1 /*
2  * RNDIS MSG parser
3  *
4  * Authors:	Benedikt Spranger, Pengutronix
5  *		Robert Schwebel, Pengutronix
6  *
7  *              This program is free software; you can redistribute it and/or
8  *              modify it under the terms of the GNU General Public License
9  *              version 2, as published by the Free Software Foundation.
10  *
11  *		This software was originally developed in conformance with
12  *		Microsoft's Remote NDIS Specification License Agreement.
13  *
14  * 03/12/2004 Kai-Uwe Bloem <linux-development@auerswald.de>
15  *		Fixed message length bug in init_response
16  *
17  * 03/25/2004 Kai-Uwe Bloem <linux-development@auerswald.de>
18  *		Fixed rndis_rm_hdr length bug.
19  *
20  * Copyright (C) 2004 by David Brownell
21  *		updates to merge with Linux 2.6, better match RNDIS spec
22  */
23 
24 #include <linux/module.h>
25 #include <linux/moduleparam.h>
26 #include <linux/kernel.h>
27 #include <linux/errno.h>
28 #include <linux/idr.h>
29 #include <linux/list.h>
30 #include <linux/proc_fs.h>
31 #include <linux/slab.h>
32 #include <linux/seq_file.h>
33 #include <linux/netdevice.h>
34 
35 #include <asm/io.h>
36 #include <asm/byteorder.h>
37 #include <asm/unaligned.h>
38 
39 #include "u_rndis.h"
40 
41 #undef	VERBOSE_DEBUG
42 
43 #include "rndis.h"
44 
45 
46 /* The driver for your USB chip needs to support ep0 OUT to work with
47  * RNDIS, plus all three CDC Ethernet endpoints (interrupt not optional).
48  *
49  * Windows hosts need an INF file like Documentation/usb/linux.inf
50  * and will be happier if you provide the host_addr module parameter.
51  */
52 
53 #if 0
54 static int rndis_debug = 0;
55 module_param (rndis_debug, int, 0);
56 MODULE_PARM_DESC (rndis_debug, "enable debugging");
57 #else
58 #define rndis_debug		0
59 #endif
60 
61 #ifdef CONFIG_USB_GADGET_DEBUG_FILES
62 
63 #define	NAME_TEMPLATE "driver/rndis-%03d"
64 
65 #endif /* CONFIG_USB_GADGET_DEBUG_FILES */
66 
67 static DEFINE_IDA(rndis_ida);
68 
69 /* Driver Version */
70 static const __le32 rndis_driver_version = cpu_to_le32(1);
71 
72 /* Function Prototypes */
73 static rndis_resp_t *rndis_add_response(struct rndis_params *params,
74 					u32 length);
75 
76 #ifdef CONFIG_USB_GADGET_DEBUG_FILES
77 
78 static const struct file_operations rndis_proc_fops;
79 
80 #endif /* CONFIG_USB_GADGET_DEBUG_FILES */
81 
82 /* supported OIDs */
83 static const u32 oid_supported_list[] = {
84 	/* the general stuff */
85 	RNDIS_OID_GEN_SUPPORTED_LIST,
86 	RNDIS_OID_GEN_HARDWARE_STATUS,
87 	RNDIS_OID_GEN_MEDIA_SUPPORTED,
88 	RNDIS_OID_GEN_MEDIA_IN_USE,
89 	RNDIS_OID_GEN_MAXIMUM_FRAME_SIZE,
90 	RNDIS_OID_GEN_LINK_SPEED,
91 	RNDIS_OID_GEN_TRANSMIT_BLOCK_SIZE,
92 	RNDIS_OID_GEN_RECEIVE_BLOCK_SIZE,
93 	RNDIS_OID_GEN_VENDOR_ID,
94 	RNDIS_OID_GEN_VENDOR_DESCRIPTION,
95 	RNDIS_OID_GEN_VENDOR_DRIVER_VERSION,
96 	RNDIS_OID_GEN_CURRENT_PACKET_FILTER,
97 	RNDIS_OID_GEN_MAXIMUM_TOTAL_SIZE,
98 	RNDIS_OID_GEN_MEDIA_CONNECT_STATUS,
99 	RNDIS_OID_GEN_PHYSICAL_MEDIUM,
100 
101 	/* the statistical stuff */
102 	RNDIS_OID_GEN_XMIT_OK,
103 	RNDIS_OID_GEN_RCV_OK,
104 	RNDIS_OID_GEN_XMIT_ERROR,
105 	RNDIS_OID_GEN_RCV_ERROR,
106 	RNDIS_OID_GEN_RCV_NO_BUFFER,
107 #ifdef	RNDIS_OPTIONAL_STATS
108 	RNDIS_OID_GEN_DIRECTED_BYTES_XMIT,
109 	RNDIS_OID_GEN_DIRECTED_FRAMES_XMIT,
110 	RNDIS_OID_GEN_MULTICAST_BYTES_XMIT,
111 	RNDIS_OID_GEN_MULTICAST_FRAMES_XMIT,
112 	RNDIS_OID_GEN_BROADCAST_BYTES_XMIT,
113 	RNDIS_OID_GEN_BROADCAST_FRAMES_XMIT,
114 	RNDIS_OID_GEN_DIRECTED_BYTES_RCV,
115 	RNDIS_OID_GEN_DIRECTED_FRAMES_RCV,
116 	RNDIS_OID_GEN_MULTICAST_BYTES_RCV,
117 	RNDIS_OID_GEN_MULTICAST_FRAMES_RCV,
118 	RNDIS_OID_GEN_BROADCAST_BYTES_RCV,
119 	RNDIS_OID_GEN_BROADCAST_FRAMES_RCV,
120 	RNDIS_OID_GEN_RCV_CRC_ERROR,
121 	RNDIS_OID_GEN_TRANSMIT_QUEUE_LENGTH,
122 #endif	/* RNDIS_OPTIONAL_STATS */
123 
124 	/* mandatory 802.3 */
125 	/* the general stuff */
126 	RNDIS_OID_802_3_PERMANENT_ADDRESS,
127 	RNDIS_OID_802_3_CURRENT_ADDRESS,
128 	RNDIS_OID_802_3_MULTICAST_LIST,
129 	RNDIS_OID_802_3_MAC_OPTIONS,
130 	RNDIS_OID_802_3_MAXIMUM_LIST_SIZE,
131 
132 	/* the statistical stuff */
133 	RNDIS_OID_802_3_RCV_ERROR_ALIGNMENT,
134 	RNDIS_OID_802_3_XMIT_ONE_COLLISION,
135 	RNDIS_OID_802_3_XMIT_MORE_COLLISIONS,
136 #ifdef	RNDIS_OPTIONAL_STATS
137 	RNDIS_OID_802_3_XMIT_DEFERRED,
138 	RNDIS_OID_802_3_XMIT_MAX_COLLISIONS,
139 	RNDIS_OID_802_3_RCV_OVERRUN,
140 	RNDIS_OID_802_3_XMIT_UNDERRUN,
141 	RNDIS_OID_802_3_XMIT_HEARTBEAT_FAILURE,
142 	RNDIS_OID_802_3_XMIT_TIMES_CRS_LOST,
143 	RNDIS_OID_802_3_XMIT_LATE_COLLISIONS,
144 #endif	/* RNDIS_OPTIONAL_STATS */
145 
146 #ifdef	RNDIS_PM
147 	/* PM and wakeup are "mandatory" for USB, but the RNDIS specs
148 	 * don't say what they mean ... and the NDIS specs are often
149 	 * confusing and/or ambiguous in this context.  (That is, more
150 	 * so than their specs for the other OIDs.)
151 	 *
152 	 * FIXME someone who knows what these should do, please
153 	 * implement them!
154 	 */
155 
156 	/* power management */
157 	OID_PNP_CAPABILITIES,
158 	OID_PNP_QUERY_POWER,
159 	OID_PNP_SET_POWER,
160 
161 #ifdef	RNDIS_WAKEUP
162 	/* wake up host */
163 	OID_PNP_ENABLE_WAKE_UP,
164 	OID_PNP_ADD_WAKE_UP_PATTERN,
165 	OID_PNP_REMOVE_WAKE_UP_PATTERN,
166 #endif	/* RNDIS_WAKEUP */
167 #endif	/* RNDIS_PM */
168 };
169 
170 
171 /* NDIS Functions */
172 static int gen_ndis_query_resp(struct rndis_params *params, u32 OID, u8 *buf,
173 			       unsigned buf_len, rndis_resp_t *r)
174 {
175 	int retval = -ENOTSUPP;
176 	u32 length = 4;	/* usually */
177 	__le32 *outbuf;
178 	int i, count;
179 	rndis_query_cmplt_type *resp;
180 	struct net_device *net;
181 	struct rtnl_link_stats64 temp;
182 	const struct rtnl_link_stats64 *stats;
183 
184 	if (!r) return -ENOMEM;
185 	resp = (rndis_query_cmplt_type *)r->buf;
186 
187 	if (!resp) return -ENOMEM;
188 
189 	if (buf_len && rndis_debug > 1) {
190 		pr_debug("query OID %08x value, len %d:\n", OID, buf_len);
191 		for (i = 0; i < buf_len; i += 16) {
192 			pr_debug("%03d: %08x %08x %08x %08x\n", i,
193 				get_unaligned_le32(&buf[i]),
194 				get_unaligned_le32(&buf[i + 4]),
195 				get_unaligned_le32(&buf[i + 8]),
196 				get_unaligned_le32(&buf[i + 12]));
197 		}
198 	}
199 
200 	/* response goes here, right after the header */
201 	outbuf = (__le32 *)&resp[1];
202 	resp->InformationBufferOffset = cpu_to_le32(16);
203 
204 	net = params->dev;
205 	stats = dev_get_stats(net, &temp);
206 
207 	switch (OID) {
208 
209 	/* general oids (table 4-1) */
210 
211 	/* mandatory */
212 	case RNDIS_OID_GEN_SUPPORTED_LIST:
213 		pr_debug("%s: RNDIS_OID_GEN_SUPPORTED_LIST\n", __func__);
214 		length = sizeof(oid_supported_list);
215 		count  = length / sizeof(u32);
216 		for (i = 0; i < count; i++)
217 			outbuf[i] = cpu_to_le32(oid_supported_list[i]);
218 		retval = 0;
219 		break;
220 
221 	/* mandatory */
222 	case RNDIS_OID_GEN_HARDWARE_STATUS:
223 		pr_debug("%s: RNDIS_OID_GEN_HARDWARE_STATUS\n", __func__);
224 		/* Bogus question!
225 		 * Hardware must be ready to receive high level protocols.
226 		 * BTW:
227 		 * reddite ergo quae sunt Caesaris Caesari
228 		 * et quae sunt Dei Deo!
229 		 */
230 		*outbuf = cpu_to_le32(0);
231 		retval = 0;
232 		break;
233 
234 	/* mandatory */
235 	case RNDIS_OID_GEN_MEDIA_SUPPORTED:
236 		pr_debug("%s: RNDIS_OID_GEN_MEDIA_SUPPORTED\n", __func__);
237 		*outbuf = cpu_to_le32(params->medium);
238 		retval = 0;
239 		break;
240 
241 	/* mandatory */
242 	case RNDIS_OID_GEN_MEDIA_IN_USE:
243 		pr_debug("%s: RNDIS_OID_GEN_MEDIA_IN_USE\n", __func__);
244 		/* one medium, one transport... (maybe you do it better) */
245 		*outbuf = cpu_to_le32(params->medium);
246 		retval = 0;
247 		break;
248 
249 	/* mandatory */
250 	case RNDIS_OID_GEN_MAXIMUM_FRAME_SIZE:
251 		pr_debug("%s: RNDIS_OID_GEN_MAXIMUM_FRAME_SIZE\n", __func__);
252 		if (params->dev) {
253 			*outbuf = cpu_to_le32(params->dev->mtu);
254 			retval = 0;
255 		}
256 		break;
257 
258 	/* mandatory */
259 	case RNDIS_OID_GEN_LINK_SPEED:
260 		if (rndis_debug > 1)
261 			pr_debug("%s: RNDIS_OID_GEN_LINK_SPEED\n", __func__);
262 		if (params->media_state == RNDIS_MEDIA_STATE_DISCONNECTED)
263 			*outbuf = cpu_to_le32(0);
264 		else
265 			*outbuf = cpu_to_le32(params->speed);
266 		retval = 0;
267 		break;
268 
269 	/* mandatory */
270 	case RNDIS_OID_GEN_TRANSMIT_BLOCK_SIZE:
271 		pr_debug("%s: RNDIS_OID_GEN_TRANSMIT_BLOCK_SIZE\n", __func__);
272 		if (params->dev) {
273 			*outbuf = cpu_to_le32(params->dev->mtu);
274 			retval = 0;
275 		}
276 		break;
277 
278 	/* mandatory */
279 	case RNDIS_OID_GEN_RECEIVE_BLOCK_SIZE:
280 		pr_debug("%s: RNDIS_OID_GEN_RECEIVE_BLOCK_SIZE\n", __func__);
281 		if (params->dev) {
282 			*outbuf = cpu_to_le32(params->dev->mtu);
283 			retval = 0;
284 		}
285 		break;
286 
287 	/* mandatory */
288 	case RNDIS_OID_GEN_VENDOR_ID:
289 		pr_debug("%s: RNDIS_OID_GEN_VENDOR_ID\n", __func__);
290 		*outbuf = cpu_to_le32(params->vendorID);
291 		retval = 0;
292 		break;
293 
294 	/* mandatory */
295 	case RNDIS_OID_GEN_VENDOR_DESCRIPTION:
296 		pr_debug("%s: RNDIS_OID_GEN_VENDOR_DESCRIPTION\n", __func__);
297 		if (params->vendorDescr) {
298 			length = strlen(params->vendorDescr);
299 			memcpy(outbuf, params->vendorDescr, length);
300 		} else {
301 			outbuf[0] = 0;
302 		}
303 		retval = 0;
304 		break;
305 
306 	case RNDIS_OID_GEN_VENDOR_DRIVER_VERSION:
307 		pr_debug("%s: RNDIS_OID_GEN_VENDOR_DRIVER_VERSION\n", __func__);
308 		/* Created as LE */
309 		*outbuf = rndis_driver_version;
310 		retval = 0;
311 		break;
312 
313 	/* mandatory */
314 	case RNDIS_OID_GEN_CURRENT_PACKET_FILTER:
315 		pr_debug("%s: RNDIS_OID_GEN_CURRENT_PACKET_FILTER\n", __func__);
316 		*outbuf = cpu_to_le32(*params->filter);
317 		retval = 0;
318 		break;
319 
320 	/* mandatory */
321 	case RNDIS_OID_GEN_MAXIMUM_TOTAL_SIZE:
322 		pr_debug("%s: RNDIS_OID_GEN_MAXIMUM_TOTAL_SIZE\n", __func__);
323 		*outbuf = cpu_to_le32(RNDIS_MAX_TOTAL_SIZE);
324 		retval = 0;
325 		break;
326 
327 	/* mandatory */
328 	case RNDIS_OID_GEN_MEDIA_CONNECT_STATUS:
329 		if (rndis_debug > 1)
330 			pr_debug("%s: RNDIS_OID_GEN_MEDIA_CONNECT_STATUS\n", __func__);
331 		*outbuf = cpu_to_le32(params->media_state);
332 		retval = 0;
333 		break;
334 
335 	case RNDIS_OID_GEN_PHYSICAL_MEDIUM:
336 		pr_debug("%s: RNDIS_OID_GEN_PHYSICAL_MEDIUM\n", __func__);
337 		*outbuf = cpu_to_le32(0);
338 		retval = 0;
339 		break;
340 
341 	/* The RNDIS specification is incomplete/wrong.   Some versions
342 	 * of MS-Windows expect OIDs that aren't specified there.  Other
343 	 * versions emit undefined RNDIS messages. DOCUMENT ALL THESE!
344 	 */
345 	case RNDIS_OID_GEN_MAC_OPTIONS:		/* from WinME */
346 		pr_debug("%s: RNDIS_OID_GEN_MAC_OPTIONS\n", __func__);
347 		*outbuf = cpu_to_le32(
348 			  RNDIS_MAC_OPTION_RECEIVE_SERIALIZED
349 			| RNDIS_MAC_OPTION_FULL_DUPLEX);
350 		retval = 0;
351 		break;
352 
353 	/* statistics OIDs (table 4-2) */
354 
355 	/* mandatory */
356 	case RNDIS_OID_GEN_XMIT_OK:
357 		if (rndis_debug > 1)
358 			pr_debug("%s: RNDIS_OID_GEN_XMIT_OK\n", __func__);
359 		if (stats) {
360 			*outbuf = cpu_to_le32(stats->tx_packets
361 				- stats->tx_errors - stats->tx_dropped);
362 			retval = 0;
363 		}
364 		break;
365 
366 	/* mandatory */
367 	case RNDIS_OID_GEN_RCV_OK:
368 		if (rndis_debug > 1)
369 			pr_debug("%s: RNDIS_OID_GEN_RCV_OK\n", __func__);
370 		if (stats) {
371 			*outbuf = cpu_to_le32(stats->rx_packets
372 				- stats->rx_errors - stats->rx_dropped);
373 			retval = 0;
374 		}
375 		break;
376 
377 	/* mandatory */
378 	case RNDIS_OID_GEN_XMIT_ERROR:
379 		if (rndis_debug > 1)
380 			pr_debug("%s: RNDIS_OID_GEN_XMIT_ERROR\n", __func__);
381 		if (stats) {
382 			*outbuf = cpu_to_le32(stats->tx_errors);
383 			retval = 0;
384 		}
385 		break;
386 
387 	/* mandatory */
388 	case RNDIS_OID_GEN_RCV_ERROR:
389 		if (rndis_debug > 1)
390 			pr_debug("%s: RNDIS_OID_GEN_RCV_ERROR\n", __func__);
391 		if (stats) {
392 			*outbuf = cpu_to_le32(stats->rx_errors);
393 			retval = 0;
394 		}
395 		break;
396 
397 	/* mandatory */
398 	case RNDIS_OID_GEN_RCV_NO_BUFFER:
399 		pr_debug("%s: RNDIS_OID_GEN_RCV_NO_BUFFER\n", __func__);
400 		if (stats) {
401 			*outbuf = cpu_to_le32(stats->rx_dropped);
402 			retval = 0;
403 		}
404 		break;
405 
406 	/* ieee802.3 OIDs (table 4-3) */
407 
408 	/* mandatory */
409 	case RNDIS_OID_802_3_PERMANENT_ADDRESS:
410 		pr_debug("%s: RNDIS_OID_802_3_PERMANENT_ADDRESS\n", __func__);
411 		if (params->dev) {
412 			length = ETH_ALEN;
413 			memcpy(outbuf, params->host_mac, length);
414 			retval = 0;
415 		}
416 		break;
417 
418 	/* mandatory */
419 	case RNDIS_OID_802_3_CURRENT_ADDRESS:
420 		pr_debug("%s: RNDIS_OID_802_3_CURRENT_ADDRESS\n", __func__);
421 		if (params->dev) {
422 			length = ETH_ALEN;
423 			memcpy(outbuf, params->host_mac, length);
424 			retval = 0;
425 		}
426 		break;
427 
428 	/* mandatory */
429 	case RNDIS_OID_802_3_MULTICAST_LIST:
430 		pr_debug("%s: RNDIS_OID_802_3_MULTICAST_LIST\n", __func__);
431 		/* Multicast base address only */
432 		*outbuf = cpu_to_le32(0xE0000000);
433 		retval = 0;
434 		break;
435 
436 	/* mandatory */
437 	case RNDIS_OID_802_3_MAXIMUM_LIST_SIZE:
438 		pr_debug("%s: RNDIS_OID_802_3_MAXIMUM_LIST_SIZE\n", __func__);
439 		/* Multicast base address only */
440 		*outbuf = cpu_to_le32(1);
441 		retval = 0;
442 		break;
443 
444 	case RNDIS_OID_802_3_MAC_OPTIONS:
445 		pr_debug("%s: RNDIS_OID_802_3_MAC_OPTIONS\n", __func__);
446 		*outbuf = cpu_to_le32(0);
447 		retval = 0;
448 		break;
449 
450 	/* ieee802.3 statistics OIDs (table 4-4) */
451 
452 	/* mandatory */
453 	case RNDIS_OID_802_3_RCV_ERROR_ALIGNMENT:
454 		pr_debug("%s: RNDIS_OID_802_3_RCV_ERROR_ALIGNMENT\n", __func__);
455 		if (stats) {
456 			*outbuf = cpu_to_le32(stats->rx_frame_errors);
457 			retval = 0;
458 		}
459 		break;
460 
461 	/* mandatory */
462 	case RNDIS_OID_802_3_XMIT_ONE_COLLISION:
463 		pr_debug("%s: RNDIS_OID_802_3_XMIT_ONE_COLLISION\n", __func__);
464 		*outbuf = cpu_to_le32(0);
465 		retval = 0;
466 		break;
467 
468 	/* mandatory */
469 	case RNDIS_OID_802_3_XMIT_MORE_COLLISIONS:
470 		pr_debug("%s: RNDIS_OID_802_3_XMIT_MORE_COLLISIONS\n", __func__);
471 		*outbuf = cpu_to_le32(0);
472 		retval = 0;
473 		break;
474 
475 	default:
476 		pr_warn("%s: query unknown OID 0x%08X\n", __func__, OID);
477 	}
478 	if (retval < 0)
479 		length = 0;
480 
481 	resp->InformationBufferLength = cpu_to_le32(length);
482 	r->length = length + sizeof(*resp);
483 	resp->MessageLength = cpu_to_le32(r->length);
484 	return retval;
485 }
486 
487 static int gen_ndis_set_resp(struct rndis_params *params, u32 OID,
488 			     u8 *buf, u32 buf_len, rndis_resp_t *r)
489 {
490 	rndis_set_cmplt_type *resp;
491 	int i, retval = -ENOTSUPP;
492 
493 	if (!r)
494 		return -ENOMEM;
495 	resp = (rndis_set_cmplt_type *)r->buf;
496 	if (!resp)
497 		return -ENOMEM;
498 
499 	if (buf_len && rndis_debug > 1) {
500 		pr_debug("set OID %08x value, len %d:\n", OID, buf_len);
501 		for (i = 0; i < buf_len; i += 16) {
502 			pr_debug("%03d: %08x %08x %08x %08x\n", i,
503 				get_unaligned_le32(&buf[i]),
504 				get_unaligned_le32(&buf[i + 4]),
505 				get_unaligned_le32(&buf[i + 8]),
506 				get_unaligned_le32(&buf[i + 12]));
507 		}
508 	}
509 
510 	switch (OID) {
511 	case RNDIS_OID_GEN_CURRENT_PACKET_FILTER:
512 
513 		/* these NDIS_PACKET_TYPE_* bitflags are shared with
514 		 * cdc_filter; it's not RNDIS-specific
515 		 * NDIS_PACKET_TYPE_x == USB_CDC_PACKET_TYPE_x for x in:
516 		 *	PROMISCUOUS, DIRECTED,
517 		 *	MULTICAST, ALL_MULTICAST, BROADCAST
518 		 */
519 		*params->filter = (u16)get_unaligned_le32(buf);
520 		pr_debug("%s: RNDIS_OID_GEN_CURRENT_PACKET_FILTER %08x\n",
521 			__func__, *params->filter);
522 
523 		/* this call has a significant side effect:  it's
524 		 * what makes the packet flow start and stop, like
525 		 * activating the CDC Ethernet altsetting.
526 		 */
527 		retval = 0;
528 		if (*params->filter) {
529 			params->state = RNDIS_DATA_INITIALIZED;
530 			netif_carrier_on(params->dev);
531 			if (netif_running(params->dev))
532 				netif_wake_queue(params->dev);
533 		} else {
534 			params->state = RNDIS_INITIALIZED;
535 			netif_carrier_off(params->dev);
536 			netif_stop_queue(params->dev);
537 		}
538 		break;
539 
540 	case RNDIS_OID_802_3_MULTICAST_LIST:
541 		/* I think we can ignore this */
542 		pr_debug("%s: RNDIS_OID_802_3_MULTICAST_LIST\n", __func__);
543 		retval = 0;
544 		break;
545 
546 	default:
547 		pr_warn("%s: set unknown OID 0x%08X, size %d\n",
548 			__func__, OID, buf_len);
549 	}
550 
551 	return retval;
552 }
553 
554 /*
555  * Response Functions
556  */
557 
558 static int rndis_init_response(struct rndis_params *params,
559 			       rndis_init_msg_type *buf)
560 {
561 	rndis_init_cmplt_type *resp;
562 	rndis_resp_t *r;
563 
564 	if (!params->dev)
565 		return -ENOTSUPP;
566 
567 	r = rndis_add_response(params, sizeof(rndis_init_cmplt_type));
568 	if (!r)
569 		return -ENOMEM;
570 	resp = (rndis_init_cmplt_type *)r->buf;
571 
572 	resp->MessageType = cpu_to_le32(RNDIS_MSG_INIT_C);
573 	resp->MessageLength = cpu_to_le32(52);
574 	resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
575 	resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
576 	resp->MajorVersion = cpu_to_le32(RNDIS_MAJOR_VERSION);
577 	resp->MinorVersion = cpu_to_le32(RNDIS_MINOR_VERSION);
578 	resp->DeviceFlags = cpu_to_le32(RNDIS_DF_CONNECTIONLESS);
579 	resp->Medium = cpu_to_le32(RNDIS_MEDIUM_802_3);
580 	resp->MaxPacketsPerTransfer = cpu_to_le32(1);
581 	resp->MaxTransferSize = cpu_to_le32(
582 		  params->dev->mtu
583 		+ sizeof(struct ethhdr)
584 		+ sizeof(struct rndis_packet_msg_type)
585 		+ 22);
586 	resp->PacketAlignmentFactor = cpu_to_le32(0);
587 	resp->AFListOffset = cpu_to_le32(0);
588 	resp->AFListSize = cpu_to_le32(0);
589 
590 	params->resp_avail(params->v);
591 	return 0;
592 }
593 
594 static int rndis_query_response(struct rndis_params *params,
595 				rndis_query_msg_type *buf)
596 {
597 	rndis_query_cmplt_type *resp;
598 	rndis_resp_t *r;
599 
600 	/* pr_debug("%s: OID = %08X\n", __func__, cpu_to_le32(buf->OID)); */
601 	if (!params->dev)
602 		return -ENOTSUPP;
603 
604 	/*
605 	 * we need more memory:
606 	 * gen_ndis_query_resp expects enough space for
607 	 * rndis_query_cmplt_type followed by data.
608 	 * oid_supported_list is the largest data reply
609 	 */
610 	r = rndis_add_response(params,
611 		sizeof(oid_supported_list) + sizeof(rndis_query_cmplt_type));
612 	if (!r)
613 		return -ENOMEM;
614 	resp = (rndis_query_cmplt_type *)r->buf;
615 
616 	resp->MessageType = cpu_to_le32(RNDIS_MSG_QUERY_C);
617 	resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
618 
619 	if (gen_ndis_query_resp(params, le32_to_cpu(buf->OID),
620 			le32_to_cpu(buf->InformationBufferOffset)
621 					+ 8 + (u8 *)buf,
622 			le32_to_cpu(buf->InformationBufferLength),
623 			r)) {
624 		/* OID not supported */
625 		resp->Status = cpu_to_le32(RNDIS_STATUS_NOT_SUPPORTED);
626 		resp->MessageLength = cpu_to_le32(sizeof *resp);
627 		resp->InformationBufferLength = cpu_to_le32(0);
628 		resp->InformationBufferOffset = cpu_to_le32(0);
629 	} else
630 		resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
631 
632 	params->resp_avail(params->v);
633 	return 0;
634 }
635 
636 static int rndis_set_response(struct rndis_params *params,
637 			      rndis_set_msg_type *buf)
638 {
639 	u32 BufLength, BufOffset;
640 	rndis_set_cmplt_type *resp;
641 	rndis_resp_t *r;
642 
643 	r = rndis_add_response(params, sizeof(rndis_set_cmplt_type));
644 	if (!r)
645 		return -ENOMEM;
646 	resp = (rndis_set_cmplt_type *)r->buf;
647 
648 	BufLength = le32_to_cpu(buf->InformationBufferLength);
649 	BufOffset = le32_to_cpu(buf->InformationBufferOffset);
650 
651 #ifdef	VERBOSE_DEBUG
652 	pr_debug("%s: Length: %d\n", __func__, BufLength);
653 	pr_debug("%s: Offset: %d\n", __func__, BufOffset);
654 	pr_debug("%s: InfoBuffer: ", __func__);
655 
656 	for (i = 0; i < BufLength; i++) {
657 		pr_debug("%02x ", *(((u8 *) buf) + i + 8 + BufOffset));
658 	}
659 
660 	pr_debug("\n");
661 #endif
662 
663 	resp->MessageType = cpu_to_le32(RNDIS_MSG_SET_C);
664 	resp->MessageLength = cpu_to_le32(16);
665 	resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
666 	if (gen_ndis_set_resp(params, le32_to_cpu(buf->OID),
667 			((u8 *)buf) + 8 + BufOffset, BufLength, r))
668 		resp->Status = cpu_to_le32(RNDIS_STATUS_NOT_SUPPORTED);
669 	else
670 		resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
671 
672 	params->resp_avail(params->v);
673 	return 0;
674 }
675 
676 static int rndis_reset_response(struct rndis_params *params,
677 				rndis_reset_msg_type *buf)
678 {
679 	rndis_reset_cmplt_type *resp;
680 	rndis_resp_t *r;
681 	u8 *xbuf;
682 	u32 length;
683 
684 	/* drain the response queue */
685 	while ((xbuf = rndis_get_next_response(params, &length)))
686 		rndis_free_response(params, xbuf);
687 
688 	r = rndis_add_response(params, sizeof(rndis_reset_cmplt_type));
689 	if (!r)
690 		return -ENOMEM;
691 	resp = (rndis_reset_cmplt_type *)r->buf;
692 
693 	resp->MessageType = cpu_to_le32(RNDIS_MSG_RESET_C);
694 	resp->MessageLength = cpu_to_le32(16);
695 	resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
696 	/* resent information */
697 	resp->AddressingReset = cpu_to_le32(1);
698 
699 	params->resp_avail(params->v);
700 	return 0;
701 }
702 
703 static int rndis_keepalive_response(struct rndis_params *params,
704 				    rndis_keepalive_msg_type *buf)
705 {
706 	rndis_keepalive_cmplt_type *resp;
707 	rndis_resp_t *r;
708 
709 	/* host "should" check only in RNDIS_DATA_INITIALIZED state */
710 
711 	r = rndis_add_response(params, sizeof(rndis_keepalive_cmplt_type));
712 	if (!r)
713 		return -ENOMEM;
714 	resp = (rndis_keepalive_cmplt_type *)r->buf;
715 
716 	resp->MessageType = cpu_to_le32(RNDIS_MSG_KEEPALIVE_C);
717 	resp->MessageLength = cpu_to_le32(16);
718 	resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
719 	resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
720 
721 	params->resp_avail(params->v);
722 	return 0;
723 }
724 
725 
726 /*
727  * Device to Host Comunication
728  */
729 static int rndis_indicate_status_msg(struct rndis_params *params, u32 status)
730 {
731 	rndis_indicate_status_msg_type *resp;
732 	rndis_resp_t *r;
733 
734 	if (params->state == RNDIS_UNINITIALIZED)
735 		return -ENOTSUPP;
736 
737 	r = rndis_add_response(params, sizeof(rndis_indicate_status_msg_type));
738 	if (!r)
739 		return -ENOMEM;
740 	resp = (rndis_indicate_status_msg_type *)r->buf;
741 
742 	resp->MessageType = cpu_to_le32(RNDIS_MSG_INDICATE);
743 	resp->MessageLength = cpu_to_le32(20);
744 	resp->Status = cpu_to_le32(status);
745 	resp->StatusBufferLength = cpu_to_le32(0);
746 	resp->StatusBufferOffset = cpu_to_le32(0);
747 
748 	params->resp_avail(params->v);
749 	return 0;
750 }
751 
752 int rndis_signal_connect(struct rndis_params *params)
753 {
754 	params->media_state = RNDIS_MEDIA_STATE_CONNECTED;
755 	return rndis_indicate_status_msg(params, RNDIS_STATUS_MEDIA_CONNECT);
756 }
757 EXPORT_SYMBOL_GPL(rndis_signal_connect);
758 
759 int rndis_signal_disconnect(struct rndis_params *params)
760 {
761 	params->media_state = RNDIS_MEDIA_STATE_DISCONNECTED;
762 	return rndis_indicate_status_msg(params, RNDIS_STATUS_MEDIA_DISCONNECT);
763 }
764 EXPORT_SYMBOL_GPL(rndis_signal_disconnect);
765 
766 void rndis_uninit(struct rndis_params *params)
767 {
768 	u8 *buf;
769 	u32 length;
770 
771 	if (!params)
772 		return;
773 	params->state = RNDIS_UNINITIALIZED;
774 
775 	/* drain the response queue */
776 	while ((buf = rndis_get_next_response(params, &length)))
777 		rndis_free_response(params, buf);
778 }
779 EXPORT_SYMBOL_GPL(rndis_uninit);
780 
781 void rndis_set_host_mac(struct rndis_params *params, const u8 *addr)
782 {
783 	params->host_mac = addr;
784 }
785 EXPORT_SYMBOL_GPL(rndis_set_host_mac);
786 
787 /*
788  * Message Parser
789  */
790 int rndis_msg_parser(struct rndis_params *params, u8 *buf)
791 {
792 	u32 MsgType, MsgLength;
793 	__le32 *tmp;
794 
795 	if (!buf)
796 		return -ENOMEM;
797 
798 	tmp = (__le32 *)buf;
799 	MsgType   = get_unaligned_le32(tmp++);
800 	MsgLength = get_unaligned_le32(tmp++);
801 
802 	if (!params)
803 		return -ENOTSUPP;
804 
805 	/* NOTE: RNDIS is *EXTREMELY* chatty ... Windows constantly polls for
806 	 * rx/tx statistics and link status, in addition to KEEPALIVE traffic
807 	 * and normal HC level polling to see if there's any IN traffic.
808 	 */
809 
810 	/* For USB: responses may take up to 10 seconds */
811 	switch (MsgType) {
812 	case RNDIS_MSG_INIT:
813 		pr_debug("%s: RNDIS_MSG_INIT\n",
814 			__func__);
815 		params->state = RNDIS_INITIALIZED;
816 		return rndis_init_response(params, (rndis_init_msg_type *)buf);
817 
818 	case RNDIS_MSG_HALT:
819 		pr_debug("%s: RNDIS_MSG_HALT\n",
820 			__func__);
821 		params->state = RNDIS_UNINITIALIZED;
822 		if (params->dev) {
823 			netif_carrier_off(params->dev);
824 			netif_stop_queue(params->dev);
825 		}
826 		return 0;
827 
828 	case RNDIS_MSG_QUERY:
829 		return rndis_query_response(params,
830 					(rndis_query_msg_type *)buf);
831 
832 	case RNDIS_MSG_SET:
833 		return rndis_set_response(params, (rndis_set_msg_type *)buf);
834 
835 	case RNDIS_MSG_RESET:
836 		pr_debug("%s: RNDIS_MSG_RESET\n",
837 			__func__);
838 		return rndis_reset_response(params,
839 					(rndis_reset_msg_type *)buf);
840 
841 	case RNDIS_MSG_KEEPALIVE:
842 		/* For USB: host does this every 5 seconds */
843 		if (rndis_debug > 1)
844 			pr_debug("%s: RNDIS_MSG_KEEPALIVE\n",
845 				__func__);
846 		return rndis_keepalive_response(params,
847 						 (rndis_keepalive_msg_type *)
848 						 buf);
849 
850 	default:
851 		/* At least Windows XP emits some undefined RNDIS messages.
852 		 * In one case those messages seemed to relate to the host
853 		 * suspending itself.
854 		 */
855 		pr_warn("%s: unknown RNDIS message 0x%08X len %d\n",
856 			__func__, MsgType, MsgLength);
857 		print_hex_dump_bytes(__func__, DUMP_PREFIX_OFFSET,
858 				     buf, MsgLength);
859 		break;
860 	}
861 
862 	return -ENOTSUPP;
863 }
864 EXPORT_SYMBOL_GPL(rndis_msg_parser);
865 
866 static inline int rndis_get_nr(void)
867 {
868 	return ida_simple_get(&rndis_ida, 0, 0, GFP_KERNEL);
869 }
870 
871 static inline void rndis_put_nr(int nr)
872 {
873 	ida_simple_remove(&rndis_ida, nr);
874 }
875 
876 struct rndis_params *rndis_register(void (*resp_avail)(void *v), void *v)
877 {
878 	struct rndis_params *params;
879 	int i;
880 
881 	if (!resp_avail)
882 		return ERR_PTR(-EINVAL);
883 
884 	i = rndis_get_nr();
885 	if (i < 0) {
886 		pr_debug("failed\n");
887 
888 		return ERR_PTR(-ENODEV);
889 	}
890 
891 	params = kzalloc(sizeof(*params), GFP_KERNEL);
892 	if (!params) {
893 		rndis_put_nr(i);
894 
895 		return ERR_PTR(-ENOMEM);
896 	}
897 
898 #ifdef	CONFIG_USB_GADGET_DEBUG_FILES
899 	{
900 		struct proc_dir_entry *proc_entry;
901 		char name[20];
902 
903 		sprintf(name, NAME_TEMPLATE, i);
904 		proc_entry = proc_create_data(name, 0660, NULL,
905 					      &rndis_proc_fops, params);
906 		if (!proc_entry) {
907 			kfree(params);
908 			rndis_put_nr(i);
909 
910 			return ERR_PTR(-EIO);
911 		}
912 	}
913 #endif
914 
915 	params->confignr = i;
916 	params->used = 1;
917 	params->state = RNDIS_UNINITIALIZED;
918 	params->media_state = RNDIS_MEDIA_STATE_DISCONNECTED;
919 	params->resp_avail = resp_avail;
920 	params->v = v;
921 	INIT_LIST_HEAD(&params->resp_queue);
922 	pr_debug("%s: configNr = %d\n", __func__, i);
923 
924 	return params;
925 }
926 EXPORT_SYMBOL_GPL(rndis_register);
927 
928 void rndis_deregister(struct rndis_params *params)
929 {
930 	int i;
931 
932 	pr_debug("%s:\n", __func__);
933 
934 	if (!params)
935 		return;
936 
937 	i = params->confignr;
938 
939 #ifdef CONFIG_USB_GADGET_DEBUG_FILES
940 	{
941 		char name[20];
942 
943 		sprintf(name, NAME_TEMPLATE, i);
944 		remove_proc_entry(name, NULL);
945 	}
946 #endif
947 
948 	kfree(params);
949 	rndis_put_nr(i);
950 }
951 EXPORT_SYMBOL_GPL(rndis_deregister);
952 int rndis_set_param_dev(struct rndis_params *params, struct net_device *dev,
953 			u16 *cdc_filter)
954 {
955 	pr_debug("%s:\n", __func__);
956 	if (!dev)
957 		return -EINVAL;
958 	if (!params)
959 		return -1;
960 
961 	params->dev = dev;
962 	params->filter = cdc_filter;
963 
964 	return 0;
965 }
966 EXPORT_SYMBOL_GPL(rndis_set_param_dev);
967 
968 int rndis_set_param_vendor(struct rndis_params *params, u32 vendorID,
969 			   const char *vendorDescr)
970 {
971 	pr_debug("%s:\n", __func__);
972 	if (!vendorDescr) return -1;
973 	if (!params)
974 		return -1;
975 
976 	params->vendorID = vendorID;
977 	params->vendorDescr = vendorDescr;
978 
979 	return 0;
980 }
981 EXPORT_SYMBOL_GPL(rndis_set_param_vendor);
982 
983 int rndis_set_param_medium(struct rndis_params *params, u32 medium, u32 speed)
984 {
985 	pr_debug("%s: %u %u\n", __func__, medium, speed);
986 	if (!params)
987 		return -1;
988 
989 	params->medium = medium;
990 	params->speed = speed;
991 
992 	return 0;
993 }
994 EXPORT_SYMBOL_GPL(rndis_set_param_medium);
995 
996 void rndis_add_hdr(struct sk_buff *skb)
997 {
998 	struct rndis_packet_msg_type *header;
999 
1000 	if (!skb)
1001 		return;
1002 	header = skb_push(skb, sizeof(*header));
1003 	memset(header, 0, sizeof *header);
1004 	header->MessageType = cpu_to_le32(RNDIS_MSG_PACKET);
1005 	header->MessageLength = cpu_to_le32(skb->len);
1006 	header->DataOffset = cpu_to_le32(36);
1007 	header->DataLength = cpu_to_le32(skb->len - sizeof(*header));
1008 }
1009 EXPORT_SYMBOL_GPL(rndis_add_hdr);
1010 
1011 void rndis_free_response(struct rndis_params *params, u8 *buf)
1012 {
1013 	rndis_resp_t *r, *n;
1014 
1015 	list_for_each_entry_safe(r, n, &params->resp_queue, list) {
1016 		if (r->buf == buf) {
1017 			list_del(&r->list);
1018 			kfree(r);
1019 		}
1020 	}
1021 }
1022 EXPORT_SYMBOL_GPL(rndis_free_response);
1023 
1024 u8 *rndis_get_next_response(struct rndis_params *params, u32 *length)
1025 {
1026 	rndis_resp_t *r, *n;
1027 
1028 	if (!length) return NULL;
1029 
1030 	list_for_each_entry_safe(r, n, &params->resp_queue, list) {
1031 		if (!r->send) {
1032 			r->send = 1;
1033 			*length = r->length;
1034 			return r->buf;
1035 		}
1036 	}
1037 
1038 	return NULL;
1039 }
1040 EXPORT_SYMBOL_GPL(rndis_get_next_response);
1041 
1042 static rndis_resp_t *rndis_add_response(struct rndis_params *params, u32 length)
1043 {
1044 	rndis_resp_t *r;
1045 
1046 	/* NOTE: this gets copied into ether.c USB_BUFSIZ bytes ... */
1047 	r = kmalloc(sizeof(rndis_resp_t) + length, GFP_ATOMIC);
1048 	if (!r) return NULL;
1049 
1050 	r->buf = (u8 *)(r + 1);
1051 	r->length = length;
1052 	r->send = 0;
1053 
1054 	list_add_tail(&r->list, &params->resp_queue);
1055 	return r;
1056 }
1057 
1058 int rndis_rm_hdr(struct gether *port,
1059 			struct sk_buff *skb,
1060 			struct sk_buff_head *list)
1061 {
1062 	/* tmp points to a struct rndis_packet_msg_type */
1063 	__le32 *tmp = (void *)skb->data;
1064 
1065 	/* MessageType, MessageLength */
1066 	if (cpu_to_le32(RNDIS_MSG_PACKET)
1067 			!= get_unaligned(tmp++)) {
1068 		dev_kfree_skb_any(skb);
1069 		return -EINVAL;
1070 	}
1071 	tmp++;
1072 
1073 	/* DataOffset, DataLength */
1074 	if (!skb_pull(skb, get_unaligned_le32(tmp++) + 8)) {
1075 		dev_kfree_skb_any(skb);
1076 		return -EOVERFLOW;
1077 	}
1078 	skb_trim(skb, get_unaligned_le32(tmp++));
1079 
1080 	skb_queue_tail(list, skb);
1081 	return 0;
1082 }
1083 EXPORT_SYMBOL_GPL(rndis_rm_hdr);
1084 
1085 #ifdef CONFIG_USB_GADGET_DEBUG_FILES
1086 
1087 static int rndis_proc_show(struct seq_file *m, void *v)
1088 {
1089 	rndis_params *param = m->private;
1090 
1091 	seq_printf(m,
1092 			 "Config Nr. %d\n"
1093 			 "used      : %s\n"
1094 			 "state     : %s\n"
1095 			 "medium    : 0x%08X\n"
1096 			 "speed     : %d\n"
1097 			 "cable     : %s\n"
1098 			 "vendor ID : 0x%08X\n"
1099 			 "vendor    : %s\n",
1100 			 param->confignr, (param->used) ? "y" : "n",
1101 			 ({ char *s = "?";
1102 			 switch (param->state) {
1103 			 case RNDIS_UNINITIALIZED:
1104 				s = "RNDIS_UNINITIALIZED"; break;
1105 			 case RNDIS_INITIALIZED:
1106 				s = "RNDIS_INITIALIZED"; break;
1107 			 case RNDIS_DATA_INITIALIZED:
1108 				s = "RNDIS_DATA_INITIALIZED"; break;
1109 			} s; }),
1110 			 param->medium,
1111 			 (param->media_state) ? 0 : param->speed*100,
1112 			 (param->media_state) ? "disconnected" : "connected",
1113 			 param->vendorID, param->vendorDescr);
1114 	return 0;
1115 }
1116 
1117 static ssize_t rndis_proc_write(struct file *file, const char __user *buffer,
1118 				size_t count, loff_t *ppos)
1119 {
1120 	rndis_params *p = PDE_DATA(file_inode(file));
1121 	u32 speed = 0;
1122 	int i, fl_speed = 0;
1123 
1124 	for (i = 0; i < count; i++) {
1125 		char c;
1126 		if (get_user(c, buffer))
1127 			return -EFAULT;
1128 		switch (c) {
1129 		case '0':
1130 		case '1':
1131 		case '2':
1132 		case '3':
1133 		case '4':
1134 		case '5':
1135 		case '6':
1136 		case '7':
1137 		case '8':
1138 		case '9':
1139 			fl_speed = 1;
1140 			speed = speed * 10 + c - '0';
1141 			break;
1142 		case 'C':
1143 		case 'c':
1144 			rndis_signal_connect(p);
1145 			break;
1146 		case 'D':
1147 		case 'd':
1148 			rndis_signal_disconnect(p);
1149 			break;
1150 		default:
1151 			if (fl_speed) p->speed = speed;
1152 			else pr_debug("%c is not valid\n", c);
1153 			break;
1154 		}
1155 
1156 		buffer++;
1157 	}
1158 
1159 	return count;
1160 }
1161 
1162 static int rndis_proc_open(struct inode *inode, struct file *file)
1163 {
1164 	return single_open(file, rndis_proc_show, PDE_DATA(inode));
1165 }
1166 
1167 static const struct file_operations rndis_proc_fops = {
1168 	.owner		= THIS_MODULE,
1169 	.open		= rndis_proc_open,
1170 	.read		= seq_read,
1171 	.llseek		= seq_lseek,
1172 	.release	= single_release,
1173 	.write		= rndis_proc_write,
1174 };
1175 
1176 #define	NAME_TEMPLATE "driver/rndis-%03d"
1177 
1178 #endif /* CONFIG_USB_GADGET_DEBUG_FILES */
1179