[PATCH] usb: gadget: legacy: ether: fix RNDIS for Windows hosts

[PATCH] usb: gadget: legacy: ether: fix RNDIS for Windows hosts

[amine-ayaou]

From: Amine Ayaou <amine-ayaou@hotmail.com>

Fix RNDIS for Windows hosts by adding Microsoft OS 1.0
descriptor that allows Windows to identify the RNDIS function.

g_ether currently advertises its RNDIS configuration using
the legacy NetChip VID/PID and the RNDIS control interface
class, subclass and protocol values provided by f_rndis
(02/02/FF).

While the Linux rndis_host driver still recognizes the legacy
02/02/FF RNDIS interface descriptors, modern Windows hosts
do not bind the RNDIS driver to g_ether.

Use the existing USB composite framework support for
Microsoft OS 1.0 descriptors to advertise RNDIS when the
RNDIS function is enabled in g_ether.

Use of OS descriptor does not change the existing device IDs
or RNDIS control interface descriptors, keeping compatibility
with older hosts.
(It only adds a string descriptor at index 0xEE and handles
the associated vendor request)

Signed-off-by: Amine Ayaou <amine-ayaou@hotmail.com>
---

Notes:
    g_ether's RNDIS is useful when a network interface via USB
    is needed early during boot, before a filesystem is available
    (e.g., nfsroot).
    
    Alternatives for having a network interface via USB during
    boot are configfs and g_ncm.
    Configuring the gadget through configfs requires userspace,
    which is unavailable before mounting the NFS root when
    no initramfs is used.
    NCM (g_ncm) is not an option on hosts that only provide
    RNDIS support.
    
    Tested on BeagleBone Black with a Windows 11 host
    (Version 10.0.26200, Build 26200)
    RNDIS automatically bound with the patch.

 drivers/usb/gadget/legacy/ether.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/legacy/ether.c b/drivers/usb/gadget/legacy/ether.c
index 99c7fc0d1d597..70de686fa56b7 100644
--- a/drivers/usb/gadget/legacy/ether.c
+++ b/drivers/usb/gadget/legacy/ether.c
@@ -11,6 +11,7 @@
 
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/nls.h>
 
 #if defined USB_ETH_RNDIS
 #  undef USB_ETH_RNDIS
@@ -92,8 +93,8 @@ static inline bool has_rndis(void)
 
 #include "u_ecm.h"
 #include "u_gether.h"
-#ifdef	USB_ETH_RNDIS
 #include "u_rndis.h"
+#ifdef	USB_ETH_RNDIS
 #include "rndis.h"
 #else
 #define rndis_borrow_net(...) do {} while (0)
@@ -364,6 +365,8 @@ static int eth_bind(struct usb_composite_dev *cdev)
 
 	if (has_rndis()) {
 		/* RNDIS plus ECM-or-Subset */
+		struct f_rndis_opts *rndis_opts = NULL;
+
 		gether_set_gadget(net, cdev->gadget);
 		status = gether_register_netdev(net);
 		if (status)
@@ -387,6 +390,18 @@ static int eth_bind(struct usb_composite_dev *cdev)
 		device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM);
 		device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM);
 		device_desc.bNumConfigurations = 2;
+
+		/* Configure Microsoft OS 1.0 descriptors for RNDIS. */
+		cdev->os_desc_config = &rndis_config_driver;
+		cdev->use_os_string = true;
+		cdev->b_vendor_code = 0xcd; /* arbitrary */
+		utf8s_to_utf16s("MSFT100", 7,
+			UTF16_LITTLE_ENDIAN, (wchar_t *)cdev->qw_sign,
+			OS_STRING_QW_SIGN_LEN / 2);
+		rndis_opts = container_of(fi_rndis, struct f_rndis_opts,
+					  func_inst);
+		memcpy(rndis_opts->rndis_ext_compat_id,
+			"RNDIS\0\0\0" "5162001", 16);
 	}
 
 	/* Allocate string descriptor numbers ... note that string
-- 
2.53.0

Re: [PATCH] usb: gadget: legacy: ether: fix RNDIS for Windows hosts

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] usb: gadget: resource leak in composite_bind() when OS desc prep fails
--

commit 9ae1a82cebd8ee193e2a0cd2544effdf04549a00
Author: Amine Ayaou <amine-ayaou@hotmail.com>

usb: gadget: legacy: ether: fix RNDIS for Windows hosts

This commit configures Microsoft OS 1.0 descriptors in g_ether when the RNDIS
function is enabled so modern Windows hosts can bind the RNDIS driver to the
legacy gadget.

> diff --git a/drivers/usb/gadget/legacy/ether.c b/drivers/usb/gadget/legacy/ether.c
> index 99c7fc0d1d597..70de686fa56b7 100644
> --- a/drivers/usb/gadget/legacy/ether.c
> +++ b/drivers/usb/gadget/legacy/ether.c
[ ... ]
> @@ -387,6 +390,18 @@ static int eth_bind(struct usb_composite_dev *cdev)
>  		device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM);
>  		device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM);
>  		device_desc.bNumConfigurations = 2;
> +
> +		/* Configure Microsoft OS 1.0 descriptors for RNDIS. */
> +		cdev->os_desc_config = &rndis_config_driver;
> +		cdev->use_os_string = true;

[Severity: Medium]
Can setting cdev->use_os_string in eth_bind() leave eth_unbind() skipped if
composite_os_desc_req_prepare() fails in composite_bind()?

In drivers/usb/gadget/composite.c:composite_bind(), composite->bind(cdev)
runs before the cdev->use_os_string check:

	status = composite->bind(cdev);
	if (status < 0)
		goto fail;

	if (cdev->use_os_string) {
		status = composite_os_desc_req_prepare(cdev, gadget->ep0);
		if (status)
			goto fail;
	}
	...
fail:
	__composite_unbind(gadget, false);
	return status;

When eth_bind() returns 0, it has already registered net via
gether_register_netdev(net) with bound set to true, allocated fi_rndis and
fi_eem/fi_ecm/fi_geth, allocated f_rndis and f_eem/f_ecm/f_geth via
usb_add_config(), and optionally allocated otg_desc[0].

If composite_os_desc_req_prepare() then fails with -ENOMEM, composite_bind()
calls __composite_unbind(gadget, false). In __composite_unbind():

	while (!list_empty(&cdev->configs)) {
		struct usb_configuration	*c;
		c = list_first_entry(&cdev->configs,
				struct usb_configuration, list);
		remove_config(cdev, c);
	}
	if (cdev->driver->unbind && unbind_driver)
		cdev->driver->unbind(cdev);

Because unbind_driver is false, eth_unbind() is not called. While
remove_config() unbinds the functions from each configuration, the function
unbind callbacks do not unregister or free net when bound and borrowed_net
are true. Without eth_unbind() running:

static int eth_unbind(struct usb_composite_dev *cdev)
{
	if (has_rndis()) {
		usb_put_function(f_rndis);
		usb_put_function_instance(fi_rndis);
	}
	if (use_eem) {
		usb_put_function(f_eem);
		usb_put_function_instance(fi_eem);
	} else if (can_support_ecm(cdev->gadget)) {
		usb_put_function(f_ecm);
		usb_put_function_instance(fi_ecm);
	} else {
		usb_put_function(f_geth);
		usb_put_function_instance(fi_geth);
	}
	kfree(otg_desc[0]);
	otg_desc[0] = NULL;

	return 0;
}

wouldn't this leak f_rndis, fi_rndis, f_eem/f_ecm/f_geth,
fi_eem/fi_ecm/fi_geth, and otg_desc[0], as well as leave net registered
after cdev is freed?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/MRVP191MB2786AD66C3EAB9F32E5B84F9EF6D2@MRVP191MB2786.EURP191.PROD.OUTLOOK.COM?part=1

Re: [PATCH] usb: gadget: legacy: ether: fix RNDIS for Windows hosts

[Greg KH]

On Fri, Oct 30, 2026 at 10:17:06AM +0100, amine-ayaou@hotmail.com wrote:
> From: Amine Ayaou <amine-ayaou@hotmail.com>
> 
> Fix RNDIS for Windows hosts by adding Microsoft OS 1.0
> descriptor that allows Windows to identify the RNDIS function.

No, please no.

RNDIS should NEVER be used, it's not required by any shipping OS that I
know of these days, do you?

Why do you want this?  And are you really still using the "legacy" USB
gadget drivers?  If so, why?  What is preventing you from using the
"new" ones?

I ask as we are about to delete these legacy drivers and I don't want to
have anyone add new features to them.

> g_ether currently advertises its RNDIS configuration using
> the legacy NetChip VID/PID and the RNDIS control interface
> class, subclass and protocol values provided by f_rndis
> (02/02/FF).
> 
> While the Linux rndis_host driver still recognizes the legacy
> 02/02/FF RNDIS interface descriptors, modern Windows hosts
> do not bind the RNDIS driver to g_ether.

modern Windows hosts know that rndis is a lame protocol and should never
be used :)

Seriously, it's a broken one, there is no security for it and it's only
good for very very old desktop systems that never were updated to a
modern operating system.  And even then I would argue it shouldn't be
used.

> Notes:
>     g_ether's RNDIS is useful when a network interface via USB
>     is needed early during boot, before a filesystem is available
>     (e.g., nfsroot).

useful for which side?  What can you do with this "during boot"?  And
you are connecting to a nfs windows server with it?

>     Alternatives for having a network interface via USB during
>     boot are configfs and g_ncm.

YEs.

>     Configuring the gadget through configfs requires userspace,
>     which is unavailable before mounting the NFS root when
>     no initramfs is used.

Then use an initramfs :)

>     NCM (g_ncm) is not an option on hosts that only provide
>     RNDIS support.

What hosts exactly are that?  And why would you connect to them?

>     Tested on BeagleBone Black with a Windows 11 host
>     (Version 10.0.26200, Build 26200)
>     RNDIS automatically bound with the patch.

And did your nfs server on that host work properly?

Sorry for the rant, but I really want to delete this stuff as it should
never be used anymore...

thanks,

greg k-h