1 /* $OpenBSD: if_urndis.c,v 1.46 2013/12/09 15:45:29 pirofti Exp $ */
2
3 /*
4 * Copyright (c) 2010 Jonathan Armani <[email protected]>
5 * Copyright (c) 2010 Fabien Romano <[email protected]>
6 * Copyright (c) 2010 Michael Knudsen <[email protected]>
7 * Copyright (c) 2014 Hans Petter Selasky <[email protected]>
8 * All rights reserved.
9 *
10 * Permission to use, copy, modify, and distribute this software for any
11 * purpose with or without fee is hereby granted, provided that the above
12 * copyright notice and this permission notice appear in all copies.
13 *
14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 */
22
23 #include <sys/cdefs.h>
24 #include <sys/stdint.h>
25 #include <sys/stddef.h>
26 #include <sys/param.h>
27 #include <sys/queue.h>
28 #include <sys/types.h>
29 #include <sys/systm.h>
30 #include <sys/socket.h>
31 #include <sys/kernel.h>
32 #include <sys/bus.h>
33 #include <sys/module.h>
34 #include <sys/lock.h>
35 #include <sys/mutex.h>
36 #include <sys/condvar.h>
37 #include <sys/sysctl.h>
38 #include <sys/sx.h>
39 #include <sys/unistd.h>
40 #include <sys/callout.h>
41 #include <sys/malloc.h>
42 #include <sys/priv.h>
43
44 #include <net/if.h>
45 #include <net/if_var.h>
46 #include <net/rndis.h>
47
48 #include <dev/usb/usb.h>
49 #include <dev/usb/usbdi.h>
50 #include <dev/usb/usbdi_util.h>
51 #include "usbdevs.h"
52
53 #define USB_DEBUG_VAR urndis_debug
54 #include <dev/usb/usb_debug.h>
55 #include <dev/usb/usb_process.h>
56 #include "usb_if.h"
57
58 #include <dev/usb/net/usb_ethernet.h>
59 #include <dev/usb/net/if_urndisreg.h>
60
61 #include <dev/usb/usb_cdc.h>
62
63 static device_probe_t urndis_probe;
64 static device_attach_t urndis_attach;
65 static device_detach_t urndis_detach;
66 static device_suspend_t urndis_suspend;
67 static device_resume_t urndis_resume;
68
69 static usb_callback_t urndis_bulk_write_callback;
70 static usb_callback_t urndis_bulk_read_callback;
71 static usb_callback_t urndis_intr_read_callback;
72
73 static uether_fn_t urndis_attach_post;
74 static uether_fn_t urndis_init;
75 static uether_fn_t urndis_stop;
76 static uether_fn_t urndis_start;
77 static uether_fn_t urndis_setmulti;
78 static uether_fn_t urndis_setpromisc;
79
80 static uint32_t urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid,
81 struct rndis_query_req *msg, uint16_t len,
82 const void **rbuf, uint16_t *rbufsz);
83 static uint32_t urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid,
84 struct rndis_set_req *msg, uint16_t len);
85 static uint32_t urndis_ctrl_handle_init(struct urndis_softc *sc,
86 const struct rndis_comp_hdr *hdr);
87 static uint32_t urndis_ctrl_handle_query(struct urndis_softc *sc,
88 const struct rndis_comp_hdr *hdr, const void **buf,
89 uint16_t *bufsz);
90 static uint32_t urndis_ctrl_handle_reset(struct urndis_softc *sc,
91 const struct rndis_comp_hdr *hdr);
92 static uint32_t urndis_ctrl_init(struct urndis_softc *sc);
93 static uint32_t urndis_ctrl_halt(struct urndis_softc *sc);
94
95 #ifdef USB_DEBUG
96 static int urndis_debug = 0;
97 static SYSCTL_NODE(_hw_usb, OID_AUTO, urndis, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
98 "USB RNDIS-Ethernet");
99 SYSCTL_INT(_hw_usb_urndis, OID_AUTO, debug, CTLFLAG_RWTUN, &urndis_debug, 0,
100 "Debug level");
101 #endif
102
103 static const struct usb_config urndis_config[URNDIS_N_TRANSFER] = {
104 [URNDIS_BULK_RX] = {
105 .type = UE_BULK,
106 .endpoint = UE_ADDR_ANY,
107 .direction = UE_DIR_RX,
108 .if_index = 0,
109 .frames = 1,
110 .bufsize = RNDIS_RX_MAXLEN,
111 .flags = {.short_xfer_ok = 1,},
112 .callback = urndis_bulk_read_callback,
113 .timeout = 0, /* no timeout */
114 .usb_mode = USB_MODE_HOST,
115 },
116
117 [URNDIS_BULK_TX] = {
118 .type = UE_BULK,
119 .endpoint = UE_ADDR_ANY,
120 .direction = UE_DIR_TX,
121 .if_index = 0,
122 .frames = RNDIS_TX_FRAMES_MAX,
123 .bufsize = (RNDIS_TX_FRAMES_MAX * RNDIS_TX_MAXLEN),
124 .flags = {
125 .force_short_xfer = 1,
126 },
127 .callback = urndis_bulk_write_callback,
128 .timeout = 10000, /* 10 seconds */
129 .usb_mode = USB_MODE_HOST,
130 },
131
132 [URNDIS_INTR_RX] = {
133 .type = UE_INTERRUPT,
134 .endpoint = UE_ADDR_ANY,
135 .direction = UE_DIR_RX,
136 .if_index = 1,
137 .bufsize = 0, /* use wMaxPacketSize */
138 .flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
139 .callback = urndis_intr_read_callback,
140 .timeout = 0,
141 .usb_mode = USB_MODE_HOST,
142 },
143 };
144
145 static device_method_t urndis_methods[] = {
146 /* Device interface */
147 DEVMETHOD(device_probe, urndis_probe),
148 DEVMETHOD(device_attach, urndis_attach),
149 DEVMETHOD(device_detach, urndis_detach),
150 DEVMETHOD(device_suspend, urndis_suspend),
151 DEVMETHOD(device_resume, urndis_resume),
152
153 DEVMETHOD_END
154 };
155
156 static driver_t urndis_driver = {
157 .name = "urndis",
158 .methods = urndis_methods,
159 .size = sizeof(struct urndis_softc),
160 };
161
162 static const STRUCT_USB_HOST_ID urndis_host_devs[] = {
163 /* Generic RNDIS class match */
164 {USB_IFACE_CLASS(UICLASS_CDC),
165 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL),
166 USB_IFACE_PROTOCOL(0xff)},
167 {USB_IFACE_CLASS(UICLASS_WIRELESS), USB_IFACE_SUBCLASS(UISUBCLASS_RF),
168 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)},
169 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(UISUBCLASS_SYNC),
170 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)},
171 /* HP-WebOS */
172 {USB_VENDOR(USB_VENDOR_PALM), USB_IFACE_CLASS(UICLASS_CDC),
173 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL),
174 USB_IFACE_PROTOCOL(0xff)},
175 /* Nokia 7 plus */
176 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(0x4),
177 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)},
178 /* Novatel Wireless 8800/8000/etc */
179 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(0xef),
180 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)},
181 };
182
183 DRIVER_MODULE(urndis, uhub, urndis_driver, NULL, NULL);
184 MODULE_VERSION(urndis, 1);
185 MODULE_DEPEND(urndis, uether, 1, 1, 1);
186 MODULE_DEPEND(urndis, usb, 1, 1, 1);
187 MODULE_DEPEND(urndis, ether, 1, 1, 1);
188 USB_PNP_HOST_INFO(urndis_host_devs);
189
190 static const struct usb_ether_methods urndis_ue_methods = {
191 .ue_attach_post = urndis_attach_post,
192 .ue_start = urndis_start,
193 .ue_init = urndis_init,
194 .ue_stop = urndis_stop,
195 .ue_setmulti = urndis_setmulti,
196 .ue_setpromisc = urndis_setpromisc,
197 };
198
199 static int
urndis_probe(device_t dev)200 urndis_probe(device_t dev)
201 {
202 struct usb_attach_arg *uaa = device_get_ivars(dev);
203
204 return (usbd_lookup_id_by_uaa(urndis_host_devs, sizeof(urndis_host_devs), uaa));
205 }
206
207 static void
urndis_attach_post(struct usb_ether * ue)208 urndis_attach_post(struct usb_ether *ue)
209 {
210
211 /* no-op */
212 }
213
214 static int
urndis_attach(device_t dev)215 urndis_attach(device_t dev)
216 {
217 union {
218 struct {
219 struct rndis_query_req query;
220 uint8_t addr[ETHER_ADDR_LEN];
221 } eaddr;
222 struct {
223 struct rndis_set_req set;
224 uint32_t filter;
225 } filter;
226 } msg;
227 struct urndis_softc *sc = device_get_softc(dev);
228 struct usb_ether *ue = &sc->sc_ue;
229 struct usb_attach_arg *uaa = device_get_ivars(dev);
230 struct usb_cdc_cm_descriptor *cmd;
231 const void *buf;
232 uint16_t bufsz;
233 uint8_t iface_index[2] = { uaa->info.bIfaceIndex + 1, uaa->info.bIfaceIndex };
234 int error;
235 uint8_t i;
236
237 sc->sc_ue.ue_udev = uaa->device;
238 sc->sc_ifaceno_ctl = uaa->info.bIfaceNum;
239
240 cmd = usbd_find_descriptor(uaa->device, NULL, uaa->info.bIfaceIndex,
241 UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_CM, 0xFF);
242 if (cmd != NULL) {
243 DPRINTF("Call Mode Descriptor found, dataif=%d\n", cmd->bDataInterface);
244 iface_index[0] = cmd->bDataInterface;
245 }
246
247 device_set_usb_desc(dev);
248
249 mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF);
250
251 /* scan the alternate settings looking for a valid one */
252 for (i = 0; i != 32; i++) {
253 error = usbd_set_alt_interface_index(uaa->device,
254 iface_index[0], i);
255
256 if (error != 0)
257 break;
258
259 error = usbd_transfer_setup(uaa->device,
260 iface_index, sc->sc_xfer, urndis_config,
261 URNDIS_N_TRANSFER, sc, &sc->sc_mtx);
262
263 if (error == 0)
264 break;
265 }
266 if ((error != 0) || (i == 32)) {
267 device_printf(dev, "No valid alternate setting found\n");
268 goto detach;
269 }
270
271 /* Initialize device - must be done before even querying it */
272 URNDIS_LOCK(sc);
273 error = urndis_ctrl_init(sc);
274 URNDIS_UNLOCK(sc);
275 if (error != (int)RNDIS_STATUS_SUCCESS) {
276 device_printf(dev, "Unable to initialize hardware\n");
277 goto detach;
278 }
279
280 /* Determine MAC address */
281 memset(msg.eaddr.addr, 0, sizeof(msg.eaddr.addr));
282 URNDIS_LOCK(sc);
283 error = urndis_ctrl_query(sc, OID_802_3_PERMANENT_ADDRESS,
284 (struct rndis_query_req *)&msg.eaddr, sizeof(msg.eaddr),
285 &buf, &bufsz);
286 URNDIS_UNLOCK(sc);
287 if (error != (int)RNDIS_STATUS_SUCCESS) {
288 device_printf(dev, "Unable to get hardware address\n");
289 goto detach;
290 }
291 if (bufsz != ETHER_ADDR_LEN) {
292 device_printf(dev, "Invalid address length: %d bytes\n", bufsz);
293 goto detach;
294 }
295 memcpy(&sc->sc_ue.ue_eaddr, buf, ETHER_ADDR_LEN);
296
297 /* Initialize packet filter */
298 sc->sc_filter = NDIS_PACKET_TYPE_BROADCAST |
299 NDIS_PACKET_TYPE_ALL_MULTICAST;
300 msg.filter.filter = htole32(sc->sc_filter);
301 URNDIS_LOCK(sc);
302 error = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
303 (struct rndis_set_req *)&msg.filter, sizeof(msg.filter));
304 URNDIS_UNLOCK(sc);
305 if (error != (int)RNDIS_STATUS_SUCCESS) {
306 device_printf(dev, "Unable to set data filters\n");
307 goto detach;
308 }
309
310 ue->ue_sc = sc;
311 ue->ue_dev = dev;
312 ue->ue_udev = uaa->device;
313 ue->ue_mtx = &sc->sc_mtx;
314 ue->ue_methods = &urndis_ue_methods;
315
316 error = uether_ifattach(ue);
317 if (error) {
318 device_printf(dev, "Could not attach interface\n");
319 goto detach;
320 }
321
322 URNDIS_LOCK(sc);
323 /* start interrupt endpoint, if any */
324 usbd_transfer_start(sc->sc_xfer[URNDIS_INTR_RX]);
325 URNDIS_UNLOCK(sc);
326
327 return (0); /* success */
328
329 detach:
330 (void)urndis_detach(dev);
331 return (ENXIO); /* failure */
332 }
333
334 static int
urndis_detach(device_t dev)335 urndis_detach(device_t dev)
336 {
337 struct urndis_softc *sc = device_get_softc(dev);
338 struct usb_ether *ue = &sc->sc_ue;
339
340 /* stop all USB transfers first */
341 usbd_transfer_unsetup(sc->sc_xfer, URNDIS_N_TRANSFER);
342
343 uether_ifdetach(ue);
344
345 URNDIS_LOCK(sc);
346 (void)urndis_ctrl_halt(sc);
347 URNDIS_UNLOCK(sc);
348
349 mtx_destroy(&sc->sc_mtx);
350
351 return (0);
352 }
353
354 static void
urndis_start(struct usb_ether * ue)355 urndis_start(struct usb_ether *ue)
356 {
357 struct urndis_softc *sc = uether_getsc(ue);
358
359 /*
360 * Start the USB transfers, if not already started:
361 */
362 usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_TX]);
363 usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_RX]);
364 }
365
366 static void
urndis_init(struct usb_ether * ue)367 urndis_init(struct usb_ether *ue)
368 {
369 struct urndis_softc *sc = uether_getsc(ue);
370 if_t ifp = uether_getifp(ue);
371
372 URNDIS_LOCK_ASSERT(sc, MA_OWNED);
373
374 if_setdrvflagbits(ifp, IFF_DRV_RUNNING, 0);
375
376 /* stall data write direction, which depends on USB mode */
377 usbd_xfer_set_stall(sc->sc_xfer[URNDIS_BULK_TX]);
378
379 /* start data transfers */
380 urndis_start(ue);
381 }
382
383 static void
urndis_stop(struct usb_ether * ue)384 urndis_stop(struct usb_ether *ue)
385 {
386 struct urndis_softc *sc = uether_getsc(ue);
387 if_t ifp = uether_getifp(ue);
388
389 URNDIS_LOCK_ASSERT(sc, MA_OWNED);
390
391 if_setdrvflagbits(ifp, 0, IFF_DRV_RUNNING);
392
393 /*
394 * stop all the transfers, if not already stopped:
395 */
396 usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_RX]);
397 usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_TX]);
398 }
399
400 static void
urndis_setmulti(struct usb_ether * ue)401 urndis_setmulti(struct usb_ether *ue)
402 {
403
404 /* no-op */
405 }
406
407 static void
urndis_setpromisc(struct usb_ether * ue)408 urndis_setpromisc(struct usb_ether *ue)
409 {
410
411 /* no-op */
412 }
413
414 static int
urndis_suspend(device_t dev)415 urndis_suspend(device_t dev)
416 {
417
418 device_printf(dev, "Suspending\n");
419 return (0);
420 }
421
422 static int
urndis_resume(device_t dev)423 urndis_resume(device_t dev)
424 {
425
426 device_printf(dev, "Resuming\n");
427 return (0);
428 }
429
430 static usb_error_t
urndis_ctrl_msg(struct urndis_softc * sc,uint8_t rt,uint8_t r,uint16_t index,uint16_t value,void * buf,uint16_t buflen)431 urndis_ctrl_msg(struct urndis_softc *sc, uint8_t rt, uint8_t r,
432 uint16_t index, uint16_t value, void *buf, uint16_t buflen)
433 {
434 usb_device_request_t req;
435
436 req.bmRequestType = rt;
437 req.bRequest = r;
438 USETW(req.wValue, value);
439 USETW(req.wIndex, index);
440 USETW(req.wLength, buflen);
441
442 return (usbd_do_request_flags(sc->sc_ue.ue_udev,
443 &sc->sc_mtx, &req, buf, (rt & UT_READ) ?
444 USB_SHORT_XFER_OK : 0, NULL, 2000 /* ms */ ));
445 }
446
447 static usb_error_t
urndis_ctrl_send(struct urndis_softc * sc,void * buf,uint16_t len)448 urndis_ctrl_send(struct urndis_softc *sc, void *buf, uint16_t len)
449 {
450 usb_error_t err;
451
452 err = urndis_ctrl_msg(sc, UT_WRITE_CLASS_INTERFACE,
453 UCDC_SEND_ENCAPSULATED_COMMAND, sc->sc_ifaceno_ctl, 0, buf, len);
454
455 DPRINTF("%s\n", usbd_errstr(err));
456
457 return (err);
458 }
459
460 static struct rndis_comp_hdr *
urndis_ctrl_recv(struct urndis_softc * sc)461 urndis_ctrl_recv(struct urndis_softc *sc)
462 {
463 struct rndis_comp_hdr *hdr;
464 usb_error_t err;
465
466 err = urndis_ctrl_msg(sc, UT_READ_CLASS_INTERFACE,
467 UCDC_GET_ENCAPSULATED_RESPONSE, sc->sc_ifaceno_ctl, 0,
468 sc->sc_response_buf, RNDIS_RESPONSE_LEN);
469
470 if (err != USB_ERR_NORMAL_COMPLETION)
471 return (NULL);
472
473 hdr = (struct rndis_comp_hdr *)sc->sc_response_buf;
474
475 DPRINTF("type 0x%x len %u\n", le32toh(hdr->rm_type),
476 le32toh(hdr->rm_len));
477
478 if (le32toh(hdr->rm_len) > RNDIS_RESPONSE_LEN) {
479 DPRINTF("ctrl message error: wrong size %u > %u\n",
480 le32toh(hdr->rm_len), RNDIS_RESPONSE_LEN);
481 return (NULL);
482 }
483 return (hdr);
484 }
485
486 static uint32_t
urndis_ctrl_handle(struct urndis_softc * sc,struct rndis_comp_hdr * hdr,const void ** buf,uint16_t * bufsz)487 urndis_ctrl_handle(struct urndis_softc *sc, struct rndis_comp_hdr *hdr,
488 const void **buf, uint16_t *bufsz)
489 {
490 uint32_t rval;
491
492 DPRINTF("\n");
493
494 if (buf != NULL && bufsz != NULL) {
495 *buf = NULL;
496 *bufsz = 0;
497 }
498 switch (le32toh(hdr->rm_type)) {
499 case REMOTE_NDIS_INITIALIZE_CMPLT:
500 rval = urndis_ctrl_handle_init(sc, hdr);
501 break;
502
503 case REMOTE_NDIS_QUERY_CMPLT:
504 rval = urndis_ctrl_handle_query(sc, hdr, buf, bufsz);
505 break;
506
507 case REMOTE_NDIS_RESET_CMPLT:
508 rval = urndis_ctrl_handle_reset(sc, hdr);
509 break;
510
511 case REMOTE_NDIS_KEEPALIVE_CMPLT:
512 case REMOTE_NDIS_SET_CMPLT:
513 rval = le32toh(hdr->rm_status);
514 break;
515
516 default:
517 device_printf(sc->sc_ue.ue_dev,
518 "ctrl message error: unknown event 0x%x\n",
519 le32toh(hdr->rm_type));
520 rval = RNDIS_STATUS_FAILURE;
521 break;
522 }
523 return (rval);
524 }
525
526 static uint32_t
urndis_ctrl_handle_init(struct urndis_softc * sc,const struct rndis_comp_hdr * hdr)527 urndis_ctrl_handle_init(struct urndis_softc *sc,
528 const struct rndis_comp_hdr *hdr)
529 {
530 const struct rndis_init_comp *msg;
531
532 msg = (const struct rndis_init_comp *)hdr;
533
534 DPRINTF("len %u rid %u status 0x%x "
535 "ver_major %u ver_minor %u devflags 0x%x medium 0x%x pktmaxcnt %u "
536 "pktmaxsz %u align %u aflistoffset %u aflistsz %u\n",
537 le32toh(msg->rm_len),
538 le32toh(msg->rm_rid),
539 le32toh(msg->rm_status),
540 le32toh(msg->rm_ver_major),
541 le32toh(msg->rm_ver_minor),
542 le32toh(msg->rm_devflags),
543 le32toh(msg->rm_medium),
544 le32toh(msg->rm_pktmaxcnt),
545 le32toh(msg->rm_pktmaxsz),
546 le32toh(msg->rm_align),
547 le32toh(msg->rm_aflistoffset),
548 le32toh(msg->rm_aflistsz));
549
550 if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
551 DPRINTF("init failed 0x%x\n", le32toh(msg->rm_status));
552 return (le32toh(msg->rm_status));
553 }
554 if (le32toh(msg->rm_devflags) != RNDIS_DF_CONNECTIONLESS) {
555 DPRINTF("wrong device type (current type: 0x%x)\n",
556 le32toh(msg->rm_devflags));
557 return (RNDIS_STATUS_FAILURE);
558 }
559 if (le32toh(msg->rm_medium) != RNDIS_MEDIUM_802_3) {
560 DPRINTF("medium not 802.3 (current medium: 0x%x)\n",
561 le32toh(msg->rm_medium));
562 return (RNDIS_STATUS_FAILURE);
563 }
564 sc->sc_lim_pktsz = le32toh(msg->rm_pktmaxsz);
565
566 return (le32toh(msg->rm_status));
567 }
568
569 static uint32_t
urndis_ctrl_handle_query(struct urndis_softc * sc,const struct rndis_comp_hdr * hdr,const void ** buf,uint16_t * bufsz)570 urndis_ctrl_handle_query(struct urndis_softc *sc,
571 const struct rndis_comp_hdr *hdr, const void **buf, uint16_t *bufsz)
572 {
573 const struct rndis_query_comp *msg;
574 uint64_t limit;
575
576 msg = (const struct rndis_query_comp *)hdr;
577
578 DPRINTF("len %u rid %u status 0x%x "
579 "buflen %u bufoff %u\n",
580 le32toh(msg->rm_len),
581 le32toh(msg->rm_rid),
582 le32toh(msg->rm_status),
583 le32toh(msg->rm_infobuflen),
584 le32toh(msg->rm_infobufoffset));
585
586 *buf = NULL;
587 *bufsz = 0;
588 if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
589 DPRINTF("query failed 0x%x\n", le32toh(msg->rm_status));
590 return (le32toh(msg->rm_status));
591 }
592 limit = le32toh(msg->rm_infobuflen);
593 limit += le32toh(msg->rm_infobufoffset);
594 limit += RNDIS_HEADER_OFFSET;
595
596 if (limit > (uint64_t)le32toh(msg->rm_len)) {
597 DPRINTF("ctrl message error: invalid query info "
598 "len/offset/end_position(%u/%u/%u) -> "
599 "go out of buffer limit %u\n",
600 le32toh(msg->rm_infobuflen),
601 le32toh(msg->rm_infobufoffset),
602 le32toh(msg->rm_infobuflen) +
603 le32toh(msg->rm_infobufoffset) + RNDIS_HEADER_OFFSET,
604 le32toh(msg->rm_len));
605 return (RNDIS_STATUS_FAILURE);
606 }
607 *buf = ((const uint8_t *)msg) + RNDIS_HEADER_OFFSET +
608 le32toh(msg->rm_infobufoffset);
609 *bufsz = le32toh(msg->rm_infobuflen);
610
611 return (le32toh(msg->rm_status));
612 }
613
614 static uint32_t
urndis_ctrl_handle_reset(struct urndis_softc * sc,const struct rndis_comp_hdr * hdr)615 urndis_ctrl_handle_reset(struct urndis_softc *sc,
616 const struct rndis_comp_hdr *hdr)
617 {
618 const struct rndis_reset_comp *msg;
619 uint32_t rval;
620
621 msg = (const struct rndis_reset_comp *)hdr;
622
623 rval = le32toh(msg->rm_status);
624
625 DPRINTF("len %u status 0x%x "
626 "adrreset %u\n",
627 le32toh(msg->rm_len),
628 rval,
629 le32toh(msg->rm_adrreset));
630
631 if (rval != RNDIS_STATUS_SUCCESS) {
632 DPRINTF("reset failed 0x%x\n", rval);
633 return (rval);
634 }
635 if (msg->rm_adrreset != 0) {
636 struct {
637 struct rndis_set_req hdr;
638 uint32_t filter;
639 } msg_filter;
640
641 msg_filter.filter = htole32(sc->sc_filter);
642
643 rval = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
644 (struct rndis_set_req *)&msg_filter, sizeof(msg_filter));
645
646 if (rval != RNDIS_STATUS_SUCCESS) {
647 DPRINTF("unable to reset data filters\n");
648 return (rval);
649 }
650 }
651 return (rval);
652 }
653
654 static uint32_t
urndis_ctrl_init(struct urndis_softc * sc)655 urndis_ctrl_init(struct urndis_softc *sc)
656 {
657 struct rndis_init_req msg;
658 struct rndis_comp_hdr *hdr;
659 uint32_t rval;
660
661 msg.rm_type = htole32(REMOTE_NDIS_INITIALIZE_MSG);
662 msg.rm_len = htole32(sizeof(msg));
663 msg.rm_rid = 0;
664 msg.rm_ver_major = htole32(RNDIS_VERSION_MAJOR);
665 msg.rm_ver_minor = htole32(1);
666 msg.rm_max_xfersz = htole32(RNDIS_RX_MAXLEN);
667
668 DPRINTF("type %u len %u rid %u ver_major %u "
669 "ver_minor %u max_xfersz %u\n",
670 le32toh(msg.rm_type),
671 le32toh(msg.rm_len),
672 le32toh(msg.rm_rid),
673 le32toh(msg.rm_ver_major),
674 le32toh(msg.rm_ver_minor),
675 le32toh(msg.rm_max_xfersz));
676
677 rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
678
679 if (rval != RNDIS_STATUS_SUCCESS) {
680 DPRINTF("init failed\n");
681 return (rval);
682 }
683 if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
684 DPRINTF("unable to get init response\n");
685 return (RNDIS_STATUS_FAILURE);
686 }
687 rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
688
689 return (rval);
690 }
691
692 static uint32_t
urndis_ctrl_halt(struct urndis_softc * sc)693 urndis_ctrl_halt(struct urndis_softc *sc)
694 {
695 struct rndis_halt_req msg;
696 uint32_t rval;
697
698 msg.rm_type = htole32(REMOTE_NDIS_HALT_MSG);
699 msg.rm_len = htole32(sizeof(msg));
700 msg.rm_rid = 0;
701
702 DPRINTF("type %u len %u rid %u\n",
703 le32toh(msg.rm_type),
704 le32toh(msg.rm_len),
705 le32toh(msg.rm_rid));
706
707 rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
708
709 if (rval != RNDIS_STATUS_SUCCESS)
710 DPRINTF("halt failed\n");
711
712 return (rval);
713 }
714
715 /*
716 * NB: Querying a device has the requirement of using an input buffer the size
717 * of the expected reply or larger, except for variably sized replies.
718 */
719 static uint32_t
urndis_ctrl_query(struct urndis_softc * sc,uint32_t oid,struct rndis_query_req * msg,uint16_t len,const void ** rbuf,uint16_t * rbufsz)720 urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid,
721 struct rndis_query_req *msg, uint16_t len, const void **rbuf,
722 uint16_t *rbufsz)
723 {
724 struct rndis_comp_hdr *hdr;
725 uint32_t datalen, rval;
726
727 msg->rm_type = htole32(REMOTE_NDIS_QUERY_MSG);
728 msg->rm_len = htole32(len);
729 msg->rm_rid = 0; /* XXX */
730 msg->rm_oid = htole32(oid);
731 datalen = len - sizeof(*msg);
732 msg->rm_infobuflen = htole32(datalen);
733 if (datalen != 0) {
734 msg->rm_infobufoffset = htole32(sizeof(*msg) -
735 RNDIS_HEADER_OFFSET);
736 } else {
737 msg->rm_infobufoffset = 0;
738 }
739 msg->rm_devicevchdl = 0;
740
741 DPRINTF("type %u len %u rid %u oid 0x%x "
742 "infobuflen %u infobufoffset %u devicevchdl %u\n",
743 le32toh(msg->rm_type),
744 le32toh(msg->rm_len),
745 le32toh(msg->rm_rid),
746 le32toh(msg->rm_oid),
747 le32toh(msg->rm_infobuflen),
748 le32toh(msg->rm_infobufoffset),
749 le32toh(msg->rm_devicevchdl));
750
751 rval = urndis_ctrl_send(sc, msg, len);
752
753 if (rval != RNDIS_STATUS_SUCCESS) {
754 DPRINTF("query failed\n");
755 return (rval);
756 }
757 if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
758 DPRINTF("unable to get query response\n");
759 return (RNDIS_STATUS_FAILURE);
760 }
761 rval = urndis_ctrl_handle(sc, hdr, rbuf, rbufsz);
762
763 return (rval);
764 }
765
766 static uint32_t
urndis_ctrl_set(struct urndis_softc * sc,uint32_t oid,struct rndis_set_req * msg,uint16_t len)767 urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid,
768 struct rndis_set_req *msg, uint16_t len)
769 {
770 struct rndis_comp_hdr *hdr;
771 uint32_t datalen, rval;
772
773 msg->rm_type = htole32(REMOTE_NDIS_SET_MSG);
774 msg->rm_len = htole32(len);
775 msg->rm_rid = 0; /* XXX */
776 msg->rm_oid = htole32(oid);
777 datalen = len - sizeof(*msg);
778 msg->rm_infobuflen = htole32(datalen);
779 if (datalen != 0) {
780 msg->rm_infobufoffset = htole32(sizeof(*msg) -
781 RNDIS_HEADER_OFFSET);
782 } else {
783 msg->rm_infobufoffset = 0;
784 }
785 msg->rm_devicevchdl = 0;
786
787 DPRINTF("type %u len %u rid %u oid 0x%x "
788 "infobuflen %u infobufoffset %u devicevchdl %u\n",
789 le32toh(msg->rm_type),
790 le32toh(msg->rm_len),
791 le32toh(msg->rm_rid),
792 le32toh(msg->rm_oid),
793 le32toh(msg->rm_infobuflen),
794 le32toh(msg->rm_infobufoffset),
795 le32toh(msg->rm_devicevchdl));
796
797 rval = urndis_ctrl_send(sc, msg, len);
798
799 if (rval != RNDIS_STATUS_SUCCESS) {
800 DPRINTF("set failed\n");
801 return (rval);
802 }
803 if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
804 DPRINTF("unable to get set response\n");
805 return (RNDIS_STATUS_FAILURE);
806 }
807 rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
808 if (rval != RNDIS_STATUS_SUCCESS)
809 DPRINTF("set failed 0x%x\n", rval);
810
811 return (rval);
812 }
813
814 static void
urndis_bulk_read_callback(struct usb_xfer * xfer,usb_error_t error)815 urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
816 {
817 struct urndis_softc *sc = usbd_xfer_softc(xfer);
818 struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, 0);
819 if_t ifp = uether_getifp(&sc->sc_ue);
820 struct rndis_packet_msg msg;
821 struct mbuf *m;
822 int actlen;
823 int aframes;
824 int offset;
825
826 switch (USB_GET_STATE(xfer)) {
827 case USB_ST_TRANSFERRED:
828 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
829
830 DPRINTFN(1, "received %u bytes in %u frames\n", actlen, aframes);
831
832 for (offset = 0; actlen >= (uint32_t)sizeof(msg);) {
833 /* copy out header */
834 usbd_copy_out(pc, offset, &msg, sizeof(msg));
835
836 if (le32toh(0x1234567U) != 0x1234567U) {
837 /* swap endianness */
838 msg.rm_type = le32toh(msg.rm_type);
839 msg.rm_len = le32toh(msg.rm_len);
840 msg.rm_dataoffset = le32toh(msg.rm_dataoffset);
841 msg.rm_datalen = le32toh(msg.rm_datalen);
842 msg.rm_oobdataoffset = le32toh(msg.rm_oobdataoffset);
843 msg.rm_oobdatalen = le32toh(msg.rm_oobdatalen);
844 msg.rm_oobdataelements = le32toh(msg.rm_oobdataelements);
845 msg.rm_pktinfooffset = le32toh(msg.rm_pktinfooffset);
846 msg.rm_pktinfolen = le32toh(msg.rm_pktinfolen);
847 msg.rm_vchandle = le32toh(msg.rm_vchandle);
848 msg.rm_reserved = le32toh(msg.rm_reserved);
849 }
850
851 DPRINTF("len %u data(off:%u len:%u) "
852 "oobdata(off:%u len:%u nb:%u) perpacket(off:%u len:%u)\n",
853 msg.rm_len, msg.rm_dataoffset, msg.rm_datalen,
854 msg.rm_oobdataoffset, msg.rm_oobdatalen,
855 msg.rm_oobdataelements, msg.rm_pktinfooffset,
856 msg.rm_pktinfooffset);
857
858 /* sanity check the RNDIS header */
859 if (msg.rm_type != REMOTE_NDIS_PACKET_MSG) {
860 DPRINTF("invalid type 0x%x != 0x%x\n",
861 msg.rm_type, REMOTE_NDIS_PACKET_MSG);
862 goto tr_setup;
863 } else if (msg.rm_len < (uint32_t)sizeof(msg)) {
864 DPRINTF("invalid msg len %u < %u\n",
865 msg.rm_len, (unsigned)sizeof(msg));
866 goto tr_setup;
867 } else if (msg.rm_len > (uint32_t)actlen) {
868 DPRINTF("invalid msg len %u > buffer "
869 "len %u\n", msg.rm_len, actlen);
870 goto tr_setup;
871 } else if (msg.rm_dataoffset >= (uint32_t)actlen) {
872 DPRINTF("invalid msg dataoffset %u > buffer "
873 "dataoffset %u\n", msg.rm_dataoffset, actlen);
874 goto tr_setup;
875 } else if (msg.rm_datalen > (uint32_t)actlen) {
876 DPRINTF("invalid msg datalen %u > buffer "
877 "datalen %u\n", msg.rm_datalen, actlen);
878 goto tr_setup;
879 } else if ((msg.rm_dataoffset + msg.rm_datalen +
880 (uint32_t)__offsetof(struct rndis_packet_msg,
881 rm_dataoffset)) > (uint32_t)actlen) {
882 DPRINTF("invalid dataoffset %u larger than %u\n",
883 msg.rm_dataoffset + msg.rm_datalen +
884 (uint32_t)__offsetof(struct rndis_packet_msg,
885 rm_dataoffset), actlen);
886 goto tr_setup;
887 } else if (msg.rm_datalen < (uint32_t)sizeof(struct ether_header)) {
888 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
889 DPRINTF("invalid ethernet size "
890 "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header));
891 goto tr_setup;
892 } else if (msg.rm_datalen > (uint32_t)(MCLBYTES - ETHER_ALIGN)) {
893 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
894 DPRINTF("invalid ethernet size "
895 "%u > %u\n",
896 msg.rm_datalen, (unsigned)MCLBYTES);
897 goto tr_setup;
898 } else if (msg.rm_datalen > (uint32_t)(MHLEN - ETHER_ALIGN)) {
899 m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
900 } else {
901 m = m_gethdr(M_NOWAIT, MT_DATA);
902 }
903
904 /* check if we have a buffer */
905 if (m != NULL) {
906 m->m_len = m->m_pkthdr.len = msg.rm_datalen + ETHER_ALIGN;
907 m_adj(m, ETHER_ALIGN);
908
909 usbd_copy_out(pc, offset + msg.rm_dataoffset +
910 __offsetof(struct rndis_packet_msg,
911 rm_dataoffset), m->m_data, msg.rm_datalen);
912
913 /* enqueue */
914 uether_rxmbuf(&sc->sc_ue, m, msg.rm_datalen);
915 } else {
916 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
917 }
918 offset += msg.rm_len;
919 actlen -= msg.rm_len;
920 }
921
922 case USB_ST_SETUP:
923 tr_setup:
924 usbd_xfer_set_frame_len(xfer, 0, RNDIS_RX_MAXLEN);
925 usbd_xfer_set_frames(xfer, 1);
926 usbd_transfer_submit(xfer);
927 uether_rxflush(&sc->sc_ue); /* must be last */
928 break;
929
930 default: /* Error */
931 DPRINTFN(1, "error = %s\n", usbd_errstr(error));
932
933 if (error != USB_ERR_CANCELLED) {
934 /* try to clear stall first */
935 usbd_xfer_set_stall(xfer);
936 usbd_xfer_set_frames(xfer, 0);
937 usbd_transfer_submit(xfer);
938 }
939 break;
940 }
941 }
942
943 static void
urndis_bulk_write_callback(struct usb_xfer * xfer,usb_error_t error)944 urndis_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
945 {
946 struct rndis_packet_msg msg;
947 struct urndis_softc *sc = usbd_xfer_softc(xfer);
948 if_t ifp = uether_getifp(&sc->sc_ue);
949 struct mbuf *m;
950 unsigned x;
951 int actlen;
952 int aframes;
953
954 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
955
956 DPRINTFN(1, "\n");
957
958 switch (USB_GET_STATE(xfer)) {
959 case USB_ST_TRANSFERRED:
960 DPRINTFN(11, "%u bytes in %u frames\n", actlen, aframes);
961
962 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
963
964 /* FALLTHROUGH */
965 case USB_ST_SETUP:
966 tr_setup:
967 memset(&msg, 0, sizeof(msg));
968
969 for (x = 0; x != RNDIS_TX_FRAMES_MAX; x++) {
970 struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, x);
971
972 usbd_xfer_set_frame_offset(xfer, x * RNDIS_TX_MAXLEN, x);
973
974 next_pkt:
975 m = if_dequeue(ifp);
976
977 if (m == NULL)
978 break;
979
980 if ((m->m_pkthdr.len + sizeof(msg)) > RNDIS_TX_MAXLEN) {
981 DPRINTF("Too big packet\n");
982 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
983
984 /* Free buffer */
985 m_freem(m);
986 goto next_pkt;
987 }
988 msg.rm_type = htole32(REMOTE_NDIS_PACKET_MSG);
989 msg.rm_len = htole32(sizeof(msg) + m->m_pkthdr.len);
990
991 msg.rm_dataoffset = htole32(RNDIS_DATA_OFFSET);
992 msg.rm_datalen = htole32(m->m_pkthdr.len);
993
994 /* copy in all data */
995 usbd_copy_in(pc, 0, &msg, sizeof(msg));
996 usbd_m_copy_in(pc, sizeof(msg), m, 0, m->m_pkthdr.len);
997 usbd_xfer_set_frame_len(xfer, x, sizeof(msg) + m->m_pkthdr.len);
998
999 /*
1000 * If there's a BPF listener, bounce a copy of
1001 * this frame to him:
1002 */
1003 BPF_MTAP(ifp, m);
1004
1005 /* Free buffer */
1006 m_freem(m);
1007 }
1008 if (x != 0) {
1009 usbd_xfer_set_frames(xfer, x);
1010 usbd_transfer_submit(xfer);
1011 }
1012 break;
1013
1014 default: /* Error */
1015 DPRINTFN(11, "transfer error, %s\n", usbd_errstr(error));
1016
1017 /* count output errors */
1018 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1019
1020 if (error != USB_ERR_CANCELLED) {
1021 /* try to clear stall first */
1022 usbd_xfer_set_stall(xfer);
1023 goto tr_setup;
1024 }
1025 break;
1026 }
1027 }
1028
1029 static void
urndis_intr_read_callback(struct usb_xfer * xfer,usb_error_t error)1030 urndis_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
1031 {
1032 int actlen;
1033
1034 usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1035
1036 switch (USB_GET_STATE(xfer)) {
1037 case USB_ST_TRANSFERRED:
1038
1039 DPRINTF("Received %d bytes\n", actlen);
1040
1041 /* TODO: decode some indications */
1042
1043 /* FALLTHROUGH */
1044 case USB_ST_SETUP:
1045 tr_setup:
1046 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1047 usbd_transfer_submit(xfer);
1048 break;
1049
1050 default: /* Error */
1051 if (error != USB_ERR_CANCELLED) {
1052 /* start clear stall */
1053 usbd_xfer_set_stall(xfer);
1054 goto tr_setup;
1055 }
1056 break;
1057 }
1058 }
1059