1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * f_eem.c -- USB CDC Ethernet (EEM) link function driver 4 * 5 * Copyright (C) 2003-2005,2008 David Brownell 6 * Copyright (C) 2008 Nokia Corporation 7 * Copyright (C) 2009 EF Johnson Technologies 8 */ 9 10 #include <linux/kernel.h> 11 #include <linux/module.h> 12 #include <linux/device.h> 13 #include <linux/etherdevice.h> 14 #include <linux/crc32.h> 15 #include <linux/slab.h> 16 17 #include "u_ether.h" 18 #include "u_ether_configfs.h" 19 #include "u_eem.h" 20 21 #define EEM_HLEN 2 22 23 /* 24 * This function is a "CDC Ethernet Emulation Model" (CDC EEM) 25 * Ethernet link. 26 */ 27 28 struct f_eem { 29 struct gether port; 30 u8 ctrl_id; 31 }; 32 33 struct in_context { 34 struct sk_buff *skb; 35 struct usb_ep *ep; 36 }; 37 38 static inline struct f_eem *func_to_eem(struct usb_function *f) 39 { 40 return container_of(f, struct f_eem, port.func); 41 } 42 43 /*-------------------------------------------------------------------------*/ 44 45 /* interface descriptor: */ 46 47 static struct usb_interface_descriptor eem_intf = { 48 .bLength = sizeof eem_intf, 49 .bDescriptorType = USB_DT_INTERFACE, 50 51 /* .bInterfaceNumber = DYNAMIC */ 52 .bNumEndpoints = 2, 53 .bInterfaceClass = USB_CLASS_COMM, 54 .bInterfaceSubClass = USB_CDC_SUBCLASS_EEM, 55 .bInterfaceProtocol = USB_CDC_PROTO_EEM, 56 /* .iInterface = DYNAMIC */ 57 }; 58 59 /* full speed support: */ 60 61 static struct usb_endpoint_descriptor eem_fs_in_desc = { 62 .bLength = USB_DT_ENDPOINT_SIZE, 63 .bDescriptorType = USB_DT_ENDPOINT, 64 65 .bEndpointAddress = USB_DIR_IN, 66 .bmAttributes = USB_ENDPOINT_XFER_BULK, 67 }; 68 69 static struct usb_endpoint_descriptor eem_fs_out_desc = { 70 .bLength = USB_DT_ENDPOINT_SIZE, 71 .bDescriptorType = USB_DT_ENDPOINT, 72 73 .bEndpointAddress = USB_DIR_OUT, 74 .bmAttributes = USB_ENDPOINT_XFER_BULK, 75 }; 76 77 static struct usb_descriptor_header *eem_fs_function[] = { 78 /* CDC EEM control descriptors */ 79 (struct usb_descriptor_header *) &eem_intf, 80 (struct usb_descriptor_header *) &eem_fs_in_desc, 81 (struct usb_descriptor_header *) &eem_fs_out_desc, 82 NULL, 83 }; 84 85 /* high speed support: */ 86 87 static struct usb_endpoint_descriptor eem_hs_in_desc = { 88 .bLength = USB_DT_ENDPOINT_SIZE, 89 .bDescriptorType = USB_DT_ENDPOINT, 90 91 .bEndpointAddress = USB_DIR_IN, 92 .bmAttributes = USB_ENDPOINT_XFER_BULK, 93 .wMaxPacketSize = cpu_to_le16(512), 94 }; 95 96 static struct usb_endpoint_descriptor eem_hs_out_desc = { 97 .bLength = USB_DT_ENDPOINT_SIZE, 98 .bDescriptorType = USB_DT_ENDPOINT, 99 100 .bEndpointAddress = USB_DIR_OUT, 101 .bmAttributes = USB_ENDPOINT_XFER_BULK, 102 .wMaxPacketSize = cpu_to_le16(512), 103 }; 104 105 static struct usb_descriptor_header *eem_hs_function[] = { 106 /* CDC EEM control descriptors */ 107 (struct usb_descriptor_header *) &eem_intf, 108 (struct usb_descriptor_header *) &eem_hs_in_desc, 109 (struct usb_descriptor_header *) &eem_hs_out_desc, 110 NULL, 111 }; 112 113 /* super speed support: */ 114 115 static struct usb_endpoint_descriptor eem_ss_in_desc = { 116 .bLength = USB_DT_ENDPOINT_SIZE, 117 .bDescriptorType = USB_DT_ENDPOINT, 118 119 .bEndpointAddress = USB_DIR_IN, 120 .bmAttributes = USB_ENDPOINT_XFER_BULK, 121 .wMaxPacketSize = cpu_to_le16(1024), 122 }; 123 124 static struct usb_endpoint_descriptor eem_ss_out_desc = { 125 .bLength = USB_DT_ENDPOINT_SIZE, 126 .bDescriptorType = USB_DT_ENDPOINT, 127 128 .bEndpointAddress = USB_DIR_OUT, 129 .bmAttributes = USB_ENDPOINT_XFER_BULK, 130 .wMaxPacketSize = cpu_to_le16(1024), 131 }; 132 133 static struct usb_ss_ep_comp_descriptor eem_ss_bulk_comp_desc = { 134 .bLength = sizeof eem_ss_bulk_comp_desc, 135 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP, 136 137 /* the following 2 values can be tweaked if necessary */ 138 /* .bMaxBurst = 0, */ 139 /* .bmAttributes = 0, */ 140 }; 141 142 static struct usb_descriptor_header *eem_ss_function[] = { 143 /* CDC EEM control descriptors */ 144 (struct usb_descriptor_header *) &eem_intf, 145 (struct usb_descriptor_header *) &eem_ss_in_desc, 146 (struct usb_descriptor_header *) &eem_ss_bulk_comp_desc, 147 (struct usb_descriptor_header *) &eem_ss_out_desc, 148 (struct usb_descriptor_header *) &eem_ss_bulk_comp_desc, 149 NULL, 150 }; 151 152 /* string descriptors: */ 153 154 static struct usb_string eem_string_defs[] = { 155 [0].s = "CDC Ethernet Emulation Model (EEM)", 156 { } /* end of list */ 157 }; 158 159 static struct usb_gadget_strings eem_string_table = { 160 .language = 0x0409, /* en-us */ 161 .strings = eem_string_defs, 162 }; 163 164 static struct usb_gadget_strings *eem_strings[] = { 165 &eem_string_table, 166 NULL, 167 }; 168 169 /*-------------------------------------------------------------------------*/ 170 171 static int eem_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl) 172 { 173 struct usb_composite_dev *cdev = f->config->cdev; 174 u16 w_index = le16_to_cpu(ctrl->wIndex); 175 u16 w_value = le16_to_cpu(ctrl->wValue); 176 u16 w_length = le16_to_cpu(ctrl->wLength); 177 178 DBG(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n", 179 ctrl->bRequestType, ctrl->bRequest, 180 w_value, w_index, w_length); 181 182 /* device either stalls (value < 0) or reports success */ 183 return -EOPNOTSUPP; 184 } 185 186 187 static int eem_set_alt(struct usb_function *f, unsigned intf, unsigned alt) 188 { 189 struct f_eem *eem = func_to_eem(f); 190 struct usb_composite_dev *cdev = f->config->cdev; 191 struct net_device *net; 192 193 /* we know alt == 0, so this is an activation or a reset */ 194 if (alt != 0) 195 goto fail; 196 197 if (intf == eem->ctrl_id) { 198 DBG(cdev, "reset eem\n"); 199 gether_disconnect(&eem->port); 200 201 if (!eem->port.in_ep->desc || !eem->port.out_ep->desc) { 202 DBG(cdev, "init eem\n"); 203 if (config_ep_by_speed(cdev->gadget, f, 204 eem->port.in_ep) || 205 config_ep_by_speed(cdev->gadget, f, 206 eem->port.out_ep)) { 207 eem->port.in_ep->desc = NULL; 208 eem->port.out_ep->desc = NULL; 209 goto fail; 210 } 211 } 212 213 /* zlps should not occur because zero-length EEM packets 214 * will be inserted in those cases where they would occur 215 */ 216 eem->port.is_zlp_ok = 1; 217 eem->port.cdc_filter = DEFAULT_FILTER; 218 DBG(cdev, "activate eem\n"); 219 net = gether_connect(&eem->port); 220 if (IS_ERR(net)) 221 return PTR_ERR(net); 222 } else 223 goto fail; 224 225 return 0; 226 fail: 227 return -EINVAL; 228 } 229 230 static void eem_disable(struct usb_function *f) 231 { 232 struct f_eem *eem = func_to_eem(f); 233 struct usb_composite_dev *cdev = f->config->cdev; 234 235 DBG(cdev, "eem deactivated\n"); 236 237 if (eem->port.in_ep->enabled) 238 gether_disconnect(&eem->port); 239 } 240 241 /*-------------------------------------------------------------------------*/ 242 243 /* EEM function driver setup/binding */ 244 245 static int eem_bind(struct usb_configuration *c, struct usb_function *f) 246 { 247 struct usb_composite_dev *cdev = c->cdev; 248 struct f_eem *eem = func_to_eem(f); 249 struct usb_string *us; 250 int status; 251 struct usb_ep *ep; 252 253 struct f_eem_opts *eem_opts; 254 255 eem_opts = container_of(f->fi, struct f_eem_opts, func_inst); 256 /* 257 * in drivers/usb/gadget/configfs.c:configfs_composite_bind() 258 * configurations are bound in sequence with list_for_each_entry, 259 * in each configuration its functions are bound in sequence 260 * with list_for_each_entry, so we assume no race condition 261 * with regard to eem_opts->bound access 262 */ 263 if (!eem_opts->bound) { 264 mutex_lock(&eem_opts->lock); 265 gether_set_gadget(eem_opts->net, cdev->gadget); 266 status = gether_register_netdev(eem_opts->net); 267 mutex_unlock(&eem_opts->lock); 268 if (status) 269 return status; 270 eem_opts->bound = true; 271 } 272 273 us = usb_gstrings_attach(cdev, eem_strings, 274 ARRAY_SIZE(eem_string_defs)); 275 if (IS_ERR(us)) 276 return PTR_ERR(us); 277 eem_intf.iInterface = us[0].id; 278 279 /* allocate instance-specific interface IDs */ 280 status = usb_interface_id(c, f); 281 if (status < 0) 282 goto fail; 283 eem->ctrl_id = status; 284 eem_intf.bInterfaceNumber = status; 285 286 status = -ENODEV; 287 288 /* allocate instance-specific endpoints */ 289 ep = usb_ep_autoconfig(cdev->gadget, &eem_fs_in_desc); 290 if (!ep) 291 goto fail; 292 eem->port.in_ep = ep; 293 294 ep = usb_ep_autoconfig(cdev->gadget, &eem_fs_out_desc); 295 if (!ep) 296 goto fail; 297 eem->port.out_ep = ep; 298 299 /* support all relevant hardware speeds... we expect that when 300 * hardware is dual speed, all bulk-capable endpoints work at 301 * both speeds 302 */ 303 eem_hs_in_desc.bEndpointAddress = eem_fs_in_desc.bEndpointAddress; 304 eem_hs_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress; 305 306 eem_ss_in_desc.bEndpointAddress = eem_fs_in_desc.bEndpointAddress; 307 eem_ss_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress; 308 309 status = usb_assign_descriptors(f, eem_fs_function, eem_hs_function, 310 eem_ss_function, eem_ss_function); 311 if (status) 312 goto fail; 313 314 DBG(cdev, "CDC Ethernet (EEM): IN/%s OUT/%s\n", 315 eem->port.in_ep->name, eem->port.out_ep->name); 316 return 0; 317 318 fail: 319 ERROR(cdev, "%s: can't bind, err %d\n", f->name, status); 320 321 return status; 322 } 323 324 static void eem_cmd_complete(struct usb_ep *ep, struct usb_request *req) 325 { 326 struct in_context *ctx = req->context; 327 328 dev_kfree_skb_any(ctx->skb); 329 kfree(req->buf); 330 usb_ep_free_request(ctx->ep, req); 331 kfree(ctx); 332 } 333 334 /* 335 * Add the EEM header and ethernet checksum. 336 * We currently do not attempt to put multiple ethernet frames 337 * into a single USB transfer 338 */ 339 static struct sk_buff *eem_wrap(struct gether *port, struct sk_buff *skb) 340 { 341 struct sk_buff *skb2 = NULL; 342 struct usb_ep *in = port->in_ep; 343 int headroom, tailroom, padlen = 0; 344 u16 len; 345 346 if (!skb) 347 return NULL; 348 349 len = skb->len; 350 headroom = skb_headroom(skb); 351 tailroom = skb_tailroom(skb); 352 353 /* When (len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) is 0, 354 * stick two bytes of zero-length EEM packet on the end. 355 */ 356 if (((len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) == 0) 357 padlen += 2; 358 359 if ((tailroom >= (ETH_FCS_LEN + padlen)) && 360 (headroom >= EEM_HLEN) && !skb_cloned(skb)) 361 goto done; 362 363 skb2 = skb_copy_expand(skb, EEM_HLEN, ETH_FCS_LEN + padlen, GFP_ATOMIC); 364 dev_kfree_skb_any(skb); 365 skb = skb2; 366 if (!skb) 367 return skb; 368 369 done: 370 /* use the "no CRC" option */ 371 put_unaligned_be32(0xdeadbeef, skb_put(skb, 4)); 372 373 /* EEM packet header format: 374 * b0..13: length of ethernet frame 375 * b14: bmCRC (0 == sentinel CRC) 376 * b15: bmType (0 == data) 377 */ 378 len = skb->len; 379 put_unaligned_le16(len & 0x3FFF, skb_push(skb, 2)); 380 381 /* add a zero-length EEM packet, if needed */ 382 if (padlen) 383 put_unaligned_le16(0, skb_put(skb, 2)); 384 385 return skb; 386 } 387 388 /* 389 * Remove the EEM header. Note that there can be many EEM packets in a single 390 * USB transfer, so we need to break them out and handle them independently. 391 */ 392 static int eem_unwrap(struct gether *port, 393 struct sk_buff *skb, 394 struct sk_buff_head *list) 395 { 396 struct usb_composite_dev *cdev = port->func.config->cdev; 397 int status = 0; 398 399 do { 400 struct sk_buff *skb2; 401 u16 header; 402 u16 len = 0; 403 404 if (skb->len < EEM_HLEN) { 405 status = -EINVAL; 406 DBG(cdev, "invalid EEM header\n"); 407 goto error; 408 } 409 410 /* remove the EEM header */ 411 header = get_unaligned_le16(skb->data); 412 skb_pull(skb, EEM_HLEN); 413 414 /* EEM packet header format: 415 * b0..14: EEM type dependent (data or command) 416 * b15: bmType (0 == data, 1 == command) 417 */ 418 if (header & BIT(15)) { 419 struct usb_request *req; 420 struct in_context *ctx; 421 struct usb_ep *ep; 422 u16 bmEEMCmd; 423 424 /* EEM command packet format: 425 * b0..10: bmEEMCmdParam 426 * b11..13: bmEEMCmd 427 * b14: reserved (must be zero) 428 * b15: bmType (1 == command) 429 */ 430 if (header & BIT(14)) 431 continue; 432 433 bmEEMCmd = (header >> 11) & 0x7; 434 switch (bmEEMCmd) { 435 case 0: /* echo */ 436 len = header & 0x7FF; 437 if (skb->len < len) { 438 status = -EOVERFLOW; 439 goto error; 440 } 441 442 skb2 = skb_clone(skb, GFP_ATOMIC); 443 if (unlikely(!skb2)) { 444 DBG(cdev, "EEM echo response error\n"); 445 goto next; 446 } 447 skb_trim(skb2, len); 448 put_unaligned_le16(BIT(15) | BIT(11) | len, 449 skb_push(skb2, 2)); 450 451 ep = port->in_ep; 452 req = usb_ep_alloc_request(ep, GFP_ATOMIC); 453 if (!req) { 454 dev_kfree_skb_any(skb2); 455 goto next; 456 } 457 458 req->buf = kmalloc(skb2->len, GFP_KERNEL); 459 if (!req->buf) { 460 usb_ep_free_request(ep, req); 461 dev_kfree_skb_any(skb2); 462 goto next; 463 } 464 465 ctx = kmalloc(sizeof(*ctx), GFP_KERNEL); 466 if (!ctx) { 467 kfree(req->buf); 468 usb_ep_free_request(ep, req); 469 dev_kfree_skb_any(skb2); 470 goto next; 471 } 472 ctx->skb = skb2; 473 ctx->ep = ep; 474 475 skb_copy_bits(skb2, 0, req->buf, skb2->len); 476 req->length = skb2->len; 477 req->complete = eem_cmd_complete; 478 req->zero = 1; 479 req->context = ctx; 480 if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC)) { 481 DBG(cdev, "echo response queue fail\n"); 482 kfree(ctx); 483 kfree(req->buf); 484 usb_ep_free_request(ep, req); 485 dev_kfree_skb_any(skb2); 486 } 487 break; 488 489 case 1: /* echo response */ 490 case 2: /* suspend hint */ 491 case 3: /* response hint */ 492 case 4: /* response complete hint */ 493 case 5: /* tickle */ 494 default: /* reserved */ 495 continue; 496 } 497 } else { 498 u32 crc, crc2; 499 struct sk_buff *skb3; 500 501 /* check for zero-length EEM packet */ 502 if (header == 0) 503 continue; 504 505 /* EEM data packet format: 506 * b0..13: length of ethernet frame 507 * b14: bmCRC (0 == sentinel, 1 == calculated) 508 * b15: bmType (0 == data) 509 */ 510 len = header & 0x3FFF; 511 if ((skb->len < len) 512 || (len < (ETH_HLEN + ETH_FCS_LEN))) { 513 status = -EINVAL; 514 goto error; 515 } 516 517 /* validate CRC */ 518 if (header & BIT(14)) { 519 crc = get_unaligned_le32(skb->data + len 520 - ETH_FCS_LEN); 521 crc2 = ~crc32_le(~0, 522 skb->data, len - ETH_FCS_LEN); 523 } else { 524 crc = get_unaligned_be32(skb->data + len 525 - ETH_FCS_LEN); 526 crc2 = 0xdeadbeef; 527 } 528 if (crc != crc2) { 529 DBG(cdev, "invalid EEM CRC\n"); 530 goto next; 531 } 532 533 skb2 = skb_clone(skb, GFP_ATOMIC); 534 if (unlikely(!skb2)) { 535 DBG(cdev, "unable to unframe EEM packet\n"); 536 goto next; 537 } 538 skb_trim(skb2, len - ETH_FCS_LEN); 539 540 skb3 = skb_copy_expand(skb2, 541 NET_IP_ALIGN, 542 0, 543 GFP_ATOMIC); 544 if (unlikely(!skb3)) { 545 dev_kfree_skb_any(skb2); 546 goto next; 547 } 548 dev_kfree_skb_any(skb2); 549 skb_queue_tail(list, skb3); 550 } 551 next: 552 skb_pull(skb, len); 553 } while (skb->len); 554 555 error: 556 dev_kfree_skb_any(skb); 557 return status; 558 } 559 560 static inline struct f_eem_opts *to_f_eem_opts(struct config_item *item) 561 { 562 return container_of(to_config_group(item), struct f_eem_opts, 563 func_inst.group); 564 } 565 566 /* f_eem_item_ops */ 567 USB_ETHERNET_CONFIGFS_ITEM(eem); 568 569 /* f_eem_opts_dev_addr */ 570 USB_ETHERNET_CONFIGFS_ITEM_ATTR_DEV_ADDR(eem); 571 572 /* f_eem_opts_host_addr */ 573 USB_ETHERNET_CONFIGFS_ITEM_ATTR_HOST_ADDR(eem); 574 575 /* f_eem_opts_qmult */ 576 USB_ETHERNET_CONFIGFS_ITEM_ATTR_QMULT(eem); 577 578 /* f_eem_opts_ifname */ 579 USB_ETHERNET_CONFIGFS_ITEM_ATTR_IFNAME(eem); 580 581 static struct configfs_attribute *eem_attrs[] = { 582 &eem_opts_attr_dev_addr, 583 &eem_opts_attr_host_addr, 584 &eem_opts_attr_qmult, 585 &eem_opts_attr_ifname, 586 NULL, 587 }; 588 589 static const struct config_item_type eem_func_type = { 590 .ct_item_ops = &eem_item_ops, 591 .ct_attrs = eem_attrs, 592 .ct_owner = THIS_MODULE, 593 }; 594 595 static void eem_free_inst(struct usb_function_instance *f) 596 { 597 struct f_eem_opts *opts; 598 599 opts = container_of(f, struct f_eem_opts, func_inst); 600 if (opts->bound) 601 gether_cleanup(netdev_priv(opts->net)); 602 else 603 free_netdev(opts->net); 604 kfree(opts); 605 } 606 607 static struct usb_function_instance *eem_alloc_inst(void) 608 { 609 struct f_eem_opts *opts; 610 611 opts = kzalloc(sizeof(*opts), GFP_KERNEL); 612 if (!opts) 613 return ERR_PTR(-ENOMEM); 614 mutex_init(&opts->lock); 615 opts->func_inst.free_func_inst = eem_free_inst; 616 opts->net = gether_setup_default(); 617 if (IS_ERR(opts->net)) { 618 struct net_device *net = opts->net; 619 kfree(opts); 620 return ERR_CAST(net); 621 } 622 623 config_group_init_type_name(&opts->func_inst.group, "", &eem_func_type); 624 625 return &opts->func_inst; 626 } 627 628 static void eem_free(struct usb_function *f) 629 { 630 struct f_eem *eem; 631 struct f_eem_opts *opts; 632 633 eem = func_to_eem(f); 634 opts = container_of(f->fi, struct f_eem_opts, func_inst); 635 kfree(eem); 636 mutex_lock(&opts->lock); 637 opts->refcnt--; 638 mutex_unlock(&opts->lock); 639 } 640 641 static void eem_unbind(struct usb_configuration *c, struct usb_function *f) 642 { 643 DBG(c->cdev, "eem unbind\n"); 644 645 usb_free_all_descriptors(f); 646 } 647 648 static struct usb_function *eem_alloc(struct usb_function_instance *fi) 649 { 650 struct f_eem *eem; 651 struct f_eem_opts *opts; 652 653 /* allocate and initialize one new instance */ 654 eem = kzalloc(sizeof(*eem), GFP_KERNEL); 655 if (!eem) 656 return ERR_PTR(-ENOMEM); 657 658 opts = container_of(fi, struct f_eem_opts, func_inst); 659 mutex_lock(&opts->lock); 660 opts->refcnt++; 661 662 eem->port.ioport = netdev_priv(opts->net); 663 mutex_unlock(&opts->lock); 664 eem->port.cdc_filter = DEFAULT_FILTER; 665 666 eem->port.func.name = "cdc_eem"; 667 /* descriptors are per-instance copies */ 668 eem->port.func.bind = eem_bind; 669 eem->port.func.unbind = eem_unbind; 670 eem->port.func.set_alt = eem_set_alt; 671 eem->port.func.setup = eem_setup; 672 eem->port.func.disable = eem_disable; 673 eem->port.func.free_func = eem_free; 674 eem->port.wrap = eem_wrap; 675 eem->port.unwrap = eem_unwrap; 676 eem->port.header_len = EEM_HLEN; 677 678 return &eem->port.func; 679 } 680 681 DECLARE_USB_FUNCTION_INIT(eem, eem_alloc_inst, eem_alloc); 682 MODULE_DESCRIPTION("USB CDC Ethernet (EEM) link function driver"); 683 MODULE_LICENSE("GPL"); 684 MODULE_AUTHOR("David Brownell"); 685