1	/*
2	* cdc_ncm.c
3	*
4	* Copyright (C) ST-Ericsson 2010-2012
5	* Contact: Alexey Orishko <alexey.orishko@stericsson.com>
6	* Original author: Hans Petter Selasky <hans.petter.selasky@stericsson.com>
7	*
8	* USB Host Driver for Network Control Model (NCM)
9	* http://www.usb.org/developers/docs/devclass_docs/NCM10_012011.zip
10	*
11	* The NCM encoding, decoding and initialization logic
12	* derives from FreeBSD 8.x. if_cdce.c and if_cdcereg.h
13	*
14	* This software is available to you under a choice of one of two
15	* licenses. You may choose this file to be licensed under the terms
16	* of the GNU General Public License (GPL) Version 2 or the 2-clause
17	* BSD license listed below:
18	*
19	* Redistribution and use in source and binary forms, with or without
20	* modification, are permitted provided that the following conditions
21	* are met:
22	* 1. Redistributions of source code must retain the above copyright
23	* notice, this list of conditions and the following disclaimer.
24	* 2. Redistributions in binary form must reproduce the above copyright
25	* notice, this list of conditions and the following disclaimer in the
26	* documentation and/or other materials provided with the distribution.
27	*
28	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
29	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
30	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
31	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
32	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
33	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
34	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
35	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
36	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
37	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38	* SUCH DAMAGE.
39	*/
40
41	#include <linux/module.h>
42	#include <linux/netdevice.h>
43	#include <linux/ctype.h>
44	#include <linux/etherdevice.h>
45	#include <linux/ethtool.h>
46	#include <linux/kstrtox.h>
47	#include <linux/workqueue.h>
48	#include <linux/mii.h>
49	#include <linux/crc32.h>
50	#include <linux/usb.h>
51	#include <linux/hrtimer.h>
52	#include <linux/atomic.h>
53	#include <linux/usb/usbnet.h>
54	#include <linux/usb/cdc.h>
55	#include <linux/usb/cdc_ncm.h>
56
57	#if IS_ENABLED(CONFIG_USB_NET_CDC_MBIM)
58	static bool prefer_mbim = true;
59	#else
60	static bool prefer_mbim;
61	#endif
62	module_param(prefer_mbim, bool, 0644);
63	MODULE_PARM_DESC(prefer_mbim, "Prefer MBIM setting on dual NCM/MBIM functions");
64
65	static void cdc_ncm_txpath_bh(struct tasklet_struct *t);
66	static void cdc_ncm_tx_timeout_start(struct cdc_ncm_ctx *ctx);
67	static enum hrtimer_restart cdc_ncm_tx_timer_cb(struct hrtimer *hr_timer);
68	static struct usb_driver cdc_ncm_driver;
69
70	struct cdc_ncm_stats {
71	char stat_string[ETH_GSTRING_LEN];
72	int sizeof_stat;
73	int stat_offset;
74	};
75
76	#define CDC_NCM_STAT(str, m) { \
77	.stat_string = str, \
78	.sizeof_stat = sizeof(((struct cdc_ncm_ctx *)0)->m), \
79	.stat_offset = offsetof(struct cdc_ncm_ctx, m) }
80	#define CDC_NCM_SIMPLE_STAT(m) CDC_NCM_STAT(__stringify(m), m)
81
82	static const struct cdc_ncm_stats cdc_ncm_gstrings_stats[] = {
83	CDC_NCM_SIMPLE_STAT(tx_reason_ntb_full),
84	CDC_NCM_SIMPLE_STAT(tx_reason_ndp_full),
85	CDC_NCM_SIMPLE_STAT(tx_reason_timeout),
86	CDC_NCM_SIMPLE_STAT(tx_reason_max_datagram),
87	CDC_NCM_SIMPLE_STAT(tx_overhead),
88	CDC_NCM_SIMPLE_STAT(tx_ntbs),
89	CDC_NCM_SIMPLE_STAT(rx_overhead),
90	CDC_NCM_SIMPLE_STAT(rx_ntbs),
91	};
92
93	#define CDC_NCM_LOW_MEM_MAX_CNT 10
94
95	static int cdc_ncm_get_sset_count(struct net_device __always_unused *netdev, int sset)
96	{
97	switch (sset) {
98	case ETH_SS_STATS:
99	return ARRAY_SIZE(cdc_ncm_gstrings_stats);
100	default:
101	return -EOPNOTSUPP;
102	}
103	}
104
105	static void cdc_ncm_get_ethtool_stats(struct net_device *netdev,
106	struct ethtool_stats __always_unused *stats,
107	u64 *data)
108	{
109	struct usbnet *dev = netdev_priv(dev: netdev);
110	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
111	int i;
112	char *p = NULL;
113
114	for (i = 0; i < ARRAY_SIZE(cdc_ncm_gstrings_stats); i++) {
115	p = (char *)ctx + cdc_ncm_gstrings_stats[i].stat_offset;
116	data[i] = (cdc_ncm_gstrings_stats[i].sizeof_stat == sizeof(u64)) ? *(u64 *)p : *(u32 *)p;
117	}
118	}
119
120	static void cdc_ncm_get_strings(struct net_device __always_unused *netdev, u32 stringset, u8 *data)
121	{
122	u8 *p = data;
123	int i;
124
125	switch (stringset) {
126	case ETH_SS_STATS:
127	for (i = 0; i < ARRAY_SIZE(cdc_ncm_gstrings_stats); i++) {
128	memcpy(p, cdc_ncm_gstrings_stats[i].stat_string, ETH_GSTRING_LEN);
129	p += ETH_GSTRING_LEN;
130	}
131	}
132	}
133
134	static void cdc_ncm_update_rxtx_max(struct usbnet *dev, u32 new_rx, u32 new_tx);
135
136	static const struct ethtool_ops cdc_ncm_ethtool_ops = {
137	.get_link = usbnet_get_link,
138	.nway_reset = usbnet_nway_reset,
139	.get_drvinfo = usbnet_get_drvinfo,
140	.get_msglevel = usbnet_get_msglevel,
141	.set_msglevel = usbnet_set_msglevel,
142	.get_ts_info = ethtool_op_get_ts_info,
143	.get_sset_count = cdc_ncm_get_sset_count,
144	.get_strings = cdc_ncm_get_strings,
145	.get_ethtool_stats = cdc_ncm_get_ethtool_stats,
146	.get_link_ksettings = usbnet_get_link_ksettings_internal,
147	.set_link_ksettings = NULL,
148	};
149
150	static u32 cdc_ncm_check_rx_max(struct usbnet *dev, u32 new_rx)
151	{
152	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
153	u32 val, max, min;
154
155	/* clamp new_rx to sane values */
156	min = USB_CDC_NCM_NTB_MIN_IN_SIZE;
157	max = min_t(u32, CDC_NCM_NTB_MAX_SIZE_RX, le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize));
158
159	/* dwNtbInMaxSize spec violation? Use MIN size for both limits */
160	if (max < min) {
161	dev_warn(&dev->intf->dev, "dwNtbInMaxSize=%u is too small. Using %u\n",
162	le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize), min);
163	max = min;
164	}
165
166	val = clamp_t(u32, new_rx, min, max);
167	if (val != new_rx)
168	dev_dbg(&dev->intf->dev, "rx_max must be in the [%u, %u] range\n", min, max);
169
170	return val;
171	}
172
173	static u32 cdc_ncm_check_tx_max(struct usbnet *dev, u32 new_tx)
174	{
175	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
176	u32 val, max, min;
177
178	/* clamp new_tx to sane values */
179	if (ctx->is_ndp16)
180	min = ctx->max_datagram_size + ctx->max_ndp_size + sizeof(struct usb_cdc_ncm_nth16);
181	else
182	min = ctx->max_datagram_size + ctx->max_ndp_size + sizeof(struct usb_cdc_ncm_nth32);
183
184	if (le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize) == 0)
185	max = CDC_NCM_NTB_MAX_SIZE_TX; /* dwNtbOutMaxSize not set */
186	else
187	max = clamp_t(u32, le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize),
188	USB_CDC_NCM_NTB_MIN_OUT_SIZE,
189	CDC_NCM_NTB_MAX_SIZE_TX);
190
191	/* some devices set dwNtbOutMaxSize too low for the above default */
192	min = min(min, max);
193
194	val = clamp_t(u32, new_tx, min, max);
195	if (val != new_tx)
196	dev_dbg(&dev->intf->dev, "tx_max must be in the [%u, %u] range\n", min, max);
197
198	return val;
199	}
200
201	static ssize_t min_tx_pkt_show(struct device *d,
202	struct device_attribute *attr, char *buf)
203	{
204	struct usbnet *dev = netdev_priv(to_net_dev(d));
205	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
206
207	return sprintf(buf, fmt: "%u\n", ctx->min_tx_pkt);
208	}
209
210	static ssize_t rx_max_show(struct device *d,
211	struct device_attribute *attr, char *buf)
212	{
213	struct usbnet *dev = netdev_priv(to_net_dev(d));
214	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
215
216	return sprintf(buf, fmt: "%u\n", ctx->rx_max);
217	}
218
219	static ssize_t tx_max_show(struct device *d,
220	struct device_attribute *attr, char *buf)
221	{
222	struct usbnet *dev = netdev_priv(to_net_dev(d));
223	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
224
225	return sprintf(buf, fmt: "%u\n", ctx->tx_max);
226	}
227
228	static ssize_t tx_timer_usecs_show(struct device *d,
229	struct device_attribute *attr, char *buf)
230	{
231	struct usbnet *dev = netdev_priv(to_net_dev(d));
232	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
233
234	return sprintf(buf, fmt: "%u\n", ctx->timer_interval / (u32)NSEC_PER_USEC);
235	}
236
237	static ssize_t min_tx_pkt_store(struct device *d,
238	struct device_attribute *attr,
239	const char *buf, size_t len)
240	{
241	struct usbnet *dev = netdev_priv(to_net_dev(d));
242	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
243	unsigned long val;
244
245	/* no need to restrict values - anything from 0 to infinity is OK */
246	if (kstrtoul(s: buf, base: 0, res: &val))
247	return -EINVAL;
248
249	ctx->min_tx_pkt = val;
250	return len;
251	}
252
253	static ssize_t rx_max_store(struct device *d,
254	struct device_attribute *attr,
255	const char *buf, size_t len)
256	{
257	struct usbnet *dev = netdev_priv(to_net_dev(d));
258	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
259	unsigned long val;
260
261	if (kstrtoul(s: buf, base: 0, res: &val) || cdc_ncm_check_rx_max(dev, new_rx: val) != val)
262	return -EINVAL;
263
264	cdc_ncm_update_rxtx_max(dev, new_rx: val, new_tx: ctx->tx_max);
265	return len;
266	}
267
268	static ssize_t tx_max_store(struct device *d,
269	struct device_attribute *attr,
270	const char *buf, size_t len)
271	{
272	struct usbnet *dev = netdev_priv(to_net_dev(d));
273	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
274	unsigned long val;
275
276	if (kstrtoul(s: buf, base: 0, res: &val) || cdc_ncm_check_tx_max(dev, new_tx: val) != val)
277	return -EINVAL;
278
279	cdc_ncm_update_rxtx_max(dev, new_rx: ctx->rx_max, new_tx: val);
280	return len;
281	}
282
283	static ssize_t tx_timer_usecs_store(struct device *d,
284	struct device_attribute *attr,
285	const char *buf, size_t len)
286	{
287	struct usbnet *dev = netdev_priv(to_net_dev(d));
288	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
289	ssize_t ret;
290	unsigned long val;
291
292	ret = kstrtoul(s: buf, base: 0, res: &val);
293	if (ret)
294	return ret;
295	if (val && (val < CDC_NCM_TIMER_INTERVAL_MIN || val > CDC_NCM_TIMER_INTERVAL_MAX))
296	return -EINVAL;
297
298	spin_lock_bh(lock: &ctx->mtx);
299	ctx->timer_interval = val * NSEC_PER_USEC;
300	if (!ctx->timer_interval)
301	ctx->tx_timer_pending = 0;
302	spin_unlock_bh(lock: &ctx->mtx);
303	return len;
304	}
305
306	static DEVICE_ATTR_RW(min_tx_pkt);
307	static DEVICE_ATTR_RW(rx_max);
308	static DEVICE_ATTR_RW(tx_max);
309	static DEVICE_ATTR_RW(tx_timer_usecs);
310
311	static ssize_t ndp_to_end_show(struct device *d, struct device_attribute *attr, char *buf)
312	{
313	struct usbnet *dev = netdev_priv(to_net_dev(d));
314	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
315
316	return sprintf(buf, fmt: "%c\n", ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END ? 'Y' : 'N');
317	}
318
319	static ssize_t ndp_to_end_store(struct device *d, struct device_attribute *attr, const char *buf, size_t len)
320	{
321	struct usbnet *dev = netdev_priv(to_net_dev(d));
322	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
323	bool enable;
324
325	if (kstrtobool(s: buf, res: &enable))
326	return -EINVAL;
327
328	/* no change? */
329	if (enable == (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END))
330	return len;
331
332	if (enable) {
333	if (ctx->is_ndp16 && !ctx->delayed_ndp16) {
334	ctx->delayed_ndp16 = kzalloc(size: ctx->max_ndp_size, GFP_KERNEL);
335	if (!ctx->delayed_ndp16)
336	return -ENOMEM;
337	}
338	if (!ctx->is_ndp16 && !ctx->delayed_ndp32) {
339	ctx->delayed_ndp32 = kzalloc(size: ctx->max_ndp_size, GFP_KERNEL);
340	if (!ctx->delayed_ndp32)
341	return -ENOMEM;
342	}
343	}
344
345	/* flush pending data before changing flag */
346	netif_tx_lock_bh(dev: dev->net);
347	usbnet_start_xmit(NULL, net: dev->net);
348	spin_lock_bh(lock: &ctx->mtx);
349	if (enable)
350	ctx->drvflags |= CDC_NCM_FLAG_NDP_TO_END;
351	else
352	ctx->drvflags &= ~CDC_NCM_FLAG_NDP_TO_END;
353	spin_unlock_bh(lock: &ctx->mtx);
354	netif_tx_unlock_bh(dev: dev->net);
355
356	return len;
357	}
358	static DEVICE_ATTR_RW(ndp_to_end);
359
360	#define NCM_PARM_ATTR(name, format, tocpu) \
361	static ssize_t cdc_ncm_show_##name(struct device *d, struct device_attribute *attr, char *buf) \
362	{ \
363	struct usbnet *dev = netdev_priv(to_net_dev(d)); \
364	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0]; \
365	return sprintf(buf, format "\n", tocpu(ctx->ncm_parm.name)); \
366	} \
367	static DEVICE_ATTR(name, 0444, cdc_ncm_show_##name, NULL)
368
369	NCM_PARM_ATTR(bmNtbFormatsSupported, "0x%04x", le16_to_cpu);
370	NCM_PARM_ATTR(dwNtbInMaxSize, "%u", le32_to_cpu);
371	NCM_PARM_ATTR(wNdpInDivisor, "%u", le16_to_cpu);
372	NCM_PARM_ATTR(wNdpInPayloadRemainder, "%u", le16_to_cpu);
373	NCM_PARM_ATTR(wNdpInAlignment, "%u", le16_to_cpu);
374	NCM_PARM_ATTR(dwNtbOutMaxSize, "%u", le32_to_cpu);
375	NCM_PARM_ATTR(wNdpOutDivisor, "%u", le16_to_cpu);
376	NCM_PARM_ATTR(wNdpOutPayloadRemainder, "%u", le16_to_cpu);
377	NCM_PARM_ATTR(wNdpOutAlignment, "%u", le16_to_cpu);
378	NCM_PARM_ATTR(wNtbOutMaxDatagrams, "%u", le16_to_cpu);
379
380	static struct attribute *cdc_ncm_sysfs_attrs[] = {
381	&dev_attr_min_tx_pkt.attr,
382	&dev_attr_ndp_to_end.attr,
383	&dev_attr_rx_max.attr,
384	&dev_attr_tx_max.attr,
385	&dev_attr_tx_timer_usecs.attr,
386	&dev_attr_bmNtbFormatsSupported.attr,
387	&dev_attr_dwNtbInMaxSize.attr,
388	&dev_attr_wNdpInDivisor.attr,
389	&dev_attr_wNdpInPayloadRemainder.attr,
390	&dev_attr_wNdpInAlignment.attr,
391	&dev_attr_dwNtbOutMaxSize.attr,
392	&dev_attr_wNdpOutDivisor.attr,
393	&dev_attr_wNdpOutPayloadRemainder.attr,
394	&dev_attr_wNdpOutAlignment.attr,
395	&dev_attr_wNtbOutMaxDatagrams.attr,
396	NULL,
397	};
398
399	static const struct attribute_group cdc_ncm_sysfs_attr_group = {
400	.name = "cdc_ncm",
401	.attrs = cdc_ncm_sysfs_attrs,
402	};
403
404	/* handle rx_max and tx_max changes */
405	static void cdc_ncm_update_rxtx_max(struct usbnet *dev, u32 new_rx, u32 new_tx)
406	{
407	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
408	u8 iface_no = ctx->control->cur_altsetting->desc.bInterfaceNumber;
409	u32 val;
410
411	val = cdc_ncm_check_rx_max(dev, new_rx);
412
413	/* inform device about NTB input size changes */
414	if (val != ctx->rx_max) {
415	__le32 dwNtbInMaxSize = cpu_to_le32(val);
416
417	dev_info(&dev->intf->dev, "setting rx_max = %u\n", val);
418
419	/* tell device to use new size */
420	if (usbnet_write_cmd(dev, USB_CDC_SET_NTB_INPUT_SIZE,
421	USB_TYPE_CLASS | USB_DIR_OUT
422	| USB_RECIP_INTERFACE,
423	value: 0, index: iface_no, data: &dwNtbInMaxSize, size: 4) < 0)
424	dev_dbg(&dev->intf->dev, "Setting NTB Input Size failed\n");
425	else
426	ctx->rx_max = val;
427	}
428
429	/* usbnet use these values for sizing rx queues */
430	if (dev->rx_urb_size != ctx->rx_max) {
431	dev->rx_urb_size = ctx->rx_max;
432	if (netif_running(dev: dev->net))
433	usbnet_unlink_rx_urbs(dev);
434	}
435
436	val = cdc_ncm_check_tx_max(dev, new_tx);
437	if (val != ctx->tx_max)
438	dev_info(&dev->intf->dev, "setting tx_max = %u\n", val);
439
440	/* Adding a pad byte here if necessary simplifies the handling
441	* in cdc_ncm_fill_tx_frame, making tx_max always represent
442	* the real skb max size.
443	*
444	* We cannot use dev->maxpacket here because this is called from
445	* .bind which is called before usbnet sets up dev->maxpacket
446	*/
447	if (val != le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize) &&
448	val % usb_maxpacket(udev: dev->udev, pipe: dev->out) == 0)
449	val++;
450
451	/* we might need to flush any pending tx buffers if running */
452	if (netif_running(dev: dev->net) && val > ctx->tx_max) {
453	netif_tx_lock_bh(dev: dev->net);
454	usbnet_start_xmit(NULL, net: dev->net);
455	/* make sure tx_curr_skb is reallocated if it was empty */
456	if (ctx->tx_curr_skb) {
457	dev_kfree_skb_any(skb: ctx->tx_curr_skb);
458	ctx->tx_curr_skb = NULL;
459	}
460	ctx->tx_max = val;
461	netif_tx_unlock_bh(dev: dev->net);
462	} else {
463	ctx->tx_max = val;
464	}
465
466	dev->hard_mtu = ctx->tx_max;
467
468	/* max qlen depend on hard_mtu and rx_urb_size */
469	usbnet_update_max_qlen(dev);
470
471	/* never pad more than 3 full USB packets per transfer */
472	ctx->min_tx_pkt = clamp_t(u16, ctx->tx_max - 3 * usb_maxpacket(dev->udev, dev->out),
473	CDC_NCM_MIN_TX_PKT, ctx->tx_max);
474	}
475
476	/* helpers for NCM and MBIM differences */
477	static u8 cdc_ncm_flags(struct usbnet *dev)
478	{
479	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
480
481	if (cdc_ncm_comm_intf_is_mbim(dev->intf->cur_altsetting) && ctx->mbim_desc)
482	return ctx->mbim_desc->bmNetworkCapabilities;
483	if (ctx->func_desc)
484	return ctx->func_desc->bmNetworkCapabilities;
485	return 0;
486	}
487
488	static int cdc_ncm_eth_hlen(struct usbnet *dev)
489	{
490	if (cdc_ncm_comm_intf_is_mbim(dev->intf->cur_altsetting))
491	return 0;
492	return ETH_HLEN;
493	}
494
495	static u32 cdc_ncm_min_dgram_size(struct usbnet *dev)
496	{
497	if (cdc_ncm_comm_intf_is_mbim(dev->intf->cur_altsetting))
498	return CDC_MBIM_MIN_DATAGRAM_SIZE;
499	return CDC_NCM_MIN_DATAGRAM_SIZE;
500	}
501
502	static u32 cdc_ncm_max_dgram_size(struct usbnet *dev)
503	{
504	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
505
506	if (cdc_ncm_comm_intf_is_mbim(dev->intf->cur_altsetting) && ctx->mbim_desc)
507	return le16_to_cpu(ctx->mbim_desc->wMaxSegmentSize);
508	if (ctx->ether_desc)
509	return le16_to_cpu(ctx->ether_desc->wMaxSegmentSize);
510	return CDC_NCM_MAX_DATAGRAM_SIZE;
511	}
512
513	/* initial one-time device setup. MUST be called with the data interface
514	* in altsetting 0
515	*/
516	static int cdc_ncm_init(struct usbnet *dev)
517	{
518	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
519	u8 iface_no = ctx->control->cur_altsetting->desc.bInterfaceNumber;
520	int err;
521
522	err = usbnet_read_cmd(dev, USB_CDC_GET_NTB_PARAMETERS,
523	USB_TYPE_CLASS | USB_DIR_IN
524	|USB_RECIP_INTERFACE,
525	value: 0, index: iface_no, data: &ctx->ncm_parm,
526	size: sizeof(ctx->ncm_parm));
527	if (err < 0) {
528	dev_err(&dev->intf->dev, "failed GET_NTB_PARAMETERS\n");
529	return err; /* GET_NTB_PARAMETERS is required */
530	}
531
532	/* set CRC Mode */
533	if (cdc_ncm_flags(dev) & USB_CDC_NCM_NCAP_CRC_MODE) {
534	dev_dbg(&dev->intf->dev, "Setting CRC mode off\n");
535	err = usbnet_write_cmd(dev, USB_CDC_SET_CRC_MODE,
536	USB_TYPE_CLASS | USB_DIR_OUT
537	| USB_RECIP_INTERFACE,
538	USB_CDC_NCM_CRC_NOT_APPENDED,
539	index: iface_no, NULL, size: 0);
540	if (err < 0)
541	dev_err(&dev->intf->dev, "SET_CRC_MODE failed\n");
542	}
543
544	/* use ndp16 by default */
545	ctx->is_ndp16 = 1;
546
547	/* set NTB format, if both formats are supported.
548	*
549	* "The host shall only send this command while the NCM Data
550	* Interface is in alternate setting 0."
551	*/
552	if (le16_to_cpu(ctx->ncm_parm.bmNtbFormatsSupported) &
553	USB_CDC_NCM_NTB32_SUPPORTED) {
554	if (ctx->drvflags & CDC_NCM_FLAG_PREFER_NTB32) {
555	ctx->is_ndp16 = 0;
556	dev_dbg(&dev->intf->dev, "Setting NTB format to 32-bit\n");
557	err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_FORMAT,
558	USB_TYPE_CLASS | USB_DIR_OUT
559	| USB_RECIP_INTERFACE,
560	USB_CDC_NCM_NTB32_FORMAT,
561	index: iface_no, NULL, size: 0);
562	} else {
563	ctx->is_ndp16 = 1;
564	dev_dbg(&dev->intf->dev, "Setting NTB format to 16-bit\n");
565	err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_FORMAT,
566	USB_TYPE_CLASS | USB_DIR_OUT
567	| USB_RECIP_INTERFACE,
568	USB_CDC_NCM_NTB16_FORMAT,
569	index: iface_no, NULL, size: 0);
570	}
571	if (err < 0) {
572	ctx->is_ndp16 = 1;
573	dev_err(&dev->intf->dev, "SET_NTB_FORMAT failed\n");
574	}
575	}
576
577	/* set initial device values */
578	ctx->rx_max = le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize);
579	ctx->tx_max = le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize);
580	ctx->tx_remainder = le16_to_cpu(ctx->ncm_parm.wNdpOutPayloadRemainder);
581	ctx->tx_modulus = le16_to_cpu(ctx->ncm_parm.wNdpOutDivisor);
582	ctx->tx_ndp_modulus = le16_to_cpu(ctx->ncm_parm.wNdpOutAlignment);
583	/* devices prior to NCM Errata shall set this field to zero */
584	ctx->tx_max_datagrams = le16_to_cpu(ctx->ncm_parm.wNtbOutMaxDatagrams);
585
586	dev_dbg(&dev->intf->dev,
587	"dwNtbInMaxSize=%u dwNtbOutMaxSize=%u wNdpOutPayloadRemainder=%u wNdpOutDivisor=%u wNdpOutAlignment=%u wNtbOutMaxDatagrams=%u flags=0x%x\n",
588	ctx->rx_max, ctx->tx_max, ctx->tx_remainder, ctx->tx_modulus,
589	ctx->tx_ndp_modulus, ctx->tx_max_datagrams, cdc_ncm_flags(dev));
590
591	/* max count of tx datagrams */
592	if ((ctx->tx_max_datagrams == 0) ||
593	(ctx->tx_max_datagrams > CDC_NCM_DPT_DATAGRAMS_MAX))
594	ctx->tx_max_datagrams = CDC_NCM_DPT_DATAGRAMS_MAX;
595
596	/* set up maximum NDP size */
597	if (ctx->is_ndp16)
598	ctx->max_ndp_size = sizeof(struct usb_cdc_ncm_ndp16) + (ctx->tx_max_datagrams + 1) * sizeof(struct usb_cdc_ncm_dpe16);
599	else
600	ctx->max_ndp_size = sizeof(struct usb_cdc_ncm_ndp32) + (ctx->tx_max_datagrams + 1) * sizeof(struct usb_cdc_ncm_dpe32);
601
602	/* initial coalescing timer interval */
603	ctx->timer_interval = CDC_NCM_TIMER_INTERVAL_USEC * NSEC_PER_USEC;
604
605	return 0;
606	}
607
608	/* set a new max datagram size */
609	static void cdc_ncm_set_dgram_size(struct usbnet *dev, int new_size)
610	{
611	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
612	u8 iface_no = ctx->control->cur_altsetting->desc.bInterfaceNumber;
613	__le16 max_datagram_size;
614	u16 mbim_mtu;
615	int err;
616
617	/* set default based on descriptors */
618	ctx->max_datagram_size = clamp_t(u32, new_size,
619	cdc_ncm_min_dgram_size(dev),
620	CDC_NCM_MAX_DATAGRAM_SIZE);
621
622	/* inform the device about the selected Max Datagram Size? */
623	if (!(cdc_ncm_flags(dev) & USB_CDC_NCM_NCAP_MAX_DATAGRAM_SIZE))
624	goto out;
625
626	/* read current mtu value from device */
627	err = usbnet_read_cmd(dev, USB_CDC_GET_MAX_DATAGRAM_SIZE,
628	USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE,
629	value: 0, index: iface_no, data: &max_datagram_size, size: sizeof(max_datagram_size));
630	if (err != sizeof(max_datagram_size)) {
631	dev_dbg(&dev->intf->dev, "GET_MAX_DATAGRAM_SIZE failed\n");
632	goto out;
633	}
634
635	if (le16_to_cpu(max_datagram_size) == ctx->max_datagram_size)
636	goto out;
637
638	max_datagram_size = cpu_to_le16(ctx->max_datagram_size);
639	err = usbnet_write_cmd(dev, USB_CDC_SET_MAX_DATAGRAM_SIZE,
640	USB_TYPE_CLASS | USB_DIR_OUT | USB_RECIP_INTERFACE,
641	value: 0, index: iface_no, data: &max_datagram_size, size: sizeof(max_datagram_size));
642	if (err < 0)
643	dev_dbg(&dev->intf->dev, "SET_MAX_DATAGRAM_SIZE failed\n");
644
645	out:
646	/* set MTU to max supported by the device if necessary */
647	dev->net->mtu = min_t(int, dev->net->mtu, ctx->max_datagram_size - cdc_ncm_eth_hlen(dev));
648
649	/* do not exceed operator preferred MTU */
650	if (ctx->mbim_extended_desc) {
651	mbim_mtu = le16_to_cpu(ctx->mbim_extended_desc->wMTU);
652	if (mbim_mtu != 0 && mbim_mtu < dev->net->mtu)
653	dev->net->mtu = mbim_mtu;
654	}
655	}
656
657	static void cdc_ncm_fix_modulus(struct usbnet *dev)
658	{
659	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
660	u32 val;
661
662	/*
663	* verify that the structure alignment is:
664	* - power of two
665	* - not greater than the maximum transmit length
666	* - not less than four bytes
667	*/
668	val = ctx->tx_ndp_modulus;
669
670	if ((val < USB_CDC_NCM_NDP_ALIGN_MIN_SIZE) ||
671	(val != ((-val) & val)) || (val >= ctx->tx_max)) {
672	dev_dbg(&dev->intf->dev, "Using default alignment: 4 bytes\n");
673	ctx->tx_ndp_modulus = USB_CDC_NCM_NDP_ALIGN_MIN_SIZE;
674	}
675
676	/*
677	* verify that the payload alignment is:
678	* - power of two
679	* - not greater than the maximum transmit length
680	* - not less than four bytes
681	*/
682	val = ctx->tx_modulus;
683
684	if ((val < USB_CDC_NCM_NDP_ALIGN_MIN_SIZE) ||
685	(val != ((-val) & val)) || (val >= ctx->tx_max)) {
686	dev_dbg(&dev->intf->dev, "Using default transmit modulus: 4 bytes\n");
687	ctx->tx_modulus = USB_CDC_NCM_NDP_ALIGN_MIN_SIZE;
688	}
689
690	/* verify the payload remainder */
691	if (ctx->tx_remainder >= ctx->tx_modulus) {
692	dev_dbg(&dev->intf->dev, "Using default transmit remainder: 0 bytes\n");
693	ctx->tx_remainder = 0;
694	}
695
696	/* adjust TX-remainder according to NCM specification. */
697	ctx->tx_remainder = ((ctx->tx_remainder - cdc_ncm_eth_hlen(dev)) &
698	(ctx->tx_modulus - 1));
699	}
700
701	static int cdc_ncm_setup(struct usbnet *dev)
702	{
703	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
704	u32 def_rx, def_tx;
705
706	/* be conservative when selecting initial buffer size to
707	* increase the number of hosts this will work for
708	*/
709	def_rx = min_t(u32, CDC_NCM_NTB_DEF_SIZE_RX,
710	le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize));
711	def_tx = min_t(u32, CDC_NCM_NTB_DEF_SIZE_TX,
712	le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize));
713
714	/* clamp rx_max and tx_max and inform device */
715	cdc_ncm_update_rxtx_max(dev, new_rx: def_rx, new_tx: def_tx);
716
717	/* sanitize the modulus and remainder values */
718	cdc_ncm_fix_modulus(dev);
719
720	/* set max datagram size */
721	cdc_ncm_set_dgram_size(dev, new_size: cdc_ncm_max_dgram_size(dev));
722	return 0;
723	}
724
725	static void
726	cdc_ncm_find_endpoints(struct usbnet *dev, struct usb_interface *intf)
727	{
728	struct usb_host_endpoint *e, *in = NULL, *out = NULL;
729	u8 ep;
730
731	for (ep = 0; ep < intf->cur_altsetting->desc.bNumEndpoints; ep++) {
732	e = intf->cur_altsetting->endpoint + ep;
733
734	/* ignore endpoints which cannot transfer data */
735	if (!usb_endpoint_maxp(epd: &e->desc))
736	continue;
737
738	switch (e->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
739	case USB_ENDPOINT_XFER_INT:
740	if (usb_endpoint_dir_in(epd: &e->desc)) {
741	if (!dev->status)
742	dev->status = e;
743	}
744	break;
745
746	case USB_ENDPOINT_XFER_BULK:
747	if (usb_endpoint_dir_in(epd: &e->desc)) {
748	if (!in)
749	in = e;
750	} else {
751	if (!out)
752	out = e;
753	}
754	break;
755
756	default:
757	break;
758	}
759	}
760	if (in && !dev->in)
761	dev->in = usb_rcvbulkpipe(dev->udev,
762	in->desc.bEndpointAddress &
763	USB_ENDPOINT_NUMBER_MASK);
764	if (out && !dev->out)
765	dev->out = usb_sndbulkpipe(dev->udev,
766	out->desc.bEndpointAddress &
767	USB_ENDPOINT_NUMBER_MASK);
768	}
769
770	static void cdc_ncm_free(struct cdc_ncm_ctx *ctx)
771	{
772	if (ctx == NULL)
773	return;
774
775	if (ctx->tx_rem_skb != NULL) {
776	dev_kfree_skb_any(skb: ctx->tx_rem_skb);
777	ctx->tx_rem_skb = NULL;
778	}
779
780	if (ctx->tx_curr_skb != NULL) {
781	dev_kfree_skb_any(skb: ctx->tx_curr_skb);
782	ctx->tx_curr_skb = NULL;
783	}
784
785	if (ctx->is_ndp16)
786	kfree(objp: ctx->delayed_ndp16);
787	else
788	kfree(objp: ctx->delayed_ndp32);
789
790	kfree(objp: ctx);
791	}
792
793	/* we need to override the usbnet change_mtu ndo for two reasons:
794	* - respect the negotiated maximum datagram size
795	* - avoid unwanted changes to rx and tx buffers
796	*/
797	int cdc_ncm_change_mtu(struct net_device *net, int new_mtu)
798	{
799	struct usbnet *dev = netdev_priv(dev: net);
800
801	net->mtu = new_mtu;
802	cdc_ncm_set_dgram_size(dev, new_size: new_mtu + cdc_ncm_eth_hlen(dev));
803
804	return 0;
805	}
806	EXPORT_SYMBOL_GPL(cdc_ncm_change_mtu);
807
808	static const struct net_device_ops cdc_ncm_netdev_ops = {
809	.ndo_open = usbnet_open,
810	.ndo_stop = usbnet_stop,
811	.ndo_start_xmit = usbnet_start_xmit,
812	.ndo_tx_timeout = usbnet_tx_timeout,
813	.ndo_set_rx_mode = usbnet_set_rx_mode,
814	.ndo_get_stats64 = dev_get_tstats64,
815	.ndo_change_mtu = cdc_ncm_change_mtu,
816	.ndo_set_mac_address = eth_mac_addr,
817	.ndo_validate_addr = eth_validate_addr,
818	};
819
820	int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_altsetting, int drvflags)
821	{
822	struct cdc_ncm_ctx *ctx;
823	struct usb_driver *driver;
824	u8 *buf;
825	int len;
826	int temp;
827	u8 iface_no;
828	struct usb_cdc_parsed_header hdr;
829
830	ctx = kzalloc(size: sizeof(*ctx), GFP_KERNEL);
831	if (!ctx)
832	return -ENOMEM;
833
834	ctx->dev = dev;
835
836	hrtimer_init(timer: &ctx->tx_timer, CLOCK_MONOTONIC, mode: HRTIMER_MODE_REL);
837	ctx->tx_timer.function = &cdc_ncm_tx_timer_cb;
838	tasklet_setup(t: &ctx->bh, callback: cdc_ncm_txpath_bh);
839	atomic_set(v: &ctx->stop, i: 0);
840	spin_lock_init(&ctx->mtx);
841
842	/* store ctx pointer in device data field */
843	dev->data[0] = (unsigned long)ctx;
844
845	/* only the control interface can be successfully probed */
846	ctx->control = intf;
847
848	/* get some pointers */
849	driver = driver_of(intf);
850	buf = intf->cur_altsetting->extra;
851	len = intf->cur_altsetting->extralen;
852
853	/* parse through descriptors associated with control interface */
854	cdc_parse_cdc_header(hdr: &hdr, intf, buffer: buf, buflen: len);
855
856	if (hdr.usb_cdc_union_desc)
857	ctx->data = usb_ifnum_to_if(dev: dev->udev,
858	ifnum: hdr.usb_cdc_union_desc->bSlaveInterface0);
859	ctx->ether_desc = hdr.usb_cdc_ether_desc;
860	ctx->func_desc = hdr.usb_cdc_ncm_desc;
861	ctx->mbim_desc = hdr.usb_cdc_mbim_desc;
862	ctx->mbim_extended_desc = hdr.usb_cdc_mbim_extended_desc;
863
864	/* some buggy devices have an IAD but no CDC Union */
865	if (!hdr.usb_cdc_union_desc && intf->intf_assoc && intf->intf_assoc->bInterfaceCount == 2) {
866	ctx->data = usb_ifnum_to_if(dev: dev->udev, ifnum: intf->cur_altsetting->desc.bInterfaceNumber + 1);
867	dev_dbg(&intf->dev, "CDC Union missing - got slave from IAD\n");
868	}
869
870	/* check if we got everything */
871	if (!ctx->data) {
872	dev_err(&intf->dev, "CDC Union missing and no IAD found\n");
873	goto error;
874	}
875	if (cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting)) {
876	if (!ctx->mbim_desc) {
877	dev_err(&intf->dev, "MBIM functional descriptor missing\n");
878	goto error;
879	}
880	} else {
881	if (!ctx->ether_desc || !ctx->func_desc) {
882	dev_err(&intf->dev, "NCM or ECM functional descriptors missing\n");
883	goto error;
884	}
885	}
886
887	/* claim data interface, if different from control */
888	if (ctx->data != ctx->control) {
889	temp = usb_driver_claim_interface(driver, iface: ctx->data, data: dev);
890	if (temp) {
891	dev_err(&intf->dev, "failed to claim data intf\n");
892	goto error;
893	}
894	}
895
896	iface_no = ctx->data->cur_altsetting->desc.bInterfaceNumber;
897
898	/* Device-specific flags */
899	ctx->drvflags = drvflags;
900
901	/* Reset data interface. Some devices will not reset properly
902	* unless they are configured first. Toggle the altsetting to
903	* force a reset.
904	* Some other devices do not work properly with this procedure
905	* that can be avoided using quirk CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE
906	*/
907	if (!(ctx->drvflags & CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE))
908	usb_set_interface(dev: dev->udev, ifnum: iface_no, alternate: data_altsetting);
909
910	temp = usb_set_interface(dev: dev->udev, ifnum: iface_no, alternate: 0);
911	if (temp) {
912	dev_dbg(&intf->dev, "set interface failed\n");
913	goto error2;
914	}
915
916	/* initialize basic device settings */
917	if (cdc_ncm_init(dev))
918	goto error2;
919
920	/* Some firmwares need a pause here or they will silently fail
921	* to set up the interface properly. This value was decided
922	* empirically on a Sierra Wireless MC7455 running 02.08.02.00
923	* firmware.
924	*/
925	usleep_range(min: 10000, max: 20000);
926
927	/* configure data interface */
928	temp = usb_set_interface(dev: dev->udev, ifnum: iface_no, alternate: data_altsetting);
929	if (temp) {
930	dev_dbg(&intf->dev, "set interface failed\n");
931	goto error2;
932	}
933
934	cdc_ncm_find_endpoints(dev, intf: ctx->data);
935	cdc_ncm_find_endpoints(dev, intf: ctx->control);
936	if (!dev->in || !dev->out || !dev->status) {
937	dev_dbg(&intf->dev, "failed to collect endpoints\n");
938	goto error2;
939	}
940
941	usb_set_intfdata(intf: ctx->control, data: dev);
942
943	if (ctx->ether_desc) {
944	temp = usbnet_get_ethernet_addr(dev, ctx->ether_desc->iMACAddress);
945	if (temp) {
946	dev_err(&intf->dev, "failed to get mac address\n");
947	goto error2;
948	}
949	dev_info(&intf->dev, "MAC-Address: %pM\n", dev->net->dev_addr);
950	}
951
952	/* finish setting up the device specific data */
953	cdc_ncm_setup(dev);
954
955	/* Allocate the delayed NDP if needed. */
956	if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
957	if (ctx->is_ndp16) {
958	ctx->delayed_ndp16 = kzalloc(size: ctx->max_ndp_size, GFP_KERNEL);
959	if (!ctx->delayed_ndp16)
960	goto error2;
961	} else {
962	ctx->delayed_ndp32 = kzalloc(size: ctx->max_ndp_size, GFP_KERNEL);
963	if (!ctx->delayed_ndp32)
964	goto error2;
965	}
966	dev_info(&intf->dev, "NDP will be placed at end of frame for this device.");
967	}
968
969	/* override ethtool_ops */
970	dev->net->ethtool_ops = &cdc_ncm_ethtool_ops;
971
972	/* add our sysfs attrs */
973	dev->net->sysfs_groups[0] = &cdc_ncm_sysfs_attr_group;
974
975	/* must handle MTU changes */
976	dev->net->netdev_ops = &cdc_ncm_netdev_ops;
977	dev->net->max_mtu = cdc_ncm_max_dgram_size(dev) - cdc_ncm_eth_hlen(dev);
978
979	return 0;
980
981	error2:
982	usb_set_intfdata(intf: ctx->control, NULL);
983	usb_set_intfdata(intf: ctx->data, NULL);
984	if (ctx->data != ctx->control)
985	usb_driver_release_interface(driver, iface: ctx->data);
986	error:
987	cdc_ncm_free(ctx: (struct cdc_ncm_ctx *)dev->data[0]);
988	dev->data[0] = 0;
989	dev_info(&intf->dev, "bind() failure\n");
990	return -ENODEV;
991	}
992	EXPORT_SYMBOL_GPL(cdc_ncm_bind_common);
993
994	void cdc_ncm_unbind(struct usbnet *dev, struct usb_interface *intf)
995	{
996	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
997	struct usb_driver *driver = driver_of(intf);
998
999	if (ctx == NULL)
1000	return; /* no setup */
1001
1002	atomic_set(v: &ctx->stop, i: 1);
1003
1004	hrtimer_cancel(timer: &ctx->tx_timer);
1005
1006	tasklet_kill(t: &ctx->bh);
1007
1008	/* handle devices with combined control and data interface */
1009	if (ctx->control == ctx->data)
1010	ctx->data = NULL;
1011
1012	/* disconnect master --> disconnect slave */
1013	if (intf == ctx->control && ctx->data) {
1014	usb_set_intfdata(intf: ctx->data, NULL);
1015	usb_driver_release_interface(driver, iface: ctx->data);
1016	ctx->data = NULL;
1017
1018	} else if (intf == ctx->data && ctx->control) {
1019	usb_set_intfdata(intf: ctx->control, NULL);
1020	usb_driver_release_interface(driver, iface: ctx->control);
1021	ctx->control = NULL;
1022	}
1023
1024	usb_set_intfdata(intf, NULL);
1025	cdc_ncm_free(ctx);
1026	}
1027	EXPORT_SYMBOL_GPL(cdc_ncm_unbind);
1028
1029	/* Return the number of the MBIM control interface altsetting iff it
1030	* is preferred and available,
1031	*/
1032	u8 cdc_ncm_select_altsetting(struct usb_interface *intf)
1033	{
1034	struct usb_host_interface *alt;
1035
1036	/* The MBIM spec defines a NCM compatible default altsetting,
1037	* which we may have matched:
1038	*
1039	* "Functions that implement both NCM 1.0 and MBIM (an
1040	* “NCM/MBIM function”) according to this recommendation
1041	* shall provide two alternate settings for the
1042	* Communication Interface. Alternate setting 0, and the
1043	* associated class and endpoint descriptors, shall be
1044	* constructed according to the rules given for the
1045	* Communication Interface in section 5 of [USBNCM10].
1046	* Alternate setting 1, and the associated class and
1047	* endpoint descriptors, shall be constructed according to
1048	* the rules given in section 6 (USB Device Model) of this
1049	* specification."
1050	*/
1051	if (intf->num_altsetting < 2)
1052	return intf->cur_altsetting->desc.bAlternateSetting;
1053
1054	if (prefer_mbim) {
1055	alt = usb_altnum_to_altsetting(intf, CDC_NCM_COMM_ALTSETTING_MBIM);
1056	if (alt && cdc_ncm_comm_intf_is_mbim(alt))
1057	return CDC_NCM_COMM_ALTSETTING_MBIM;
1058	}
1059	return CDC_NCM_COMM_ALTSETTING_NCM;
1060	}
1061	EXPORT_SYMBOL_GPL(cdc_ncm_select_altsetting);
1062
1063	static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
1064	{
1065	/* MBIM backwards compatible function? */
1066	if (cdc_ncm_select_altsetting(intf) != CDC_NCM_COMM_ALTSETTING_NCM)
1067	return -ENODEV;
1068
1069	/* The NCM data altsetting is fixed, so we hard-coded it.
1070	* Additionally, generic NCM devices are assumed to accept arbitrarily
1071	* placed NDP.
1072	*/
1073	return cdc_ncm_bind_common(dev, intf, CDC_NCM_DATA_ALTSETTING_NCM, 0);
1074	}
1075
1076	static void cdc_ncm_align_tail(struct sk_buff *skb, size_t modulus, size_t remainder, size_t max)
1077	{
1078	size_t align = ALIGN(skb->len, modulus) - skb->len + remainder;
1079
1080	if (skb->len + align > max)
1081	align = max - skb->len;
1082	if (align && skb_tailroom(skb) >= align)
1083	skb_put_zero(skb, len: align);
1084	}
1085
1086	/* return a pointer to a valid struct usb_cdc_ncm_ndp16 of type sign, possibly
1087	* allocating a new one within skb
1088	*/
1089	static struct usb_cdc_ncm_ndp16 *cdc_ncm_ndp16(struct cdc_ncm_ctx *ctx, struct sk_buff *skb, __le32 sign, size_t reserve)
1090	{
1091	struct usb_cdc_ncm_ndp16 *ndp16 = NULL;
1092	struct usb_cdc_ncm_nth16 *nth16 = (void *)skb->data;
1093	size_t ndpoffset = le16_to_cpu(nth16->wNdpIndex);
1094
1095	/* If NDP should be moved to the end of the NCM package, we can't follow the
1096	* NTH16 header as we would normally do. NDP isn't written to the SKB yet, and
1097	* the wNdpIndex field in the header is actually not consistent with reality. It will be later.
1098	*/
1099	if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
1100	if (ctx->delayed_ndp16->dwSignature == sign)
1101	return ctx->delayed_ndp16;
1102
1103	/* We can only push a single NDP to the end. Return
1104	* NULL to send what we've already got and queue this
1105	* skb for later.
1106	*/
1107	else if (ctx->delayed_ndp16->dwSignature)
1108	return NULL;
1109	}
1110
1111	/* follow the chain of NDPs, looking for a match */
1112	while (ndpoffset) {
1113	ndp16 = (struct usb_cdc_ncm_ndp16 *)(skb->data + ndpoffset);
1114	if (ndp16->dwSignature == sign)
1115	return ndp16;
1116	ndpoffset = le16_to_cpu(ndp16->wNextNdpIndex);
1117	}
1118
1119	/* align new NDP */
1120	if (!(ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END))
1121	cdc_ncm_align_tail(skb, modulus: ctx->tx_ndp_modulus, remainder: 0, max: ctx->tx_curr_size);
1122
1123	/* verify that there is room for the NDP and the datagram (reserve) */
1124	if ((ctx->tx_curr_size - skb->len - reserve) < ctx->max_ndp_size)
1125	return NULL;
1126
1127	/* link to it */
1128	if (ndp16)
1129	ndp16->wNextNdpIndex = cpu_to_le16(skb->len);
1130	else
1131	nth16->wNdpIndex = cpu_to_le16(skb->len);
1132
1133	/* push a new empty NDP */
1134	if (!(ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END))
1135	ndp16 = skb_put_zero(skb, len: ctx->max_ndp_size);
1136	else
1137	ndp16 = ctx->delayed_ndp16;
1138
1139	ndp16->dwSignature = sign;
1140	ndp16->wLength = cpu_to_le16(sizeof(struct usb_cdc_ncm_ndp16) + sizeof(struct usb_cdc_ncm_dpe16));
1141	return ndp16;
1142	}
1143
1144	static struct usb_cdc_ncm_ndp32 *cdc_ncm_ndp32(struct cdc_ncm_ctx *ctx, struct sk_buff *skb, __le32 sign, size_t reserve)
1145	{
1146	struct usb_cdc_ncm_ndp32 *ndp32 = NULL;
1147	struct usb_cdc_ncm_nth32 *nth32 = (void *)skb->data;
1148	size_t ndpoffset = le32_to_cpu(nth32->dwNdpIndex);
1149
1150	/* If NDP should be moved to the end of the NCM package, we can't follow the
1151	* NTH32 header as we would normally do. NDP isn't written to the SKB yet, and
1152	* the wNdpIndex field in the header is actually not consistent with reality. It will be later.
1153	*/
1154	if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
1155	if (ctx->delayed_ndp32->dwSignature == sign)
1156	return ctx->delayed_ndp32;
1157
1158	/* We can only push a single NDP to the end. Return
1159	* NULL to send what we've already got and queue this
1160	* skb for later.
1161	*/
1162	else if (ctx->delayed_ndp32->dwSignature)
1163	return NULL;
1164	}
1165
1166	/* follow the chain of NDPs, looking for a match */
1167	while (ndpoffset) {
1168	ndp32 = (struct usb_cdc_ncm_ndp32 *)(skb->data + ndpoffset);
1169	if (ndp32->dwSignature == sign)
1170	return ndp32;
1171	ndpoffset = le32_to_cpu(ndp32->dwNextNdpIndex);
1172	}
1173
1174	/* align new NDP */
1175	if (!(ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END))
1176	cdc_ncm_align_tail(skb, modulus: ctx->tx_ndp_modulus, remainder: 0, max: ctx->tx_curr_size);
1177
1178	/* verify that there is room for the NDP and the datagram (reserve) */
1179	if ((ctx->tx_curr_size - skb->len - reserve) < ctx->max_ndp_size)
1180	return NULL;
1181
1182	/* link to it */
1183	if (ndp32)
1184	ndp32->dwNextNdpIndex = cpu_to_le32(skb->len);
1185	else
1186	nth32->dwNdpIndex = cpu_to_le32(skb->len);
1187
1188	/* push a new empty NDP */
1189	if (!(ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END))
1190	ndp32 = skb_put_zero(skb, len: ctx->max_ndp_size);
1191	else
1192	ndp32 = ctx->delayed_ndp32;
1193
1194	ndp32->dwSignature = sign;
1195	ndp32->wLength = cpu_to_le16(sizeof(struct usb_cdc_ncm_ndp32) + sizeof(struct usb_cdc_ncm_dpe32));
1196	return ndp32;
1197	}
1198
1199	struct sk_buff *
1200	cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
1201	{
1202	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
1203	union {
1204	struct usb_cdc_ncm_nth16 *nth16;
1205	struct usb_cdc_ncm_nth32 *nth32;
1206	} nth;
1207	union {
1208	struct usb_cdc_ncm_ndp16 *ndp16;
1209	struct usb_cdc_ncm_ndp32 *ndp32;
1210	} ndp;
1211	struct sk_buff *skb_out;
1212	u16 n = 0, index, ndplen;
1213	u8 ready2send = 0;
1214	u32 delayed_ndp_size;
1215	size_t padding_count;
1216
1217	/* When our NDP gets written in cdc_ncm_ndp(), then skb_out->len gets updated
1218	* accordingly. Otherwise, we should check here.
1219	*/
1220	if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END)
1221	delayed_ndp_size = ctx->max_ndp_size +
1222	max_t(u32,
1223	ctx->tx_ndp_modulus,
1224	ctx->tx_modulus + ctx->tx_remainder) - 1;
1225	else
1226	delayed_ndp_size = 0;
1227
1228	/* if there is a remaining skb, it gets priority */
1229	if (skb != NULL) {
1230	swap(skb, ctx->tx_rem_skb);
1231	swap(sign, ctx->tx_rem_sign);
1232	} else {
1233	ready2send = 1;
1234	}
1235
1236	/* check if we are resuming an OUT skb */
1237	skb_out = ctx->tx_curr_skb;
1238
1239	/* allocate a new OUT skb */
1240	if (!skb_out) {
1241	if (ctx->tx_low_mem_val == 0) {
1242	ctx->tx_curr_size = ctx->tx_max;
1243	skb_out = alloc_skb(size: ctx->tx_curr_size, GFP_ATOMIC);
1244	/* If the memory allocation fails we will wait longer
1245	* each time before attempting another full size
1246	* allocation again to not overload the system
1247	* further.
1248	*/
1249	if (skb_out == NULL) {
1250	/* If even the smallest allocation fails, abort. */
1251	if (ctx->tx_curr_size == USB_CDC_NCM_NTB_MIN_OUT_SIZE)
1252	goto alloc_failed;
1253	ctx->tx_low_mem_max_cnt = min(ctx->tx_low_mem_max_cnt + 1,
1254	(unsigned)CDC_NCM_LOW_MEM_MAX_CNT);
1255	ctx->tx_low_mem_val = ctx->tx_low_mem_max_cnt;
1256	}
1257	}
1258	if (skb_out == NULL) {
1259	/* See if a very small allocation is possible.
1260	* We will send this packet immediately and hope
1261	* that there is more memory available later.
1262	*/
1263	if (skb)
1264	ctx->tx_curr_size = max(skb->len,
1265	(u32)USB_CDC_NCM_NTB_MIN_OUT_SIZE);
1266	else
1267	ctx->tx_curr_size = USB_CDC_NCM_NTB_MIN_OUT_SIZE;
1268	skb_out = alloc_skb(size: ctx->tx_curr_size, GFP_ATOMIC);
1269
1270	/* No allocation possible so we will abort */
1271	if (!skb_out)
1272	goto alloc_failed;
1273	ctx->tx_low_mem_val--;
1274	}
1275	if (ctx->is_ndp16) {
1276	/* fill out the initial 16-bit NTB header */
1277	nth.nth16 = skb_put_zero(skb: skb_out, len: sizeof(struct usb_cdc_ncm_nth16));
1278	nth.nth16->dwSignature = cpu_to_le32(USB_CDC_NCM_NTH16_SIGN);
1279	nth.nth16->wHeaderLength = cpu_to_le16(sizeof(struct usb_cdc_ncm_nth16));
1280	nth.nth16->wSequence = cpu_to_le16(ctx->tx_seq++);
1281	} else {
1282	/* fill out the initial 32-bit NTB header */
1283	nth.nth32 = skb_put_zero(skb: skb_out, len: sizeof(struct usb_cdc_ncm_nth32));
1284	nth.nth32->dwSignature = cpu_to_le32(USB_CDC_NCM_NTH32_SIGN);
1285	nth.nth32->wHeaderLength = cpu_to_le16(sizeof(struct usb_cdc_ncm_nth32));
1286	nth.nth32->wSequence = cpu_to_le16(ctx->tx_seq++);
1287	}
1288
1289	/* count total number of frames in this NTB */
1290	ctx->tx_curr_frame_num = 0;
1291
1292	/* recent payload counter for this skb_out */
1293	ctx->tx_curr_frame_payload = 0;
1294	}
1295
1296	for (n = ctx->tx_curr_frame_num; n < ctx->tx_max_datagrams; n++) {
1297	/* send any remaining skb first */
1298	if (skb == NULL) {
1299	skb = ctx->tx_rem_skb;
1300	sign = ctx->tx_rem_sign;
1301	ctx->tx_rem_skb = NULL;
1302
1303	/* check for end of skb */
1304	if (skb == NULL)
1305	break;
1306	}
1307
1308	/* get the appropriate NDP for this skb */
1309	if (ctx->is_ndp16)
1310	ndp.ndp16 = cdc_ncm_ndp16(ctx, skb: skb_out, sign, reserve: skb->len + ctx->tx_modulus + ctx->tx_remainder);
1311	else
1312	ndp.ndp32 = cdc_ncm_ndp32(ctx, skb: skb_out, sign, reserve: skb->len + ctx->tx_modulus + ctx->tx_remainder);
1313
1314	/* align beginning of next frame */
1315	cdc_ncm_align_tail(skb: skb_out, modulus: ctx->tx_modulus, remainder: ctx->tx_remainder, max: ctx->tx_curr_size);
1316
1317	/* check if we had enough room left for both NDP and frame */
1318	if ((ctx->is_ndp16 && !ndp.ndp16) || (!ctx->is_ndp16 && !ndp.ndp32) ||
1319	skb_out->len + skb->len + delayed_ndp_size > ctx->tx_curr_size) {
1320	if (n == 0) {
1321	/* won't fit, MTU problem? */
1322	dev_kfree_skb_any(skb);
1323	skb = NULL;
1324	dev->net->stats.tx_dropped++;
1325	} else {
1326	/* no room for skb - store for later */
1327	if (ctx->tx_rem_skb != NULL) {
1328	dev_kfree_skb_any(skb: ctx->tx_rem_skb);
1329	dev->net->stats.tx_dropped++;
1330	}
1331	ctx->tx_rem_skb = skb;
1332	ctx->tx_rem_sign = sign;
1333	skb = NULL;
1334	ready2send = 1;
1335	ctx->tx_reason_ntb_full++; /* count reason for transmitting */
1336	}
1337	break;
1338	}
1339
1340	/* calculate frame number within this NDP */
1341	if (ctx->is_ndp16) {
1342	ndplen = le16_to_cpu(ndp.ndp16->wLength);
1343	index = (ndplen - sizeof(struct usb_cdc_ncm_ndp16)) / sizeof(struct usb_cdc_ncm_dpe16) - 1;
1344
1345	/* OK, add this skb */
1346	ndp.ndp16->dpe16[index].wDatagramLength = cpu_to_le16(skb->len);
1347	ndp.ndp16->dpe16[index].wDatagramIndex = cpu_to_le16(skb_out->len);
1348	ndp.ndp16->wLength = cpu_to_le16(ndplen + sizeof(struct usb_cdc_ncm_dpe16));
1349	} else {
1350	ndplen = le16_to_cpu(ndp.ndp32->wLength);
1351	index = (ndplen - sizeof(struct usb_cdc_ncm_ndp32)) / sizeof(struct usb_cdc_ncm_dpe32) - 1;
1352
1353	ndp.ndp32->dpe32[index].dwDatagramLength = cpu_to_le32(skb->len);
1354	ndp.ndp32->dpe32[index].dwDatagramIndex = cpu_to_le32(skb_out->len);
1355	ndp.ndp32->wLength = cpu_to_le16(ndplen + sizeof(struct usb_cdc_ncm_dpe32));
1356	}
1357	skb_put_data(skb: skb_out, data: skb->data, len: skb->len);
1358	ctx->tx_curr_frame_payload += skb->len; /* count real tx payload data */
1359	dev_kfree_skb_any(skb);
1360	skb = NULL;
1361
1362	/* send now if this NDP is full */
1363	if (index >= CDC_NCM_DPT_DATAGRAMS_MAX) {
1364	ready2send = 1;
1365	ctx->tx_reason_ndp_full++; /* count reason for transmitting */
1366	break;
1367	}
1368	}
1369
1370	/* free up any dangling skb */
1371	if (skb != NULL) {
1372	dev_kfree_skb_any(skb);
1373	skb = NULL;
1374	dev->net->stats.tx_dropped++;
1375	}
1376
1377	ctx->tx_curr_frame_num = n;
1378
1379	if (n == 0) {
1380	/* wait for more frames */
1381	/* push variables */
1382	ctx->tx_curr_skb = skb_out;
1383	goto exit_no_skb;
1384
1385	} else if ((n < ctx->tx_max_datagrams) && (ready2send == 0) && (ctx->timer_interval > 0)) {
1386	/* wait for more frames */
1387	/* push variables */
1388	ctx->tx_curr_skb = skb_out;
1389	/* set the pending count */
1390	if (n < CDC_NCM_RESTART_TIMER_DATAGRAM_CNT)
1391	ctx->tx_timer_pending = CDC_NCM_TIMER_PENDING_CNT;
1392	goto exit_no_skb;
1393
1394	} else {
1395	if (n == ctx->tx_max_datagrams)
1396	ctx->tx_reason_max_datagram++; /* count reason for transmitting */
1397	/* frame goes out */
1398	/* variables will be reset at next call */
1399	}
1400
1401	/* If requested, put NDP at end of frame. */
1402	if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
1403	if (ctx->is_ndp16) {
1404	nth.nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data;
1405	cdc_ncm_align_tail(skb: skb_out, modulus: ctx->tx_ndp_modulus, remainder: 0, max: ctx->tx_curr_size - ctx->max_ndp_size);
1406	nth.nth16->wNdpIndex = cpu_to_le16(skb_out->len);
1407	skb_put_data(skb: skb_out, data: ctx->delayed_ndp16, len: ctx->max_ndp_size);
1408
1409	/* Zero out delayed NDP - signature checking will naturally fail. */
1410	ndp.ndp16 = memset(ctx->delayed_ndp16, 0, ctx->max_ndp_size);
1411	} else {
1412	nth.nth32 = (struct usb_cdc_ncm_nth32 *)skb_out->data;
1413	cdc_ncm_align_tail(skb: skb_out, modulus: ctx->tx_ndp_modulus, remainder: 0, max: ctx->tx_curr_size - ctx->max_ndp_size);
1414	nth.nth32->dwNdpIndex = cpu_to_le32(skb_out->len);
1415	skb_put_data(skb: skb_out, data: ctx->delayed_ndp32, len: ctx->max_ndp_size);
1416
1417	ndp.ndp32 = memset(ctx->delayed_ndp32, 0, ctx->max_ndp_size);
1418	}
1419	}
1420
1421	/* If collected data size is less or equal ctx->min_tx_pkt
1422	* bytes, we send buffers as it is. If we get more data, it
1423	* would be more efficient for USB HS mobile device with DMA
1424	* engine to receive a full size NTB, than canceling DMA
1425	* transfer and receiving a short packet.
1426	*
1427	* This optimization support is pointless if we end up sending
1428	* a ZLP after full sized NTBs.
1429	*/
1430	if (!(dev->driver_info->flags & FLAG_SEND_ZLP) &&
1431	skb_out->len > ctx->min_tx_pkt) {
1432	padding_count = ctx->tx_curr_size - skb_out->len;
1433	if (!WARN_ON(padding_count > ctx->tx_curr_size))
1434	skb_put_zero(skb: skb_out, len: padding_count);
1435	} else if (skb_out->len < ctx->tx_curr_size &&
1436	(skb_out->len % dev->maxpacket) == 0) {
1437	skb_put_u8(skb: skb_out, val: 0); /* force short packet */
1438	}
1439
1440	/* set final frame length */
1441	if (ctx->is_ndp16) {
1442	nth.nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data;
1443	nth.nth16->wBlockLength = cpu_to_le16(skb_out->len);
1444	} else {
1445	nth.nth32 = (struct usb_cdc_ncm_nth32 *)skb_out->data;
1446	nth.nth32->dwBlockLength = cpu_to_le32(skb_out->len);
1447	}
1448
1449	/* return skb */
1450	ctx->tx_curr_skb = NULL;
1451
1452	/* keep private stats: framing overhead and number of NTBs */
1453	ctx->tx_overhead += skb_out->len - ctx->tx_curr_frame_payload;
1454	ctx->tx_ntbs++;
1455
1456	/* usbnet will count all the framing overhead by default.
1457	* Adjust the stats so that the tx_bytes counter show real
1458	* payload data instead.
1459	*/
1460	usbnet_set_skb_tx_stats(skb: skb_out, packets: n,
1461	bytes_delta: (long)ctx->tx_curr_frame_payload - skb_out->len);
1462
1463	return skb_out;
1464
1465	alloc_failed:
1466	if (skb) {
1467	dev_kfree_skb_any(skb);
1468	dev->net->stats.tx_dropped++;
1469	}
1470	exit_no_skb:
1471	/* Start timer, if there is a remaining non-empty skb */
1472	if (ctx->tx_curr_skb != NULL && n > 0)
1473	cdc_ncm_tx_timeout_start(ctx);
1474	return NULL;
1475	}
1476	EXPORT_SYMBOL_GPL(cdc_ncm_fill_tx_frame);
1477
1478	static void cdc_ncm_tx_timeout_start(struct cdc_ncm_ctx *ctx)
1479	{
1480	/* start timer, if not already started */
1481	if (!(hrtimer_active(timer: &ctx->tx_timer) || atomic_read(v: &ctx->stop)))
1482	hrtimer_start(timer: &ctx->tx_timer,
1483	tim: ctx->timer_interval,
1484	mode: HRTIMER_MODE_REL);
1485	}
1486
1487	static enum hrtimer_restart cdc_ncm_tx_timer_cb(struct hrtimer *timer)
1488	{
1489	struct cdc_ncm_ctx *ctx =
1490	container_of(timer, struct cdc_ncm_ctx, tx_timer);
1491
1492	if (!atomic_read(v: &ctx->stop))
1493	tasklet_schedule(t: &ctx->bh);
1494	return HRTIMER_NORESTART;
1495	}
1496
1497	static void cdc_ncm_txpath_bh(struct tasklet_struct *t)
1498	{
1499	struct cdc_ncm_ctx *ctx = from_tasklet(ctx, t, bh);
1500	struct usbnet *dev = ctx->dev;
1501
1502	spin_lock(lock: &ctx->mtx);
1503	if (ctx->tx_timer_pending != 0) {
1504	ctx->tx_timer_pending--;
1505	cdc_ncm_tx_timeout_start(ctx);
1506	spin_unlock(lock: &ctx->mtx);
1507	} else if (dev->net != NULL) {
1508	ctx->tx_reason_timeout++; /* count reason for transmitting */
1509	spin_unlock(lock: &ctx->mtx);
1510	netif_tx_lock_bh(dev: dev->net);
1511	usbnet_start_xmit(NULL, net: dev->net);
1512	netif_tx_unlock_bh(dev: dev->net);
1513	} else {
1514	spin_unlock(lock: &ctx->mtx);
1515	}
1516	}
1517
1518	struct sk_buff *
1519	cdc_ncm_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
1520	{
1521	struct sk_buff *skb_out;
1522	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
1523
1524	/*
1525	* The Ethernet API we are using does not support transmitting
1526	* multiple Ethernet frames in a single call. This driver will
1527	* accumulate multiple Ethernet frames and send out a larger
1528	* USB frame when the USB buffer is full or when a single jiffies
1529	* timeout happens.
1530	*/
1531	if (ctx == NULL)
1532	goto error;
1533
1534	spin_lock_bh(lock: &ctx->mtx);
1535
1536	if (ctx->is_ndp16)
1537	skb_out = cdc_ncm_fill_tx_frame(dev, skb, cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN));
1538	else
1539	skb_out = cdc_ncm_fill_tx_frame(dev, skb, cpu_to_le32(USB_CDC_NCM_NDP32_NOCRC_SIGN));
1540
1541	spin_unlock_bh(lock: &ctx->mtx);
1542	return skb_out;
1543
1544	error:
1545	if (skb != NULL)
1546	dev_kfree_skb_any(skb);
1547
1548	return NULL;
1549	}
1550	EXPORT_SYMBOL_GPL(cdc_ncm_tx_fixup);
1551
1552	/* verify NTB header and return offset of first NDP, or negative error */
1553	int cdc_ncm_rx_verify_nth16(struct cdc_ncm_ctx *ctx, struct sk_buff *skb_in)
1554	{
1555	struct usbnet *dev = netdev_priv(dev: skb_in->dev);
1556	struct usb_cdc_ncm_nth16 *nth16;
1557	int len;
1558	int ret = -EINVAL;
1559
1560	if (ctx == NULL)
1561	goto error;
1562
1563	if (skb_in->len < (sizeof(struct usb_cdc_ncm_nth16) +
1564	sizeof(struct usb_cdc_ncm_ndp16))) {
1565	netif_dbg(dev, rx_err, dev->net, "frame too short\n");
1566	goto error;
1567	}
1568
1569	nth16 = (struct usb_cdc_ncm_nth16 *)skb_in->data;
1570
1571	if (nth16->dwSignature != cpu_to_le32(USB_CDC_NCM_NTH16_SIGN)) {
1572	netif_dbg(dev, rx_err, dev->net,
1573	"invalid NTH16 signature <%#010x>\n",
1574	le32_to_cpu(nth16->dwSignature));
1575	goto error;
1576	}
1577
1578	len = le16_to_cpu(nth16->wBlockLength);
1579	if (len > ctx->rx_max) {
1580	netif_dbg(dev, rx_err, dev->net,
1581	"unsupported NTB block length %u/%u\n", len,
1582	ctx->rx_max);
1583	goto error;
1584	}
1585
1586	if ((ctx->rx_seq + 1) != le16_to_cpu(nth16->wSequence) &&
1587	(ctx->rx_seq || le16_to_cpu(nth16->wSequence)) &&
1588	!((ctx->rx_seq == 0xffff) && !le16_to_cpu(nth16->wSequence))) {
1589	netif_dbg(dev, rx_err, dev->net,
1590	"sequence number glitch prev=%d curr=%d\n",
1591	ctx->rx_seq, le16_to_cpu(nth16->wSequence));
1592	}
1593	ctx->rx_seq = le16_to_cpu(nth16->wSequence);
1594
1595	ret = le16_to_cpu(nth16->wNdpIndex);
1596	error:
1597	return ret;
1598	}
1599	EXPORT_SYMBOL_GPL(cdc_ncm_rx_verify_nth16);
1600
1601	int cdc_ncm_rx_verify_nth32(struct cdc_ncm_ctx *ctx, struct sk_buff *skb_in)
1602	{
1603	struct usbnet *dev = netdev_priv(dev: skb_in->dev);
1604	struct usb_cdc_ncm_nth32 *nth32;
1605	int len;
1606	int ret = -EINVAL;
1607
1608	if (ctx == NULL)
1609	goto error;
1610
1611	if (skb_in->len < (sizeof(struct usb_cdc_ncm_nth32) +
1612	sizeof(struct usb_cdc_ncm_ndp32))) {
1613	netif_dbg(dev, rx_err, dev->net, "frame too short\n");
1614	goto error;
1615	}
1616
1617	nth32 = (struct usb_cdc_ncm_nth32 *)skb_in->data;
1618
1619	if (nth32->dwSignature != cpu_to_le32(USB_CDC_NCM_NTH32_SIGN)) {
1620	netif_dbg(dev, rx_err, dev->net,
1621	"invalid NTH32 signature <%#010x>\n",
1622	le32_to_cpu(nth32->dwSignature));
1623	goto error;
1624	}
1625
1626	len = le32_to_cpu(nth32->dwBlockLength);
1627	if (len > ctx->rx_max) {
1628	netif_dbg(dev, rx_err, dev->net,
1629	"unsupported NTB block length %u/%u\n", len,
1630	ctx->rx_max);
1631	goto error;
1632	}
1633
1634	if ((ctx->rx_seq + 1) != le16_to_cpu(nth32->wSequence) &&
1635	(ctx->rx_seq || le16_to_cpu(nth32->wSequence)) &&
1636	!((ctx->rx_seq == 0xffff) && !le16_to_cpu(nth32->wSequence))) {
1637	netif_dbg(dev, rx_err, dev->net,
1638	"sequence number glitch prev=%d curr=%d\n",
1639	ctx->rx_seq, le16_to_cpu(nth32->wSequence));
1640	}
1641	ctx->rx_seq = le16_to_cpu(nth32->wSequence);
1642
1643	ret = le32_to_cpu(nth32->dwNdpIndex);
1644	error:
1645	return ret;
1646	}
1647	EXPORT_SYMBOL_GPL(cdc_ncm_rx_verify_nth32);
1648
1649	/* verify NDP header and return number of datagrams, or negative error */
1650	int cdc_ncm_rx_verify_ndp16(struct sk_buff *skb_in, int ndpoffset)
1651	{
1652	struct usbnet *dev = netdev_priv(dev: skb_in->dev);
1653	struct usb_cdc_ncm_ndp16 *ndp16;
1654	int ret = -EINVAL;
1655
1656	if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) > skb_in->len) {
1657	netif_dbg(dev, rx_err, dev->net, "invalid NDP offset <%u>\n",
1658	ndpoffset);
1659	goto error;
1660	}
1661	ndp16 = (struct usb_cdc_ncm_ndp16 *)(skb_in->data + ndpoffset);
1662
1663	if (le16_to_cpu(ndp16->wLength) < USB_CDC_NCM_NDP16_LENGTH_MIN) {
1664	netif_dbg(dev, rx_err, dev->net, "invalid DPT16 length <%u>\n",
1665	le16_to_cpu(ndp16->wLength));
1666	goto error;
1667	}
1668
1669	ret = ((le16_to_cpu(ndp16->wLength) -
1670	sizeof(struct usb_cdc_ncm_ndp16)) /
1671	sizeof(struct usb_cdc_ncm_dpe16));
1672	ret--; /* we process NDP entries except for the last one */
1673
1674	if ((sizeof(struct usb_cdc_ncm_ndp16) +
1675	ret * (sizeof(struct usb_cdc_ncm_dpe16))) > skb_in->len) {
1676	netif_dbg(dev, rx_err, dev->net, "Invalid nframes = %d\n", ret);
1677	ret = -EINVAL;
1678	}
1679
1680	error:
1681	return ret;
1682	}
1683	EXPORT_SYMBOL_GPL(cdc_ncm_rx_verify_ndp16);
1684
1685	/* verify NDP header and return number of datagrams, or negative error */
1686	int cdc_ncm_rx_verify_ndp32(struct sk_buff *skb_in, int ndpoffset)
1687	{
1688	struct usbnet *dev = netdev_priv(dev: skb_in->dev);
1689	struct usb_cdc_ncm_ndp32 *ndp32;
1690	int ret = -EINVAL;
1691
1692	if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp32)) > skb_in->len) {
1693	netif_dbg(dev, rx_err, dev->net, "invalid NDP offset <%u>\n",
1694	ndpoffset);
1695	goto error;
1696	}
1697	ndp32 = (struct usb_cdc_ncm_ndp32 *)(skb_in->data + ndpoffset);
1698
1699	if (le16_to_cpu(ndp32->wLength) < USB_CDC_NCM_NDP32_LENGTH_MIN) {
1700	netif_dbg(dev, rx_err, dev->net, "invalid DPT32 length <%u>\n",
1701	le16_to_cpu(ndp32->wLength));
1702	goto error;
1703	}
1704
1705	ret = ((le16_to_cpu(ndp32->wLength) -
1706	sizeof(struct usb_cdc_ncm_ndp32)) /
1707	sizeof(struct usb_cdc_ncm_dpe32));
1708	ret--; /* we process NDP entries except for the last one */
1709
1710	if ((sizeof(struct usb_cdc_ncm_ndp32) +
1711	ret * (sizeof(struct usb_cdc_ncm_dpe32))) > skb_in->len) {
1712	netif_dbg(dev, rx_err, dev->net, "Invalid nframes = %d\n", ret);
1713	ret = -EINVAL;
1714	}
1715
1716	error:
1717	return ret;
1718	}
1719	EXPORT_SYMBOL_GPL(cdc_ncm_rx_verify_ndp32);
1720
1721	int cdc_ncm_rx_fixup(struct usbnet *dev, struct sk_buff *skb_in)
1722	{
1723	struct sk_buff *skb;
1724	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
1725	unsigned int len;
1726	int nframes;
1727	int x;
1728	unsigned int offset;
1729	union {
1730	struct usb_cdc_ncm_ndp16 *ndp16;
1731	struct usb_cdc_ncm_ndp32 *ndp32;
1732	} ndp;
1733	union {
1734	struct usb_cdc_ncm_dpe16 *dpe16;
1735	struct usb_cdc_ncm_dpe32 *dpe32;
1736	} dpe;
1737
1738	int ndpoffset;
1739	int loopcount = 50; /* arbitrary max preventing infinite loop */
1740	u32 payload = 0;
1741
1742	if (ctx->is_ndp16)
1743	ndpoffset = cdc_ncm_rx_verify_nth16(ctx, skb_in);
1744	else
1745	ndpoffset = cdc_ncm_rx_verify_nth32(ctx, skb_in);
1746
1747	if (ndpoffset < 0)
1748	goto error;
1749
1750	next_ndp:
1751	if (ctx->is_ndp16) {
1752	nframes = cdc_ncm_rx_verify_ndp16(skb_in, ndpoffset);
1753	if (nframes < 0)
1754	goto error;
1755
1756	ndp.ndp16 = (struct usb_cdc_ncm_ndp16 *)(skb_in->data + ndpoffset);
1757
1758	if (ndp.ndp16->dwSignature != cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN)) {
1759	netif_dbg(dev, rx_err, dev->net,
1760	"invalid DPT16 signature <%#010x>\n",
1761	le32_to_cpu(ndp.ndp16->dwSignature));
1762	goto err_ndp;
1763	}
1764	dpe.dpe16 = ndp.ndp16->dpe16;
1765	} else {
1766	nframes = cdc_ncm_rx_verify_ndp32(skb_in, ndpoffset);
1767	if (nframes < 0)
1768	goto error;
1769
1770	ndp.ndp32 = (struct usb_cdc_ncm_ndp32 *)(skb_in->data + ndpoffset);
1771
1772	if (ndp.ndp32->dwSignature != cpu_to_le32(USB_CDC_NCM_NDP32_NOCRC_SIGN)) {
1773	netif_dbg(dev, rx_err, dev->net,
1774	"invalid DPT32 signature <%#010x>\n",
1775	le32_to_cpu(ndp.ndp32->dwSignature));
1776	goto err_ndp;
1777	}
1778	dpe.dpe32 = ndp.ndp32->dpe32;
1779	}
1780
1781	for (x = 0; x < nframes; x++) {
1782	if (ctx->is_ndp16) {
1783	offset = le16_to_cpu(dpe.dpe16->wDatagramIndex);
1784	len = le16_to_cpu(dpe.dpe16->wDatagramLength);
1785	} else {
1786	offset = le32_to_cpu(dpe.dpe32->dwDatagramIndex);
1787	len = le32_to_cpu(dpe.dpe32->dwDatagramLength);
1788	}
1789
1790	/*
1791	* CDC NCM ch. 3.7
1792	* All entries after first NULL entry are to be ignored
1793	*/
1794	if ((offset == 0) || (len == 0)) {
1795	if (!x)
1796	goto err_ndp; /* empty NTB */
1797	break;
1798	}
1799
1800	/* sanity checking - watch out for integer wrap*/
1801	if ((offset > skb_in->len) || (len > skb_in->len - offset) ||
1802	(len > ctx->rx_max) || (len < ETH_HLEN)) {
1803	netif_dbg(dev, rx_err, dev->net,
1804	"invalid frame detected (ignored) offset[%u]=%u, length=%u, skb=%p\n",
1805	x, offset, len, skb_in);
1806	if (!x)
1807	goto err_ndp;
1808	break;
1809
1810	} else {
1811	/* create a fresh copy to reduce truesize */
1812	skb = netdev_alloc_skb_ip_align(dev: dev->net, length: len);
1813	if (!skb)
1814	goto error;
1815	skb_put_data(skb, data: skb_in->data + offset, len);
1816	usbnet_skb_return(dev, skb);
1817	payload += len; /* count payload bytes in this NTB */
1818	}
1819
1820	if (ctx->is_ndp16)
1821	dpe.dpe16++;
1822	else
1823	dpe.dpe32++;
1824	}
1825	err_ndp:
1826	/* are there more NDPs to process? */
1827	if (ctx->is_ndp16)
1828	ndpoffset = le16_to_cpu(ndp.ndp16->wNextNdpIndex);
1829	else
1830	ndpoffset = le32_to_cpu(ndp.ndp32->dwNextNdpIndex);
1831
1832	if (ndpoffset && loopcount--)
1833	goto next_ndp;
1834
1835	/* update stats */
1836	ctx->rx_overhead += skb_in->len - payload;
1837	ctx->rx_ntbs++;
1838
1839	return 1;
1840	error:
1841	return 0;
1842	}
1843	EXPORT_SYMBOL_GPL(cdc_ncm_rx_fixup);
1844
1845	static void
1846	cdc_ncm_speed_change(struct usbnet *dev,
1847	struct usb_cdc_speed_change *data)
1848	{
1849	/* RTL8156 shipped before 2021 sends notification about every 32ms. */
1850	dev->rx_speed = le32_to_cpu(data->DLBitRRate);
1851	dev->tx_speed = le32_to_cpu(data->ULBitRate);
1852	}
1853
1854	static void cdc_ncm_status(struct usbnet *dev, struct urb *urb)
1855	{
1856	struct usb_cdc_notification *event;
1857
1858	if (urb->actual_length < sizeof(*event))
1859	return;
1860
1861	/* test for split data in 8-byte chunks */
1862	if (test_and_clear_bit(EVENT_STS_SPLIT, addr: &dev->flags)) {
1863	cdc_ncm_speed_change(dev,
1864	data: (struct usb_cdc_speed_change *)urb->transfer_buffer);
1865	return;
1866	}
1867
1868	event = urb->transfer_buffer;
1869
1870	switch (event->bNotificationType) {
1871	case USB_CDC_NOTIFY_NETWORK_CONNECTION:
1872	/*
1873	* According to the CDC NCM specification ch.7.1
1874	* USB_CDC_NOTIFY_NETWORK_CONNECTION notification shall be
1875	* sent by device after USB_CDC_NOTIFY_SPEED_CHANGE.
1876	*/
1877	/* RTL8156 shipped before 2021 sends notification about
1878	* every 32ms. Don't forward notification if state is same.
1879	*/
1880	if (netif_carrier_ok(dev: dev->net) != !!event->wValue)
1881	usbnet_link_change(dev, !!event->wValue, 0);
1882	break;
1883
1884	case USB_CDC_NOTIFY_SPEED_CHANGE:
1885	if (urb->actual_length < (sizeof(*event) +
1886	sizeof(struct usb_cdc_speed_change)))
1887	set_bit(EVENT_STS_SPLIT, addr: &dev->flags);
1888	else
1889	cdc_ncm_speed_change(dev,
1890	data: (struct usb_cdc_speed_change *)&event[1]);
1891	break;
1892
1893	default:
1894	dev_dbg(&dev->udev->dev,
1895	"NCM: unexpected notification 0x%02x!\n",
1896	event->bNotificationType);
1897	break;
1898	}
1899	}
1900
1901	static const struct driver_info cdc_ncm_info = {
1902	.description = "CDC NCM (NO ZLP)",
1903	.flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
1904	| FLAG_LINK_INTR | FLAG_ETHER,
1905	.bind = cdc_ncm_bind,
1906	.unbind = cdc_ncm_unbind,
1907	.manage_power = usbnet_manage_power,
1908	.status = cdc_ncm_status,
1909	.rx_fixup = cdc_ncm_rx_fixup,
1910	.tx_fixup = cdc_ncm_tx_fixup,
1911	.set_rx_mode = usbnet_cdc_update_filter,
1912	};
1913
1914	/* Same as cdc_ncm_info, but with FLAG_SEND_ZLP */
1915	static const struct driver_info cdc_ncm_zlp_info = {
1916	.description = "CDC NCM (SEND ZLP)",
1917	.flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
1918	| FLAG_LINK_INTR | FLAG_ETHER | FLAG_SEND_ZLP,
1919	.bind = cdc_ncm_bind,
1920	.unbind = cdc_ncm_unbind,
1921	.manage_power = usbnet_manage_power,
1922	.status = cdc_ncm_status,
1923	.rx_fixup = cdc_ncm_rx_fixup,
1924	.tx_fixup = cdc_ncm_tx_fixup,
1925	.set_rx_mode = usbnet_cdc_update_filter,
1926	};
1927
1928	/* Same as cdc_ncm_info, but with FLAG_WWAN */
1929	static const struct driver_info wwan_info = {
1930	.description = "Mobile Broadband Network Device",
1931	.flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
1932	| FLAG_LINK_INTR | FLAG_WWAN,
1933	.bind = cdc_ncm_bind,
1934	.unbind = cdc_ncm_unbind,
1935	.manage_power = usbnet_manage_power,
1936	.status = cdc_ncm_status,
1937	.rx_fixup = cdc_ncm_rx_fixup,
1938	.tx_fixup = cdc_ncm_tx_fixup,
1939	.set_rx_mode = usbnet_cdc_update_filter,
1940	};
1941
1942	/* Same as wwan_info, but with FLAG_NOARP */
1943	static const struct driver_info wwan_noarp_info = {
1944	.description = "Mobile Broadband Network Device (NO ARP)",
1945	.flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
1946	| FLAG_LINK_INTR | FLAG_WWAN | FLAG_NOARP,
1947	.bind = cdc_ncm_bind,
1948	.unbind = cdc_ncm_unbind,
1949	.manage_power = usbnet_manage_power,
1950	.status = cdc_ncm_status,
1951	.rx_fixup = cdc_ncm_rx_fixup,
1952	.tx_fixup = cdc_ncm_tx_fixup,
1953	.set_rx_mode = usbnet_cdc_update_filter,
1954	};
1955
1956	static const struct usb_device_id cdc_devs[] = {
1957	/* Ericsson MBM devices like F5521gw */
1958	{ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
1959	| USB_DEVICE_ID_MATCH_VENDOR,
1960	.idVendor = 0x0bdb,
1961	.bInterfaceClass = USB_CLASS_COMM,
1962	.bInterfaceSubClass = USB_CDC_SUBCLASS_NCM,
1963	.bInterfaceProtocol = USB_CDC_PROTO_NONE,
1964	.driver_info = (unsigned long) &wwan_info,
1965	},
1966
1967	/* Telit LE910 V2 */
1968	{ USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x0036,
1969	USB_CLASS_COMM,
1970	USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
1971	.driver_info = (unsigned long)&wwan_noarp_info,
1972	},
1973
1974	/* DW5812 LTE Verizon Mobile Broadband Card
1975	* Unlike DW5550 this device requires FLAG_NOARP
1976	*/
1977	{ USB_DEVICE_AND_INTERFACE_INFO(0x413c, 0x81bb,
1978	USB_CLASS_COMM,
1979	USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
1980	.driver_info = (unsigned long)&wwan_noarp_info,
1981	},
1982
1983	/* DW5813 LTE AT&T Mobile Broadband Card
1984	* Unlike DW5550 this device requires FLAG_NOARP
1985	*/
1986	{ USB_DEVICE_AND_INTERFACE_INFO(0x413c, 0x81bc,
1987	USB_CLASS_COMM,
1988	USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
1989	.driver_info = (unsigned long)&wwan_noarp_info,
1990	},
1991
1992	/* Dell branded MBM devices like DW5550 */
1993	{ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
1994	| USB_DEVICE_ID_MATCH_VENDOR,
1995	.idVendor = 0x413c,
1996	.bInterfaceClass = USB_CLASS_COMM,
1997	.bInterfaceSubClass = USB_CDC_SUBCLASS_NCM,
1998	.bInterfaceProtocol = USB_CDC_PROTO_NONE,
1999	.driver_info = (unsigned long) &wwan_info,
2000	},
2001
2002	/* Toshiba branded MBM devices */
2003	{ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
2004	| USB_DEVICE_ID_MATCH_VENDOR,
2005	.idVendor = 0x0930,
2006	.bInterfaceClass = USB_CLASS_COMM,
2007	.bInterfaceSubClass = USB_CDC_SUBCLASS_NCM,
2008	.bInterfaceProtocol = USB_CDC_PROTO_NONE,
2009	.driver_info = (unsigned long) &wwan_info,
2010	},
2011
2012	/* tag Huawei devices as wwan */
2013	{ USB_VENDOR_AND_INTERFACE_INFO(0x12d1,
2014	USB_CLASS_COMM,
2015	USB_CDC_SUBCLASS_NCM,
2016	USB_CDC_PROTO_NONE),
2017	.driver_info = (unsigned long)&wwan_info,
2018	},
2019
2020	/* Infineon(now Intel) HSPA Modem platform */
2021	{ USB_DEVICE_AND_INTERFACE_INFO(0x1519, 0x0443,
2022	USB_CLASS_COMM,
2023	USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
2024	.driver_info = (unsigned long)&wwan_noarp_info,
2025	},
2026
2027	/* u-blox TOBY-L4 */
2028	{ USB_DEVICE_AND_INTERFACE_INFO(0x1546, 0x1010,
2029	USB_CLASS_COMM,
2030	USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
2031	.driver_info = (unsigned long)&wwan_info,
2032	},
2033
2034	/* DisplayLink docking stations */
2035	{ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
2036	| USB_DEVICE_ID_MATCH_VENDOR,
2037	.idVendor = 0x17e9,
2038	.bInterfaceClass = USB_CLASS_COMM,
2039	.bInterfaceSubClass = USB_CDC_SUBCLASS_NCM,
2040	.bInterfaceProtocol = USB_CDC_PROTO_NONE,
2041	.driver_info = (unsigned long)&cdc_ncm_zlp_info,
2042	},
2043
2044	/* Generic CDC-NCM devices */
2045	{ USB_INTERFACE_INFO(USB_CLASS_COMM,
2046	USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
2047	.driver_info = (unsigned long)&cdc_ncm_info,
2048	},
2049	{
2050	},
2051	};
2052	MODULE_DEVICE_TABLE(usb, cdc_devs);
2053
2054	static struct usb_driver cdc_ncm_driver = {
2055	.name = "cdc_ncm",
2056	.id_table = cdc_devs,
2057	.probe = usbnet_probe,
2058	.disconnect = usbnet_disconnect,
2059	.suspend = usbnet_suspend,
2060	.resume = usbnet_resume,
2061	.reset_resume = usbnet_resume,
2062	.supports_autosuspend = 1,
2063	.disable_hub_initiated_lpm = 1,
2064	};
2065
2066	module_usb_driver(cdc_ncm_driver);
2067
2068	MODULE_AUTHOR("Hans Petter Selasky");
2069	MODULE_DESCRIPTION("USB CDC NCM host driver");
2070	MODULE_LICENSE("Dual BSD/GPL");
2071