xref: /freebsd/sys/dev/usb/net/if_urndis.c (revision d65cd7a57bf0600b722afc770838a5d0c1c3a8e1)
1 /*	$OpenBSD: if_urndis.c,v 1.46 2013/12/09 15:45:29 pirofti Exp $ */
2 
3 /*
4  * Copyright (c) 2010 Jonathan Armani <armani@openbsd.org>
5  * Copyright (c) 2010 Fabien Romano <fabien@openbsd.org>
6  * Copyright (c) 2010 Michael Knudsen <mk@openbsd.org>
7  * Copyright (c) 2014 Hans Petter Selasky <hselasky@freebsd.org>
8  * All rights reserved.
9  *
10  * Permission to use, copy, modify, and distribute this software for any
11  * purpose with or without fee is hereby granted, provided that the above
12  * copyright notice and this permission notice appear in all copies.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21  */
22 
23 #include <sys/cdefs.h>
24 __FBSDID("$FreeBSD$");
25 
26 #include <sys/stdint.h>
27 #include <sys/stddef.h>
28 #include <sys/param.h>
29 #include <sys/queue.h>
30 #include <sys/types.h>
31 #include <sys/systm.h>
32 #include <sys/socket.h>
33 #include <sys/kernel.h>
34 #include <sys/bus.h>
35 #include <sys/module.h>
36 #include <sys/lock.h>
37 #include <sys/mutex.h>
38 #include <sys/condvar.h>
39 #include <sys/sysctl.h>
40 #include <sys/sx.h>
41 #include <sys/unistd.h>
42 #include <sys/callout.h>
43 #include <sys/malloc.h>
44 #include <sys/priv.h>
45 
46 #include <net/if.h>
47 #include <net/if_var.h>
48 #include <net/rndis.h>
49 
50 #include <dev/usb/usb.h>
51 #include <dev/usb/usbdi.h>
52 #include <dev/usb/usbdi_util.h>
53 #include "usbdevs.h"
54 
55 #define	USB_DEBUG_VAR urndis_debug
56 #include <dev/usb/usb_debug.h>
57 #include <dev/usb/usb_process.h>
58 #include "usb_if.h"
59 
60 #include <dev/usb/net/usb_ethernet.h>
61 #include <dev/usb/net/if_urndisreg.h>
62 
63 #include <dev/usb/usb_cdc.h>
64 
65 static device_probe_t urndis_probe;
66 static device_attach_t urndis_attach;
67 static device_detach_t urndis_detach;
68 static device_suspend_t urndis_suspend;
69 static device_resume_t urndis_resume;
70 
71 static usb_callback_t urndis_bulk_write_callback;
72 static usb_callback_t urndis_bulk_read_callback;
73 static usb_callback_t urndis_intr_read_callback;
74 
75 static uether_fn_t urndis_attach_post;
76 static uether_fn_t urndis_init;
77 static uether_fn_t urndis_stop;
78 static uether_fn_t urndis_start;
79 static uether_fn_t urndis_setmulti;
80 static uether_fn_t urndis_setpromisc;
81 
82 static uint32_t	urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid,
83 		    struct rndis_query_req *msg, uint16_t len,
84 		    const void **rbuf, uint16_t *rbufsz);
85 static uint32_t	urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid,
86 		    struct rndis_set_req *msg, uint16_t len);
87 static uint32_t	urndis_ctrl_handle_init(struct urndis_softc *sc,
88 		    const struct rndis_comp_hdr *hdr);
89 static uint32_t	urndis_ctrl_handle_query(struct urndis_softc *sc,
90 		    const struct rndis_comp_hdr *hdr, const void **buf,
91 		    uint16_t *bufsz);
92 static uint32_t	urndis_ctrl_handle_reset(struct urndis_softc *sc,
93 		    const struct rndis_comp_hdr *hdr);
94 static uint32_t	urndis_ctrl_init(struct urndis_softc *sc);
95 static uint32_t	urndis_ctrl_halt(struct urndis_softc *sc);
96 
97 #ifdef USB_DEBUG
98 static int urndis_debug = 0;
99 static	SYSCTL_NODE(_hw_usb, OID_AUTO, urndis, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
100     "USB RNDIS-Ethernet");
101 SYSCTL_INT(_hw_usb_urndis, OID_AUTO, debug, CTLFLAG_RWTUN, &urndis_debug, 0,
102     "Debug level");
103 #endif
104 
105 static const struct usb_config urndis_config[URNDIS_N_TRANSFER] = {
106 	[URNDIS_BULK_RX] = {
107 		.type = UE_BULK,
108 		.endpoint = UE_ADDR_ANY,
109 		.direction = UE_DIR_RX,
110 		.if_index = 0,
111 		.frames = 1,
112 		.bufsize = RNDIS_RX_MAXLEN,
113 		.flags = {.short_xfer_ok = 1,},
114 		.callback = urndis_bulk_read_callback,
115 		.timeout = 0,		/* no timeout */
116 		.usb_mode = USB_MODE_HOST,
117 	},
118 
119 	[URNDIS_BULK_TX] = {
120 		.type = UE_BULK,
121 		.endpoint = UE_ADDR_ANY,
122 		.direction = UE_DIR_TX,
123 		.if_index = 0,
124 		.frames = RNDIS_TX_FRAMES_MAX,
125 		.bufsize = (RNDIS_TX_FRAMES_MAX * RNDIS_TX_MAXLEN),
126 		.flags = {
127 			.force_short_xfer = 1,
128 		},
129 		.callback = urndis_bulk_write_callback,
130 		.timeout = 10000,	/* 10 seconds */
131 		.usb_mode = USB_MODE_HOST,
132 	},
133 
134 	[URNDIS_INTR_RX] = {
135 		.type = UE_INTERRUPT,
136 		.endpoint = UE_ADDR_ANY,
137 		.direction = UE_DIR_RX,
138 		.if_index = 1,
139 		.bufsize = 0,	/* use wMaxPacketSize */
140 		.flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
141 		.callback = urndis_intr_read_callback,
142 		.timeout = 0,
143 		.usb_mode = USB_MODE_HOST,
144 	},
145 };
146 
147 static device_method_t urndis_methods[] = {
148 	/* Device interface */
149 	DEVMETHOD(device_probe, urndis_probe),
150 	DEVMETHOD(device_attach, urndis_attach),
151 	DEVMETHOD(device_detach, urndis_detach),
152 	DEVMETHOD(device_suspend, urndis_suspend),
153 	DEVMETHOD(device_resume, urndis_resume),
154 
155 	DEVMETHOD_END
156 };
157 
158 static driver_t urndis_driver = {
159 	.name = "urndis",
160 	.methods = urndis_methods,
161 	.size = sizeof(struct urndis_softc),
162 };
163 
164 static devclass_t urndis_devclass;
165 
166 static const STRUCT_USB_HOST_ID urndis_host_devs[] = {
167 	/* Generic RNDIS class match */
168 	{USB_IFACE_CLASS(UICLASS_CDC),
169 		USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL),
170 		USB_IFACE_PROTOCOL(0xff)},
171 	{USB_IFACE_CLASS(UICLASS_WIRELESS), USB_IFACE_SUBCLASS(UISUBCLASS_RF),
172 		USB_IFACE_PROTOCOL(UIPROTO_RNDIS)},
173 	{USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(UISUBCLASS_SYNC),
174 		USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)},
175 	/* HP-WebOS */
176 	{USB_VENDOR(USB_VENDOR_PALM), USB_IFACE_CLASS(UICLASS_CDC),
177 		USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL),
178 		USB_IFACE_PROTOCOL(0xff)},
179 	/* Nokia 7 plus */
180 	{USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(0x4),
181 		USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)},
182 };
183 
184 DRIVER_MODULE(urndis, uhub, urndis_driver, urndis_devclass, NULL, NULL);
185 MODULE_VERSION(urndis, 1);
186 MODULE_DEPEND(urndis, uether, 1, 1, 1);
187 MODULE_DEPEND(urndis, usb, 1, 1, 1);
188 MODULE_DEPEND(urndis, ether, 1, 1, 1);
189 USB_PNP_HOST_INFO(urndis_host_devs);
190 
191 static const struct usb_ether_methods urndis_ue_methods = {
192 	.ue_attach_post = urndis_attach_post,
193 	.ue_start = urndis_start,
194 	.ue_init = urndis_init,
195 	.ue_stop = urndis_stop,
196 	.ue_setmulti = urndis_setmulti,
197 	.ue_setpromisc = urndis_setpromisc,
198 };
199 
200 static int
201 urndis_probe(device_t dev)
202 {
203 	struct usb_attach_arg *uaa = device_get_ivars(dev);
204 
205 	return (usbd_lookup_id_by_uaa(urndis_host_devs, sizeof(urndis_host_devs), uaa));
206 }
207 
208 static void
209 urndis_attach_post(struct usb_ether *ue)
210 {
211 
212 	/* no-op */
213 }
214 
215 static int
216 urndis_attach(device_t dev)
217 {
218 	static struct {
219 		union {
220 			struct rndis_query_req query;
221 			struct rndis_set_req set;
222 		} hdr;
223 		union {
224 			uint8_t eaddr[ETHER_ADDR_LEN];
225 			uint32_t filter;
226 		} ibuf;
227 	} msg;
228 	struct urndis_softc *sc = device_get_softc(dev);
229 	struct usb_ether *ue = &sc->sc_ue;
230 	struct usb_attach_arg *uaa = device_get_ivars(dev);
231 	struct usb_cdc_cm_descriptor *cmd;
232 	const void *buf;
233 	uint16_t bufsz;
234 	uint8_t iface_index[2] = { uaa->info.bIfaceIndex + 1, uaa->info.bIfaceIndex };
235 	int error;
236 	uint8_t i;
237 
238 	sc->sc_ue.ue_udev = uaa->device;
239 	sc->sc_ifaceno_ctl = uaa->info.bIfaceNum;
240 
241 	cmd = usbd_find_descriptor(uaa->device, NULL, uaa->info.bIfaceIndex,
242 	    UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_CM, 0xFF);
243 	if (cmd != NULL) {
244 		DPRINTF("Call Mode Descriptor found, dataif=%d\n", cmd->bDataInterface);
245 		iface_index[0] = cmd->bDataInterface;
246 	}
247 
248 	device_set_usb_desc(dev);
249 
250 	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF);
251 
252 	/* scan the alternate settings looking for a valid one */
253 	for (i = 0; i != 32; i++) {
254 		error = usbd_set_alt_interface_index(uaa->device,
255 		    iface_index[0], i);
256 
257 		if (error != 0)
258 			break;
259 
260 		error = usbd_transfer_setup(uaa->device,
261 		    iface_index, sc->sc_xfer, urndis_config,
262 		    URNDIS_N_TRANSFER, sc, &sc->sc_mtx);
263 
264 		if (error == 0)
265 			break;
266 	}
267 	if ((error != 0) || (i == 32)) {
268 		device_printf(dev, "No valid alternate setting found\n");
269 		goto detach;
270 	}
271 
272 	/* Initialize device - must be done before even querying it */
273 	URNDIS_LOCK(sc);
274 	error = urndis_ctrl_init(sc);
275 	URNDIS_UNLOCK(sc);
276 	if (error != (int)RNDIS_STATUS_SUCCESS) {
277 		device_printf(dev, "Unable to initialize hardware\n");
278 		goto detach;
279 	}
280 
281 	/* Determine MAC address */
282 	memset(msg.ibuf.eaddr, 0, sizeof(msg.ibuf.eaddr));
283 	URNDIS_LOCK(sc);
284 	error = urndis_ctrl_query(sc, OID_802_3_PERMANENT_ADDRESS,
285 	    &msg.hdr.query, sizeof(msg.hdr.query) + sizeof(msg.ibuf.eaddr),
286 	    &buf, &bufsz);
287 	URNDIS_UNLOCK(sc);
288 	if (error != (int)RNDIS_STATUS_SUCCESS) {
289 		device_printf(dev, "Unable to get hardware address\n");
290 		goto detach;
291 	}
292 	if (bufsz != ETHER_ADDR_LEN) {
293 		device_printf(dev, "Invalid address length: %d bytes\n", bufsz);
294 		goto detach;
295 	}
296 	memcpy(&sc->sc_ue.ue_eaddr, buf, ETHER_ADDR_LEN);
297 
298 	/* Initialize packet filter */
299 	sc->sc_filter = NDIS_PACKET_TYPE_BROADCAST |
300 	    NDIS_PACKET_TYPE_ALL_MULTICAST;
301 	msg.ibuf.filter = htole32(sc->sc_filter);
302 	URNDIS_LOCK(sc);
303 	error = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
304 	    &msg.hdr.set, sizeof(msg.hdr.set) + sizeof(msg.ibuf.filter));
305 	URNDIS_UNLOCK(sc);
306 	if (error != (int)RNDIS_STATUS_SUCCESS) {
307 		device_printf(dev, "Unable to set data filters\n");
308 		goto detach;
309 	}
310 
311 	ue->ue_sc = sc;
312 	ue->ue_dev = dev;
313 	ue->ue_udev = uaa->device;
314 	ue->ue_mtx = &sc->sc_mtx;
315 	ue->ue_methods = &urndis_ue_methods;
316 
317 	error = uether_ifattach(ue);
318 	if (error) {
319 		device_printf(dev, "Could not attach interface\n");
320 		goto detach;
321 	}
322 
323 	URNDIS_LOCK(sc);
324 	/* start interrupt endpoint, if any */
325 	usbd_transfer_start(sc->sc_xfer[URNDIS_INTR_RX]);
326 	URNDIS_UNLOCK(sc);
327 
328 	return (0);			/* success */
329 
330 detach:
331 	(void)urndis_detach(dev);
332 	return (ENXIO);			/* failure */
333 }
334 
335 static int
336 urndis_detach(device_t dev)
337 {
338 	struct urndis_softc *sc = device_get_softc(dev);
339 	struct usb_ether *ue = &sc->sc_ue;
340 
341 	/* stop all USB transfers first */
342 	usbd_transfer_unsetup(sc->sc_xfer, URNDIS_N_TRANSFER);
343 
344 	uether_ifdetach(ue);
345 
346 	URNDIS_LOCK(sc);
347 	(void)urndis_ctrl_halt(sc);
348 	URNDIS_UNLOCK(sc);
349 
350 	mtx_destroy(&sc->sc_mtx);
351 
352 	return (0);
353 }
354 
355 static void
356 urndis_start(struct usb_ether *ue)
357 {
358 	struct urndis_softc *sc = uether_getsc(ue);
359 
360 	/*
361 	 * Start the USB transfers, if not already started:
362 	 */
363 	usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_TX]);
364 	usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_RX]);
365 }
366 
367 static void
368 urndis_init(struct usb_ether *ue)
369 {
370 	struct urndis_softc *sc = uether_getsc(ue);
371 	struct ifnet *ifp = uether_getifp(ue);
372 
373 	URNDIS_LOCK_ASSERT(sc, MA_OWNED);
374 
375 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
376 
377 	/* stall data write direction, which depends on USB mode */
378 	usbd_xfer_set_stall(sc->sc_xfer[URNDIS_BULK_TX]);
379 
380 	/* start data transfers */
381 	urndis_start(ue);
382 }
383 
384 static void
385 urndis_stop(struct usb_ether *ue)
386 {
387 	struct urndis_softc *sc = uether_getsc(ue);
388 	struct ifnet *ifp = uether_getifp(ue);
389 
390 	URNDIS_LOCK_ASSERT(sc, MA_OWNED);
391 
392 	ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
393 
394 	/*
395 	 * stop all the transfers, if not already stopped:
396 	 */
397 	usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_RX]);
398 	usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_TX]);
399 }
400 
401 static void
402 urndis_setmulti(struct usb_ether *ue)
403 {
404 
405 	/* no-op */
406 }
407 
408 static void
409 urndis_setpromisc(struct usb_ether *ue)
410 {
411 
412 	/* no-op */
413 }
414 
415 static int
416 urndis_suspend(device_t dev)
417 {
418 
419 	device_printf(dev, "Suspending\n");
420 	return (0);
421 }
422 
423 static int
424 urndis_resume(device_t dev)
425 {
426 
427 	device_printf(dev, "Resuming\n");
428 	return (0);
429 }
430 
431 static usb_error_t
432 urndis_ctrl_msg(struct urndis_softc *sc, uint8_t rt, uint8_t r,
433     uint16_t index, uint16_t value, void *buf, uint16_t buflen)
434 {
435 	usb_device_request_t req;
436 
437 	req.bmRequestType = rt;
438 	req.bRequest = r;
439 	USETW(req.wValue, value);
440 	USETW(req.wIndex, index);
441 	USETW(req.wLength, buflen);
442 
443 	return (usbd_do_request_flags(sc->sc_ue.ue_udev,
444 	    &sc->sc_mtx, &req, buf, (rt & UT_READ) ?
445 	    USB_SHORT_XFER_OK : 0, NULL, 2000 /* ms */ ));
446 }
447 
448 static usb_error_t
449 urndis_ctrl_send(struct urndis_softc *sc, void *buf, uint16_t len)
450 {
451 	usb_error_t err;
452 
453 	err = urndis_ctrl_msg(sc, UT_WRITE_CLASS_INTERFACE,
454 	    UCDC_SEND_ENCAPSULATED_COMMAND, sc->sc_ifaceno_ctl, 0, buf, len);
455 
456 	DPRINTF("%s\n", usbd_errstr(err));
457 
458 	return (err);
459 }
460 
461 static struct rndis_comp_hdr *
462 urndis_ctrl_recv(struct urndis_softc *sc)
463 {
464 	struct rndis_comp_hdr *hdr;
465 	usb_error_t err;
466 
467 	err = urndis_ctrl_msg(sc, UT_READ_CLASS_INTERFACE,
468 	    UCDC_GET_ENCAPSULATED_RESPONSE, sc->sc_ifaceno_ctl, 0,
469 	    sc->sc_response_buf, RNDIS_RESPONSE_LEN);
470 
471 	if (err != USB_ERR_NORMAL_COMPLETION)
472 		return (NULL);
473 
474 	hdr = (struct rndis_comp_hdr *)sc->sc_response_buf;
475 
476 	DPRINTF("type 0x%x len %u\n", le32toh(hdr->rm_type),
477 	    le32toh(hdr->rm_len));
478 
479 	if (le32toh(hdr->rm_len) > RNDIS_RESPONSE_LEN) {
480 		DPRINTF("ctrl message error: wrong size %u > %u\n",
481 		    le32toh(hdr->rm_len), RNDIS_RESPONSE_LEN);
482 		return (NULL);
483 	}
484 	return (hdr);
485 }
486 
487 static uint32_t
488 urndis_ctrl_handle(struct urndis_softc *sc, struct rndis_comp_hdr *hdr,
489     const void **buf, uint16_t *bufsz)
490 {
491 	uint32_t rval;
492 
493 	DPRINTF("\n");
494 
495 	if (buf != NULL && bufsz != NULL) {
496 		*buf = NULL;
497 		*bufsz = 0;
498 	}
499 	switch (le32toh(hdr->rm_type)) {
500 	case REMOTE_NDIS_INITIALIZE_CMPLT:
501 		rval = urndis_ctrl_handle_init(sc, hdr);
502 		break;
503 
504 	case REMOTE_NDIS_QUERY_CMPLT:
505 		rval = urndis_ctrl_handle_query(sc, hdr, buf, bufsz);
506 		break;
507 
508 	case REMOTE_NDIS_RESET_CMPLT:
509 		rval = urndis_ctrl_handle_reset(sc, hdr);
510 		break;
511 
512 	case REMOTE_NDIS_KEEPALIVE_CMPLT:
513 	case REMOTE_NDIS_SET_CMPLT:
514 		rval = le32toh(hdr->rm_status);
515 		break;
516 
517 	default:
518 		device_printf(sc->sc_ue.ue_dev,
519 		    "ctrl message error: unknown event 0x%x\n",
520 		    le32toh(hdr->rm_type));
521 		rval = RNDIS_STATUS_FAILURE;
522 		break;
523 	}
524 	return (rval);
525 }
526 
527 static uint32_t
528 urndis_ctrl_handle_init(struct urndis_softc *sc,
529     const struct rndis_comp_hdr *hdr)
530 {
531 	const struct rndis_init_comp *msg;
532 
533 	msg = (const struct rndis_init_comp *)hdr;
534 
535 	DPRINTF("len %u rid %u status 0x%x "
536 	    "ver_major %u ver_minor %u devflags 0x%x medium 0x%x pktmaxcnt %u "
537 	    "pktmaxsz %u align %u aflistoffset %u aflistsz %u\n",
538 	    le32toh(msg->rm_len),
539 	    le32toh(msg->rm_rid),
540 	    le32toh(msg->rm_status),
541 	    le32toh(msg->rm_ver_major),
542 	    le32toh(msg->rm_ver_minor),
543 	    le32toh(msg->rm_devflags),
544 	    le32toh(msg->rm_medium),
545 	    le32toh(msg->rm_pktmaxcnt),
546 	    le32toh(msg->rm_pktmaxsz),
547 	    le32toh(msg->rm_align),
548 	    le32toh(msg->rm_aflistoffset),
549 	    le32toh(msg->rm_aflistsz));
550 
551 	if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
552 		DPRINTF("init failed 0x%x\n", le32toh(msg->rm_status));
553 		return (le32toh(msg->rm_status));
554 	}
555 	if (le32toh(msg->rm_devflags) != RNDIS_DF_CONNECTIONLESS) {
556 		DPRINTF("wrong device type (current type: 0x%x)\n",
557 		    le32toh(msg->rm_devflags));
558 		return (RNDIS_STATUS_FAILURE);
559 	}
560 	if (le32toh(msg->rm_medium) != RNDIS_MEDIUM_802_3) {
561 		DPRINTF("medium not 802.3 (current medium: 0x%x)\n",
562 		    le32toh(msg->rm_medium));
563 		return (RNDIS_STATUS_FAILURE);
564 	}
565 	sc->sc_lim_pktsz = le32toh(msg->rm_pktmaxsz);
566 
567 	return (le32toh(msg->rm_status));
568 }
569 
570 static uint32_t
571 urndis_ctrl_handle_query(struct urndis_softc *sc,
572     const struct rndis_comp_hdr *hdr, const void **buf, uint16_t *bufsz)
573 {
574 	const struct rndis_query_comp *msg;
575 	uint64_t limit;
576 
577 	msg = (const struct rndis_query_comp *)hdr;
578 
579 	DPRINTF("len %u rid %u status 0x%x "
580 	    "buflen %u bufoff %u\n",
581 	    le32toh(msg->rm_len),
582 	    le32toh(msg->rm_rid),
583 	    le32toh(msg->rm_status),
584 	    le32toh(msg->rm_infobuflen),
585 	    le32toh(msg->rm_infobufoffset));
586 
587 	*buf = NULL;
588 	*bufsz = 0;
589 	if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
590 		DPRINTF("query failed 0x%x\n", le32toh(msg->rm_status));
591 		return (le32toh(msg->rm_status));
592 	}
593 	limit = le32toh(msg->rm_infobuflen);
594 	limit += le32toh(msg->rm_infobufoffset);
595 	limit += RNDIS_HEADER_OFFSET;
596 
597 	if (limit > (uint64_t)le32toh(msg->rm_len)) {
598 		DPRINTF("ctrl message error: invalid query info "
599 		    "len/offset/end_position(%u/%u/%u) -> "
600 		    "go out of buffer limit %u\n",
601 		    le32toh(msg->rm_infobuflen),
602 		    le32toh(msg->rm_infobufoffset),
603 		    le32toh(msg->rm_infobuflen) +
604 		    le32toh(msg->rm_infobufoffset) + RNDIS_HEADER_OFFSET,
605 		    le32toh(msg->rm_len));
606 		return (RNDIS_STATUS_FAILURE);
607 	}
608 	*buf = ((const uint8_t *)msg) + RNDIS_HEADER_OFFSET +
609 	    le32toh(msg->rm_infobufoffset);
610 	*bufsz = le32toh(msg->rm_infobuflen);
611 
612 	return (le32toh(msg->rm_status));
613 }
614 
615 static uint32_t
616 urndis_ctrl_handle_reset(struct urndis_softc *sc,
617     const struct rndis_comp_hdr *hdr)
618 {
619 	const struct rndis_reset_comp *msg;
620 	uint32_t rval;
621 
622 	msg = (const struct rndis_reset_comp *)hdr;
623 
624 	rval = le32toh(msg->rm_status);
625 
626 	DPRINTF("len %u status 0x%x "
627 	    "adrreset %u\n",
628 	    le32toh(msg->rm_len),
629 	    rval,
630 	    le32toh(msg->rm_adrreset));
631 
632 	if (rval != RNDIS_STATUS_SUCCESS) {
633 		DPRINTF("reset failed 0x%x\n", rval);
634 		return (rval);
635 	}
636 	if (msg->rm_adrreset != 0) {
637 		struct {
638 			struct rndis_set_req hdr;
639 			uint32_t filter;
640 		} msg_filter;
641 
642 		msg_filter.filter = htole32(sc->sc_filter);
643 
644 		rval = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
645 		    &msg_filter.hdr, sizeof(msg_filter));
646 
647 		if (rval != RNDIS_STATUS_SUCCESS) {
648 			DPRINTF("unable to reset data filters\n");
649 			return (rval);
650 		}
651 	}
652 	return (rval);
653 }
654 
655 static uint32_t
656 urndis_ctrl_init(struct urndis_softc *sc)
657 {
658 	struct rndis_init_req msg;
659 	struct rndis_comp_hdr *hdr;
660 	uint32_t rval;
661 
662 	msg.rm_type = htole32(REMOTE_NDIS_INITIALIZE_MSG);
663 	msg.rm_len = htole32(sizeof(msg));
664 	msg.rm_rid = 0;
665 	msg.rm_ver_major = htole32(RNDIS_VERSION_MAJOR);
666 	msg.rm_ver_minor = htole32(1);
667 	msg.rm_max_xfersz = htole32(RNDIS_RX_MAXLEN);
668 
669 	DPRINTF("type %u len %u rid %u ver_major %u "
670 	    "ver_minor %u max_xfersz %u\n",
671 	    le32toh(msg.rm_type),
672 	    le32toh(msg.rm_len),
673 	    le32toh(msg.rm_rid),
674 	    le32toh(msg.rm_ver_major),
675 	    le32toh(msg.rm_ver_minor),
676 	    le32toh(msg.rm_max_xfersz));
677 
678 	rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
679 
680 	if (rval != RNDIS_STATUS_SUCCESS) {
681 		DPRINTF("init failed\n");
682 		return (rval);
683 	}
684 	if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
685 		DPRINTF("unable to get init response\n");
686 		return (RNDIS_STATUS_FAILURE);
687 	}
688 	rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
689 
690 	return (rval);
691 }
692 
693 static uint32_t
694 urndis_ctrl_halt(struct urndis_softc *sc)
695 {
696 	struct rndis_halt_req msg;
697 	uint32_t rval;
698 
699 	msg.rm_type = htole32(REMOTE_NDIS_HALT_MSG);
700 	msg.rm_len = htole32(sizeof(msg));
701 	msg.rm_rid = 0;
702 
703 	DPRINTF("type %u len %u rid %u\n",
704 	    le32toh(msg.rm_type),
705 	    le32toh(msg.rm_len),
706 	    le32toh(msg.rm_rid));
707 
708 	rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
709 
710 	if (rval != RNDIS_STATUS_SUCCESS)
711 		DPRINTF("halt failed\n");
712 
713 	return (rval);
714 }
715 
716 /*
717  * NB: Querying a device has the requirement of using an input buffer the size
718  *     of the expected reply or larger, except for variably sized replies.
719  */
720 static uint32_t
721 urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid,
722     struct rndis_query_req *msg, uint16_t len, const void **rbuf,
723     uint16_t *rbufsz)
724 {
725 	struct rndis_comp_hdr *hdr;
726 	uint32_t datalen, rval;
727 
728 	msg->rm_type = htole32(REMOTE_NDIS_QUERY_MSG);
729 	msg->rm_len = htole32(len);
730 	msg->rm_rid = 0;		/* XXX */
731 	msg->rm_oid = htole32(oid);
732 	datalen = len - sizeof(*msg);
733 	msg->rm_infobuflen = htole32(datalen);
734 	if (datalen != 0) {
735 		msg->rm_infobufoffset = htole32(sizeof(*msg) -
736 		    RNDIS_HEADER_OFFSET);
737 	} else {
738 		msg->rm_infobufoffset = 0;
739 	}
740 	msg->rm_devicevchdl = 0;
741 
742 	DPRINTF("type %u len %u rid %u oid 0x%x "
743 	    "infobuflen %u infobufoffset %u devicevchdl %u\n",
744 	    le32toh(msg->rm_type),
745 	    le32toh(msg->rm_len),
746 	    le32toh(msg->rm_rid),
747 	    le32toh(msg->rm_oid),
748 	    le32toh(msg->rm_infobuflen),
749 	    le32toh(msg->rm_infobufoffset),
750 	    le32toh(msg->rm_devicevchdl));
751 
752 	rval = urndis_ctrl_send(sc, msg, len);
753 
754 	if (rval != RNDIS_STATUS_SUCCESS) {
755 		DPRINTF("query failed\n");
756 		return (rval);
757 	}
758 	if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
759 		DPRINTF("unable to get query response\n");
760 		return (RNDIS_STATUS_FAILURE);
761 	}
762 	rval = urndis_ctrl_handle(sc, hdr, rbuf, rbufsz);
763 
764 	return (rval);
765 }
766 
767 static uint32_t
768 urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid,
769     struct rndis_set_req *msg, uint16_t len)
770 {
771 	struct rndis_comp_hdr *hdr;
772 	uint32_t datalen, rval;
773 
774 	msg->rm_type = htole32(REMOTE_NDIS_SET_MSG);
775 	msg->rm_len = htole32(len);
776 	msg->rm_rid = 0;		/* XXX */
777 	msg->rm_oid = htole32(oid);
778 	datalen = len - sizeof(*msg);
779 	msg->rm_infobuflen = htole32(datalen);
780 	if (datalen != 0) {
781 		msg->rm_infobufoffset = htole32(sizeof(*msg) -
782 		    RNDIS_HEADER_OFFSET);
783 	} else {
784 		msg->rm_infobufoffset = 0;
785 	}
786 	msg->rm_devicevchdl = 0;
787 
788 	DPRINTF("type %u len %u rid %u oid 0x%x "
789 	    "infobuflen %u infobufoffset %u devicevchdl %u\n",
790 	    le32toh(msg->rm_type),
791 	    le32toh(msg->rm_len),
792 	    le32toh(msg->rm_rid),
793 	    le32toh(msg->rm_oid),
794 	    le32toh(msg->rm_infobuflen),
795 	    le32toh(msg->rm_infobufoffset),
796 	    le32toh(msg->rm_devicevchdl));
797 
798 	rval = urndis_ctrl_send(sc, msg, len);
799 
800 	if (rval != RNDIS_STATUS_SUCCESS) {
801 		DPRINTF("set failed\n");
802 		return (rval);
803 	}
804 	if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
805 		DPRINTF("unable to get set response\n");
806 		return (RNDIS_STATUS_FAILURE);
807 	}
808 	rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
809 	if (rval != RNDIS_STATUS_SUCCESS)
810 		DPRINTF("set failed 0x%x\n", rval);
811 
812 	return (rval);
813 }
814 
815 static void
816 urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
817 {
818 	struct urndis_softc *sc = usbd_xfer_softc(xfer);
819 	struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, 0);
820 	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
821 	struct rndis_packet_msg msg;
822 	struct mbuf *m;
823 	int actlen;
824 	int aframes;
825 	int offset;
826 
827 	switch (USB_GET_STATE(xfer)) {
828 	case USB_ST_TRANSFERRED:
829 		usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
830 
831 		DPRINTFN(1, "received %u bytes in %u frames\n", actlen, aframes);
832 
833 		for (offset = 0; actlen >= (uint32_t)sizeof(msg);) {
834 			/* copy out header */
835 			usbd_copy_out(pc, offset, &msg, sizeof(msg));
836 
837 			if (le32toh(0x1234567U) != 0x1234567U) {
838 				/* swap endianness */
839 				msg.rm_type = le32toh(msg.rm_type);
840 				msg.rm_len = le32toh(msg.rm_len);
841 				msg.rm_dataoffset = le32toh(msg.rm_dataoffset);
842 				msg.rm_datalen = le32toh(msg.rm_datalen);
843 				msg.rm_oobdataoffset = le32toh(msg.rm_oobdataoffset);
844 				msg.rm_oobdatalen = le32toh(msg.rm_oobdatalen);
845 				msg.rm_oobdataelements = le32toh(msg.rm_oobdataelements);
846 				msg.rm_pktinfooffset = le32toh(msg.rm_pktinfooffset);
847 				msg.rm_pktinfolen = le32toh(msg.rm_pktinfolen);
848 				msg.rm_vchandle = le32toh(msg.rm_vchandle);
849 				msg.rm_reserved = le32toh(msg.rm_reserved);
850 			}
851 
852 			DPRINTF("len %u data(off:%u len:%u) "
853 			    "oobdata(off:%u len:%u nb:%u) perpacket(off:%u len:%u)\n",
854 			    msg.rm_len, msg.rm_dataoffset, msg.rm_datalen,
855 			    msg.rm_oobdataoffset, msg.rm_oobdatalen,
856 			    msg.rm_oobdataelements, msg.rm_pktinfooffset,
857 			    msg.rm_pktinfooffset);
858 
859 			/* sanity check the RNDIS header */
860 			if (msg.rm_type != REMOTE_NDIS_PACKET_MSG) {
861 				DPRINTF("invalid type 0x%x != 0x%x\n",
862 				    msg.rm_type, REMOTE_NDIS_PACKET_MSG);
863 				goto tr_setup;
864 			} else if (msg.rm_len < (uint32_t)sizeof(msg)) {
865 				DPRINTF("invalid msg len %u < %u\n",
866 				    msg.rm_len, (unsigned)sizeof(msg));
867 				goto tr_setup;
868 			} else if (msg.rm_len > (uint32_t)actlen) {
869 				DPRINTF("invalid msg len %u > buffer "
870 				    "len %u\n", msg.rm_len, actlen);
871 				goto tr_setup;
872 			} else if (msg.rm_dataoffset >= (uint32_t)actlen) {
873 				DPRINTF("invalid msg dataoffset %u > buffer "
874 				    "dataoffset %u\n", msg.rm_dataoffset, actlen);
875 				goto tr_setup;
876 			} else if (msg.rm_datalen > (uint32_t)actlen) {
877 				DPRINTF("invalid msg datalen %u > buffer "
878 				    "datalen %u\n", msg.rm_datalen, actlen);
879 				goto tr_setup;
880 			} else if ((msg.rm_dataoffset + msg.rm_datalen +
881 			    (uint32_t)__offsetof(struct rndis_packet_msg,
882 			    rm_dataoffset)) > (uint32_t)actlen) {
883 				DPRINTF("invalid dataoffset %u larger than %u\n",
884 				    msg.rm_dataoffset + msg.rm_datalen +
885 				    (uint32_t)__offsetof(struct rndis_packet_msg,
886 				    rm_dataoffset), actlen);
887 				goto tr_setup;
888 			} else if (msg.rm_datalen < (uint32_t)sizeof(struct ether_header)) {
889 				if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
890 				DPRINTF("invalid ethernet size "
891 				    "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header));
892 				goto tr_setup;
893 			} else if (msg.rm_datalen > (uint32_t)(MCLBYTES - ETHER_ALIGN)) {
894 				if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
895 				DPRINTF("invalid ethernet size "
896 				    "%u > %u\n",
897 				    msg.rm_datalen, (unsigned)MCLBYTES);
898 				goto tr_setup;
899 			} else if (msg.rm_datalen > (uint32_t)(MHLEN - ETHER_ALIGN)) {
900 				m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
901 			} else {
902 				m = m_gethdr(M_NOWAIT, MT_DATA);
903 			}
904 
905 			/* check if we have a buffer */
906 			if (m != NULL) {
907 				m->m_len = m->m_pkthdr.len = msg.rm_datalen + ETHER_ALIGN;
908 				m_adj(m, ETHER_ALIGN);
909 
910 				usbd_copy_out(pc, offset + msg.rm_dataoffset +
911 				    __offsetof(struct rndis_packet_msg,
912 				    rm_dataoffset), m->m_data, msg.rm_datalen);
913 
914 				/* enqueue */
915 				uether_rxmbuf(&sc->sc_ue, m, msg.rm_datalen);
916 			} else {
917 				if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
918 			}
919 			offset += msg.rm_len;
920 			actlen -= msg.rm_len;
921 		}
922 
923 	case USB_ST_SETUP:
924 tr_setup:
925 		usbd_xfer_set_frame_len(xfer, 0, RNDIS_RX_MAXLEN);
926 		usbd_xfer_set_frames(xfer, 1);
927 		usbd_transfer_submit(xfer);
928 		uether_rxflush(&sc->sc_ue);	/* must be last */
929 		break;
930 
931 	default:			/* Error */
932 		DPRINTFN(1, "error = %s\n", usbd_errstr(error));
933 
934 		if (error != USB_ERR_CANCELLED) {
935 			/* try to clear stall first */
936 			usbd_xfer_set_stall(xfer);
937 			usbd_xfer_set_frames(xfer, 0);
938 			usbd_transfer_submit(xfer);
939 		}
940 		break;
941 	}
942 }
943 
944 static void
945 urndis_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
946 {
947 	struct rndis_packet_msg msg;
948 	struct urndis_softc *sc = usbd_xfer_softc(xfer);
949 	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
950 	struct mbuf *m;
951 	unsigned x;
952 	int actlen;
953 	int aframes;
954 
955 	usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
956 
957 	DPRINTFN(1, "\n");
958 
959 	switch (USB_GET_STATE(xfer)) {
960 	case USB_ST_TRANSFERRED:
961 		DPRINTFN(11, "%u bytes in %u frames\n", actlen, aframes);
962 
963 		if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
964 
965 		/* FALLTHROUGH */
966 	case USB_ST_SETUP:
967 tr_setup:
968 		memset(&msg, 0, sizeof(msg));
969 
970 		for (x = 0; x != RNDIS_TX_FRAMES_MAX; x++) {
971 			struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, x);
972 
973 			usbd_xfer_set_frame_offset(xfer, x * RNDIS_TX_MAXLEN, x);
974 
975 next_pkt:
976 			IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
977 
978 			if (m == NULL)
979 				break;
980 
981 			if ((m->m_pkthdr.len + sizeof(msg)) > RNDIS_TX_MAXLEN) {
982 				DPRINTF("Too big packet\n");
983 				if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
984 
985 				/* Free buffer */
986 				m_freem(m);
987 				goto next_pkt;
988 			}
989 			msg.rm_type = htole32(REMOTE_NDIS_PACKET_MSG);
990 			msg.rm_len = htole32(sizeof(msg) + m->m_pkthdr.len);
991 
992 			msg.rm_dataoffset = htole32(RNDIS_DATA_OFFSET);
993 			msg.rm_datalen = htole32(m->m_pkthdr.len);
994 
995 			/* copy in all data */
996 			usbd_copy_in(pc, 0, &msg, sizeof(msg));
997 			usbd_m_copy_in(pc, sizeof(msg), m, 0, m->m_pkthdr.len);
998 			usbd_xfer_set_frame_len(xfer, x, sizeof(msg) + m->m_pkthdr.len);
999 
1000 			/*
1001 			 * If there's a BPF listener, bounce a copy of
1002 			 * this frame to him:
1003 			 */
1004 			BPF_MTAP(ifp, m);
1005 
1006 			/* Free buffer */
1007 			m_freem(m);
1008 		}
1009 		if (x != 0) {
1010 			usbd_xfer_set_frames(xfer, x);
1011 			usbd_transfer_submit(xfer);
1012 		}
1013 		break;
1014 
1015 	default:			/* Error */
1016 		DPRINTFN(11, "transfer error, %s\n", usbd_errstr(error));
1017 
1018 		/* count output errors */
1019 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1020 
1021 		if (error != USB_ERR_CANCELLED) {
1022 			/* try to clear stall first */
1023 			usbd_xfer_set_stall(xfer);
1024 			goto tr_setup;
1025 		}
1026 		break;
1027 	}
1028 }
1029 
1030 static void
1031 urndis_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
1032 {
1033 	int actlen;
1034 
1035 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1036 
1037 	switch (USB_GET_STATE(xfer)) {
1038 	case USB_ST_TRANSFERRED:
1039 
1040 		DPRINTF("Received %d bytes\n", actlen);
1041 
1042 		/* TODO: decode some indications */
1043 
1044 		/* FALLTHROUGH */
1045 	case USB_ST_SETUP:
1046 tr_setup:
1047 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1048 		usbd_transfer_submit(xfer);
1049 		break;
1050 
1051 	default:			/* Error */
1052 		if (error != USB_ERR_CANCELLED) {
1053 			/* start clear stall */
1054 			usbd_xfer_set_stall(xfer);
1055 			goto tr_setup;
1056 		}
1057 		break;
1058 	}
1059 }
1060