USB: gadget: Add EEM gadget driver

This patch adds a CDC EEM ethernet gadget driver.  CDC EEM is a newer
USB ethernet specification that uses a simpler interface than the older
CDC ECM.  This makes CDC EEM usable by a wider set of USB hardware.
By default the ethernet gadget will still use CDC ECM/Subset, but kernel
configuration and/or a module parameter will allow alternative use of
the CDC EEM protocol.

Changes since last version:
	- Brought in missing RNDIS changes that caused compile error
	- Modified 'sentinel CRC' checking to match EEM host driver

Signed-off-by: Brian Niebuhr <bniebuhr@efjohnson.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

8 files changed, 699 insertions, 48 deletions

diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 3537d915d275..4d8ab470f087 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -628,8 +628,8 @@ config USB_ETH
         tristate "Ethernet Gadget (with CDC Ethernet support)"
         depends on NET
         help
-          This driver implements Ethernet style communication, in either
-          of two ways:
+          This driver implements Ethernet style communication, in one of
+          several ways:
           
            - The "Communication Device Class" (CDC) Ethernet Control Model.
              That protocol is often avoided with pure Ethernet adapters, in
@@ -639,7 +639,11 @@ config USB_ETH
            - On hardware can't implement that protocol, a simple CDC subset
              is used, placing fewer demands on USB.
 
-          RNDIS support is a third option, more demanding than that subset.
+           - CDC Ethernet Emulation Model (EEM) is a newer standard that has
+             a simpler interface that can be used by more USB hardware.
+
+          RNDIS support is an additional option, more demanding than than
+          subset.
 
           Within the USB device, this gadget driver exposes a network device
           "usbX", where X depends on what other networking devices you have.
@@ -672,6 +676,22 @@ config USB_ETH_RNDIS
            XP, you'll need to download drivers from Microsoft's website; a URL
            is given in comments found in that info file.
 
+config USB_ETH_EEM
+       bool "Ethernet Emulation Model (EEM) support"
+       depends on USB_ETH
+       default n
+       help
+         CDC EEM is a newer USB standard that is somewhat simpler than CDC ECM
+         and therefore can be supported by more hardware.  Technically ECM and
+         EEM are designed for different applications.  The ECM model extends
+         the network interface to the target (e.g. a USB cable modem), and the
+         EEM model is for mobile devices to communicate with hosts using
+         ethernet over USB.  For Linux gadgets, however, the interface with
+         the host is the same (a usbX device), so the differences are minimal.
+
+         If you say "y" here, the Ethernet gadget driver will use the EEM
+         protocol rather than ECM.  If unsure, say "n".
+
 config USB_GADGETFS
         tristate "Gadget Filesystem (EXPERIMENTAL)"
         depends on EXPERIMENTAL
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index bd102f5052ba..f37de283d0ab 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -61,6 +61,11 @@
  * simpler, Microsoft pushes their own approach: RNDIS.  The published
  * RNDIS specs are ambiguous and appear to be incomplete, and are also
  * needlessly complex.  They borrow more from CDC ACM than CDC ECM.
+ *
+ * While CDC ECM, CDC Subset, and RNDIS are designed to extend the ethernet
+ * interface to the target, CDC EEM was designed to use ethernet over the USB
+ * link between the host and target.  CDC EEM is implemented as an alternative
+ * to those other protocols when that communication model is more appropriate
  */
 
 #define DRIVER_DESC             "Ethernet Gadget"
@@ -114,6 +119,7 @@ static inline bool has_rndis(void)
 #include "f_rndis.c"
 #include "rndis.c"
 #endif
+#include "f_eem.c"
 #include "u_ether.c"
 
 /*-------------------------------------------------------------------------*/
@@ -150,6 +156,10 @@ static inline bool has_rndis(void)
 #define RNDIS_VENDOR_NUM        0x0525  /* NetChip */
 #define RNDIS_PRODUCT_NUM       0xa4a2  /* Ethernet/RNDIS Gadget */
 
+/* For EEM gadgets */
+#define EEM_VENDOR_NUM  0x0525  /* INVALID - NEEDS TO BE ALLOCATED */
+#define EEM_PRODUCT_NUM 0xa4a1  /* INVALID - NEEDS TO BE ALLOCATED */
+
 /*-------------------------------------------------------------------------*/
 
 static struct usb_device_descriptor device_desc = {
@@ -246,8 +256,16 @@ static struct usb_configuration rndis_config_driver = {
 
 /*-------------------------------------------------------------------------*/
 
+#ifdef CONFIG_USB_ETH_EEM
+static int use_eem = 1;
+#else
+static int use_eem;
+#endif
+module_param(use_eem, bool, 0);
+MODULE_PARM_DESC(use_eem, "use CDC EEM mode");
+
 /*
- * We _always_ have an ECM or CDC Subset configuration.
+ * We _always_ have an ECM, CDC Subset, or EEM configuration.
  */
 static int __init eth_do_config(struct usb_configuration *c)
 {
@@ -258,7 +276,9 @@ static int __init eth_do_config(struct usb_configuration *c)
                 c->bmAttributes |= USB_CONFIG_ATT_WAKEUP;
         }
 
-        if (can_support_ecm(c->cdev->gadget))
+        if (use_eem)
+                return eem_bind_config(c);
+        else if (can_support_ecm(c->cdev->gadget))
                 return ecm_bind_config(c, hostaddr);
         else
                 return geth_bind_config(c, hostaddr);
@@ -286,7 +306,12 @@ static int __init eth_bind(struct usb_composite_dev *cdev)
                 return status;
 
         /* set up main config label and device descriptor */
-        if (can_support_ecm(cdev->gadget)) {
+        if (use_eem) {
+                /* EEM */
+                eth_config_driver.label = "CDC Ethernet (EEM)";
+                device_desc.idVendor = cpu_to_le16(EEM_VENDOR_NUM);
+                device_desc.idProduct = cpu_to_le16(EEM_PRODUCT_NUM);
+        } else if (can_support_ecm(cdev->gadget)) {
                 /* ECM */
                 eth_config_driver.label = "CDC Ethernet (ECM)";
         } else {
diff --git a/drivers/usb/gadget/f_eem.c b/drivers/usb/gadget/f_eem.c
new file mode 100644
index 000000000000..0a577d5694fd
--- /dev/null
+++ b/drivers/usb/gadget/f_eem.c
@@ -0,0 +1,562 @@
+/*
+ * f_eem.c -- USB CDC Ethernet (EEM) link function driver
+ *
+ * Copyright (C) 2003-2005,2008 David Brownell
+ * Copyright (C) 2008 Nokia Corporation
+ * Copyright (C) 2009 EF Johnson Technologies
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/etherdevice.h>
+#include <linux/crc32.h>
+
+#include "u_ether.h"
+
+#define EEM_HLEN 2
+
+/*
+ * This function is a "CDC Ethernet Emulation Model" (CDC EEM)
+ * Ethernet link.
+ */
+
+struct eem_ep_descs {
+        struct usb_endpoint_descriptor  *in;
+        struct usb_endpoint_descriptor  *out;
+};
+
+struct f_eem {
+        struct gether                   port;
+        u8                              ctrl_id;
+
+        struct eem_ep_descs             fs;
+        struct eem_ep_descs             hs;
+};
+
+static inline struct f_eem *func_to_eem(struct usb_function *f)
+{
+        return container_of(f, struct f_eem, port.func);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* interface descriptor: */
+
+static struct usb_interface_descriptor eem_intf __initdata = {
+        .bLength =              sizeof eem_intf,
+        .bDescriptorType =      USB_DT_INTERFACE,
+
+        /* .bInterfaceNumber = DYNAMIC */
+        .bNumEndpoints =        2,
+        .bInterfaceClass =      USB_CLASS_COMM,
+        .bInterfaceSubClass =   USB_CDC_SUBCLASS_EEM,
+        .bInterfaceProtocol =   USB_CDC_PROTO_EEM,
+        /* .iInterface = DYNAMIC */
+};
+
+/* full speed support: */
+
+static struct usb_endpoint_descriptor eem_fs_in_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor eem_fs_out_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_descriptor_header *eem_fs_function[] __initdata = {
+        /* CDC EEM control descriptors */
+        (struct usb_descriptor_header *) &eem_intf,
+        (struct usb_descriptor_header *) &eem_fs_in_desc,
+        (struct usb_descriptor_header *) &eem_fs_out_desc,
+        NULL,
+};
+
+/* high speed support: */
+
+static struct usb_endpoint_descriptor eem_hs_in_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor eem_hs_out_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       cpu_to_le16(512),
+};
+
+static struct usb_descriptor_header *eem_hs_function[] __initdata = {
+        /* CDC EEM control descriptors */
+        (struct usb_descriptor_header *) &eem_intf,
+        (struct usb_descriptor_header *) &eem_hs_in_desc,
+        (struct usb_descriptor_header *) &eem_hs_out_desc,
+        NULL,
+};
+
+/* string descriptors: */
+
+static struct usb_string eem_string_defs[] = {
+        [0].s = "CDC Ethernet Emulation Model (EEM)",
+        {  } /* end of list */
+};
+
+static struct usb_gadget_strings eem_string_table = {
+        .language =             0x0409, /* en-us */
+        .strings =              eem_string_defs,
+};
+
+static struct usb_gadget_strings *eem_strings[] = {
+        &eem_string_table,
+        NULL,
+};
+
+/*-------------------------------------------------------------------------*/
+
+static int eem_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
+{
+        struct usb_composite_dev *cdev = f->config->cdev;
+        int                     value = -EOPNOTSUPP;
+        u16                     w_index = le16_to_cpu(ctrl->wIndex);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+        u16                     w_length = le16_to_cpu(ctrl->wLength);
+
+        DBG(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n",
+                ctrl->bRequestType, ctrl->bRequest,
+                w_value, w_index, w_length);
+
+        /* device either stalls (value < 0) or reports success */
+        return value;
+}
+
+
+static int eem_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+{
+        struct f_eem            *eem = func_to_eem(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        struct net_device       *net;
+
+        /* we know alt == 0, so this is an activation or a reset */
+        if (alt != 0)
+                goto fail;
+
+        if (intf == eem->ctrl_id) {
+
+                if (eem->port.in_ep->driver_data) {
+                        DBG(cdev, "reset eem\n");
+                        gether_disconnect(&eem->port);
+                }
+
+                if (!eem->port.in) {
+                        DBG(cdev, "init eem\n");
+                        eem->port.in = ep_choose(cdev->gadget,
+                                        eem->hs.in, eem->fs.in);
+                        eem->port.out = ep_choose(cdev->gadget,
+                                        eem->hs.out, eem->fs.out);
+                }
+
+                /* zlps should not occur because zero-length EEM packets
+                 * will be inserted in those cases where they would occur
+                 */
+                eem->port.is_zlp_ok = 1;
+                eem->port.cdc_filter = DEFAULT_FILTER;
+                DBG(cdev, "activate eem\n");
+                net = gether_connect(&eem->port);
+                if (IS_ERR(net))
+                        return PTR_ERR(net);
+        } else
+                goto fail;
+
+        return 0;
+fail:
+        return -EINVAL;
+}
+
+static void eem_disable(struct usb_function *f)
+{
+        struct f_eem            *eem = func_to_eem(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        DBG(cdev, "eem deactivated\n");
+
+        if (eem->port.in_ep->driver_data)
+                gether_disconnect(&eem->port);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* EEM function driver setup/binding */
+
+static int __init
+eem_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct f_eem            *eem = func_to_eem(f);
+        int                     status;
+        struct usb_ep           *ep;
+
+        /* allocate instance-specific interface IDs */
+        status = usb_interface_id(c, f);
+        if (status < 0)
+                goto fail;
+        eem->ctrl_id = status;
+        eem_intf.bInterfaceNumber = status;
+
+        status = -ENODEV;
+
+        /* allocate instance-specific endpoints */
+        ep = usb_ep_autoconfig(cdev->gadget, &eem_fs_in_desc);
+        if (!ep)
+                goto fail;
+        eem->port.in_ep = ep;
+        ep->driver_data = cdev; /* claim */
+
+        ep = usb_ep_autoconfig(cdev->gadget, &eem_fs_out_desc);
+        if (!ep)
+                goto fail;
+        eem->port.out_ep = ep;
+        ep->driver_data = cdev; /* claim */
+
+        status = -ENOMEM;
+
+        /* copy descriptors, and track endpoint copies */
+        f->descriptors = usb_copy_descriptors(eem_fs_function);
+        if (!f->descriptors)
+                goto fail;
+
+        eem->fs.in = usb_find_endpoint(eem_fs_function,
+                        f->descriptors, &eem_fs_in_desc);
+        eem->fs.out = usb_find_endpoint(eem_fs_function,
+                        f->descriptors, &eem_fs_out_desc);
+
+        /* support all relevant hardware speeds... we expect that when
+         * hardware is dual speed, all bulk-capable endpoints work at
+         * both speeds
+         */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                eem_hs_in_desc.bEndpointAddress =
+                                eem_fs_in_desc.bEndpointAddress;
+                eem_hs_out_desc.bEndpointAddress =
+                                eem_fs_out_desc.bEndpointAddress;
+
+                /* copy descriptors, and track endpoint copies */
+                f->hs_descriptors = usb_copy_descriptors(eem_hs_function);
+                if (!f->hs_descriptors)
+                        goto fail;
+
+                eem->hs.in = usb_find_endpoint(eem_hs_function,
+                                f->hs_descriptors, &eem_hs_in_desc);
+                eem->hs.out = usb_find_endpoint(eem_hs_function,
+                                f->hs_descriptors, &eem_hs_out_desc);
+        }
+
+        DBG(cdev, "CDC Ethernet (EEM): %s speed IN/%s OUT/%s\n",
+                        gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
+                        eem->port.in_ep->name, eem->port.out_ep->name);
+        return 0;
+
+fail:
+        if (f->descriptors)
+                usb_free_descriptors(f->descriptors);
+
+        /* we might as well release our claims on endpoints */
+        if (eem->port.out)
+                eem->port.out_ep->driver_data = NULL;
+        if (eem->port.in)
+                eem->port.in_ep->driver_data = NULL;
+
+        ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
+
+        return status;
+}
+
+static void
+eem_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct f_eem    *eem = func_to_eem(f);
+
+        DBG(c->cdev, "eem unbind\n");
+
+        if (gadget_is_dualspeed(c->cdev->gadget))
+                usb_free_descriptors(f->hs_descriptors);
+        usb_free_descriptors(f->descriptors);
+        kfree(eem);
+}
+
+static void eem_cmd_complete(struct usb_ep *ep, struct usb_request *req)
+{
+}
+
+/*
+ * Add the EEM header and ethernet checksum.
+ * We currently do not attempt to put multiple ethernet frames
+ * into a single USB transfer
+ */
+static struct sk_buff *eem_wrap(struct gether *port, struct sk_buff *skb)
+{
+        struct sk_buff  *skb2 = NULL;
+        struct usb_ep   *in = port->in_ep;
+        int             padlen = 0;
+        u16             len = skb->len;
+
+        if (!skb_cloned(skb)) {
+                int headroom = skb_headroom(skb);
+                int tailroom = skb_tailroom(skb);
+
+                /* When (len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) is 0,
+                 * stick two bytes of zero-length EEM packet on the end.
+                 */
+                if (((len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) == 0)
+                        padlen += 2;
+
+                if ((tailroom >= (ETH_FCS_LEN + padlen)) &&
+                                (headroom >= EEM_HLEN))
+                        goto done;
+        }
+
+        skb2 = skb_copy_expand(skb, EEM_HLEN, ETH_FCS_LEN + padlen, GFP_ATOMIC);
+        dev_kfree_skb_any(skb);
+        skb = skb2;
+        if (!skb)
+                return skb;
+
+done:
+        /* use the "no CRC" option */
+        put_unaligned_be32(0xdeadbeef, skb_put(skb, 4));
+
+        /* EEM packet header format:
+         * b0..13:      length of ethernet frame
+         * b14:         bmCRC (0 == sentinel CRC)
+         * b15:         bmType (0 == data)
+         */
+        len = skb->len;
+        put_unaligned_le16((len & 0x3FFF) | BIT(14), skb_push(skb, 2));
+
+        /* add a zero-length EEM packet, if needed */
+        if (padlen)
+                put_unaligned_le16(0, skb_put(skb, 2));
+
+        return skb;
+}
+
+/*
+ * Remove the EEM header.  Note that there can be many EEM packets in a single
+ * USB transfer, so we need to break them out and handle them independently.
+ */
+static int eem_unwrap(struct gether *port,
+                        struct sk_buff *skb,
+                        struct sk_buff_head *list)
+{
+        struct usb_composite_dev        *cdev = port->func.config->cdev;
+        int                             status = 0;
+
+        do {
+                struct sk_buff  *skb2;
+                u16             header;
+                u16             len = 0;
+
+                if (skb->len < EEM_HLEN) {
+                        status = -EINVAL;
+                        DBG(cdev, "invalid EEM header\n");
+                        goto error;
+                }
+
+                /* remove the EEM header */
+                header = get_unaligned_le16(skb->data);
+                skb_pull(skb, EEM_HLEN);
+
+                /* EEM packet header format:
+                 * b0..14:      EEM type dependent (data or command)
+                 * b15:         bmType (0 == data, 1 == command)
+                 */
+                if (header & BIT(15)) {
+                        struct usb_request      *req = cdev->req;
+                        u16                     bmEEMCmd;
+
+                        /* EEM command packet format:
+                         * b0..10:      bmEEMCmdParam
+                         * b11..13:     bmEEMCmd
+                         * b14:         reserved (must be zero)
+                         * b15:         bmType (1 == command)
+                         */
+                        if (header & BIT(14))
+                                continue;
+
+                        bmEEMCmd = (header >> 11) & 0x7;
+                        switch (bmEEMCmd) {
+                        case 0: /* echo */
+                                len = header & 0x7FF;
+                                if (skb->len < len) {
+                                        status = -EOVERFLOW;
+                                        goto error;
+                                }
+
+                                skb2 = skb_clone(skb, GFP_ATOMIC);
+                                if (unlikely(!skb2)) {
+                                        DBG(cdev, "EEM echo response error\n");
+                                        goto next;
+                                }
+                                skb_trim(skb2, len);
+                                put_unaligned_le16(BIT(15) | BIT(11) | len,
+                                                        skb_push(skb2, 2));
+                                skb_copy_bits(skb, 0, req->buf, skb->len);
+                                req->length = skb->len;
+                                req->complete = eem_cmd_complete;
+                                req->zero = 1;
+                                if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC))
+                                        DBG(cdev, "echo response queue fail\n");
+                                break;
+
+                        case 1:  /* echo response */
+                        case 2:  /* suspend hint */
+                        case 3:  /* response hint */
+                        case 4:  /* response complete hint */
+                        case 5:  /* tickle */
+                        default: /* reserved */
+                                continue;
+                        }
+                } else {
+                        u32             crc, crc2;
+                        struct sk_buff  *skb3;
+
+                        /* check for zero-length EEM packet */
+                        if (header == 0)
+                                continue;
+
+                        /* EEM data packet format:
+                         * b0..13:      length of ethernet frame
+                         * b14:         bmCRC (0 == sentinel, 1 == calculated)
+                         * b15:         bmType (0 == data)
+                         */
+                        len = header & 0x3FFF;
+                        if ((skb->len < len)
+                                        || (len < (ETH_HLEN + ETH_FCS_LEN))) {
+                                status = -EINVAL;
+                                goto error;
+                        }
+
+                        /* validate CRC */
+                        crc = get_unaligned_le32(skb->data + len - ETH_FCS_LEN);
+                        if (header & BIT(14)) {
+                                crc = get_unaligned_le32(skb->data + len
+                                                        - ETH_FCS_LEN);
+                                crc2 = ~crc32_le(~0,
+                                                skb->data,
+                                                skb->len - ETH_FCS_LEN);
+                        } else {
+                                crc = get_unaligned_be32(skb->data + len
+                                                        - ETH_FCS_LEN);
+                                crc2 = 0xdeadbeef;
+                        }
+                        if (crc != crc2) {
+                                DBG(cdev, "invalid EEM CRC\n");
+                                goto next;
+                        }
+
+                        skb2 = skb_clone(skb, GFP_ATOMIC);
+                        if (unlikely(!skb2)) {
+                                DBG(cdev, "unable to unframe EEM packet\n");
+                                continue;
+                        }
+                        skb_trim(skb2, len - ETH_FCS_LEN);
+
+                        skb3 = skb_copy_expand(skb2,
+                                                NET_IP_ALIGN,
+                                                0,
+                                                GFP_ATOMIC);
+                        if (unlikely(!skb3)) {
+                                DBG(cdev, "unable to realign EEM packet\n");
+                                dev_kfree_skb_any(skb2);
+                                continue;
+                        }
+                        dev_kfree_skb_any(skb2);
+                        skb_queue_tail(list, skb3);
+                }
+next:
+                skb_pull(skb, len);
+        } while (skb->len);
+
+error:
+        dev_kfree_skb_any(skb);
+        return status;
+}
+
+/**
+ * eem_bind_config - add CDC Ethernet (EEM) network link to a configuration
+ * @c: the configuration to support the network link
+ * Context: single threaded during gadget setup
+ *
+ * Returns zero on success, else negative errno.
+ *
+ * Caller must have called @gether_setup().  Caller is also responsible
+ * for calling @gether_cleanup() before module unload.
+ */
+int __init eem_bind_config(struct usb_configuration *c)
+{
+        struct f_eem    *eem;
+        int             status;
+
+        /* maybe allocate device-global string IDs */
+        if (eem_string_defs[0].id == 0) {
+
+                /* control interface label */
+                status = usb_string_id(c->cdev);
+                if (status < 0)
+                        return status;
+                eem_string_defs[0].id = status;
+                eem_intf.iInterface = status;
+        }
+
+        /* allocate and initialize one new instance */
+        eem = kzalloc(sizeof *eem, GFP_KERNEL);
+        if (!eem)
+                return -ENOMEM;
+
+        eem->port.cdc_filter = DEFAULT_FILTER;
+
+        eem->port.func.name = "cdc_eem";
+        eem->port.func.strings = eem_strings;
+        /* descriptors are per-instance copies */
+        eem->port.func.bind = eem_bind;
+        eem->port.func.unbind = eem_unbind;
+        eem->port.func.set_alt = eem_set_alt;
+        eem->port.func.setup = eem_setup;
+        eem->port.func.disable = eem_disable;
+        eem->port.wrap = eem_wrap;
+        eem->port.unwrap = eem_unwrap;
+        eem->port.header_len = EEM_HLEN;
+
+        status = usb_add_function(c, &eem->port.func);
+        if (status)
+                kfree(eem);
+        return status;
+}
+
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
index 424a37c5773f..c9966cc07d3a 100644
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -286,12 +286,17 @@ static struct usb_gadget_strings *rndis_strings[] = {
 
 /*-------------------------------------------------------------------------*/
 
-static struct sk_buff *rndis_add_header(struct sk_buff *skb)
+static struct sk_buff *rndis_add_header(struct gether *port,
+                                        struct sk_buff *skb)
 {
-        skb = skb_realloc_headroom(skb, sizeof(struct rndis_packet_msg_type));
-        if (skb)
-                rndis_add_hdr(skb);
-        return skb;
+        struct sk_buff *skb2;
+
+        skb2 = skb_realloc_headroom(skb, sizeof(struct rndis_packet_msg_type));
+        if (skb2)
+                rndis_add_hdr(skb2);
+
+        dev_kfree_skb_any(skb);
+        return skb2;
 }
 
 static void rndis_response_available(void *_rndis)
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index ca41b0b5afb3..48267bc0b2e0 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -1022,22 +1022,29 @@ static rndis_resp_t *rndis_add_response (int configNr, u32 length)
         return r;
 }
 
-int rndis_rm_hdr(struct sk_buff *skb)
+int rndis_rm_hdr(struct gether *port,
+                        struct sk_buff *skb,
+                        struct sk_buff_head *list)
 {
         /* tmp points to a struct rndis_packet_msg_type */
         __le32          *tmp = (void *) skb->data;
 
         /* MessageType, MessageLength */
         if (cpu_to_le32(REMOTE_NDIS_PACKET_MSG)
-                        != get_unaligned(tmp++))
+                        != get_unaligned(tmp++)) {
+                dev_kfree_skb_any(skb);
                 return -EINVAL;
+        }
         tmp++;
 
         /* DataOffset, DataLength */
-        if (!skb_pull(skb, get_unaligned_le32(tmp++) + 8))
+        if (!skb_pull(skb, get_unaligned_le32(tmp++) + 8)) {
+                dev_kfree_skb_any(skb);
                 return -EOVERFLOW;
+        }
         skb_trim(skb, get_unaligned_le32(tmp++));
 
+        skb_queue_tail(list, skb);
         return 0;
 }
 
diff --git a/drivers/usb/gadget/rndis.h b/drivers/usb/gadget/rndis.h
index aac61dfe0f03..c236aaa9dcd1 100644
--- a/drivers/usb/gadget/rndis.h
+++ b/drivers/usb/gadget/rndis.h
@@ -251,7 +251,8 @@ int  rndis_set_param_vendor (u8 configNr, u32 vendorID,
                             const char *vendorDescr);
 int  rndis_set_param_medium (u8 configNr, u32 medium, u32 speed);
 void rndis_add_hdr (struct sk_buff *skb);
-int rndis_rm_hdr (struct sk_buff *skb);
+int rndis_rm_hdr(struct gether *port, struct sk_buff *skb,
+                        struct sk_buff_head *list);
 u8   *rndis_get_next_response (int configNr, u32 *length);
 void rndis_free_response (int configNr, u8 *buf);
 
diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c
index c66521953917..f8751ff863cd 100644
--- a/drivers/usb/gadget/u_ether.c
+++ b/drivers/usb/gadget/u_ether.c
@@ -37,8 +37,9 @@
  * one (!) network link through the USB gadget stack, normally "usb0".
  *
  * The control and data models are handled by the function driver which
- * connects to this code; such as CDC Ethernet, "CDC Subset", or RNDIS.
- * That includes all descriptor and endpoint management.
+ * connects to this code; such as CDC Ethernet (ECM or EEM),
+ * "CDC Subset", or RNDIS.  That includes all descriptor and endpoint
+ * management.
  *
  * Link level addressing is handled by this component using module
  * parameters; if no such parameters are provided, random link level
@@ -68,9 +69,13 @@ struct eth_dev {
         struct list_head        tx_reqs, rx_reqs;
         atomic_t                tx_qlen;
 
+        struct sk_buff_head     rx_frames;
+
         unsigned                header_len;
-        struct sk_buff          *(*wrap)(struct sk_buff *skb);
-        int                     (*unwrap)(struct sk_buff *skb);
+        struct sk_buff          *(*wrap)(struct gether *, struct sk_buff *skb);
+        int                     (*unwrap)(struct gether *,
+                                                struct sk_buff *skb,
+                                                struct sk_buff_head *list);
 
         struct work_struct      work;
 
@@ -269,7 +274,7 @@ enomem:
 
 static void rx_complete(struct usb_ep *ep, struct usb_request *req)
 {
-        struct sk_buff  *skb = req->context;
+        struct sk_buff  *skb = req->context, *skb2;
         struct eth_dev  *dev = ep->driver_data;
         int             status = req->status;
 
@@ -278,26 +283,47 @@ static void rx_complete(struct usb_ep *ep, struct usb_request *req)
         /* normal completion */
         case 0:
                 skb_put(skb, req->actual);
-                if (dev->unwrap)
-                        status = dev->unwrap(skb);
-                if (status < 0
-                                || ETH_HLEN > skb->len
-                                || skb->len > ETH_FRAME_LEN) {
-                        dev->net->stats.rx_errors++;
-                        dev->net->stats.rx_length_errors++;
-                        DBG(dev, "rx length %d\n", skb->len);
-                        break;
-                }
 
-                skb->protocol = eth_type_trans(skb, dev->net);
-                dev->net->stats.rx_packets++;
-                dev->net->stats.rx_bytes += skb->len;
+                if (dev->unwrap) {
+                        unsigned long   flags;
 
-                /* no buffer copies needed, unless hardware can't
-                 * use skb buffers.
-                 */
-                status = netif_rx(skb);
+                        spin_lock_irqsave(&dev->lock, flags);
+                        if (dev->port_usb) {
+                                status = dev->unwrap(dev->port_usb,
+                                                        skb,
+                                                        &dev->rx_frames);
+                        } else {
+                                dev_kfree_skb_any(skb);
+                                status = -ENOTCONN;
+                        }
+                        spin_unlock_irqrestore(&dev->lock, flags);
+                } else {
+                        skb_queue_tail(&dev->rx_frames, skb);
+                }
                 skb = NULL;
+
+                skb2 = skb_dequeue(&dev->rx_frames);
+                while (skb2) {
+                        if (status < 0
+                                        || ETH_HLEN > skb2->len
+                                        || skb2->len > ETH_FRAME_LEN) {
+                                dev->net->stats.rx_errors++;
+                                dev->net->stats.rx_length_errors++;
+                                DBG(dev, "rx length %d\n", skb2->len);
+                                dev_kfree_skb_any(skb2);
+                                goto next_frame;
+                        }
+                        skb2->protocol = eth_type_trans(skb2, dev->net);
+                        dev->net->stats.rx_packets++;
+                        dev->net->stats.rx_bytes += skb2->len;
+
+                        /* no buffer copies needed, unless hardware can't
+                         * use skb buffers.
+                         */
+                        status = netif_rx(skb2);
+next_frame:
+                        skb2 = skb_dequeue(&dev->rx_frames);
+                }
                 break;
 
         /* software-driven interface shutdown */
@@ -537,14 +563,15 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
          * or there's not enough space for extra headers we need
          */
         if (dev->wrap) {
-                struct sk_buff  *skb_new;
+                unsigned long   flags;
 
-                skb_new = dev->wrap(skb);
-                if (!skb_new)
+                spin_lock_irqsave(&dev->lock, flags);
+                if (dev->port_usb)
+                        skb = dev->wrap(dev->port_usb, skb);
+                spin_unlock_irqrestore(&dev->lock, flags);
+                if (!skb)
                         goto drop;
 
-                dev_kfree_skb_any(skb);
-                skb = skb_new;
                 length = skb->len;
         }
         req->buf = skb->data;
@@ -578,9 +605,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
         }
 
         if (retval) {
+                dev_kfree_skb_any(skb);
 drop:
                 dev->net->stats.tx_dropped++;
-                dev_kfree_skb_any(skb);
                 spin_lock_irqsave(&dev->req_lock, flags);
                 if (list_empty(&dev->tx_reqs))
                         netif_start_queue(net);
@@ -753,6 +780,8 @@ int __init gether_setup(struct usb_gadget *g, u8 ethaddr[ETH_ALEN])
         INIT_LIST_HEAD(&dev->tx_reqs);
         INIT_LIST_HEAD(&dev->rx_reqs);
 
+        skb_queue_head_init(&dev->rx_frames);
+
         /* network device setup */
         dev->net = net;
         strcpy(net->name, "usb%d");
diff --git a/drivers/usb/gadget/u_ether.h b/drivers/usb/gadget/u_ether.h
index 0d1f7ae3b071..91b39ffdf6ea 100644
--- a/drivers/usb/gadget/u_ether.h
+++ b/drivers/usb/gadget/u_ether.h
@@ -60,12 +60,13 @@ struct gether {
 
         u16                             cdc_filter;
 
-        /* hooks for added framing, as needed for RNDIS and EEM.
-         * we currently don't support multiple frames per SKB.
-         */
+        /* hooks for added framing, as needed for RNDIS and EEM. */
         u32                             header_len;
-        struct sk_buff                  *(*wrap)(struct sk_buff *skb);
-        int                             (*unwrap)(struct sk_buff *skb);
+        struct sk_buff                  *(*wrap)(struct gether *port,
+                                                struct sk_buff *skb);
+        int                             (*unwrap)(struct gether *port,
+                                                struct sk_buff *skb,
+                                                struct sk_buff_head *list);
 
         /* called on network open/close */
         void                            (*open)(struct gether *);
@@ -109,6 +110,7 @@ static inline bool can_support_ecm(struct usb_gadget *gadget)
 /* each configuration may bind one instance of an ethernet link */
 int geth_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN]);
 int ecm_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN]);
+int eem_bind_config(struct usb_configuration *c);
 
 #ifdef CONFIG_USB_ETH_RNDIS