Linux Audio

Check our new training course

Loading...
v6.8
   1// SPDX-License-Identifier: GPL-2.0+
   2/*
   3 * f_ncm.c -- USB CDC Network (NCM) link function driver
   4 *
   5 * Copyright (C) 2010 Nokia Corporation
   6 * Contact: Yauheni Kaliuta <yauheni.kaliuta@nokia.com>
   7 *
   8 * The driver borrows from f_ecm.c which is:
   9 *
  10 * Copyright (C) 2003-2005,2008 David Brownell
  11 * Copyright (C) 2008 Nokia Corporation
  12 */
  13
  14#include <linux/kernel.h>
  15#include <linux/interrupt.h>
  16#include <linux/module.h>
  17#include <linux/device.h>
  18#include <linux/etherdevice.h>
  19#include <linux/crc32.h>
  20
  21#include <linux/usb/cdc.h>
  22
  23#include "u_ether.h"
  24#include "u_ether_configfs.h"
  25#include "u_ncm.h"
  26#include "configfs.h"
  27
  28/*
  29 * This function is a "CDC Network Control Model" (CDC NCM) Ethernet link.
  30 * NCM is intended to be used with high-speed network attachments.
  31 *
  32 * Note that NCM requires the use of "alternate settings" for its data
  33 * interface.  This means that the set_alt() method has real work to do,
  34 * and also means that a get_alt() method is required.
  35 */
  36
  37/* to trigger crc/non-crc ndp signature */
  38
  39#define NCM_NDP_HDR_CRC		0x01000000
  40
  41enum ncm_notify_state {
  42	NCM_NOTIFY_NONE,		/* don't notify */
  43	NCM_NOTIFY_CONNECT,		/* issue CONNECT next */
  44	NCM_NOTIFY_SPEED,		/* issue SPEED_CHANGE next */
  45};
  46
  47struct f_ncm {
  48	struct gether			port;
  49	u8				ctrl_id, data_id;
  50
  51	char				ethaddr[14];
  52
  53	struct usb_ep			*notify;
  54	struct usb_request		*notify_req;
  55	u8				notify_state;
  56	atomic_t			notify_count;
  57	bool				is_open;
  58
  59	const struct ndp_parser_opts	*parser_opts;
  60	bool				is_crc;
  61	u32				ndp_sign;
  62
  63	/*
  64	 * for notification, it is accessed from both
  65	 * callback and ethernet open/close
  66	 */
  67	spinlock_t			lock;
  68
  69	struct net_device		*netdev;
  70
  71	/* For multi-frame NDP TX */
  72	struct sk_buff			*skb_tx_data;
  73	struct sk_buff			*skb_tx_ndp;
  74	u16				ndp_dgram_count;
  75	struct hrtimer			task_timer;
  76};
  77
  78static inline struct f_ncm *func_to_ncm(struct usb_function *f)
  79{
  80	return container_of(f, struct f_ncm, port.func);
  81}
  82
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  83/*-------------------------------------------------------------------------*/
  84
  85/*
  86 * We cannot group frames so use just the minimal size which ok to put
  87 * one max-size ethernet frame.
  88 * If the host can group frames, allow it to do that, 16K is selected,
  89 * because it's used by default by the current linux host driver
  90 */
  91#define NTB_DEFAULT_IN_SIZE	16384
  92#define NTB_OUT_SIZE		16384
  93
  94/* Allocation for storing the NDP, 32 should suffice for a
  95 * 16k packet. This allows a maximum of 32 * 507 Byte packets to
  96 * be transmitted in a single 16kB skb, though when sending full size
  97 * packets this limit will be plenty.
  98 * Smaller packets are not likely to be trying to maximize the
  99 * throughput and will be mstly sending smaller infrequent frames.
 100 */
 101#define TX_MAX_NUM_DPE		32
 102
 103/* Delay for the transmit to wait before sending an unfilled NTB frame. */
 104#define TX_TIMEOUT_NSECS	300000
 105
 106/*
 107 * Although max mtu as dictated by u_ether is 15412 bytes, setting
 108 * max_segment_size to 15426 would not be efficient. If user chooses segment
 109 * size to be (>= 8192), then we can't aggregate more than one buffer in each
 110 * NTB (assuming each packet coming from network layer is >= 8192 bytes) as ep
 111 * maxpacket limit is 16384. So let max_segment_size be limited to 8000 to allow
 112 * at least 2 packets to be aggregated reducing wastage of NTB buffer space
 113 */
 114#define MAX_DATAGRAM_SIZE	8000
 115
 116#define FORMATS_SUPPORTED	(USB_CDC_NCM_NTB16_SUPPORTED |	\
 117				 USB_CDC_NCM_NTB32_SUPPORTED)
 118
 119static struct usb_cdc_ncm_ntb_parameters ntb_parameters = {
 120	.wLength = cpu_to_le16(sizeof(ntb_parameters)),
 121	.bmNtbFormatsSupported = cpu_to_le16(FORMATS_SUPPORTED),
 122	.dwNtbInMaxSize = cpu_to_le32(NTB_DEFAULT_IN_SIZE),
 123	.wNdpInDivisor = cpu_to_le16(4),
 124	.wNdpInPayloadRemainder = cpu_to_le16(0),
 125	.wNdpInAlignment = cpu_to_le16(4),
 126
 127	.dwNtbOutMaxSize = cpu_to_le32(NTB_OUT_SIZE),
 128	.wNdpOutDivisor = cpu_to_le16(4),
 129	.wNdpOutPayloadRemainder = cpu_to_le16(0),
 130	.wNdpOutAlignment = cpu_to_le16(4),
 131};
 132
 133/*
 134 * Use wMaxPacketSize big enough to fit CDC_NOTIFY_SPEED_CHANGE in one
 135 * packet, to simplify cancellation; and a big transfer interval, to
 136 * waste less bandwidth.
 137 */
 138
 139#define NCM_STATUS_INTERVAL_MS		32
 140#define NCM_STATUS_BYTECOUNT		16	/* 8 byte header + data */
 141
 142static struct usb_interface_assoc_descriptor ncm_iad_desc = {
 143	.bLength =		sizeof ncm_iad_desc,
 144	.bDescriptorType =	USB_DT_INTERFACE_ASSOCIATION,
 145
 146	/* .bFirstInterface =	DYNAMIC, */
 147	.bInterfaceCount =	2,	/* control + data */
 148	.bFunctionClass =	USB_CLASS_COMM,
 149	.bFunctionSubClass =	USB_CDC_SUBCLASS_NCM,
 150	.bFunctionProtocol =	USB_CDC_PROTO_NONE,
 151	/* .iFunction =		DYNAMIC */
 152};
 153
 154/* interface descriptor: */
 155
 156static struct usb_interface_descriptor ncm_control_intf = {
 157	.bLength =		sizeof ncm_control_intf,
 158	.bDescriptorType =	USB_DT_INTERFACE,
 159
 160	/* .bInterfaceNumber = DYNAMIC */
 161	.bNumEndpoints =	1,
 162	.bInterfaceClass =	USB_CLASS_COMM,
 163	.bInterfaceSubClass =	USB_CDC_SUBCLASS_NCM,
 164	.bInterfaceProtocol =	USB_CDC_PROTO_NONE,
 165	/* .iInterface = DYNAMIC */
 166};
 167
 168static struct usb_cdc_header_desc ncm_header_desc = {
 169	.bLength =		sizeof ncm_header_desc,
 170	.bDescriptorType =	USB_DT_CS_INTERFACE,
 171	.bDescriptorSubType =	USB_CDC_HEADER_TYPE,
 172
 173	.bcdCDC =		cpu_to_le16(0x0110),
 174};
 175
 176static struct usb_cdc_union_desc ncm_union_desc = {
 177	.bLength =		sizeof(ncm_union_desc),
 178	.bDescriptorType =	USB_DT_CS_INTERFACE,
 179	.bDescriptorSubType =	USB_CDC_UNION_TYPE,
 180	/* .bMasterInterface0 =	DYNAMIC */
 181	/* .bSlaveInterface0 =	DYNAMIC */
 182};
 183
 184static struct usb_cdc_ether_desc ecm_desc = {
 185	.bLength =		sizeof ecm_desc,
 186	.bDescriptorType =	USB_DT_CS_INTERFACE,
 187	.bDescriptorSubType =	USB_CDC_ETHERNET_TYPE,
 188
 189	/* this descriptor actually adds value, surprise! */
 190	/* .iMACAddress = DYNAMIC */
 191	.bmEthernetStatistics =	cpu_to_le32(0), /* no statistics */
 
 192	.wNumberMCFilters =	cpu_to_le16(0),
 193	.bNumberPowerFilters =	0,
 194};
 195
 196#define NCAPS	(USB_CDC_NCM_NCAP_ETH_FILTER | USB_CDC_NCM_NCAP_CRC_MODE)
 197
 198static struct usb_cdc_ncm_desc ncm_desc = {
 199	.bLength =		sizeof ncm_desc,
 200	.bDescriptorType =	USB_DT_CS_INTERFACE,
 201	.bDescriptorSubType =	USB_CDC_NCM_TYPE,
 202
 203	.bcdNcmVersion =	cpu_to_le16(0x0100),
 204	/* can process SetEthernetPacketFilter */
 205	.bmNetworkCapabilities = NCAPS,
 206};
 207
 208/* the default data interface has no endpoints ... */
 209
 210static struct usb_interface_descriptor ncm_data_nop_intf = {
 211	.bLength =		sizeof ncm_data_nop_intf,
 212	.bDescriptorType =	USB_DT_INTERFACE,
 213
 214	.bInterfaceNumber =	1,
 215	.bAlternateSetting =	0,
 216	.bNumEndpoints =	0,
 217	.bInterfaceClass =	USB_CLASS_CDC_DATA,
 218	.bInterfaceSubClass =	0,
 219	.bInterfaceProtocol =	USB_CDC_NCM_PROTO_NTB,
 220	/* .iInterface = DYNAMIC */
 221};
 222
 223/* ... but the "real" data interface has two bulk endpoints */
 224
 225static struct usb_interface_descriptor ncm_data_intf = {
 226	.bLength =		sizeof ncm_data_intf,
 227	.bDescriptorType =	USB_DT_INTERFACE,
 228
 229	.bInterfaceNumber =	1,
 230	.bAlternateSetting =	1,
 231	.bNumEndpoints =	2,
 232	.bInterfaceClass =	USB_CLASS_CDC_DATA,
 233	.bInterfaceSubClass =	0,
 234	.bInterfaceProtocol =	USB_CDC_NCM_PROTO_NTB,
 235	/* .iInterface = DYNAMIC */
 236};
 237
 238/* full speed support: */
 239
 240static struct usb_endpoint_descriptor fs_ncm_notify_desc = {
 241	.bLength =		USB_DT_ENDPOINT_SIZE,
 242	.bDescriptorType =	USB_DT_ENDPOINT,
 243
 244	.bEndpointAddress =	USB_DIR_IN,
 245	.bmAttributes =		USB_ENDPOINT_XFER_INT,
 246	.wMaxPacketSize =	cpu_to_le16(NCM_STATUS_BYTECOUNT),
 247	.bInterval =		NCM_STATUS_INTERVAL_MS,
 248};
 249
 250static struct usb_endpoint_descriptor fs_ncm_in_desc = {
 251	.bLength =		USB_DT_ENDPOINT_SIZE,
 252	.bDescriptorType =	USB_DT_ENDPOINT,
 253
 254	.bEndpointAddress =	USB_DIR_IN,
 255	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
 256};
 257
 258static struct usb_endpoint_descriptor fs_ncm_out_desc = {
 259	.bLength =		USB_DT_ENDPOINT_SIZE,
 260	.bDescriptorType =	USB_DT_ENDPOINT,
 261
 262	.bEndpointAddress =	USB_DIR_OUT,
 263	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
 264};
 265
 266static struct usb_descriptor_header *ncm_fs_function[] = {
 267	(struct usb_descriptor_header *) &ncm_iad_desc,
 268	/* CDC NCM control descriptors */
 269	(struct usb_descriptor_header *) &ncm_control_intf,
 270	(struct usb_descriptor_header *) &ncm_header_desc,
 271	(struct usb_descriptor_header *) &ncm_union_desc,
 272	(struct usb_descriptor_header *) &ecm_desc,
 273	(struct usb_descriptor_header *) &ncm_desc,
 274	(struct usb_descriptor_header *) &fs_ncm_notify_desc,
 275	/* data interface, altsettings 0 and 1 */
 276	(struct usb_descriptor_header *) &ncm_data_nop_intf,
 277	(struct usb_descriptor_header *) &ncm_data_intf,
 278	(struct usb_descriptor_header *) &fs_ncm_in_desc,
 279	(struct usb_descriptor_header *) &fs_ncm_out_desc,
 280	NULL,
 281};
 282
 283/* high speed support: */
 284
 285static struct usb_endpoint_descriptor hs_ncm_notify_desc = {
 286	.bLength =		USB_DT_ENDPOINT_SIZE,
 287	.bDescriptorType =	USB_DT_ENDPOINT,
 288
 289	.bEndpointAddress =	USB_DIR_IN,
 290	.bmAttributes =		USB_ENDPOINT_XFER_INT,
 291	.wMaxPacketSize =	cpu_to_le16(NCM_STATUS_BYTECOUNT),
 292	.bInterval =		USB_MS_TO_HS_INTERVAL(NCM_STATUS_INTERVAL_MS),
 293};
 294static struct usb_endpoint_descriptor hs_ncm_in_desc = {
 295	.bLength =		USB_DT_ENDPOINT_SIZE,
 296	.bDescriptorType =	USB_DT_ENDPOINT,
 297
 298	.bEndpointAddress =	USB_DIR_IN,
 299	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
 300	.wMaxPacketSize =	cpu_to_le16(512),
 301};
 302
 303static struct usb_endpoint_descriptor hs_ncm_out_desc = {
 304	.bLength =		USB_DT_ENDPOINT_SIZE,
 305	.bDescriptorType =	USB_DT_ENDPOINT,
 306
 307	.bEndpointAddress =	USB_DIR_OUT,
 308	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
 309	.wMaxPacketSize =	cpu_to_le16(512),
 310};
 311
 312static struct usb_descriptor_header *ncm_hs_function[] = {
 313	(struct usb_descriptor_header *) &ncm_iad_desc,
 314	/* CDC NCM control descriptors */
 315	(struct usb_descriptor_header *) &ncm_control_intf,
 316	(struct usb_descriptor_header *) &ncm_header_desc,
 317	(struct usb_descriptor_header *) &ncm_union_desc,
 318	(struct usb_descriptor_header *) &ecm_desc,
 319	(struct usb_descriptor_header *) &ncm_desc,
 320	(struct usb_descriptor_header *) &hs_ncm_notify_desc,
 321	/* data interface, altsettings 0 and 1 */
 322	(struct usb_descriptor_header *) &ncm_data_nop_intf,
 323	(struct usb_descriptor_header *) &ncm_data_intf,
 324	(struct usb_descriptor_header *) &hs_ncm_in_desc,
 325	(struct usb_descriptor_header *) &hs_ncm_out_desc,
 326	NULL,
 327};
 328
 329
 330/* super speed support: */
 331
 332static struct usb_endpoint_descriptor ss_ncm_notify_desc = {
 333	.bLength =		USB_DT_ENDPOINT_SIZE,
 334	.bDescriptorType =	USB_DT_ENDPOINT,
 335
 336	.bEndpointAddress =	USB_DIR_IN,
 337	.bmAttributes =		USB_ENDPOINT_XFER_INT,
 338	.wMaxPacketSize =	cpu_to_le16(NCM_STATUS_BYTECOUNT),
 339	.bInterval =		USB_MS_TO_HS_INTERVAL(NCM_STATUS_INTERVAL_MS)
 340};
 341
 342static struct usb_ss_ep_comp_descriptor ss_ncm_notify_comp_desc = {
 343	.bLength =		sizeof(ss_ncm_notify_comp_desc),
 344	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
 345
 346	/* the following 3 values can be tweaked if necessary */
 347	/* .bMaxBurst =		0, */
 348	/* .bmAttributes =	0, */
 349	.wBytesPerInterval =	cpu_to_le16(NCM_STATUS_BYTECOUNT),
 350};
 351
 352static struct usb_endpoint_descriptor ss_ncm_in_desc = {
 353	.bLength =		USB_DT_ENDPOINT_SIZE,
 354	.bDescriptorType =	USB_DT_ENDPOINT,
 355
 356	.bEndpointAddress =	USB_DIR_IN,
 357	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
 358	.wMaxPacketSize =	cpu_to_le16(1024),
 359};
 360
 361static struct usb_endpoint_descriptor ss_ncm_out_desc = {
 362	.bLength =		USB_DT_ENDPOINT_SIZE,
 363	.bDescriptorType =	USB_DT_ENDPOINT,
 364
 365	.bEndpointAddress =	USB_DIR_OUT,
 366	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
 367	.wMaxPacketSize =	cpu_to_le16(1024),
 368};
 369
 370static struct usb_ss_ep_comp_descriptor ss_ncm_bulk_comp_desc = {
 371	.bLength =		sizeof(ss_ncm_bulk_comp_desc),
 372	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
 373
 374	/* the following 2 values can be tweaked if necessary */
 375	.bMaxBurst =		15,
 376	/* .bmAttributes =	0, */
 377};
 378
 379static struct usb_descriptor_header *ncm_ss_function[] = {
 380	(struct usb_descriptor_header *) &ncm_iad_desc,
 381	/* CDC NCM control descriptors */
 382	(struct usb_descriptor_header *) &ncm_control_intf,
 383	(struct usb_descriptor_header *) &ncm_header_desc,
 384	(struct usb_descriptor_header *) &ncm_union_desc,
 385	(struct usb_descriptor_header *) &ecm_desc,
 386	(struct usb_descriptor_header *) &ncm_desc,
 387	(struct usb_descriptor_header *) &ss_ncm_notify_desc,
 388	(struct usb_descriptor_header *) &ss_ncm_notify_comp_desc,
 389	/* data interface, altsettings 0 and 1 */
 390	(struct usb_descriptor_header *) &ncm_data_nop_intf,
 391	(struct usb_descriptor_header *) &ncm_data_intf,
 392	(struct usb_descriptor_header *) &ss_ncm_in_desc,
 393	(struct usb_descriptor_header *) &ss_ncm_bulk_comp_desc,
 394	(struct usb_descriptor_header *) &ss_ncm_out_desc,
 395	(struct usb_descriptor_header *) &ss_ncm_bulk_comp_desc,
 396	NULL,
 397};
 398
 399/* string descriptors: */
 400
 401#define STRING_CTRL_IDX	0
 402#define STRING_MAC_IDX	1
 403#define STRING_DATA_IDX	2
 404#define STRING_IAD_IDX	3
 405
 406static struct usb_string ncm_string_defs[] = {
 407	[STRING_CTRL_IDX].s = "CDC Network Control Model (NCM)",
 408	[STRING_MAC_IDX].s = "",
 409	[STRING_DATA_IDX].s = "CDC Network Data",
 410	[STRING_IAD_IDX].s = "CDC NCM",
 411	{  } /* end of list */
 412};
 413
 414static struct usb_gadget_strings ncm_string_table = {
 415	.language =		0x0409,	/* en-us */
 416	.strings =		ncm_string_defs,
 417};
 418
 419static struct usb_gadget_strings *ncm_strings[] = {
 420	&ncm_string_table,
 421	NULL,
 422};
 423
 424/*
 425 * Here are options for NCM Datagram Pointer table (NDP) parser.
 426 * There are 2 different formats: NDP16 and NDP32 in the spec (ch. 3),
 427 * in NDP16 offsets and sizes fields are 1 16bit word wide,
 428 * in NDP32 -- 2 16bit words wide. Also signatures are different.
 429 * To make the parser code the same, put the differences in the structure,
 430 * and switch pointers to the structures when the format is changed.
 431 */
 432
 433struct ndp_parser_opts {
 434	u32		nth_sign;
 435	u32		ndp_sign;
 436	unsigned	nth_size;
 437	unsigned	ndp_size;
 438	unsigned	dpe_size;
 439	unsigned	ndplen_align;
 440	/* sizes in u16 units */
 441	unsigned	dgram_item_len; /* index or length */
 442	unsigned	block_length;
 443	unsigned	ndp_index;
 444	unsigned	reserved1;
 445	unsigned	reserved2;
 446	unsigned	next_ndp_index;
 447};
 448
 449static const struct ndp_parser_opts ndp16_opts = {
 450	.nth_sign = USB_CDC_NCM_NTH16_SIGN,
 451	.ndp_sign = USB_CDC_NCM_NDP16_NOCRC_SIGN,
 452	.nth_size = sizeof(struct usb_cdc_ncm_nth16),
 453	.ndp_size = sizeof(struct usb_cdc_ncm_ndp16),
 454	.dpe_size = sizeof(struct usb_cdc_ncm_dpe16),
 455	.ndplen_align = 4,
 456	.dgram_item_len = 1,
 457	.block_length = 1,
 458	.ndp_index = 1,
 459	.reserved1 = 0,
 460	.reserved2 = 0,
 461	.next_ndp_index = 1,
 462};
 463
 464static const struct ndp_parser_opts ndp32_opts = {
 465	.nth_sign = USB_CDC_NCM_NTH32_SIGN,
 466	.ndp_sign = USB_CDC_NCM_NDP32_NOCRC_SIGN,
 467	.nth_size = sizeof(struct usb_cdc_ncm_nth32),
 468	.ndp_size = sizeof(struct usb_cdc_ncm_ndp32),
 469	.dpe_size = sizeof(struct usb_cdc_ncm_dpe32),
 470	.ndplen_align = 8,
 471	.dgram_item_len = 2,
 472	.block_length = 2,
 473	.ndp_index = 2,
 474	.reserved1 = 1,
 475	.reserved2 = 2,
 476	.next_ndp_index = 2,
 477};
 478
 479static inline void put_ncm(__le16 **p, unsigned size, unsigned val)
 480{
 481	switch (size) {
 482	case 1:
 483		put_unaligned_le16((u16)val, *p);
 484		break;
 485	case 2:
 486		put_unaligned_le32((u32)val, *p);
 487
 488		break;
 489	default:
 490		BUG();
 491	}
 492
 493	*p += size;
 494}
 495
 496static inline unsigned get_ncm(__le16 **p, unsigned size)
 497{
 498	unsigned tmp;
 499
 500	switch (size) {
 501	case 1:
 502		tmp = get_unaligned_le16(*p);
 503		break;
 504	case 2:
 505		tmp = get_unaligned_le32(*p);
 506		break;
 507	default:
 508		BUG();
 509	}
 510
 511	*p += size;
 512	return tmp;
 513}
 514
 515/*-------------------------------------------------------------------------*/
 516
 517static inline void ncm_reset_values(struct f_ncm *ncm)
 518{
 519	ncm->parser_opts = &ndp16_opts;
 520	ncm->is_crc = false;
 521	ncm->ndp_sign = ncm->parser_opts->ndp_sign;
 522	ncm->port.cdc_filter = DEFAULT_FILTER;
 523
 524	/* doesn't make sense for ncm, fixed size used */
 525	ncm->port.header_len = 0;
 526
 527	ncm->port.fixed_out_len = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize);
 528	ncm->port.fixed_in_len = NTB_DEFAULT_IN_SIZE;
 529}
 530
 531/*
 532 * Context: ncm->lock held
 533 */
 534static void ncm_do_notify(struct f_ncm *ncm)
 535{
 536	struct usb_request		*req = ncm->notify_req;
 537	struct usb_cdc_notification	*event;
 538	struct usb_composite_dev	*cdev = ncm->port.func.config->cdev;
 539	__le32				*data;
 540	int				status;
 541
 542	/* notification already in flight? */
 543	if (atomic_read(&ncm->notify_count))
 544		return;
 545
 546	event = req->buf;
 547	switch (ncm->notify_state) {
 548	case NCM_NOTIFY_NONE:
 549		return;
 550
 551	case NCM_NOTIFY_CONNECT:
 552		event->bNotificationType = USB_CDC_NOTIFY_NETWORK_CONNECTION;
 553		if (ncm->is_open)
 554			event->wValue = cpu_to_le16(1);
 555		else
 556			event->wValue = cpu_to_le16(0);
 557		event->wLength = 0;
 558		req->length = sizeof *event;
 559
 560		DBG(cdev, "notify connect %s\n",
 561				ncm->is_open ? "true" : "false");
 562		ncm->notify_state = NCM_NOTIFY_NONE;
 563		break;
 564
 565	case NCM_NOTIFY_SPEED:
 566		event->bNotificationType = USB_CDC_NOTIFY_SPEED_CHANGE;
 567		event->wValue = cpu_to_le16(0);
 568		event->wLength = cpu_to_le16(8);
 569		req->length = NCM_STATUS_BYTECOUNT;
 570
 571		/* SPEED_CHANGE data is up/down speeds in bits/sec */
 572		data = req->buf + sizeof *event;
 573		data[0] = cpu_to_le32(gether_bitrate(cdev->gadget));
 574		data[1] = data[0];
 575
 576		DBG(cdev, "notify speed %u\n", gether_bitrate(cdev->gadget));
 577		ncm->notify_state = NCM_NOTIFY_CONNECT;
 578		break;
 579	}
 580	event->bmRequestType = 0xA1;
 581	event->wIndex = cpu_to_le16(ncm->ctrl_id);
 582
 583	atomic_inc(&ncm->notify_count);
 584
 585	/*
 586	 * In double buffering if there is a space in FIFO,
 587	 * completion callback can be called right after the call,
 588	 * so unlocking
 589	 */
 590	spin_unlock(&ncm->lock);
 591	status = usb_ep_queue(ncm->notify, req, GFP_ATOMIC);
 592	spin_lock(&ncm->lock);
 593	if (status < 0) {
 594		atomic_dec(&ncm->notify_count);
 595		DBG(cdev, "notify --> %d\n", status);
 596	}
 597}
 598
 599/*
 600 * Context: ncm->lock held
 601 */
 602static void ncm_notify(struct f_ncm *ncm)
 603{
 604	/*
 605	 * NOTE on most versions of Linux, host side cdc-ethernet
 606	 * won't listen for notifications until its netdevice opens.
 607	 * The first notification then sits in the FIFO for a long
 608	 * time, and the second one is queued.
 609	 *
 610	 * If ncm_notify() is called before the second (CONNECT)
 611	 * notification is sent, then it will reset to send the SPEED
 612	 * notificaion again (and again, and again), but it's not a problem
 613	 */
 614	ncm->notify_state = NCM_NOTIFY_SPEED;
 615	ncm_do_notify(ncm);
 616}
 617
 618static void ncm_notify_complete(struct usb_ep *ep, struct usb_request *req)
 619{
 620	struct f_ncm			*ncm = req->context;
 621	struct usb_composite_dev	*cdev = ncm->port.func.config->cdev;
 622	struct usb_cdc_notification	*event = req->buf;
 623
 624	spin_lock(&ncm->lock);
 625	switch (req->status) {
 626	case 0:
 627		VDBG(cdev, "Notification %02x sent\n",
 628		     event->bNotificationType);
 629		atomic_dec(&ncm->notify_count);
 630		break;
 631	case -ECONNRESET:
 632	case -ESHUTDOWN:
 633		atomic_set(&ncm->notify_count, 0);
 634		ncm->notify_state = NCM_NOTIFY_NONE;
 635		break;
 636	default:
 637		DBG(cdev, "event %02x --> %d\n",
 638			event->bNotificationType, req->status);
 639		atomic_dec(&ncm->notify_count);
 640		break;
 641	}
 642	ncm_do_notify(ncm);
 643	spin_unlock(&ncm->lock);
 644}
 645
 646static void ncm_ep0out_complete(struct usb_ep *ep, struct usb_request *req)
 647{
 648	/* now for SET_NTB_INPUT_SIZE only */
 649	unsigned		in_size;
 650	struct usb_function	*f = req->context;
 651	struct f_ncm		*ncm = func_to_ncm(f);
 652	struct usb_composite_dev *cdev = f->config->cdev;
 653
 654	req->context = NULL;
 655	if (req->status || req->actual != req->length) {
 656		DBG(cdev, "Bad control-OUT transfer\n");
 657		goto invalid;
 658	}
 659
 660	in_size = get_unaligned_le32(req->buf);
 661	if (in_size < USB_CDC_NCM_NTB_MIN_IN_SIZE ||
 662	    in_size > le32_to_cpu(ntb_parameters.dwNtbInMaxSize)) {
 663		DBG(cdev, "Got wrong INPUT SIZE (%d) from host\n", in_size);
 664		goto invalid;
 665	}
 666
 667	ncm->port.fixed_in_len = in_size;
 668	VDBG(cdev, "Set NTB INPUT SIZE %d\n", in_size);
 669	return;
 670
 671invalid:
 672	usb_ep_set_halt(ep);
 673	return;
 674}
 675
 676static int ncm_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
 677{
 678	struct f_ncm		*ncm = func_to_ncm(f);
 679	struct usb_composite_dev *cdev = f->config->cdev;
 680	struct usb_request	*req = cdev->req;
 681	int			value = -EOPNOTSUPP;
 682	u16			w_index = le16_to_cpu(ctrl->wIndex);
 683	u16			w_value = le16_to_cpu(ctrl->wValue);
 684	u16			w_length = le16_to_cpu(ctrl->wLength);
 685
 686	/*
 687	 * composite driver infrastructure handles everything except
 688	 * CDC class messages; interface activation uses set_alt().
 689	 */
 690	switch ((ctrl->bRequestType << 8) | ctrl->bRequest) {
 691	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 692			| USB_CDC_SET_ETHERNET_PACKET_FILTER:
 693		/*
 694		 * see 6.2.30: no data, wIndex = interface,
 695		 * wValue = packet filter bitmap
 696		 */
 697		if (w_length != 0 || w_index != ncm->ctrl_id)
 698			goto invalid;
 699		DBG(cdev, "packet filter %02x\n", w_value);
 700		/*
 701		 * REVISIT locking of cdc_filter.  This assumes the UDC
 702		 * driver won't have a concurrent packet TX irq running on
 703		 * another CPU; or that if it does, this write is atomic...
 704		 */
 705		ncm->port.cdc_filter = w_value;
 706		value = 0;
 707		break;
 708	/*
 709	 * and optionally:
 710	 * case USB_CDC_SEND_ENCAPSULATED_COMMAND:
 711	 * case USB_CDC_GET_ENCAPSULATED_RESPONSE:
 712	 * case USB_CDC_SET_ETHERNET_MULTICAST_FILTERS:
 713	 * case USB_CDC_SET_ETHERNET_PM_PATTERN_FILTER:
 714	 * case USB_CDC_GET_ETHERNET_PM_PATTERN_FILTER:
 715	 * case USB_CDC_GET_ETHERNET_STATISTIC:
 716	 */
 717
 718	case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 719		| USB_CDC_GET_NTB_PARAMETERS:
 720
 721		if (w_length == 0 || w_value != 0 || w_index != ncm->ctrl_id)
 722			goto invalid;
 723		value = w_length > sizeof ntb_parameters ?
 724			sizeof ntb_parameters : w_length;
 725		memcpy(req->buf, &ntb_parameters, value);
 726		VDBG(cdev, "Host asked NTB parameters\n");
 727		break;
 728
 729	case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 730		| USB_CDC_GET_NTB_INPUT_SIZE:
 731
 732		if (w_length < 4 || w_value != 0 || w_index != ncm->ctrl_id)
 733			goto invalid;
 734		put_unaligned_le32(ncm->port.fixed_in_len, req->buf);
 735		value = 4;
 736		VDBG(cdev, "Host asked INPUT SIZE, sending %d\n",
 737		     ncm->port.fixed_in_len);
 738		break;
 739
 740	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 741		| USB_CDC_SET_NTB_INPUT_SIZE:
 742	{
 743		if (w_length != 4 || w_value != 0 || w_index != ncm->ctrl_id)
 744			goto invalid;
 745		req->complete = ncm_ep0out_complete;
 746		req->length = w_length;
 747		req->context = f;
 748
 749		value = req->length;
 750		break;
 751	}
 752
 753	case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 754		| USB_CDC_GET_NTB_FORMAT:
 755	{
 756		uint16_t format;
 757
 758		if (w_length < 2 || w_value != 0 || w_index != ncm->ctrl_id)
 759			goto invalid;
 760		format = (ncm->parser_opts == &ndp16_opts) ? 0x0000 : 0x0001;
 761		put_unaligned_le16(format, req->buf);
 762		value = 2;
 763		VDBG(cdev, "Host asked NTB FORMAT, sending %d\n", format);
 764		break;
 765	}
 766
 767	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 768		| USB_CDC_SET_NTB_FORMAT:
 769	{
 770		if (w_length != 0 || w_index != ncm->ctrl_id)
 771			goto invalid;
 772		switch (w_value) {
 773		case 0x0000:
 774			ncm->parser_opts = &ndp16_opts;
 775			DBG(cdev, "NCM16 selected\n");
 776			break;
 777		case 0x0001:
 778			ncm->parser_opts = &ndp32_opts;
 779			DBG(cdev, "NCM32 selected\n");
 780			break;
 781		default:
 782			goto invalid;
 783		}
 784		value = 0;
 785		break;
 786	}
 787	case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 788		| USB_CDC_GET_CRC_MODE:
 789	{
 790		uint16_t is_crc;
 791
 792		if (w_length < 2 || w_value != 0 || w_index != ncm->ctrl_id)
 793			goto invalid;
 794		is_crc = ncm->is_crc ? 0x0001 : 0x0000;
 795		put_unaligned_le16(is_crc, req->buf);
 796		value = 2;
 797		VDBG(cdev, "Host asked CRC MODE, sending %d\n", is_crc);
 798		break;
 799	}
 800
 801	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 802		| USB_CDC_SET_CRC_MODE:
 803	{
 804		if (w_length != 0 || w_index != ncm->ctrl_id)
 805			goto invalid;
 806		switch (w_value) {
 807		case 0x0000:
 808			ncm->is_crc = false;
 809			DBG(cdev, "non-CRC mode selected\n");
 810			break;
 811		case 0x0001:
 812			ncm->is_crc = true;
 813			DBG(cdev, "CRC mode selected\n");
 814			break;
 815		default:
 816			goto invalid;
 817		}
 818		value = 0;
 819		break;
 820	}
 821
 822	/* and disabled in ncm descriptor: */
 823	/* case USB_CDC_GET_NET_ADDRESS: */
 824	/* case USB_CDC_SET_NET_ADDRESS: */
 825	/* case USB_CDC_GET_MAX_DATAGRAM_SIZE: */
 826	/* case USB_CDC_SET_MAX_DATAGRAM_SIZE: */
 827
 828	default:
 829invalid:
 830		DBG(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n",
 831			ctrl->bRequestType, ctrl->bRequest,
 832			w_value, w_index, w_length);
 833	}
 834	ncm->ndp_sign = ncm->parser_opts->ndp_sign |
 835		(ncm->is_crc ? NCM_NDP_HDR_CRC : 0);
 836
 837	/* respond with data transfer or status phase? */
 838	if (value >= 0) {
 839		DBG(cdev, "ncm req%02x.%02x v%04x i%04x l%d\n",
 840			ctrl->bRequestType, ctrl->bRequest,
 841			w_value, w_index, w_length);
 842		req->zero = 0;
 843		req->length = value;
 844		value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
 845		if (value < 0)
 846			ERROR(cdev, "ncm req %02x.%02x response err %d\n",
 847					ctrl->bRequestType, ctrl->bRequest,
 848					value);
 849	}
 850
 851	/* device either stalls (value < 0) or reports success */
 852	return value;
 853}
 854
 855
 856static int ncm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 857{
 858	struct f_ncm		*ncm = func_to_ncm(f);
 859	struct usb_composite_dev *cdev = f->config->cdev;
 860
 861	/* Control interface has only altsetting 0 */
 862	if (intf == ncm->ctrl_id) {
 863		if (alt != 0)
 864			goto fail;
 865
 866		DBG(cdev, "reset ncm control %d\n", intf);
 867		usb_ep_disable(ncm->notify);
 868
 869		if (!(ncm->notify->desc)) {
 870			DBG(cdev, "init ncm ctrl %d\n", intf);
 871			if (config_ep_by_speed(cdev->gadget, f, ncm->notify))
 872				goto fail;
 873		}
 874		usb_ep_enable(ncm->notify);
 875
 876	/* Data interface has two altsettings, 0 and 1 */
 877	} else if (intf == ncm->data_id) {
 878		if (alt > 1)
 879			goto fail;
 880
 881		if (ncm->port.in_ep->enabled) {
 882			DBG(cdev, "reset ncm\n");
 883			ncm->netdev = NULL;
 884			gether_disconnect(&ncm->port);
 885			ncm_reset_values(ncm);
 886		}
 887
 888		/*
 889		 * CDC Network only sends data in non-default altsettings.
 890		 * Changing altsettings resets filters, statistics, etc.
 891		 */
 892		if (alt == 1) {
 893			struct net_device	*net;
 894
 895			if (!ncm->port.in_ep->desc ||
 896			    !ncm->port.out_ep->desc) {
 897				DBG(cdev, "init ncm\n");
 898				if (config_ep_by_speed(cdev->gadget, f,
 899						       ncm->port.in_ep) ||
 900				    config_ep_by_speed(cdev->gadget, f,
 901						       ncm->port.out_ep)) {
 902					ncm->port.in_ep->desc = NULL;
 903					ncm->port.out_ep->desc = NULL;
 904					goto fail;
 905				}
 906			}
 907
 908			/* TODO */
 909			/* Enable zlps by default for NCM conformance;
 910			 * override for musb_hdrc (avoids txdma ovhead)
 911			 */
 912			ncm->port.is_zlp_ok =
 913				gadget_is_zlp_supported(cdev->gadget);
 914			ncm->port.cdc_filter = DEFAULT_FILTER;
 915			DBG(cdev, "activate ncm\n");
 916			net = gether_connect(&ncm->port);
 917			if (IS_ERR(net))
 918				return PTR_ERR(net);
 919			ncm->netdev = net;
 920		}
 921
 922		spin_lock(&ncm->lock);
 923		ncm_notify(ncm);
 924		spin_unlock(&ncm->lock);
 925	} else
 926		goto fail;
 927
 928	return 0;
 929fail:
 930	return -EINVAL;
 931}
 932
 933/*
 934 * Because the data interface supports multiple altsettings,
 935 * this NCM function *MUST* implement a get_alt() method.
 936 */
 937static int ncm_get_alt(struct usb_function *f, unsigned intf)
 938{
 939	struct f_ncm		*ncm = func_to_ncm(f);
 940
 941	if (intf == ncm->ctrl_id)
 942		return 0;
 943	return ncm->port.in_ep->enabled ? 1 : 0;
 944}
 945
 946static struct sk_buff *package_for_tx(struct f_ncm *ncm)
 947{
 948	__le16		*ntb_iter;
 949	struct sk_buff	*skb2 = NULL;
 950	unsigned	ndp_pad;
 951	unsigned	ndp_index;
 952	unsigned	new_len;
 953
 954	const struct ndp_parser_opts *opts = ncm->parser_opts;
 955	const int ndp_align = le16_to_cpu(ntb_parameters.wNdpInAlignment);
 956	const int dgram_idx_len = 2 * 2 * opts->dgram_item_len;
 957
 958	/* Stop the timer */
 959	hrtimer_try_to_cancel(&ncm->task_timer);
 960
 961	ndp_pad = ALIGN(ncm->skb_tx_data->len, ndp_align) -
 962			ncm->skb_tx_data->len;
 963	ndp_index = ncm->skb_tx_data->len + ndp_pad;
 964	new_len = ndp_index + dgram_idx_len + ncm->skb_tx_ndp->len;
 965
 966	/* Set the final BlockLength and wNdpIndex */
 967	ntb_iter = (void *) ncm->skb_tx_data->data;
 968	/* Increment pointer to BlockLength */
 969	ntb_iter += 2 + 1 + 1;
 970	put_ncm(&ntb_iter, opts->block_length, new_len);
 971	put_ncm(&ntb_iter, opts->ndp_index, ndp_index);
 972
 973	/* Set the final NDP wLength */
 974	new_len = opts->ndp_size +
 975			(ncm->ndp_dgram_count * dgram_idx_len);
 976	ncm->ndp_dgram_count = 0;
 977	/* Increment from start to wLength */
 978	ntb_iter = (void *) ncm->skb_tx_ndp->data;
 979	ntb_iter += 2;
 980	put_unaligned_le16(new_len, ntb_iter);
 981
 982	/* Merge the skbs */
 983	swap(skb2, ncm->skb_tx_data);
 984	if (ncm->skb_tx_data) {
 985		dev_consume_skb_any(ncm->skb_tx_data);
 986		ncm->skb_tx_data = NULL;
 987	}
 988
 989	/* Insert NDP alignment. */
 990	skb_put_zero(skb2, ndp_pad);
 991
 992	/* Copy NTB across. */
 993	skb_put_data(skb2, ncm->skb_tx_ndp->data, ncm->skb_tx_ndp->len);
 994	dev_consume_skb_any(ncm->skb_tx_ndp);
 995	ncm->skb_tx_ndp = NULL;
 996
 997	/* Insert zero'd datagram. */
 998	skb_put_zero(skb2, dgram_idx_len);
 999
1000	return skb2;
1001}
1002
1003static struct sk_buff *ncm_wrap_ntb(struct gether *port,
1004				    struct sk_buff *skb)
1005{
1006	struct f_ncm	*ncm = func_to_ncm(&port->func);
1007	struct sk_buff	*skb2 = NULL;
1008
1009	if (skb) {
1010		int		ncb_len = 0;
1011		__le16		*ntb_data;
1012		__le16		*ntb_ndp;
1013		int		dgram_pad;
1014
1015		unsigned	max_size = ncm->port.fixed_in_len;
1016		const struct ndp_parser_opts *opts = ncm->parser_opts;
1017		const int ndp_align = le16_to_cpu(ntb_parameters.wNdpInAlignment);
1018		const int div = le16_to_cpu(ntb_parameters.wNdpInDivisor);
1019		const int rem = le16_to_cpu(ntb_parameters.wNdpInPayloadRemainder);
1020		const int dgram_idx_len = 2 * 2 * opts->dgram_item_len;
1021
1022		/* Add the CRC if required up front */
1023		if (ncm->is_crc) {
1024			uint32_t	crc;
1025			__le16		*crc_pos;
1026
1027			crc = ~crc32_le(~0,
1028					skb->data,
1029					skb->len);
1030			crc_pos = skb_put(skb, sizeof(uint32_t));
1031			put_unaligned_le32(crc, crc_pos);
1032		}
1033
1034		/* If the new skb is too big for the current NCM NTB then
1035		 * set the current stored skb to be sent now and clear it
1036		 * ready for new data.
1037		 * NOTE: Assume maximum align for speed of calculation.
1038		 */
1039		if (ncm->skb_tx_data
1040		    && (ncm->ndp_dgram_count >= TX_MAX_NUM_DPE
1041		    || (ncm->skb_tx_data->len +
1042		    div + rem + skb->len +
1043		    ncm->skb_tx_ndp->len + ndp_align + (2 * dgram_idx_len))
1044		    > max_size)) {
1045			skb2 = package_for_tx(ncm);
1046			if (!skb2)
1047				goto err;
1048		}
1049
1050		if (!ncm->skb_tx_data) {
1051			ncb_len = opts->nth_size;
1052			dgram_pad = ALIGN(ncb_len, div) + rem - ncb_len;
1053			ncb_len += dgram_pad;
1054
1055			/* Create a new skb for the NTH and datagrams. */
1056			ncm->skb_tx_data = alloc_skb(max_size, GFP_ATOMIC);
1057			if (!ncm->skb_tx_data)
1058				goto err;
1059
1060			ncm->skb_tx_data->dev = ncm->netdev;
1061			ntb_data = skb_put_zero(ncm->skb_tx_data, ncb_len);
1062			/* dwSignature */
1063			put_unaligned_le32(opts->nth_sign, ntb_data);
1064			ntb_data += 2;
1065			/* wHeaderLength */
1066			put_unaligned_le16(opts->nth_size, ntb_data++);
1067
1068			/* Allocate an skb for storing the NDP,
1069			 * TX_MAX_NUM_DPE should easily suffice for a
1070			 * 16k packet.
1071			 */
1072			ncm->skb_tx_ndp = alloc_skb((int)(opts->ndp_size
1073						    + opts->dpe_size
1074						    * TX_MAX_NUM_DPE),
1075						    GFP_ATOMIC);
1076			if (!ncm->skb_tx_ndp)
1077				goto err;
1078
1079			ncm->skb_tx_ndp->dev = ncm->netdev;
1080			ntb_ndp = skb_put(ncm->skb_tx_ndp, opts->ndp_size);
1081			memset(ntb_ndp, 0, ncb_len);
1082			/* dwSignature */
1083			put_unaligned_le32(ncm->ndp_sign, ntb_ndp);
1084			ntb_ndp += 2;
1085
1086			/* There is always a zeroed entry */
1087			ncm->ndp_dgram_count = 1;
1088
1089			/* Note: we skip opts->next_ndp_index */
1090
1091			/* Start the timer. */
1092			hrtimer_start(&ncm->task_timer, TX_TIMEOUT_NSECS,
1093				      HRTIMER_MODE_REL_SOFT);
1094		}
1095
1096		/* Add the datagram position entries */
1097		ntb_ndp = skb_put_zero(ncm->skb_tx_ndp, dgram_idx_len);
1098
1099		ncb_len = ncm->skb_tx_data->len;
1100		dgram_pad = ALIGN(ncb_len, div) + rem - ncb_len;
1101		ncb_len += dgram_pad;
1102
1103		/* (d)wDatagramIndex */
1104		put_ncm(&ntb_ndp, opts->dgram_item_len, ncb_len);
1105		/* (d)wDatagramLength */
1106		put_ncm(&ntb_ndp, opts->dgram_item_len, skb->len);
1107		ncm->ndp_dgram_count++;
1108
1109		/* Add the new data to the skb */
1110		skb_put_zero(ncm->skb_tx_data, dgram_pad);
1111		skb_put_data(ncm->skb_tx_data, skb->data, skb->len);
1112		dev_consume_skb_any(skb);
1113		skb = NULL;
1114
1115	} else if (ncm->skb_tx_data) {
1116		/* If we get here ncm_wrap_ntb() was called with NULL skb,
1117		 * because eth_start_xmit() was called with NULL skb by
1118		 * ncm_tx_timeout() - hence, this is our signal to flush/send.
1119		 */
1120		skb2 = package_for_tx(ncm);
1121		if (!skb2)
1122			goto err;
1123	}
1124
1125	return skb2;
1126
1127err:
1128	ncm->netdev->stats.tx_dropped++;
1129
1130	if (skb)
1131		dev_kfree_skb_any(skb);
1132	if (ncm->skb_tx_data)
1133		dev_kfree_skb_any(ncm->skb_tx_data);
1134	if (ncm->skb_tx_ndp)
1135		dev_kfree_skb_any(ncm->skb_tx_ndp);
1136
1137	return NULL;
1138}
1139
1140/*
1141 * The transmit should only be run if no skb data has been sent
1142 * for a certain duration.
1143 */
1144static enum hrtimer_restart ncm_tx_timeout(struct hrtimer *data)
1145{
1146	struct f_ncm *ncm = container_of(data, struct f_ncm, task_timer);
1147	struct net_device *netdev = READ_ONCE(ncm->netdev);
1148
1149	if (netdev) {
1150		/* XXX This allowance of a NULL skb argument to ndo_start_xmit
1151		 * XXX is not sane.  The gadget layer should be redesigned so
1152		 * XXX that the dev->wrap() invocations to build SKBs is transparent
1153		 * XXX and performed in some way outside of the ndo_start_xmit
1154		 * XXX interface.
1155		 *
1156		 * This will call directly into u_ether's eth_start_xmit()
1157		 */
1158		netdev->netdev_ops->ndo_start_xmit(NULL, netdev);
1159	}
1160	return HRTIMER_NORESTART;
1161}
1162
1163static int ncm_unwrap_ntb(struct gether *port,
1164			  struct sk_buff *skb,
1165			  struct sk_buff_head *list)
1166{
1167	struct f_ncm	*ncm = func_to_ncm(&port->func);
1168	unsigned char	*ntb_ptr = skb->data;
1169	__le16		*tmp;
1170	unsigned	index, index2;
1171	int		ndp_index;
1172	unsigned	dg_len, dg_len2;
1173	unsigned	ndp_len;
1174	unsigned	block_len;
1175	struct sk_buff	*skb2;
1176	int		ret = -EINVAL;
1177	unsigned	ntb_max = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize);
1178	unsigned	frame_max;
1179	const struct ndp_parser_opts *opts = ncm->parser_opts;
1180	unsigned	crc_len = ncm->is_crc ? sizeof(uint32_t) : 0;
1181	int		dgram_counter;
1182	int		to_process = skb->len;
1183	struct f_ncm_opts *ncm_opts;
1184
1185	ncm_opts = container_of(port->func.fi, struct f_ncm_opts, func_inst);
1186	frame_max = ncm_opts->max_segment_size;
1187
1188parse_ntb:
1189	tmp = (__le16 *)ntb_ptr;
1190
1191	/* dwSignature */
1192	if (get_unaligned_le32(tmp) != opts->nth_sign) {
1193		INFO(port->func.config->cdev, "Wrong NTH SIGN, skblen %d\n",
1194			skb->len);
1195		print_hex_dump(KERN_INFO, "HEAD:", DUMP_PREFIX_ADDRESS, 32, 1,
1196			       skb->data, 32, false);
1197
1198		goto err;
1199	}
1200	tmp += 2;
1201	/* wHeaderLength */
1202	if (get_unaligned_le16(tmp++) != opts->nth_size) {
1203		INFO(port->func.config->cdev, "Wrong NTB headersize\n");
1204		goto err;
1205	}
1206	tmp++; /* skip wSequence */
1207
1208	block_len = get_ncm(&tmp, opts->block_length);
1209	/* (d)wBlockLength */
1210	if (block_len > ntb_max) {
1211		INFO(port->func.config->cdev, "OUT size exceeded\n");
1212		goto err;
1213	}
1214
1215	ndp_index = get_ncm(&tmp, opts->ndp_index);
1216
1217	/* Run through all the NDP's in the NTB */
1218	do {
1219		/*
1220		 * NCM 3.2
1221		 * dwNdpIndex
1222		 */
1223		if (((ndp_index % 4) != 0) ||
1224				(ndp_index < opts->nth_size) ||
1225				(ndp_index > (block_len -
1226					      opts->ndp_size))) {
1227			INFO(port->func.config->cdev, "Bad index: %#X\n",
1228			     ndp_index);
1229			goto err;
1230		}
1231
1232		/*
1233		 * walk through NDP
1234		 * dwSignature
1235		 */
1236		tmp = (__le16 *)(ntb_ptr + ndp_index);
1237		if (get_unaligned_le32(tmp) != ncm->ndp_sign) {
1238			INFO(port->func.config->cdev, "Wrong NDP SIGN\n");
1239			goto err;
1240		}
1241		tmp += 2;
1242
1243		ndp_len = get_unaligned_le16(tmp++);
1244		/*
1245		 * NCM 3.3.1
1246		 * wLength
1247		 * entry is 2 items
1248		 * item size is 16/32 bits, opts->dgram_item_len * 2 bytes
1249		 * minimal: struct usb_cdc_ncm_ndpX + normal entry + zero entry
1250		 * Each entry is a dgram index and a dgram length.
1251		 */
1252		if ((ndp_len < opts->ndp_size
1253				+ 2 * 2 * (opts->dgram_item_len * 2)) ||
1254				(ndp_len % opts->ndplen_align != 0)) {
1255			INFO(port->func.config->cdev, "Bad NDP length: %#X\n",
1256			     ndp_len);
1257			goto err;
1258		}
1259		tmp += opts->reserved1;
1260		/* Check for another NDP (d)wNextNdpIndex */
1261		ndp_index = get_ncm(&tmp, opts->next_ndp_index);
1262		tmp += opts->reserved2;
1263
1264		ndp_len -= opts->ndp_size;
1265		index2 = get_ncm(&tmp, opts->dgram_item_len);
1266		dg_len2 = get_ncm(&tmp, opts->dgram_item_len);
1267		dgram_counter = 0;
1268
1269		do {
1270			index = index2;
1271			/* wDatagramIndex[0] */
1272			if ((index < opts->nth_size) ||
1273					(index > block_len - opts->dpe_size)) {
1274				INFO(port->func.config->cdev,
1275				     "Bad index: %#X\n", index);
1276				goto err;
1277			}
1278
1279			dg_len = dg_len2;
1280			/*
1281			 * wDatagramLength[0]
1282			 * ethernet hdr + crc or larger than max frame size
1283			 */
1284			if ((dg_len < 14 + crc_len) ||
1285					(dg_len > frame_max)) {
1286				INFO(port->func.config->cdev,
1287				     "Bad dgram length: %#X\n", dg_len);
1288				goto err;
1289			}
1290			if (ncm->is_crc) {
1291				uint32_t crc, crc2;
1292
1293				crc = get_unaligned_le32(ntb_ptr +
1294							 index + dg_len -
1295							 crc_len);
1296				crc2 = ~crc32_le(~0,
1297						 ntb_ptr + index,
1298						 dg_len - crc_len);
1299				if (crc != crc2) {
1300					INFO(port->func.config->cdev,
1301					     "Bad CRC\n");
1302					goto err;
1303				}
1304			}
1305
1306			index2 = get_ncm(&tmp, opts->dgram_item_len);
1307			dg_len2 = get_ncm(&tmp, opts->dgram_item_len);
1308
1309			/* wDatagramIndex[1] */
1310			if (index2 > block_len - opts->dpe_size) {
1311				INFO(port->func.config->cdev,
1312				     "Bad index: %#X\n", index2);
1313				goto err;
1314			}
1315
1316			/*
1317			 * Copy the data into a new skb.
1318			 * This ensures the truesize is correct
1319			 */
1320			skb2 = netdev_alloc_skb_ip_align(ncm->netdev,
1321							 dg_len - crc_len);
1322			if (skb2 == NULL)
1323				goto err;
1324			skb_put_data(skb2, ntb_ptr + index,
1325				     dg_len - crc_len);
1326
1327			skb_queue_tail(list, skb2);
1328
1329			ndp_len -= 2 * (opts->dgram_item_len * 2);
1330
1331			dgram_counter++;
1332			if (index2 == 0 || dg_len2 == 0)
1333				break;
1334		} while (ndp_len > 2 * (opts->dgram_item_len * 2));
1335	} while (ndp_index);
1336
1337	VDBG(port->func.config->cdev,
1338	     "Parsed NTB with %d frames\n", dgram_counter);
1339
1340	to_process -= block_len;
1341
1342	/*
1343	 * Windows NCM driver avoids USB ZLPs by adding a 1-byte
1344	 * zero pad as needed.
1345	 */
1346	if (to_process == 1 &&
1347	    (*(unsigned char *)(ntb_ptr + block_len) == 0x00)) {
1348		to_process--;
1349	} else if ((to_process > 0) && (block_len != 0)) {
1350		ntb_ptr = (unsigned char *)(ntb_ptr + block_len);
1351		goto parse_ntb;
1352	}
1353
1354	dev_consume_skb_any(skb);
1355
 
 
1356	return 0;
1357err:
1358	skb_queue_purge(list);
1359	dev_kfree_skb_any(skb);
1360	return ret;
1361}
1362
1363static void ncm_disable(struct usb_function *f)
1364{
1365	struct f_ncm		*ncm = func_to_ncm(f);
1366	struct usb_composite_dev *cdev = f->config->cdev;
1367
1368	DBG(cdev, "ncm deactivated\n");
1369
1370	if (ncm->port.in_ep->enabled) {
1371		ncm->netdev = NULL;
1372		gether_disconnect(&ncm->port);
1373	}
1374
1375	if (ncm->notify->enabled) {
1376		usb_ep_disable(ncm->notify);
1377		ncm->notify->desc = NULL;
1378	}
1379}
1380
1381/*-------------------------------------------------------------------------*/
1382
1383/*
1384 * Callbacks let us notify the host about connect/disconnect when the
1385 * net device is opened or closed.
1386 *
1387 * For testing, note that link states on this side include both opened
1388 * and closed variants of:
1389 *
1390 *   - disconnected/unconfigured
1391 *   - configured but inactive (data alt 0)
1392 *   - configured and active (data alt 1)
1393 *
1394 * Each needs to be tested with unplug, rmmod, SET_CONFIGURATION, and
1395 * SET_INTERFACE (altsetting).  Remember also that "configured" doesn't
1396 * imply the host is actually polling the notification endpoint, and
1397 * likewise that "active" doesn't imply it's actually using the data
1398 * endpoints for traffic.
1399 */
1400
1401static void ncm_open(struct gether *geth)
1402{
1403	struct f_ncm		*ncm = func_to_ncm(&geth->func);
1404
1405	DBG(ncm->port.func.config->cdev, "%s\n", __func__);
1406
1407	spin_lock(&ncm->lock);
1408	ncm->is_open = true;
1409	ncm_notify(ncm);
1410	spin_unlock(&ncm->lock);
1411}
1412
1413static void ncm_close(struct gether *geth)
1414{
1415	struct f_ncm		*ncm = func_to_ncm(&geth->func);
1416
1417	DBG(ncm->port.func.config->cdev, "%s\n", __func__);
1418
1419	spin_lock(&ncm->lock);
1420	ncm->is_open = false;
1421	ncm_notify(ncm);
1422	spin_unlock(&ncm->lock);
1423}
1424
1425/*-------------------------------------------------------------------------*/
1426
1427/* ethernet function driver setup/binding */
1428
1429static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
1430{
1431	struct usb_composite_dev *cdev = c->cdev;
1432	struct f_ncm		*ncm = func_to_ncm(f);
1433	struct usb_string	*us;
1434	int			status = 0;
1435	struct usb_ep		*ep;
1436	struct f_ncm_opts	*ncm_opts;
1437
1438	if (!can_support_ecm(cdev->gadget))
1439		return -EINVAL;
1440
1441	ncm_opts = container_of(f->fi, struct f_ncm_opts, func_inst);
1442
1443	if (cdev->use_os_string) {
1444		f->os_desc_table = kzalloc(sizeof(*f->os_desc_table),
1445					   GFP_KERNEL);
1446		if (!f->os_desc_table)
1447			return -ENOMEM;
1448		f->os_desc_n = 1;
1449		f->os_desc_table[0].os_desc = &ncm_opts->ncm_os_desc;
1450	}
1451
1452	mutex_lock(&ncm_opts->lock);
1453	gether_set_gadget(ncm_opts->net, cdev->gadget);
 
 
 
 
 
1454	if (!ncm_opts->bound) {
1455		ncm_opts->net->mtu = (ncm_opts->max_segment_size - ETH_HLEN);
 
1456		status = gether_register_netdev(ncm_opts->net);
 
 
 
 
1457	}
1458	mutex_unlock(&ncm_opts->lock);
1459
1460	if (status)
1461		goto fail;
1462
1463	ncm_opts->bound = true;
1464
1465	us = usb_gstrings_attach(cdev, ncm_strings,
1466				 ARRAY_SIZE(ncm_string_defs));
1467	if (IS_ERR(us)) {
1468		status = PTR_ERR(us);
1469		goto fail;
1470	}
1471	ncm_control_intf.iInterface = us[STRING_CTRL_IDX].id;
1472	ncm_data_nop_intf.iInterface = us[STRING_DATA_IDX].id;
1473	ncm_data_intf.iInterface = us[STRING_DATA_IDX].id;
1474	ecm_desc.iMACAddress = us[STRING_MAC_IDX].id;
1475	ncm_iad_desc.iFunction = us[STRING_IAD_IDX].id;
1476
1477	/* allocate instance-specific interface IDs */
1478	status = usb_interface_id(c, f);
1479	if (status < 0)
1480		goto fail;
1481	ncm->ctrl_id = status;
1482	ncm_iad_desc.bFirstInterface = status;
1483
1484	ncm_control_intf.bInterfaceNumber = status;
1485	ncm_union_desc.bMasterInterface0 = status;
1486
1487	if (cdev->use_os_string)
1488		f->os_desc_table[0].if_id =
1489			ncm_iad_desc.bFirstInterface;
1490
1491	status = usb_interface_id(c, f);
1492	if (status < 0)
1493		goto fail;
1494	ncm->data_id = status;
1495
1496	ncm_data_nop_intf.bInterfaceNumber = status;
1497	ncm_data_intf.bInterfaceNumber = status;
1498	ncm_union_desc.bSlaveInterface0 = status;
1499
1500	ecm_desc.wMaxSegmentSize = cpu_to_le16(ncm_opts->max_segment_size);
1501
1502	status = -ENODEV;
1503
1504	/* allocate instance-specific endpoints */
1505	ep = usb_ep_autoconfig(cdev->gadget, &fs_ncm_in_desc);
1506	if (!ep)
1507		goto fail;
1508	ncm->port.in_ep = ep;
1509
1510	ep = usb_ep_autoconfig(cdev->gadget, &fs_ncm_out_desc);
1511	if (!ep)
1512		goto fail;
1513	ncm->port.out_ep = ep;
1514
1515	ep = usb_ep_autoconfig(cdev->gadget, &fs_ncm_notify_desc);
1516	if (!ep)
1517		goto fail;
1518	ncm->notify = ep;
1519
1520	status = -ENOMEM;
1521
1522	/* allocate notification request and buffer */
1523	ncm->notify_req = usb_ep_alloc_request(ep, GFP_KERNEL);
1524	if (!ncm->notify_req)
1525		goto fail;
1526	ncm->notify_req->buf = kmalloc(NCM_STATUS_BYTECOUNT, GFP_KERNEL);
1527	if (!ncm->notify_req->buf)
1528		goto fail;
1529	ncm->notify_req->context = ncm;
1530	ncm->notify_req->complete = ncm_notify_complete;
1531
1532	/*
1533	 * support all relevant hardware speeds... we expect that when
1534	 * hardware is dual speed, all bulk-capable endpoints work at
1535	 * both speeds
1536	 */
1537	hs_ncm_in_desc.bEndpointAddress = fs_ncm_in_desc.bEndpointAddress;
1538	hs_ncm_out_desc.bEndpointAddress = fs_ncm_out_desc.bEndpointAddress;
1539	hs_ncm_notify_desc.bEndpointAddress =
1540		fs_ncm_notify_desc.bEndpointAddress;
1541
1542	ss_ncm_in_desc.bEndpointAddress = fs_ncm_in_desc.bEndpointAddress;
1543	ss_ncm_out_desc.bEndpointAddress = fs_ncm_out_desc.bEndpointAddress;
1544	ss_ncm_notify_desc.bEndpointAddress =
1545		fs_ncm_notify_desc.bEndpointAddress;
1546
1547	status = usb_assign_descriptors(f, ncm_fs_function, ncm_hs_function,
1548			ncm_ss_function, ncm_ss_function);
1549	if (status)
1550		goto fail;
1551
1552	/*
1553	 * NOTE:  all that is done without knowing or caring about
1554	 * the network link ... which is unavailable to this code
1555	 * until we're activated via set_alt().
1556	 */
1557
1558	ncm->port.open = ncm_open;
1559	ncm->port.close = ncm_close;
1560
1561	hrtimer_init(&ncm->task_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT);
1562	ncm->task_timer.function = ncm_tx_timeout;
1563
1564	DBG(cdev, "CDC Network: IN/%s OUT/%s NOTIFY/%s\n",
 
 
1565			ncm->port.in_ep->name, ncm->port.out_ep->name,
1566			ncm->notify->name);
1567	return 0;
1568
1569fail:
1570	kfree(f->os_desc_table);
1571	f->os_desc_n = 0;
1572
1573	if (ncm->notify_req) {
1574		kfree(ncm->notify_req->buf);
1575		usb_ep_free_request(ncm->notify, ncm->notify_req);
1576	}
1577
1578	ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
1579
1580	return status;
1581}
1582
1583static inline struct f_ncm_opts *to_f_ncm_opts(struct config_item *item)
1584{
1585	return container_of(to_config_group(item), struct f_ncm_opts,
1586			    func_inst.group);
1587}
1588
1589/* f_ncm_item_ops */
1590USB_ETHERNET_CONFIGFS_ITEM(ncm);
1591
1592/* f_ncm_opts_dev_addr */
1593USB_ETHERNET_CONFIGFS_ITEM_ATTR_DEV_ADDR(ncm);
1594
1595/* f_ncm_opts_host_addr */
1596USB_ETHERNET_CONFIGFS_ITEM_ATTR_HOST_ADDR(ncm);
1597
1598/* f_ncm_opts_qmult */
1599USB_ETHERNET_CONFIGFS_ITEM_ATTR_QMULT(ncm);
1600
1601/* f_ncm_opts_ifname */
1602USB_ETHERNET_CONFIGFS_ITEM_ATTR_IFNAME(ncm);
1603
1604static ssize_t ncm_opts_max_segment_size_show(struct config_item *item,
1605					      char *page)
1606{
1607	struct f_ncm_opts *opts = to_f_ncm_opts(item);
1608	u16 segment_size;
1609
1610	mutex_lock(&opts->lock);
1611	segment_size = opts->max_segment_size;
1612	mutex_unlock(&opts->lock);
1613
1614	return sysfs_emit(page, "%u\n", segment_size);
1615}
1616
1617static ssize_t ncm_opts_max_segment_size_store(struct config_item *item,
1618					       const char *page, size_t len)
1619{
1620	struct f_ncm_opts *opts = to_f_ncm_opts(item);
1621	u16 segment_size;
1622	int ret;
1623
1624	mutex_lock(&opts->lock);
1625	if (opts->refcnt) {
1626		ret = -EBUSY;
1627		goto out;
1628	}
1629
1630	ret = kstrtou16(page, 0, &segment_size);
1631	if (ret)
1632		goto out;
1633
1634	if (segment_size > MAX_DATAGRAM_SIZE) {
1635		ret = -EINVAL;
1636		goto out;
1637	}
1638
1639	opts->max_segment_size = segment_size;
1640	ret = len;
1641out:
1642	mutex_unlock(&opts->lock);
1643	return ret;
1644}
1645
1646CONFIGFS_ATTR(ncm_opts_, max_segment_size);
1647
1648static struct configfs_attribute *ncm_attrs[] = {
1649	&ncm_opts_attr_dev_addr,
1650	&ncm_opts_attr_host_addr,
1651	&ncm_opts_attr_qmult,
1652	&ncm_opts_attr_ifname,
1653	&ncm_opts_attr_max_segment_size,
1654	NULL,
1655};
1656
1657static const struct config_item_type ncm_func_type = {
1658	.ct_item_ops	= &ncm_item_ops,
1659	.ct_attrs	= ncm_attrs,
1660	.ct_owner	= THIS_MODULE,
1661};
1662
1663static void ncm_free_inst(struct usb_function_instance *f)
1664{
1665	struct f_ncm_opts *opts;
1666
1667	opts = container_of(f, struct f_ncm_opts, func_inst);
1668	if (opts->bound)
1669		gether_cleanup(netdev_priv(opts->net));
1670	else
1671		free_netdev(opts->net);
1672	kfree(opts->ncm_interf_group);
1673	kfree(opts);
1674}
1675
1676static struct usb_function_instance *ncm_alloc_inst(void)
1677{
1678	struct f_ncm_opts *opts;
1679	struct usb_os_desc *descs[1];
1680	char *names[1];
1681	struct config_group *ncm_interf_group;
1682
1683	opts = kzalloc(sizeof(*opts), GFP_KERNEL);
1684	if (!opts)
1685		return ERR_PTR(-ENOMEM);
1686	opts->ncm_os_desc.ext_compat_id = opts->ncm_ext_compat_id;
1687
1688	mutex_init(&opts->lock);
1689	opts->func_inst.free_func_inst = ncm_free_inst;
1690	opts->net = gether_setup_default();
1691	if (IS_ERR(opts->net)) {
1692		struct net_device *net = opts->net;
1693		kfree(opts);
1694		return ERR_CAST(net);
1695	}
1696	opts->max_segment_size = ETH_FRAME_LEN;
1697	INIT_LIST_HEAD(&opts->ncm_os_desc.ext_prop);
1698
1699	descs[0] = &opts->ncm_os_desc;
1700	names[0] = "ncm";
1701
1702	config_group_init_type_name(&opts->func_inst.group, "", &ncm_func_type);
1703	ncm_interf_group =
1704		usb_os_desc_prepare_interf_dir(&opts->func_inst.group, 1, descs,
1705					       names, THIS_MODULE);
1706	if (IS_ERR(ncm_interf_group)) {
1707		ncm_free_inst(&opts->func_inst);
1708		return ERR_CAST(ncm_interf_group);
1709	}
1710	opts->ncm_interf_group = ncm_interf_group;
1711
1712	return &opts->func_inst;
1713}
1714
1715static void ncm_free(struct usb_function *f)
1716{
1717	struct f_ncm *ncm;
1718	struct f_ncm_opts *opts;
1719
1720	ncm = func_to_ncm(f);
1721	opts = container_of(f->fi, struct f_ncm_opts, func_inst);
1722	kfree(ncm);
1723	mutex_lock(&opts->lock);
1724	opts->refcnt--;
1725	mutex_unlock(&opts->lock);
1726}
1727
1728static void ncm_unbind(struct usb_configuration *c, struct usb_function *f)
1729{
1730	struct f_ncm *ncm = func_to_ncm(f);
1731
1732	DBG(c->cdev, "ncm unbind\n");
1733
1734	hrtimer_cancel(&ncm->task_timer);
1735
1736	kfree(f->os_desc_table);
1737	f->os_desc_n = 0;
1738
1739	ncm_string_defs[0].id = 0;
1740	usb_free_all_descriptors(f);
1741
1742	if (atomic_read(&ncm->notify_count)) {
1743		usb_ep_dequeue(ncm->notify, ncm->notify_req);
1744		atomic_set(&ncm->notify_count, 0);
1745	}
1746
1747	kfree(ncm->notify_req->buf);
1748	usb_ep_free_request(ncm->notify, ncm->notify_req);
1749}
1750
1751static struct usb_function *ncm_alloc(struct usb_function_instance *fi)
1752{
1753	struct f_ncm		*ncm;
1754	struct f_ncm_opts	*opts;
1755	int status;
1756
1757	/* allocate and initialize one new instance */
1758	ncm = kzalloc(sizeof(*ncm), GFP_KERNEL);
1759	if (!ncm)
1760		return ERR_PTR(-ENOMEM);
1761
1762	opts = container_of(fi, struct f_ncm_opts, func_inst);
1763	mutex_lock(&opts->lock);
1764	opts->refcnt++;
1765
1766	/* export host's Ethernet address in CDC format */
1767	status = gether_get_host_addr_cdc(opts->net, ncm->ethaddr,
1768				      sizeof(ncm->ethaddr));
1769	if (status < 12) { /* strlen("01234567890a") */
1770		kfree(ncm);
1771		mutex_unlock(&opts->lock);
1772		return ERR_PTR(-EINVAL);
1773	}
1774	ncm_string_defs[STRING_MAC_IDX].s = ncm->ethaddr;
1775
1776	spin_lock_init(&ncm->lock);
1777	ncm_reset_values(ncm);
1778	ncm->port.ioport = netdev_priv(opts->net);
1779	mutex_unlock(&opts->lock);
1780	ncm->port.is_fixed = true;
1781	ncm->port.supports_multi_frame = true;
1782
1783	ncm->port.func.name = "cdc_network";
1784	/* descriptors are per-instance copies */
1785	ncm->port.func.bind = ncm_bind;
1786	ncm->port.func.unbind = ncm_unbind;
1787	ncm->port.func.set_alt = ncm_set_alt;
1788	ncm->port.func.get_alt = ncm_get_alt;
1789	ncm->port.func.setup = ncm_setup;
1790	ncm->port.func.disable = ncm_disable;
1791	ncm->port.func.free_func = ncm_free;
1792
1793	ncm->port.wrap = ncm_wrap_ntb;
1794	ncm->port.unwrap = ncm_unwrap_ntb;
1795
1796	return &ncm->port.func;
1797}
1798
1799DECLARE_USB_FUNCTION_INIT(ncm, ncm_alloc_inst, ncm_alloc);
1800MODULE_LICENSE("GPL");
1801MODULE_AUTHOR("Yauheni Kaliuta");
v6.2
   1// SPDX-License-Identifier: GPL-2.0+
   2/*
   3 * f_ncm.c -- USB CDC Network (NCM) link function driver
   4 *
   5 * Copyright (C) 2010 Nokia Corporation
   6 * Contact: Yauheni Kaliuta <yauheni.kaliuta@nokia.com>
   7 *
   8 * The driver borrows from f_ecm.c which is:
   9 *
  10 * Copyright (C) 2003-2005,2008 David Brownell
  11 * Copyright (C) 2008 Nokia Corporation
  12 */
  13
  14#include <linux/kernel.h>
  15#include <linux/interrupt.h>
  16#include <linux/module.h>
  17#include <linux/device.h>
  18#include <linux/etherdevice.h>
  19#include <linux/crc32.h>
  20
  21#include <linux/usb/cdc.h>
  22
  23#include "u_ether.h"
  24#include "u_ether_configfs.h"
  25#include "u_ncm.h"
  26#include "configfs.h"
  27
  28/*
  29 * This function is a "CDC Network Control Model" (CDC NCM) Ethernet link.
  30 * NCM is intended to be used with high-speed network attachments.
  31 *
  32 * Note that NCM requires the use of "alternate settings" for its data
  33 * interface.  This means that the set_alt() method has real work to do,
  34 * and also means that a get_alt() method is required.
  35 */
  36
  37/* to trigger crc/non-crc ndp signature */
  38
  39#define NCM_NDP_HDR_CRC		0x01000000
  40
  41enum ncm_notify_state {
  42	NCM_NOTIFY_NONE,		/* don't notify */
  43	NCM_NOTIFY_CONNECT,		/* issue CONNECT next */
  44	NCM_NOTIFY_SPEED,		/* issue SPEED_CHANGE next */
  45};
  46
  47struct f_ncm {
  48	struct gether			port;
  49	u8				ctrl_id, data_id;
  50
  51	char				ethaddr[14];
  52
  53	struct usb_ep			*notify;
  54	struct usb_request		*notify_req;
  55	u8				notify_state;
  56	atomic_t			notify_count;
  57	bool				is_open;
  58
  59	const struct ndp_parser_opts	*parser_opts;
  60	bool				is_crc;
  61	u32				ndp_sign;
  62
  63	/*
  64	 * for notification, it is accessed from both
  65	 * callback and ethernet open/close
  66	 */
  67	spinlock_t			lock;
  68
  69	struct net_device		*netdev;
  70
  71	/* For multi-frame NDP TX */
  72	struct sk_buff			*skb_tx_data;
  73	struct sk_buff			*skb_tx_ndp;
  74	u16				ndp_dgram_count;
  75	struct hrtimer			task_timer;
  76};
  77
  78static inline struct f_ncm *func_to_ncm(struct usb_function *f)
  79{
  80	return container_of(f, struct f_ncm, port.func);
  81}
  82
  83/* peak (theoretical) bulk transfer rate in bits-per-second */
  84static inline unsigned ncm_bitrate(struct usb_gadget *g)
  85{
  86	if (!g)
  87		return 0;
  88	else if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
  89		return 4250000000U;
  90	else if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
  91		return 3750000000U;
  92	else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
  93		return 13 * 512 * 8 * 1000 * 8;
  94	else
  95		return 19 *  64 * 1 * 1000 * 8;
  96}
  97
  98/*-------------------------------------------------------------------------*/
  99
 100/*
 101 * We cannot group frames so use just the minimal size which ok to put
 102 * one max-size ethernet frame.
 103 * If the host can group frames, allow it to do that, 16K is selected,
 104 * because it's used by default by the current linux host driver
 105 */
 106#define NTB_DEFAULT_IN_SIZE	16384
 107#define NTB_OUT_SIZE		16384
 108
 109/* Allocation for storing the NDP, 32 should suffice for a
 110 * 16k packet. This allows a maximum of 32 * 507 Byte packets to
 111 * be transmitted in a single 16kB skb, though when sending full size
 112 * packets this limit will be plenty.
 113 * Smaller packets are not likely to be trying to maximize the
 114 * throughput and will be mstly sending smaller infrequent frames.
 115 */
 116#define TX_MAX_NUM_DPE		32
 117
 118/* Delay for the transmit to wait before sending an unfilled NTB frame. */
 119#define TX_TIMEOUT_NSECS	300000
 120
 
 
 
 
 
 
 
 
 
 
 121#define FORMATS_SUPPORTED	(USB_CDC_NCM_NTB16_SUPPORTED |	\
 122				 USB_CDC_NCM_NTB32_SUPPORTED)
 123
 124static struct usb_cdc_ncm_ntb_parameters ntb_parameters = {
 125	.wLength = cpu_to_le16(sizeof(ntb_parameters)),
 126	.bmNtbFormatsSupported = cpu_to_le16(FORMATS_SUPPORTED),
 127	.dwNtbInMaxSize = cpu_to_le32(NTB_DEFAULT_IN_SIZE),
 128	.wNdpInDivisor = cpu_to_le16(4),
 129	.wNdpInPayloadRemainder = cpu_to_le16(0),
 130	.wNdpInAlignment = cpu_to_le16(4),
 131
 132	.dwNtbOutMaxSize = cpu_to_le32(NTB_OUT_SIZE),
 133	.wNdpOutDivisor = cpu_to_le16(4),
 134	.wNdpOutPayloadRemainder = cpu_to_le16(0),
 135	.wNdpOutAlignment = cpu_to_le16(4),
 136};
 137
 138/*
 139 * Use wMaxPacketSize big enough to fit CDC_NOTIFY_SPEED_CHANGE in one
 140 * packet, to simplify cancellation; and a big transfer interval, to
 141 * waste less bandwidth.
 142 */
 143
 144#define NCM_STATUS_INTERVAL_MS		32
 145#define NCM_STATUS_BYTECOUNT		16	/* 8 byte header + data */
 146
 147static struct usb_interface_assoc_descriptor ncm_iad_desc = {
 148	.bLength =		sizeof ncm_iad_desc,
 149	.bDescriptorType =	USB_DT_INTERFACE_ASSOCIATION,
 150
 151	/* .bFirstInterface =	DYNAMIC, */
 152	.bInterfaceCount =	2,	/* control + data */
 153	.bFunctionClass =	USB_CLASS_COMM,
 154	.bFunctionSubClass =	USB_CDC_SUBCLASS_NCM,
 155	.bFunctionProtocol =	USB_CDC_PROTO_NONE,
 156	/* .iFunction =		DYNAMIC */
 157};
 158
 159/* interface descriptor: */
 160
 161static struct usb_interface_descriptor ncm_control_intf = {
 162	.bLength =		sizeof ncm_control_intf,
 163	.bDescriptorType =	USB_DT_INTERFACE,
 164
 165	/* .bInterfaceNumber = DYNAMIC */
 166	.bNumEndpoints =	1,
 167	.bInterfaceClass =	USB_CLASS_COMM,
 168	.bInterfaceSubClass =	USB_CDC_SUBCLASS_NCM,
 169	.bInterfaceProtocol =	USB_CDC_PROTO_NONE,
 170	/* .iInterface = DYNAMIC */
 171};
 172
 173static struct usb_cdc_header_desc ncm_header_desc = {
 174	.bLength =		sizeof ncm_header_desc,
 175	.bDescriptorType =	USB_DT_CS_INTERFACE,
 176	.bDescriptorSubType =	USB_CDC_HEADER_TYPE,
 177
 178	.bcdCDC =		cpu_to_le16(0x0110),
 179};
 180
 181static struct usb_cdc_union_desc ncm_union_desc = {
 182	.bLength =		sizeof(ncm_union_desc),
 183	.bDescriptorType =	USB_DT_CS_INTERFACE,
 184	.bDescriptorSubType =	USB_CDC_UNION_TYPE,
 185	/* .bMasterInterface0 =	DYNAMIC */
 186	/* .bSlaveInterface0 =	DYNAMIC */
 187};
 188
 189static struct usb_cdc_ether_desc ecm_desc = {
 190	.bLength =		sizeof ecm_desc,
 191	.bDescriptorType =	USB_DT_CS_INTERFACE,
 192	.bDescriptorSubType =	USB_CDC_ETHERNET_TYPE,
 193
 194	/* this descriptor actually adds value, surprise! */
 195	/* .iMACAddress = DYNAMIC */
 196	.bmEthernetStatistics =	cpu_to_le32(0), /* no statistics */
 197	.wMaxSegmentSize =	cpu_to_le16(ETH_FRAME_LEN),
 198	.wNumberMCFilters =	cpu_to_le16(0),
 199	.bNumberPowerFilters =	0,
 200};
 201
 202#define NCAPS	(USB_CDC_NCM_NCAP_ETH_FILTER | USB_CDC_NCM_NCAP_CRC_MODE)
 203
 204static struct usb_cdc_ncm_desc ncm_desc = {
 205	.bLength =		sizeof ncm_desc,
 206	.bDescriptorType =	USB_DT_CS_INTERFACE,
 207	.bDescriptorSubType =	USB_CDC_NCM_TYPE,
 208
 209	.bcdNcmVersion =	cpu_to_le16(0x0100),
 210	/* can process SetEthernetPacketFilter */
 211	.bmNetworkCapabilities = NCAPS,
 212};
 213
 214/* the default data interface has no endpoints ... */
 215
 216static struct usb_interface_descriptor ncm_data_nop_intf = {
 217	.bLength =		sizeof ncm_data_nop_intf,
 218	.bDescriptorType =	USB_DT_INTERFACE,
 219
 220	.bInterfaceNumber =	1,
 221	.bAlternateSetting =	0,
 222	.bNumEndpoints =	0,
 223	.bInterfaceClass =	USB_CLASS_CDC_DATA,
 224	.bInterfaceSubClass =	0,
 225	.bInterfaceProtocol =	USB_CDC_NCM_PROTO_NTB,
 226	/* .iInterface = DYNAMIC */
 227};
 228
 229/* ... but the "real" data interface has two bulk endpoints */
 230
 231static struct usb_interface_descriptor ncm_data_intf = {
 232	.bLength =		sizeof ncm_data_intf,
 233	.bDescriptorType =	USB_DT_INTERFACE,
 234
 235	.bInterfaceNumber =	1,
 236	.bAlternateSetting =	1,
 237	.bNumEndpoints =	2,
 238	.bInterfaceClass =	USB_CLASS_CDC_DATA,
 239	.bInterfaceSubClass =	0,
 240	.bInterfaceProtocol =	USB_CDC_NCM_PROTO_NTB,
 241	/* .iInterface = DYNAMIC */
 242};
 243
 244/* full speed support: */
 245
 246static struct usb_endpoint_descriptor fs_ncm_notify_desc = {
 247	.bLength =		USB_DT_ENDPOINT_SIZE,
 248	.bDescriptorType =	USB_DT_ENDPOINT,
 249
 250	.bEndpointAddress =	USB_DIR_IN,
 251	.bmAttributes =		USB_ENDPOINT_XFER_INT,
 252	.wMaxPacketSize =	cpu_to_le16(NCM_STATUS_BYTECOUNT),
 253	.bInterval =		NCM_STATUS_INTERVAL_MS,
 254};
 255
 256static struct usb_endpoint_descriptor fs_ncm_in_desc = {
 257	.bLength =		USB_DT_ENDPOINT_SIZE,
 258	.bDescriptorType =	USB_DT_ENDPOINT,
 259
 260	.bEndpointAddress =	USB_DIR_IN,
 261	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
 262};
 263
 264static struct usb_endpoint_descriptor fs_ncm_out_desc = {
 265	.bLength =		USB_DT_ENDPOINT_SIZE,
 266	.bDescriptorType =	USB_DT_ENDPOINT,
 267
 268	.bEndpointAddress =	USB_DIR_OUT,
 269	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
 270};
 271
 272static struct usb_descriptor_header *ncm_fs_function[] = {
 273	(struct usb_descriptor_header *) &ncm_iad_desc,
 274	/* CDC NCM control descriptors */
 275	(struct usb_descriptor_header *) &ncm_control_intf,
 276	(struct usb_descriptor_header *) &ncm_header_desc,
 277	(struct usb_descriptor_header *) &ncm_union_desc,
 278	(struct usb_descriptor_header *) &ecm_desc,
 279	(struct usb_descriptor_header *) &ncm_desc,
 280	(struct usb_descriptor_header *) &fs_ncm_notify_desc,
 281	/* data interface, altsettings 0 and 1 */
 282	(struct usb_descriptor_header *) &ncm_data_nop_intf,
 283	(struct usb_descriptor_header *) &ncm_data_intf,
 284	(struct usb_descriptor_header *) &fs_ncm_in_desc,
 285	(struct usb_descriptor_header *) &fs_ncm_out_desc,
 286	NULL,
 287};
 288
 289/* high speed support: */
 290
 291static struct usb_endpoint_descriptor hs_ncm_notify_desc = {
 292	.bLength =		USB_DT_ENDPOINT_SIZE,
 293	.bDescriptorType =	USB_DT_ENDPOINT,
 294
 295	.bEndpointAddress =	USB_DIR_IN,
 296	.bmAttributes =		USB_ENDPOINT_XFER_INT,
 297	.wMaxPacketSize =	cpu_to_le16(NCM_STATUS_BYTECOUNT),
 298	.bInterval =		USB_MS_TO_HS_INTERVAL(NCM_STATUS_INTERVAL_MS),
 299};
 300static struct usb_endpoint_descriptor hs_ncm_in_desc = {
 301	.bLength =		USB_DT_ENDPOINT_SIZE,
 302	.bDescriptorType =	USB_DT_ENDPOINT,
 303
 304	.bEndpointAddress =	USB_DIR_IN,
 305	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
 306	.wMaxPacketSize =	cpu_to_le16(512),
 307};
 308
 309static struct usb_endpoint_descriptor hs_ncm_out_desc = {
 310	.bLength =		USB_DT_ENDPOINT_SIZE,
 311	.bDescriptorType =	USB_DT_ENDPOINT,
 312
 313	.bEndpointAddress =	USB_DIR_OUT,
 314	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
 315	.wMaxPacketSize =	cpu_to_le16(512),
 316};
 317
 318static struct usb_descriptor_header *ncm_hs_function[] = {
 319	(struct usb_descriptor_header *) &ncm_iad_desc,
 320	/* CDC NCM control descriptors */
 321	(struct usb_descriptor_header *) &ncm_control_intf,
 322	(struct usb_descriptor_header *) &ncm_header_desc,
 323	(struct usb_descriptor_header *) &ncm_union_desc,
 324	(struct usb_descriptor_header *) &ecm_desc,
 325	(struct usb_descriptor_header *) &ncm_desc,
 326	(struct usb_descriptor_header *) &hs_ncm_notify_desc,
 327	/* data interface, altsettings 0 and 1 */
 328	(struct usb_descriptor_header *) &ncm_data_nop_intf,
 329	(struct usb_descriptor_header *) &ncm_data_intf,
 330	(struct usb_descriptor_header *) &hs_ncm_in_desc,
 331	(struct usb_descriptor_header *) &hs_ncm_out_desc,
 332	NULL,
 333};
 334
 335
 336/* super speed support: */
 337
 338static struct usb_endpoint_descriptor ss_ncm_notify_desc = {
 339	.bLength =		USB_DT_ENDPOINT_SIZE,
 340	.bDescriptorType =	USB_DT_ENDPOINT,
 341
 342	.bEndpointAddress =	USB_DIR_IN,
 343	.bmAttributes =		USB_ENDPOINT_XFER_INT,
 344	.wMaxPacketSize =	cpu_to_le16(NCM_STATUS_BYTECOUNT),
 345	.bInterval =		USB_MS_TO_HS_INTERVAL(NCM_STATUS_INTERVAL_MS)
 346};
 347
 348static struct usb_ss_ep_comp_descriptor ss_ncm_notify_comp_desc = {
 349	.bLength =		sizeof(ss_ncm_notify_comp_desc),
 350	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
 351
 352	/* the following 3 values can be tweaked if necessary */
 353	/* .bMaxBurst =		0, */
 354	/* .bmAttributes =	0, */
 355	.wBytesPerInterval =	cpu_to_le16(NCM_STATUS_BYTECOUNT),
 356};
 357
 358static struct usb_endpoint_descriptor ss_ncm_in_desc = {
 359	.bLength =		USB_DT_ENDPOINT_SIZE,
 360	.bDescriptorType =	USB_DT_ENDPOINT,
 361
 362	.bEndpointAddress =	USB_DIR_IN,
 363	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
 364	.wMaxPacketSize =	cpu_to_le16(1024),
 365};
 366
 367static struct usb_endpoint_descriptor ss_ncm_out_desc = {
 368	.bLength =		USB_DT_ENDPOINT_SIZE,
 369	.bDescriptorType =	USB_DT_ENDPOINT,
 370
 371	.bEndpointAddress =	USB_DIR_OUT,
 372	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
 373	.wMaxPacketSize =	cpu_to_le16(1024),
 374};
 375
 376static struct usb_ss_ep_comp_descriptor ss_ncm_bulk_comp_desc = {
 377	.bLength =		sizeof(ss_ncm_bulk_comp_desc),
 378	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
 379
 380	/* the following 2 values can be tweaked if necessary */
 381	.bMaxBurst =		15,
 382	/* .bmAttributes =	0, */
 383};
 384
 385static struct usb_descriptor_header *ncm_ss_function[] = {
 386	(struct usb_descriptor_header *) &ncm_iad_desc,
 387	/* CDC NCM control descriptors */
 388	(struct usb_descriptor_header *) &ncm_control_intf,
 389	(struct usb_descriptor_header *) &ncm_header_desc,
 390	(struct usb_descriptor_header *) &ncm_union_desc,
 391	(struct usb_descriptor_header *) &ecm_desc,
 392	(struct usb_descriptor_header *) &ncm_desc,
 393	(struct usb_descriptor_header *) &ss_ncm_notify_desc,
 394	(struct usb_descriptor_header *) &ss_ncm_notify_comp_desc,
 395	/* data interface, altsettings 0 and 1 */
 396	(struct usb_descriptor_header *) &ncm_data_nop_intf,
 397	(struct usb_descriptor_header *) &ncm_data_intf,
 398	(struct usb_descriptor_header *) &ss_ncm_in_desc,
 399	(struct usb_descriptor_header *) &ss_ncm_bulk_comp_desc,
 400	(struct usb_descriptor_header *) &ss_ncm_out_desc,
 401	(struct usb_descriptor_header *) &ss_ncm_bulk_comp_desc,
 402	NULL,
 403};
 404
 405/* string descriptors: */
 406
 407#define STRING_CTRL_IDX	0
 408#define STRING_MAC_IDX	1
 409#define STRING_DATA_IDX	2
 410#define STRING_IAD_IDX	3
 411
 412static struct usb_string ncm_string_defs[] = {
 413	[STRING_CTRL_IDX].s = "CDC Network Control Model (NCM)",
 414	[STRING_MAC_IDX].s = "",
 415	[STRING_DATA_IDX].s = "CDC Network Data",
 416	[STRING_IAD_IDX].s = "CDC NCM",
 417	{  } /* end of list */
 418};
 419
 420static struct usb_gadget_strings ncm_string_table = {
 421	.language =		0x0409,	/* en-us */
 422	.strings =		ncm_string_defs,
 423};
 424
 425static struct usb_gadget_strings *ncm_strings[] = {
 426	&ncm_string_table,
 427	NULL,
 428};
 429
 430/*
 431 * Here are options for NCM Datagram Pointer table (NDP) parser.
 432 * There are 2 different formats: NDP16 and NDP32 in the spec (ch. 3),
 433 * in NDP16 offsets and sizes fields are 1 16bit word wide,
 434 * in NDP32 -- 2 16bit words wide. Also signatures are different.
 435 * To make the parser code the same, put the differences in the structure,
 436 * and switch pointers to the structures when the format is changed.
 437 */
 438
 439struct ndp_parser_opts {
 440	u32		nth_sign;
 441	u32		ndp_sign;
 442	unsigned	nth_size;
 443	unsigned	ndp_size;
 444	unsigned	dpe_size;
 445	unsigned	ndplen_align;
 446	/* sizes in u16 units */
 447	unsigned	dgram_item_len; /* index or length */
 448	unsigned	block_length;
 449	unsigned	ndp_index;
 450	unsigned	reserved1;
 451	unsigned	reserved2;
 452	unsigned	next_ndp_index;
 453};
 454
 455static const struct ndp_parser_opts ndp16_opts = {
 456	.nth_sign = USB_CDC_NCM_NTH16_SIGN,
 457	.ndp_sign = USB_CDC_NCM_NDP16_NOCRC_SIGN,
 458	.nth_size = sizeof(struct usb_cdc_ncm_nth16),
 459	.ndp_size = sizeof(struct usb_cdc_ncm_ndp16),
 460	.dpe_size = sizeof(struct usb_cdc_ncm_dpe16),
 461	.ndplen_align = 4,
 462	.dgram_item_len = 1,
 463	.block_length = 1,
 464	.ndp_index = 1,
 465	.reserved1 = 0,
 466	.reserved2 = 0,
 467	.next_ndp_index = 1,
 468};
 469
 470static const struct ndp_parser_opts ndp32_opts = {
 471	.nth_sign = USB_CDC_NCM_NTH32_SIGN,
 472	.ndp_sign = USB_CDC_NCM_NDP32_NOCRC_SIGN,
 473	.nth_size = sizeof(struct usb_cdc_ncm_nth32),
 474	.ndp_size = sizeof(struct usb_cdc_ncm_ndp32),
 475	.dpe_size = sizeof(struct usb_cdc_ncm_dpe32),
 476	.ndplen_align = 8,
 477	.dgram_item_len = 2,
 478	.block_length = 2,
 479	.ndp_index = 2,
 480	.reserved1 = 1,
 481	.reserved2 = 2,
 482	.next_ndp_index = 2,
 483};
 484
 485static inline void put_ncm(__le16 **p, unsigned size, unsigned val)
 486{
 487	switch (size) {
 488	case 1:
 489		put_unaligned_le16((u16)val, *p);
 490		break;
 491	case 2:
 492		put_unaligned_le32((u32)val, *p);
 493
 494		break;
 495	default:
 496		BUG();
 497	}
 498
 499	*p += size;
 500}
 501
 502static inline unsigned get_ncm(__le16 **p, unsigned size)
 503{
 504	unsigned tmp;
 505
 506	switch (size) {
 507	case 1:
 508		tmp = get_unaligned_le16(*p);
 509		break;
 510	case 2:
 511		tmp = get_unaligned_le32(*p);
 512		break;
 513	default:
 514		BUG();
 515	}
 516
 517	*p += size;
 518	return tmp;
 519}
 520
 521/*-------------------------------------------------------------------------*/
 522
 523static inline void ncm_reset_values(struct f_ncm *ncm)
 524{
 525	ncm->parser_opts = &ndp16_opts;
 526	ncm->is_crc = false;
 527	ncm->ndp_sign = ncm->parser_opts->ndp_sign;
 528	ncm->port.cdc_filter = DEFAULT_FILTER;
 529
 530	/* doesn't make sense for ncm, fixed size used */
 531	ncm->port.header_len = 0;
 532
 533	ncm->port.fixed_out_len = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize);
 534	ncm->port.fixed_in_len = NTB_DEFAULT_IN_SIZE;
 535}
 536
 537/*
 538 * Context: ncm->lock held
 539 */
 540static void ncm_do_notify(struct f_ncm *ncm)
 541{
 542	struct usb_request		*req = ncm->notify_req;
 543	struct usb_cdc_notification	*event;
 544	struct usb_composite_dev	*cdev = ncm->port.func.config->cdev;
 545	__le32				*data;
 546	int				status;
 547
 548	/* notification already in flight? */
 549	if (atomic_read(&ncm->notify_count))
 550		return;
 551
 552	event = req->buf;
 553	switch (ncm->notify_state) {
 554	case NCM_NOTIFY_NONE:
 555		return;
 556
 557	case NCM_NOTIFY_CONNECT:
 558		event->bNotificationType = USB_CDC_NOTIFY_NETWORK_CONNECTION;
 559		if (ncm->is_open)
 560			event->wValue = cpu_to_le16(1);
 561		else
 562			event->wValue = cpu_to_le16(0);
 563		event->wLength = 0;
 564		req->length = sizeof *event;
 565
 566		DBG(cdev, "notify connect %s\n",
 567				ncm->is_open ? "true" : "false");
 568		ncm->notify_state = NCM_NOTIFY_NONE;
 569		break;
 570
 571	case NCM_NOTIFY_SPEED:
 572		event->bNotificationType = USB_CDC_NOTIFY_SPEED_CHANGE;
 573		event->wValue = cpu_to_le16(0);
 574		event->wLength = cpu_to_le16(8);
 575		req->length = NCM_STATUS_BYTECOUNT;
 576
 577		/* SPEED_CHANGE data is up/down speeds in bits/sec */
 578		data = req->buf + sizeof *event;
 579		data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));
 580		data[1] = data[0];
 581
 582		DBG(cdev, "notify speed %u\n", ncm_bitrate(cdev->gadget));
 583		ncm->notify_state = NCM_NOTIFY_CONNECT;
 584		break;
 585	}
 586	event->bmRequestType = 0xA1;
 587	event->wIndex = cpu_to_le16(ncm->ctrl_id);
 588
 589	atomic_inc(&ncm->notify_count);
 590
 591	/*
 592	 * In double buffering if there is a space in FIFO,
 593	 * completion callback can be called right after the call,
 594	 * so unlocking
 595	 */
 596	spin_unlock(&ncm->lock);
 597	status = usb_ep_queue(ncm->notify, req, GFP_ATOMIC);
 598	spin_lock(&ncm->lock);
 599	if (status < 0) {
 600		atomic_dec(&ncm->notify_count);
 601		DBG(cdev, "notify --> %d\n", status);
 602	}
 603}
 604
 605/*
 606 * Context: ncm->lock held
 607 */
 608static void ncm_notify(struct f_ncm *ncm)
 609{
 610	/*
 611	 * NOTE on most versions of Linux, host side cdc-ethernet
 612	 * won't listen for notifications until its netdevice opens.
 613	 * The first notification then sits in the FIFO for a long
 614	 * time, and the second one is queued.
 615	 *
 616	 * If ncm_notify() is called before the second (CONNECT)
 617	 * notification is sent, then it will reset to send the SPEED
 618	 * notificaion again (and again, and again), but it's not a problem
 619	 */
 620	ncm->notify_state = NCM_NOTIFY_SPEED;
 621	ncm_do_notify(ncm);
 622}
 623
 624static void ncm_notify_complete(struct usb_ep *ep, struct usb_request *req)
 625{
 626	struct f_ncm			*ncm = req->context;
 627	struct usb_composite_dev	*cdev = ncm->port.func.config->cdev;
 628	struct usb_cdc_notification	*event = req->buf;
 629
 630	spin_lock(&ncm->lock);
 631	switch (req->status) {
 632	case 0:
 633		VDBG(cdev, "Notification %02x sent\n",
 634		     event->bNotificationType);
 635		atomic_dec(&ncm->notify_count);
 636		break;
 637	case -ECONNRESET:
 638	case -ESHUTDOWN:
 639		atomic_set(&ncm->notify_count, 0);
 640		ncm->notify_state = NCM_NOTIFY_NONE;
 641		break;
 642	default:
 643		DBG(cdev, "event %02x --> %d\n",
 644			event->bNotificationType, req->status);
 645		atomic_dec(&ncm->notify_count);
 646		break;
 647	}
 648	ncm_do_notify(ncm);
 649	spin_unlock(&ncm->lock);
 650}
 651
 652static void ncm_ep0out_complete(struct usb_ep *ep, struct usb_request *req)
 653{
 654	/* now for SET_NTB_INPUT_SIZE only */
 655	unsigned		in_size;
 656	struct usb_function	*f = req->context;
 657	struct f_ncm		*ncm = func_to_ncm(f);
 658	struct usb_composite_dev *cdev = f->config->cdev;
 659
 660	req->context = NULL;
 661	if (req->status || req->actual != req->length) {
 662		DBG(cdev, "Bad control-OUT transfer\n");
 663		goto invalid;
 664	}
 665
 666	in_size = get_unaligned_le32(req->buf);
 667	if (in_size < USB_CDC_NCM_NTB_MIN_IN_SIZE ||
 668	    in_size > le32_to_cpu(ntb_parameters.dwNtbInMaxSize)) {
 669		DBG(cdev, "Got wrong INPUT SIZE (%d) from host\n", in_size);
 670		goto invalid;
 671	}
 672
 673	ncm->port.fixed_in_len = in_size;
 674	VDBG(cdev, "Set NTB INPUT SIZE %d\n", in_size);
 675	return;
 676
 677invalid:
 678	usb_ep_set_halt(ep);
 679	return;
 680}
 681
 682static int ncm_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
 683{
 684	struct f_ncm		*ncm = func_to_ncm(f);
 685	struct usb_composite_dev *cdev = f->config->cdev;
 686	struct usb_request	*req = cdev->req;
 687	int			value = -EOPNOTSUPP;
 688	u16			w_index = le16_to_cpu(ctrl->wIndex);
 689	u16			w_value = le16_to_cpu(ctrl->wValue);
 690	u16			w_length = le16_to_cpu(ctrl->wLength);
 691
 692	/*
 693	 * composite driver infrastructure handles everything except
 694	 * CDC class messages; interface activation uses set_alt().
 695	 */
 696	switch ((ctrl->bRequestType << 8) | ctrl->bRequest) {
 697	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 698			| USB_CDC_SET_ETHERNET_PACKET_FILTER:
 699		/*
 700		 * see 6.2.30: no data, wIndex = interface,
 701		 * wValue = packet filter bitmap
 702		 */
 703		if (w_length != 0 || w_index != ncm->ctrl_id)
 704			goto invalid;
 705		DBG(cdev, "packet filter %02x\n", w_value);
 706		/*
 707		 * REVISIT locking of cdc_filter.  This assumes the UDC
 708		 * driver won't have a concurrent packet TX irq running on
 709		 * another CPU; or that if it does, this write is atomic...
 710		 */
 711		ncm->port.cdc_filter = w_value;
 712		value = 0;
 713		break;
 714	/*
 715	 * and optionally:
 716	 * case USB_CDC_SEND_ENCAPSULATED_COMMAND:
 717	 * case USB_CDC_GET_ENCAPSULATED_RESPONSE:
 718	 * case USB_CDC_SET_ETHERNET_MULTICAST_FILTERS:
 719	 * case USB_CDC_SET_ETHERNET_PM_PATTERN_FILTER:
 720	 * case USB_CDC_GET_ETHERNET_PM_PATTERN_FILTER:
 721	 * case USB_CDC_GET_ETHERNET_STATISTIC:
 722	 */
 723
 724	case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 725		| USB_CDC_GET_NTB_PARAMETERS:
 726
 727		if (w_length == 0 || w_value != 0 || w_index != ncm->ctrl_id)
 728			goto invalid;
 729		value = w_length > sizeof ntb_parameters ?
 730			sizeof ntb_parameters : w_length;
 731		memcpy(req->buf, &ntb_parameters, value);
 732		VDBG(cdev, "Host asked NTB parameters\n");
 733		break;
 734
 735	case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 736		| USB_CDC_GET_NTB_INPUT_SIZE:
 737
 738		if (w_length < 4 || w_value != 0 || w_index != ncm->ctrl_id)
 739			goto invalid;
 740		put_unaligned_le32(ncm->port.fixed_in_len, req->buf);
 741		value = 4;
 742		VDBG(cdev, "Host asked INPUT SIZE, sending %d\n",
 743		     ncm->port.fixed_in_len);
 744		break;
 745
 746	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 747		| USB_CDC_SET_NTB_INPUT_SIZE:
 748	{
 749		if (w_length != 4 || w_value != 0 || w_index != ncm->ctrl_id)
 750			goto invalid;
 751		req->complete = ncm_ep0out_complete;
 752		req->length = w_length;
 753		req->context = f;
 754
 755		value = req->length;
 756		break;
 757	}
 758
 759	case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 760		| USB_CDC_GET_NTB_FORMAT:
 761	{
 762		uint16_t format;
 763
 764		if (w_length < 2 || w_value != 0 || w_index != ncm->ctrl_id)
 765			goto invalid;
 766		format = (ncm->parser_opts == &ndp16_opts) ? 0x0000 : 0x0001;
 767		put_unaligned_le16(format, req->buf);
 768		value = 2;
 769		VDBG(cdev, "Host asked NTB FORMAT, sending %d\n", format);
 770		break;
 771	}
 772
 773	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 774		| USB_CDC_SET_NTB_FORMAT:
 775	{
 776		if (w_length != 0 || w_index != ncm->ctrl_id)
 777			goto invalid;
 778		switch (w_value) {
 779		case 0x0000:
 780			ncm->parser_opts = &ndp16_opts;
 781			DBG(cdev, "NCM16 selected\n");
 782			break;
 783		case 0x0001:
 784			ncm->parser_opts = &ndp32_opts;
 785			DBG(cdev, "NCM32 selected\n");
 786			break;
 787		default:
 788			goto invalid;
 789		}
 790		value = 0;
 791		break;
 792	}
 793	case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 794		| USB_CDC_GET_CRC_MODE:
 795	{
 796		uint16_t is_crc;
 797
 798		if (w_length < 2 || w_value != 0 || w_index != ncm->ctrl_id)
 799			goto invalid;
 800		is_crc = ncm->is_crc ? 0x0001 : 0x0000;
 801		put_unaligned_le16(is_crc, req->buf);
 802		value = 2;
 803		VDBG(cdev, "Host asked CRC MODE, sending %d\n", is_crc);
 804		break;
 805	}
 806
 807	case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
 808		| USB_CDC_SET_CRC_MODE:
 809	{
 810		if (w_length != 0 || w_index != ncm->ctrl_id)
 811			goto invalid;
 812		switch (w_value) {
 813		case 0x0000:
 814			ncm->is_crc = false;
 815			DBG(cdev, "non-CRC mode selected\n");
 816			break;
 817		case 0x0001:
 818			ncm->is_crc = true;
 819			DBG(cdev, "CRC mode selected\n");
 820			break;
 821		default:
 822			goto invalid;
 823		}
 824		value = 0;
 825		break;
 826	}
 827
 828	/* and disabled in ncm descriptor: */
 829	/* case USB_CDC_GET_NET_ADDRESS: */
 830	/* case USB_CDC_SET_NET_ADDRESS: */
 831	/* case USB_CDC_GET_MAX_DATAGRAM_SIZE: */
 832	/* case USB_CDC_SET_MAX_DATAGRAM_SIZE: */
 833
 834	default:
 835invalid:
 836		DBG(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n",
 837			ctrl->bRequestType, ctrl->bRequest,
 838			w_value, w_index, w_length);
 839	}
 840	ncm->ndp_sign = ncm->parser_opts->ndp_sign |
 841		(ncm->is_crc ? NCM_NDP_HDR_CRC : 0);
 842
 843	/* respond with data transfer or status phase? */
 844	if (value >= 0) {
 845		DBG(cdev, "ncm req%02x.%02x v%04x i%04x l%d\n",
 846			ctrl->bRequestType, ctrl->bRequest,
 847			w_value, w_index, w_length);
 848		req->zero = 0;
 849		req->length = value;
 850		value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
 851		if (value < 0)
 852			ERROR(cdev, "ncm req %02x.%02x response err %d\n",
 853					ctrl->bRequestType, ctrl->bRequest,
 854					value);
 855	}
 856
 857	/* device either stalls (value < 0) or reports success */
 858	return value;
 859}
 860
 861
 862static int ncm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 863{
 864	struct f_ncm		*ncm = func_to_ncm(f);
 865	struct usb_composite_dev *cdev = f->config->cdev;
 866
 867	/* Control interface has only altsetting 0 */
 868	if (intf == ncm->ctrl_id) {
 869		if (alt != 0)
 870			goto fail;
 871
 872		DBG(cdev, "reset ncm control %d\n", intf);
 873		usb_ep_disable(ncm->notify);
 874
 875		if (!(ncm->notify->desc)) {
 876			DBG(cdev, "init ncm ctrl %d\n", intf);
 877			if (config_ep_by_speed(cdev->gadget, f, ncm->notify))
 878				goto fail;
 879		}
 880		usb_ep_enable(ncm->notify);
 881
 882	/* Data interface has two altsettings, 0 and 1 */
 883	} else if (intf == ncm->data_id) {
 884		if (alt > 1)
 885			goto fail;
 886
 887		if (ncm->port.in_ep->enabled) {
 888			DBG(cdev, "reset ncm\n");
 889			ncm->netdev = NULL;
 890			gether_disconnect(&ncm->port);
 891			ncm_reset_values(ncm);
 892		}
 893
 894		/*
 895		 * CDC Network only sends data in non-default altsettings.
 896		 * Changing altsettings resets filters, statistics, etc.
 897		 */
 898		if (alt == 1) {
 899			struct net_device	*net;
 900
 901			if (!ncm->port.in_ep->desc ||
 902			    !ncm->port.out_ep->desc) {
 903				DBG(cdev, "init ncm\n");
 904				if (config_ep_by_speed(cdev->gadget, f,
 905						       ncm->port.in_ep) ||
 906				    config_ep_by_speed(cdev->gadget, f,
 907						       ncm->port.out_ep)) {
 908					ncm->port.in_ep->desc = NULL;
 909					ncm->port.out_ep->desc = NULL;
 910					goto fail;
 911				}
 912			}
 913
 914			/* TODO */
 915			/* Enable zlps by default for NCM conformance;
 916			 * override for musb_hdrc (avoids txdma ovhead)
 917			 */
 918			ncm->port.is_zlp_ok =
 919				gadget_is_zlp_supported(cdev->gadget);
 920			ncm->port.cdc_filter = DEFAULT_FILTER;
 921			DBG(cdev, "activate ncm\n");
 922			net = gether_connect(&ncm->port);
 923			if (IS_ERR(net))
 924				return PTR_ERR(net);
 925			ncm->netdev = net;
 926		}
 927
 928		spin_lock(&ncm->lock);
 929		ncm_notify(ncm);
 930		spin_unlock(&ncm->lock);
 931	} else
 932		goto fail;
 933
 934	return 0;
 935fail:
 936	return -EINVAL;
 937}
 938
 939/*
 940 * Because the data interface supports multiple altsettings,
 941 * this NCM function *MUST* implement a get_alt() method.
 942 */
 943static int ncm_get_alt(struct usb_function *f, unsigned intf)
 944{
 945	struct f_ncm		*ncm = func_to_ncm(f);
 946
 947	if (intf == ncm->ctrl_id)
 948		return 0;
 949	return ncm->port.in_ep->enabled ? 1 : 0;
 950}
 951
 952static struct sk_buff *package_for_tx(struct f_ncm *ncm)
 953{
 954	__le16		*ntb_iter;
 955	struct sk_buff	*skb2 = NULL;
 956	unsigned	ndp_pad;
 957	unsigned	ndp_index;
 958	unsigned	new_len;
 959
 960	const struct ndp_parser_opts *opts = ncm->parser_opts;
 961	const int ndp_align = le16_to_cpu(ntb_parameters.wNdpInAlignment);
 962	const int dgram_idx_len = 2 * 2 * opts->dgram_item_len;
 963
 964	/* Stop the timer */
 965	hrtimer_try_to_cancel(&ncm->task_timer);
 966
 967	ndp_pad = ALIGN(ncm->skb_tx_data->len, ndp_align) -
 968			ncm->skb_tx_data->len;
 969	ndp_index = ncm->skb_tx_data->len + ndp_pad;
 970	new_len = ndp_index + dgram_idx_len + ncm->skb_tx_ndp->len;
 971
 972	/* Set the final BlockLength and wNdpIndex */
 973	ntb_iter = (void *) ncm->skb_tx_data->data;
 974	/* Increment pointer to BlockLength */
 975	ntb_iter += 2 + 1 + 1;
 976	put_ncm(&ntb_iter, opts->block_length, new_len);
 977	put_ncm(&ntb_iter, opts->ndp_index, ndp_index);
 978
 979	/* Set the final NDP wLength */
 980	new_len = opts->ndp_size +
 981			(ncm->ndp_dgram_count * dgram_idx_len);
 982	ncm->ndp_dgram_count = 0;
 983	/* Increment from start to wLength */
 984	ntb_iter = (void *) ncm->skb_tx_ndp->data;
 985	ntb_iter += 2;
 986	put_unaligned_le16(new_len, ntb_iter);
 987
 988	/* Merge the skbs */
 989	swap(skb2, ncm->skb_tx_data);
 990	if (ncm->skb_tx_data) {
 991		dev_consume_skb_any(ncm->skb_tx_data);
 992		ncm->skb_tx_data = NULL;
 993	}
 994
 995	/* Insert NDP alignment. */
 996	skb_put_zero(skb2, ndp_pad);
 997
 998	/* Copy NTB across. */
 999	skb_put_data(skb2, ncm->skb_tx_ndp->data, ncm->skb_tx_ndp->len);
1000	dev_consume_skb_any(ncm->skb_tx_ndp);
1001	ncm->skb_tx_ndp = NULL;
1002
1003	/* Insert zero'd datagram. */
1004	skb_put_zero(skb2, dgram_idx_len);
1005
1006	return skb2;
1007}
1008
1009static struct sk_buff *ncm_wrap_ntb(struct gether *port,
1010				    struct sk_buff *skb)
1011{
1012	struct f_ncm	*ncm = func_to_ncm(&port->func);
1013	struct sk_buff	*skb2 = NULL;
1014
1015	if (skb) {
1016		int		ncb_len = 0;
1017		__le16		*ntb_data;
1018		__le16		*ntb_ndp;
1019		int		dgram_pad;
1020
1021		unsigned	max_size = ncm->port.fixed_in_len;
1022		const struct ndp_parser_opts *opts = ncm->parser_opts;
1023		const int ndp_align = le16_to_cpu(ntb_parameters.wNdpInAlignment);
1024		const int div = le16_to_cpu(ntb_parameters.wNdpInDivisor);
1025		const int rem = le16_to_cpu(ntb_parameters.wNdpInPayloadRemainder);
1026		const int dgram_idx_len = 2 * 2 * opts->dgram_item_len;
1027
1028		/* Add the CRC if required up front */
1029		if (ncm->is_crc) {
1030			uint32_t	crc;
1031			__le16		*crc_pos;
1032
1033			crc = ~crc32_le(~0,
1034					skb->data,
1035					skb->len);
1036			crc_pos = skb_put(skb, sizeof(uint32_t));
1037			put_unaligned_le32(crc, crc_pos);
1038		}
1039
1040		/* If the new skb is too big for the current NCM NTB then
1041		 * set the current stored skb to be sent now and clear it
1042		 * ready for new data.
1043		 * NOTE: Assume maximum align for speed of calculation.
1044		 */
1045		if (ncm->skb_tx_data
1046		    && (ncm->ndp_dgram_count >= TX_MAX_NUM_DPE
1047		    || (ncm->skb_tx_data->len +
1048		    div + rem + skb->len +
1049		    ncm->skb_tx_ndp->len + ndp_align + (2 * dgram_idx_len))
1050		    > max_size)) {
1051			skb2 = package_for_tx(ncm);
1052			if (!skb2)
1053				goto err;
1054		}
1055
1056		if (!ncm->skb_tx_data) {
1057			ncb_len = opts->nth_size;
1058			dgram_pad = ALIGN(ncb_len, div) + rem - ncb_len;
1059			ncb_len += dgram_pad;
1060
1061			/* Create a new skb for the NTH and datagrams. */
1062			ncm->skb_tx_data = alloc_skb(max_size, GFP_ATOMIC);
1063			if (!ncm->skb_tx_data)
1064				goto err;
1065
1066			ncm->skb_tx_data->dev = ncm->netdev;
1067			ntb_data = skb_put_zero(ncm->skb_tx_data, ncb_len);
1068			/* dwSignature */
1069			put_unaligned_le32(opts->nth_sign, ntb_data);
1070			ntb_data += 2;
1071			/* wHeaderLength */
1072			put_unaligned_le16(opts->nth_size, ntb_data++);
1073
1074			/* Allocate an skb for storing the NDP,
1075			 * TX_MAX_NUM_DPE should easily suffice for a
1076			 * 16k packet.
1077			 */
1078			ncm->skb_tx_ndp = alloc_skb((int)(opts->ndp_size
1079						    + opts->dpe_size
1080						    * TX_MAX_NUM_DPE),
1081						    GFP_ATOMIC);
1082			if (!ncm->skb_tx_ndp)
1083				goto err;
1084
1085			ncm->skb_tx_ndp->dev = ncm->netdev;
1086			ntb_ndp = skb_put(ncm->skb_tx_ndp, opts->ndp_size);
1087			memset(ntb_ndp, 0, ncb_len);
1088			/* dwSignature */
1089			put_unaligned_le32(ncm->ndp_sign, ntb_ndp);
1090			ntb_ndp += 2;
1091
1092			/* There is always a zeroed entry */
1093			ncm->ndp_dgram_count = 1;
1094
1095			/* Note: we skip opts->next_ndp_index */
1096
1097			/* Start the timer. */
1098			hrtimer_start(&ncm->task_timer, TX_TIMEOUT_NSECS,
1099				      HRTIMER_MODE_REL_SOFT);
1100		}
1101
1102		/* Add the datagram position entries */
1103		ntb_ndp = skb_put_zero(ncm->skb_tx_ndp, dgram_idx_len);
1104
1105		ncb_len = ncm->skb_tx_data->len;
1106		dgram_pad = ALIGN(ncb_len, div) + rem - ncb_len;
1107		ncb_len += dgram_pad;
1108
1109		/* (d)wDatagramIndex */
1110		put_ncm(&ntb_ndp, opts->dgram_item_len, ncb_len);
1111		/* (d)wDatagramLength */
1112		put_ncm(&ntb_ndp, opts->dgram_item_len, skb->len);
1113		ncm->ndp_dgram_count++;
1114
1115		/* Add the new data to the skb */
1116		skb_put_zero(ncm->skb_tx_data, dgram_pad);
1117		skb_put_data(ncm->skb_tx_data, skb->data, skb->len);
1118		dev_consume_skb_any(skb);
1119		skb = NULL;
1120
1121	} else if (ncm->skb_tx_data) {
1122		/* If we get here ncm_wrap_ntb() was called with NULL skb,
1123		 * because eth_start_xmit() was called with NULL skb by
1124		 * ncm_tx_timeout() - hence, this is our signal to flush/send.
1125		 */
1126		skb2 = package_for_tx(ncm);
1127		if (!skb2)
1128			goto err;
1129	}
1130
1131	return skb2;
1132
1133err:
1134	ncm->netdev->stats.tx_dropped++;
1135
1136	if (skb)
1137		dev_kfree_skb_any(skb);
1138	if (ncm->skb_tx_data)
1139		dev_kfree_skb_any(ncm->skb_tx_data);
1140	if (ncm->skb_tx_ndp)
1141		dev_kfree_skb_any(ncm->skb_tx_ndp);
1142
1143	return NULL;
1144}
1145
1146/*
1147 * The transmit should only be run if no skb data has been sent
1148 * for a certain duration.
1149 */
1150static enum hrtimer_restart ncm_tx_timeout(struct hrtimer *data)
1151{
1152	struct f_ncm *ncm = container_of(data, struct f_ncm, task_timer);
1153	struct net_device *netdev = READ_ONCE(ncm->netdev);
1154
1155	if (netdev) {
1156		/* XXX This allowance of a NULL skb argument to ndo_start_xmit
1157		 * XXX is not sane.  The gadget layer should be redesigned so
1158		 * XXX that the dev->wrap() invocations to build SKBs is transparent
1159		 * XXX and performed in some way outside of the ndo_start_xmit
1160		 * XXX interface.
1161		 *
1162		 * This will call directly into u_ether's eth_start_xmit()
1163		 */
1164		netdev->netdev_ops->ndo_start_xmit(NULL, netdev);
1165	}
1166	return HRTIMER_NORESTART;
1167}
1168
1169static int ncm_unwrap_ntb(struct gether *port,
1170			  struct sk_buff *skb,
1171			  struct sk_buff_head *list)
1172{
1173	struct f_ncm	*ncm = func_to_ncm(&port->func);
1174	__le16		*tmp = (void *) skb->data;
 
1175	unsigned	index, index2;
1176	int		ndp_index;
1177	unsigned	dg_len, dg_len2;
1178	unsigned	ndp_len;
1179	unsigned	block_len;
1180	struct sk_buff	*skb2;
1181	int		ret = -EINVAL;
1182	unsigned	ntb_max = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize);
1183	unsigned	frame_max = le16_to_cpu(ecm_desc.wMaxSegmentSize);
1184	const struct ndp_parser_opts *opts = ncm->parser_opts;
1185	unsigned	crc_len = ncm->is_crc ? sizeof(uint32_t) : 0;
1186	int		dgram_counter;
 
 
 
 
 
 
 
 
1187
1188	/* dwSignature */
1189	if (get_unaligned_le32(tmp) != opts->nth_sign) {
1190		INFO(port->func.config->cdev, "Wrong NTH SIGN, skblen %d\n",
1191			skb->len);
1192		print_hex_dump(KERN_INFO, "HEAD:", DUMP_PREFIX_ADDRESS, 32, 1,
1193			       skb->data, 32, false);
1194
1195		goto err;
1196	}
1197	tmp += 2;
1198	/* wHeaderLength */
1199	if (get_unaligned_le16(tmp++) != opts->nth_size) {
1200		INFO(port->func.config->cdev, "Wrong NTB headersize\n");
1201		goto err;
1202	}
1203	tmp++; /* skip wSequence */
1204
1205	block_len = get_ncm(&tmp, opts->block_length);
1206	/* (d)wBlockLength */
1207	if (block_len > ntb_max) {
1208		INFO(port->func.config->cdev, "OUT size exceeded\n");
1209		goto err;
1210	}
1211
1212	ndp_index = get_ncm(&tmp, opts->ndp_index);
1213
1214	/* Run through all the NDP's in the NTB */
1215	do {
1216		/*
1217		 * NCM 3.2
1218		 * dwNdpIndex
1219		 */
1220		if (((ndp_index % 4) != 0) ||
1221				(ndp_index < opts->nth_size) ||
1222				(ndp_index > (block_len -
1223					      opts->ndp_size))) {
1224			INFO(port->func.config->cdev, "Bad index: %#X\n",
1225			     ndp_index);
1226			goto err;
1227		}
1228
1229		/*
1230		 * walk through NDP
1231		 * dwSignature
1232		 */
1233		tmp = (void *)(skb->data + ndp_index);
1234		if (get_unaligned_le32(tmp) != ncm->ndp_sign) {
1235			INFO(port->func.config->cdev, "Wrong NDP SIGN\n");
1236			goto err;
1237		}
1238		tmp += 2;
1239
1240		ndp_len = get_unaligned_le16(tmp++);
1241		/*
1242		 * NCM 3.3.1
1243		 * wLength
1244		 * entry is 2 items
1245		 * item size is 16/32 bits, opts->dgram_item_len * 2 bytes
1246		 * minimal: struct usb_cdc_ncm_ndpX + normal entry + zero entry
1247		 * Each entry is a dgram index and a dgram length.
1248		 */
1249		if ((ndp_len < opts->ndp_size
1250				+ 2 * 2 * (opts->dgram_item_len * 2)) ||
1251				(ndp_len % opts->ndplen_align != 0)) {
1252			INFO(port->func.config->cdev, "Bad NDP length: %#X\n",
1253			     ndp_len);
1254			goto err;
1255		}
1256		tmp += opts->reserved1;
1257		/* Check for another NDP (d)wNextNdpIndex */
1258		ndp_index = get_ncm(&tmp, opts->next_ndp_index);
1259		tmp += opts->reserved2;
1260
1261		ndp_len -= opts->ndp_size;
1262		index2 = get_ncm(&tmp, opts->dgram_item_len);
1263		dg_len2 = get_ncm(&tmp, opts->dgram_item_len);
1264		dgram_counter = 0;
1265
1266		do {
1267			index = index2;
1268			/* wDatagramIndex[0] */
1269			if ((index < opts->nth_size) ||
1270					(index > block_len - opts->dpe_size)) {
1271				INFO(port->func.config->cdev,
1272				     "Bad index: %#X\n", index);
1273				goto err;
1274			}
1275
1276			dg_len = dg_len2;
1277			/*
1278			 * wDatagramLength[0]
1279			 * ethernet hdr + crc or larger than max frame size
1280			 */
1281			if ((dg_len < 14 + crc_len) ||
1282					(dg_len > frame_max)) {
1283				INFO(port->func.config->cdev,
1284				     "Bad dgram length: %#X\n", dg_len);
1285				goto err;
1286			}
1287			if (ncm->is_crc) {
1288				uint32_t crc, crc2;
1289
1290				crc = get_unaligned_le32(skb->data +
1291							 index + dg_len -
1292							 crc_len);
1293				crc2 = ~crc32_le(~0,
1294						 skb->data + index,
1295						 dg_len - crc_len);
1296				if (crc != crc2) {
1297					INFO(port->func.config->cdev,
1298					     "Bad CRC\n");
1299					goto err;
1300				}
1301			}
1302
1303			index2 = get_ncm(&tmp, opts->dgram_item_len);
1304			dg_len2 = get_ncm(&tmp, opts->dgram_item_len);
1305
1306			/* wDatagramIndex[1] */
1307			if (index2 > block_len - opts->dpe_size) {
1308				INFO(port->func.config->cdev,
1309				     "Bad index: %#X\n", index2);
1310				goto err;
1311			}
1312
1313			/*
1314			 * Copy the data into a new skb.
1315			 * This ensures the truesize is correct
1316			 */
1317			skb2 = netdev_alloc_skb_ip_align(ncm->netdev,
1318							 dg_len - crc_len);
1319			if (skb2 == NULL)
1320				goto err;
1321			skb_put_data(skb2, skb->data + index,
1322				     dg_len - crc_len);
1323
1324			skb_queue_tail(list, skb2);
1325
1326			ndp_len -= 2 * (opts->dgram_item_len * 2);
1327
1328			dgram_counter++;
1329			if (index2 == 0 || dg_len2 == 0)
1330				break;
1331		} while (ndp_len > 2 * (opts->dgram_item_len * 2));
1332	} while (ndp_index);
1333
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1334	dev_consume_skb_any(skb);
1335
1336	VDBG(port->func.config->cdev,
1337	     "Parsed NTB with %d frames\n", dgram_counter);
1338	return 0;
1339err:
1340	skb_queue_purge(list);
1341	dev_kfree_skb_any(skb);
1342	return ret;
1343}
1344
1345static void ncm_disable(struct usb_function *f)
1346{
1347	struct f_ncm		*ncm = func_to_ncm(f);
1348	struct usb_composite_dev *cdev = f->config->cdev;
1349
1350	DBG(cdev, "ncm deactivated\n");
1351
1352	if (ncm->port.in_ep->enabled) {
1353		ncm->netdev = NULL;
1354		gether_disconnect(&ncm->port);
1355	}
1356
1357	if (ncm->notify->enabled) {
1358		usb_ep_disable(ncm->notify);
1359		ncm->notify->desc = NULL;
1360	}
1361}
1362
1363/*-------------------------------------------------------------------------*/
1364
1365/*
1366 * Callbacks let us notify the host about connect/disconnect when the
1367 * net device is opened or closed.
1368 *
1369 * For testing, note that link states on this side include both opened
1370 * and closed variants of:
1371 *
1372 *   - disconnected/unconfigured
1373 *   - configured but inactive (data alt 0)
1374 *   - configured and active (data alt 1)
1375 *
1376 * Each needs to be tested with unplug, rmmod, SET_CONFIGURATION, and
1377 * SET_INTERFACE (altsetting).  Remember also that "configured" doesn't
1378 * imply the host is actually polling the notification endpoint, and
1379 * likewise that "active" doesn't imply it's actually using the data
1380 * endpoints for traffic.
1381 */
1382
1383static void ncm_open(struct gether *geth)
1384{
1385	struct f_ncm		*ncm = func_to_ncm(&geth->func);
1386
1387	DBG(ncm->port.func.config->cdev, "%s\n", __func__);
1388
1389	spin_lock(&ncm->lock);
1390	ncm->is_open = true;
1391	ncm_notify(ncm);
1392	spin_unlock(&ncm->lock);
1393}
1394
1395static void ncm_close(struct gether *geth)
1396{
1397	struct f_ncm		*ncm = func_to_ncm(&geth->func);
1398
1399	DBG(ncm->port.func.config->cdev, "%s\n", __func__);
1400
1401	spin_lock(&ncm->lock);
1402	ncm->is_open = false;
1403	ncm_notify(ncm);
1404	spin_unlock(&ncm->lock);
1405}
1406
1407/*-------------------------------------------------------------------------*/
1408
1409/* ethernet function driver setup/binding */
1410
1411static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
1412{
1413	struct usb_composite_dev *cdev = c->cdev;
1414	struct f_ncm		*ncm = func_to_ncm(f);
1415	struct usb_string	*us;
1416	int			status;
1417	struct usb_ep		*ep;
1418	struct f_ncm_opts	*ncm_opts;
1419
1420	if (!can_support_ecm(cdev->gadget))
1421		return -EINVAL;
1422
1423	ncm_opts = container_of(f->fi, struct f_ncm_opts, func_inst);
1424
1425	if (cdev->use_os_string) {
1426		f->os_desc_table = kzalloc(sizeof(*f->os_desc_table),
1427					   GFP_KERNEL);
1428		if (!f->os_desc_table)
1429			return -ENOMEM;
1430		f->os_desc_n = 1;
1431		f->os_desc_table[0].os_desc = &ncm_opts->ncm_os_desc;
1432	}
1433
1434	/*
1435	 * in drivers/usb/gadget/configfs.c:configfs_composite_bind()
1436	 * configurations are bound in sequence with list_for_each_entry,
1437	 * in each configuration its functions are bound in sequence
1438	 * with list_for_each_entry, so we assume no race condition
1439	 * with regard to ncm_opts->bound access
1440	 */
1441	if (!ncm_opts->bound) {
1442		mutex_lock(&ncm_opts->lock);
1443		gether_set_gadget(ncm_opts->net, cdev->gadget);
1444		status = gether_register_netdev(ncm_opts->net);
1445		mutex_unlock(&ncm_opts->lock);
1446		if (status)
1447			goto fail;
1448		ncm_opts->bound = true;
1449	}
 
 
 
 
 
 
 
1450	us = usb_gstrings_attach(cdev, ncm_strings,
1451				 ARRAY_SIZE(ncm_string_defs));
1452	if (IS_ERR(us)) {
1453		status = PTR_ERR(us);
1454		goto fail;
1455	}
1456	ncm_control_intf.iInterface = us[STRING_CTRL_IDX].id;
1457	ncm_data_nop_intf.iInterface = us[STRING_DATA_IDX].id;
1458	ncm_data_intf.iInterface = us[STRING_DATA_IDX].id;
1459	ecm_desc.iMACAddress = us[STRING_MAC_IDX].id;
1460	ncm_iad_desc.iFunction = us[STRING_IAD_IDX].id;
1461
1462	/* allocate instance-specific interface IDs */
1463	status = usb_interface_id(c, f);
1464	if (status < 0)
1465		goto fail;
1466	ncm->ctrl_id = status;
1467	ncm_iad_desc.bFirstInterface = status;
1468
1469	ncm_control_intf.bInterfaceNumber = status;
1470	ncm_union_desc.bMasterInterface0 = status;
1471
1472	if (cdev->use_os_string)
1473		f->os_desc_table[0].if_id =
1474			ncm_iad_desc.bFirstInterface;
1475
1476	status = usb_interface_id(c, f);
1477	if (status < 0)
1478		goto fail;
1479	ncm->data_id = status;
1480
1481	ncm_data_nop_intf.bInterfaceNumber = status;
1482	ncm_data_intf.bInterfaceNumber = status;
1483	ncm_union_desc.bSlaveInterface0 = status;
1484
 
 
1485	status = -ENODEV;
1486
1487	/* allocate instance-specific endpoints */
1488	ep = usb_ep_autoconfig(cdev->gadget, &fs_ncm_in_desc);
1489	if (!ep)
1490		goto fail;
1491	ncm->port.in_ep = ep;
1492
1493	ep = usb_ep_autoconfig(cdev->gadget, &fs_ncm_out_desc);
1494	if (!ep)
1495		goto fail;
1496	ncm->port.out_ep = ep;
1497
1498	ep = usb_ep_autoconfig(cdev->gadget, &fs_ncm_notify_desc);
1499	if (!ep)
1500		goto fail;
1501	ncm->notify = ep;
1502
1503	status = -ENOMEM;
1504
1505	/* allocate notification request and buffer */
1506	ncm->notify_req = usb_ep_alloc_request(ep, GFP_KERNEL);
1507	if (!ncm->notify_req)
1508		goto fail;
1509	ncm->notify_req->buf = kmalloc(NCM_STATUS_BYTECOUNT, GFP_KERNEL);
1510	if (!ncm->notify_req->buf)
1511		goto fail;
1512	ncm->notify_req->context = ncm;
1513	ncm->notify_req->complete = ncm_notify_complete;
1514
1515	/*
1516	 * support all relevant hardware speeds... we expect that when
1517	 * hardware is dual speed, all bulk-capable endpoints work at
1518	 * both speeds
1519	 */
1520	hs_ncm_in_desc.bEndpointAddress = fs_ncm_in_desc.bEndpointAddress;
1521	hs_ncm_out_desc.bEndpointAddress = fs_ncm_out_desc.bEndpointAddress;
1522	hs_ncm_notify_desc.bEndpointAddress =
1523		fs_ncm_notify_desc.bEndpointAddress;
1524
1525	ss_ncm_in_desc.bEndpointAddress = fs_ncm_in_desc.bEndpointAddress;
1526	ss_ncm_out_desc.bEndpointAddress = fs_ncm_out_desc.bEndpointAddress;
1527	ss_ncm_notify_desc.bEndpointAddress =
1528		fs_ncm_notify_desc.bEndpointAddress;
1529
1530	status = usb_assign_descriptors(f, ncm_fs_function, ncm_hs_function,
1531			ncm_ss_function, ncm_ss_function);
1532	if (status)
1533		goto fail;
1534
1535	/*
1536	 * NOTE:  all that is done without knowing or caring about
1537	 * the network link ... which is unavailable to this code
1538	 * until we're activated via set_alt().
1539	 */
1540
1541	ncm->port.open = ncm_open;
1542	ncm->port.close = ncm_close;
1543
1544	hrtimer_init(&ncm->task_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT);
1545	ncm->task_timer.function = ncm_tx_timeout;
1546
1547	DBG(cdev, "CDC Network: %s speed IN/%s OUT/%s NOTIFY/%s\n",
1548			gadget_is_superspeed(c->cdev->gadget) ? "super" :
1549			gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
1550			ncm->port.in_ep->name, ncm->port.out_ep->name,
1551			ncm->notify->name);
1552	return 0;
1553
1554fail:
1555	kfree(f->os_desc_table);
1556	f->os_desc_n = 0;
1557
1558	if (ncm->notify_req) {
1559		kfree(ncm->notify_req->buf);
1560		usb_ep_free_request(ncm->notify, ncm->notify_req);
1561	}
1562
1563	ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
1564
1565	return status;
1566}
1567
1568static inline struct f_ncm_opts *to_f_ncm_opts(struct config_item *item)
1569{
1570	return container_of(to_config_group(item), struct f_ncm_opts,
1571			    func_inst.group);
1572}
1573
1574/* f_ncm_item_ops */
1575USB_ETHERNET_CONFIGFS_ITEM(ncm);
1576
1577/* f_ncm_opts_dev_addr */
1578USB_ETHERNET_CONFIGFS_ITEM_ATTR_DEV_ADDR(ncm);
1579
1580/* f_ncm_opts_host_addr */
1581USB_ETHERNET_CONFIGFS_ITEM_ATTR_HOST_ADDR(ncm);
1582
1583/* f_ncm_opts_qmult */
1584USB_ETHERNET_CONFIGFS_ITEM_ATTR_QMULT(ncm);
1585
1586/* f_ncm_opts_ifname */
1587USB_ETHERNET_CONFIGFS_ITEM_ATTR_IFNAME(ncm);
1588
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1589static struct configfs_attribute *ncm_attrs[] = {
1590	&ncm_opts_attr_dev_addr,
1591	&ncm_opts_attr_host_addr,
1592	&ncm_opts_attr_qmult,
1593	&ncm_opts_attr_ifname,
 
1594	NULL,
1595};
1596
1597static const struct config_item_type ncm_func_type = {
1598	.ct_item_ops	= &ncm_item_ops,
1599	.ct_attrs	= ncm_attrs,
1600	.ct_owner	= THIS_MODULE,
1601};
1602
1603static void ncm_free_inst(struct usb_function_instance *f)
1604{
1605	struct f_ncm_opts *opts;
1606
1607	opts = container_of(f, struct f_ncm_opts, func_inst);
1608	if (opts->bound)
1609		gether_cleanup(netdev_priv(opts->net));
1610	else
1611		free_netdev(opts->net);
1612	kfree(opts->ncm_interf_group);
1613	kfree(opts);
1614}
1615
1616static struct usb_function_instance *ncm_alloc_inst(void)
1617{
1618	struct f_ncm_opts *opts;
1619	struct usb_os_desc *descs[1];
1620	char *names[1];
1621	struct config_group *ncm_interf_group;
1622
1623	opts = kzalloc(sizeof(*opts), GFP_KERNEL);
1624	if (!opts)
1625		return ERR_PTR(-ENOMEM);
1626	opts->ncm_os_desc.ext_compat_id = opts->ncm_ext_compat_id;
1627
1628	mutex_init(&opts->lock);
1629	opts->func_inst.free_func_inst = ncm_free_inst;
1630	opts->net = gether_setup_default();
1631	if (IS_ERR(opts->net)) {
1632		struct net_device *net = opts->net;
1633		kfree(opts);
1634		return ERR_CAST(net);
1635	}
 
1636	INIT_LIST_HEAD(&opts->ncm_os_desc.ext_prop);
1637
1638	descs[0] = &opts->ncm_os_desc;
1639	names[0] = "ncm";
1640
1641	config_group_init_type_name(&opts->func_inst.group, "", &ncm_func_type);
1642	ncm_interf_group =
1643		usb_os_desc_prepare_interf_dir(&opts->func_inst.group, 1, descs,
1644					       names, THIS_MODULE);
1645	if (IS_ERR(ncm_interf_group)) {
1646		ncm_free_inst(&opts->func_inst);
1647		return ERR_CAST(ncm_interf_group);
1648	}
1649	opts->ncm_interf_group = ncm_interf_group;
1650
1651	return &opts->func_inst;
1652}
1653
1654static void ncm_free(struct usb_function *f)
1655{
1656	struct f_ncm *ncm;
1657	struct f_ncm_opts *opts;
1658
1659	ncm = func_to_ncm(f);
1660	opts = container_of(f->fi, struct f_ncm_opts, func_inst);
1661	kfree(ncm);
1662	mutex_lock(&opts->lock);
1663	opts->refcnt--;
1664	mutex_unlock(&opts->lock);
1665}
1666
1667static void ncm_unbind(struct usb_configuration *c, struct usb_function *f)
1668{
1669	struct f_ncm *ncm = func_to_ncm(f);
1670
1671	DBG(c->cdev, "ncm unbind\n");
1672
1673	hrtimer_cancel(&ncm->task_timer);
1674
1675	kfree(f->os_desc_table);
1676	f->os_desc_n = 0;
1677
1678	ncm_string_defs[0].id = 0;
1679	usb_free_all_descriptors(f);
1680
1681	if (atomic_read(&ncm->notify_count)) {
1682		usb_ep_dequeue(ncm->notify, ncm->notify_req);
1683		atomic_set(&ncm->notify_count, 0);
1684	}
1685
1686	kfree(ncm->notify_req->buf);
1687	usb_ep_free_request(ncm->notify, ncm->notify_req);
1688}
1689
1690static struct usb_function *ncm_alloc(struct usb_function_instance *fi)
1691{
1692	struct f_ncm		*ncm;
1693	struct f_ncm_opts	*opts;
1694	int status;
1695
1696	/* allocate and initialize one new instance */
1697	ncm = kzalloc(sizeof(*ncm), GFP_KERNEL);
1698	if (!ncm)
1699		return ERR_PTR(-ENOMEM);
1700
1701	opts = container_of(fi, struct f_ncm_opts, func_inst);
1702	mutex_lock(&opts->lock);
1703	opts->refcnt++;
1704
1705	/* export host's Ethernet address in CDC format */
1706	status = gether_get_host_addr_cdc(opts->net, ncm->ethaddr,
1707				      sizeof(ncm->ethaddr));
1708	if (status < 12) { /* strlen("01234567890a") */
1709		kfree(ncm);
1710		mutex_unlock(&opts->lock);
1711		return ERR_PTR(-EINVAL);
1712	}
1713	ncm_string_defs[STRING_MAC_IDX].s = ncm->ethaddr;
1714
1715	spin_lock_init(&ncm->lock);
1716	ncm_reset_values(ncm);
1717	ncm->port.ioport = netdev_priv(opts->net);
1718	mutex_unlock(&opts->lock);
1719	ncm->port.is_fixed = true;
1720	ncm->port.supports_multi_frame = true;
1721
1722	ncm->port.func.name = "cdc_network";
1723	/* descriptors are per-instance copies */
1724	ncm->port.func.bind = ncm_bind;
1725	ncm->port.func.unbind = ncm_unbind;
1726	ncm->port.func.set_alt = ncm_set_alt;
1727	ncm->port.func.get_alt = ncm_get_alt;
1728	ncm->port.func.setup = ncm_setup;
1729	ncm->port.func.disable = ncm_disable;
1730	ncm->port.func.free_func = ncm_free;
1731
1732	ncm->port.wrap = ncm_wrap_ntb;
1733	ncm->port.unwrap = ncm_unwrap_ntb;
1734
1735	return &ncm->port.func;
1736}
1737
1738DECLARE_USB_FUNCTION_INIT(ncm, ncm_alloc_inst, ncm_alloc);
1739MODULE_LICENSE("GPL");
1740MODULE_AUTHOR("Yauheni Kaliuta");