1*4882a593Smuzhiyun // SPDX-License-Identifier: GPL-2.0+
2*4882a593Smuzhiyun /*
3*4882a593Smuzhiyun * Safe Encapsulated USB Serial Driver
4*4882a593Smuzhiyun *
5*4882a593Smuzhiyun * Copyright (C) 2010 Johan Hovold <jhovold@gmail.com>
6*4882a593Smuzhiyun * Copyright (C) 2001 Lineo
7*4882a593Smuzhiyun * Copyright (C) 2001 Hewlett-Packard
8*4882a593Smuzhiyun *
9*4882a593Smuzhiyun * By:
10*4882a593Smuzhiyun * Stuart Lynne <sl@lineo.com>, Tom Rushworth <tbr@lineo.com>
11*4882a593Smuzhiyun */
12*4882a593Smuzhiyun
13*4882a593Smuzhiyun /*
14*4882a593Smuzhiyun * The encapsultaion is designed to overcome difficulties with some USB
15*4882a593Smuzhiyun * hardware.
16*4882a593Smuzhiyun *
17*4882a593Smuzhiyun * While the USB protocol has a CRC over the data while in transit, i.e. while
18*4882a593Smuzhiyun * being carried over the bus, there is no end to end protection. If the
19*4882a593Smuzhiyun * hardware has any problems getting the data into or out of the USB transmit
20*4882a593Smuzhiyun * and receive FIFO's then data can be lost.
21*4882a593Smuzhiyun *
22*4882a593Smuzhiyun * This protocol adds a two byte trailer to each USB packet to specify the
23*4882a593Smuzhiyun * number of bytes of valid data and a 10 bit CRC that will allow the receiver
24*4882a593Smuzhiyun * to verify that the entire USB packet was received without error.
25*4882a593Smuzhiyun *
26*4882a593Smuzhiyun * Because in this case the sender and receiver are the class and function
27*4882a593Smuzhiyun * drivers there is now end to end protection.
28*4882a593Smuzhiyun *
29*4882a593Smuzhiyun * There is an additional option that can be used to force all transmitted
30*4882a593Smuzhiyun * packets to be padded to the maximum packet size. This provides a work
31*4882a593Smuzhiyun * around for some devices which have problems with small USB packets.
32*4882a593Smuzhiyun *
33*4882a593Smuzhiyun * Assuming a packetsize of N:
34*4882a593Smuzhiyun *
35*4882a593Smuzhiyun * 0..N-2 data and optional padding
36*4882a593Smuzhiyun *
37*4882a593Smuzhiyun * N-2 bits 7-2 - number of bytes of valid data
38*4882a593Smuzhiyun * bits 1-0 top two bits of 10 bit CRC
39*4882a593Smuzhiyun * N-1 bottom 8 bits of 10 bit CRC
40*4882a593Smuzhiyun *
41*4882a593Smuzhiyun *
42*4882a593Smuzhiyun * | Data Length | 10 bit CRC |
43*4882a593Smuzhiyun * + 7 . 6 . 5 . 4 . 3 . 2 . 1 . 0 | 7 . 6 . 5 . 4 . 3 . 2 . 1 . 0 +
44*4882a593Smuzhiyun *
45*4882a593Smuzhiyun * The 10 bit CRC is computed across the sent data, followed by the trailer
46*4882a593Smuzhiyun * with the length set and the CRC set to zero. The CRC is then OR'd into
47*4882a593Smuzhiyun * the trailer.
48*4882a593Smuzhiyun *
49*4882a593Smuzhiyun * When received a 10 bit CRC is computed over the entire frame including
50*4882a593Smuzhiyun * the trailer and should be equal to zero.
51*4882a593Smuzhiyun *
52*4882a593Smuzhiyun * Two module parameters are used to control the encapsulation, if both are
53*4882a593Smuzhiyun * turned of the module works as a simple serial device with NO
54*4882a593Smuzhiyun * encapsulation.
55*4882a593Smuzhiyun *
56*4882a593Smuzhiyun * See linux/drivers/usbd/serial_fd for a device function driver
57*4882a593Smuzhiyun * implementation of this.
58*4882a593Smuzhiyun *
59*4882a593Smuzhiyun */
60*4882a593Smuzhiyun
61*4882a593Smuzhiyun #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
62*4882a593Smuzhiyun
63*4882a593Smuzhiyun #include <linux/kernel.h>
64*4882a593Smuzhiyun #include <linux/errno.h>
65*4882a593Smuzhiyun #include <linux/gfp.h>
66*4882a593Smuzhiyun #include <linux/tty.h>
67*4882a593Smuzhiyun #include <linux/tty_driver.h>
68*4882a593Smuzhiyun #include <linux/tty_flip.h>
69*4882a593Smuzhiyun #include <linux/module.h>
70*4882a593Smuzhiyun #include <linux/spinlock.h>
71*4882a593Smuzhiyun #include <linux/uaccess.h>
72*4882a593Smuzhiyun #include <linux/usb.h>
73*4882a593Smuzhiyun #include <linux/usb/serial.h>
74*4882a593Smuzhiyun
75*4882a593Smuzhiyun static bool safe = true;
76*4882a593Smuzhiyun static bool padded = IS_ENABLED(CONFIG_USB_SERIAL_SAFE_PADDED);
77*4882a593Smuzhiyun
78*4882a593Smuzhiyun #define DRIVER_AUTHOR "sl@lineo.com, tbr@lineo.com, Johan Hovold <jhovold@gmail.com>"
79*4882a593Smuzhiyun #define DRIVER_DESC "USB Safe Encapsulated Serial"
80*4882a593Smuzhiyun
81*4882a593Smuzhiyun MODULE_AUTHOR(DRIVER_AUTHOR);
82*4882a593Smuzhiyun MODULE_DESCRIPTION(DRIVER_DESC);
83*4882a593Smuzhiyun MODULE_LICENSE("GPL");
84*4882a593Smuzhiyun
85*4882a593Smuzhiyun module_param(safe, bool, 0);
86*4882a593Smuzhiyun MODULE_PARM_DESC(safe, "Turn Safe Encapsulation On/Off");
87*4882a593Smuzhiyun
88*4882a593Smuzhiyun module_param(padded, bool, 0);
89*4882a593Smuzhiyun MODULE_PARM_DESC(padded, "Pad to full wMaxPacketSize On/Off");
90*4882a593Smuzhiyun
91*4882a593Smuzhiyun #define CDC_DEVICE_CLASS 0x02
92*4882a593Smuzhiyun
93*4882a593Smuzhiyun #define CDC_INTERFACE_CLASS 0x02
94*4882a593Smuzhiyun #define CDC_INTERFACE_SUBCLASS 0x06
95*4882a593Smuzhiyun
96*4882a593Smuzhiyun #define LINEO_INTERFACE_CLASS 0xff
97*4882a593Smuzhiyun
98*4882a593Smuzhiyun #define LINEO_INTERFACE_SUBCLASS_SAFENET 0x01
99*4882a593Smuzhiyun #define LINEO_SAFENET_CRC 0x01
100*4882a593Smuzhiyun #define LINEO_SAFENET_CRC_PADDED 0x02
101*4882a593Smuzhiyun
102*4882a593Smuzhiyun #define LINEO_INTERFACE_SUBCLASS_SAFESERIAL 0x02
103*4882a593Smuzhiyun #define LINEO_SAFESERIAL_CRC 0x01
104*4882a593Smuzhiyun #define LINEO_SAFESERIAL_CRC_PADDED 0x02
105*4882a593Smuzhiyun
106*4882a593Smuzhiyun
107*4882a593Smuzhiyun #define MY_USB_DEVICE(vend, prod, dc, ic, isc) \
108*4882a593Smuzhiyun .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
109*4882a593Smuzhiyun USB_DEVICE_ID_MATCH_DEV_CLASS | \
110*4882a593Smuzhiyun USB_DEVICE_ID_MATCH_INT_CLASS | \
111*4882a593Smuzhiyun USB_DEVICE_ID_MATCH_INT_SUBCLASS, \
112*4882a593Smuzhiyun .idVendor = (vend), \
113*4882a593Smuzhiyun .idProduct = (prod),\
114*4882a593Smuzhiyun .bDeviceClass = (dc),\
115*4882a593Smuzhiyun .bInterfaceClass = (ic), \
116*4882a593Smuzhiyun .bInterfaceSubClass = (isc),
117*4882a593Smuzhiyun
118*4882a593Smuzhiyun static const struct usb_device_id id_table[] = {
119*4882a593Smuzhiyun {MY_USB_DEVICE(0x49f, 0xffff, CDC_DEVICE_CLASS, LINEO_INTERFACE_CLASS, LINEO_INTERFACE_SUBCLASS_SAFESERIAL)}, /* Itsy */
120*4882a593Smuzhiyun {MY_USB_DEVICE(0x3f0, 0x2101, CDC_DEVICE_CLASS, LINEO_INTERFACE_CLASS, LINEO_INTERFACE_SUBCLASS_SAFESERIAL)}, /* Calypso */
121*4882a593Smuzhiyun {MY_USB_DEVICE(0x4dd, 0x8001, CDC_DEVICE_CLASS, LINEO_INTERFACE_CLASS, LINEO_INTERFACE_SUBCLASS_SAFESERIAL)}, /* Iris */
122*4882a593Smuzhiyun {MY_USB_DEVICE(0x4dd, 0x8002, CDC_DEVICE_CLASS, LINEO_INTERFACE_CLASS, LINEO_INTERFACE_SUBCLASS_SAFESERIAL)}, /* Collie */
123*4882a593Smuzhiyun {MY_USB_DEVICE(0x4dd, 0x8003, CDC_DEVICE_CLASS, LINEO_INTERFACE_CLASS, LINEO_INTERFACE_SUBCLASS_SAFESERIAL)}, /* Collie */
124*4882a593Smuzhiyun {MY_USB_DEVICE(0x4dd, 0x8004, CDC_DEVICE_CLASS, LINEO_INTERFACE_CLASS, LINEO_INTERFACE_SUBCLASS_SAFESERIAL)}, /* Collie */
125*4882a593Smuzhiyun {MY_USB_DEVICE(0x5f9, 0xffff, CDC_DEVICE_CLASS, LINEO_INTERFACE_CLASS, LINEO_INTERFACE_SUBCLASS_SAFESERIAL)}, /* Sharp tmp */
126*4882a593Smuzhiyun {} /* terminating entry */
127*4882a593Smuzhiyun };
128*4882a593Smuzhiyun
129*4882a593Smuzhiyun MODULE_DEVICE_TABLE(usb, id_table);
130*4882a593Smuzhiyun
131*4882a593Smuzhiyun static const __u16 crc10_table[256] = {
132*4882a593Smuzhiyun 0x000, 0x233, 0x255, 0x066, 0x299, 0x0aa, 0x0cc, 0x2ff,
133*4882a593Smuzhiyun 0x301, 0x132, 0x154, 0x367, 0x198, 0x3ab, 0x3cd, 0x1fe,
134*4882a593Smuzhiyun 0x031, 0x202, 0x264, 0x057, 0x2a8, 0x09b, 0x0fd, 0x2ce,
135*4882a593Smuzhiyun 0x330, 0x103, 0x165, 0x356, 0x1a9, 0x39a, 0x3fc, 0x1cf,
136*4882a593Smuzhiyun 0x062, 0x251, 0x237, 0x004, 0x2fb, 0x0c8, 0x0ae, 0x29d,
137*4882a593Smuzhiyun 0x363, 0x150, 0x136, 0x305, 0x1fa, 0x3c9, 0x3af, 0x19c,
138*4882a593Smuzhiyun 0x053, 0x260, 0x206, 0x035, 0x2ca, 0x0f9, 0x09f, 0x2ac,
139*4882a593Smuzhiyun 0x352, 0x161, 0x107, 0x334, 0x1cb, 0x3f8, 0x39e, 0x1ad,
140*4882a593Smuzhiyun 0x0c4, 0x2f7, 0x291, 0x0a2, 0x25d, 0x06e, 0x008, 0x23b,
141*4882a593Smuzhiyun 0x3c5, 0x1f6, 0x190, 0x3a3, 0x15c, 0x36f, 0x309, 0x13a,
142*4882a593Smuzhiyun 0x0f5, 0x2c6, 0x2a0, 0x093, 0x26c, 0x05f, 0x039, 0x20a,
143*4882a593Smuzhiyun 0x3f4, 0x1c7, 0x1a1, 0x392, 0x16d, 0x35e, 0x338, 0x10b,
144*4882a593Smuzhiyun 0x0a6, 0x295, 0x2f3, 0x0c0, 0x23f, 0x00c, 0x06a, 0x259,
145*4882a593Smuzhiyun 0x3a7, 0x194, 0x1f2, 0x3c1, 0x13e, 0x30d, 0x36b, 0x158,
146*4882a593Smuzhiyun 0x097, 0x2a4, 0x2c2, 0x0f1, 0x20e, 0x03d, 0x05b, 0x268,
147*4882a593Smuzhiyun 0x396, 0x1a5, 0x1c3, 0x3f0, 0x10f, 0x33c, 0x35a, 0x169,
148*4882a593Smuzhiyun 0x188, 0x3bb, 0x3dd, 0x1ee, 0x311, 0x122, 0x144, 0x377,
149*4882a593Smuzhiyun 0x289, 0x0ba, 0x0dc, 0x2ef, 0x010, 0x223, 0x245, 0x076,
150*4882a593Smuzhiyun 0x1b9, 0x38a, 0x3ec, 0x1df, 0x320, 0x113, 0x175, 0x346,
151*4882a593Smuzhiyun 0x2b8, 0x08b, 0x0ed, 0x2de, 0x021, 0x212, 0x274, 0x047,
152*4882a593Smuzhiyun 0x1ea, 0x3d9, 0x3bf, 0x18c, 0x373, 0x140, 0x126, 0x315,
153*4882a593Smuzhiyun 0x2eb, 0x0d8, 0x0be, 0x28d, 0x072, 0x241, 0x227, 0x014,
154*4882a593Smuzhiyun 0x1db, 0x3e8, 0x38e, 0x1bd, 0x342, 0x171, 0x117, 0x324,
155*4882a593Smuzhiyun 0x2da, 0x0e9, 0x08f, 0x2bc, 0x043, 0x270, 0x216, 0x025,
156*4882a593Smuzhiyun 0x14c, 0x37f, 0x319, 0x12a, 0x3d5, 0x1e6, 0x180, 0x3b3,
157*4882a593Smuzhiyun 0x24d, 0x07e, 0x018, 0x22b, 0x0d4, 0x2e7, 0x281, 0x0b2,
158*4882a593Smuzhiyun 0x17d, 0x34e, 0x328, 0x11b, 0x3e4, 0x1d7, 0x1b1, 0x382,
159*4882a593Smuzhiyun 0x27c, 0x04f, 0x029, 0x21a, 0x0e5, 0x2d6, 0x2b0, 0x083,
160*4882a593Smuzhiyun 0x12e, 0x31d, 0x37b, 0x148, 0x3b7, 0x184, 0x1e2, 0x3d1,
161*4882a593Smuzhiyun 0x22f, 0x01c, 0x07a, 0x249, 0x0b6, 0x285, 0x2e3, 0x0d0,
162*4882a593Smuzhiyun 0x11f, 0x32c, 0x34a, 0x179, 0x386, 0x1b5, 0x1d3, 0x3e0,
163*4882a593Smuzhiyun 0x21e, 0x02d, 0x04b, 0x278, 0x087, 0x2b4, 0x2d2, 0x0e1,
164*4882a593Smuzhiyun };
165*4882a593Smuzhiyun
166*4882a593Smuzhiyun #define CRC10_INITFCS 0x000 /* Initial FCS value */
167*4882a593Smuzhiyun #define CRC10_GOODFCS 0x000 /* Good final FCS value */
168*4882a593Smuzhiyun #define CRC10_FCS(fcs, c) ((((fcs) << 8) & 0x3ff) ^ crc10_table[((fcs) >> 2) & 0xff] ^ (c))
169*4882a593Smuzhiyun
170*4882a593Smuzhiyun /**
171*4882a593Smuzhiyun * fcs_compute10 - memcpy and calculate 10 bit CRC across buffer
172*4882a593Smuzhiyun * @sp: pointer to buffer
173*4882a593Smuzhiyun * @len: number of bytes
174*4882a593Smuzhiyun * @fcs: starting FCS
175*4882a593Smuzhiyun *
176*4882a593Smuzhiyun * Perform a memcpy and calculate fcs using ppp 10bit CRC algorithm. Return
177*4882a593Smuzhiyun * new 10 bit FCS.
178*4882a593Smuzhiyun */
fcs_compute10(unsigned char * sp,int len,__u16 fcs)179*4882a593Smuzhiyun static inline __u16 fcs_compute10(unsigned char *sp, int len, __u16 fcs)
180*4882a593Smuzhiyun {
181*4882a593Smuzhiyun for (; len-- > 0; fcs = CRC10_FCS(fcs, *sp++));
182*4882a593Smuzhiyun return fcs;
183*4882a593Smuzhiyun }
184*4882a593Smuzhiyun
safe_process_read_urb(struct urb * urb)185*4882a593Smuzhiyun static void safe_process_read_urb(struct urb *urb)
186*4882a593Smuzhiyun {
187*4882a593Smuzhiyun struct usb_serial_port *port = urb->context;
188*4882a593Smuzhiyun unsigned char *data = urb->transfer_buffer;
189*4882a593Smuzhiyun unsigned char length = urb->actual_length;
190*4882a593Smuzhiyun int actual_length;
191*4882a593Smuzhiyun __u16 fcs;
192*4882a593Smuzhiyun
193*4882a593Smuzhiyun if (!length)
194*4882a593Smuzhiyun return;
195*4882a593Smuzhiyun
196*4882a593Smuzhiyun if (!safe)
197*4882a593Smuzhiyun goto out;
198*4882a593Smuzhiyun
199*4882a593Smuzhiyun if (length < 2) {
200*4882a593Smuzhiyun dev_err(&port->dev, "malformed packet\n");
201*4882a593Smuzhiyun return;
202*4882a593Smuzhiyun }
203*4882a593Smuzhiyun
204*4882a593Smuzhiyun fcs = fcs_compute10(data, length, CRC10_INITFCS);
205*4882a593Smuzhiyun if (fcs) {
206*4882a593Smuzhiyun dev_err(&port->dev, "%s - bad CRC %x\n", __func__, fcs);
207*4882a593Smuzhiyun return;
208*4882a593Smuzhiyun }
209*4882a593Smuzhiyun
210*4882a593Smuzhiyun actual_length = data[length - 2] >> 2;
211*4882a593Smuzhiyun if (actual_length > (length - 2)) {
212*4882a593Smuzhiyun dev_err(&port->dev, "%s - inconsistent lengths %d:%d\n",
213*4882a593Smuzhiyun __func__, actual_length, length);
214*4882a593Smuzhiyun return;
215*4882a593Smuzhiyun }
216*4882a593Smuzhiyun dev_info(&urb->dev->dev, "%s - actual: %d\n", __func__, actual_length);
217*4882a593Smuzhiyun length = actual_length;
218*4882a593Smuzhiyun out:
219*4882a593Smuzhiyun tty_insert_flip_string(&port->port, data, length);
220*4882a593Smuzhiyun tty_flip_buffer_push(&port->port);
221*4882a593Smuzhiyun }
222*4882a593Smuzhiyun
safe_prepare_write_buffer(struct usb_serial_port * port,void * dest,size_t size)223*4882a593Smuzhiyun static int safe_prepare_write_buffer(struct usb_serial_port *port,
224*4882a593Smuzhiyun void *dest, size_t size)
225*4882a593Smuzhiyun {
226*4882a593Smuzhiyun unsigned char *buf = dest;
227*4882a593Smuzhiyun int count;
228*4882a593Smuzhiyun int trailer_len;
229*4882a593Smuzhiyun int pkt_len;
230*4882a593Smuzhiyun __u16 fcs;
231*4882a593Smuzhiyun
232*4882a593Smuzhiyun trailer_len = safe ? 2 : 0;
233*4882a593Smuzhiyun
234*4882a593Smuzhiyun count = kfifo_out_locked(&port->write_fifo, buf, size - trailer_len,
235*4882a593Smuzhiyun &port->lock);
236*4882a593Smuzhiyun if (!safe)
237*4882a593Smuzhiyun return count;
238*4882a593Smuzhiyun
239*4882a593Smuzhiyun /* pad if necessary */
240*4882a593Smuzhiyun if (padded) {
241*4882a593Smuzhiyun pkt_len = size;
242*4882a593Smuzhiyun memset(buf + count, '0', pkt_len - count - trailer_len);
243*4882a593Smuzhiyun } else {
244*4882a593Smuzhiyun pkt_len = count + trailer_len;
245*4882a593Smuzhiyun }
246*4882a593Smuzhiyun
247*4882a593Smuzhiyun /* set count */
248*4882a593Smuzhiyun buf[pkt_len - 2] = count << 2;
249*4882a593Smuzhiyun buf[pkt_len - 1] = 0;
250*4882a593Smuzhiyun
251*4882a593Smuzhiyun /* compute fcs and insert into trailer */
252*4882a593Smuzhiyun fcs = fcs_compute10(buf, pkt_len, CRC10_INITFCS);
253*4882a593Smuzhiyun buf[pkt_len - 2] |= fcs >> 8;
254*4882a593Smuzhiyun buf[pkt_len - 1] |= fcs & 0xff;
255*4882a593Smuzhiyun
256*4882a593Smuzhiyun return pkt_len;
257*4882a593Smuzhiyun }
258*4882a593Smuzhiyun
safe_startup(struct usb_serial * serial)259*4882a593Smuzhiyun static int safe_startup(struct usb_serial *serial)
260*4882a593Smuzhiyun {
261*4882a593Smuzhiyun struct usb_interface_descriptor *desc;
262*4882a593Smuzhiyun
263*4882a593Smuzhiyun if (serial->dev->descriptor.bDeviceClass != CDC_DEVICE_CLASS)
264*4882a593Smuzhiyun return -ENODEV;
265*4882a593Smuzhiyun
266*4882a593Smuzhiyun desc = &serial->interface->cur_altsetting->desc;
267*4882a593Smuzhiyun
268*4882a593Smuzhiyun if (desc->bInterfaceClass != LINEO_INTERFACE_CLASS)
269*4882a593Smuzhiyun return -ENODEV;
270*4882a593Smuzhiyun if (desc->bInterfaceSubClass != LINEO_INTERFACE_SUBCLASS_SAFESERIAL)
271*4882a593Smuzhiyun return -ENODEV;
272*4882a593Smuzhiyun
273*4882a593Smuzhiyun switch (desc->bInterfaceProtocol) {
274*4882a593Smuzhiyun case LINEO_SAFESERIAL_CRC:
275*4882a593Smuzhiyun break;
276*4882a593Smuzhiyun case LINEO_SAFESERIAL_CRC_PADDED:
277*4882a593Smuzhiyun padded = true;
278*4882a593Smuzhiyun break;
279*4882a593Smuzhiyun default:
280*4882a593Smuzhiyun return -EINVAL;
281*4882a593Smuzhiyun }
282*4882a593Smuzhiyun return 0;
283*4882a593Smuzhiyun }
284*4882a593Smuzhiyun
285*4882a593Smuzhiyun static struct usb_serial_driver safe_device = {
286*4882a593Smuzhiyun .driver = {
287*4882a593Smuzhiyun .owner = THIS_MODULE,
288*4882a593Smuzhiyun .name = "safe_serial",
289*4882a593Smuzhiyun },
290*4882a593Smuzhiyun .id_table = id_table,
291*4882a593Smuzhiyun .num_ports = 1,
292*4882a593Smuzhiyun .process_read_urb = safe_process_read_urb,
293*4882a593Smuzhiyun .prepare_write_buffer = safe_prepare_write_buffer,
294*4882a593Smuzhiyun .attach = safe_startup,
295*4882a593Smuzhiyun };
296*4882a593Smuzhiyun
297*4882a593Smuzhiyun static struct usb_serial_driver * const serial_drivers[] = {
298*4882a593Smuzhiyun &safe_device, NULL
299*4882a593Smuzhiyun };
300*4882a593Smuzhiyun
301*4882a593Smuzhiyun module_usb_serial_driver(serial_drivers, id_table);
302