haiku.git

/*
	Driver for USB RNDIS Network devices
	Copyright (C) 2022 Adrien Destugues <pulkomandy@pulkomandy.tk>
	Distributed under the terms of the MIT license.
*/
#include <ether_driver.h>
#include <net/if_media.h>
#include <string.h>
#include <stdlib.h>

#include "RNDISDevice.h"
#include "Driver.h"


const uint32 OID_GEN_MAXIMUM_FRAME_SIZE = 0x00010106;
const uint32 OID_GEN_LINK_SPEED = 0x00010107;
const uint32 OID_GEN_CURRENT_PACKET_FILTER = 0x0001010E;
const uint32 OID_GEN_MEDIA_CONNECT_STATUS = 0x00010114;
const uint32 OID_802_3_PERMANENT_ADDRESS = 0x01010101;


enum RndisCommands {
	REMOTE_NDIS_PACKET_MSG = 1,
	REMOTE_NDIS_INITIALIZE_MSG = 2,
	REMOTE_NDIS_INITIALIZE_CMPLT = 0x80000002,
	REMOTE_NDIS_HALT_MSG = 3,
	REMOTE_NDIS_QUERY_MSG = 4,
	REMOTE_NDIS_QUERY_CMPLT = 0x80000004,
	REMOTE_NDIS_SET_MSG = 5,
	REMOTE_NDIS_SET_CMPLT = 0x80000005,
	REMOTE_NDIS_RESET_MSG = 6,
	REMOTE_NDIS_RESET_CMPLT = 0x80000006,
	REMOTE_NDIS_INDICATE_STATUS_MSG = 7,
	REMOTE_NDIS_KEEPALIVE_MSG = 8,
	REMOTE_NDIS_KEEPALIVE_CMPLT = 0x80000008
};


enum Status
{
	RNDIS_STATUS_SUCCESS = 0,
	RNDIS_STATUS_FAILURE = 0xC0000001,
	RNDIS_STATUS_INVALID_DATA = 0xC0010015,
	RNDIS_STATUS_NOT_SUPPORTED = 0xC00000BB,
	RNDIS_STATUS_MEDIA_CONNECT = 0x4001000B,
	RNDIS_STATUS_MEDIA_DISCONNECT = 0x4001000C,
};


enum MediaConnectStatus
{
	MEDIA_STATE_UNKNOWN,
	MEDIA_STATE_CONNECTED,
	MEDIA_STATE_DISCONNECTED
};


const uint32 NDIS_PACKET_TYPE_ALL_MULTICAST = 0x00000004;
const uint32 NDIS_PACKET_TYPE_BROADCAST = 0x00000008;



RNDISDevice::RNDISDevice(usb_device device)
	:	fStatus(B_ERROR),
		fOpen(false),
		fRemoved(false),
		fInsideNotify(0),
		fDevice(device),
		fDataInterfaceIndex(0),
		fMaxSegmentSize(0),
		fNotifyEndpoint(0),
		fReadEndpoint(0),
		fWriteEndpoint(0),
		fNotifyReadSem(-1),
		fNotifyWriteSem(-1),
		fLockWriteSem(-1),
		fNotifyControlSem(-1),
		fReadHeader(NULL),
		fLinkStateChangeSem(-1),
		fMediaConnectState(MEDIA_STATE_UNKNOWN),
		fDownstreamSpeed(0)
{
	const usb_device_descriptor *deviceDescriptor
		= gUSBModule->get_device_descriptor(device);

	if (deviceDescriptor == NULL) {
		TRACE_ALWAYS("failed to get device descriptor\n");
		return;
	}

	fVendorID = deviceDescriptor->vendor_id;
	fProductID = deviceDescriptor->product_id;

	fNotifyReadSem = create_sem(0, DRIVER_NAME"_notify_read");
	if (fNotifyReadSem < B_OK) {
		TRACE_ALWAYS("failed to create read notify sem\n");
		return;
	}

	fNotifyWriteSem = create_sem(0, DRIVER_NAME"_notify_write");
	if (fNotifyWriteSem < B_OK) {
		TRACE_ALWAYS("failed to create write notify sem\n");
		return;
	}

	fLockWriteSem = create_sem(1, DRIVER_NAME"_lock_write");
	if (fNotifyWriteSem < B_OK) {
		TRACE_ALWAYS("failed to create write lock sem\n");
		return;
	}

	fNotifyControlSem = create_sem(0, DRIVER_NAME"_notify_control");
	if (fNotifyControlSem < B_OK) {
		TRACE_ALWAYS("failed to create control notify sem\n");
		return;
	}

	if (_SetupDevice() != B_OK) {
		TRACE_ALWAYS("failed to setup device\n");
		return;
	}

	fStatus = B_OK;
}


RNDISDevice::~RNDISDevice()
{
	if (fNotifyReadSem >= B_OK)
		delete_sem(fNotifyReadSem);
	if (fNotifyWriteSem >= B_OK)
		delete_sem(fNotifyWriteSem);
	if (fLockWriteSem >= B_OK)
		delete_sem(fLockWriteSem);
	if (fNotifyControlSem >= B_OK)
		delete_sem(fNotifyControlSem);

	if (!fRemoved)
		gUSBModule->cancel_queued_transfers(fNotifyEndpoint);
}


status_t
RNDISDevice::Open()
{
	if (fOpen)
		return B_BUSY;
	if (fRemoved)
		return B_ERROR;

	// reset the device by switching the data interface to the disabled first
	// interface and then enable it by setting the second actual data interface
	const usb_configuration_info *config
		= gUSBModule->get_configuration(fDevice);

	usb_interface_info *interface = config->interface[fDataInterfaceIndex].active;
	if (interface->endpoint_count < 2) {
		TRACE_ALWAYS("setting the data alternate interface failed\n");
		return B_ERROR;
	}

	if (!(interface->endpoint[0].descr->endpoint_address & USB_ENDPOINT_ADDR_DIR_IN))
		fWriteEndpoint = interface->endpoint[0].handle;
	else
		fReadEndpoint = interface->endpoint[0].handle;

	if (interface->endpoint[1].descr->endpoint_address & USB_ENDPOINT_ADDR_DIR_IN)
		fReadEndpoint = interface->endpoint[1].handle;
	else
		fWriteEndpoint = interface->endpoint[1].handle;

	if (fReadEndpoint == 0 || fWriteEndpoint == 0) {
		TRACE_ALWAYS("no read and write endpoints found\n");
		return B_ERROR;
	}

	if (gUSBModule->queue_interrupt(fNotifyEndpoint, &fNotifyBuffer,
		sizeof(fNotifyBuffer), _NotifyCallback, this) != B_OK) {
		TRACE_ALWAYS("failed to setup notification interrupt\n");
		return B_ERROR;
	}

	status_t status = _RNDISInitialize();
	if (status != B_OK) {
		TRACE_ALWAYS("failed to initialize RNDIS device\n");
		return status;
	}

	status = _ReadMACAddress(fDevice, fMACAddress);
	if (status != B_OK) {
		TRACE_ALWAYS("failed to read mac address\n");
		return status;
	}

	// TODO these are non-fatal but make sure we have sane defaults for them
	status = _ReadMaxSegmentSize(fDevice);
	if (status != B_OK) {
		TRACE_ALWAYS("failed to read fragment size\n");
	}

	status = _ReadMediaState(fDevice);
	if (status != B_OK) {
		fMediaConnectState = MEDIA_STATE_CONNECTED;
		TRACE_ALWAYS("failed to read media state\n");
	}

	status = _ReadLinkSpeed(fDevice);
	if (status != B_OK) {
		fDownstreamSpeed = 1000 * 100; // 10Mbps
		TRACE_ALWAYS("failed to read link speed\n");
	}

	// Tell the device to connect
	status = _EnableBroadcast(fDevice);
	TRACE("Initialization result: %s\n", strerror(status));

	// the device should now be ready
	if (status == B_OK)
		fOpen = true;
	return status;
}


status_t
RNDISDevice::Close()
{
	if (fRemoved) {
		fOpen = false;
		return B_OK;
	}

	// TODO tell the device to disconnect?

	gUSBModule->cancel_queued_transfers(fNotifyEndpoint);
	gUSBModule->cancel_queued_transfers(fReadEndpoint);
	gUSBModule->cancel_queued_transfers(fWriteEndpoint);

	fOpen = false;
	return B_OK;
}


status_t
RNDISDevice::Free()
{
	return B_OK;
}


status_t
RNDISDevice::Read(uint8 *buffer, size_t *numBytes)
{
	if (fRemoved) {
		TRACE("Reading, but device is removed\n");
		*numBytes = 0;
		return B_DEVICE_NOT_FOUND;
	}

	// The read funcion can return only one packet at a time, but we can receive multiple ones in
	// a single USB transfer. So we need to buffer them, and check if we have something in our
	// buffer for each Read() call before scheduling a new USB transfer. This would be more
	// efficient if the network stack had a way to read multiple frames at once.
	if (fReadHeader == NULL) {
		TRACE("Reading next packet batch\n");
		status_t result = gUSBModule->queue_bulk(fReadEndpoint, fReadBuffer, sizeof(fReadBuffer),
			_ReadCallback, this);
		if (result != B_OK) {
			TRACE_ALWAYS("failed to schedule read transfer: %s\n", strerror(result));
			fReadHeader = NULL;
			*numBytes = 0;
			return result;
		}

		result = acquire_sem_etc(fNotifyReadSem, 1, B_CAN_INTERRUPT, 0);
		if (result < B_OK) {
			TRACE_ALWAYS("error while waiting for frame: %s\n", strerror(result));
			fReadHeader = NULL;
			*numBytes = 0;
			return result;
		}

		if (fStatusRead == B_CANCELED) {
			TRACE_ALWAYS("request was cancelled: %s\n", strerror(result));
			// The transfer was canceled, so no data was actually received.
			fReadHeader = NULL;
			*numBytes = 0;
			return fStatusRead;
		}

		if ((fStatusRead != B_OK) && !fRemoved) {
			// In other error cases (triggered by the device), we need to clear the "halt" feature
			// so that the next transfers will work.
			TRACE_ALWAYS("device read status error: %s\n", strerror(fStatusRead));

			gUSBModule->cancel_queued_transfers(fReadEndpoint);

			result = gUSBModule->clear_feature(fReadEndpoint, USB_FEATURE_ENDPOINT_HALT);
			if (result != B_OK) {
				TRACE_ALWAYS("failed to clear halt state on read\n");
			}
			fReadHeader = NULL;
			*numBytes = 0;
			return fStatusRead;
		}
		fReadHeader = (uint32*)fReadBuffer;
	} else {
		TRACE("Returning buffered packet\n");
	}

	if (fReadHeader[0] != REMOTE_NDIS_PACKET_MSG) {
		TRACE_ALWAYS("Received unexpected packet type %08" B_PRIx32 " on data link\n",
			fReadHeader[0]);
		*numBytes = 0;
		fReadHeader = NULL;
		return B_BAD_VALUE;
	}

	if (fReadHeader[1] + ((uint8*)fReadHeader - fReadBuffer) > fActualLengthRead) {
		TRACE_ALWAYS("Received frame at %ld length %08" B_PRIx32 " out of bounds of receive buffer"
			"%08" B_PRIx32 "\n", (uint8*) fReadHeader - fReadBuffer, fReadHeader[1],
			fActualLengthRead);
	}

	if (fReadHeader[2] + fReadHeader[3] > fReadHeader[1]) {
		TRACE_ALWAYS("Received frame data goes past end of frame: %" B_PRIu32 " + %" B_PRIu32
			" > %" B_PRIu32, fReadHeader[2], fReadHeader[3], fReadHeader[1]);
	}

	if (fReadHeader[4] != 0 || fReadHeader[5] != 0 || fReadHeader[6] != 0) {
		TRACE_ALWAYS("Received frame has out of band data: off %08" B_PRIx32 " len %08" B_PRIx32
			" count %08" B_PRIx32 "\n", fReadHeader[4], fReadHeader[5], fReadHeader[6]);
	}

	if (fReadHeader[7] != 0 || fReadHeader[8] != 0) {
		TRACE_ALWAYS("Received frame has per-packet info: off %08" B_PRIx32 " len %08" B_PRIx32
			"\n", fReadHeader[7], fReadHeader[8]);
	}

	if (fReadHeader[9] != 0) {
		TRACE_ALWAYS("Received frame has non-0 reserved field %08" B_PRIx32 "\n", fReadHeader[9]);
	}

	*numBytes = fReadHeader[3];
	int offset = fReadHeader[2] + 2 * sizeof(uint32);
	memcpy(buffer, (uint8*)fReadHeader + offset, fReadHeader[3]);

	TRACE("Received data packet len %08" B_PRIx32 " data [off %08" B_PRIx32 " len %08" B_PRIx32 "]\n",
		fReadHeader[1], fReadHeader[2], fReadHeader[3]);

	// Advance to next packet
	fReadHeader = (uint32*)((uint8*)fReadHeader + fReadHeader[1]);

	// Are we past the end of the buffer? If so, prepare to receive another one on the next read
	if ((uint32)((uint8*)fReadHeader - fReadBuffer) >= fActualLengthRead)
		fReadHeader = NULL;

	return B_OK;
}


class SemLocker {
public:
	SemLocker(sem_id sem)
		: fSem(sem)
	{
		fStatus = acquire_sem(fSem);
	}

	~SemLocker()
	{
		if (fStatus == B_OK)
			release_sem(fSem);
	}

	status_t fStatus;
private:
	sem_id fSem;
};


status_t
RNDISDevice::Write(const uint8 *buffer, size_t *numBytes)
{
	if (fRemoved) {
		*numBytes = 0;
		return B_DEVICE_NOT_FOUND;
	}

	iovec vec[2];

	uint32 header[11] = { 0 };
	header[0] = REMOTE_NDIS_PACKET_MSG;
	header[1] = *numBytes + sizeof(header);
	header[2] = 0x24;
	header[3] = *numBytes;

	vec[0].iov_base = &header;
	vec[0].iov_len = sizeof(header);

	vec[1].iov_base = (void*)buffer;
	vec[1].iov_len = *numBytes;

	SemLocker mutex(fLockWriteSem);
	status_t result = mutex.fStatus;
	if (result < B_OK) {
		*numBytes = 0;
		return result;
	}

	result = gUSBModule->queue_bulk_v(fWriteEndpoint, vec, 2, _WriteCallback, this);
	if (result != B_OK) {
		*numBytes = 0;
		return result;
	}

	do {
		result = acquire_sem_etc(fNotifyWriteSem, 1, B_CAN_INTERRUPT, 0);
	} while (result == B_INTERRUPTED);

	if (result < B_OK) {
		*numBytes = 0;
		return result;
	}

	if (fStatusWrite == B_CANCELED) {
		// The transfer was canceled, so no data was actually sent.
		*numBytes = 0;
		return fStatusWrite;
	}

	if ((fStatusWrite != B_OK) && !fRemoved) {
		TRACE_ALWAYS("device write status error 0x%08" B_PRIx32 "\n", fStatusWrite);

		gUSBModule->cancel_queued_transfers(fReadEndpoint);

		result = gUSBModule->clear_feature(fWriteEndpoint, USB_FEATURE_ENDPOINT_HALT);
		if (result != B_OK) {
			TRACE_ALWAYS("failed to clear halt state on write\n");
			*numBytes = 0;
			return result;
		}
	}

	*numBytes = fActualLengthWrite;

	return B_OK;
}


status_t
RNDISDevice::Control(uint32 op, void *buffer, size_t length)
{
	switch (op) {
		case ETHER_INIT:
			return B_OK;

		case ETHER_GETADDR:
			memcpy(buffer, &fMACAddress, sizeof(fMACAddress));
			return B_OK;

		case ETHER_GETFRAMESIZE:
			*(uint32 *)buffer = fMaxSegmentSize;
			return B_OK;

		case ETHER_SET_LINK_STATE_SEM:
			fLinkStateChangeSem = *(sem_id *)buffer;
			return B_OK;

		case ETHER_GET_LINK_STATE:
		{
			ether_link_state *state = (ether_link_state *)buffer;
			// FIXME get media duplex state from OID_GEN_LINK_STATE if supported
			state->media = IFM_ETHER | IFM_FULL_DUPLEX;
			if (fMediaConnectState != MEDIA_STATE_DISCONNECTED)
				state->media |= IFM_ACTIVE;
			state->quality = 1000;
			state->speed = fDownstreamSpeed * 100;
			return B_OK;
		}

		case ETHER_SEND_NET_BUFFER:
		case ETHER_RECEIVE_NET_BUFFER:
			// Ignored for now, we use the old read/write interface instead
			return B_DEV_INVALID_IOCTL;

		default:
			TRACE_ALWAYS("unsupported ioctl %" B_PRIu32 "\n", op);
	}

	return B_DEV_INVALID_IOCTL;
}


void
RNDISDevice::Removed()
{
	fRemoved = true;
	fMediaConnectState = MEDIA_STATE_DISCONNECTED;
	fDownstreamSpeed = 0;

	// the notify hook is different from the read and write hooks as it does
	// itself schedule traffic (while the other hooks only release a semaphore
	// to notify another thread which in turn safly checks for the removed
	// case) - so we must ensure that we are not inside the notify hook anymore
	// before returning, as we would otherwise violate the promise not to use
	// any of the pipes after returning from the removed hook
	while (atomic_add(&fInsideNotify, 0) != 0)
		snooze(100);

	gUSBModule->cancel_queued_transfers(fNotifyEndpoint);
	gUSBModule->cancel_queued_transfers(fReadEndpoint);
	gUSBModule->cancel_queued_transfers(fWriteEndpoint);

	if (fLinkStateChangeSem >= B_OK)
		release_sem_etc(fLinkStateChangeSem, 1, B_DO_NOT_RESCHEDULE);
}


status_t
RNDISDevice::_SendCommand(const void* data, size_t length)
{
	size_t actualLength;
	return gUSBModule->send_request(fDevice, USB_REQTYPE_INTERFACE_OUT | USB_REQTYPE_CLASS,
		USB_CDC_SEND_ENCAPSULATED_COMMAND, 0, 0, length, (void*)data, &actualLength);
}


status_t
RNDISDevice::_ReadResponse(void* data, size_t length)
{
	size_t actualLength;
	return gUSBModule->send_request(fDevice, USB_REQTYPE_INTERFACE_IN | USB_REQTYPE_CLASS,
		USB_CDC_GET_ENCAPSULATED_RESPONSE, 0, 0, length, data, &actualLength);
}


status_t
RNDISDevice::_RNDISInitialize()
{
	uint32 request[] = {
		REMOTE_NDIS_INITIALIZE_MSG,
		6 * sizeof(uint32), // MessageLength
		0x00000000, // RequestID
		0x00000001, 0x00000000, // Version (major, minor)
		0x00004000 // MaxTransferSize
	};

	status_t result = _SendCommand(request, sizeof(request));
	TRACE("Send init command results in %s\n", strerror(result));

	acquire_sem(fNotifyControlSem);

	TRACE("Received notification after init command\n");

	uint32 response[0x34 / 4];

	result = _ReadResponse(response, sizeof(response));
	TRACE("Read init command results in %s\n", strerror(result));
	if (result != B_OK)
		return result;

	TRACE("Type      %" B_PRIx32 "\n", response[0]);
	TRACE("Length    %" B_PRIx32 "\n", response[1]);
	TRACE("Req ID    %" B_PRIx32 "\n", response[2]);
	TRACE("Status    %" B_PRIx32 "\n", response[3]);
	TRACE("Vers Maj  %" B_PRIx32 "\n", response[4]);
	TRACE("Vers Min  %" B_PRIx32 "\n", response[5]);
	TRACE("DevFlags  %" B_PRIx32 "\n", response[6]);
	TRACE("Medium    %" B_PRIx32 "\n", response[7]);
	TRACE("Max Pkts  %" B_PRIx32 "\n", response[8]);
	TRACE("Max Bytes %" B_PRIx32 "\n", response[9]);
	TRACE("Alignment %" B_PRIx32 "\n", response[10]);
	TRACE("Reserved  ");
	for (int i = 11; i < 0x34 / 4; i++)
		TRACE("%" B_PRIx32 " ", response[i]);
	TRACE("\n");

	// TODO configure stuff until we get a SET_CPLT message meaning everything is configured
	// TODO set up a notification sytem to be notified if these change? Do we have OIDs for them?
	// OID_GEN_HARDWARE_STATUS, OID_GEN_MEDIA_IN_USE

	return B_OK;
}


status_t
RNDISDevice::_SetupDevice()
{
	const usb_device_descriptor *deviceDescriptor
                = gUSBModule->get_device_descriptor(fDevice);

	if (deviceDescriptor == NULL) {
		TRACE_ALWAYS("failed to get device descriptor\n");
		return B_ERROR;
	}

	uint8 controlIndex = 0;
	uint8 dataIndex = 0;
	bool foundUnionDescriptor = false;
	bool foundCMDescriptor = false;
	bool found = false;
	const usb_configuration_info *config = NULL;
	for (int i = 0; i < deviceDescriptor->num_configurations && !found; i++) {
		config = gUSBModule->get_nth_configuration(fDevice, i);
		if (config == NULL)
			continue;

		for (size_t j = 0; j < config->interface_count && !found; j++) {
			const usb_interface_info *interface = config->interface[j].active;
			usb_interface_descriptor *descriptor = interface->descr;
			if (descriptor->interface_class != USB_COMMUNICATION_WIRELESS_DEVICE_CLASS
				|| descriptor->interface_subclass != 0x01
				|| descriptor->interface_protocol != 0x03
				|| interface->generic_count == 0) {
				continue;
			}

			// try to find and interpret the union and call management functional
			// descriptors (they allow us to locate the data interface)
			foundUnionDescriptor = foundCMDescriptor = false;
			for (size_t k = 0; k < interface->generic_count; k++) {
				usb_generic_descriptor *generic = &interface->generic[k]->generic;
				if (generic->length >= sizeof(usb_cdc_union_functional_descriptor)
					&& generic->data[0] == USB_CDC_UNION_FUNCTIONAL_DESCRIPTOR) {
					controlIndex = generic->data[1];
					foundUnionDescriptor = true;
				} else if (generic->length >= sizeof(usb_cdc_cm_functional_descriptor)
					&& generic->data[0] == USB_CDC_CM_FUNCTIONAL_DESCRIPTOR) {
					usb_cdc_cm_functional_descriptor *cm
						= (usb_cdc_cm_functional_descriptor *)generic;
					dataIndex = cm->data_interface;
					foundCMDescriptor = true;
				}

				if (foundUnionDescriptor && foundCMDescriptor) {
					found = true;
					break;
				}
			}
		}
	}

	if (!foundUnionDescriptor) {
		TRACE_ALWAYS("did not find a union descriptor\n");
		return B_ERROR;
	}

	if (!foundCMDescriptor) {
		TRACE_ALWAYS("did not find an ethernet descriptor\n");
		return B_ERROR;
	}

	// set the current configuration
	gUSBModule->set_configuration(fDevice, config);
	if (controlIndex >= config->interface_count) {
		TRACE_ALWAYS("control interface index invalid\n");
		return B_ERROR;
	}

	// check that the indicated control interface fits our needs
	usb_interface_info *interface = config->interface[controlIndex].active;
	usb_interface_descriptor *descriptor = interface->descr;
	if ((descriptor->interface_class != 0xE0
		|| descriptor->interface_subclass != 0x01
		|| descriptor->interface_protocol != 0x03)
		|| interface->endpoint_count == 0) {
		TRACE_ALWAYS("control interface invalid\n");
		return B_ERROR;
	}

	fNotifyEndpoint = interface->endpoint[0].handle;
	if (interface->endpoint[0].descr->max_packet_size > sizeof(fNotifyBuffer)) {
		TRACE_ALWAYS("Notify buffer is too small, need at least %d bytes\n",
			interface->endpoint[0].descr->max_packet_size);
		return B_ERROR;
	}

	if (dataIndex >= config->interface_count) {
		TRACE_ALWAYS("data interface index %d out of range %" B_PRIuSIZE "\n", dataIndex,
			config->interface_count);
		return B_ERROR;
	}

	interface = &config->interface[dataIndex].alt[0];
	descriptor = interface->descr;
	if (descriptor->interface_class != USB_CDC_DATA_INTERFACE_CLASS
		|| interface->endpoint_count < 2) {
		TRACE_ALWAYS("data interface %d invalid (class %x, %" B_PRIuSIZE " endpoints)\n", dataIndex,
			descriptor->interface_class, interface->endpoint_count);
		return B_ERROR;
	}

	fDataInterfaceIndex = dataIndex;
	return B_OK;
}


status_t
RNDISDevice::_GetOID(uint32 oid, void* buffer, size_t length)
{
	uint32 request[] = {
		REMOTE_NDIS_QUERY_MSG,
		7 * sizeof(uint32), // Length of the request
		0x00000001, // Request ID (FIXME generate this dynamically if we need multiple requests in
					// flight, so we can match up the replies with the different requests)
		oid,
		0, 0, 0
	};

	status_t result = _SendCommand(request, sizeof(request));
	if (result != B_OK)
		return result;

	acquire_sem(fNotifyControlSem);

	uint8 response[length + 24];
	result = _ReadResponse(response, length + 24);
	memcpy(buffer, &response[24], length);
	return result;
}


status_t
RNDISDevice::_ReadMACAddress(usb_device device, uint8 *buffer)
{
	status_t result = _GetOID(OID_802_3_PERMANENT_ADDRESS, buffer, 6);
	if (result != B_OK)
		return result;

	TRACE_ALWAYS("mac address: %02x:%02x:%02x:%02x:%02x:%02x\n",
		buffer[0], buffer[1], buffer[2], buffer[3], buffer[4], buffer[5]);
	return B_OK;
}


status_t
RNDISDevice::_ReadMaxSegmentSize(usb_device device)
{
	status_t result = _GetOID(OID_GEN_MAXIMUM_FRAME_SIZE, &fMaxSegmentSize,
		sizeof(fMaxSegmentSize));
	if (result != B_OK)
		return result;

	TRACE_ALWAYS("max frame size: %" B_PRId32 "\n", fMaxSegmentSize);
	return B_OK;
}


status_t
RNDISDevice::_ReadMediaState(usb_device device)
{
	status_t result = _GetOID(OID_GEN_MEDIA_CONNECT_STATUS, &fMediaConnectState,
		sizeof(fMediaConnectState));
	if (result != B_OK)
		return result;

	TRACE_ALWAYS("media connect state: %" B_PRId32 "\n", fMediaConnectState);
	return B_OK;
}


status_t
RNDISDevice::_ReadLinkSpeed(usb_device device)
{
	status_t result = _GetOID(OID_GEN_LINK_SPEED, &fDownstreamSpeed,
		sizeof(fDownstreamSpeed));
	if (result != B_OK)
		return result;

	TRACE_ALWAYS("link speed: %" B_PRId32 " * 100bps\n", fDownstreamSpeed);
	return B_OK;
}


status_t
RNDISDevice::_EnableBroadcast(usb_device device)
{
	uint32 request[] = {
		REMOTE_NDIS_SET_MSG,
		8 * sizeof(uint32), // Length of the request
		0x00000001, // Request ID (FIXME generate this dynamically if we need multiple requests in
					// flight, so we can match up the replies with the different requests)
		OID_GEN_CURRENT_PACKET_FILTER,
		0x14, // buffer length
		0x14, // buffer offset
		0, // reserved
		NDIS_PACKET_TYPE_ALL_MULTICAST | NDIS_PACKET_TYPE_BROADCAST
	};

	status_t result = _SendCommand(request, sizeof(request));
	if (result != B_OK) {
		TRACE_ALWAYS("Failed to start traffic (set oid: %s)\n", strerror(result));
		return result;
	}

	acquire_sem(fNotifyControlSem);

	uint32 response[4];
	result = _ReadResponse(response, 4 * sizeof(uint32));
	if (result != B_OK) {
		TRACE_ALWAYS("Failed to start traffic (response: %s)\n", strerror(result));
		return result;
	}

	// TODO check other fields in the response (message type, length, request id) match our request

	switch (response[3])
	{
		case RNDIS_STATUS_SUCCESS:
			return B_OK;
		case RNDIS_STATUS_FAILURE:
			return B_ERROR;
		case RNDIS_STATUS_INVALID_DATA:
			return B_BAD_DATA;
		case RNDIS_STATUS_NOT_SUPPORTED:
			return B_NOT_SUPPORTED;
		case RNDIS_STATUS_MEDIA_CONNECT:
			return EISCONN;
		case RNDIS_STATUS_MEDIA_DISCONNECT:
			return ENOTCONN;
		default:
			TRACE_ALWAYS("Unexpected error code %" B_PRIx32 "\n", response[3]);
			return B_IO_ERROR;
	}
}


void
RNDISDevice::_ReadCallback(void *cookie, int32 status, void *data,
	size_t actualLength)
{
	RNDISDevice *device = (RNDISDevice *)cookie;
	device->fActualLengthRead = actualLength;
	device->fStatusRead = status;
	release_sem_etc(device->fNotifyReadSem, 1, B_DO_NOT_RESCHEDULE);
}


void
RNDISDevice::_WriteCallback(void *cookie, int32 status, void *data,
	size_t actualLength)
{
	RNDISDevice *device = (RNDISDevice *)cookie;
	device->fActualLengthWrite = actualLength;
	device->fStatusWrite = status;
	release_sem_etc(device->fNotifyWriteSem, 1, B_DO_NOT_RESCHEDULE);
}


void
RNDISDevice::_NotifyCallback(void *cookie, int32 status, void *_data,
	size_t actualLength)
{
	RNDISDevice *device = (RNDISDevice *)cookie;
	atomic_add(&device->fInsideNotify, 1);
	if (status == B_CANCELED || device->fRemoved) {
		atomic_add(&device->fInsideNotify, -1);
		return;
	}

	if (status != B_OK) {
		TRACE_ALWAYS("device notify status error 0x%08" B_PRIx32 "\n", status);

		if (gUSBModule->clear_feature(device->fNotifyEndpoint,
			USB_FEATURE_ENDPOINT_HALT) != B_OK)
			TRACE_ALWAYS("failed to clear halt state in notify hook\n");
	} else if (actualLength != 8) {
		TRACE_ALWAYS("Received notification with unexpected number of bytes %" B_PRIuSIZE "\n",
			actualLength);
	} else {
#ifdef TRACE_RNDIS
		uint32* data = (uint32*)_data;
		uint32 notification = data[0];
		uint32 reserved = data[1];
		TRACE("Received notification %" B_PRIx32 " %" B_PRIx32 "\n", notification, reserved);
#endif
		release_sem_etc(device->fNotifyControlSem, 1, B_DO_NOT_RESCHEDULE);
	}

	// schedule next notification buffer
	gUSBModule->queue_interrupt(device->fNotifyEndpoint, device->fNotifyBuffer,
		sizeof(device->fNotifyBuffer), _NotifyCallback, device);
	atomic_add(&device->fInsideNotify, -1);
}