1 /* $OpenBSD: if_urndis.c,v 1.46 2013/12/09 15:45:29 pirofti Exp $ */ 2 3 /* 4 * Copyright (c) 2010 Jonathan Armani <armani@openbsd.org> 5 * Copyright (c) 2010 Fabien Romano <fabien@openbsd.org> 6 * Copyright (c) 2010 Michael Knudsen <mk@openbsd.org> 7 * Copyright (c) 2014 Hans Petter Selasky <hselasky@freebsd.org> 8 * All rights reserved. 9 * 10 * Permission to use, copy, modify, and distribute this software for any 11 * purpose with or without fee is hereby granted, provided that the above 12 * copyright notice and this permission notice appear in all copies. 13 * 14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 21 */ 22 23 #include <sys/cdefs.h> 24 __FBSDID("$FreeBSD$"); 25 26 #include <sys/stdint.h> 27 #include <sys/stddef.h> 28 #include <sys/param.h> 29 #include <sys/queue.h> 30 #include <sys/types.h> 31 #include <sys/systm.h> 32 #include <sys/socket.h> 33 #include <sys/kernel.h> 34 #include <sys/bus.h> 35 #include <sys/module.h> 36 #include <sys/lock.h> 37 #include <sys/mutex.h> 38 #include <sys/condvar.h> 39 #include <sys/sysctl.h> 40 #include <sys/sx.h> 41 #include <sys/unistd.h> 42 #include <sys/callout.h> 43 #include <sys/malloc.h> 44 #include <sys/priv.h> 45 46 #include <net/if.h> 47 #include <net/if_var.h> 48 #include <net/rndis.h> 49 50 #include <dev/usb/usb.h> 51 #include <dev/usb/usbdi.h> 52 #include <dev/usb/usbdi_util.h> 53 #include "usbdevs.h" 54 55 #define USB_DEBUG_VAR urndis_debug 56 #include <dev/usb/usb_debug.h> 57 #include <dev/usb/usb_process.h> 58 #include "usb_if.h" 59 60 #include <dev/usb/net/usb_ethernet.h> 61 #include <dev/usb/net/if_urndisreg.h> 62 63 #include <dev/usb/usb_cdc.h> 64 65 static device_probe_t urndis_probe; 66 static device_attach_t urndis_attach; 67 static device_detach_t urndis_detach; 68 static device_suspend_t urndis_suspend; 69 static device_resume_t urndis_resume; 70 71 static usb_callback_t urndis_bulk_write_callback; 72 static usb_callback_t urndis_bulk_read_callback; 73 static usb_callback_t urndis_intr_read_callback; 74 75 static uether_fn_t urndis_attach_post; 76 static uether_fn_t urndis_init; 77 static uether_fn_t urndis_stop; 78 static uether_fn_t urndis_start; 79 static uether_fn_t urndis_setmulti; 80 static uether_fn_t urndis_setpromisc; 81 82 static uint32_t urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid, 83 struct rndis_query_req *msg, uint16_t len, 84 const void **rbuf, uint16_t *rbufsz); 85 static uint32_t urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid, 86 struct rndis_set_req *msg, uint16_t len); 87 static uint32_t urndis_ctrl_handle_init(struct urndis_softc *sc, 88 const struct rndis_comp_hdr *hdr); 89 static uint32_t urndis_ctrl_handle_query(struct urndis_softc *sc, 90 const struct rndis_comp_hdr *hdr, const void **buf, 91 uint16_t *bufsz); 92 static uint32_t urndis_ctrl_handle_reset(struct urndis_softc *sc, 93 const struct rndis_comp_hdr *hdr); 94 static uint32_t urndis_ctrl_init(struct urndis_softc *sc); 95 static uint32_t urndis_ctrl_halt(struct urndis_softc *sc); 96 97 #ifdef USB_DEBUG 98 static int urndis_debug = 0; 99 static SYSCTL_NODE(_hw_usb, OID_AUTO, urndis, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 100 "USB RNDIS-Ethernet"); 101 SYSCTL_INT(_hw_usb_urndis, OID_AUTO, debug, CTLFLAG_RWTUN, &urndis_debug, 0, 102 "Debug level"); 103 #endif 104 105 static const struct usb_config urndis_config[URNDIS_N_TRANSFER] = { 106 [URNDIS_BULK_RX] = { 107 .type = UE_BULK, 108 .endpoint = UE_ADDR_ANY, 109 .direction = UE_DIR_RX, 110 .if_index = 0, 111 .frames = 1, 112 .bufsize = RNDIS_RX_MAXLEN, 113 .flags = {.short_xfer_ok = 1,}, 114 .callback = urndis_bulk_read_callback, 115 .timeout = 0, /* no timeout */ 116 .usb_mode = USB_MODE_HOST, 117 }, 118 119 [URNDIS_BULK_TX] = { 120 .type = UE_BULK, 121 .endpoint = UE_ADDR_ANY, 122 .direction = UE_DIR_TX, 123 .if_index = 0, 124 .frames = RNDIS_TX_FRAMES_MAX, 125 .bufsize = (RNDIS_TX_FRAMES_MAX * RNDIS_TX_MAXLEN), 126 .flags = { 127 .force_short_xfer = 1, 128 }, 129 .callback = urndis_bulk_write_callback, 130 .timeout = 10000, /* 10 seconds */ 131 .usb_mode = USB_MODE_HOST, 132 }, 133 134 [URNDIS_INTR_RX] = { 135 .type = UE_INTERRUPT, 136 .endpoint = UE_ADDR_ANY, 137 .direction = UE_DIR_RX, 138 .if_index = 1, 139 .bufsize = 0, /* use wMaxPacketSize */ 140 .flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,}, 141 .callback = urndis_intr_read_callback, 142 .timeout = 0, 143 .usb_mode = USB_MODE_HOST, 144 }, 145 }; 146 147 static device_method_t urndis_methods[] = { 148 /* Device interface */ 149 DEVMETHOD(device_probe, urndis_probe), 150 DEVMETHOD(device_attach, urndis_attach), 151 DEVMETHOD(device_detach, urndis_detach), 152 DEVMETHOD(device_suspend, urndis_suspend), 153 DEVMETHOD(device_resume, urndis_resume), 154 155 DEVMETHOD_END 156 }; 157 158 static driver_t urndis_driver = { 159 .name = "urndis", 160 .methods = urndis_methods, 161 .size = sizeof(struct urndis_softc), 162 }; 163 164 static devclass_t urndis_devclass; 165 166 static const STRUCT_USB_HOST_ID urndis_host_devs[] = { 167 /* Generic RNDIS class match */ 168 {USB_IFACE_CLASS(UICLASS_CDC), 169 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL), 170 USB_IFACE_PROTOCOL(0xff)}, 171 {USB_IFACE_CLASS(UICLASS_WIRELESS), USB_IFACE_SUBCLASS(UISUBCLASS_RF), 172 USB_IFACE_PROTOCOL(UIPROTO_RNDIS)}, 173 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(UISUBCLASS_SYNC), 174 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)}, 175 /* HP-WebOS */ 176 {USB_VENDOR(USB_VENDOR_PALM), USB_IFACE_CLASS(UICLASS_CDC), 177 USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL), 178 USB_IFACE_PROTOCOL(0xff)}, 179 /* Nokia 7 plus */ 180 {USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(0x4), 181 USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)}, 182 }; 183 184 DRIVER_MODULE(urndis, uhub, urndis_driver, urndis_devclass, NULL, NULL); 185 MODULE_VERSION(urndis, 1); 186 MODULE_DEPEND(urndis, uether, 1, 1, 1); 187 MODULE_DEPEND(urndis, usb, 1, 1, 1); 188 MODULE_DEPEND(urndis, ether, 1, 1, 1); 189 USB_PNP_HOST_INFO(urndis_host_devs); 190 191 static const struct usb_ether_methods urndis_ue_methods = { 192 .ue_attach_post = urndis_attach_post, 193 .ue_start = urndis_start, 194 .ue_init = urndis_init, 195 .ue_stop = urndis_stop, 196 .ue_setmulti = urndis_setmulti, 197 .ue_setpromisc = urndis_setpromisc, 198 }; 199 200 static int 201 urndis_probe(device_t dev) 202 { 203 struct usb_attach_arg *uaa = device_get_ivars(dev); 204 205 return (usbd_lookup_id_by_uaa(urndis_host_devs, sizeof(urndis_host_devs), uaa)); 206 } 207 208 static void 209 urndis_attach_post(struct usb_ether *ue) 210 { 211 212 /* no-op */ 213 } 214 215 static int 216 urndis_attach(device_t dev) 217 { 218 static struct { 219 union { 220 struct rndis_query_req query; 221 struct rndis_set_req set; 222 } hdr; 223 union { 224 uint8_t eaddr[ETHER_ADDR_LEN]; 225 uint32_t filter; 226 } ibuf; 227 } msg; 228 struct urndis_softc *sc = device_get_softc(dev); 229 struct usb_ether *ue = &sc->sc_ue; 230 struct usb_attach_arg *uaa = device_get_ivars(dev); 231 struct usb_cdc_cm_descriptor *cmd; 232 const void *buf; 233 uint16_t bufsz; 234 uint8_t iface_index[2] = { uaa->info.bIfaceIndex + 1, uaa->info.bIfaceIndex }; 235 int error; 236 uint8_t i; 237 238 sc->sc_ue.ue_udev = uaa->device; 239 sc->sc_ifaceno_ctl = uaa->info.bIfaceNum; 240 241 cmd = usbd_find_descriptor(uaa->device, NULL, uaa->info.bIfaceIndex, 242 UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_CM, 0xFF); 243 if (cmd != NULL) { 244 DPRINTF("Call Mode Descriptor found, dataif=%d\n", cmd->bDataInterface); 245 iface_index[0] = cmd->bDataInterface; 246 } 247 248 device_set_usb_desc(dev); 249 250 mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF); 251 252 /* scan the alternate settings looking for a valid one */ 253 for (i = 0; i != 32; i++) { 254 error = usbd_set_alt_interface_index(uaa->device, 255 iface_index[0], i); 256 257 if (error != 0) 258 break; 259 260 error = usbd_transfer_setup(uaa->device, 261 iface_index, sc->sc_xfer, urndis_config, 262 URNDIS_N_TRANSFER, sc, &sc->sc_mtx); 263 264 if (error == 0) 265 break; 266 } 267 if ((error != 0) || (i == 32)) { 268 device_printf(dev, "No valid alternate setting found\n"); 269 goto detach; 270 } 271 272 /* Initialize device - must be done before even querying it */ 273 URNDIS_LOCK(sc); 274 error = urndis_ctrl_init(sc); 275 URNDIS_UNLOCK(sc); 276 if (error != (int)RNDIS_STATUS_SUCCESS) { 277 device_printf(dev, "Unable to initialize hardware\n"); 278 goto detach; 279 } 280 281 /* Determine MAC address */ 282 memset(msg.ibuf.eaddr, 0, sizeof(msg.ibuf.eaddr)); 283 URNDIS_LOCK(sc); 284 error = urndis_ctrl_query(sc, OID_802_3_PERMANENT_ADDRESS, 285 &msg.hdr.query, sizeof(msg.hdr.query) + sizeof(msg.ibuf.eaddr), 286 &buf, &bufsz); 287 URNDIS_UNLOCK(sc); 288 if (error != (int)RNDIS_STATUS_SUCCESS) { 289 device_printf(dev, "Unable to get hardware address\n"); 290 goto detach; 291 } 292 if (bufsz != ETHER_ADDR_LEN) { 293 device_printf(dev, "Invalid address length: %d bytes\n", bufsz); 294 goto detach; 295 } 296 memcpy(&sc->sc_ue.ue_eaddr, buf, ETHER_ADDR_LEN); 297 298 /* Initialize packet filter */ 299 sc->sc_filter = NDIS_PACKET_TYPE_BROADCAST | 300 NDIS_PACKET_TYPE_ALL_MULTICAST; 301 msg.ibuf.filter = htole32(sc->sc_filter); 302 URNDIS_LOCK(sc); 303 error = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER, 304 &msg.hdr.set, sizeof(msg.hdr.set) + sizeof(msg.ibuf.filter)); 305 URNDIS_UNLOCK(sc); 306 if (error != (int)RNDIS_STATUS_SUCCESS) { 307 device_printf(dev, "Unable to set data filters\n"); 308 goto detach; 309 } 310 311 ue->ue_sc = sc; 312 ue->ue_dev = dev; 313 ue->ue_udev = uaa->device; 314 ue->ue_mtx = &sc->sc_mtx; 315 ue->ue_methods = &urndis_ue_methods; 316 317 error = uether_ifattach(ue); 318 if (error) { 319 device_printf(dev, "Could not attach interface\n"); 320 goto detach; 321 } 322 323 URNDIS_LOCK(sc); 324 /* start interrupt endpoint, if any */ 325 usbd_transfer_start(sc->sc_xfer[URNDIS_INTR_RX]); 326 URNDIS_UNLOCK(sc); 327 328 return (0); /* success */ 329 330 detach: 331 (void)urndis_detach(dev); 332 return (ENXIO); /* failure */ 333 } 334 335 static int 336 urndis_detach(device_t dev) 337 { 338 struct urndis_softc *sc = device_get_softc(dev); 339 struct usb_ether *ue = &sc->sc_ue; 340 341 /* stop all USB transfers first */ 342 usbd_transfer_unsetup(sc->sc_xfer, URNDIS_N_TRANSFER); 343 344 uether_ifdetach(ue); 345 346 URNDIS_LOCK(sc); 347 (void)urndis_ctrl_halt(sc); 348 URNDIS_UNLOCK(sc); 349 350 mtx_destroy(&sc->sc_mtx); 351 352 return (0); 353 } 354 355 static void 356 urndis_start(struct usb_ether *ue) 357 { 358 struct urndis_softc *sc = uether_getsc(ue); 359 360 /* 361 * Start the USB transfers, if not already started: 362 */ 363 usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_TX]); 364 usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_RX]); 365 } 366 367 static void 368 urndis_init(struct usb_ether *ue) 369 { 370 struct urndis_softc *sc = uether_getsc(ue); 371 struct ifnet *ifp = uether_getifp(ue); 372 373 URNDIS_LOCK_ASSERT(sc, MA_OWNED); 374 375 ifp->if_drv_flags |= IFF_DRV_RUNNING; 376 377 /* stall data write direction, which depends on USB mode */ 378 usbd_xfer_set_stall(sc->sc_xfer[URNDIS_BULK_TX]); 379 380 /* start data transfers */ 381 urndis_start(ue); 382 } 383 384 static void 385 urndis_stop(struct usb_ether *ue) 386 { 387 struct urndis_softc *sc = uether_getsc(ue); 388 struct ifnet *ifp = uether_getifp(ue); 389 390 URNDIS_LOCK_ASSERT(sc, MA_OWNED); 391 392 ifp->if_drv_flags &= ~IFF_DRV_RUNNING; 393 394 /* 395 * stop all the transfers, if not already stopped: 396 */ 397 usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_RX]); 398 usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_TX]); 399 } 400 401 static void 402 urndis_setmulti(struct usb_ether *ue) 403 { 404 405 /* no-op */ 406 } 407 408 static void 409 urndis_setpromisc(struct usb_ether *ue) 410 { 411 412 /* no-op */ 413 } 414 415 static int 416 urndis_suspend(device_t dev) 417 { 418 419 device_printf(dev, "Suspending\n"); 420 return (0); 421 } 422 423 static int 424 urndis_resume(device_t dev) 425 { 426 427 device_printf(dev, "Resuming\n"); 428 return (0); 429 } 430 431 static usb_error_t 432 urndis_ctrl_msg(struct urndis_softc *sc, uint8_t rt, uint8_t r, 433 uint16_t index, uint16_t value, void *buf, uint16_t buflen) 434 { 435 usb_device_request_t req; 436 437 req.bmRequestType = rt; 438 req.bRequest = r; 439 USETW(req.wValue, value); 440 USETW(req.wIndex, index); 441 USETW(req.wLength, buflen); 442 443 return (usbd_do_request_flags(sc->sc_ue.ue_udev, 444 &sc->sc_mtx, &req, buf, (rt & UT_READ) ? 445 USB_SHORT_XFER_OK : 0, NULL, 2000 /* ms */ )); 446 } 447 448 static usb_error_t 449 urndis_ctrl_send(struct urndis_softc *sc, void *buf, uint16_t len) 450 { 451 usb_error_t err; 452 453 err = urndis_ctrl_msg(sc, UT_WRITE_CLASS_INTERFACE, 454 UCDC_SEND_ENCAPSULATED_COMMAND, sc->sc_ifaceno_ctl, 0, buf, len); 455 456 DPRINTF("%s\n", usbd_errstr(err)); 457 458 return (err); 459 } 460 461 static struct rndis_comp_hdr * 462 urndis_ctrl_recv(struct urndis_softc *sc) 463 { 464 struct rndis_comp_hdr *hdr; 465 usb_error_t err; 466 467 err = urndis_ctrl_msg(sc, UT_READ_CLASS_INTERFACE, 468 UCDC_GET_ENCAPSULATED_RESPONSE, sc->sc_ifaceno_ctl, 0, 469 sc->sc_response_buf, RNDIS_RESPONSE_LEN); 470 471 if (err != USB_ERR_NORMAL_COMPLETION) 472 return (NULL); 473 474 hdr = (struct rndis_comp_hdr *)sc->sc_response_buf; 475 476 DPRINTF("type 0x%x len %u\n", le32toh(hdr->rm_type), 477 le32toh(hdr->rm_len)); 478 479 if (le32toh(hdr->rm_len) > RNDIS_RESPONSE_LEN) { 480 DPRINTF("ctrl message error: wrong size %u > %u\n", 481 le32toh(hdr->rm_len), RNDIS_RESPONSE_LEN); 482 return (NULL); 483 } 484 return (hdr); 485 } 486 487 static uint32_t 488 urndis_ctrl_handle(struct urndis_softc *sc, struct rndis_comp_hdr *hdr, 489 const void **buf, uint16_t *bufsz) 490 { 491 uint32_t rval; 492 493 DPRINTF("\n"); 494 495 if (buf != NULL && bufsz != NULL) { 496 *buf = NULL; 497 *bufsz = 0; 498 } 499 switch (le32toh(hdr->rm_type)) { 500 case REMOTE_NDIS_INITIALIZE_CMPLT: 501 rval = urndis_ctrl_handle_init(sc, hdr); 502 break; 503 504 case REMOTE_NDIS_QUERY_CMPLT: 505 rval = urndis_ctrl_handle_query(sc, hdr, buf, bufsz); 506 break; 507 508 case REMOTE_NDIS_RESET_CMPLT: 509 rval = urndis_ctrl_handle_reset(sc, hdr); 510 break; 511 512 case REMOTE_NDIS_KEEPALIVE_CMPLT: 513 case REMOTE_NDIS_SET_CMPLT: 514 rval = le32toh(hdr->rm_status); 515 break; 516 517 default: 518 device_printf(sc->sc_ue.ue_dev, 519 "ctrl message error: unknown event 0x%x\n", 520 le32toh(hdr->rm_type)); 521 rval = RNDIS_STATUS_FAILURE; 522 break; 523 } 524 return (rval); 525 } 526 527 static uint32_t 528 urndis_ctrl_handle_init(struct urndis_softc *sc, 529 const struct rndis_comp_hdr *hdr) 530 { 531 const struct rndis_init_comp *msg; 532 533 msg = (const struct rndis_init_comp *)hdr; 534 535 DPRINTF("len %u rid %u status 0x%x " 536 "ver_major %u ver_minor %u devflags 0x%x medium 0x%x pktmaxcnt %u " 537 "pktmaxsz %u align %u aflistoffset %u aflistsz %u\n", 538 le32toh(msg->rm_len), 539 le32toh(msg->rm_rid), 540 le32toh(msg->rm_status), 541 le32toh(msg->rm_ver_major), 542 le32toh(msg->rm_ver_minor), 543 le32toh(msg->rm_devflags), 544 le32toh(msg->rm_medium), 545 le32toh(msg->rm_pktmaxcnt), 546 le32toh(msg->rm_pktmaxsz), 547 le32toh(msg->rm_align), 548 le32toh(msg->rm_aflistoffset), 549 le32toh(msg->rm_aflistsz)); 550 551 if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) { 552 DPRINTF("init failed 0x%x\n", le32toh(msg->rm_status)); 553 return (le32toh(msg->rm_status)); 554 } 555 if (le32toh(msg->rm_devflags) != RNDIS_DF_CONNECTIONLESS) { 556 DPRINTF("wrong device type (current type: 0x%x)\n", 557 le32toh(msg->rm_devflags)); 558 return (RNDIS_STATUS_FAILURE); 559 } 560 if (le32toh(msg->rm_medium) != RNDIS_MEDIUM_802_3) { 561 DPRINTF("medium not 802.3 (current medium: 0x%x)\n", 562 le32toh(msg->rm_medium)); 563 return (RNDIS_STATUS_FAILURE); 564 } 565 sc->sc_lim_pktsz = le32toh(msg->rm_pktmaxsz); 566 567 return (le32toh(msg->rm_status)); 568 } 569 570 static uint32_t 571 urndis_ctrl_handle_query(struct urndis_softc *sc, 572 const struct rndis_comp_hdr *hdr, const void **buf, uint16_t *bufsz) 573 { 574 const struct rndis_query_comp *msg; 575 uint64_t limit; 576 577 msg = (const struct rndis_query_comp *)hdr; 578 579 DPRINTF("len %u rid %u status 0x%x " 580 "buflen %u bufoff %u\n", 581 le32toh(msg->rm_len), 582 le32toh(msg->rm_rid), 583 le32toh(msg->rm_status), 584 le32toh(msg->rm_infobuflen), 585 le32toh(msg->rm_infobufoffset)); 586 587 *buf = NULL; 588 *bufsz = 0; 589 if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) { 590 DPRINTF("query failed 0x%x\n", le32toh(msg->rm_status)); 591 return (le32toh(msg->rm_status)); 592 } 593 limit = le32toh(msg->rm_infobuflen); 594 limit += le32toh(msg->rm_infobufoffset); 595 limit += RNDIS_HEADER_OFFSET; 596 597 if (limit > (uint64_t)le32toh(msg->rm_len)) { 598 DPRINTF("ctrl message error: invalid query info " 599 "len/offset/end_position(%u/%u/%u) -> " 600 "go out of buffer limit %u\n", 601 le32toh(msg->rm_infobuflen), 602 le32toh(msg->rm_infobufoffset), 603 le32toh(msg->rm_infobuflen) + 604 le32toh(msg->rm_infobufoffset) + RNDIS_HEADER_OFFSET, 605 le32toh(msg->rm_len)); 606 return (RNDIS_STATUS_FAILURE); 607 } 608 *buf = ((const uint8_t *)msg) + RNDIS_HEADER_OFFSET + 609 le32toh(msg->rm_infobufoffset); 610 *bufsz = le32toh(msg->rm_infobuflen); 611 612 return (le32toh(msg->rm_status)); 613 } 614 615 static uint32_t 616 urndis_ctrl_handle_reset(struct urndis_softc *sc, 617 const struct rndis_comp_hdr *hdr) 618 { 619 const struct rndis_reset_comp *msg; 620 uint32_t rval; 621 622 msg = (const struct rndis_reset_comp *)hdr; 623 624 rval = le32toh(msg->rm_status); 625 626 DPRINTF("len %u status 0x%x " 627 "adrreset %u\n", 628 le32toh(msg->rm_len), 629 rval, 630 le32toh(msg->rm_adrreset)); 631 632 if (rval != RNDIS_STATUS_SUCCESS) { 633 DPRINTF("reset failed 0x%x\n", rval); 634 return (rval); 635 } 636 if (msg->rm_adrreset != 0) { 637 struct { 638 struct rndis_set_req hdr; 639 uint32_t filter; 640 } msg_filter; 641 642 msg_filter.filter = htole32(sc->sc_filter); 643 644 rval = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER, 645 &msg_filter.hdr, sizeof(msg_filter)); 646 647 if (rval != RNDIS_STATUS_SUCCESS) { 648 DPRINTF("unable to reset data filters\n"); 649 return (rval); 650 } 651 } 652 return (rval); 653 } 654 655 static uint32_t 656 urndis_ctrl_init(struct urndis_softc *sc) 657 { 658 struct rndis_init_req msg; 659 struct rndis_comp_hdr *hdr; 660 uint32_t rval; 661 662 msg.rm_type = htole32(REMOTE_NDIS_INITIALIZE_MSG); 663 msg.rm_len = htole32(sizeof(msg)); 664 msg.rm_rid = 0; 665 msg.rm_ver_major = htole32(RNDIS_VERSION_MAJOR); 666 msg.rm_ver_minor = htole32(1); 667 msg.rm_max_xfersz = htole32(RNDIS_RX_MAXLEN); 668 669 DPRINTF("type %u len %u rid %u ver_major %u " 670 "ver_minor %u max_xfersz %u\n", 671 le32toh(msg.rm_type), 672 le32toh(msg.rm_len), 673 le32toh(msg.rm_rid), 674 le32toh(msg.rm_ver_major), 675 le32toh(msg.rm_ver_minor), 676 le32toh(msg.rm_max_xfersz)); 677 678 rval = urndis_ctrl_send(sc, &msg, sizeof(msg)); 679 680 if (rval != RNDIS_STATUS_SUCCESS) { 681 DPRINTF("init failed\n"); 682 return (rval); 683 } 684 if ((hdr = urndis_ctrl_recv(sc)) == NULL) { 685 DPRINTF("unable to get init response\n"); 686 return (RNDIS_STATUS_FAILURE); 687 } 688 rval = urndis_ctrl_handle(sc, hdr, NULL, NULL); 689 690 return (rval); 691 } 692 693 static uint32_t 694 urndis_ctrl_halt(struct urndis_softc *sc) 695 { 696 struct rndis_halt_req msg; 697 uint32_t rval; 698 699 msg.rm_type = htole32(REMOTE_NDIS_HALT_MSG); 700 msg.rm_len = htole32(sizeof(msg)); 701 msg.rm_rid = 0; 702 703 DPRINTF("type %u len %u rid %u\n", 704 le32toh(msg.rm_type), 705 le32toh(msg.rm_len), 706 le32toh(msg.rm_rid)); 707 708 rval = urndis_ctrl_send(sc, &msg, sizeof(msg)); 709 710 if (rval != RNDIS_STATUS_SUCCESS) 711 DPRINTF("halt failed\n"); 712 713 return (rval); 714 } 715 716 /* 717 * NB: Querying a device has the requirement of using an input buffer the size 718 * of the expected reply or larger, except for variably sized replies. 719 */ 720 static uint32_t 721 urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid, 722 struct rndis_query_req *msg, uint16_t len, const void **rbuf, 723 uint16_t *rbufsz) 724 { 725 struct rndis_comp_hdr *hdr; 726 uint32_t datalen, rval; 727 728 msg->rm_type = htole32(REMOTE_NDIS_QUERY_MSG); 729 msg->rm_len = htole32(len); 730 msg->rm_rid = 0; /* XXX */ 731 msg->rm_oid = htole32(oid); 732 datalen = len - sizeof(*msg); 733 msg->rm_infobuflen = htole32(datalen); 734 if (datalen != 0) { 735 msg->rm_infobufoffset = htole32(sizeof(*msg) - 736 RNDIS_HEADER_OFFSET); 737 } else { 738 msg->rm_infobufoffset = 0; 739 } 740 msg->rm_devicevchdl = 0; 741 742 DPRINTF("type %u len %u rid %u oid 0x%x " 743 "infobuflen %u infobufoffset %u devicevchdl %u\n", 744 le32toh(msg->rm_type), 745 le32toh(msg->rm_len), 746 le32toh(msg->rm_rid), 747 le32toh(msg->rm_oid), 748 le32toh(msg->rm_infobuflen), 749 le32toh(msg->rm_infobufoffset), 750 le32toh(msg->rm_devicevchdl)); 751 752 rval = urndis_ctrl_send(sc, msg, len); 753 754 if (rval != RNDIS_STATUS_SUCCESS) { 755 DPRINTF("query failed\n"); 756 return (rval); 757 } 758 if ((hdr = urndis_ctrl_recv(sc)) == NULL) { 759 DPRINTF("unable to get query response\n"); 760 return (RNDIS_STATUS_FAILURE); 761 } 762 rval = urndis_ctrl_handle(sc, hdr, rbuf, rbufsz); 763 764 return (rval); 765 } 766 767 static uint32_t 768 urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid, 769 struct rndis_set_req *msg, uint16_t len) 770 { 771 struct rndis_comp_hdr *hdr; 772 uint32_t datalen, rval; 773 774 msg->rm_type = htole32(REMOTE_NDIS_SET_MSG); 775 msg->rm_len = htole32(len); 776 msg->rm_rid = 0; /* XXX */ 777 msg->rm_oid = htole32(oid); 778 datalen = len - sizeof(*msg); 779 msg->rm_infobuflen = htole32(datalen); 780 if (datalen != 0) { 781 msg->rm_infobufoffset = htole32(sizeof(*msg) - 782 RNDIS_HEADER_OFFSET); 783 } else { 784 msg->rm_infobufoffset = 0; 785 } 786 msg->rm_devicevchdl = 0; 787 788 DPRINTF("type %u len %u rid %u oid 0x%x " 789 "infobuflen %u infobufoffset %u devicevchdl %u\n", 790 le32toh(msg->rm_type), 791 le32toh(msg->rm_len), 792 le32toh(msg->rm_rid), 793 le32toh(msg->rm_oid), 794 le32toh(msg->rm_infobuflen), 795 le32toh(msg->rm_infobufoffset), 796 le32toh(msg->rm_devicevchdl)); 797 798 rval = urndis_ctrl_send(sc, msg, len); 799 800 if (rval != RNDIS_STATUS_SUCCESS) { 801 DPRINTF("set failed\n"); 802 return (rval); 803 } 804 if ((hdr = urndis_ctrl_recv(sc)) == NULL) { 805 DPRINTF("unable to get set response\n"); 806 return (RNDIS_STATUS_FAILURE); 807 } 808 rval = urndis_ctrl_handle(sc, hdr, NULL, NULL); 809 if (rval != RNDIS_STATUS_SUCCESS) 810 DPRINTF("set failed 0x%x\n", rval); 811 812 return (rval); 813 } 814 815 static void 816 urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error) 817 { 818 struct urndis_softc *sc = usbd_xfer_softc(xfer); 819 struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, 0); 820 struct ifnet *ifp = uether_getifp(&sc->sc_ue); 821 struct rndis_packet_msg msg; 822 struct mbuf *m; 823 int actlen; 824 int aframes; 825 int offset; 826 827 switch (USB_GET_STATE(xfer)) { 828 case USB_ST_TRANSFERRED: 829 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL); 830 831 DPRINTFN(1, "received %u bytes in %u frames\n", actlen, aframes); 832 833 for (offset = 0; actlen >= (uint32_t)sizeof(msg);) { 834 /* copy out header */ 835 usbd_copy_out(pc, offset, &msg, sizeof(msg)); 836 837 if (le32toh(0x1234567U) != 0x1234567U) { 838 /* swap endianness */ 839 msg.rm_type = le32toh(msg.rm_type); 840 msg.rm_len = le32toh(msg.rm_len); 841 msg.rm_dataoffset = le32toh(msg.rm_dataoffset); 842 msg.rm_datalen = le32toh(msg.rm_datalen); 843 msg.rm_oobdataoffset = le32toh(msg.rm_oobdataoffset); 844 msg.rm_oobdatalen = le32toh(msg.rm_oobdatalen); 845 msg.rm_oobdataelements = le32toh(msg.rm_oobdataelements); 846 msg.rm_pktinfooffset = le32toh(msg.rm_pktinfooffset); 847 msg.rm_pktinfolen = le32toh(msg.rm_pktinfolen); 848 msg.rm_vchandle = le32toh(msg.rm_vchandle); 849 msg.rm_reserved = le32toh(msg.rm_reserved); 850 } 851 852 DPRINTF("len %u data(off:%u len:%u) " 853 "oobdata(off:%u len:%u nb:%u) perpacket(off:%u len:%u)\n", 854 msg.rm_len, msg.rm_dataoffset, msg.rm_datalen, 855 msg.rm_oobdataoffset, msg.rm_oobdatalen, 856 msg.rm_oobdataelements, msg.rm_pktinfooffset, 857 msg.rm_pktinfooffset); 858 859 /* sanity check the RNDIS header */ 860 if (msg.rm_type != REMOTE_NDIS_PACKET_MSG) { 861 DPRINTF("invalid type 0x%x != 0x%x\n", 862 msg.rm_type, REMOTE_NDIS_PACKET_MSG); 863 goto tr_setup; 864 } else if (msg.rm_len < (uint32_t)sizeof(msg)) { 865 DPRINTF("invalid msg len %u < %u\n", 866 msg.rm_len, (unsigned)sizeof(msg)); 867 goto tr_setup; 868 } else if (msg.rm_len > (uint32_t)actlen) { 869 DPRINTF("invalid msg len %u > buffer " 870 "len %u\n", msg.rm_len, actlen); 871 goto tr_setup; 872 } else if (msg.rm_dataoffset >= (uint32_t)actlen) { 873 DPRINTF("invalid msg dataoffset %u > buffer " 874 "dataoffset %u\n", msg.rm_dataoffset, actlen); 875 goto tr_setup; 876 } else if (msg.rm_datalen > (uint32_t)actlen) { 877 DPRINTF("invalid msg datalen %u > buffer " 878 "datalen %u\n", msg.rm_datalen, actlen); 879 goto tr_setup; 880 } else if ((msg.rm_dataoffset + msg.rm_datalen + 881 (uint32_t)__offsetof(struct rndis_packet_msg, 882 rm_dataoffset)) > (uint32_t)actlen) { 883 DPRINTF("invalid dataoffset %u larger than %u\n", 884 msg.rm_dataoffset + msg.rm_datalen + 885 (uint32_t)__offsetof(struct rndis_packet_msg, 886 rm_dataoffset), actlen); 887 goto tr_setup; 888 } else if (msg.rm_datalen < (uint32_t)sizeof(struct ether_header)) { 889 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1); 890 DPRINTF("invalid ethernet size " 891 "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header)); 892 goto tr_setup; 893 } else if (msg.rm_datalen > (uint32_t)(MCLBYTES - ETHER_ALIGN)) { 894 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1); 895 DPRINTF("invalid ethernet size " 896 "%u > %u\n", 897 msg.rm_datalen, (unsigned)MCLBYTES); 898 goto tr_setup; 899 } else if (msg.rm_datalen > (uint32_t)(MHLEN - ETHER_ALIGN)) { 900 m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR); 901 } else { 902 m = m_gethdr(M_NOWAIT, MT_DATA); 903 } 904 905 /* check if we have a buffer */ 906 if (m != NULL) { 907 m->m_len = m->m_pkthdr.len = msg.rm_datalen + ETHER_ALIGN; 908 m_adj(m, ETHER_ALIGN); 909 910 usbd_copy_out(pc, offset + msg.rm_dataoffset + 911 __offsetof(struct rndis_packet_msg, 912 rm_dataoffset), m->m_data, msg.rm_datalen); 913 914 /* enqueue */ 915 uether_rxmbuf(&sc->sc_ue, m, msg.rm_datalen); 916 } else { 917 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1); 918 } 919 offset += msg.rm_len; 920 actlen -= msg.rm_len; 921 } 922 923 case USB_ST_SETUP: 924 tr_setup: 925 usbd_xfer_set_frame_len(xfer, 0, RNDIS_RX_MAXLEN); 926 usbd_xfer_set_frames(xfer, 1); 927 usbd_transfer_submit(xfer); 928 uether_rxflush(&sc->sc_ue); /* must be last */ 929 break; 930 931 default: /* Error */ 932 DPRINTFN(1, "error = %s\n", usbd_errstr(error)); 933 934 if (error != USB_ERR_CANCELLED) { 935 /* try to clear stall first */ 936 usbd_xfer_set_stall(xfer); 937 usbd_xfer_set_frames(xfer, 0); 938 usbd_transfer_submit(xfer); 939 } 940 break; 941 } 942 } 943 944 static void 945 urndis_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error) 946 { 947 struct rndis_packet_msg msg; 948 struct urndis_softc *sc = usbd_xfer_softc(xfer); 949 struct ifnet *ifp = uether_getifp(&sc->sc_ue); 950 struct mbuf *m; 951 unsigned x; 952 int actlen; 953 int aframes; 954 955 usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL); 956 957 DPRINTFN(1, "\n"); 958 959 switch (USB_GET_STATE(xfer)) { 960 case USB_ST_TRANSFERRED: 961 DPRINTFN(11, "%u bytes in %u frames\n", actlen, aframes); 962 963 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1); 964 965 /* FALLTHROUGH */ 966 case USB_ST_SETUP: 967 tr_setup: 968 memset(&msg, 0, sizeof(msg)); 969 970 for (x = 0; x != RNDIS_TX_FRAMES_MAX; x++) { 971 struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, x); 972 973 usbd_xfer_set_frame_offset(xfer, x * RNDIS_TX_MAXLEN, x); 974 975 next_pkt: 976 IFQ_DRV_DEQUEUE(&ifp->if_snd, m); 977 978 if (m == NULL) 979 break; 980 981 if ((m->m_pkthdr.len + sizeof(msg)) > RNDIS_TX_MAXLEN) { 982 DPRINTF("Too big packet\n"); 983 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1); 984 985 /* Free buffer */ 986 m_freem(m); 987 goto next_pkt; 988 } 989 msg.rm_type = htole32(REMOTE_NDIS_PACKET_MSG); 990 msg.rm_len = htole32(sizeof(msg) + m->m_pkthdr.len); 991 992 msg.rm_dataoffset = htole32(RNDIS_DATA_OFFSET); 993 msg.rm_datalen = htole32(m->m_pkthdr.len); 994 995 /* copy in all data */ 996 usbd_copy_in(pc, 0, &msg, sizeof(msg)); 997 usbd_m_copy_in(pc, sizeof(msg), m, 0, m->m_pkthdr.len); 998 usbd_xfer_set_frame_len(xfer, x, sizeof(msg) + m->m_pkthdr.len); 999 1000 /* 1001 * If there's a BPF listener, bounce a copy of 1002 * this frame to him: 1003 */ 1004 BPF_MTAP(ifp, m); 1005 1006 /* Free buffer */ 1007 m_freem(m); 1008 } 1009 if (x != 0) { 1010 usbd_xfer_set_frames(xfer, x); 1011 usbd_transfer_submit(xfer); 1012 } 1013 break; 1014 1015 default: /* Error */ 1016 DPRINTFN(11, "transfer error, %s\n", usbd_errstr(error)); 1017 1018 /* count output errors */ 1019 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1); 1020 1021 if (error != USB_ERR_CANCELLED) { 1022 /* try to clear stall first */ 1023 usbd_xfer_set_stall(xfer); 1024 goto tr_setup; 1025 } 1026 break; 1027 } 1028 } 1029 1030 static void 1031 urndis_intr_read_callback(struct usb_xfer *xfer, usb_error_t error) 1032 { 1033 int actlen; 1034 1035 usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL); 1036 1037 switch (USB_GET_STATE(xfer)) { 1038 case USB_ST_TRANSFERRED: 1039 1040 DPRINTF("Received %d bytes\n", actlen); 1041 1042 /* TODO: decode some indications */ 1043 1044 /* FALLTHROUGH */ 1045 case USB_ST_SETUP: 1046 tr_setup: 1047 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer)); 1048 usbd_transfer_submit(xfer); 1049 break; 1050 1051 default: /* Error */ 1052 if (error != USB_ERR_CANCELLED) { 1053 /* start clear stall */ 1054 usbd_xfer_set_stall(xfer); 1055 goto tr_setup; 1056 } 1057 break; 1058 } 1059 } 1060