le32toh(msg->rm_infobufoffset) + RNDIS_HEADER_OFFSET, 601 le32toh(msg->rm_len)); 602 return (RNDIS_STATUS_FAILURE); 603 } 604 *buf = ((const uint8_t *)msg) + RNDIS_HEADER_OFFSET + 605 le32toh(msg->rm_infobufoffset); 606 *bufsz = le32toh(msg->rm_infobuflen); 607 608 return (le32toh(msg->rm_status)); 609 } 610 611 static uint32_t 612 urndis_ctrl_handle_reset(struct urndis_softc *sc, 613 const struct rndis_comp_hdr *hdr) 614 { 615 const struct rndis_reset_comp *msg; 616 uint32_t rval; 617 618 msg = (const struct rndis_reset_comp *)hdr; 619 620 rval = le32toh(msg->rm_status); 621 622 DPRINTF("len %u status 0x%x " 623 "adrreset %u\n", 624 le32toh(msg->rm_len), 625 rval, 626 le32toh(msg->rm_adrreset)); 627 628 if (rval != RNDIS_STATUS_SUCCESS) { 629 DPRINTF("reset failed 0x%x\n", rval); 630 return (rval); 631 } 632 if (msg->rm_adrreset != 0) { 633 struct { 634 struct rndis_set_req hdr; 635 uint32_t filter; 636 } msg_filter; 637 638 msg_filter.filter = htole32(sc->sc_filter); 639 640 rval = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER, 641 &msg_filter.hdr, sizeof(msg_filter)); 642 643 if (rval != RNDIS_STATUS_SUCCESS) { 644 DPRINTF("unable to reset data filters\n"); 645 return (rval); 646 } 647 } 648 return (rval); 649 } 650 651 static uint32_t 652 urndis_ctrl_init(struct urndis_softc *sc) 653 { 654 struct rndis_init_req msg; 655 struct rndis_comp_hdr *hdr; 656 uint32_t rval; 657 658 msg.rm_type = htole32(REMOTE_NDIS_INITIALIZE_MSG); 659 msg.rm_len = htole32(sizeof(msg)); 660 msg.rm_rid = 0; 661 msg.rm_ver_major = htole32(RNDIS_VERSION_MAJOR); 662 msg.rm_ver_minor = htole32(1); 663 msg.rm_max_xfersz = htole32(RNDIS_RX_MAXLEN); 664 665 DPRINTF("type %u len %u rid %u ver_major %u " 666 "ver_minor %u max_xfersz %u\n", 667 le32toh(msg.rm_type), 668 le32toh(msg.rm_len), 669 le32toh(msg.rm_rid), 670 le32toh(msg.rm_ver_major), 671 le32toh(msg.rm_ver_minor), 672 le32toh(msg.rm_max_xfersz)); 673 674 rval = urndis_ctrl_send(sc, &msg, sizeof(msg)); 675 676 if (rval != RNDIS_STATUS_SUCCESS) { 677 DPRINTF("init failed\n"); 678 return (rval); 679 } 680 if ((hdr = urndis_ctrl_recv(sc)) == NULL) { 681 DPRINTF("unable to get init response\n"); 682 return (RNDIS_STATUS_FAILURE); 683 } 684 rval = urndis_ctrl_handle(sc, hdr, NULL, NULL); 685 686 return (rval); 687 } 688 689 static uint32_t 690 urndis_ctrl_halt(struct urndis_softc *sc) 691 { 692 struct rndis_halt_req msg; 693 uint32_t rval; 694 695 msg.rm_type = htole32(REMOTE_NDIS_HALT_MSG); 696 msg.rm_len = htole32(sizeof(msg)); 697 msg.rm_rid = 0; 698 699 DPRINTF("type %u len %u rid %u\n", 700 le32toh(msg.rm_type), 701 le32toh(msg.rm_len), 702 le32toh(msg.rm_rid)); 703 704 rval = urndis_ctrl_send(sc, &msg, sizeof(msg)); 705 706 if (rval != RNDIS_STATUS_SUCCESS) 707 DPRINTF("halt failed\n"); 708 709 return (rval); 710 } 711 712 /* 713 * NB: Querying a device has the requirement of using an input buffer the size 714 * of the expected reply or larger, except for variably sized replies. 715 */ 716 static uint32_t 717 urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid, 718 struct rndis_query_req *msg, uint16_t len, const void **rbuf, 719 uint16_t *rbufsz) 720 { 721 struct rndis_comp_hdr *hdr; 722 uint32_t datalen, rval; 723 724 msg->rm_type = htole32(REMOTE_NDIS_QUERY_MSG); 725 msg->rm_len = htole32(len); 726 msg->rm_rid = 0; /* XXX */ 727 msg->rm_oid = htole32(oid); 728 datalen = len - sizeof(*msg); 729 msg->rm_infobuflen = htole32(datalen); 730 if (datalen != 0) { 731 msg->rm_infobufoffset = htole32(sizeof(*msg) - 732 RNDIS_HEADER_OFFSET); 733 } else { 734 msg->rm_infobufoffset = 0; 735 } 736 msg->rm_devicevchdl = 0; 737 738 DPRINTF("type %u len %u rid %u oid 0x%x " 739 "infobuflen %u infobufoffset %u devicevchdl %u\n", 740 le32toh(msg->rm_type), 741 le32toh(msg->rm_len), 742 le32toh(msg->rm_rid), 743 le32toh(msg->rm_oid), 744 le32toh(msg->rm_infobuflen), 745 le32toh(msg->rm_infobufoffset), 746 le32toh(msg->rm_devicevchdl)); 747 748 rval = urndis_ctrl_send(sc, msg, len); 749 750 if (rval != RNDIS_STATUS_SUCCESS) { 751 DPRINTF("query failed\n"); 752 return (rval); 753 } 754 if ((hdr = urndis_ctrl_recv(sc)) == NULL) { 755 DPRINTF("unable to get query response\n"); 756 return (RNDIS_STATUS_FAILURE); 757 } 758 rval = urndis_ctrl_handle(sc, hdr, rbuf, rbufsz); 759 760 return (rval); 761 } 762 763 static uint32_t 764 urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid, 765 struct rndis_set_req *msg, uint16_t len) 766 { 767 struct rndis_comp_hdr *hdr; 768 uint32_t datalen, rval; 769 770 msg->rm_type = htole32(REMOTE_NDIS_SET_MSG); 771 msg->rm_len = htole32(len); 772 msg->rm_rid = 0; /* XXX */ 773 msg->rm_oid = htole32(oid); 774 datalen = len - sizeof(*msg); 775 msg->rm_infobuflen = htole32(datalen); 776 if (datalen != 0) { 777 msg->rm_infobufoffset = htole32(sizeof(*msg) - 778 RNDIS_HEADER_OFFSET); 779 } else { 780 msg->rm_infobufoffset = 0; 781 } 782 msg->rm_devicevchdl = 0; 783 784 DPRINTF("type %u len %u rid %u oid 0x%x " 785 "infobuflen %u infobufoffset %u devicevchdl %u\n", 786 le32toh(msg->rm_type), 787 le32toh(msg->rm_len), 788 le32toh(msg->rm_rid), 789 le32toh(msg->rm_oid), 790 le32toh(msg->rm_infobuflen), 791 le32toh(msg->rm_infobufoffset), 792 le32toh(msg->rm_devicevchdl)); 793 794 rval = urndis_ctrl_send(sc, msg, len); 795 796 if (rval != RNDIS_STATUS_SUCCESS) { 797 DPRINTF("set failed\n"); 798 return (rval); 799 } 800 if ((hdr = urndis_ctrl_recv(sc)) == NULL) { 801 DPRINTF("unable to get set response\n"); 802 return (RNDIS_STATUS_FAILURE); 803 } 804 rval = urndis_ctrl_handle(sc, hdr, NULL, NULL); 805 if (rval != RNDIS_STATUS_SUCCESS) 806 DPRINTF("set failed 0x%x\n", rval); 807 808 return (rval); 809 } 810 811 static void 812 urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error) 813 { 814 struct urndis_softc *sc = usbd_xfer_softc(xfer); 815 struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, 0); 816 struct ifnet *ifp = uether_getifp(&sc->sc_ue); 817 struct rndis_packet_msg msg; 818 struct mbuf *m; 819 int actlen; 820 int aframes; 821 int offset; 822 823 switch (USB_GET_STATE(xfer)) { 824 case USB_ST_TRANSFERRED: 825 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL); 826 827 DPRINTFN(1, "received %u bytes in %u frames\n", actlen, aframes); 828 829 for (offset = 0; actlen >= (uint32_t)sizeof(msg);) { 830 /* copy out header */ 831 usbd_copy_out(pc, offset, &msg, sizeof(msg)); 832 833 if (le32toh(0x1234567U) != 0x1234567U) { 834 /* swap endianness */ 835 msg.rm_type = le32toh(msg.rm_type); 836 msg.rm_len = le32toh(msg.rm_len); 837 msg.rm_dataoffset = le32toh(msg.rm_dataoffset); 838 msg.rm_datalen = le32toh(msg.rm_datalen); 839 msg.rm_oobdataoffset = le32toh(msg.rm_oobdataoffset); 840 msg.rm_oobdatalen = le32toh(msg.rm_oobdatalen); 841 msg.rm_oobdataelements = le32toh(msg.rm_oobdataelements); 842 msg.rm_pktinfooffset = le32toh(msg.rm_pktinfooffset); 843 msg.rm_pktinfolen = le32toh(msg.rm_pktinfolen); 844 msg.rm_vchandle = le32toh(msg.rm_vchandle); 845 msg.rm_reserved = le32toh(msg.rm_reserved); 846 } 847 848 DPRINTF("len %u data(off:%u len:%u) " 849 "oobdata(off:%u len:%u nb:%u) perpacket(off:%u len:%u)\n", 850 msg.rm_len, msg.rm_dataoffset, msg.rm_datalen, 851 msg.rm_oobdataoffset, msg.rm_oobdatalen, 852 msg.rm_oobdataelements, msg.rm_pktinfooffset, 853 msg.rm_pktinfooffset); 854 855 /* sanity check the RNDIS header */ 856 if (msg.rm_type != REMOTE_NDIS_PACKET_MSG) { 857 DPRINTF("invalid type 0x%x != 0x%x\n", 858 msg.rm_type, REMOTE_NDIS_PACKET_MSG); 859 goto tr_setup; 860 } else if (msg.rm_len < (uint32_t)sizeof(msg)) { 861 DPRINTF("invalid msg len %u < %u\n", 862 msg.rm_len, (unsigned)sizeof(msg)); 863 goto tr_setup; 864 } else if (msg.rm_len > (uint32_t)actlen) { 865 DPRINTF("invalid msg len %u > buffer " 866 "len %u\n", msg.rm_len, actlen); 867 goto tr_setup; 868 } else if (msg.rm_dataoffset >= (uint32_t)actlen) { 869 DPRINTF("invalid msg dataoffset %u > buffer " 870 "dataoffset %u\n", msg.rm_dataoffset, actlen); 871 goto tr_setup; 872 } else if (msg.rm_datalen > (uint32_t)actlen) { 873 DPRINTF("invalid msg datalen %u > buffer " 874 "datalen %u\n", msg.rm_datalen, actlen); 875 goto tr_setup; 876 } else if ((msg.rm_dataoffset + msg.rm_datalen + 877 (uint32_t)__offsetof(struct rndis_packet_msg, 878 rm_dataoffset)) > (uint32_t)actlen) { 879 DPRINTF("invalid dataoffset %u larger than %u\n", 880 msg.rm_dataoffset + msg.rm_datalen + 881 (uint32_t)__offsetof(struct rndis_packet_msg, 882 rm_dataoffset), actlen); 883 goto tr_setup; 884 } else if (msg.rm_datalen < (uint32_t)sizeof(struct ether_header)) { 885 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1); 886 DPRINTF("invalid ethernet size " 887 "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header)); 888 goto tr_setup; 889 } else if (msg.rm_datalen > (uint32_t)(MCLBYTES - ETHER_ALIGN)) { 890 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1); 891 DPRINTF("invalid ethernet size " 892 "%u > %u\n", 893 msg.rm_datalen, (unsigned)MCLBYTES); 894 goto tr_setup; 895 } else if (msg.rm_datalen > (uint32_t)(MHLEN - ETHER_ALIGN)) { 896 m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR); 897 } else { 898 m = m_gethdr(M_NOWAIT, MT_DATA); 899 } 900 901 /* check if we have a buffer */ 902 if (m != NULL) { 903 m->m_len = m->m_pkthdr.len = msg.rm_datalen + ETHER_ALIGN; 904 m_adj(m, ETHER_ALIGN); 905 906 usbd_copy_out(pc, offset + msg.rm_dataoffset + 907 __offsetof(struct rndis_packet_msg, 908 rm_dataoffset), m->m_data, msg.rm_datalen); 909 910 /* enqueue */ 911 uether_rxmbuf(&sc->sc_ue, m, msg.rm_datalen); 912 } else { 913 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1); 914 } 915 offset += msg.rm_len; 916 actlen -= msg.rm_len; 917 } 918 919 case USB_ST_SETUP: 920 tr_setup: 921 usbd_xfer_set_frame_len(xfer, 0, RNDIS_RX_MAXLEN); 922 usbd_xfer_set_frames(xfer, 1); 923 usbd_transfer_submit(xfer); 924 uether_rxflush(&sc->sc_ue); /* must be last */ 925 break; 926 927 default: /* Error */ 928 DPRINTFN(1, "error = %s\n", usbd_errstr(error)); 929 930 if (error != USB_ERR_CANCELLED) { 931 /* try to clear stall first */ 932 usbd_xfer_set_stall(xfer); 933 usbd_xfer_set_frames(xfer, 0); 934 usbd_transfer_submit(xfer); 935 } 936 break; 937 } 938 } 939 940 static void 941 urndis_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error) 942 { 943 struct rndis_packet_msg msg; 944 struct urndis_softc *sc = usbd_xfer_softc(xfer); 945 struct ifnet *ifp = uether_getifp(&sc->sc_ue); 946 struct mbuf *m; 947 unsigned x; 948 int actlen; 949 int aframes; 950 951 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL); 952 953 DPRINTFN(1, "\n"); 954 955 switch (USB_GET_STATE(xfer)) { 956 case USB_ST_TRANSFERRED: 957 DPRINTFN(11, "%u bytes in %u frames\n", actlen, aframes); 958 959 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1); 960 961 /* FALLTHROUGH */ 962 case USB_ST_SETUP: 963 tr_setup: 964 memset(&msg, 0, sizeof(msg)); 965 966 for (x = 0; x != RNDIS_TX_FRAMES_MAX; x++) { 967 struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, x); 968 969 usbd_xfer_set_frame_offset(xfer, x * RNDIS_TX_MAXLEN, x); 970 971 next_pkt: 972 IFQ_DRV_DEQUEUE(&ifp->if_snd, m); 973 974 if (m == NULL) 975 break; 976 977 if ((m->m_pkthdr.len + sizeof(msg)) > RNDIS_TX_MAXLEN) { 978 DPRINTF("Too big packet\n"); 979 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1); 980 981 /* Free buffer */ 982 m_freem(m); 983 goto next_pkt; 984 } 985 msg.rm_type = htole32(REMOTE_NDIS_PACKET_MSG); 986 msg.rm_len = htole32(sizeof(msg) + m->m_pkthdr.len); 987 988 msg.rm_dataoffset = htole32(RNDIS_DATA_OFFSET); 989 msg.rm_datalen = htole32(m->m_pkthdr.len); 990 991 /* copy in all data */ 992 usbd_copy_in(pc, 0, &msg, sizeof(msg)); 993 usbd_m_copy_in(pc, sizeof(msg), m, 0, m->m_pkthdr.len); 994 usbd_xfer_set_frame_len(xfer, x, sizeof(msg) + m->m_pkthdr.len); 995 996 /* 997 * If there's a BPF listener, bounce a copy of 998 * this frame to him: 999 */ 1000 BPF_MTAP(ifp, m); 1001 1002 /* Free buffer */ 1003 m_freem(m); 1004 } 1005 if (x != 0) { 1006 usbd_xfer_set_frames(xfer, x); 1007 usbd_transfer_submit(xfer); 1008 } 1009 break; 1010 1011 default: /* Error */ 1012 DPRINTFN(11, "transfer error, %s\n", usbd_errstr(error)); 1013 1014 /* count output errors */ 1015 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1); 1016 1017 if (error != USB_ERR_CANCELLED) { 1018 /* try to clear stall first */ 1019 usbd_xfer_set_stall(xfer); 1020 goto tr_setup; 1021 } 1022 break; 1023 } 1024 } 1025 1026 static void 1027 urndis_intr_read_callback(struct usb_xfer *xfer, usb_error_t error) 1028 { 1029 int actlen; 1030 1031 usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL); 1032 1033 switch (USB_GET_STATE(xfer)) { 1034 case USB_ST_TRANSFERRED: 1035 1036 DPRINTF("Received %d bytes\n", actlen); 1037 1038 /* TODO: decode some indications */ 1039 1040 /* FALLTHROUGH */ 1041 case USB_ST_SETUP: 1042 tr_setup: 1043 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer)); 1044 usbd_transfer_submit(xfer); 1045 break; 1046 1047 default: /* Error */ 1048 if (error != USB_ERR_CANCELLED) { 1049 /* start clear stall */ 1050 usbd_xfer_set_stall(xfer); 1051 goto tr_setup; 1052 } 1053 break; 1054 } 1055 } 1056