qemu/hw/usb/dev-network.c
<<
>>
Prefs
   1/*
   2 * QEMU USB Net devices
   3 *
   4 * Copyright (c) 2006 Thomas Sailer
   5 * Copyright (c) 2008 Andrzej Zaborowski
   6 *
   7 * Permission is hereby granted, free of charge, to any person obtaining a copy
   8 * of this software and associated documentation files (the "Software"), to deal
   9 * in the Software without restriction, including without limitation the rights
  10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11 * copies of the Software, and to permit persons to whom the Software is
  12 * furnished to do so, subject to the following conditions:
  13 *
  14 * The above copyright notice and this permission notice shall be included in
  15 * all copies or substantial portions of the Software.
  16 *
  17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  23 * THE SOFTWARE.
  24 */
  25
  26#include "qemu/osdep.h"
  27#include "qapi/error.h"
  28#include "qemu-common.h"
  29#include "hw/usb.h"
  30#include "hw/usb/desc.h"
  31#include "net/net.h"
  32#include "qemu/error-report.h"
  33#include "qemu/queue.h"
  34#include "qemu/config-file.h"
  35#include "sysemu/sysemu.h"
  36#include "qemu/iov.h"
  37#include "qemu/cutils.h"
  38
  39/*#define TRAFFIC_DEBUG*/
  40/* Thanks to NetChip Technologies for donating this product ID.
  41 * It's for devices with only CDC Ethernet configurations.
  42 */
  43#define CDC_VENDOR_NUM          0x0525  /* NetChip */
  44#define CDC_PRODUCT_NUM         0xa4a1  /* Linux-USB Ethernet Gadget */
  45/* For hardware that can talk RNDIS and either of the above protocols,
  46 * use this ID ... the windows INF files will know it.
  47 */
  48#define RNDIS_VENDOR_NUM        0x0525  /* NetChip */
  49#define RNDIS_PRODUCT_NUM       0xa4a2  /* Ethernet/RNDIS Gadget */
  50
  51enum usbstring_idx {
  52    STRING_MANUFACTURER         = 1,
  53    STRING_PRODUCT,
  54    STRING_ETHADDR,
  55    STRING_DATA,
  56    STRING_CONTROL,
  57    STRING_RNDIS_CONTROL,
  58    STRING_CDC,
  59    STRING_SUBSET,
  60    STRING_RNDIS,
  61    STRING_SERIALNUMBER,
  62};
  63
  64#define DEV_CONFIG_VALUE                1       /* CDC or a subset */
  65#define DEV_RNDIS_CONFIG_VALUE          2       /* RNDIS; optional */
  66
  67#define USB_CDC_SUBCLASS_ACM            0x02
  68#define USB_CDC_SUBCLASS_ETHERNET       0x06
  69
  70#define USB_CDC_PROTO_NONE              0
  71#define USB_CDC_ACM_PROTO_VENDOR        0xff
  72
  73#define USB_CDC_HEADER_TYPE             0x00    /* header_desc */
  74#define USB_CDC_CALL_MANAGEMENT_TYPE    0x01    /* call_mgmt_descriptor */
  75#define USB_CDC_ACM_TYPE                0x02    /* acm_descriptor */
  76#define USB_CDC_UNION_TYPE              0x06    /* union_desc */
  77#define USB_CDC_ETHERNET_TYPE           0x0f    /* ether_desc */
  78
  79#define USB_CDC_SEND_ENCAPSULATED_COMMAND       0x00
  80#define USB_CDC_GET_ENCAPSULATED_RESPONSE       0x01
  81#define USB_CDC_REQ_SET_LINE_CODING             0x20
  82#define USB_CDC_REQ_GET_LINE_CODING             0x21
  83#define USB_CDC_REQ_SET_CONTROL_LINE_STATE      0x22
  84#define USB_CDC_REQ_SEND_BREAK                  0x23
  85#define USB_CDC_SET_ETHERNET_MULTICAST_FILTERS  0x40
  86#define USB_CDC_SET_ETHERNET_PM_PATTERN_FILTER  0x41
  87#define USB_CDC_GET_ETHERNET_PM_PATTERN_FILTER  0x42
  88#define USB_CDC_SET_ETHERNET_PACKET_FILTER      0x43
  89#define USB_CDC_GET_ETHERNET_STATISTIC          0x44
  90
  91#define LOG2_STATUS_INTERVAL_MSEC       5    /* 1 << 5 == 32 msec */
  92#define STATUS_BYTECOUNT                16   /* 8 byte header + data */
  93
  94#define ETH_FRAME_LEN                   1514 /* Max. octets in frame sans FCS */
  95
  96static const USBDescStrings usb_net_stringtable = {
  97    [STRING_MANUFACTURER]       = "QEMU",
  98    [STRING_PRODUCT]            = "RNDIS/QEMU USB Network Device",
  99    [STRING_ETHADDR]            = "400102030405",
 100    [STRING_DATA]               = "QEMU USB Net Data Interface",
 101    [STRING_CONTROL]            = "QEMU USB Net Control Interface",
 102    [STRING_RNDIS_CONTROL]      = "QEMU USB Net RNDIS Control Interface",
 103    [STRING_CDC]                = "QEMU USB Net CDC",
 104    [STRING_SUBSET]             = "QEMU USB Net Subset",
 105    [STRING_RNDIS]              = "QEMU USB Net RNDIS",
 106    [STRING_SERIALNUMBER]       = "1",
 107};
 108
 109static const USBDescIface desc_iface_rndis[] = {
 110    {
 111        /* RNDIS Control Interface */
 112        .bInterfaceNumber              = 0,
 113        .bNumEndpoints                 = 1,
 114        .bInterfaceClass               = USB_CLASS_COMM,
 115        .bInterfaceSubClass            = USB_CDC_SUBCLASS_ACM,
 116        .bInterfaceProtocol            = USB_CDC_ACM_PROTO_VENDOR,
 117        .iInterface                    = STRING_RNDIS_CONTROL,
 118        .ndesc                         = 4,
 119        .descs = (USBDescOther[]) {
 120            {
 121                /* Header Descriptor */
 122                .data = (uint8_t[]) {
 123                    0x05,                       /*  u8    bLength */
 124                    USB_DT_CS_INTERFACE,        /*  u8    bDescriptorType */
 125                    USB_CDC_HEADER_TYPE,        /*  u8    bDescriptorSubType */
 126                    0x10, 0x01,                 /*  le16  bcdCDC */
 127                },
 128            },{
 129                /* Call Management Descriptor */
 130                .data = (uint8_t[]) {
 131                    0x05,                       /*  u8    bLength */
 132                    USB_DT_CS_INTERFACE,        /*  u8    bDescriptorType */
 133                    USB_CDC_CALL_MANAGEMENT_TYPE, /*  u8    bDescriptorSubType */
 134                    0x00,                       /*  u8    bmCapabilities */
 135                    0x01,                       /*  u8    bDataInterface */
 136                },
 137            },{
 138                /* ACM Descriptor */
 139                .data = (uint8_t[]) {
 140                    0x04,                       /*  u8    bLength */
 141                    USB_DT_CS_INTERFACE,        /*  u8    bDescriptorType */
 142                    USB_CDC_ACM_TYPE,           /*  u8    bDescriptorSubType */
 143                    0x00,                       /*  u8    bmCapabilities */
 144                },
 145            },{
 146                /* Union Descriptor */
 147                .data = (uint8_t[]) {
 148                    0x05,                       /*  u8    bLength */
 149                    USB_DT_CS_INTERFACE,        /*  u8    bDescriptorType */
 150                    USB_CDC_UNION_TYPE,         /*  u8    bDescriptorSubType */
 151                    0x00,                       /*  u8    bMasterInterface0 */
 152                    0x01,                       /*  u8    bSlaveInterface0 */
 153                },
 154            },
 155        },
 156        .eps = (USBDescEndpoint[]) {
 157            {
 158                .bEndpointAddress      = USB_DIR_IN | 0x01,
 159                .bmAttributes          = USB_ENDPOINT_XFER_INT,
 160                .wMaxPacketSize        = STATUS_BYTECOUNT,
 161                .bInterval             = 1 << LOG2_STATUS_INTERVAL_MSEC,
 162            },
 163        }
 164    },{
 165        /* RNDIS Data Interface */
 166        .bInterfaceNumber              = 1,
 167        .bNumEndpoints                 = 2,
 168        .bInterfaceClass               = USB_CLASS_CDC_DATA,
 169        .iInterface                    = STRING_DATA,
 170        .eps = (USBDescEndpoint[]) {
 171            {
 172                .bEndpointAddress      = USB_DIR_IN | 0x02,
 173                .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 174                .wMaxPacketSize        = 0x40,
 175            },{
 176                .bEndpointAddress      = USB_DIR_OUT | 0x02,
 177                .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 178                .wMaxPacketSize        = 0x40,
 179            }
 180        }
 181    }
 182};
 183
 184static const USBDescIface desc_iface_cdc[] = {
 185    {
 186        /* CDC Control Interface */
 187        .bInterfaceNumber              = 0,
 188        .bNumEndpoints                 = 1,
 189        .bInterfaceClass               = USB_CLASS_COMM,
 190        .bInterfaceSubClass            = USB_CDC_SUBCLASS_ETHERNET,
 191        .bInterfaceProtocol            = USB_CDC_PROTO_NONE,
 192        .iInterface                    = STRING_CONTROL,
 193        .ndesc                         = 3,
 194        .descs = (USBDescOther[]) {
 195            {
 196                /* Header Descriptor */
 197                .data = (uint8_t[]) {
 198                    0x05,                       /*  u8    bLength */
 199                    USB_DT_CS_INTERFACE,        /*  u8    bDescriptorType */
 200                    USB_CDC_HEADER_TYPE,        /*  u8    bDescriptorSubType */
 201                    0x10, 0x01,                 /*  le16  bcdCDC */
 202                },
 203            },{
 204                /* Union Descriptor */
 205                .data = (uint8_t[]) {
 206                    0x05,                       /*  u8    bLength */
 207                    USB_DT_CS_INTERFACE,        /*  u8    bDescriptorType */
 208                    USB_CDC_UNION_TYPE,         /*  u8    bDescriptorSubType */
 209                    0x00,                       /*  u8    bMasterInterface0 */
 210                    0x01,                       /*  u8    bSlaveInterface0 */
 211                },
 212            },{
 213                /* Ethernet Descriptor */
 214                .data = (uint8_t[]) {
 215                    0x0d,                       /*  u8    bLength */
 216                    USB_DT_CS_INTERFACE,        /*  u8    bDescriptorType */
 217                    USB_CDC_ETHERNET_TYPE,      /*  u8    bDescriptorSubType */
 218                    STRING_ETHADDR,             /*  u8    iMACAddress */
 219                    0x00, 0x00, 0x00, 0x00,     /*  le32  bmEthernetStatistics */
 220                    ETH_FRAME_LEN & 0xff,
 221                    ETH_FRAME_LEN >> 8,         /*  le16  wMaxSegmentSize */
 222                    0x00, 0x00,                 /*  le16  wNumberMCFilters */
 223                    0x00,                       /*  u8    bNumberPowerFilters */
 224                },
 225            },
 226        },
 227        .eps = (USBDescEndpoint[]) {
 228            {
 229                .bEndpointAddress      = USB_DIR_IN | 0x01,
 230                .bmAttributes          = USB_ENDPOINT_XFER_INT,
 231                .wMaxPacketSize        = STATUS_BYTECOUNT,
 232                .bInterval             = 1 << LOG2_STATUS_INTERVAL_MSEC,
 233            },
 234        }
 235    },{
 236        /* CDC Data Interface (off) */
 237        .bInterfaceNumber              = 1,
 238        .bAlternateSetting             = 0,
 239        .bNumEndpoints                 = 0,
 240        .bInterfaceClass               = USB_CLASS_CDC_DATA,
 241    },{
 242        /* CDC Data Interface */
 243        .bInterfaceNumber              = 1,
 244        .bAlternateSetting             = 1,
 245        .bNumEndpoints                 = 2,
 246        .bInterfaceClass               = USB_CLASS_CDC_DATA,
 247        .iInterface                    = STRING_DATA,
 248        .eps = (USBDescEndpoint[]) {
 249            {
 250                .bEndpointAddress      = USB_DIR_IN | 0x02,
 251                .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 252                .wMaxPacketSize        = 0x40,
 253            },{
 254                .bEndpointAddress      = USB_DIR_OUT | 0x02,
 255                .bmAttributes          = USB_ENDPOINT_XFER_BULK,
 256                .wMaxPacketSize        = 0x40,
 257            }
 258        }
 259    }
 260};
 261
 262static const USBDescDevice desc_device_net = {
 263    .bcdUSB                        = 0x0200,
 264    .bDeviceClass                  = USB_CLASS_COMM,
 265    .bMaxPacketSize0               = 0x40,
 266    .bNumConfigurations            = 2,
 267    .confs = (USBDescConfig[]) {
 268        {
 269            .bNumInterfaces        = 2,
 270            .bConfigurationValue   = DEV_RNDIS_CONFIG_VALUE,
 271            .iConfiguration        = STRING_RNDIS,
 272            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
 273            .bMaxPower             = 0x32,
 274            .nif = ARRAY_SIZE(desc_iface_rndis),
 275            .ifs = desc_iface_rndis,
 276        },{
 277            .bNumInterfaces        = 2,
 278            .bConfigurationValue   = DEV_CONFIG_VALUE,
 279            .iConfiguration        = STRING_CDC,
 280            .bmAttributes          = USB_CFG_ATT_ONE | USB_CFG_ATT_SELFPOWER,
 281            .bMaxPower             = 0x32,
 282            .nif = ARRAY_SIZE(desc_iface_cdc),
 283            .ifs = desc_iface_cdc,
 284        }
 285    },
 286};
 287
 288static const USBDesc desc_net = {
 289    .id = {
 290        .idVendor          = RNDIS_VENDOR_NUM,
 291        .idProduct         = RNDIS_PRODUCT_NUM,
 292        .bcdDevice         = 0,
 293        .iManufacturer     = STRING_MANUFACTURER,
 294        .iProduct          = STRING_PRODUCT,
 295        .iSerialNumber     = STRING_SERIALNUMBER,
 296    },
 297    .full = &desc_device_net,
 298    .str  = usb_net_stringtable,
 299};
 300
 301/*
 302 * RNDIS Definitions - in theory not specific to USB.
 303 */
 304#define RNDIS_MAXIMUM_FRAME_SIZE        1518
 305#define RNDIS_MAX_TOTAL_SIZE            1558
 306
 307/* Remote NDIS Versions */
 308#define RNDIS_MAJOR_VERSION             1
 309#define RNDIS_MINOR_VERSION             0
 310
 311/* Status Values */
 312#define RNDIS_STATUS_SUCCESS            0x00000000U /* Success */
 313#define RNDIS_STATUS_FAILURE            0xc0000001U /* Unspecified error */
 314#define RNDIS_STATUS_INVALID_DATA       0xc0010015U /* Invalid data */
 315#define RNDIS_STATUS_NOT_SUPPORTED      0xc00000bbU /* Unsupported request */
 316#define RNDIS_STATUS_MEDIA_CONNECT      0x4001000bU /* Device connected */
 317#define RNDIS_STATUS_MEDIA_DISCONNECT   0x4001000cU /* Device disconnected */
 318
 319/* Message Set for Connectionless (802.3) Devices */
 320enum {
 321    RNDIS_PACKET_MSG            = 1,
 322    RNDIS_INITIALIZE_MSG        = 2,    /* Initialize device */
 323    RNDIS_HALT_MSG              = 3,
 324    RNDIS_QUERY_MSG             = 4,
 325    RNDIS_SET_MSG               = 5,
 326    RNDIS_RESET_MSG             = 6,
 327    RNDIS_INDICATE_STATUS_MSG   = 7,
 328    RNDIS_KEEPALIVE_MSG         = 8,
 329};
 330
 331/* Message completion */
 332enum {
 333    RNDIS_INITIALIZE_CMPLT      = 0x80000002U,
 334    RNDIS_QUERY_CMPLT           = 0x80000004U,
 335    RNDIS_SET_CMPLT             = 0x80000005U,
 336    RNDIS_RESET_CMPLT           = 0x80000006U,
 337    RNDIS_KEEPALIVE_CMPLT       = 0x80000008U,
 338};
 339
 340/* Device Flags */
 341enum {
 342    RNDIS_DF_CONNECTIONLESS     = 1,
 343    RNDIS_DF_CONNECTIONORIENTED = 2,
 344};
 345
 346#define RNDIS_MEDIUM_802_3              0x00000000U
 347
 348/* from drivers/net/sk98lin/h/skgepnmi.h */
 349#define OID_PNP_CAPABILITIES            0xfd010100
 350#define OID_PNP_SET_POWER               0xfd010101
 351#define OID_PNP_QUERY_POWER             0xfd010102
 352#define OID_PNP_ADD_WAKE_UP_PATTERN     0xfd010103
 353#define OID_PNP_REMOVE_WAKE_UP_PATTERN  0xfd010104
 354#define OID_PNP_ENABLE_WAKE_UP          0xfd010106
 355
 356typedef uint32_t le32;
 357
 358typedef struct rndis_init_msg_type {
 359    le32 MessageType;
 360    le32 MessageLength;
 361    le32 RequestID;
 362    le32 MajorVersion;
 363    le32 MinorVersion;
 364    le32 MaxTransferSize;
 365} rndis_init_msg_type;
 366
 367typedef struct rndis_init_cmplt_type {
 368    le32 MessageType;
 369    le32 MessageLength;
 370    le32 RequestID;
 371    le32 Status;
 372    le32 MajorVersion;
 373    le32 MinorVersion;
 374    le32 DeviceFlags;
 375    le32 Medium;
 376    le32 MaxPacketsPerTransfer;
 377    le32 MaxTransferSize;
 378    le32 PacketAlignmentFactor;
 379    le32 AFListOffset;
 380    le32 AFListSize;
 381} rndis_init_cmplt_type;
 382
 383typedef struct rndis_halt_msg_type {
 384    le32 MessageType;
 385    le32 MessageLength;
 386    le32 RequestID;
 387} rndis_halt_msg_type;
 388
 389typedef struct rndis_query_msg_type {
 390    le32 MessageType;
 391    le32 MessageLength;
 392    le32 RequestID;
 393    le32 OID;
 394    le32 InformationBufferLength;
 395    le32 InformationBufferOffset;
 396    le32 DeviceVcHandle;
 397} rndis_query_msg_type;
 398
 399typedef struct rndis_query_cmplt_type {
 400    le32 MessageType;
 401    le32 MessageLength;
 402    le32 RequestID;
 403    le32 Status;
 404    le32 InformationBufferLength;
 405    le32 InformationBufferOffset;
 406} rndis_query_cmplt_type;
 407
 408typedef struct rndis_set_msg_type {
 409    le32 MessageType;
 410    le32 MessageLength;
 411    le32 RequestID;
 412    le32 OID;
 413    le32 InformationBufferLength;
 414    le32 InformationBufferOffset;
 415    le32 DeviceVcHandle;
 416} rndis_set_msg_type;
 417
 418typedef struct rndis_set_cmplt_type {
 419    le32 MessageType;
 420    le32 MessageLength;
 421    le32 RequestID;
 422    le32 Status;
 423} rndis_set_cmplt_type;
 424
 425typedef struct rndis_reset_msg_type {
 426    le32 MessageType;
 427    le32 MessageLength;
 428    le32 Reserved;
 429} rndis_reset_msg_type;
 430
 431typedef struct rndis_reset_cmplt_type {
 432    le32 MessageType;
 433    le32 MessageLength;
 434    le32 Status;
 435    le32 AddressingReset;
 436} rndis_reset_cmplt_type;
 437
 438typedef struct rndis_indicate_status_msg_type {
 439    le32 MessageType;
 440    le32 MessageLength;
 441    le32 Status;
 442    le32 StatusBufferLength;
 443    le32 StatusBufferOffset;
 444} rndis_indicate_status_msg_type;
 445
 446typedef struct rndis_keepalive_msg_type {
 447    le32 MessageType;
 448    le32 MessageLength;
 449    le32 RequestID;
 450} rndis_keepalive_msg_type;
 451
 452typedef struct rndis_keepalive_cmplt_type {
 453    le32 MessageType;
 454    le32 MessageLength;
 455    le32 RequestID;
 456    le32 Status;
 457} rndis_keepalive_cmplt_type;
 458
 459struct rndis_packet_msg_type {
 460    le32 MessageType;
 461    le32 MessageLength;
 462    le32 DataOffset;
 463    le32 DataLength;
 464    le32 OOBDataOffset;
 465    le32 OOBDataLength;
 466    le32 NumOOBDataElements;
 467    le32 PerPacketInfoOffset;
 468    le32 PerPacketInfoLength;
 469    le32 VcHandle;
 470    le32 Reserved;
 471};
 472
 473struct rndis_config_parameter {
 474    le32 ParameterNameOffset;
 475    le32 ParameterNameLength;
 476    le32 ParameterType;
 477    le32 ParameterValueOffset;
 478    le32 ParameterValueLength;
 479};
 480
 481/* implementation specific */
 482enum rndis_state
 483{
 484    RNDIS_UNINITIALIZED,
 485    RNDIS_INITIALIZED,
 486    RNDIS_DATA_INITIALIZED,
 487};
 488
 489/* from ndis.h */
 490enum ndis_oid {
 491    /* Required Object IDs (OIDs) */
 492    OID_GEN_SUPPORTED_LIST              = 0x00010101,
 493    OID_GEN_HARDWARE_STATUS             = 0x00010102,
 494    OID_GEN_MEDIA_SUPPORTED             = 0x00010103,
 495    OID_GEN_MEDIA_IN_USE                = 0x00010104,
 496    OID_GEN_MAXIMUM_LOOKAHEAD           = 0x00010105,
 497    OID_GEN_MAXIMUM_FRAME_SIZE          = 0x00010106,
 498    OID_GEN_LINK_SPEED                  = 0x00010107,
 499    OID_GEN_TRANSMIT_BUFFER_SPACE       = 0x00010108,
 500    OID_GEN_RECEIVE_BUFFER_SPACE        = 0x00010109,
 501    OID_GEN_TRANSMIT_BLOCK_SIZE         = 0x0001010a,
 502    OID_GEN_RECEIVE_BLOCK_SIZE          = 0x0001010b,
 503    OID_GEN_VENDOR_ID                   = 0x0001010c,
 504    OID_GEN_VENDOR_DESCRIPTION          = 0x0001010d,
 505    OID_GEN_CURRENT_PACKET_FILTER       = 0x0001010e,
 506    OID_GEN_CURRENT_LOOKAHEAD           = 0x0001010f,
 507    OID_GEN_DRIVER_VERSION              = 0x00010110,
 508    OID_GEN_MAXIMUM_TOTAL_SIZE          = 0x00010111,
 509    OID_GEN_PROTOCOL_OPTIONS            = 0x00010112,
 510    OID_GEN_MAC_OPTIONS                 = 0x00010113,
 511    OID_GEN_MEDIA_CONNECT_STATUS        = 0x00010114,
 512    OID_GEN_MAXIMUM_SEND_PACKETS        = 0x00010115,
 513    OID_GEN_VENDOR_DRIVER_VERSION       = 0x00010116,
 514    OID_GEN_SUPPORTED_GUIDS             = 0x00010117,
 515    OID_GEN_NETWORK_LAYER_ADDRESSES     = 0x00010118,
 516    OID_GEN_TRANSPORT_HEADER_OFFSET     = 0x00010119,
 517    OID_GEN_MACHINE_NAME                = 0x0001021a,
 518    OID_GEN_RNDIS_CONFIG_PARAMETER      = 0x0001021b,
 519    OID_GEN_VLAN_ID                     = 0x0001021c,
 520
 521    /* Optional OIDs */
 522    OID_GEN_MEDIA_CAPABILITIES          = 0x00010201,
 523    OID_GEN_PHYSICAL_MEDIUM             = 0x00010202,
 524
 525    /* Required statistics OIDs */
 526    OID_GEN_XMIT_OK                     = 0x00020101,
 527    OID_GEN_RCV_OK                      = 0x00020102,
 528    OID_GEN_XMIT_ERROR                  = 0x00020103,
 529    OID_GEN_RCV_ERROR                   = 0x00020104,
 530    OID_GEN_RCV_NO_BUFFER               = 0x00020105,
 531
 532    /* Optional statistics OIDs */
 533    OID_GEN_DIRECTED_BYTES_XMIT         = 0x00020201,
 534    OID_GEN_DIRECTED_FRAMES_XMIT        = 0x00020202,
 535    OID_GEN_MULTICAST_BYTES_XMIT        = 0x00020203,
 536    OID_GEN_MULTICAST_FRAMES_XMIT       = 0x00020204,
 537    OID_GEN_BROADCAST_BYTES_XMIT        = 0x00020205,
 538    OID_GEN_BROADCAST_FRAMES_XMIT       = 0x00020206,
 539    OID_GEN_DIRECTED_BYTES_RCV          = 0x00020207,
 540    OID_GEN_DIRECTED_FRAMES_RCV         = 0x00020208,
 541    OID_GEN_MULTICAST_BYTES_RCV         = 0x00020209,
 542    OID_GEN_MULTICAST_FRAMES_RCV        = 0x0002020a,
 543    OID_GEN_BROADCAST_BYTES_RCV         = 0x0002020b,
 544    OID_GEN_BROADCAST_FRAMES_RCV        = 0x0002020c,
 545    OID_GEN_RCV_CRC_ERROR               = 0x0002020d,
 546    OID_GEN_TRANSMIT_QUEUE_LENGTH       = 0x0002020e,
 547    OID_GEN_GET_TIME_CAPS               = 0x0002020f,
 548    OID_GEN_GET_NETCARD_TIME            = 0x00020210,
 549    OID_GEN_NETCARD_LOAD                = 0x00020211,
 550    OID_GEN_DEVICE_PROFILE              = 0x00020212,
 551    OID_GEN_INIT_TIME_MS                = 0x00020213,
 552    OID_GEN_RESET_COUNTS                = 0x00020214,
 553    OID_GEN_MEDIA_SENSE_COUNTS          = 0x00020215,
 554    OID_GEN_FRIENDLY_NAME               = 0x00020216,
 555    OID_GEN_MINIPORT_INFO               = 0x00020217,
 556    OID_GEN_RESET_VERIFY_PARAMETERS     = 0x00020218,
 557
 558    /* IEEE 802.3 (Ethernet) OIDs */
 559    OID_802_3_PERMANENT_ADDRESS         = 0x01010101,
 560    OID_802_3_CURRENT_ADDRESS           = 0x01010102,
 561    OID_802_3_MULTICAST_LIST            = 0x01010103,
 562    OID_802_3_MAXIMUM_LIST_SIZE         = 0x01010104,
 563    OID_802_3_MAC_OPTIONS               = 0x01010105,
 564    OID_802_3_RCV_ERROR_ALIGNMENT       = 0x01020101,
 565    OID_802_3_XMIT_ONE_COLLISION        = 0x01020102,
 566    OID_802_3_XMIT_MORE_COLLISIONS      = 0x01020103,
 567    OID_802_3_XMIT_DEFERRED             = 0x01020201,
 568    OID_802_3_XMIT_MAX_COLLISIONS       = 0x01020202,
 569    OID_802_3_RCV_OVERRUN               = 0x01020203,
 570    OID_802_3_XMIT_UNDERRUN             = 0x01020204,
 571    OID_802_3_XMIT_HEARTBEAT_FAILURE    = 0x01020205,
 572    OID_802_3_XMIT_TIMES_CRS_LOST       = 0x01020206,
 573    OID_802_3_XMIT_LATE_COLLISIONS      = 0x01020207,
 574};
 575
 576static const uint32_t oid_supported_list[] =
 577{
 578    /* the general stuff */
 579    OID_GEN_SUPPORTED_LIST,
 580    OID_GEN_HARDWARE_STATUS,
 581    OID_GEN_MEDIA_SUPPORTED,
 582    OID_GEN_MEDIA_IN_USE,
 583    OID_GEN_MAXIMUM_FRAME_SIZE,
 584    OID_GEN_LINK_SPEED,
 585    OID_GEN_TRANSMIT_BLOCK_SIZE,
 586    OID_GEN_RECEIVE_BLOCK_SIZE,
 587    OID_GEN_VENDOR_ID,
 588    OID_GEN_VENDOR_DESCRIPTION,
 589    OID_GEN_VENDOR_DRIVER_VERSION,
 590    OID_GEN_CURRENT_PACKET_FILTER,
 591    OID_GEN_MAXIMUM_TOTAL_SIZE,
 592    OID_GEN_MEDIA_CONNECT_STATUS,
 593    OID_GEN_PHYSICAL_MEDIUM,
 594
 595    /* the statistical stuff */
 596    OID_GEN_XMIT_OK,
 597    OID_GEN_RCV_OK,
 598    OID_GEN_XMIT_ERROR,
 599    OID_GEN_RCV_ERROR,
 600    OID_GEN_RCV_NO_BUFFER,
 601
 602    /* IEEE 802.3 */
 603    /* the general stuff */
 604    OID_802_3_PERMANENT_ADDRESS,
 605    OID_802_3_CURRENT_ADDRESS,
 606    OID_802_3_MULTICAST_LIST,
 607    OID_802_3_MAC_OPTIONS,
 608    OID_802_3_MAXIMUM_LIST_SIZE,
 609
 610    /* the statistical stuff */
 611    OID_802_3_RCV_ERROR_ALIGNMENT,
 612    OID_802_3_XMIT_ONE_COLLISION,
 613    OID_802_3_XMIT_MORE_COLLISIONS,
 614};
 615
 616#define NDIS_MAC_OPTION_COPY_LOOKAHEAD_DATA     (1 << 0)
 617#define NDIS_MAC_OPTION_RECEIVE_SERIALIZED      (1 << 1)
 618#define NDIS_MAC_OPTION_TRANSFERS_NOT_PEND      (1 << 2)
 619#define NDIS_MAC_OPTION_NO_LOOPBACK             (1 << 3)
 620#define NDIS_MAC_OPTION_FULL_DUPLEX             (1 << 4)
 621#define NDIS_MAC_OPTION_EOTX_INDICATION         (1 << 5)
 622#define NDIS_MAC_OPTION_8021P_PRIORITY          (1 << 6)
 623
 624struct rndis_response {
 625    QTAILQ_ENTRY(rndis_response) entries;
 626    uint32_t length;
 627    uint8_t buf[0];
 628};
 629
 630typedef struct USBNetState {
 631    USBDevice dev;
 632
 633    enum rndis_state rndis_state;
 634    uint32_t medium;
 635    uint32_t speed;
 636    uint32_t media_state;
 637    uint16_t filter;
 638    uint32_t vendorid;
 639
 640    unsigned int out_ptr;
 641    uint8_t out_buf[2048];
 642
 643    unsigned int in_ptr, in_len;
 644    uint8_t in_buf[2048];
 645
 646    USBEndpoint *intr;
 647
 648    char usbstring_mac[13];
 649    NICState *nic;
 650    NICConf conf;
 651    QTAILQ_HEAD(rndis_resp_head, rndis_response) rndis_resp;
 652} USBNetState;
 653
 654#define TYPE_USB_NET "usb-net"
 655#define USB_NET(obj) OBJECT_CHECK(USBNetState, (obj), TYPE_USB_NET)
 656
 657static int is_rndis(USBNetState *s)
 658{
 659    return s->dev.config ?
 660            s->dev.config->bConfigurationValue == DEV_RNDIS_CONFIG_VALUE : 0;
 661}
 662
 663static int ndis_query(USBNetState *s, uint32_t oid,
 664                      uint8_t *inbuf, unsigned int inlen, uint8_t *outbuf,
 665                      size_t outlen)
 666{
 667    unsigned int i;
 668
 669    switch (oid) {
 670    /* general oids (table 4-1) */
 671    /* mandatory */
 672    case OID_GEN_SUPPORTED_LIST:
 673        for (i = 0; i < ARRAY_SIZE(oid_supported_list); i++)
 674            ((le32 *) outbuf)[i] = cpu_to_le32(oid_supported_list[i]);
 675        return sizeof(oid_supported_list);
 676
 677    /* mandatory */
 678    case OID_GEN_HARDWARE_STATUS:
 679        *((le32 *) outbuf) = cpu_to_le32(0);
 680        return sizeof(le32);
 681
 682    /* mandatory */
 683    case OID_GEN_MEDIA_SUPPORTED:
 684        *((le32 *) outbuf) = cpu_to_le32(s->medium);
 685        return sizeof(le32);
 686
 687    /* mandatory */
 688    case OID_GEN_MEDIA_IN_USE:
 689        *((le32 *) outbuf) = cpu_to_le32(s->medium);
 690        return sizeof(le32);
 691
 692    /* mandatory */
 693    case OID_GEN_MAXIMUM_FRAME_SIZE:
 694        *((le32 *) outbuf) = cpu_to_le32(ETH_FRAME_LEN);
 695        return sizeof(le32);
 696
 697    /* mandatory */
 698    case OID_GEN_LINK_SPEED:
 699        *((le32 *) outbuf) = cpu_to_le32(s->speed);
 700        return sizeof(le32);
 701
 702    /* mandatory */
 703    case OID_GEN_TRANSMIT_BLOCK_SIZE:
 704        *((le32 *) outbuf) = cpu_to_le32(ETH_FRAME_LEN);
 705        return sizeof(le32);
 706
 707    /* mandatory */
 708    case OID_GEN_RECEIVE_BLOCK_SIZE:
 709        *((le32 *) outbuf) = cpu_to_le32(ETH_FRAME_LEN);
 710        return sizeof(le32);
 711
 712    /* mandatory */
 713    case OID_GEN_VENDOR_ID:
 714        *((le32 *) outbuf) = cpu_to_le32(s->vendorid);
 715        return sizeof(le32);
 716
 717    /* mandatory */
 718    case OID_GEN_VENDOR_DESCRIPTION:
 719        pstrcpy((char *)outbuf, outlen, "QEMU USB RNDIS Net");
 720        return strlen((char *)outbuf) + 1;
 721
 722    case OID_GEN_VENDOR_DRIVER_VERSION:
 723        *((le32 *) outbuf) = cpu_to_le32(1);
 724        return sizeof(le32);
 725
 726    /* mandatory */
 727    case OID_GEN_CURRENT_PACKET_FILTER:
 728        *((le32 *) outbuf) = cpu_to_le32(s->filter);
 729        return sizeof(le32);
 730
 731    /* mandatory */
 732    case OID_GEN_MAXIMUM_TOTAL_SIZE:
 733        *((le32 *) outbuf) = cpu_to_le32(RNDIS_MAX_TOTAL_SIZE);
 734        return sizeof(le32);
 735
 736    /* mandatory */
 737    case OID_GEN_MEDIA_CONNECT_STATUS:
 738        *((le32 *) outbuf) = cpu_to_le32(s->media_state);
 739        return sizeof(le32);
 740
 741    case OID_GEN_PHYSICAL_MEDIUM:
 742        *((le32 *) outbuf) = cpu_to_le32(0);
 743        return sizeof(le32);
 744
 745    case OID_GEN_MAC_OPTIONS:
 746        *((le32 *) outbuf) = cpu_to_le32(
 747                        NDIS_MAC_OPTION_RECEIVE_SERIALIZED |
 748                        NDIS_MAC_OPTION_FULL_DUPLEX);
 749        return sizeof(le32);
 750
 751    /* statistics OIDs (table 4-2) */
 752    /* mandatory */
 753    case OID_GEN_XMIT_OK:
 754        *((le32 *) outbuf) = cpu_to_le32(0);
 755        return sizeof(le32);
 756
 757    /* mandatory */
 758    case OID_GEN_RCV_OK:
 759        *((le32 *) outbuf) = cpu_to_le32(0);
 760        return sizeof(le32);
 761
 762    /* mandatory */
 763    case OID_GEN_XMIT_ERROR:
 764        *((le32 *) outbuf) = cpu_to_le32(0);
 765        return sizeof(le32);
 766
 767    /* mandatory */
 768    case OID_GEN_RCV_ERROR:
 769        *((le32 *) outbuf) = cpu_to_le32(0);
 770        return sizeof(le32);
 771
 772    /* mandatory */
 773    case OID_GEN_RCV_NO_BUFFER:
 774        *((le32 *) outbuf) = cpu_to_le32(0);
 775        return sizeof(le32);
 776
 777    /* ieee802.3 OIDs (table 4-3) */
 778    /* mandatory */
 779    case OID_802_3_PERMANENT_ADDRESS:
 780        memcpy(outbuf, s->conf.macaddr.a, 6);
 781        return 6;
 782
 783    /* mandatory */
 784    case OID_802_3_CURRENT_ADDRESS:
 785        memcpy(outbuf, s->conf.macaddr.a, 6);
 786        return 6;
 787
 788    /* mandatory */
 789    case OID_802_3_MULTICAST_LIST:
 790        *((le32 *) outbuf) = cpu_to_le32(0xe0000000);
 791        return sizeof(le32);
 792
 793    /* mandatory */
 794    case OID_802_3_MAXIMUM_LIST_SIZE:
 795        *((le32 *) outbuf) = cpu_to_le32(1);
 796        return sizeof(le32);
 797
 798    case OID_802_3_MAC_OPTIONS:
 799        return 0;
 800
 801    /* ieee802.3 statistics OIDs (table 4-4) */
 802    /* mandatory */
 803    case OID_802_3_RCV_ERROR_ALIGNMENT:
 804        *((le32 *) outbuf) = cpu_to_le32(0);
 805        return sizeof(le32);
 806
 807    /* mandatory */
 808    case OID_802_3_XMIT_ONE_COLLISION:
 809        *((le32 *) outbuf) = cpu_to_le32(0);
 810        return sizeof(le32);
 811
 812    /* mandatory */
 813    case OID_802_3_XMIT_MORE_COLLISIONS:
 814        *((le32 *) outbuf) = cpu_to_le32(0);
 815        return sizeof(le32);
 816
 817    default:
 818        fprintf(stderr, "usbnet: unknown OID 0x%08x\n", oid);
 819        return 0;
 820    }
 821    return -1;
 822}
 823
 824static int ndis_set(USBNetState *s, uint32_t oid,
 825                uint8_t *inbuf, unsigned int inlen)
 826{
 827    switch (oid) {
 828    case OID_GEN_CURRENT_PACKET_FILTER:
 829        s->filter = le32_to_cpup((le32 *) inbuf);
 830        if (s->filter) {
 831            s->rndis_state = RNDIS_DATA_INITIALIZED;
 832        } else {
 833            s->rndis_state = RNDIS_INITIALIZED;
 834        }
 835        return 0;
 836
 837    case OID_802_3_MULTICAST_LIST:
 838        return 0;
 839    }
 840    return -1;
 841}
 842
 843static int rndis_get_response(USBNetState *s, uint8_t *buf)
 844{
 845    int ret = 0;
 846    struct rndis_response *r = s->rndis_resp.tqh_first;
 847
 848    if (!r)
 849        return ret;
 850
 851    QTAILQ_REMOVE(&s->rndis_resp, r, entries);
 852    ret = r->length;
 853    memcpy(buf, r->buf, r->length);
 854    g_free(r);
 855
 856    return ret;
 857}
 858
 859static void *rndis_queue_response(USBNetState *s, unsigned int length)
 860{
 861    struct rndis_response *r =
 862            g_malloc0(sizeof(struct rndis_response) + length);
 863
 864    if (QTAILQ_EMPTY(&s->rndis_resp)) {
 865        usb_wakeup(s->intr, 0);
 866    }
 867
 868    QTAILQ_INSERT_TAIL(&s->rndis_resp, r, entries);
 869    r->length = length;
 870
 871    return &r->buf[0];
 872}
 873
 874static void rndis_clear_responsequeue(USBNetState *s)
 875{
 876    struct rndis_response *r;
 877
 878    while ((r = s->rndis_resp.tqh_first)) {
 879        QTAILQ_REMOVE(&s->rndis_resp, r, entries);
 880        g_free(r);
 881    }
 882}
 883
 884static int rndis_init_response(USBNetState *s, rndis_init_msg_type *buf)
 885{
 886    rndis_init_cmplt_type *resp =
 887            rndis_queue_response(s, sizeof(rndis_init_cmplt_type));
 888
 889    if (!resp)
 890        return USB_RET_STALL;
 891
 892    resp->MessageType = cpu_to_le32(RNDIS_INITIALIZE_CMPLT);
 893    resp->MessageLength = cpu_to_le32(sizeof(rndis_init_cmplt_type));
 894    resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
 895    resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
 896    resp->MajorVersion = cpu_to_le32(RNDIS_MAJOR_VERSION);
 897    resp->MinorVersion = cpu_to_le32(RNDIS_MINOR_VERSION);
 898    resp->DeviceFlags = cpu_to_le32(RNDIS_DF_CONNECTIONLESS);
 899    resp->Medium = cpu_to_le32(RNDIS_MEDIUM_802_3);
 900    resp->MaxPacketsPerTransfer = cpu_to_le32(1);
 901    resp->MaxTransferSize = cpu_to_le32(ETH_FRAME_LEN +
 902                    sizeof(struct rndis_packet_msg_type) + 22);
 903    resp->PacketAlignmentFactor = cpu_to_le32(0);
 904    resp->AFListOffset = cpu_to_le32(0);
 905    resp->AFListSize = cpu_to_le32(0);
 906    return 0;
 907}
 908
 909static int rndis_query_response(USBNetState *s,
 910                rndis_query_msg_type *buf, unsigned int length)
 911{
 912    rndis_query_cmplt_type *resp;
 913    /* oid_supported_list is the largest data reply */
 914    uint8_t infobuf[sizeof(oid_supported_list)];
 915    uint32_t bufoffs, buflen;
 916    int infobuflen;
 917    unsigned int resplen;
 918
 919    bufoffs = le32_to_cpu(buf->InformationBufferOffset) + 8;
 920    buflen = le32_to_cpu(buf->InformationBufferLength);
 921    if (buflen > length || bufoffs >= length || bufoffs + buflen > length) {
 922        return USB_RET_STALL;
 923    }
 924
 925    infobuflen = ndis_query(s, le32_to_cpu(buf->OID),
 926                            bufoffs + (uint8_t *) buf, buflen, infobuf,
 927                            sizeof(infobuf));
 928    resplen = sizeof(rndis_query_cmplt_type) +
 929            ((infobuflen < 0) ? 0 : infobuflen);
 930    resp = rndis_queue_response(s, resplen);
 931    if (!resp)
 932        return USB_RET_STALL;
 933
 934    resp->MessageType = cpu_to_le32(RNDIS_QUERY_CMPLT);
 935    resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
 936    resp->MessageLength = cpu_to_le32(resplen);
 937
 938    if (infobuflen < 0) {
 939        /* OID not supported */
 940        resp->Status = cpu_to_le32(RNDIS_STATUS_NOT_SUPPORTED);
 941        resp->InformationBufferLength = cpu_to_le32(0);
 942        resp->InformationBufferOffset = cpu_to_le32(0);
 943        return 0;
 944    }
 945
 946    resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
 947    resp->InformationBufferOffset =
 948            cpu_to_le32(infobuflen ? sizeof(rndis_query_cmplt_type) - 8 : 0);
 949    resp->InformationBufferLength = cpu_to_le32(infobuflen);
 950    memcpy(resp + 1, infobuf, infobuflen);
 951
 952    return 0;
 953}
 954
 955static int rndis_set_response(USBNetState *s,
 956                rndis_set_msg_type *buf, unsigned int length)
 957{
 958    rndis_set_cmplt_type *resp =
 959            rndis_queue_response(s, sizeof(rndis_set_cmplt_type));
 960    uint32_t bufoffs, buflen;
 961    int ret;
 962
 963    if (!resp)
 964        return USB_RET_STALL;
 965
 966    bufoffs = le32_to_cpu(buf->InformationBufferOffset) + 8;
 967    buflen = le32_to_cpu(buf->InformationBufferLength);
 968    if (buflen > length || bufoffs >= length || bufoffs + buflen > length) {
 969        return USB_RET_STALL;
 970    }
 971
 972    ret = ndis_set(s, le32_to_cpu(buf->OID),
 973                    bufoffs + (uint8_t *) buf, buflen);
 974    resp->MessageType = cpu_to_le32(RNDIS_SET_CMPLT);
 975    resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
 976    resp->MessageLength = cpu_to_le32(sizeof(rndis_set_cmplt_type));
 977    if (ret < 0) {
 978        /* OID not supported */
 979        resp->Status = cpu_to_le32(RNDIS_STATUS_NOT_SUPPORTED);
 980        return 0;
 981    }
 982    resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
 983
 984    return 0;
 985}
 986
 987static int rndis_reset_response(USBNetState *s, rndis_reset_msg_type *buf)
 988{
 989    rndis_reset_cmplt_type *resp =
 990            rndis_queue_response(s, sizeof(rndis_reset_cmplt_type));
 991
 992    if (!resp)
 993        return USB_RET_STALL;
 994
 995    resp->MessageType = cpu_to_le32(RNDIS_RESET_CMPLT);
 996    resp->MessageLength = cpu_to_le32(sizeof(rndis_reset_cmplt_type));
 997    resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
 998    resp->AddressingReset = cpu_to_le32(1); /* reset information */
 999
1000    return 0;
1001}
1002
1003static int rndis_keepalive_response(USBNetState *s,
1004                rndis_keepalive_msg_type *buf)
1005{
1006    rndis_keepalive_cmplt_type *resp =
1007            rndis_queue_response(s, sizeof(rndis_keepalive_cmplt_type));
1008
1009    if (!resp)
1010        return USB_RET_STALL;
1011
1012    resp->MessageType = cpu_to_le32(RNDIS_KEEPALIVE_CMPLT);
1013    resp->MessageLength = cpu_to_le32(sizeof(rndis_keepalive_cmplt_type));
1014    resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
1015    resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
1016
1017    return 0;
1018}
1019
1020/* Prepare to receive the next packet */
1021static void usb_net_reset_in_buf(USBNetState *s)
1022{
1023    s->in_ptr = s->in_len = 0;
1024    qemu_flush_queued_packets(qemu_get_queue(s->nic));
1025}
1026
1027static int rndis_parse(USBNetState *s, uint8_t *data, int length)
1028{
1029    uint32_t msg_type;
1030    le32 *tmp = (le32 *) data;
1031
1032    msg_type = le32_to_cpup(tmp);
1033
1034    switch (msg_type) {
1035    case RNDIS_INITIALIZE_MSG:
1036        s->rndis_state = RNDIS_INITIALIZED;
1037        return rndis_init_response(s, (rndis_init_msg_type *) data);
1038
1039    case RNDIS_HALT_MSG:
1040        s->rndis_state = RNDIS_UNINITIALIZED;
1041        return 0;
1042
1043    case RNDIS_QUERY_MSG:
1044        return rndis_query_response(s, (rndis_query_msg_type *) data, length);
1045
1046    case RNDIS_SET_MSG:
1047        return rndis_set_response(s, (rndis_set_msg_type *) data, length);
1048
1049    case RNDIS_RESET_MSG:
1050        rndis_clear_responsequeue(s);
1051        s->out_ptr = 0;
1052        usb_net_reset_in_buf(s);
1053        return rndis_reset_response(s, (rndis_reset_msg_type *) data);
1054
1055    case RNDIS_KEEPALIVE_MSG:
1056        /* For USB: host does this every 5 seconds */
1057        return rndis_keepalive_response(s, (rndis_keepalive_msg_type *) data);
1058    }
1059
1060    return USB_RET_STALL;
1061}
1062
1063static void usb_net_handle_reset(USBDevice *dev)
1064{
1065}
1066
1067static void usb_net_handle_control(USBDevice *dev, USBPacket *p,
1068               int request, int value, int index, int length, uint8_t *data)
1069{
1070    USBNetState *s = (USBNetState *) dev;
1071    int ret;
1072
1073    ret = usb_desc_handle_control(dev, p, request, value, index, length, data);
1074    if (ret >= 0) {
1075        return;
1076    }
1077
1078    switch(request) {
1079    case ClassInterfaceOutRequest | USB_CDC_SEND_ENCAPSULATED_COMMAND:
1080        if (!is_rndis(s) || value || index != 0) {
1081            goto fail;
1082        }
1083#ifdef TRAFFIC_DEBUG
1084        {
1085            unsigned int i;
1086            fprintf(stderr, "SEND_ENCAPSULATED_COMMAND:");
1087            for (i = 0; i < length; i++) {
1088                if (!(i & 15))
1089                    fprintf(stderr, "\n%04x:", i);
1090                fprintf(stderr, " %02x", data[i]);
1091            }
1092            fprintf(stderr, "\n\n");
1093        }
1094#endif
1095        ret = rndis_parse(s, data, length);
1096        if (ret < 0) {
1097            p->status = ret;
1098        }
1099        break;
1100
1101    case ClassInterfaceRequest | USB_CDC_GET_ENCAPSULATED_RESPONSE:
1102        if (!is_rndis(s) || value || index != 0) {
1103            goto fail;
1104        }
1105        p->actual_length = rndis_get_response(s, data);
1106        if (p->actual_length == 0) {
1107            data[0] = 0;
1108            p->actual_length = 1;
1109        }
1110#ifdef TRAFFIC_DEBUG
1111        {
1112            unsigned int i;
1113            fprintf(stderr, "GET_ENCAPSULATED_RESPONSE:");
1114            for (i = 0; i < p->actual_length; i++) {
1115                if (!(i & 15))
1116                    fprintf(stderr, "\n%04x:", i);
1117                fprintf(stderr, " %02x", data[i]);
1118            }
1119            fprintf(stderr, "\n\n");
1120        }
1121#endif
1122        break;
1123
1124    default:
1125    fail:
1126        fprintf(stderr, "usbnet: failed control transaction: "
1127                        "request 0x%x value 0x%x index 0x%x length 0x%x\n",
1128                        request, value, index, length);
1129        p->status = USB_RET_STALL;
1130        break;
1131    }
1132}
1133
1134static void usb_net_handle_statusin(USBNetState *s, USBPacket *p)
1135{
1136    le32 buf[2];
1137
1138    if (p->iov.size < 8) {
1139        p->status = USB_RET_STALL;
1140        return;
1141    }
1142
1143    buf[0] = cpu_to_le32(1);
1144    buf[1] = cpu_to_le32(0);
1145    usb_packet_copy(p, buf, 8);
1146    if (!s->rndis_resp.tqh_first) {
1147        p->status = USB_RET_NAK;
1148    }
1149
1150#ifdef TRAFFIC_DEBUG
1151    fprintf(stderr, "usbnet: interrupt poll len %zu return %d",
1152            p->iov.size, p->status);
1153    iov_hexdump(p->iov.iov, p->iov.niov, stderr, "usbnet", p->status);
1154#endif
1155}
1156
1157static void usb_net_handle_datain(USBNetState *s, USBPacket *p)
1158{
1159    int len;
1160
1161    if (s->in_ptr > s->in_len) {
1162        usb_net_reset_in_buf(s);
1163        p->status = USB_RET_NAK;
1164        return;
1165    }
1166    if (!s->in_len) {
1167        p->status = USB_RET_NAK;
1168        return;
1169    }
1170    len = s->in_len - s->in_ptr;
1171    if (len > p->iov.size) {
1172        len = p->iov.size;
1173    }
1174    usb_packet_copy(p, &s->in_buf[s->in_ptr], len);
1175    s->in_ptr += len;
1176    if (s->in_ptr >= s->in_len &&
1177                    (is_rndis(s) || (s->in_len & (64 - 1)) || !len)) {
1178        /* no short packet necessary */
1179        usb_net_reset_in_buf(s);
1180    }
1181
1182#ifdef TRAFFIC_DEBUG
1183    fprintf(stderr, "usbnet: data in len %zu return %d", p->iov.size, len);
1184    iov_hexdump(p->iov.iov, p->iov.niov, stderr, "usbnet", len);
1185#endif
1186}
1187
1188static void usb_net_handle_dataout(USBNetState *s, USBPacket *p)
1189{
1190    int sz = sizeof(s->out_buf) - s->out_ptr;
1191    struct rndis_packet_msg_type *msg =
1192            (struct rndis_packet_msg_type *) s->out_buf;
1193    uint32_t len;
1194
1195#ifdef TRAFFIC_DEBUG
1196    fprintf(stderr, "usbnet: data out len %zu\n", p->iov.size);
1197    iov_hexdump(p->iov.iov, p->iov.niov, stderr, "usbnet", p->iov.size);
1198#endif
1199
1200    if (sz > p->iov.size) {
1201        sz = p->iov.size;
1202    }
1203    usb_packet_copy(p, &s->out_buf[s->out_ptr], sz);
1204    s->out_ptr += sz;
1205
1206    if (!is_rndis(s)) {
1207        if (p->iov.size < 64) {
1208            qemu_send_packet(qemu_get_queue(s->nic), s->out_buf, s->out_ptr);
1209            s->out_ptr = 0;
1210        }
1211        return;
1212    }
1213    len = le32_to_cpu(msg->MessageLength);
1214    if (s->out_ptr < 8 || s->out_ptr < len) {
1215        return;
1216    }
1217    if (le32_to_cpu(msg->MessageType) == RNDIS_PACKET_MSG) {
1218        uint32_t offs = 8 + le32_to_cpu(msg->DataOffset);
1219        uint32_t size = le32_to_cpu(msg->DataLength);
1220        if (offs < len && size < len && offs + size <= len) {
1221            qemu_send_packet(qemu_get_queue(s->nic), s->out_buf + offs, size);
1222        }
1223    }
1224    s->out_ptr -= len;
1225    memmove(s->out_buf, &s->out_buf[len], s->out_ptr);
1226}
1227
1228static void usb_net_handle_data(USBDevice *dev, USBPacket *p)
1229{
1230    USBNetState *s = (USBNetState *) dev;
1231
1232    switch(p->pid) {
1233    case USB_TOKEN_IN:
1234        switch (p->ep->nr) {
1235        case 1:
1236            usb_net_handle_statusin(s, p);
1237            break;
1238
1239        case 2:
1240            usb_net_handle_datain(s, p);
1241            break;
1242
1243        default:
1244            goto fail;
1245        }
1246        break;
1247
1248    case USB_TOKEN_OUT:
1249        switch (p->ep->nr) {
1250        case 2:
1251            usb_net_handle_dataout(s, p);
1252            break;
1253
1254        default:
1255            goto fail;
1256        }
1257        break;
1258
1259    default:
1260    fail:
1261        p->status = USB_RET_STALL;
1262        break;
1263    }
1264
1265    if (p->status == USB_RET_STALL) {
1266        fprintf(stderr, "usbnet: failed data transaction: "
1267                        "pid 0x%x ep 0x%x len 0x%zx\n",
1268                        p->pid, p->ep->nr, p->iov.size);
1269    }
1270}
1271
1272static ssize_t usbnet_receive(NetClientState *nc, const uint8_t *buf, size_t size)
1273{
1274    USBNetState *s = qemu_get_nic_opaque(nc);
1275    uint8_t *in_buf = s->in_buf;
1276    size_t total_size = size;
1277
1278    if (!s->dev.config) {
1279        return -1;
1280    }
1281
1282    if (is_rndis(s)) {
1283        if (s->rndis_state != RNDIS_DATA_INITIALIZED) {
1284            return -1;
1285        }
1286        total_size += sizeof(struct rndis_packet_msg_type);
1287    }
1288    if (total_size > sizeof(s->in_buf)) {
1289        return -1;
1290    }
1291
1292    /* Only accept packet if input buffer is empty */
1293    if (s->in_len > 0) {
1294        return 0;
1295    }
1296
1297    if (is_rndis(s)) {
1298        struct rndis_packet_msg_type *msg;
1299
1300        msg = (struct rndis_packet_msg_type *)in_buf;
1301        memset(msg, 0, sizeof(struct rndis_packet_msg_type));
1302        msg->MessageType = cpu_to_le32(RNDIS_PACKET_MSG);
1303        msg->MessageLength = cpu_to_le32(size + sizeof(*msg));
1304        msg->DataOffset = cpu_to_le32(sizeof(*msg) - 8);
1305        msg->DataLength = cpu_to_le32(size);
1306        /* msg->OOBDataOffset;
1307         * msg->OOBDataLength;
1308         * msg->NumOOBDataElements;
1309         * msg->PerPacketInfoOffset;
1310         * msg->PerPacketInfoLength;
1311         * msg->VcHandle;
1312         * msg->Reserved;
1313         */
1314        in_buf += sizeof(*msg);
1315    }
1316
1317    memcpy(in_buf, buf, size);
1318    s->in_len = total_size;
1319    s->in_ptr = 0;
1320    return size;
1321}
1322
1323static void usbnet_cleanup(NetClientState *nc)
1324{
1325    USBNetState *s = qemu_get_nic_opaque(nc);
1326
1327    s->nic = NULL;
1328}
1329
1330static void usb_net_handle_destroy(USBDevice *dev)
1331{
1332    USBNetState *s = (USBNetState *) dev;
1333
1334    /* TODO: remove the nd_table[] entry */
1335    rndis_clear_responsequeue(s);
1336    qemu_del_nic(s->nic);
1337}
1338
1339static NetClientInfo net_usbnet_info = {
1340    .type = NET_CLIENT_OPTIONS_KIND_NIC,
1341    .size = sizeof(NICState),
1342    .receive = usbnet_receive,
1343    .cleanup = usbnet_cleanup,
1344};
1345
1346static void usb_net_realize(USBDevice *dev, Error **errrp)
1347{
1348    USBNetState *s = USB_NET(dev);
1349
1350    usb_desc_create_serial(dev);
1351    usb_desc_init(dev);
1352
1353    s->rndis_state = RNDIS_UNINITIALIZED;
1354    QTAILQ_INIT(&s->rndis_resp);
1355
1356    s->medium = 0;      /* NDIS_MEDIUM_802_3 */
1357    s->speed = 1000000; /* 100MBps, in 100Bps units */
1358    s->media_state = 0; /* NDIS_MEDIA_STATE_CONNECTED */;
1359    s->filter = 0;
1360    s->vendorid = 0x1234;
1361    s->intr = usb_ep_get(dev, USB_TOKEN_IN, 1);
1362
1363    qemu_macaddr_default_if_unset(&s->conf.macaddr);
1364    s->nic = qemu_new_nic(&net_usbnet_info, &s->conf,
1365                          object_get_typename(OBJECT(s)), s->dev.qdev.id, s);
1366    qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
1367    snprintf(s->usbstring_mac, sizeof(s->usbstring_mac),
1368             "%02x%02x%02x%02x%02x%02x",
1369             0x40,
1370             s->conf.macaddr.a[1],
1371             s->conf.macaddr.a[2],
1372             s->conf.macaddr.a[3],
1373             s->conf.macaddr.a[4],
1374             s->conf.macaddr.a[5]);
1375    usb_desc_set_string(dev, STRING_ETHADDR, s->usbstring_mac);
1376}
1377
1378static void usb_net_instance_init(Object *obj)
1379{
1380    USBDevice *dev = USB_DEVICE(obj);
1381    USBNetState *s = USB_NET(dev);
1382
1383    device_add_bootindex_property(obj, &s->conf.bootindex,
1384                                  "bootindex", "/ethernet-phy@0",
1385                                  &dev->qdev, NULL);
1386}
1387
1388static USBDevice *usb_net_init(USBBus *bus, const char *cmdline)
1389{
1390    Error *local_err = NULL;
1391    USBDevice *dev;
1392    QemuOpts *opts;
1393    int idx;
1394
1395    opts = qemu_opts_parse_noisily(qemu_find_opts("net"), cmdline, false);
1396    if (!opts) {
1397        return NULL;
1398    }
1399    qemu_opt_set(opts, "type", "nic", &error_abort);
1400    qemu_opt_set(opts, "model", "usb", &error_abort);
1401
1402    idx = net_client_init(opts, 0, &local_err);
1403    if (local_err) {
1404        error_report_err(local_err);
1405        return NULL;
1406    }
1407
1408    dev = usb_create(bus, "usb-net");
1409    qdev_set_nic_properties(&dev->qdev, &nd_table[idx]);
1410    return dev;
1411}
1412
1413static const VMStateDescription vmstate_usb_net = {
1414    .name = "usb-net",
1415    .unmigratable = 1,
1416};
1417
1418static Property net_properties[] = {
1419    DEFINE_NIC_PROPERTIES(USBNetState, conf),
1420    DEFINE_PROP_END_OF_LIST(),
1421};
1422
1423static void usb_net_class_initfn(ObjectClass *klass, void *data)
1424{
1425    DeviceClass *dc = DEVICE_CLASS(klass);
1426    USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
1427
1428    uc->realize        = usb_net_realize;
1429    uc->product_desc   = "QEMU USB Network Interface";
1430    uc->usb_desc       = &desc_net;
1431    uc->handle_reset   = usb_net_handle_reset;
1432    uc->handle_control = usb_net_handle_control;
1433    uc->handle_data    = usb_net_handle_data;
1434    uc->handle_destroy = usb_net_handle_destroy;
1435    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
1436    dc->fw_name = "network";
1437    dc->vmsd = &vmstate_usb_net;
1438    dc->props = net_properties;
1439}
1440
1441static const TypeInfo net_info = {
1442    .name          = TYPE_USB_NET,
1443    .parent        = TYPE_USB_DEVICE,
1444    .instance_size = sizeof(USBNetState),
1445    .class_init    = usb_net_class_initfn,
1446    .instance_init = usb_net_instance_init,
1447};
1448
1449static void usb_net_register_types(void)
1450{
1451    type_register_static(&net_info);
1452    usb_legacy_register(TYPE_USB_NET, "net", usb_net_init);
1453}
1454
1455type_init(usb_net_register_types)
1456