1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * f_eem.c -- USB CDC Ethernet (EEM) link function driver
4 *
5 * Copyright (C) 2003-2005,2008 David Brownell
6 * Copyright (C) 2008 Nokia Corporation
7 * Copyright (C) 2009 EF Johnson Technologies
8 */
9
10 #include <linux/kernel.h>
11 #include <linux/module.h>
12 #include <linux/device.h>
13 #include <linux/etherdevice.h>
14 #include <linux/crc32.h>
15 #include <linux/slab.h>
16
17 #include "u_ether.h"
18 #include "u_ether_configfs.h"
19 #include "u_eem.h"
20
21 #define EEM_HLEN 2
22
23 /*
24 * This function is a "CDC Ethernet Emulation Model" (CDC EEM)
25 * Ethernet link.
26 */
27
28 struct f_eem {
29 struct gether port;
30 u8 ctrl_id;
31 };
32
33 struct in_context {
34 struct sk_buff *skb;
35 struct usb_ep *ep;
36 };
37
func_to_eem(struct usb_function * f)38 static inline struct f_eem *func_to_eem(struct usb_function *f)
39 {
40 return container_of(f, struct f_eem, port.func);
41 }
42
43 /*-------------------------------------------------------------------------*/
44
45 /* interface descriptor: */
46
47 static struct usb_interface_descriptor eem_intf = {
48 .bLength = sizeof eem_intf,
49 .bDescriptorType = USB_DT_INTERFACE,
50
51 /* .bInterfaceNumber = DYNAMIC */
52 .bNumEndpoints = 2,
53 .bInterfaceClass = USB_CLASS_COMM,
54 .bInterfaceSubClass = USB_CDC_SUBCLASS_EEM,
55 .bInterfaceProtocol = USB_CDC_PROTO_EEM,
56 /* .iInterface = DYNAMIC */
57 };
58
59 /* full speed support: */
60
61 static struct usb_endpoint_descriptor eem_fs_in_desc = {
62 .bLength = USB_DT_ENDPOINT_SIZE,
63 .bDescriptorType = USB_DT_ENDPOINT,
64
65 .bEndpointAddress = USB_DIR_IN,
66 .bmAttributes = USB_ENDPOINT_XFER_BULK,
67 };
68
69 static struct usb_endpoint_descriptor eem_fs_out_desc = {
70 .bLength = USB_DT_ENDPOINT_SIZE,
71 .bDescriptorType = USB_DT_ENDPOINT,
72
73 .bEndpointAddress = USB_DIR_OUT,
74 .bmAttributes = USB_ENDPOINT_XFER_BULK,
75 };
76
77 static struct usb_descriptor_header *eem_fs_function[] = {
78 /* CDC EEM control descriptors */
79 (struct usb_descriptor_header *) &eem_intf,
80 (struct usb_descriptor_header *) &eem_fs_in_desc,
81 (struct usb_descriptor_header *) &eem_fs_out_desc,
82 NULL,
83 };
84
85 /* high speed support: */
86
87 static struct usb_endpoint_descriptor eem_hs_in_desc = {
88 .bLength = USB_DT_ENDPOINT_SIZE,
89 .bDescriptorType = USB_DT_ENDPOINT,
90
91 .bEndpointAddress = USB_DIR_IN,
92 .bmAttributes = USB_ENDPOINT_XFER_BULK,
93 .wMaxPacketSize = cpu_to_le16(512),
94 };
95
96 static struct usb_endpoint_descriptor eem_hs_out_desc = {
97 .bLength = USB_DT_ENDPOINT_SIZE,
98 .bDescriptorType = USB_DT_ENDPOINT,
99
100 .bEndpointAddress = USB_DIR_OUT,
101 .bmAttributes = USB_ENDPOINT_XFER_BULK,
102 .wMaxPacketSize = cpu_to_le16(512),
103 };
104
105 static struct usb_descriptor_header *eem_hs_function[] = {
106 /* CDC EEM control descriptors */
107 (struct usb_descriptor_header *) &eem_intf,
108 (struct usb_descriptor_header *) &eem_hs_in_desc,
109 (struct usb_descriptor_header *) &eem_hs_out_desc,
110 NULL,
111 };
112
113 /* super speed support: */
114
115 static struct usb_endpoint_descriptor eem_ss_in_desc = {
116 .bLength = USB_DT_ENDPOINT_SIZE,
117 .bDescriptorType = USB_DT_ENDPOINT,
118
119 .bEndpointAddress = USB_DIR_IN,
120 .bmAttributes = USB_ENDPOINT_XFER_BULK,
121 .wMaxPacketSize = cpu_to_le16(1024),
122 };
123
124 static struct usb_endpoint_descriptor eem_ss_out_desc = {
125 .bLength = USB_DT_ENDPOINT_SIZE,
126 .bDescriptorType = USB_DT_ENDPOINT,
127
128 .bEndpointAddress = USB_DIR_OUT,
129 .bmAttributes = USB_ENDPOINT_XFER_BULK,
130 .wMaxPacketSize = cpu_to_le16(1024),
131 };
132
133 static struct usb_ss_ep_comp_descriptor eem_ss_bulk_comp_desc = {
134 .bLength = sizeof eem_ss_bulk_comp_desc,
135 .bDescriptorType = USB_DT_SS_ENDPOINT_COMP,
136
137 /* the following 2 values can be tweaked if necessary */
138 /* .bMaxBurst = 0, */
139 /* .bmAttributes = 0, */
140 };
141
142 static struct usb_descriptor_header *eem_ss_function[] = {
143 /* CDC EEM control descriptors */
144 (struct usb_descriptor_header *) &eem_intf,
145 (struct usb_descriptor_header *) &eem_ss_in_desc,
146 (struct usb_descriptor_header *) &eem_ss_bulk_comp_desc,
147 (struct usb_descriptor_header *) &eem_ss_out_desc,
148 (struct usb_descriptor_header *) &eem_ss_bulk_comp_desc,
149 NULL,
150 };
151
152 /* string descriptors: */
153
154 static struct usb_string eem_string_defs[] = {
155 [0].s = "CDC Ethernet Emulation Model (EEM)",
156 { } /* end of list */
157 };
158
159 static struct usb_gadget_strings eem_string_table = {
160 .language = 0x0409, /* en-us */
161 .strings = eem_string_defs,
162 };
163
164 static struct usb_gadget_strings *eem_strings[] = {
165 &eem_string_table,
166 NULL,
167 };
168
169 /*-------------------------------------------------------------------------*/
170
eem_setup(struct usb_function * f,const struct usb_ctrlrequest * ctrl)171 static int eem_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
172 {
173 struct usb_composite_dev *cdev = f->config->cdev;
174 u16 w_index = le16_to_cpu(ctrl->wIndex);
175 u16 w_value = le16_to_cpu(ctrl->wValue);
176 u16 w_length = le16_to_cpu(ctrl->wLength);
177
178 DBG(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n",
179 ctrl->bRequestType, ctrl->bRequest,
180 w_value, w_index, w_length);
181
182 /* device either stalls (value < 0) or reports success */
183 return -EOPNOTSUPP;
184 }
185
186
eem_set_alt(struct usb_function * f,unsigned intf,unsigned alt)187 static int eem_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
188 {
189 struct f_eem *eem = func_to_eem(f);
190 struct usb_composite_dev *cdev = f->config->cdev;
191 struct net_device *net;
192
193 /* we know alt == 0, so this is an activation or a reset */
194 if (alt != 0)
195 goto fail;
196
197 if (intf == eem->ctrl_id) {
198 DBG(cdev, "reset eem\n");
199 gether_disconnect(&eem->port);
200
201 if (!eem->port.in_ep->desc || !eem->port.out_ep->desc) {
202 DBG(cdev, "init eem\n");
203 if (config_ep_by_speed(cdev->gadget, f,
204 eem->port.in_ep) ||
205 config_ep_by_speed(cdev->gadget, f,
206 eem->port.out_ep)) {
207 eem->port.in_ep->desc = NULL;
208 eem->port.out_ep->desc = NULL;
209 goto fail;
210 }
211 }
212
213 /* zlps should not occur because zero-length EEM packets
214 * will be inserted in those cases where they would occur
215 */
216 eem->port.is_zlp_ok = 1;
217 eem->port.cdc_filter = DEFAULT_FILTER;
218 DBG(cdev, "activate eem\n");
219 net = gether_connect(&eem->port);
220 if (IS_ERR(net))
221 return PTR_ERR(net);
222 } else
223 goto fail;
224
225 return 0;
226 fail:
227 return -EINVAL;
228 }
229
eem_disable(struct usb_function * f)230 static void eem_disable(struct usb_function *f)
231 {
232 struct f_eem *eem = func_to_eem(f);
233 struct usb_composite_dev *cdev = f->config->cdev;
234
235 DBG(cdev, "eem deactivated\n");
236
237 if (eem->port.in_ep->enabled)
238 gether_disconnect(&eem->port);
239 }
240
241 /*-------------------------------------------------------------------------*/
242
243 /* EEM function driver setup/binding */
244
eem_bind(struct usb_configuration * c,struct usb_function * f)245 static int eem_bind(struct usb_configuration *c, struct usb_function *f)
246 {
247 struct usb_composite_dev *cdev = c->cdev;
248 struct f_eem *eem = func_to_eem(f);
249 struct usb_string *us;
250 int status;
251 struct usb_ep *ep;
252
253 struct f_eem_opts *eem_opts;
254
255 eem_opts = container_of(f->fi, struct f_eem_opts, func_inst);
256 /*
257 * in drivers/usb/gadget/configfs.c:configfs_composite_bind()
258 * configurations are bound in sequence with list_for_each_entry,
259 * in each configuration its functions are bound in sequence
260 * with list_for_each_entry, so we assume no race condition
261 * with regard to eem_opts->bound access
262 */
263 if (!eem_opts->bound) {
264 mutex_lock(&eem_opts->lock);
265 gether_set_gadget(eem_opts->net, cdev->gadget);
266 status = gether_register_netdev(eem_opts->net);
267 mutex_unlock(&eem_opts->lock);
268 if (status)
269 return status;
270 eem_opts->bound = true;
271 }
272
273 us = usb_gstrings_attach(cdev, eem_strings,
274 ARRAY_SIZE(eem_string_defs));
275 if (IS_ERR(us))
276 return PTR_ERR(us);
277 eem_intf.iInterface = us[0].id;
278
279 /* allocate instance-specific interface IDs */
280 status = usb_interface_id(c, f);
281 if (status < 0)
282 goto fail;
283 eem->ctrl_id = status;
284 eem_intf.bInterfaceNumber = status;
285
286 status = -ENODEV;
287
288 /* allocate instance-specific endpoints */
289 ep = usb_ep_autoconfig(cdev->gadget, &eem_fs_in_desc);
290 if (!ep)
291 goto fail;
292 eem->port.in_ep = ep;
293
294 ep = usb_ep_autoconfig(cdev->gadget, &eem_fs_out_desc);
295 if (!ep)
296 goto fail;
297 eem->port.out_ep = ep;
298
299 /* support all relevant hardware speeds... we expect that when
300 * hardware is dual speed, all bulk-capable endpoints work at
301 * both speeds
302 */
303 eem_hs_in_desc.bEndpointAddress = eem_fs_in_desc.bEndpointAddress;
304 eem_hs_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress;
305
306 eem_ss_in_desc.bEndpointAddress = eem_fs_in_desc.bEndpointAddress;
307 eem_ss_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress;
308
309 status = usb_assign_descriptors(f, eem_fs_function, eem_hs_function,
310 eem_ss_function, eem_ss_function);
311 if (status)
312 goto fail;
313
314 DBG(cdev, "CDC Ethernet (EEM): IN/%s OUT/%s\n",
315 eem->port.in_ep->name, eem->port.out_ep->name);
316 return 0;
317
318 fail:
319 ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
320
321 return status;
322 }
323
eem_cmd_complete(struct usb_ep * ep,struct usb_request * req)324 static void eem_cmd_complete(struct usb_ep *ep, struct usb_request *req)
325 {
326 struct in_context *ctx = req->context;
327
328 dev_kfree_skb_any(ctx->skb);
329 kfree(req->buf);
330 usb_ep_free_request(ctx->ep, req);
331 kfree(ctx);
332 }
333
334 /*
335 * Add the EEM header and ethernet checksum.
336 * We currently do not attempt to put multiple ethernet frames
337 * into a single USB transfer
338 */
eem_wrap(struct gether * port,struct sk_buff * skb)339 static struct sk_buff *eem_wrap(struct gether *port, struct sk_buff *skb)
340 {
341 struct sk_buff *skb2 = NULL;
342 struct usb_ep *in = port->in_ep;
343 int headroom, tailroom, padlen = 0;
344 u16 len;
345
346 if (!skb)
347 return NULL;
348
349 len = skb->len;
350 headroom = skb_headroom(skb);
351 tailroom = skb_tailroom(skb);
352
353 /* When (len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) is 0,
354 * stick two bytes of zero-length EEM packet on the end.
355 */
356 if (((len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) == 0)
357 padlen += 2;
358
359 if ((tailroom >= (ETH_FCS_LEN + padlen)) &&
360 (headroom >= EEM_HLEN) && !skb_cloned(skb))
361 goto done;
362
363 skb2 = skb_copy_expand(skb, EEM_HLEN, ETH_FCS_LEN + padlen, GFP_ATOMIC);
364 dev_kfree_skb_any(skb);
365 skb = skb2;
366 if (!skb)
367 return skb;
368
369 done:
370 /* use the "no CRC" option */
371 put_unaligned_be32(0xdeadbeef, skb_put(skb, 4));
372
373 /* EEM packet header format:
374 * b0..13: length of ethernet frame
375 * b14: bmCRC (0 == sentinel CRC)
376 * b15: bmType (0 == data)
377 */
378 len = skb->len;
379 put_unaligned_le16(len & 0x3FFF, skb_push(skb, 2));
380
381 /* add a zero-length EEM packet, if needed */
382 if (padlen)
383 put_unaligned_le16(0, skb_put(skb, 2));
384
385 return skb;
386 }
387
388 /*
389 * Remove the EEM header. Note that there can be many EEM packets in a single
390 * USB transfer, so we need to break them out and handle them independently.
391 */
eem_unwrap(struct gether * port,struct sk_buff * skb,struct sk_buff_head * list)392 static int eem_unwrap(struct gether *port,
393 struct sk_buff *skb,
394 struct sk_buff_head *list)
395 {
396 struct usb_composite_dev *cdev = port->func.config->cdev;
397 int status = 0;
398
399 do {
400 struct sk_buff *skb2;
401 u16 header;
402 u16 len = 0;
403
404 if (skb->len < EEM_HLEN) {
405 status = -EINVAL;
406 DBG(cdev, "invalid EEM header\n");
407 goto error;
408 }
409
410 /* remove the EEM header */
411 header = get_unaligned_le16(skb->data);
412 skb_pull(skb, EEM_HLEN);
413
414 /* EEM packet header format:
415 * b0..14: EEM type dependent (data or command)
416 * b15: bmType (0 == data, 1 == command)
417 */
418 if (header & BIT(15)) {
419 struct usb_request *req;
420 struct in_context *ctx;
421 struct usb_ep *ep;
422 u16 bmEEMCmd;
423
424 /* EEM command packet format:
425 * b0..10: bmEEMCmdParam
426 * b11..13: bmEEMCmd
427 * b14: reserved (must be zero)
428 * b15: bmType (1 == command)
429 */
430 if (header & BIT(14))
431 continue;
432
433 bmEEMCmd = (header >> 11) & 0x7;
434 switch (bmEEMCmd) {
435 case 0: /* echo */
436 len = header & 0x7FF;
437 if (skb->len < len) {
438 status = -EOVERFLOW;
439 goto error;
440 }
441
442 skb2 = skb_clone(skb, GFP_ATOMIC);
443 if (unlikely(!skb2)) {
444 DBG(cdev, "EEM echo response error\n");
445 goto next;
446 }
447 skb_trim(skb2, len);
448 put_unaligned_le16(BIT(15) | BIT(11) | len,
449 skb_push(skb2, 2));
450
451 ep = port->in_ep;
452 req = usb_ep_alloc_request(ep, GFP_ATOMIC);
453 if (!req) {
454 dev_kfree_skb_any(skb2);
455 goto next;
456 }
457
458 req->buf = kmalloc(skb2->len, GFP_KERNEL);
459 if (!req->buf) {
460 usb_ep_free_request(ep, req);
461 dev_kfree_skb_any(skb2);
462 goto next;
463 }
464
465 ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
466 if (!ctx) {
467 kfree(req->buf);
468 usb_ep_free_request(ep, req);
469 dev_kfree_skb_any(skb2);
470 goto next;
471 }
472 ctx->skb = skb2;
473 ctx->ep = ep;
474
475 skb_copy_bits(skb2, 0, req->buf, skb2->len);
476 req->length = skb2->len;
477 req->complete = eem_cmd_complete;
478 req->zero = 1;
479 req->context = ctx;
480 if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC))
481 DBG(cdev, "echo response queue fail\n");
482 break;
483
484 case 1: /* echo response */
485 case 2: /* suspend hint */
486 case 3: /* response hint */
487 case 4: /* response complete hint */
488 case 5: /* tickle */
489 default: /* reserved */
490 continue;
491 }
492 } else {
493 u32 crc, crc2;
494 struct sk_buff *skb3;
495
496 /* check for zero-length EEM packet */
497 if (header == 0)
498 continue;
499
500 /* EEM data packet format:
501 * b0..13: length of ethernet frame
502 * b14: bmCRC (0 == sentinel, 1 == calculated)
503 * b15: bmType (0 == data)
504 */
505 len = header & 0x3FFF;
506 if ((skb->len < len)
507 || (len < (ETH_HLEN + ETH_FCS_LEN))) {
508 status = -EINVAL;
509 goto error;
510 }
511
512 /* validate CRC */
513 if (header & BIT(14)) {
514 crc = get_unaligned_le32(skb->data + len
515 - ETH_FCS_LEN);
516 crc2 = ~crc32_le(~0,
517 skb->data, len - ETH_FCS_LEN);
518 } else {
519 crc = get_unaligned_be32(skb->data + len
520 - ETH_FCS_LEN);
521 crc2 = 0xdeadbeef;
522 }
523 if (crc != crc2) {
524 DBG(cdev, "invalid EEM CRC\n");
525 goto next;
526 }
527
528 skb2 = skb_clone(skb, GFP_ATOMIC);
529 if (unlikely(!skb2)) {
530 DBG(cdev, "unable to unframe EEM packet\n");
531 goto next;
532 }
533 skb_trim(skb2, len - ETH_FCS_LEN);
534
535 skb3 = skb_copy_expand(skb2,
536 NET_IP_ALIGN,
537 0,
538 GFP_ATOMIC);
539 if (unlikely(!skb3)) {
540 dev_kfree_skb_any(skb2);
541 goto next;
542 }
543 dev_kfree_skb_any(skb2);
544 skb_queue_tail(list, skb3);
545 }
546 next:
547 skb_pull(skb, len);
548 } while (skb->len);
549
550 error:
551 dev_kfree_skb_any(skb);
552 return status;
553 }
554
to_f_eem_opts(struct config_item * item)555 static inline struct f_eem_opts *to_f_eem_opts(struct config_item *item)
556 {
557 return container_of(to_config_group(item), struct f_eem_opts,
558 func_inst.group);
559 }
560
561 /* f_eem_item_ops */
562 USB_ETHERNET_CONFIGFS_ITEM(eem);
563
564 /* f_eem_opts_dev_addr */
565 USB_ETHERNET_CONFIGFS_ITEM_ATTR_DEV_ADDR(eem);
566
567 /* f_eem_opts_host_addr */
568 USB_ETHERNET_CONFIGFS_ITEM_ATTR_HOST_ADDR(eem);
569
570 /* f_eem_opts_qmult */
571 USB_ETHERNET_CONFIGFS_ITEM_ATTR_QMULT(eem);
572
573 /* f_eem_opts_ifname */
574 USB_ETHERNET_CONFIGFS_ITEM_ATTR_IFNAME(eem);
575
576 static struct configfs_attribute *eem_attrs[] = {
577 &eem_opts_attr_dev_addr,
578 &eem_opts_attr_host_addr,
579 &eem_opts_attr_qmult,
580 &eem_opts_attr_ifname,
581 NULL,
582 };
583
584 static const struct config_item_type eem_func_type = {
585 .ct_item_ops = &eem_item_ops,
586 .ct_attrs = eem_attrs,
587 .ct_owner = THIS_MODULE,
588 };
589
eem_free_inst(struct usb_function_instance * f)590 static void eem_free_inst(struct usb_function_instance *f)
591 {
592 struct f_eem_opts *opts;
593
594 opts = container_of(f, struct f_eem_opts, func_inst);
595 if (opts->bound)
596 gether_cleanup(netdev_priv(opts->net));
597 else
598 free_netdev(opts->net);
599 kfree(opts);
600 }
601
eem_alloc_inst(void)602 static struct usb_function_instance *eem_alloc_inst(void)
603 {
604 struct f_eem_opts *opts;
605
606 opts = kzalloc(sizeof(*opts), GFP_KERNEL);
607 if (!opts)
608 return ERR_PTR(-ENOMEM);
609 mutex_init(&opts->lock);
610 opts->func_inst.free_func_inst = eem_free_inst;
611 opts->net = gether_setup_default();
612 if (IS_ERR(opts->net)) {
613 struct net_device *net = opts->net;
614 kfree(opts);
615 return ERR_CAST(net);
616 }
617
618 config_group_init_type_name(&opts->func_inst.group, "", &eem_func_type);
619
620 return &opts->func_inst;
621 }
622
eem_free(struct usb_function * f)623 static void eem_free(struct usb_function *f)
624 {
625 struct f_eem *eem;
626 struct f_eem_opts *opts;
627
628 eem = func_to_eem(f);
629 opts = container_of(f->fi, struct f_eem_opts, func_inst);
630 kfree(eem);
631 mutex_lock(&opts->lock);
632 opts->refcnt--;
633 mutex_unlock(&opts->lock);
634 }
635
eem_unbind(struct usb_configuration * c,struct usb_function * f)636 static void eem_unbind(struct usb_configuration *c, struct usb_function *f)
637 {
638 DBG(c->cdev, "eem unbind\n");
639
640 usb_free_all_descriptors(f);
641 }
642
eem_alloc(struct usb_function_instance * fi)643 static struct usb_function *eem_alloc(struct usb_function_instance *fi)
644 {
645 struct f_eem *eem;
646 struct f_eem_opts *opts;
647
648 /* allocate and initialize one new instance */
649 eem = kzalloc(sizeof(*eem), GFP_KERNEL);
650 if (!eem)
651 return ERR_PTR(-ENOMEM);
652
653 opts = container_of(fi, struct f_eem_opts, func_inst);
654 mutex_lock(&opts->lock);
655 opts->refcnt++;
656
657 eem->port.ioport = netdev_priv(opts->net);
658 mutex_unlock(&opts->lock);
659 eem->port.cdc_filter = DEFAULT_FILTER;
660
661 eem->port.func.name = "cdc_eem";
662 /* descriptors are per-instance copies */
663 eem->port.func.bind = eem_bind;
664 eem->port.func.unbind = eem_unbind;
665 eem->port.func.set_alt = eem_set_alt;
666 eem->port.func.setup = eem_setup;
667 eem->port.func.disable = eem_disable;
668 eem->port.func.free_func = eem_free;
669 eem->port.wrap = eem_wrap;
670 eem->port.unwrap = eem_unwrap;
671 eem->port.header_len = EEM_HLEN;
672
673 return &eem->port.func;
674 }
675
676 DECLARE_USB_FUNCTION_INIT(eem, eem_alloc_inst, eem_alloc);
677 MODULE_LICENSE("GPL");
678 MODULE_AUTHOR("David Brownell");
679