1 /* $OpenBSD: if_urndis.c,v 1.46 2013/12/09 15:45:29 pirofti Exp $ */
2
3 /*
4 * Copyright (c) 2010 Jonathan Armani <[email protected]>
5 * Copyright (c) 2010 Fabien Romano <[email protected]>
6 * Copyright (c) 2010 Michael Knudsen <[email protected]>
7 * Copyright (c) 2014 Hans Petter Selasky <[email protected]>
8 * All rights reserved.
9 *
10 * Permission to use, copy, modify, and distribute this software for any
11 * purpose with or without fee is hereby granted, provided that the above
12 * copyright notice and this permission notice appear in all copies.
13 *
14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 */
22
23 #include <sys/cdefs.h>
24 __FBSDID("$FreeBSD$");
25
26 #include <sys/stdint.h>
27 #include <sys/stddef.h>
28 #include <sys/param.h>
29 #include <sys/queue.h>
30 #include <sys/types.h>
31 #include <sys/systm.h>
32 #include <sys/socket.h>
33 #include <sys/kernel.h>
34 #include <sys/bus.h>
35 #include <sys/module.h>
36 #include <sys/lock.h>
37 #include <sys/mutex.h>
38 #include <sys/condvar.h>
39 #include <sys/sysctl.h>
40 #include <sys/sx.h>
41 #include <sys/unistd.h>
42 #include <sys/callout.h>
43 #include <sys/malloc.h>
44 #include <sys/priv.h>
45
46 #include <net/if.h>
47 #include <net/if_var.h>
48 #include <net/rndis.h>
49
50 #include <dev/usb/usb.h>
51 #include <dev/usb/usbdi.h>
52 #include <dev/usb/usbdi_util.h>
53 #include "usbdevs.h"
54
55 #define USB_DEBUG_VAR urndis_debug
56 #include <dev/usb/usb_debug.h>
57 #include <dev/usb/usb_process.h>
58 #include "usb_if.h"
59
60 #include <dev/usb/net/usb_ethernet.h>
61 #include <dev/usb/net/if_urndisreg.h>
62
63 #include <dev/usb/usb_cdc.h>
64
65 static device_probe_t urndis_probe;
66 static device_attach_t urndis_attach;
67 static device_detach_t urndis_detach;
68 static device_suspend_t urndis_suspend;
69 static device_resume_t urndis_resume;
70
71 static usb_callback_t urndis_bulk_write_callback;
72 static usb_callback_t urndis_bulk_read_callback;
73 static usb_callback_t urndis_intr_read_callback;
74
75 static uether_fn_t urndis_attach_post;
76 static uether_fn_t urndis_init;
77 static uether_fn_t urndis_stop;
78 static uether_fn_t urndis_start;
79 static uether_fn_t urndis_setmulti;
80 static uether_fn_t urndis_setpromisc;
81
82 static uint32_t urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid,
83 struct rndis_query_req *msg, uint16_t len,
84 const void **rbuf, uint16_t *rbufsz);
85 static uint32_t urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid,
86 struct rndis_set_req *msg, uint16_t len);
87 static uint32_t urndis_ctrl_handle_init(struct urndis_softc *sc,
88 const struct rndis_comp_hdr *hdr);
89 static uint32_t urndis_ctrl_handle_query(struct urndis_softc *sc,
90 const struct rndis_comp_hdr *hdr, const void **buf,
91 uint16_t *bufsz);
92 static uint32_t urndis_ctrl_handle_reset(struct urndis_softc *sc,
93 const struct rndis_comp_hdr *hdr);
94 static uint32_t urndis_ctrl_init(struct urndis_softc *sc);
95 static uint32_t urndis_ctrl_halt(struct urndis_softc *sc);
96
97 #ifdef USB_DEBUG
98 static int urndis_debug = 0;
99 static SYSCTL_NODE(_hw_usb, OID_AUTO, urndis, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
100 "USB RNDIS-Ethernet");
101 SYSCTL_INT(_hw_usb_urndis, OID_AUTO, debug, CTLFLAG_RWTUN, &urndis_debug, 0,
102 "Debug level");
103 #endif
104
105 static const struct usb_config urndis_config[URNDIS_N_TRANSFER] = {
106 [URNDIS_BULK_RX] = {
107 .type = UE_BULK,
108 .endpoint = UE_ADDR_ANY,
109 .direction = UE_DIR_RX,
110 .if_index = 0,
111 .frames = 1,
112 .bufsize = RNDIS_RX_MAXLEN,
113 .flags = {.short_xfer_ok = 1,},
114 .callback = urndis_bulk_read_callback,
115 .timeout = 0, /* no timeout */
116 .usb_mode = USB_MODE_HOST,
117 },
118
119 [URNDIS_BULK_TX] = {
120 .type = UE_BULK,
121 .endpoint = UE_ADDR_ANY,
122 .direction = UE_DIR_TX,
123 .if_index = 0,
124 .frames = RNDIS_TX_FRAMES_MAX,
125 .bufsize = (RNDIS_TX_FRAMES_MAX * RNDIS_TX_MAXLEN),
126 .flags = {
127 .force_short_xfer = 1,
128 },
129 .callback = urndis_bulk_write_callback,
130 .timeout = 10000, /* 10 seconds */
131 .usb_mode = USB_MODE_HOST,
132 },
133
134 [URNDIS_INTR_RX] = {
135 .type = UE_INTERRUPT,
136 .endpoint = UE_ADDR_ANY,
137 .direction = UE_DIR_RX,
138 .if_index = 1,
139 .bufsize = 0, /* use wMaxPacketSize */
140 .flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
141 .callback = urndis_intr_read_callback,
142 .timeout = 0,
143 .usb_mode = USB_MODE_HOST,
144 },
145 };
146
147 static device_method_t urndis_methods[] = {
148 /* Device interface */
149 DEVMETHOD(device_probe, urndis_probe),
150 DEVMETHOD(device_attach, urndis_attach),
151 DEVMETHOD(device_detach, urndis_detach),
152 DEVMETHOD(device_suspend, urndis_suspend),
153 DEVMETHOD(device_resume, urndis_resume),
154
155 DEVMETHOD_END
156 };
157
158 static driver_t urndis_driver = {
159 .name = "urndis",
160 .methods = urndis_methods,
161 .size = sizeof(struct urndis_softc),
162 };
163
164 static devclass_t urndis_devclass;
165
166 static const STRUCT_USB_HOST_ID urndis_host_devs[] = {
167 /* Generic RNDIS class match */
168 {USB_IFACE_CLASS(UICLASS_CDC),
169 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL),
170 USB_IFACE_PROTOCOL(0xff)},
171 {USB_IFACE_CLASS(UICLASS_WIRELESS), USB_IFACE_SUBCLASS(UISUBCLASS_RF),
172 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)},
173 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(UISUBCLASS_SYNC),
174 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)},
175 /* HP-WebOS */
176 {USB_VENDOR(USB_VENDOR_PALM), USB_IFACE_CLASS(UICLASS_CDC),
177 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL),
178 USB_IFACE_PROTOCOL(0xff)},
179 /* Nokia 7 plus */
180 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(0x4),
181 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)},
182 /* Novatel Wireless 8800/8000/etc */
183 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(0xef),
184 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)},
185 };
186
187 DRIVER_MODULE(urndis, uhub, urndis_driver, urndis_devclass, NULL, NULL);
188 MODULE_VERSION(urndis, 1);
189 MODULE_DEPEND(urndis, uether, 1, 1, 1);
190 MODULE_DEPEND(urndis, usb, 1, 1, 1);
191 MODULE_DEPEND(urndis, ether, 1, 1, 1);
192 USB_PNP_HOST_INFO(urndis_host_devs);
193
194 static const struct usb_ether_methods urndis_ue_methods = {
195 .ue_attach_post = urndis_attach_post,
196 .ue_start = urndis_start,
197 .ue_init = urndis_init,
198 .ue_stop = urndis_stop,
199 .ue_setmulti = urndis_setmulti,
200 .ue_setpromisc = urndis_setpromisc,
201 };
202
203 static int
urndis_probe(device_t dev)204 urndis_probe(device_t dev)
205 {
206 struct usb_attach_arg *uaa = device_get_ivars(dev);
207
208 return (usbd_lookup_id_by_uaa(urndis_host_devs, sizeof(urndis_host_devs), uaa));
209 }
210
211 static void
urndis_attach_post(struct usb_ether * ue)212 urndis_attach_post(struct usb_ether *ue)
213 {
214
215 /* no-op */
216 }
217
218 static int
urndis_attach(device_t dev)219 urndis_attach(device_t dev)
220 {
221 static struct {
222 union {
223 struct rndis_query_req query;
224 struct rndis_set_req set;
225 } hdr;
226 union {
227 uint8_t eaddr[ETHER_ADDR_LEN];
228 uint32_t filter;
229 } ibuf;
230 } msg;
231 struct urndis_softc *sc = device_get_softc(dev);
232 struct usb_ether *ue = &sc->sc_ue;
233 struct usb_attach_arg *uaa = device_get_ivars(dev);
234 struct usb_cdc_cm_descriptor *cmd;
235 const void *buf;
236 uint16_t bufsz;
237 uint8_t iface_index[2] = { uaa->info.bIfaceIndex + 1, uaa->info.bIfaceIndex };
238 int error;
239 uint8_t i;
240
241 sc->sc_ue.ue_udev = uaa->device;
242 sc->sc_ifaceno_ctl = uaa->info.bIfaceNum;
243
244 cmd = usbd_find_descriptor(uaa->device, NULL, uaa->info.bIfaceIndex,
245 UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_CM, 0xFF);
246 if (cmd != NULL) {
247 DPRINTF("Call Mode Descriptor found, dataif=%d\n", cmd->bDataInterface);
248 iface_index[0] = cmd->bDataInterface;
249 }
250
251 device_set_usb_desc(dev);
252
253 mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF);
254
255 /* scan the alternate settings looking for a valid one */
256 for (i = 0; i != 32; i++) {
257 error = usbd_set_alt_interface_index(uaa->device,
258 iface_index[0], i);
259
260 if (error != 0)
261 break;
262
263 error = usbd_transfer_setup(uaa->device,
264 iface_index, sc->sc_xfer, urndis_config,
265 URNDIS_N_TRANSFER, sc, &sc->sc_mtx);
266
267 if (error == 0)
268 break;
269 }
270 if ((error != 0) || (i == 32)) {
271 device_printf(dev, "No valid alternate setting found\n");
272 goto detach;
273 }
274
275 /* Initialize device - must be done before even querying it */
276 URNDIS_LOCK(sc);
277 error = urndis_ctrl_init(sc);
278 URNDIS_UNLOCK(sc);
279 if (error != (int)RNDIS_STATUS_SUCCESS) {
280 device_printf(dev, "Unable to initialize hardware\n");
281 goto detach;
282 }
283
284 /* Determine MAC address */
285 memset(msg.ibuf.eaddr, 0, sizeof(msg.ibuf.eaddr));
286 URNDIS_LOCK(sc);
287 error = urndis_ctrl_query(sc, OID_802_3_PERMANENT_ADDRESS,
288 &msg.hdr.query, sizeof(msg.hdr.query) + sizeof(msg.ibuf.eaddr),
289 &buf, &bufsz);
290 URNDIS_UNLOCK(sc);
291 if (error != (int)RNDIS_STATUS_SUCCESS) {
292 device_printf(dev, "Unable to get hardware address\n");
293 goto detach;
294 }
295 if (bufsz != ETHER_ADDR_LEN) {
296 device_printf(dev, "Invalid address length: %d bytes\n", bufsz);
297 goto detach;
298 }
299 memcpy(&sc->sc_ue.ue_eaddr, buf, ETHER_ADDR_LEN);
300
301 /* Initialize packet filter */
302 sc->sc_filter = NDIS_PACKET_TYPE_BROADCAST |
303 NDIS_PACKET_TYPE_ALL_MULTICAST;
304 msg.ibuf.filter = htole32(sc->sc_filter);
305 URNDIS_LOCK(sc);
306 error = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
307 &msg.hdr.set, sizeof(msg.hdr.set) + sizeof(msg.ibuf.filter));
308 URNDIS_UNLOCK(sc);
309 if (error != (int)RNDIS_STATUS_SUCCESS) {
310 device_printf(dev, "Unable to set data filters\n");
311 goto detach;
312 }
313
314 ue->ue_sc = sc;
315 ue->ue_dev = dev;
316 ue->ue_udev = uaa->device;
317 ue->ue_mtx = &sc->sc_mtx;
318 ue->ue_methods = &urndis_ue_methods;
319
320 error = uether_ifattach(ue);
321 if (error) {
322 device_printf(dev, "Could not attach interface\n");
323 goto detach;
324 }
325
326 URNDIS_LOCK(sc);
327 /* start interrupt endpoint, if any */
328 usbd_transfer_start(sc->sc_xfer[URNDIS_INTR_RX]);
329 URNDIS_UNLOCK(sc);
330
331 return (0); /* success */
332
333 detach:
334 (void)urndis_detach(dev);
335 return (ENXIO); /* failure */
336 }
337
338 static int
urndis_detach(device_t dev)339 urndis_detach(device_t dev)
340 {
341 struct urndis_softc *sc = device_get_softc(dev);
342 struct usb_ether *ue = &sc->sc_ue;
343
344 /* stop all USB transfers first */
345 usbd_transfer_unsetup(sc->sc_xfer, URNDIS_N_TRANSFER);
346
347 uether_ifdetach(ue);
348
349 URNDIS_LOCK(sc);
350 (void)urndis_ctrl_halt(sc);
351 URNDIS_UNLOCK(sc);
352
353 mtx_destroy(&sc->sc_mtx);
354
355 return (0);
356 }
357
358 static void
urndis_start(struct usb_ether * ue)359 urndis_start(struct usb_ether *ue)
360 {
361 struct urndis_softc *sc = uether_getsc(ue);
362
363 /*
364 * Start the USB transfers, if not already started:
365 */
366 usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_TX]);
367 usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_RX]);
368 }
369
370 static void
urndis_init(struct usb_ether * ue)371 urndis_init(struct usb_ether *ue)
372 {
373 struct urndis_softc *sc = uether_getsc(ue);
374 struct ifnet *ifp = uether_getifp(ue);
375
376 URNDIS_LOCK_ASSERT(sc, MA_OWNED);
377
378 ifp->if_drv_flags |= IFF_DRV_RUNNING;
379
380 /* stall data write direction, which depends on USB mode */
381 usbd_xfer_set_stall(sc->sc_xfer[URNDIS_BULK_TX]);
382
383 /* start data transfers */
384 urndis_start(ue);
385 }
386
387 static void
urndis_stop(struct usb_ether * ue)388 urndis_stop(struct usb_ether *ue)
389 {
390 struct urndis_softc *sc = uether_getsc(ue);
391 struct ifnet *ifp = uether_getifp(ue);
392
393 URNDIS_LOCK_ASSERT(sc, MA_OWNED);
394
395 ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
396
397 /*
398 * stop all the transfers, if not already stopped:
399 */
400 usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_RX]);
401 usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_TX]);
402 }
403
404 static void
urndis_setmulti(struct usb_ether * ue)405 urndis_setmulti(struct usb_ether *ue)
406 {
407
408 /* no-op */
409 }
410
411 static void
urndis_setpromisc(struct usb_ether * ue)412 urndis_setpromisc(struct usb_ether *ue)
413 {
414
415 /* no-op */
416 }
417
418 static int
urndis_suspend(device_t dev)419 urndis_suspend(device_t dev)
420 {
421
422 device_printf(dev, "Suspending\n");
423 return (0);
424 }
425
426 static int
urndis_resume(device_t dev)427 urndis_resume(device_t dev)
428 {
429
430 device_printf(dev, "Resuming\n");
431 return (0);
432 }
433
434 static usb_error_t
urndis_ctrl_msg(struct urndis_softc * sc,uint8_t rt,uint8_t r,uint16_t index,uint16_t value,void * buf,uint16_t buflen)435 urndis_ctrl_msg(struct urndis_softc *sc, uint8_t rt, uint8_t r,
436 uint16_t index, uint16_t value, void *buf, uint16_t buflen)
437 {
438 usb_device_request_t req;
439
440 req.bmRequestType = rt;
441 req.bRequest = r;
442 USETW(req.wValue, value);
443 USETW(req.wIndex, index);
444 USETW(req.wLength, buflen);
445
446 return (usbd_do_request_flags(sc->sc_ue.ue_udev,
447 &sc->sc_mtx, &req, buf, (rt & UT_READ) ?
448 USB_SHORT_XFER_OK : 0, NULL, 2000 /* ms */ ));
449 }
450
451 static usb_error_t
urndis_ctrl_send(struct urndis_softc * sc,void * buf,uint16_t len)452 urndis_ctrl_send(struct urndis_softc *sc, void *buf, uint16_t len)
453 {
454 usb_error_t err;
455
456 err = urndis_ctrl_msg(sc, UT_WRITE_CLASS_INTERFACE,
457 UCDC_SEND_ENCAPSULATED_COMMAND, sc->sc_ifaceno_ctl, 0, buf, len);
458
459 DPRINTF("%s\n", usbd_errstr(err));
460
461 return (err);
462 }
463
464 static struct rndis_comp_hdr *
urndis_ctrl_recv(struct urndis_softc * sc)465 urndis_ctrl_recv(struct urndis_softc *sc)
466 {
467 struct rndis_comp_hdr *hdr;
468 usb_error_t err;
469
470 err = urndis_ctrl_msg(sc, UT_READ_CLASS_INTERFACE,
471 UCDC_GET_ENCAPSULATED_RESPONSE, sc->sc_ifaceno_ctl, 0,
472 sc->sc_response_buf, RNDIS_RESPONSE_LEN);
473
474 if (err != USB_ERR_NORMAL_COMPLETION)
475 return (NULL);
476
477 hdr = (struct rndis_comp_hdr *)sc->sc_response_buf;
478
479 DPRINTF("type 0x%x len %u\n", le32toh(hdr->rm_type),
480 le32toh(hdr->rm_len));
481
482 if (le32toh(hdr->rm_len) > RNDIS_RESPONSE_LEN) {
483 DPRINTF("ctrl message error: wrong size %u > %u\n",
484 le32toh(hdr->rm_len), RNDIS_RESPONSE_LEN);
485 return (NULL);
486 }
487 return (hdr);
488 }
489
490 static uint32_t
urndis_ctrl_handle(struct urndis_softc * sc,struct rndis_comp_hdr * hdr,const void ** buf,uint16_t * bufsz)491 urndis_ctrl_handle(struct urndis_softc *sc, struct rndis_comp_hdr *hdr,
492 const void **buf, uint16_t *bufsz)
493 {
494 uint32_t rval;
495
496 DPRINTF("\n");
497
498 if (buf != NULL && bufsz != NULL) {
499 *buf = NULL;
500 *bufsz = 0;
501 }
502 switch (le32toh(hdr->rm_type)) {
503 case REMOTE_NDIS_INITIALIZE_CMPLT:
504 rval = urndis_ctrl_handle_init(sc, hdr);
505 break;
506
507 case REMOTE_NDIS_QUERY_CMPLT:
508 rval = urndis_ctrl_handle_query(sc, hdr, buf, bufsz);
509 break;
510
511 case REMOTE_NDIS_RESET_CMPLT:
512 rval = urndis_ctrl_handle_reset(sc, hdr);
513 break;
514
515 case REMOTE_NDIS_KEEPALIVE_CMPLT:
516 case REMOTE_NDIS_SET_CMPLT:
517 rval = le32toh(hdr->rm_status);
518 break;
519
520 default:
521 device_printf(sc->sc_ue.ue_dev,
522 "ctrl message error: unknown event 0x%x\n",
523 le32toh(hdr->rm_type));
524 rval = RNDIS_STATUS_FAILURE;
525 break;
526 }
527 return (rval);
528 }
529
530 static uint32_t
urndis_ctrl_handle_init(struct urndis_softc * sc,const struct rndis_comp_hdr * hdr)531 urndis_ctrl_handle_init(struct urndis_softc *sc,
532 const struct rndis_comp_hdr *hdr)
533 {
534 const struct rndis_init_comp *msg;
535
536 msg = (const struct rndis_init_comp *)hdr;
537
538 DPRINTF("len %u rid %u status 0x%x "
539 "ver_major %u ver_minor %u devflags 0x%x medium 0x%x pktmaxcnt %u "
540 "pktmaxsz %u align %u aflistoffset %u aflistsz %u\n",
541 le32toh(msg->rm_len),
542 le32toh(msg->rm_rid),
543 le32toh(msg->rm_status),
544 le32toh(msg->rm_ver_major),
545 le32toh(msg->rm_ver_minor),
546 le32toh(msg->rm_devflags),
547 le32toh(msg->rm_medium),
548 le32toh(msg->rm_pktmaxcnt),
549 le32toh(msg->rm_pktmaxsz),
550 le32toh(msg->rm_align),
551 le32toh(msg->rm_aflistoffset),
552 le32toh(msg->rm_aflistsz));
553
554 if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
555 DPRINTF("init failed 0x%x\n", le32toh(msg->rm_status));
556 return (le32toh(msg->rm_status));
557 }
558 if (le32toh(msg->rm_devflags) != RNDIS_DF_CONNECTIONLESS) {
559 DPRINTF("wrong device type (current type: 0x%x)\n",
560 le32toh(msg->rm_devflags));
561 return (RNDIS_STATUS_FAILURE);
562 }
563 if (le32toh(msg->rm_medium) != RNDIS_MEDIUM_802_3) {
564 DPRINTF("medium not 802.3 (current medium: 0x%x)\n",
565 le32toh(msg->rm_medium));
566 return (RNDIS_STATUS_FAILURE);
567 }
568 sc->sc_lim_pktsz = le32toh(msg->rm_pktmaxsz);
569
570 return (le32toh(msg->rm_status));
571 }
572
573 static uint32_t
urndis_ctrl_handle_query(struct urndis_softc * sc,const struct rndis_comp_hdr * hdr,const void ** buf,uint16_t * bufsz)574 urndis_ctrl_handle_query(struct urndis_softc *sc,
575 const struct rndis_comp_hdr *hdr, const void **buf, uint16_t *bufsz)
576 {
577 const struct rndis_query_comp *msg;
578 uint64_t limit;
579
580 msg = (const struct rndis_query_comp *)hdr;
581
582 DPRINTF("len %u rid %u status 0x%x "
583 "buflen %u bufoff %u\n",
584 le32toh(msg->rm_len),
585 le32toh(msg->rm_rid),
586 le32toh(msg->rm_status),
587 le32toh(msg->rm_infobuflen),
588 le32toh(msg->rm_infobufoffset));
589
590 *buf = NULL;
591 *bufsz = 0;
592 if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
593 DPRINTF("query failed 0x%x\n", le32toh(msg->rm_status));
594 return (le32toh(msg->rm_status));
595 }
596 limit = le32toh(msg->rm_infobuflen);
597 limit += le32toh(msg->rm_infobufoffset);
598 limit += RNDIS_HEADER_OFFSET;
599
600 if (limit > (uint64_t)le32toh(msg->rm_len)) {
601 DPRINTF("ctrl message error: invalid query info "
602 "len/offset/end_position(%u/%u/%u) -> "
603 "go out of buffer limit %u\n",
604 le32toh(msg->rm_infobuflen),
605 le32toh(msg->rm_infobufoffset),
606 le32toh(msg->rm_infobuflen) +
607 le32toh(msg->rm_infobufoffset) + RNDIS_HEADER_OFFSET,
608 le32toh(msg->rm_len));
609 return (RNDIS_STATUS_FAILURE);
610 }
611 *buf = ((const uint8_t *)msg) + RNDIS_HEADER_OFFSET +
612 le32toh(msg->rm_infobufoffset);
613 *bufsz = le32toh(msg->rm_infobuflen);
614
615 return (le32toh(msg->rm_status));
616 }
617
618 static uint32_t
urndis_ctrl_handle_reset(struct urndis_softc * sc,const struct rndis_comp_hdr * hdr)619 urndis_ctrl_handle_reset(struct urndis_softc *sc,
620 const struct rndis_comp_hdr *hdr)
621 {
622 const struct rndis_reset_comp *msg;
623 uint32_t rval;
624
625 msg = (const struct rndis_reset_comp *)hdr;
626
627 rval = le32toh(msg->rm_status);
628
629 DPRINTF("len %u status 0x%x "
630 "adrreset %u\n",
631 le32toh(msg->rm_len),
632 rval,
633 le32toh(msg->rm_adrreset));
634
635 if (rval != RNDIS_STATUS_SUCCESS) {
636 DPRINTF("reset failed 0x%x\n", rval);
637 return (rval);
638 }
639 if (msg->rm_adrreset != 0) {
640 struct {
641 struct rndis_set_req hdr;
642 uint32_t filter;
643 } msg_filter;
644
645 msg_filter.filter = htole32(sc->sc_filter);
646
647 rval = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
648 &msg_filter.hdr, sizeof(msg_filter));
649
650 if (rval != RNDIS_STATUS_SUCCESS) {
651 DPRINTF("unable to reset data filters\n");
652 return (rval);
653 }
654 }
655 return (rval);
656 }
657
658 static uint32_t
urndis_ctrl_init(struct urndis_softc * sc)659 urndis_ctrl_init(struct urndis_softc *sc)
660 {
661 struct rndis_init_req msg;
662 struct rndis_comp_hdr *hdr;
663 uint32_t rval;
664
665 msg.rm_type = htole32(REMOTE_NDIS_INITIALIZE_MSG);
666 msg.rm_len = htole32(sizeof(msg));
667 msg.rm_rid = 0;
668 msg.rm_ver_major = htole32(RNDIS_VERSION_MAJOR);
669 msg.rm_ver_minor = htole32(1);
670 msg.rm_max_xfersz = htole32(RNDIS_RX_MAXLEN);
671
672 DPRINTF("type %u len %u rid %u ver_major %u "
673 "ver_minor %u max_xfersz %u\n",
674 le32toh(msg.rm_type),
675 le32toh(msg.rm_len),
676 le32toh(msg.rm_rid),
677 le32toh(msg.rm_ver_major),
678 le32toh(msg.rm_ver_minor),
679 le32toh(msg.rm_max_xfersz));
680
681 rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
682
683 if (rval != RNDIS_STATUS_SUCCESS) {
684 DPRINTF("init failed\n");
685 return (rval);
686 }
687 if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
688 DPRINTF("unable to get init response\n");
689 return (RNDIS_STATUS_FAILURE);
690 }
691 rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
692
693 return (rval);
694 }
695
696 static uint32_t
urndis_ctrl_halt(struct urndis_softc * sc)697 urndis_ctrl_halt(struct urndis_softc *sc)
698 {
699 struct rndis_halt_req msg;
700 uint32_t rval;
701
702 msg.rm_type = htole32(REMOTE_NDIS_HALT_MSG);
703 msg.rm_len = htole32(sizeof(msg));
704 msg.rm_rid = 0;
705
706 DPRINTF("type %u len %u rid %u\n",
707 le32toh(msg.rm_type),
708 le32toh(msg.rm_len),
709 le32toh(msg.rm_rid));
710
711 rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
712
713 if (rval != RNDIS_STATUS_SUCCESS)
714 DPRINTF("halt failed\n");
715
716 return (rval);
717 }
718
719 /*
720 * NB: Querying a device has the requirement of using an input buffer the size
721 * of the expected reply or larger, except for variably sized replies.
722 */
723 static uint32_t
urndis_ctrl_query(struct urndis_softc * sc,uint32_t oid,struct rndis_query_req * msg,uint16_t len,const void ** rbuf,uint16_t * rbufsz)724 urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid,
725 struct rndis_query_req *msg, uint16_t len, const void **rbuf,
726 uint16_t *rbufsz)
727 {
728 struct rndis_comp_hdr *hdr;
729 uint32_t datalen, rval;
730
731 msg->rm_type = htole32(REMOTE_NDIS_QUERY_MSG);
732 msg->rm_len = htole32(len);
733 msg->rm_rid = 0; /* XXX */
734 msg->rm_oid = htole32(oid);
735 datalen = len - sizeof(*msg);
736 msg->rm_infobuflen = htole32(datalen);
737 if (datalen != 0) {
738 msg->rm_infobufoffset = htole32(sizeof(*msg) -
739 RNDIS_HEADER_OFFSET);
740 } else {
741 msg->rm_infobufoffset = 0;
742 }
743 msg->rm_devicevchdl = 0;
744
745 DPRINTF("type %u len %u rid %u oid 0x%x "
746 "infobuflen %u infobufoffset %u devicevchdl %u\n",
747 le32toh(msg->rm_type),
748 le32toh(msg->rm_len),
749 le32toh(msg->rm_rid),
750 le32toh(msg->rm_oid),
751 le32toh(msg->rm_infobuflen),
752 le32toh(msg->rm_infobufoffset),
753 le32toh(msg->rm_devicevchdl));
754
755 rval = urndis_ctrl_send(sc, msg, len);
756
757 if (rval != RNDIS_STATUS_SUCCESS) {
758 DPRINTF("query failed\n");
759 return (rval);
760 }
761 if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
762 DPRINTF("unable to get query response\n");
763 return (RNDIS_STATUS_FAILURE);
764 }
765 rval = urndis_ctrl_handle(sc, hdr, rbuf, rbufsz);
766
767 return (rval);
768 }
769
770 static uint32_t
urndis_ctrl_set(struct urndis_softc * sc,uint32_t oid,struct rndis_set_req * msg,uint16_t len)771 urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid,
772 struct rndis_set_req *msg, uint16_t len)
773 {
774 struct rndis_comp_hdr *hdr;
775 uint32_t datalen, rval;
776
777 msg->rm_type = htole32(REMOTE_NDIS_SET_MSG);
778 msg->rm_len = htole32(len);
779 msg->rm_rid = 0; /* XXX */
780 msg->rm_oid = htole32(oid);
781 datalen = len - sizeof(*msg);
782 msg->rm_infobuflen = htole32(datalen);
783 if (datalen != 0) {
784 msg->rm_infobufoffset = htole32(sizeof(*msg) -
785 RNDIS_HEADER_OFFSET);
786 } else {
787 msg->rm_infobufoffset = 0;
788 }
789 msg->rm_devicevchdl = 0;
790
791 DPRINTF("type %u len %u rid %u oid 0x%x "
792 "infobuflen %u infobufoffset %u devicevchdl %u\n",
793 le32toh(msg->rm_type),
794 le32toh(msg->rm_len),
795 le32toh(msg->rm_rid),
796 le32toh(msg->rm_oid),
797 le32toh(msg->rm_infobuflen),
798 le32toh(msg->rm_infobufoffset),
799 le32toh(msg->rm_devicevchdl));
800
801 rval = urndis_ctrl_send(sc, msg, len);
802
803 if (rval != RNDIS_STATUS_SUCCESS) {
804 DPRINTF("set failed\n");
805 return (rval);
806 }
807 if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
808 DPRINTF("unable to get set response\n");
809 return (RNDIS_STATUS_FAILURE);
810 }
811 rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
812 if (rval != RNDIS_STATUS_SUCCESS)
813 DPRINTF("set failed 0x%x\n", rval);
814
815 return (rval);
816 }
817
818 static void
urndis_bulk_read_callback(struct usb_xfer * xfer,usb_error_t error)819 urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
820 {
821 struct urndis_softc *sc = usbd_xfer_softc(xfer);
822 struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, 0);
823 struct ifnet *ifp = uether_getifp(&sc->sc_ue);
824 struct rndis_packet_msg msg;
825 struct mbuf *m;
826 int actlen;
827 int aframes;
828 int offset;
829
830 switch (USB_GET_STATE(xfer)) {
831 case USB_ST_TRANSFERRED:
832 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
833
834 DPRINTFN(1, "received %u bytes in %u frames\n", actlen, aframes);
835
836 for (offset = 0; actlen >= (uint32_t)sizeof(msg);) {
837 /* copy out header */
838 usbd_copy_out(pc, offset, &msg, sizeof(msg));
839
840 if (le32toh(0x1234567U) != 0x1234567U) {
841 /* swap endianness */
842 msg.rm_type = le32toh(msg.rm_type);
843 msg.rm_len = le32toh(msg.rm_len);
844 msg.rm_dataoffset = le32toh(msg.rm_dataoffset);
845 msg.rm_datalen = le32toh(msg.rm_datalen);
846 msg.rm_oobdataoffset = le32toh(msg.rm_oobdataoffset);
847 msg.rm_oobdatalen = le32toh(msg.rm_oobdatalen);
848 msg.rm_oobdataelements = le32toh(msg.rm_oobdataelements);
849 msg.rm_pktinfooffset = le32toh(msg.rm_pktinfooffset);
850 msg.rm_pktinfolen = le32toh(msg.rm_pktinfolen);
851 msg.rm_vchandle = le32toh(msg.rm_vchandle);
852 msg.rm_reserved = le32toh(msg.rm_reserved);
853 }
854
855 DPRINTF("len %u data(off:%u len:%u) "
856 "oobdata(off:%u len:%u nb:%u) perpacket(off:%u len:%u)\n",
857 msg.rm_len, msg.rm_dataoffset, msg.rm_datalen,
858 msg.rm_oobdataoffset, msg.rm_oobdatalen,
859 msg.rm_oobdataelements, msg.rm_pktinfooffset,
860 msg.rm_pktinfooffset);
861
862 /* sanity check the RNDIS header */
863 if (msg.rm_type != REMOTE_NDIS_PACKET_MSG) {
864 DPRINTF("invalid type 0x%x != 0x%x\n",
865 msg.rm_type, REMOTE_NDIS_PACKET_MSG);
866 goto tr_setup;
867 } else if (msg.rm_len < (uint32_t)sizeof(msg)) {
868 DPRINTF("invalid msg len %u < %u\n",
869 msg.rm_len, (unsigned)sizeof(msg));
870 goto tr_setup;
871 } else if (msg.rm_len > (uint32_t)actlen) {
872 DPRINTF("invalid msg len %u > buffer "
873 "len %u\n", msg.rm_len, actlen);
874 goto tr_setup;
875 } else if (msg.rm_dataoffset >= (uint32_t)actlen) {
876 DPRINTF("invalid msg dataoffset %u > buffer "
877 "dataoffset %u\n", msg.rm_dataoffset, actlen);
878 goto tr_setup;
879 } else if (msg.rm_datalen > (uint32_t)actlen) {
880 DPRINTF("invalid msg datalen %u > buffer "
881 "datalen %u\n", msg.rm_datalen, actlen);
882 goto tr_setup;
883 } else if ((msg.rm_dataoffset + msg.rm_datalen +
884 (uint32_t)__offsetof(struct rndis_packet_msg,
885 rm_dataoffset)) > (uint32_t)actlen) {
886 DPRINTF("invalid dataoffset %u larger than %u\n",
887 msg.rm_dataoffset + msg.rm_datalen +
888 (uint32_t)__offsetof(struct rndis_packet_msg,
889 rm_dataoffset), actlen);
890 goto tr_setup;
891 } else if (msg.rm_datalen < (uint32_t)sizeof(struct ether_header)) {
892 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
893 DPRINTF("invalid ethernet size "
894 "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header));
895 goto tr_setup;
896 } else if (msg.rm_datalen > (uint32_t)(MCLBYTES - ETHER_ALIGN)) {
897 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
898 DPRINTF("invalid ethernet size "
899 "%u > %u\n",
900 msg.rm_datalen, (unsigned)MCLBYTES);
901 goto tr_setup;
902 } else if (msg.rm_datalen > (uint32_t)(MHLEN - ETHER_ALIGN)) {
903 m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
904 } else {
905 m = m_gethdr(M_NOWAIT, MT_DATA);
906 }
907
908 /* check if we have a buffer */
909 if (m != NULL) {
910 m->m_len = m->m_pkthdr.len = msg.rm_datalen + ETHER_ALIGN;
911 m_adj(m, ETHER_ALIGN);
912
913 usbd_copy_out(pc, offset + msg.rm_dataoffset +
914 __offsetof(struct rndis_packet_msg,
915 rm_dataoffset), m->m_data, msg.rm_datalen);
916
917 /* enqueue */
918 uether_rxmbuf(&sc->sc_ue, m, msg.rm_datalen);
919 } else {
920 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
921 }
922 offset += msg.rm_len;
923 actlen -= msg.rm_len;
924 }
925
926 case USB_ST_SETUP:
927 tr_setup:
928 usbd_xfer_set_frame_len(xfer, 0, RNDIS_RX_MAXLEN);
929 usbd_xfer_set_frames(xfer, 1);
930 usbd_transfer_submit(xfer);
931 uether_rxflush(&sc->sc_ue); /* must be last */
932 break;
933
934 default: /* Error */
935 DPRINTFN(1, "error = %s\n", usbd_errstr(error));
936
937 if (error != USB_ERR_CANCELLED) {
938 /* try to clear stall first */
939 usbd_xfer_set_stall(xfer);
940 usbd_xfer_set_frames(xfer, 0);
941 usbd_transfer_submit(xfer);
942 }
943 break;
944 }
945 }
946
947 static void
urndis_bulk_write_callback(struct usb_xfer * xfer,usb_error_t error)948 urndis_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
949 {
950 struct rndis_packet_msg msg;
951 struct urndis_softc *sc = usbd_xfer_softc(xfer);
952 struct ifnet *ifp = uether_getifp(&sc->sc_ue);
953 struct mbuf *m;
954 unsigned x;
955 int actlen;
956 int aframes;
957
958 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
959
960 DPRINTFN(1, "\n");
961
962 switch (USB_GET_STATE(xfer)) {
963 case USB_ST_TRANSFERRED:
964 DPRINTFN(11, "%u bytes in %u frames\n", actlen, aframes);
965
966 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
967
968 /* FALLTHROUGH */
969 case USB_ST_SETUP:
970 tr_setup:
971 memset(&msg, 0, sizeof(msg));
972
973 for (x = 0; x != RNDIS_TX_FRAMES_MAX; x++) {
974 struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, x);
975
976 usbd_xfer_set_frame_offset(xfer, x * RNDIS_TX_MAXLEN, x);
977
978 next_pkt:
979 IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
980
981 if (m == NULL)
982 break;
983
984 if ((m->m_pkthdr.len + sizeof(msg)) > RNDIS_TX_MAXLEN) {
985 DPRINTF("Too big packet\n");
986 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
987
988 /* Free buffer */
989 m_freem(m);
990 goto next_pkt;
991 }
992 msg.rm_type = htole32(REMOTE_NDIS_PACKET_MSG);
993 msg.rm_len = htole32(sizeof(msg) + m->m_pkthdr.len);
994
995 msg.rm_dataoffset = htole32(RNDIS_DATA_OFFSET);
996 msg.rm_datalen = htole32(m->m_pkthdr.len);
997
998 /* copy in all data */
999 usbd_copy_in(pc, 0, &msg, sizeof(msg));
1000 usbd_m_copy_in(pc, sizeof(msg), m, 0, m->m_pkthdr.len);
1001 usbd_xfer_set_frame_len(xfer, x, sizeof(msg) + m->m_pkthdr.len);
1002
1003 /*
1004 * If there's a BPF listener, bounce a copy of
1005 * this frame to him:
1006 */
1007 BPF_MTAP(ifp, m);
1008
1009 /* Free buffer */
1010 m_freem(m);
1011 }
1012 if (x != 0) {
1013 usbd_xfer_set_frames(xfer, x);
1014 usbd_transfer_submit(xfer);
1015 }
1016 break;
1017
1018 default: /* Error */
1019 DPRINTFN(11, "transfer error, %s\n", usbd_errstr(error));
1020
1021 /* count output errors */
1022 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1023
1024 if (error != USB_ERR_CANCELLED) {
1025 /* try to clear stall first */
1026 usbd_xfer_set_stall(xfer);
1027 goto tr_setup;
1028 }
1029 break;
1030 }
1031 }
1032
1033 static void
urndis_intr_read_callback(struct usb_xfer * xfer,usb_error_t error)1034 urndis_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
1035 {
1036 int actlen;
1037
1038 usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1039
1040 switch (USB_GET_STATE(xfer)) {
1041 case USB_ST_TRANSFERRED:
1042
1043 DPRINTF("Received %d bytes\n", actlen);
1044
1045 /* TODO: decode some indications */
1046
1047 /* FALLTHROUGH */
1048 case USB_ST_SETUP:
1049 tr_setup:
1050 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1051 usbd_transfer_submit(xfer);
1052 break;
1053
1054 default: /* Error */
1055 if (error != USB_ERR_CANCELLED) {
1056 /* start clear stall */
1057 usbd_xfer_set_stall(xfer);
1058 goto tr_setup;
1059 }
1060 break;
1061 }
1062 }
1063