Import USB RNDIS driver to FreeBSD from OpenBSD.

Useful for so-called USB tethering.
- Imported code from OpenBSD
- Adapted code to FreeBSD
- Removed some unused functions
- Fixed some buffer encoding and decoding issues
- Optimised data transport path a bit, by sending multiple packets at a time
- Increased receive buffer to 16K

Obtained from:	OpenBSD
Requested by:	eadler @
MFC after:	2 weeks

7 files changed, 1355 insertions, 1 deletions

diff --git a/sys/conf/NOTES b/sys/conf/NOTES
index 8095c0e1f190..92a183c5c3bf 100644
--- a/sys/conf/NOTES
+++ b/sys/conf/NOTES
@@ -2746,6 +2746,8 @@ device		upgt
 # Ralink Technology RT2500USB wireless driver
 device		ural
 #
+# RNDIS USB ethernet driver
+device		urndis
 # Realtek RTL8187B/L wireless driver
 device		urtw
 #
diff --git a/sys/conf/files b/sys/conf/files
index dba13a71c351..75e1fe615b21 100644
--- a/sys/conf/files
+++ b/sys/conf/files
@@ -2293,9 +2293,11 @@ dev/usb/net/if_rue.c		optional rue
 dev/usb/net/if_smsc.c		optional smsc
 dev/usb/net/if_udav.c		optional udav
 dev/usb/net/if_usie.c		optional usie
+dev/usb/net/if_urndis.c		optional urndis
 dev/usb/net/ruephy.c		optional rue
 dev/usb/net/usb_ethernet.c	optional aue | axe | axge | cdce | cue | kue | \
-					 mos | rue | smsc | udav | ipheth
+					 mos | rue | smsc | udav | ipheth | \
+					 urndis
 dev/usb/net/uhso.c		optional uhso
 #
 # USB WLAN drivers
diff --git a/sys/dev/usb/net/if_urndis.c b/sys/dev/usb/net/if_urndis.c
new file mode 100644
index 000000000000..b4856a0395b2
--- /dev/null
+++ b/sys/dev/usb/net/if_urndis.c
@@ -0,0 +1,1013 @@
+/*	$OpenBSD: if_urndis.c,v 1.46 2013/12/09 15:45:29 pirofti Exp $ */
+
+/*
+ * Copyright (c) 2010 Jonathan Armani <armani@openbsd.org>
+ * Copyright (c) 2010 Fabien Romano <fabien@openbsd.org>
+ * Copyright (c) 2010 Michael Knudsen <mk@openbsd.org>
+ * Copyright (c) 2014 Hans Petter Selasky <hselasky@freebsd.org>
+ * All rights reserved.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/stdint.h>
+#include <sys/stddef.h>
+#include <sys/param.h>
+#include <sys/queue.h>
+#include <sys/types.h>
+#include <sys/systm.h>
+#include <sys/socket.h>
+#include <sys/kernel.h>
+#include <sys/bus.h>
+#include <sys/module.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/condvar.h>
+#include <sys/sysctl.h>
+#include <sys/sx.h>
+#include <sys/unistd.h>
+#include <sys/callout.h>
+#include <sys/malloc.h>
+#include <sys/priv.h>
+
+#include <net/if.h>
+#include <net/if_var.h>
+
+#include <dev/usb/usb.h>
+#include <dev/usb/usbdi.h>
+#include <dev/usb/usbdi_util.h>
+#include "usbdevs.h"
+
+#define	USB_DEBUG_VAR urndis_debug
+#include <dev/usb/usb_debug.h>
+#include <dev/usb/usb_process.h>
+#include "usb_if.h"
+
+#include <dev/usb/net/usb_ethernet.h>
+#include <dev/usb/net/if_urndisreg.h>
+
+#include <dev/usb/usb_cdc.h>
+
+static device_probe_t urndis_probe;
+static device_attach_t urndis_attach;
+static device_detach_t urndis_detach;
+static device_suspend_t urndis_suspend;
+static device_resume_t urndis_resume;
+
+static usb_callback_t urndis_bulk_write_callback;
+static usb_callback_t urndis_bulk_read_callback;
+static usb_callback_t urndis_intr_read_callback;
+
+static uether_fn_t urndis_attach_post;
+static uether_fn_t urndis_init;
+static uether_fn_t urndis_stop;
+static uether_fn_t urndis_start;
+static uether_fn_t urndis_setmulti;
+static uether_fn_t urndis_setpromisc;
+
+static uint32_t urndis_ctrl_query(struct urndis_softc *, uint32_t, const void **, uint16_t *);
+static uint32_t urndis_ctrl_set(struct urndis_softc *, uint32_t, struct urndis_set_req *, uint16_t);
+static uint32_t urndis_ctrl_handle_init(struct urndis_softc *, const struct urndis_comp_hdr *);
+static uint32_t urndis_ctrl_handle_query(struct urndis_softc *, const struct urndis_comp_hdr *, const void **, uint16_t *);
+static uint32_t urndis_ctrl_handle_reset(struct urndis_softc *, const struct urndis_comp_hdr *);
+static uint32_t urndis_ctrl_init(struct urndis_softc *);
+
+#ifdef USB_DEBUG
+static int urndis_debug = 0;
+static	SYSCTL_NODE(_hw_usb, OID_AUTO, urndis, CTLFLAG_RW, 0, "USB RNDIS-Ethernet");
+SYSCTL_INT(_hw_usb_urndis, OID_AUTO, debug, CTLFLAG_RW, &urndis_debug, 0,
+    "Debug level");
+#endif
+
+static const struct usb_config urndis_config[URNDIS_N_TRANSFER] = {
+
+	[URNDIS_BULK_RX] = {
+		.type = UE_BULK,
+		.endpoint = UE_ADDR_ANY,
+		.direction = UE_DIR_RX,
+		.if_index = 0,
+		.frames = 1,
+		.bufsize = RNDIS_RX_MAXLEN,
+		.flags = {.short_xfer_ok = 1,},
+		.callback = urndis_bulk_read_callback,
+		.timeout = 0,		/* no timeout */
+		.usb_mode = USB_MODE_HOST,
+	},
+
+	[URNDIS_BULK_TX] = {
+		.type = UE_BULK,
+		.endpoint = UE_ADDR_ANY,
+		.direction = UE_DIR_TX,
+		.if_index = 0,
+		.frames = RNDIS_TX_FRAMES_MAX,
+		.bufsize = (RNDIS_TX_FRAMES_MAX * RNDIS_TX_MAXLEN),
+		.flags = {
+			.force_short_xfer = 1,
+		},
+		.callback = urndis_bulk_write_callback,
+		.timeout = 10000,	/* 10 seconds */
+		.usb_mode = USB_MODE_HOST,
+	},
+
+	[URNDIS_INTR_RX] = {
+		.type = UE_INTERRUPT,
+		.endpoint = UE_ADDR_ANY,
+		.direction = UE_DIR_RX,
+		.if_index = 1,
+		.bufsize = 0,	/* use wMaxPacketSize */
+		.flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
+		.callback = urndis_intr_read_callback,
+		.timeout = 0,
+		.usb_mode = USB_MODE_HOST,
+	},
+};
+
+static device_method_t urndis_methods[] = {
+	/* Device interface */
+	DEVMETHOD(device_probe, urndis_probe),
+	DEVMETHOD(device_attach, urndis_attach),
+	DEVMETHOD(device_detach, urndis_detach),
+	DEVMETHOD(device_suspend, urndis_suspend),
+	DEVMETHOD(device_resume, urndis_resume),
+
+	DEVMETHOD_END
+};
+
+static driver_t urndis_driver = {
+	.name = "urndis",
+	.methods = urndis_methods,
+	.size = sizeof(struct urndis_softc),
+};
+
+static devclass_t urndis_devclass;
+
+DRIVER_MODULE(urndis, uhub, urndis_driver, urndis_devclass, NULL, 0);
+MODULE_VERSION(urndis, 1);
+MODULE_DEPEND(urndis, uether, 1, 1, 1);
+MODULE_DEPEND(urndis, usb, 1, 1, 1);
+MODULE_DEPEND(urndis, ether, 1, 1, 1);
+
+static const struct usb_ether_methods urndis_ue_methods = {
+	.ue_attach_post = urndis_attach_post,
+	.ue_start = urndis_start,
+	.ue_init = urndis_init,
+	.ue_stop = urndis_stop,
+	.ue_setmulti = urndis_setmulti,
+	.ue_setpromisc = urndis_setpromisc,
+};
+
+static const STRUCT_USB_HOST_ID urndis_host_devs[] = {
+	{USB_IFACE_CLASS(UICLASS_CDC), USB_IFACE_SUBCLASS(UISUBCLASS_ABSTRACT_CONTROL_MODEL),
+	USB_IFACE_PROTOCOL(0xff)},
+	{USB_IFACE_CLASS(UICLASS_WIRELESS), USB_IFACE_SUBCLASS(UISUBCLASS_RF),
+	USB_IFACE_PROTOCOL(UIPROTO_RNDIS)},
+	{USB_IFACE_CLASS(UICLASS_IAD), USB_IFACE_SUBCLASS(UISUBCLASS_SYNC),
+	USB_IFACE_PROTOCOL(UIPROTO_ACTIVESYNC)},
+};
+
+static int
+urndis_probe(device_t dev)
+{
+	struct usb_attach_arg *uaa = device_get_ivars(dev);
+
+	return (usbd_lookup_id_by_uaa(urndis_host_devs, sizeof(urndis_host_devs), uaa));
+}
+
+static void
+urndis_attach_post(struct usb_ether *ue)
+{
+	/* no-op */
+	return;
+}
+
+static int
+urndis_attach(device_t dev)
+{
+	struct urndis_softc *sc = device_get_softc(dev);
+	struct usb_ether *ue = &sc->sc_ue;
+	struct usb_attach_arg *uaa = device_get_ivars(dev);
+	struct usb_cdc_cm_descriptor *cmd;
+	struct {
+		struct urndis_set_req hdr;
+		uint32_t filter;
+	} msg_filter;
+	const void *buf;
+	uint16_t bufsz;
+	uint8_t iface_index[2] = { uaa->info.bIfaceIndex + 1, uaa->info.bIfaceIndex };
+	int error;
+	uint8_t i;
+
+	sc->sc_ue.ue_udev = uaa->device;
+	sc->sc_ifaceno_ctl = uaa->info.bIfaceNum;
+
+	cmd = usbd_find_descriptor(uaa->device, NULL, uaa->info.bIfaceIndex,
+	    UDESC_CS_INTERFACE, 0xFF, UDESCSUB_CDC_CM, 0xFF);
+	if (cmd != 0) {
+		DPRINTF("Call Mode Descriptor found, dataif=%d\n", cmd->bDataInterface);
+		iface_index[0] = cmd->bDataInterface;
+	}
+
+	device_set_usb_desc(dev);
+
+	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), NULL, MTX_DEF);
+
+	/* scan the alternate settings looking for a valid one */
+
+	for (i = 0; i != 32; i++) {
+
+		error = usbd_set_alt_interface_index(uaa->device,
+		    iface_index[0], i);
+
+		if (error != 0)
+			break;
+
+		error = usbd_transfer_setup(uaa->device,
+		    iface_index, sc->sc_xfer, urndis_config,
+		    URNDIS_N_TRANSFER, sc, &sc->sc_mtx);
+
+		if (error == 0)
+			break;
+	}
+
+	if ((error != 0) || (i == 32)) {
+		device_printf(dev, "No valid alternate "
+		    "setting found\n");
+		goto detach;
+	}
+	URNDIS_LOCK(sc);
+	error = urndis_ctrl_query(sc, OID_802_3_PERMANENT_ADDRESS, &buf, &bufsz);
+	URNDIS_UNLOCK(sc);
+
+	if (error != (int)RNDIS_STATUS_SUCCESS) {
+		device_printf(dev, "Unable to get hardware address\n");
+		goto detach;
+	}
+	if (bufsz != ETHER_ADDR_LEN) {
+		device_printf(dev, "Invalid address length: %d bytes\n", bufsz);
+		goto detach;
+	}
+	memcpy(&sc->sc_ue.ue_eaddr, buf, ETHER_ADDR_LEN);
+
+	/* Initialize packet filter */
+	sc->sc_filter = RNDIS_PACKET_TYPE_BROADCAST |
+	    RNDIS_PACKET_TYPE_ALL_MULTICAST;
+	msg_filter.filter = htole32(sc->sc_filter);
+
+	URNDIS_LOCK(sc);
+	error = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
+	    &msg_filter.hdr, sizeof(msg_filter));
+	URNDIS_UNLOCK(sc);
+
+	if (error != (int)RNDIS_STATUS_SUCCESS) {
+		device_printf(dev, "Unable to set data filters\n");
+		goto detach;
+	}
+	ue->ue_sc = sc;
+	ue->ue_dev = dev;
+	ue->ue_udev = uaa->device;
+	ue->ue_mtx = &sc->sc_mtx;
+	ue->ue_methods = &urndis_ue_methods;
+
+	error = uether_ifattach(ue);
+	if (error) {
+		device_printf(dev, "Could not attach interface\n");
+		goto detach;
+	}
+
+	URNDIS_LOCK(sc);
+	/* start interrupt endpoint, if any */
+	usbd_transfer_start(sc->sc_xfer[URNDIS_INTR_RX]);
+	URNDIS_UNLOCK(sc);
+
+	return (0);			/* success */
+
+detach:
+	urndis_detach(dev);
+	return (ENXIO);			/* failure */
+}
+
+static int
+urndis_detach(device_t dev)
+{
+	struct urndis_softc *sc = device_get_softc(dev);
+	struct usb_ether *ue = &sc->sc_ue;
+
+	/* stop all USB transfers first */
+	usbd_transfer_unsetup(sc->sc_xfer, URNDIS_N_TRANSFER);
+
+	uether_ifdetach(ue);
+
+	mtx_destroy(&sc->sc_mtx);
+
+	return (0);
+}
+
+static void
+urndis_start(struct usb_ether *ue)
+{
+	struct urndis_softc *sc = uether_getsc(ue);
+
+	/*
+	 * Start the USB transfers, if not already started:
+	 */
+	usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_TX]);
+	usbd_transfer_start(sc->sc_xfer[URNDIS_BULK_RX]);
+}
+
+static void
+urndis_init(struct usb_ether *ue)
+{
+	struct urndis_softc *sc = uether_getsc(ue);
+	struct ifnet *ifp = uether_getifp(ue);
+
+	URNDIS_LOCK_ASSERT(sc, MA_OWNED);
+
+	ifp->if_drv_flags |= IFF_DRV_RUNNING;
+
+	urndis_ctrl_init(sc);
+
+	/* stall data write direction, which depends on USB mode */
+	usbd_xfer_set_stall(sc->sc_xfer[URNDIS_BULK_TX]);
+
+	/* start data transfers */
+	urndis_start(ue);
+}
+
+static void
+urndis_stop(struct usb_ether *ue)
+{
+	struct urndis_softc *sc = uether_getsc(ue);
+	struct ifnet *ifp = uether_getifp(ue);
+
+	URNDIS_LOCK_ASSERT(sc, MA_OWNED);
+
+	ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
+
+	/*
+	 * stop all the transfers, if not already stopped:
+	 */
+	usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_RX]);
+	usbd_transfer_stop(sc->sc_xfer[URNDIS_BULK_TX]);
+}
+
+static void
+urndis_setmulti(struct usb_ether *ue)
+{
+	/* no-op */
+	return;
+}
+
+static void
+urndis_setpromisc(struct usb_ether *ue)
+{
+	/* no-op */
+	return;
+}
+
+static int
+urndis_suspend(device_t dev)
+{
+	device_printf(dev, "Suspending\n");
+	return (0);
+}
+
+static int
+urndis_resume(device_t dev)
+{
+	device_printf(dev, "Resuming\n");
+	return (0);
+}
+
+static usb_error_t
+urndis_ctrl_msg(struct urndis_softc *sc, uint8_t rt, uint8_t r,
+    uint16_t index, uint16_t value, void *buf, uint16_t buflen)
+{
+	usb_device_request_t req;
+
+	req.bmRequestType = rt;
+	req.bRequest = r;
+	USETW(req.wValue, value);
+	USETW(req.wIndex, index);
+	USETW(req.wLength, buflen);
+
+	return (usbd_do_request_flags(sc->sc_ue.ue_udev,
+	    &sc->sc_mtx, &req, buf, (rt & UT_READ) ?
+	    USB_SHORT_XFER_OK : 0, NULL, 2000 /* ms */ ));
+}
+
+static usb_error_t
+urndis_ctrl_send(struct urndis_softc *sc, void *buf, uint16_t len)
+{
+	usb_error_t err;
+
+	err = urndis_ctrl_msg(sc, UT_WRITE_CLASS_INTERFACE, UR_GET_STATUS,
+	    sc->sc_ifaceno_ctl, 0, buf, len);
+
+	DPRINTF("%s\n", usbd_errstr(err));
+
+	return (err);
+}
+
+static struct urndis_comp_hdr *
+urndis_ctrl_recv(struct urndis_softc *sc)
+{
+	struct urndis_comp_hdr *hdr;
+	usb_error_t err;
+
+	err = urndis_ctrl_msg(sc, UT_READ_CLASS_INTERFACE, UR_CLEAR_FEATURE,
+	    sc->sc_ifaceno_ctl, 0, sc->sc_response_buf, RNDIS_RESPONSE_LEN);
+
+	if (err != USB_ERR_NORMAL_COMPLETION)
+		return (NULL);
+
+	hdr = (struct urndis_comp_hdr *)sc->sc_response_buf;
+
+	DPRINTF("type 0x%x len %u\n", le32toh(hdr->rm_type),
+	    le32toh(hdr->rm_len));
+
+	if (le32toh(hdr->rm_len) > RNDIS_RESPONSE_LEN) {
+		DPRINTF("ctrl message error: wrong size %u > %u\n",
+		    le32toh(hdr->rm_len), RNDIS_RESPONSE_LEN);
+		return (NULL);
+	}
+	return (hdr);
+}
+
+static uint32_t
+urndis_ctrl_handle(struct urndis_softc *sc, struct urndis_comp_hdr *hdr,
+    const void **buf, uint16_t *bufsz)
+{
+	uint32_t rval;
+
+	DPRINTF("\n");
+
+	if (buf != NULL && bufsz != NULL) {
+		*buf = NULL;
+		*bufsz = 0;
+	}
+	switch (le32toh(hdr->rm_type)) {
+	case REMOTE_NDIS_INITIALIZE_CMPLT:
+		rval = urndis_ctrl_handle_init(sc, hdr);
+		break;
+
+	case REMOTE_NDIS_QUERY_CMPLT:
+		rval = urndis_ctrl_handle_query(sc, hdr, buf, bufsz);
+		break;
+
+	case REMOTE_NDIS_RESET_CMPLT:
+		rval = urndis_ctrl_handle_reset(sc, hdr);
+		break;
+
+	case REMOTE_NDIS_KEEPALIVE_CMPLT:
+	case REMOTE_NDIS_SET_CMPLT:
+		rval = le32toh(hdr->rm_status);
+		break;
+
+	default:
+		DPRINTF("ctrl message error: unknown event 0x%x\n",
+		    le32toh(hdr->rm_type));
+		rval = RNDIS_STATUS_FAILURE;
+		break;
+	}
+	return (rval);
+}
+
+static uint32_t
+urndis_ctrl_handle_init(struct urndis_softc *sc,
+    const struct urndis_comp_hdr *hdr)
+{
+	const struct urndis_init_comp *msg;
+
+	msg = (const struct urndis_init_comp *)hdr;
+
+	DPRINTF("len %u rid %u status 0x%x "
+	    "ver_major %u ver_minor %u devflags 0x%x medium 0x%x pktmaxcnt %u "
+	    "pktmaxsz %u align %u aflistoffset %u aflistsz %u\n",
+	    le32toh(msg->rm_len),
+	    le32toh(msg->rm_rid),
+	    le32toh(msg->rm_status),
+	    le32toh(msg->rm_ver_major),
+	    le32toh(msg->rm_ver_minor),
+	    le32toh(msg->rm_devflags),
+	    le32toh(msg->rm_medium),
+	    le32toh(msg->rm_pktmaxcnt),
+	    le32toh(msg->rm_pktmaxsz),
+	    le32toh(msg->rm_align),
+	    le32toh(msg->rm_aflistoffset),
+	    le32toh(msg->rm_aflistsz));
+
+	if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
+		DPRINTF("init failed 0x%x\n", le32toh(msg->rm_status));
+		return (le32toh(msg->rm_status));
+	}
+	if (le32toh(msg->rm_devflags) != RNDIS_DF_CONNECTIONLESS) {
+		DPRINTF("wrong device type (current type: 0x%x)\n",
+		    le32toh(msg->rm_devflags));
+		return (RNDIS_STATUS_FAILURE);
+	}
+	if (le32toh(msg->rm_medium) != RNDIS_MEDIUM_802_3) {
+		DPRINTF("medium not 802.3 (current medium: 0x%x)\n",
+		    le32toh(msg->rm_medium));
+		return (RNDIS_STATUS_FAILURE);
+	}
+	sc->sc_lim_pktsz = le32toh(msg->rm_pktmaxsz);
+
+	return (le32toh(msg->rm_status));
+}
+
+static uint32_t
+urndis_ctrl_handle_query(struct urndis_softc *sc,
+    const struct urndis_comp_hdr *hdr, const void **buf, uint16_t *bufsz)
+{
+	const struct urndis_query_comp *msg;
+	uint64_t limit;
+
+	msg = (const struct urndis_query_comp *)hdr;
+
+	DPRINTF("len %u rid %u status 0x%x "
+	    "buflen %u bufoff %u\n",
+	    le32toh(msg->rm_len),
+	    le32toh(msg->rm_rid),
+	    le32toh(msg->rm_status),
+	    le32toh(msg->rm_infobuflen),
+	    le32toh(msg->rm_infobufoffset));
+
+	if (buf != NULL && bufsz != NULL) {
+		*buf = NULL;
+		*bufsz = 0;
+	}
+	if (le32toh(msg->rm_status) != RNDIS_STATUS_SUCCESS) {
+		DPRINTF("query failed 0x%x\n", le32toh(msg->rm_status));
+		return (le32toh(msg->rm_status));
+	}
+	limit = le32toh(msg->rm_infobuflen);
+	limit += le32toh(msg->rm_infobufoffset);
+	limit += RNDIS_HEADER_OFFSET;
+
+	if (limit > (uint64_t)le32toh(msg->rm_len)) {
+		DPRINTF("ctrl message error: invalid query info "
+		    "len/offset/end_position(%u/%u/%u) -> "
+		    "go out of buffer limit %u\n",
+		    le32toh(msg->rm_infobuflen),
+		    le32toh(msg->rm_infobufoffset),
+		    le32toh(msg->rm_infobuflen) +
+		    le32toh(msg->rm_infobufoffset) + RNDIS_HEADER_OFFSET,
+		    le32toh(msg->rm_len));
+		return (RNDIS_STATUS_FAILURE);
+	}
+	if (buf != NULL && bufsz != NULL) {
+		*buf = ((const uint8_t *)msg) + RNDIS_HEADER_OFFSET + le32toh(msg->rm_infobufoffset);
+		*bufsz = le32toh(msg->rm_infobuflen);
+	}
+	return (le32toh(msg->rm_status));
+}
+
+static uint32_t
+urndis_ctrl_handle_reset(struct urndis_softc *sc,
+    const struct urndis_comp_hdr *hdr)
+{
+	const struct urndis_reset_comp *msg;
+	uint32_t rval;
+
+	msg = (const struct urndis_reset_comp *)hdr;
+
+	rval = le32toh(msg->rm_status);
+
+	DPRINTF("len %u status 0x%x "
+	    "adrreset %u\n",
+	    le32toh(msg->rm_len),
+	    rval,
+	    le32toh(msg->rm_adrreset));
+
+	if (rval != RNDIS_STATUS_SUCCESS) {
+		DPRINTF("reset failed 0x%x\n", rval);
+		return (rval);
+	}
+	if (msg->rm_adrreset != 0) {
+		struct {
+			struct urndis_set_req hdr;
+			uint32_t filter;
+		} msg_filter;
+
+		msg_filter.filter = htole32(sc->sc_filter);
+
+		rval = urndis_ctrl_set(sc, OID_GEN_CURRENT_PACKET_FILTER,
+		    &msg_filter.hdr, sizeof(msg_filter));
+
+		if (rval != RNDIS_STATUS_SUCCESS) {
+			DPRINTF("unable to reset data filters\n");
+			return (rval);
+		}
+	}
+	return (rval);
+}
+
+static uint32_t
+urndis_ctrl_init(struct urndis_softc *sc)
+{
+	struct urndis_init_req msg;
+	struct urndis_comp_hdr *hdr;
+	uint32_t rval;
+
+	msg.rm_type = htole32(REMOTE_NDIS_INITIALIZE_MSG);
+	msg.rm_len = htole32(sizeof(msg));
+	msg.rm_rid = htole32(0);
+	msg.rm_ver_major = htole32(1);
+	msg.rm_ver_minor = htole32(1);
+	msg.rm_max_xfersz = htole32(RNDIS_RX_MAXLEN);
+
+	DPRINTF("type %u len %u rid %u ver_major %u "
+	    "ver_minor %u max_xfersz %u\n",
+	    le32toh(msg.rm_type),
+	    le32toh(msg.rm_len),
+	    le32toh(msg.rm_rid),
+	    le32toh(msg.rm_ver_major),
+	    le32toh(msg.rm_ver_minor),
+	    le32toh(msg.rm_max_xfersz));
+
+	rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
+
+	if (rval != RNDIS_STATUS_SUCCESS) {
+		DPRINTF("init failed\n");
+		return (rval);
+	}
+	if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
+		DPRINTF("unable to get init response\n");
+		return (RNDIS_STATUS_FAILURE);
+	}
+	rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
+
+	return (rval);
+}
+
+#if 0
+static uint32_t
+urndis_ctrl_halt(struct urndis_softc *sc)
+{
+	struct urndis_halt_req msg;
+	uint32_t rval;
+
+	msg.rm_type = htole32(REMOTE_NDIS_HALT_MSG);
+	msg.rm_len = htole32(sizeof(msg));
+	msg.rm_rid = 0;
+
+	DPRINTF("type %u len %u rid %u\n",
+	    le32toh(msg.rm_type),
+	    le32toh(msg.rm_len),
+	    le32toh(msg.rm_rid));
+
+	rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
+
+	if (rval != RNDIS_STATUS_SUCCESS)
+		printf("halt failed\n");
+
+	return (rval);
+}
+
+#endif
+
+static uint32_t
+urndis_ctrl_query(struct urndis_softc *sc, uint32_t oid, const void **rbuf, uint16_t *rbufsz)
+{
+	struct urndis_query_req msg;
+	uint32_t rval;
+	struct urndis_comp_hdr *hdr;
+
+	msg.rm_type = htole32(REMOTE_NDIS_QUERY_MSG);
+	msg.rm_len = htole32(sizeof(msg));
+	msg.rm_rid = 0;			/* XXX */
+	msg.rm_oid = htole32(oid);
+	msg.rm_infobuflen = htole32(0);
+	msg.rm_infobufoffset = 0;
+	msg.rm_devicevchdl = 0;
+
+	DPRINTF("type %u len %u rid %u oid 0x%x "
+	    "infobuflen %u infobufoffset %u devicevchdl %u\n",
+	    le32toh(msg.rm_type),
+	    le32toh(msg.rm_len),
+	    le32toh(msg.rm_rid),
+	    le32toh(msg.rm_oid),
+	    le32toh(msg.rm_infobuflen),
+	    le32toh(msg.rm_infobufoffset),
+	    le32toh(msg.rm_devicevchdl));
+
+	rval = urndis_ctrl_send(sc, &msg, sizeof(msg));
+
+	if (rval != RNDIS_STATUS_SUCCESS) {
+		DPRINTF("query failed\n");
+		return (rval);
+	}
+	if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
+		DPRINTF("unable to get query response\n");
+		return (RNDIS_STATUS_FAILURE);
+	}
+	rval = urndis_ctrl_handle(sc, hdr, rbuf, rbufsz);
+
+	return (rval);
+}
+
+static uint32_t
+urndis_ctrl_set(struct urndis_softc *sc, uint32_t oid, struct urndis_set_req *msg, uint16_t len)
+{
+	struct urndis_comp_hdr *hdr;
+	uint32_t rval;
+	uint32_t datalen = len - sizeof(*msg);
+
+	msg->rm_type = htole32(REMOTE_NDIS_SET_MSG);
+	msg->rm_len = htole32(len);
+	msg->rm_rid = 0;		/* XXX */
+	msg->rm_oid = htole32(oid);
+	msg->rm_infobuflen = htole32(datalen);
+	if (datalen != 0) {
+		msg->rm_infobufoffset = htole32(sizeof(*msg) - RNDIS_HEADER_OFFSET);
+	} else {
+		msg->rm_infobufoffset = 0;
+	}
+	msg->rm_devicevchdl = 0;
+
+	DPRINTF("type %u len %u rid %u oid 0x%x "
+	    "infobuflen %u infobufoffset %u devicevchdl %u\n",
+	    le32toh(msg->rm_type),
+	    le32toh(msg->rm_len),
+	    le32toh(msg->rm_rid),
+	    le32toh(msg->rm_oid),
+	    le32toh(msg->rm_infobuflen),
+	    le32toh(msg->rm_infobufoffset),
+	    le32toh(msg->rm_devicevchdl));
+
+	rval = urndis_ctrl_send(sc, msg, len);
+
+	if (rval != RNDIS_STATUS_SUCCESS) {
+		DPRINTF("set failed\n");
+		return (rval);
+	}
+	if ((hdr = urndis_ctrl_recv(sc)) == NULL) {
+		DPRINTF("unable to get set response\n");
+		return (RNDIS_STATUS_FAILURE);
+	}
+	rval = urndis_ctrl_handle(sc, hdr, NULL, NULL);
+	if (rval != RNDIS_STATUS_SUCCESS)
+		DPRINTF("set failed 0x%x\n", rval);
+
+	return (rval);
+}
+
+static void
+urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
+{
+	struct urndis_softc *sc = usbd_xfer_softc(xfer);
+	struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, 0);
+	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
+	struct urndis_packet_msg msg;
+	struct mbuf *m;
+	int actlen;
+	int aframes;
+	int offset;
+
+	switch (USB_GET_STATE(xfer)) {
+	case USB_ST_TRANSFERRED:
+
+		usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
+
+		DPRINTFN(1, "received %u bytes in %u frames\n", actlen, aframes);
+
+		for (offset = 0; actlen >= (uint32_t)sizeof(msg);) {
+
+			/* copy out header */
+			usbd_copy_out(pc, offset, &msg, sizeof(msg));
+
+			if (le32toh(0x1234567U) != 0x1234567U) {
+				/* swap endianness */
+				msg.rm_type = le32toh(msg.rm_type);
+				msg.rm_len = le32toh(msg.rm_len);
+				msg.rm_dataoffset = le32toh(msg.rm_dataoffset);
+				msg.rm_datalen = le32toh(msg.rm_datalen);
+				msg.rm_oobdataoffset = le32toh(msg.rm_oobdataoffset);
+				msg.rm_oobdatalen = le32toh(msg.rm_oobdatalen);
+				msg.rm_oobdataelements = le32toh(msg.rm_oobdataelements);
+				msg.rm_pktinfooffset = le32toh(msg.rm_pktinfooffset);
+				msg.rm_pktinfolen = le32toh(msg.rm_pktinfolen);
+				msg.rm_vchandle = le32toh(msg.rm_vchandle);
+				msg.rm_reserved = le32toh(msg.rm_reserved);
+			}
+
+			DPRINTF("len %u data(off:%u len:%u) "
+			    "oobdata(off:%u len:%u nb:%u) perpacket(off:%u len:%u)\n",
+			    msg.rm_len, msg.rm_dataoffset, msg.rm_datalen,
+			    msg.rm_oobdataoffset, msg.rm_oobdatalen,
+			    msg.rm_oobdataelements, msg.rm_pktinfooffset,
+			    msg.rm_pktinfooffset);
+
+			/* sanity check the RNDIS header */
+			if (msg.rm_type != REMOTE_NDIS_PACKET_MSG) {
+				DPRINTF("invalid type 0x%x != 0x%x\n",
+				    msg.rm_type, REMOTE_NDIS_PACKET_MSG);
+				goto tr_setup;
+			} else if (msg.rm_len < (uint32_t)sizeof(msg)) {
+				DPRINTF("invalid msg len %u < %u\n",
+				    msg.rm_len, (unsigned)sizeof(msg));
+				goto tr_setup;
+			} else if (msg.rm_len > (uint32_t)actlen) {
+				DPRINTF("invalid msg len %u > buffer "
+				    "len %u\n", msg.rm_len, actlen);
+				goto tr_setup;
+			} else if (msg.rm_dataoffset >= (uint32_t)actlen) {
+				DPRINTF("invalid msg dataoffset %u > buffer "
+				    "dataoffset %u\n", msg.rm_dataoffset, actlen);
+				goto tr_setup;
+			} else if (msg.rm_datalen > (uint32_t)actlen) {
+				DPRINTF("invalid msg datalen %u > buffer "
+				    "datalen %u\n", msg.rm_datalen, actlen);
+				goto tr_setup;
+			} else if ((msg.rm_dataoffset + msg.rm_datalen +
+			    (uint32_t)__offsetof(struct urndis_packet_msg,
+			    rm_dataoffset)) > (uint32_t)actlen) {
+				DPRINTF("invalid dataoffset %u larger than %u\n",
+				    msg.rm_dataoffset + msg.rm_datalen +
+				    (uint32_t)__offsetof(struct urndis_packet_msg,
+				    rm_dataoffset));
+				goto tr_setup;
+			} else if (msg.rm_datalen < (uint32_t)sizeof(struct ether_header)) {
+				ifp->if_ierrors++;
+				DPRINTF("invalid ethernet size "
+				    "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header));
+				goto tr_setup;
+			} else if (msg.rm_datalen > (uint32_t)MCLBYTES) {
+				ifp->if_ierrors++;
+				DPRINTF("invalid ethernet size "
+				    "%u > %u\n",
+				    msg.rm_datalen, (unsigned)MCLBYTES);
+				goto tr_setup;
+			} else if (msg.rm_datalen > (uint32_t)(MHLEN - ETHER_ALIGN)) {
+				m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
+			} else {
+				m = m_gethdr(M_NOWAIT, MT_DATA);
+			}
+
+			/* check if we have a buffer */
+			if (m != NULL) {
+				m_adj(m, ETHER_ALIGN);
+
+				usbd_copy_out(pc, offset + msg.rm_dataoffset +
+				    __offsetof(struct urndis_packet_msg,
+				    rm_dataoffset), m->m_data, msg.rm_datalen);
+
+				/* enqueue */
+				uether_rxmbuf(&sc->sc_ue, m, msg.rm_datalen);
+			} else {
+				ifp->if_ierrors++;
+			}
+			offset += msg.rm_len;
+			actlen -= msg.rm_len;
+		}
+
+	case USB_ST_SETUP:
+tr_setup:
+		usbd_xfer_set_frame_len(xfer, 0, RNDIS_RX_MAXLEN);
+		usbd_xfer_set_frames(xfer, 1);
+		usbd_transfer_submit(xfer);
+		uether_rxflush(&sc->sc_ue);	/* must be last */
+		break;
+
+	default:			/* Error */
+		DPRINTFN(1, "error = %s\n", usbd_errstr(error));
+
+		if (error != USB_ERR_CANCELLED) {
+			/* try to clear stall first */
+			usbd_xfer_set_stall(xfer);
+			usbd_xfer_set_frames(xfer, 0);
+			usbd_transfer_submit(xfer);
+		}
+		break;
+	}
+}
+
+static void
+urndis_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
+{
+	struct urndis_packet_msg msg;
+	struct urndis_softc *sc = usbd_xfer_softc(xfer);
+	struct ifnet *ifp = uether_getifp(&sc->sc_ue);
+	struct mbuf *m;
+	unsigned x;
+	int actlen;
+	int aframes;
+
+	usbd_xfer_status(xfer, &actlen, NULL, &aframes, NULL);
+
+	DPRINTFN(1, "\n");
+
+	switch (USB_GET_STATE(xfer)) {
+	case USB_ST_TRANSFERRED:
+		DPRINTFN(11, "%u bytes in %u frames\n", actlen, aframes);
+
+		ifp->if_opackets++;
+
+		/* FALLTHROUGH */
+	case USB_ST_SETUP:
+tr_setup:
+		memset(&msg, 0, sizeof(msg));
+
+		for (x = 0; x != RNDIS_TX_FRAMES_MAX; x++) {
+			struct usb_page_cache *pc = usbd_xfer_get_frame(xfer, x);
+
+			usbd_xfer_set_frame_offset(xfer, x * RNDIS_TX_MAXLEN, x);
+
+	next_pkt:
+			IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
+
+			if (m == NULL)
+				break;
+
+			if ((m->m_pkthdr.len + sizeof(msg)) > RNDIS_TX_MAXLEN) {
+				DPRINTF("Too big packet\n");
+				ifp->if_oerrors++;
+
+				/* Free buffer */
+				m_freem(m);
+				goto next_pkt;
+			}
+			msg.rm_type = htole32(REMOTE_NDIS_PACKET_MSG);
+			msg.rm_len = htole32(sizeof(msg) + m->m_pkthdr.len);
+
+			msg.rm_dataoffset = htole32(RNDIS_DATA_OFFSET);
+			msg.rm_datalen = htole32(m->m_pkthdr.len);
+
+			/* copy in all data */
+			usbd_copy_in(pc, 0, &msg, sizeof(msg));
+			usbd_m_copy_in(pc, sizeof(msg), m, 0, m->m_pkthdr.len);
+			usbd_xfer_set_frame_len(xfer, x, sizeof(msg) + m->m_pkthdr.len);
+
+			/*
+			 * If there's a BPF listener, bounce a copy of
+			 * this frame to him:
+			 */
+			BPF_MTAP(ifp, m);
+
+			/* Free buffer */
+			m_freem(m);
+		}
+		if (x != 0) {
+			usbd_xfer_set_frames(xfer, x);
+			usbd_transfer_submit(xfer);
+		}
+		break;
+
+	default:			/* Error */
+		DPRINTFN(11, "transfer error, %s\n", usbd_errstr(error));
+
+		/* count output errors */
+		ifp->if_oerrors++;
+
+		if (error != USB_ERR_CANCELLED) {
+			/* try to clear stall first */
+			usbd_xfer_set_stall(xfer);
+			goto tr_setup;
+		}
+		break;
+	}
+}
+
+static void
+urndis_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
+{
+	int actlen;
+
+	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
+
+	switch (USB_GET_STATE(xfer)) {
+	case USB_ST_TRANSFERRED:
+
+		DPRINTF("Received %d bytes\n", actlen);
+
+		/* TODO: decode some indications */
+
+		/* FALLTHROUGH */
+	case USB_ST_SETUP:
+tr_setup:
+		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
+		usbd_transfer_submit(xfer);
+		break;
+
+	default:			/* Error */
+		if (error != USB_ERR_CANCELLED) {
+			/* start clear stall */
+			usbd_xfer_set_stall(xfer);
+			goto tr_setup;
+		}
+		break;
+	}
+}
diff --git a/sys/dev/usb/net/if_urndisreg.h b/sys/dev/usb/net/if_urndisreg.h
new file mode 100644
index 000000000000..315faa7ce684
--- /dev/null
+++ b/sys/dev/usb/net/if_urndisreg.h
@@ -0,0 +1,296 @@
+/*	$FreeBSD$ */
+/*	$OpenBSD: if_urndisreg.h,v 1.19 2013/11/21 14:08:05 mpi Exp $ */
+
+/*
+ * Copyright (c) 2010 Jonathan Armani <armani@openbsd.org>
+ * Copyright (c) 2010 Fabien Romano <fabien@openbsd.org>
+ * Copyright (c) 2010 Michael Knudsen <mk@openbsd.org>
+ * All rights reserved.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _IF_URNDISREG_H_
+#define	_IF_URNDISREG_H_
+
+#define	RNDIS_RESPONSE_LEN	1024	/* bytes */
+#define	RNDIS_RX_MAXLEN		(16 * 1024)
+#define	RNDIS_TX_FRAMES_MAX	8
+#define	RNDIS_TX_MAXLEN		MCLBYTES
+
+enum {
+	URNDIS_BULK_RX,
+	URNDIS_BULK_TX,
+	URNDIS_INTR_RX,
+	URNDIS_N_TRANSFER,
+};
+
+struct urndis_softc {
+
+	struct usb_ether sc_ue;
+	struct mtx sc_mtx;
+
+	/* RNDIS device info */
+	uint32_t sc_lim_pktsz;
+	uint32_t sc_filter;
+
+	struct usb_device *sc_udev;
+	struct usb_xfer *sc_xfer[URNDIS_N_TRANSFER];
+
+	uint8_t	sc_ifaceno_ctl;
+	uint8_t	sc_response_buf[RNDIS_RESPONSE_LEN] __aligned(4);
+};
+
+#define	URNDIS_LOCK(sc) mtx_lock(&(sc)->sc_mtx)
+#define	URNDIS_UNLOCK(sc) mtx_unlock(&(sc)->sc_mtx)
+#define	URNDIS_LOCK_ASSERT(sc, what) mtx_assert(&(sc)->sc_mtx, (x))
+
+#define	RNDIS_STATUS_BUFFER_OVERFLOW 	0x80000005L
+#define	RNDIS_STATUS_FAILURE 		0xC0000001L
+#define	RNDIS_STATUS_INVALID_DATA 	0xC0010015L
+#define	RNDIS_STATUS_MEDIA_CONNECT 	0x4001000BL
+#define	RNDIS_STATUS_MEDIA_DISCONNECT 	0x4001000CL
+#define	RNDIS_STATUS_NOT_SUPPORTED 	0xC00000BBL
+#define	RNDIS_STATUS_PENDING 		STATUS_PENDING	/* XXX */
+#define	RNDIS_STATUS_RESOURCES 		0xC000009AL
+#define	RNDIS_STATUS_SUCCESS 		0x00000000L
+
+#define	OID_GEN_SUPPORTED_LIST		0x00010101
+#define	OID_GEN_HARDWARE_STATUS		0x00010102
+#define	OID_GEN_MEDIA_SUPPORTED		0x00010103
+#define	OID_GEN_MEDIA_IN_USE		0x00010104
+#define	OID_GEN_MAXIMUM_LOOKAHEAD	0x00010105
+#define	OID_GEN_MAXIMUM_FRAME_SIZE	0x00010106
+#define	OID_GEN_LINK_SPEED		0x00010107
+#define	OID_GEN_TRANSMIT_BUFFER_SPACE	0x00010108
+#define	OID_GEN_RECEIVE_BUFFER_SPACE	0x00010109
+#define	OID_GEN_TRANSMIT_BLOCK_SIZE	0x0001010A
+#define	OID_GEN_RECEIVE_BLOCK_SIZE	0x0001010B
+#define	OID_GEN_VENDOR_ID		0x0001010C
+#define	OID_GEN_VENDOR_DESCRIPTION	0x0001010D
+#define	OID_GEN_CURRENT_PACKET_FILTER	0x0001010E
+#define	OID_GEN_CURRENT_LOOKAHEAD	0x0001010F
+#define	OID_GEN_DRIVER_VERSION		0x00010110
+#define	OID_GEN_MAXIMUM_TOTAL_SIZE	0x00010111
+#define	OID_GEN_PROTOCOL_OPTIONS	0x00010112
+#define	OID_GEN_MAC_OPTIONS		0x00010113
+#define	OID_GEN_MEDIA_CONNECT_STATUS	0x00010114
+#define	OID_GEN_MAXIMUM_SEND_PACKETS	0x00010115
+#define	OID_GEN_VENDOR_DRIVER_VERSION	0x00010116
+#define	OID_GEN_SUPPORTED_GUIDS		0x00010117
+#define	OID_GEN_NETWORK_LAYER_ADDRESSES	0x00010118
+#define	OID_GEN_TRANSPORT_HEADER_OFFSET	0x00010119
+#define	OID_GEN_MACHINE_NAME		0x0001021A
+#define	OID_GEN_RNDIS_CONFIG_PARAMETER	0x0001021B
+#define	OID_GEN_VLAN_ID			0x0001021C
+
+#define	OID_802_3_PERMANENT_ADDRESS	0x01010101
+#define	OID_802_3_CURRENT_ADDRESS	0x01010102
+#define	OID_802_3_MULTICAST_LIST	0x01010103
+#define	OID_802_3_MAXIMUM_LIST_SIZE	0x01010104
+#define	OID_802_3_MAC_OPTIONS		0x01010105
+#define	OID_802_3_RCV_ERROR_ALIGNMENT	0x01020101
+#define	OID_802_3_XMIT_ONE_COLLISION	0x01020102
+#define	OID_802_3_XMIT_MORE_COLLISIONS	0x01020103
+#define	OID_802_3_XMIT_DEFERRED		0x01020201
+#define	OID_802_3_XMIT_MAX_COLLISIONS	0x01020202
+#define	OID_802_3_RCV_OVERRUN		0x01020203
+#define	OID_802_3_XMIT_UNDERRUN		0x01020204
+#define	OID_802_3_XMIT_HEARTBEAT_FAILURE	0x01020205
+#define	OID_802_3_XMIT_TIMES_CRS_LOST	0x01020206
+#define	OID_802_3_XMIT_LATE_COLLISIONS	0x01020207
+
+#define	RNDIS_MEDIUM_802_3		0x00000000
+
+/* Device flags */
+#define	RNDIS_DF_CONNECTIONLESS		0x00000001
+#define	RNDIS_DF_CONNECTION_ORIENTED	0x00000002
+
+/*
+ * RNDIS data message
+ */
+#define	REMOTE_NDIS_PACKET_MSG		0x00000001
+
+struct urndis_packet_msg {
+	uint32_t rm_type;
+	uint32_t rm_len;
+	uint32_t rm_dataoffset;
+	uint32_t rm_datalen;
+	uint32_t rm_oobdataoffset;
+	uint32_t rm_oobdatalen;
+	uint32_t rm_oobdataelements;
+	uint32_t rm_pktinfooffset;
+	uint32_t rm_pktinfolen;
+	uint32_t rm_vchandle;
+	uint32_t rm_reserved;
+};
+
+/*
+ * RNDIS control messages
+ */
+struct urndis_comp_hdr {
+	uint32_t rm_type;
+	uint32_t rm_len;
+	uint32_t rm_rid;
+	uint32_t rm_status;
+};
+
+/* Initialize the device. */
+#define	REMOTE_NDIS_INITIALIZE_MSG	0x00000002
+#define	REMOTE_NDIS_INITIALIZE_CMPLT	0x80000002
+
+struct urndis_init_req {
+	uint32_t rm_type;
+	uint32_t rm_len;
+	uint32_t rm_rid;
+	uint32_t rm_ver_major;
+	uint32_t rm_ver_minor;
+	uint32_t rm_max_xfersz;
+};
+
+struct urndis_init_comp {
+	uint32_t rm_type;
+	uint32_t rm_len;
+	uint32_t rm_rid;
+	uint32_t rm_status;
+	uint32_t rm_ver_major;
+	uint32_t rm_ver_minor;
+	uint32_t rm_devflags;
+	uint32_t rm_medium;
+	uint32_t rm_pktmaxcnt;
+	uint32_t rm_pktmaxsz;
+	uint32_t rm_align;
+	uint32_t rm_aflistoffset;
+	uint32_t rm_aflistsz;
+};
+
+/* Halt the device.  No response sent. */
+#define	REMOTE_NDIS_HALT_MSG		0x00000003
+
+struct urndis_halt_req {
+	uint32_t rm_type;
+	uint32_t rm_len;
+	uint32_t rm_rid;
+};
+
+/* Send a query object. */
+#define	REMOTE_NDIS_QUERY_MSG		0x00000004
+#define	REMOTE_NDIS_QUERY_CMPLT		0x80000004
+
+struct urndis_query_req {
+	uint32_t rm_type;
+	uint32_t rm_len;
+	uint32_t rm_rid;
+	uint32_t rm_oid;
+	uint32_t rm_infobuflen;
+	uint32_t rm_infobufoffset;
+	uint32_t rm_devicevchdl;
+};
+
+struct urndis_query_comp {
+	uint32_t rm_type;
+	uint32_t rm_len;
+	uint32_t rm_rid;
+	uint32_t rm_status;
+	uint32_t rm_infobuflen;
+	uint32_t rm_infobufoffset;
+};
+
+/* Send a set object request. */
+#define	REMOTE_NDIS_SET_MSG		0x00000005
+#define	REMOTE_NDIS_SET_CMPLT		0x80000005
+
+struct urndis_set_req {
+	uint32_t rm_type;
+	uint32_t rm_len;
+	uint32_t rm_rid;
+	uint32_t rm_oid;
+	uint32_t rm_infobuflen;
+	uint32_t rm_infobufoffset;
+	uint32_t rm_devicevchdl;
+};
+
+struct urndis_set_comp {
+	uint32_t rm_type;
+	uint32_t rm_len;
+	uint32_t rm_rid;
+	uint32_t rm_status;
+};
+
+#define	REMOTE_NDIS_SET_PARAM_NUMERIC	0x00000000
+#define	REMOTE_NDIS_SET_PARAM_STRING	0x00000002
+
+struct urndis_set_parameter {
+	uint32_t rm_nameoffset;
+	uint32_t rm_namelen;
+	uint32_t rm_type;
+	uint32_t rm_valueoffset;
+	uint32_t rm_valuelen;
+};
+
+/* Perform a soft reset on the device. */
+#define	REMOTE_NDIS_RESET_MSG		0x00000006
+#define	REMOTE_NDIS_RESET_CMPLT		0x80000006
+
+struct urndis_reset_req {
+	uint32_t rm_type;
+	uint32_t rm_len;
+	uint32_t rm_rid;
+};
+
+struct urndis_reset_comp {
+	uint32_t rm_type;
+	uint32_t rm_len;
+	uint32_t rm_status;
+	uint32_t rm_adrreset;
+};
+
+/* 802.3 link-state or undefined message error. */
+#define	REMOTE_NDIS_INDICATE_STATUS_MSG	0x00000007
+
+/* Keepalive messsage.  May be sent by device. */
+#define	REMOTE_NDIS_KEEPALIVE_MSG	0x00000008
+#define	REMOTE_NDIS_KEEPALIVE_CMPLT	0x80000008
+
+struct urndis_keepalive_req {
+	uint32_t rm_type;
+	uint32_t rm_len;
+	uint32_t rm_rid;
+};
+
+struct urndis_keepalive_comp {
+	uint32_t rm_type;
+	uint32_t rm_len;
+	uint32_t rm_rid;
+	uint32_t rm_status;
+};
+
+/* packet filter bits used by OID_GEN_CURRENT_PACKET_FILTER */
+#define	RNDIS_PACKET_TYPE_DIRECTED		0x00000001
+#define	RNDIS_PACKET_TYPE_MULTICAST		0x00000002
+#define	RNDIS_PACKET_TYPE_ALL_MULTICAST		0x00000004
+#define	RNDIS_PACKET_TYPE_BROADCAST		0x00000008
+#define	RNDIS_PACKET_TYPE_SOURCE_ROUTING	0x00000010
+#define	RNDIS_PACKET_TYPE_PROMISCUOUS		0x00000020
+#define	RNDIS_PACKET_TYPE_SMT			0x00000040
+#define	RNDIS_PACKET_TYPE_ALL_LOCAL		0x00000080
+#define	RNDIS_PACKET_TYPE_GROUP			0x00001000
+#define	RNDIS_PACKET_TYPE_ALL_FUNCTIONAL	0x00002000
+#define	RNDIS_PACKET_TYPE_FUNCTIONAL		0x00004000
+#define	RNDIS_PACKET_TYPE_MAC_FRAME		0x00008000
+
+/* RNDIS offsets */
+#define	RNDIS_HEADER_OFFSET	8	/* bytes */
+#define	RNDIS_DATA_OFFSET	((uint32_t)(sizeof(struct urndis_packet_msg) - RNDIS_HEADER_OFFSET))
+
+#endif					/* _IF_URNDISREG_H_ */
diff --git a/sys/dev/usb/usb.h b/sys/dev/usb/usb.h
index 3e014521c2bc..eb664f70c5fb 100644
--- a/sys/dev/usb/usb.h
+++ b/sys/dev/usb/usb.h
@@ -500,8 +500,11 @@ typedef struct usb_interface_assoc_descriptor usb_interface_assoc_descriptor_t;
 #define	UICLASS_WIRELESS	0xe0
 #define	UISUBCLASS_RF			0x01
 #define	UIPROTO_BLUETOOTH		0x01
+#define	UIPROTO_RNDIS			0x03
 
 #define	UICLASS_IAD		0xEF	/* Interface Association Descriptor */
+#define	UISUBCLASS_SYNC			0x01
+#define	UIPROTO_ACTIVESYNC		0x01
 
 #define	UICLASS_APPL_SPEC	0xfe
 #define	UISUBCLASS_FIRMWARE_DOWNLOAD	1
diff --git a/sys/modules/usb/Makefile b/sys/modules/usb/Makefile
index 626f4b40ea94..eacd2ebcc1d0 100644
--- a/sys/modules/usb/Makefile
+++ b/sys/modules/usb/Makefile
@@ -51,6 +51,7 @@ SUBDIR += atp uhid ukbd ums udbp ufm uep wsp
 SUBDIR += ucom u3g uark ubsa ubser uchcom ucycom ufoma uftdi ugensa uipaq ulpt \
 	  umct umcs umodem umoscom uplcom uslcom uvisor uvscom
 SUBDIR += uether aue axe axge cdce cue ${_kue} mos rue smsc udav uhso ipheth
+SUBDIR += urndis
 SUBDIR += usfs umass urio
 SUBDIR += quirk template
 SUBDIR += ${_g_audio} ${_g_keyboard} ${_g_modem} ${_g_mouse}
diff --git a/sys/modules/usb/urndis/Makefile b/sys/modules/usb/urndis/Makefile
new file mode 100644
index 000000000000..929572dd6152
--- /dev/null
+++ b/sys/modules/usb/urndis/Makefile
@@ -0,0 +1,37 @@
+#
+# $FreeBSD$
+#
+# Copyright (c) 2014 Hans Petter Selasky. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+#
+
+S=     ${.CURDIR}/../../..
+
+.PATH: $S/dev/usb/net
+
+KMOD=	if_urndis
+SRCS=	opt_bus.h opt_usb.h device_if.h bus_if.h usb_if.h usbdevs.h \
+	miibus_if.h opt_inet.h \
+	if_urndis.c
+
+.include <bsd.kmod.mk>