1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * f_eem.c -- USB CDC Ethernet (EEM) link function driver 4 * 5 * Copyright (C) 2003-2005,2008 David Brownell 6 * Copyright (C) 2008 Nokia Corporation 7 * Copyright (C) 2009 EF Johnson Technologies 8 */ 9 10 #include <linux/cleanup.h> 11 #include <linux/kernel.h> 12 #include <linux/module.h> 13 #include <linux/device.h> 14 #include <linux/etherdevice.h> 15 #include <linux/crc32.h> 16 #include <linux/slab.h> 17 18 #include "u_ether.h" 19 #include "u_ether_configfs.h" 20 #include "u_eem.h" 21 22 #define EEM_HLEN 2 23 24 /* 25 * This function is a "CDC Ethernet Emulation Model" (CDC EEM) 26 * Ethernet link. 27 */ 28 29 struct f_eem { 30 struct gether port; 31 u8 ctrl_id; 32 }; 33 34 struct in_context { 35 struct sk_buff *skb; 36 struct usb_ep *ep; 37 }; 38 39 static inline struct f_eem *func_to_eem(struct usb_function *f) 40 { 41 return container_of(f, struct f_eem, port.func); 42 } 43 44 /*-------------------------------------------------------------------------*/ 45 46 /* interface descriptor: */ 47 48 static struct usb_interface_descriptor eem_intf = { 49 .bLength = sizeof eem_intf, 50 .bDescriptorType = USB_DT_INTERFACE, 51 52 /* .bInterfaceNumber = DYNAMIC */ 53 .bNumEndpoints = 2, 54 .bInterfaceClass = USB_CLASS_COMM, 55 .bInterfaceSubClass = USB_CDC_SUBCLASS_EEM, 56 .bInterfaceProtocol = USB_CDC_PROTO_EEM, 57 /* .iInterface = DYNAMIC */ 58 }; 59 60 /* full speed support: */ 61 62 static struct usb_endpoint_descriptor eem_fs_in_desc = { 63 .bLength = USB_DT_ENDPOINT_SIZE, 64 .bDescriptorType = USB_DT_ENDPOINT, 65 66 .bEndpointAddress = USB_DIR_IN, 67 .bmAttributes = USB_ENDPOINT_XFER_BULK, 68 }; 69 70 static struct usb_endpoint_descriptor eem_fs_out_desc = { 71 .bLength = USB_DT_ENDPOINT_SIZE, 72 .bDescriptorType = USB_DT_ENDPOINT, 73 74 .bEndpointAddress = USB_DIR_OUT, 75 .bmAttributes = USB_ENDPOINT_XFER_BULK, 76 }; 77 78 static struct usb_descriptor_header *eem_fs_function[] = { 79 /* CDC EEM control descriptors */ 80 (struct usb_descriptor_header *) &eem_intf, 81 (struct usb_descriptor_header *) &eem_fs_in_desc, 82 (struct usb_descriptor_header *) &eem_fs_out_desc, 83 NULL, 84 }; 85 86 /* high speed support: */ 87 88 static struct usb_endpoint_descriptor eem_hs_in_desc = { 89 .bLength = USB_DT_ENDPOINT_SIZE, 90 .bDescriptorType = USB_DT_ENDPOINT, 91 92 .bEndpointAddress = USB_DIR_IN, 93 .bmAttributes = USB_ENDPOINT_XFER_BULK, 94 .wMaxPacketSize = cpu_to_le16(512), 95 }; 96 97 static struct usb_endpoint_descriptor eem_hs_out_desc = { 98 .bLength = USB_DT_ENDPOINT_SIZE, 99 .bDescriptorType = USB_DT_ENDPOINT, 100 101 .bEndpointAddress = USB_DIR_OUT, 102 .bmAttributes = USB_ENDPOINT_XFER_BULK, 103 .wMaxPacketSize = cpu_to_le16(512), 104 }; 105 106 static struct usb_descriptor_header *eem_hs_function[] = { 107 /* CDC EEM control descriptors */ 108 (struct usb_descriptor_header *) &eem_intf, 109 (struct usb_descriptor_header *) &eem_hs_in_desc, 110 (struct usb_descriptor_header *) &eem_hs_out_desc, 111 NULL, 112 }; 113 114 /* super speed support: */ 115 116 static struct usb_endpoint_descriptor eem_ss_in_desc = { 117 .bLength = USB_DT_ENDPOINT_SIZE, 118 .bDescriptorType = USB_DT_ENDPOINT, 119 120 .bEndpointAddress = USB_DIR_IN, 121 .bmAttributes = USB_ENDPOINT_XFER_BULK, 122 .wMaxPacketSize = cpu_to_le16(1024), 123 }; 124 125 static struct usb_endpoint_descriptor eem_ss_out_desc = { 126 .bLength = USB_DT_ENDPOINT_SIZE, 127 .bDescriptorType = USB_DT_ENDPOINT, 128 129 .bEndpointAddress = USB_DIR_OUT, 130 .bmAttributes = USB_ENDPOINT_XFER_BULK, 131 .wMaxPacketSize = cpu_to_le16(1024), 132 }; 133 134 static struct usb_ss_ep_comp_descriptor eem_ss_bulk_comp_desc = { 135 .bLength = sizeof eem_ss_bulk_comp_desc, 136 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP, 137 138 /* the following 2 values can be tweaked if necessary */ 139 /* .bMaxBurst = 0, */ 140 /* .bmAttributes = 0, */ 141 }; 142 143 static struct usb_descriptor_header *eem_ss_function[] = { 144 /* CDC EEM control descriptors */ 145 (struct usb_descriptor_header *) &eem_intf, 146 (struct usb_descriptor_header *) &eem_ss_in_desc, 147 (struct usb_descriptor_header *) &eem_ss_bulk_comp_desc, 148 (struct usb_descriptor_header *) &eem_ss_out_desc, 149 (struct usb_descriptor_header *) &eem_ss_bulk_comp_desc, 150 NULL, 151 }; 152 153 /* string descriptors: */ 154 155 static struct usb_string eem_string_defs[] = { 156 [0].s = "CDC Ethernet Emulation Model (EEM)", 157 { } /* end of list */ 158 }; 159 160 static struct usb_gadget_strings eem_string_table = { 161 .language = 0x0409, /* en-us */ 162 .strings = eem_string_defs, 163 }; 164 165 static struct usb_gadget_strings *eem_strings[] = { 166 &eem_string_table, 167 NULL, 168 }; 169 170 /*-------------------------------------------------------------------------*/ 171 172 static int eem_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl) 173 { 174 struct usb_composite_dev *cdev = f->config->cdev; 175 u16 w_index = le16_to_cpu(ctrl->wIndex); 176 u16 w_value = le16_to_cpu(ctrl->wValue); 177 u16 w_length = le16_to_cpu(ctrl->wLength); 178 179 DBG(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n", 180 ctrl->bRequestType, ctrl->bRequest, 181 w_value, w_index, w_length); 182 183 /* device either stalls (value < 0) or reports success */ 184 return -EOPNOTSUPP; 185 } 186 187 188 static int eem_set_alt(struct usb_function *f, unsigned intf, unsigned alt) 189 { 190 struct f_eem *eem = func_to_eem(f); 191 struct usb_composite_dev *cdev = f->config->cdev; 192 struct net_device *net; 193 194 /* we know alt == 0, so this is an activation or a reset */ 195 if (alt != 0) 196 goto fail; 197 198 if (intf == eem->ctrl_id) { 199 DBG(cdev, "reset eem\n"); 200 gether_disconnect(&eem->port); 201 202 if (!eem->port.in_ep->desc || !eem->port.out_ep->desc) { 203 DBG(cdev, "init eem\n"); 204 if (config_ep_by_speed(cdev->gadget, f, 205 eem->port.in_ep) || 206 config_ep_by_speed(cdev->gadget, f, 207 eem->port.out_ep)) { 208 eem->port.in_ep->desc = NULL; 209 eem->port.out_ep->desc = NULL; 210 goto fail; 211 } 212 } 213 214 /* zlps should not occur because zero-length EEM packets 215 * will be inserted in those cases where they would occur 216 */ 217 eem->port.is_zlp_ok = 1; 218 eem->port.cdc_filter = DEFAULT_FILTER; 219 DBG(cdev, "activate eem\n"); 220 net = gether_connect(&eem->port); 221 if (IS_ERR(net)) 222 return PTR_ERR(net); 223 } else 224 goto fail; 225 226 return 0; 227 fail: 228 return -EINVAL; 229 } 230 231 static void eem_disable(struct usb_function *f) 232 { 233 struct f_eem *eem = func_to_eem(f); 234 struct usb_composite_dev *cdev = f->config->cdev; 235 236 DBG(cdev, "eem deactivated\n"); 237 238 if (eem->port.in_ep->enabled) 239 gether_disconnect(&eem->port); 240 } 241 242 /*-------------------------------------------------------------------------*/ 243 244 /* EEM function driver setup/binding */ 245 246 static int eem_bind(struct usb_configuration *c, struct usb_function *f) 247 { 248 struct usb_composite_dev *cdev = c->cdev; 249 struct f_eem *eem = func_to_eem(f); 250 struct usb_string *us; 251 int status; 252 struct usb_ep *ep; 253 254 struct f_eem_opts *eem_opts; 255 struct net_device *net __free(detach_gadget) = NULL; 256 257 eem_opts = container_of(f->fi, struct f_eem_opts, func_inst); 258 259 scoped_guard(mutex, &eem_opts->lock) 260 if (eem_opts->bind_count == 0 && !eem_opts->bound) { 261 if (!device_is_registered(&eem_opts->net->dev)) { 262 gether_set_gadget(eem_opts->net, cdev->gadget); 263 status = gether_register_netdev(eem_opts->net); 264 } else 265 status = gether_attach_gadget(eem_opts->net, cdev->gadget); 266 267 if (status) 268 return status; 269 net = eem_opts->net; 270 } 271 272 us = usb_gstrings_attach(cdev, eem_strings, 273 ARRAY_SIZE(eem_string_defs)); 274 if (IS_ERR(us)) 275 return PTR_ERR(us); 276 eem_intf.iInterface = us[0].id; 277 278 /* allocate instance-specific interface IDs */ 279 status = usb_interface_id(c, f); 280 if (status < 0) 281 return status; 282 eem->ctrl_id = status; 283 eem_intf.bInterfaceNumber = status; 284 285 /* allocate instance-specific endpoints */ 286 ep = usb_ep_autoconfig(cdev->gadget, &eem_fs_in_desc); 287 if (!ep) 288 return -ENODEV; 289 eem->port.in_ep = ep; 290 291 ep = usb_ep_autoconfig(cdev->gadget, &eem_fs_out_desc); 292 if (!ep) 293 return -ENODEV; 294 eem->port.out_ep = ep; 295 296 /* support all relevant hardware speeds... we expect that when 297 * hardware is dual speed, all bulk-capable endpoints work at 298 * both speeds 299 */ 300 eem_hs_in_desc.bEndpointAddress = eem_fs_in_desc.bEndpointAddress; 301 eem_hs_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress; 302 303 eem_ss_in_desc.bEndpointAddress = eem_fs_in_desc.bEndpointAddress; 304 eem_ss_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress; 305 306 status = usb_assign_descriptors(f, eem_fs_function, eem_hs_function, 307 eem_ss_function, eem_ss_function); 308 if (status) 309 return status; 310 311 eem_opts->bind_count++; 312 retain_and_null_ptr(net); 313 314 DBG(cdev, "CDC Ethernet (EEM): IN/%s OUT/%s\n", 315 eem->port.in_ep->name, eem->port.out_ep->name); 316 return 0; 317 } 318 319 static void eem_cmd_complete(struct usb_ep *ep, struct usb_request *req) 320 { 321 struct in_context *ctx = req->context; 322 323 dev_kfree_skb_any(ctx->skb); 324 kfree(req->buf); 325 usb_ep_free_request(ctx->ep, req); 326 kfree(ctx); 327 } 328 329 /* 330 * Add the EEM header and ethernet checksum. 331 * We currently do not attempt to put multiple ethernet frames 332 * into a single USB transfer 333 */ 334 static struct sk_buff *eem_wrap(struct gether *port, struct sk_buff *skb) 335 { 336 struct sk_buff *skb2 = NULL; 337 struct usb_ep *in = port->in_ep; 338 int headroom, tailroom, padlen = 0; 339 u16 len; 340 341 if (!skb) 342 return NULL; 343 344 len = skb->len; 345 headroom = skb_headroom(skb); 346 tailroom = skb_tailroom(skb); 347 348 /* When (len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) is 0, 349 * stick two bytes of zero-length EEM packet on the end. 350 */ 351 if (((len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) == 0) 352 padlen += 2; 353 354 if ((tailroom >= (ETH_FCS_LEN + padlen)) && 355 (headroom >= EEM_HLEN) && !skb_cloned(skb)) 356 goto done; 357 358 skb2 = skb_copy_expand(skb, EEM_HLEN, ETH_FCS_LEN + padlen, GFP_ATOMIC); 359 dev_kfree_skb_any(skb); 360 skb = skb2; 361 if (!skb) 362 return skb; 363 364 done: 365 /* use the "no CRC" option */ 366 put_unaligned_be32(0xdeadbeef, skb_put(skb, 4)); 367 368 /* EEM packet header format: 369 * b0..13: length of ethernet frame 370 * b14: bmCRC (0 == sentinel CRC) 371 * b15: bmType (0 == data) 372 */ 373 len = skb->len; 374 put_unaligned_le16(len & 0x3FFF, skb_push(skb, 2)); 375 376 /* add a zero-length EEM packet, if needed */ 377 if (padlen) 378 put_unaligned_le16(0, skb_put(skb, 2)); 379 380 return skb; 381 } 382 383 /* 384 * Remove the EEM header. Note that there can be many EEM packets in a single 385 * USB transfer, so we need to break them out and handle them independently. 386 */ 387 static int eem_unwrap(struct gether *port, 388 struct sk_buff *skb, 389 struct sk_buff_head *list) 390 { 391 struct usb_composite_dev *cdev = port->func.config->cdev; 392 int status = 0; 393 394 do { 395 struct sk_buff *skb2; 396 u16 header; 397 u16 len = 0; 398 399 if (skb->len < EEM_HLEN) { 400 status = -EINVAL; 401 DBG(cdev, "invalid EEM header\n"); 402 goto error; 403 } 404 405 /* remove the EEM header */ 406 header = get_unaligned_le16(skb->data); 407 skb_pull(skb, EEM_HLEN); 408 409 /* EEM packet header format: 410 * b0..14: EEM type dependent (data or command) 411 * b15: bmType (0 == data, 1 == command) 412 */ 413 if (header & BIT(15)) { 414 struct usb_request *req; 415 struct in_context *ctx; 416 struct usb_ep *ep; 417 u16 bmEEMCmd; 418 419 /* EEM command packet format: 420 * b0..10: bmEEMCmdParam 421 * b11..13: bmEEMCmd 422 * b14: reserved (must be zero) 423 * b15: bmType (1 == command) 424 */ 425 if (header & BIT(14)) 426 continue; 427 428 bmEEMCmd = (header >> 11) & 0x7; 429 switch (bmEEMCmd) { 430 case 0: /* echo */ 431 len = header & 0x7FF; 432 if (skb->len < len) { 433 status = -EOVERFLOW; 434 goto error; 435 } 436 437 skb2 = skb_clone(skb, GFP_ATOMIC); 438 if (unlikely(!skb2)) { 439 DBG(cdev, "EEM echo response error\n"); 440 goto next; 441 } 442 skb_trim(skb2, len); 443 put_unaligned_le16(BIT(15) | BIT(11) | len, 444 skb_push(skb2, 2)); 445 446 ep = port->in_ep; 447 req = usb_ep_alloc_request(ep, GFP_ATOMIC); 448 if (!req) { 449 dev_kfree_skb_any(skb2); 450 goto next; 451 } 452 453 req->buf = kmalloc(skb2->len, GFP_KERNEL); 454 if (!req->buf) { 455 usb_ep_free_request(ep, req); 456 dev_kfree_skb_any(skb2); 457 goto next; 458 } 459 460 ctx = kmalloc_obj(*ctx); 461 if (!ctx) { 462 kfree(req->buf); 463 usb_ep_free_request(ep, req); 464 dev_kfree_skb_any(skb2); 465 goto next; 466 } 467 ctx->skb = skb2; 468 ctx->ep = ep; 469 470 skb_copy_bits(skb2, 0, req->buf, skb2->len); 471 req->length = skb2->len; 472 req->complete = eem_cmd_complete; 473 req->zero = 1; 474 req->context = ctx; 475 if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC)) { 476 DBG(cdev, "echo response queue fail\n"); 477 kfree(ctx); 478 kfree(req->buf); 479 usb_ep_free_request(ep, req); 480 dev_kfree_skb_any(skb2); 481 } 482 break; 483 484 case 1: /* echo response */ 485 case 2: /* suspend hint */ 486 case 3: /* response hint */ 487 case 4: /* response complete hint */ 488 case 5: /* tickle */ 489 default: /* reserved */ 490 continue; 491 } 492 } else { 493 u32 crc, crc2; 494 struct sk_buff *skb3; 495 496 /* check for zero-length EEM packet */ 497 if (header == 0) 498 continue; 499 500 /* EEM data packet format: 501 * b0..13: length of ethernet frame 502 * b14: bmCRC (0 == sentinel, 1 == calculated) 503 * b15: bmType (0 == data) 504 */ 505 len = header & 0x3FFF; 506 if ((skb->len < len) 507 || (len < (ETH_HLEN + ETH_FCS_LEN))) { 508 status = -EINVAL; 509 goto error; 510 } 511 512 /* validate CRC */ 513 if (header & BIT(14)) { 514 crc = get_unaligned_le32(skb->data + len 515 - ETH_FCS_LEN); 516 crc2 = ~crc32_le(~0, 517 skb->data, len - ETH_FCS_LEN); 518 } else { 519 crc = get_unaligned_be32(skb->data + len 520 - ETH_FCS_LEN); 521 crc2 = 0xdeadbeef; 522 } 523 if (crc != crc2) { 524 DBG(cdev, "invalid EEM CRC\n"); 525 goto next; 526 } 527 528 skb2 = skb_clone(skb, GFP_ATOMIC); 529 if (unlikely(!skb2)) { 530 DBG(cdev, "unable to unframe EEM packet\n"); 531 goto next; 532 } 533 skb_trim(skb2, len - ETH_FCS_LEN); 534 535 skb3 = skb_copy_expand(skb2, 536 NET_IP_ALIGN, 537 0, 538 GFP_ATOMIC); 539 if (unlikely(!skb3)) { 540 dev_kfree_skb_any(skb2); 541 goto next; 542 } 543 dev_kfree_skb_any(skb2); 544 skb_queue_tail(list, skb3); 545 } 546 next: 547 skb_pull(skb, len); 548 } while (skb->len); 549 550 error: 551 dev_kfree_skb_any(skb); 552 return status; 553 } 554 555 static inline struct f_eem_opts *to_f_eem_opts(struct config_item *item) 556 { 557 return container_of(to_config_group(item), struct f_eem_opts, 558 func_inst.group); 559 } 560 561 /* f_eem_item_ops */ 562 USB_ETHERNET_CONFIGFS_ITEM(eem); 563 564 /* f_eem_opts_dev_addr */ 565 USB_ETHERNET_CONFIGFS_ITEM_ATTR_DEV_ADDR(eem); 566 567 /* f_eem_opts_host_addr */ 568 USB_ETHERNET_CONFIGFS_ITEM_ATTR_HOST_ADDR(eem); 569 570 /* f_eem_opts_qmult */ 571 USB_ETHERNET_CONFIGFS_ITEM_ATTR_QMULT(eem); 572 573 /* f_eem_opts_ifname */ 574 USB_ETHERNET_CONFIGFS_ITEM_ATTR_IFNAME(eem); 575 576 static struct configfs_attribute *eem_attrs[] = { 577 &eem_opts_attr_dev_addr, 578 &eem_opts_attr_host_addr, 579 &eem_opts_attr_qmult, 580 &eem_opts_attr_ifname, 581 NULL, 582 }; 583 584 static const struct config_item_type eem_func_type = { 585 .ct_item_ops = &eem_item_ops, 586 .ct_attrs = eem_attrs, 587 .ct_owner = THIS_MODULE, 588 }; 589 590 static void eem_free_inst(struct usb_function_instance *f) 591 { 592 struct f_eem_opts *opts; 593 594 opts = container_of(f, struct f_eem_opts, func_inst); 595 if (device_is_registered(&opts->net->dev)) 596 gether_cleanup(netdev_priv(opts->net)); 597 else 598 free_netdev(opts->net); 599 kfree(opts); 600 } 601 602 static struct usb_function_instance *eem_alloc_inst(void) 603 { 604 struct f_eem_opts *opts; 605 606 opts = kzalloc_obj(*opts); 607 if (!opts) 608 return ERR_PTR(-ENOMEM); 609 mutex_init(&opts->lock); 610 opts->func_inst.free_func_inst = eem_free_inst; 611 opts->net = gether_setup_default(); 612 if (IS_ERR(opts->net)) { 613 struct net_device *net = opts->net; 614 kfree(opts); 615 return ERR_CAST(net); 616 } 617 618 config_group_init_type_name(&opts->func_inst.group, "", &eem_func_type); 619 620 return &opts->func_inst; 621 } 622 623 static void eem_free(struct usb_function *f) 624 { 625 struct f_eem *eem; 626 struct f_eem_opts *opts; 627 628 eem = func_to_eem(f); 629 opts = container_of(f->fi, struct f_eem_opts, func_inst); 630 kfree(eem); 631 mutex_lock(&opts->lock); 632 opts->refcnt--; 633 mutex_unlock(&opts->lock); 634 } 635 636 static void eem_unbind(struct usb_configuration *c, struct usb_function *f) 637 { 638 struct f_eem_opts *opts; 639 640 DBG(c->cdev, "eem unbind\n"); 641 642 opts = container_of(f->fi, struct f_eem_opts, func_inst); 643 644 usb_free_all_descriptors(f); 645 646 opts->bind_count--; 647 if (opts->bind_count == 0 && !opts->bound) 648 gether_detach_gadget(opts->net); 649 } 650 651 static struct usb_function *eem_alloc(struct usb_function_instance *fi) 652 { 653 struct f_eem *eem; 654 struct f_eem_opts *opts; 655 656 /* allocate and initialize one new instance */ 657 eem = kzalloc_obj(*eem); 658 if (!eem) 659 return ERR_PTR(-ENOMEM); 660 661 opts = container_of(fi, struct f_eem_opts, func_inst); 662 mutex_lock(&opts->lock); 663 opts->refcnt++; 664 665 eem->port.ioport = netdev_priv(opts->net); 666 mutex_unlock(&opts->lock); 667 eem->port.cdc_filter = DEFAULT_FILTER; 668 669 eem->port.func.name = "cdc_eem"; 670 /* descriptors are per-instance copies */ 671 eem->port.func.bind = eem_bind; 672 eem->port.func.unbind = eem_unbind; 673 eem->port.func.set_alt = eem_set_alt; 674 eem->port.func.setup = eem_setup; 675 eem->port.func.disable = eem_disable; 676 eem->port.func.free_func = eem_free; 677 eem->port.wrap = eem_wrap; 678 eem->port.unwrap = eem_unwrap; 679 eem->port.header_len = EEM_HLEN; 680 681 return &eem->port.func; 682 } 683 684 DECLARE_USB_FUNCTION_INIT(eem, eem_alloc_inst, eem_alloc); 685 MODULE_DESCRIPTION("USB CDC Ethernet (EEM) link function driver"); 686 MODULE_LICENSE("GPL"); 687 MODULE_AUTHOR("David Brownell"); 688