Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0+
2/*
3 * Copyright (C) 2003-2008 Takahiro Hirofuchi
4 * Copyright (C) 2015-2016 Samsung Electronics
5 * Krzysztof Opasiak <k.opasiak@samsung.com>
6 */
7
8#include <asm/byteorder.h>
9#include <linux/file.h>
10#include <linux/fs.h>
11#include <linux/kernel.h>
12#include <linux/slab.h>
13#include <linux/stat.h>
14#include <linux/module.h>
15#include <linux/moduleparam.h>
16#include <net/sock.h>
17
18#include "usbip_common.h"
19
20#define DRIVER_AUTHOR "Takahiro Hirofuchi <hirofuchi@users.sourceforge.net>"
21#define DRIVER_DESC "USB/IP Core"
22
23#ifdef CONFIG_USBIP_DEBUG
24unsigned long usbip_debug_flag = 0xffffffff;
25#else
26unsigned long usbip_debug_flag;
27#endif
28EXPORT_SYMBOL_GPL(usbip_debug_flag);
29module_param(usbip_debug_flag, ulong, S_IRUGO|S_IWUSR);
30MODULE_PARM_DESC(usbip_debug_flag, "debug flags (defined in usbip_common.h)");
31
32/* FIXME */
33struct device_attribute dev_attr_usbip_debug;
34EXPORT_SYMBOL_GPL(dev_attr_usbip_debug);
35
36static ssize_t usbip_debug_show(struct device *dev,
37 struct device_attribute *attr, char *buf)
38{
39 return sprintf(buf, "%lx\n", usbip_debug_flag);
40}
41
42static ssize_t usbip_debug_store(struct device *dev,
43 struct device_attribute *attr, const char *buf,
44 size_t count)
45{
46 if (sscanf(buf, "%lx", &usbip_debug_flag) != 1)
47 return -EINVAL;
48 return count;
49}
50DEVICE_ATTR_RW(usbip_debug);
51
52static void usbip_dump_buffer(char *buff, int bufflen)
53{
54 print_hex_dump(KERN_DEBUG, "usbip-core", DUMP_PREFIX_OFFSET, 16, 4,
55 buff, bufflen, false);
56}
57
58static void usbip_dump_pipe(unsigned int p)
59{
60 unsigned char type = usb_pipetype(p);
61 unsigned char ep = usb_pipeendpoint(p);
62 unsigned char dev = usb_pipedevice(p);
63 unsigned char dir = usb_pipein(p);
64
65 pr_debug("dev(%d) ep(%d) [%s] ", dev, ep, dir ? "IN" : "OUT");
66
67 switch (type) {
68 case PIPE_ISOCHRONOUS:
69 pr_debug("ISO\n");
70 break;
71 case PIPE_INTERRUPT:
72 pr_debug("INT\n");
73 break;
74 case PIPE_CONTROL:
75 pr_debug("CTRL\n");
76 break;
77 case PIPE_BULK:
78 pr_debug("BULK\n");
79 break;
80 default:
81 pr_debug("ERR\n");
82 break;
83 }
84}
85
86static void usbip_dump_usb_device(struct usb_device *udev)
87{
88 struct device *dev = &udev->dev;
89 int i;
90
91 dev_dbg(dev, " devnum(%d) devpath(%s) usb speed(%s)",
92 udev->devnum, udev->devpath, usb_speed_string(udev->speed));
93
94 pr_debug("tt hub ttport %d\n", udev->ttport);
95
96 dev_dbg(dev, " ");
97 for (i = 0; i < 16; i++)
98 pr_debug(" %2u", i);
99 pr_debug("\n");
100
101 dev_dbg(dev, " toggle0(IN) :");
102 for (i = 0; i < 16; i++)
103 pr_debug(" %2u", (udev->toggle[0] & (1 << i)) ? 1 : 0);
104 pr_debug("\n");
105
106 dev_dbg(dev, " toggle1(OUT):");
107 for (i = 0; i < 16; i++)
108 pr_debug(" %2u", (udev->toggle[1] & (1 << i)) ? 1 : 0);
109 pr_debug("\n");
110
111 dev_dbg(dev, " epmaxp_in :");
112 for (i = 0; i < 16; i++) {
113 if (udev->ep_in[i])
114 pr_debug(" %2u",
115 le16_to_cpu(udev->ep_in[i]->desc.wMaxPacketSize));
116 }
117 pr_debug("\n");
118
119 dev_dbg(dev, " epmaxp_out :");
120 for (i = 0; i < 16; i++) {
121 if (udev->ep_out[i])
122 pr_debug(" %2u",
123 le16_to_cpu(udev->ep_out[i]->desc.wMaxPacketSize));
124 }
125 pr_debug("\n");
126
127 dev_dbg(dev, "parent %s, bus %s\n", dev_name(&udev->parent->dev),
128 udev->bus->bus_name);
129
130 dev_dbg(dev, "have_langid %d, string_langid %d\n",
131 udev->have_langid, udev->string_langid);
132
133 dev_dbg(dev, "maxchild %d\n", udev->maxchild);
134}
135
136static void usbip_dump_request_type(__u8 rt)
137{
138 switch (rt & USB_RECIP_MASK) {
139 case USB_RECIP_DEVICE:
140 pr_debug("DEVICE");
141 break;
142 case USB_RECIP_INTERFACE:
143 pr_debug("INTERF");
144 break;
145 case USB_RECIP_ENDPOINT:
146 pr_debug("ENDPOI");
147 break;
148 case USB_RECIP_OTHER:
149 pr_debug("OTHER ");
150 break;
151 default:
152 pr_debug("------");
153 break;
154 }
155}
156
157static void usbip_dump_usb_ctrlrequest(struct usb_ctrlrequest *cmd)
158{
159 if (!cmd) {
160 pr_debug(" : null pointer\n");
161 return;
162 }
163
164 pr_debug(" ");
165 pr_debug("bRequestType(%02X) bRequest(%02X) wValue(%04X) wIndex(%04X) wLength(%04X) ",
166 cmd->bRequestType, cmd->bRequest,
167 cmd->wValue, cmd->wIndex, cmd->wLength);
168 pr_debug("\n ");
169
170 if ((cmd->bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD) {
171 pr_debug("STANDARD ");
172 switch (cmd->bRequest) {
173 case USB_REQ_GET_STATUS:
174 pr_debug("GET_STATUS\n");
175 break;
176 case USB_REQ_CLEAR_FEATURE:
177 pr_debug("CLEAR_FEAT\n");
178 break;
179 case USB_REQ_SET_FEATURE:
180 pr_debug("SET_FEAT\n");
181 break;
182 case USB_REQ_SET_ADDRESS:
183 pr_debug("SET_ADDRRS\n");
184 break;
185 case USB_REQ_GET_DESCRIPTOR:
186 pr_debug("GET_DESCRI\n");
187 break;
188 case USB_REQ_SET_DESCRIPTOR:
189 pr_debug("SET_DESCRI\n");
190 break;
191 case USB_REQ_GET_CONFIGURATION:
192 pr_debug("GET_CONFIG\n");
193 break;
194 case USB_REQ_SET_CONFIGURATION:
195 pr_debug("SET_CONFIG\n");
196 break;
197 case USB_REQ_GET_INTERFACE:
198 pr_debug("GET_INTERF\n");
199 break;
200 case USB_REQ_SET_INTERFACE:
201 pr_debug("SET_INTERF\n");
202 break;
203 case USB_REQ_SYNCH_FRAME:
204 pr_debug("SYNC_FRAME\n");
205 break;
206 default:
207 pr_debug("REQ(%02X)\n", cmd->bRequest);
208 break;
209 }
210 usbip_dump_request_type(cmd->bRequestType);
211 } else if ((cmd->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS) {
212 pr_debug("CLASS\n");
213 } else if ((cmd->bRequestType & USB_TYPE_MASK) == USB_TYPE_VENDOR) {
214 pr_debug("VENDOR\n");
215 } else if ((cmd->bRequestType & USB_TYPE_MASK) == USB_TYPE_RESERVED) {
216 pr_debug("RESERVED\n");
217 }
218}
219
220void usbip_dump_urb(struct urb *urb)
221{
222 struct device *dev;
223
224 if (!urb) {
225 pr_debug("urb: null pointer!!\n");
226 return;
227 }
228
229 if (!urb->dev) {
230 pr_debug("urb->dev: null pointer!!\n");
231 return;
232 }
233
234 dev = &urb->dev->dev;
235
236 usbip_dump_usb_device(urb->dev);
237
238 dev_dbg(dev, " pipe :%08x ", urb->pipe);
239
240 usbip_dump_pipe(urb->pipe);
241
242 dev_dbg(dev, " status :%d\n", urb->status);
243 dev_dbg(dev, " transfer_flags :%08X\n", urb->transfer_flags);
244 dev_dbg(dev, " transfer_buffer_length:%d\n",
245 urb->transfer_buffer_length);
246 dev_dbg(dev, " actual_length :%d\n", urb->actual_length);
247
248 if (urb->setup_packet && usb_pipetype(urb->pipe) == PIPE_CONTROL)
249 usbip_dump_usb_ctrlrequest(
250 (struct usb_ctrlrequest *)urb->setup_packet);
251
252 dev_dbg(dev, " start_frame :%d\n", urb->start_frame);
253 dev_dbg(dev, " number_of_packets :%d\n", urb->number_of_packets);
254 dev_dbg(dev, " interval :%d\n", urb->interval);
255 dev_dbg(dev, " error_count :%d\n", urb->error_count);
256}
257EXPORT_SYMBOL_GPL(usbip_dump_urb);
258
259void usbip_dump_header(struct usbip_header *pdu)
260{
261 pr_debug("BASE: cmd %u seq %u devid %u dir %u ep %u\n",
262 pdu->base.command,
263 pdu->base.seqnum,
264 pdu->base.devid,
265 pdu->base.direction,
266 pdu->base.ep);
267
268 switch (pdu->base.command) {
269 case USBIP_CMD_SUBMIT:
270 pr_debug("USBIP_CMD_SUBMIT: x_flags %u x_len %u sf %u #p %d iv %d\n",
271 pdu->u.cmd_submit.transfer_flags,
272 pdu->u.cmd_submit.transfer_buffer_length,
273 pdu->u.cmd_submit.start_frame,
274 pdu->u.cmd_submit.number_of_packets,
275 pdu->u.cmd_submit.interval);
276 break;
277 case USBIP_CMD_UNLINK:
278 pr_debug("USBIP_CMD_UNLINK: seq %u\n",
279 pdu->u.cmd_unlink.seqnum);
280 break;
281 case USBIP_RET_SUBMIT:
282 pr_debug("USBIP_RET_SUBMIT: st %d al %u sf %d #p %d ec %d\n",
283 pdu->u.ret_submit.status,
284 pdu->u.ret_submit.actual_length,
285 pdu->u.ret_submit.start_frame,
286 pdu->u.ret_submit.number_of_packets,
287 pdu->u.ret_submit.error_count);
288 break;
289 case USBIP_RET_UNLINK:
290 pr_debug("USBIP_RET_UNLINK: status %d\n",
291 pdu->u.ret_unlink.status);
292 break;
293 default:
294 /* NOT REACHED */
295 pr_err("unknown command\n");
296 break;
297 }
298}
299EXPORT_SYMBOL_GPL(usbip_dump_header);
300
301/* Receive data over TCP/IP. */
302int usbip_recv(struct socket *sock, void *buf, int size)
303{
304 int result;
305 struct kvec iov = {.iov_base = buf, .iov_len = size};
306 struct msghdr msg = {.msg_flags = MSG_NOSIGNAL};
307 int total = 0;
308
309 if (!sock || !buf || !size)
310 return -EINVAL;
311
312 iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, size);
313
314 usbip_dbg_xmit("enter\n");
315
316 do {
317 sock->sk->sk_allocation = GFP_NOIO;
318 sock->sk->sk_use_task_frag = false;
319
320 result = sock_recvmsg(sock, &msg, MSG_WAITALL);
321 if (result <= 0)
322 goto err;
323
324 total += result;
325 } while (msg_data_left(&msg));
326
327 if (usbip_dbg_flag_xmit) {
328 pr_debug("receiving....\n");
329 usbip_dump_buffer(buf, size);
330 pr_debug("received, osize %d ret %d size %zd total %d\n",
331 size, result, msg_data_left(&msg), total);
332 }
333
334 return total;
335
336err:
337 return result;
338}
339EXPORT_SYMBOL_GPL(usbip_recv);
340
341/* there may be more cases to tweak the flags. */
342static unsigned int tweak_transfer_flags(unsigned int flags)
343{
344 flags &= ~URB_NO_TRANSFER_DMA_MAP;
345 return flags;
346}
347
348/*
349 * USBIP driver packs URB transfer flags in PDUs that are exchanged
350 * between Server (usbip_host) and Client (vhci_hcd). URB_* flags
351 * are internal to kernel and could change. Where as USBIP URB flags
352 * exchanged in PDUs are USBIP user API must not change.
353 *
354 * USBIP_URB* flags are exported as explicit API and client and server
355 * do mapping from kernel flags to USBIP_URB*. Details as follows:
356 *
357 * Client tx path (USBIP_CMD_SUBMIT):
358 * - Maps URB_* to USBIP_URB_* when it sends USBIP_CMD_SUBMIT packet.
359 *
360 * Server rx path (USBIP_CMD_SUBMIT):
361 * - Maps USBIP_URB_* to URB_* when it receives USBIP_CMD_SUBMIT packet.
362 *
363 * Flags aren't included in USBIP_CMD_UNLINK and USBIP_RET_SUBMIT packets
364 * and no special handling is needed for them in the following cases:
365 * - Server rx path (USBIP_CMD_UNLINK)
366 * - Client rx path & Server tx path (USBIP_RET_SUBMIT)
367 *
368 * Code paths:
369 * usbip_pack_pdu() is the common routine that handles packing pdu from
370 * urb and unpack pdu to an urb.
371 *
372 * usbip_pack_cmd_submit() and usbip_pack_ret_submit() handle
373 * USBIP_CMD_SUBMIT and USBIP_RET_SUBMIT respectively.
374 *
375 * usbip_map_urb_to_usbip() and usbip_map_usbip_to_urb() are used
376 * by usbip_pack_cmd_submit() and usbip_pack_ret_submit() to map
377 * flags.
378 */
379
380struct urb_to_usbip_flags {
381 u32 urb_flag;
382 u32 usbip_flag;
383};
384
385#define NUM_USBIP_FLAGS 17
386
387static const struct urb_to_usbip_flags flag_map[NUM_USBIP_FLAGS] = {
388 {URB_SHORT_NOT_OK, USBIP_URB_SHORT_NOT_OK},
389 {URB_ISO_ASAP, USBIP_URB_ISO_ASAP},
390 {URB_NO_TRANSFER_DMA_MAP, USBIP_URB_NO_TRANSFER_DMA_MAP},
391 {URB_ZERO_PACKET, USBIP_URB_ZERO_PACKET},
392 {URB_NO_INTERRUPT, USBIP_URB_NO_INTERRUPT},
393 {URB_FREE_BUFFER, USBIP_URB_FREE_BUFFER},
394 {URB_DIR_IN, USBIP_URB_DIR_IN},
395 {URB_DIR_OUT, USBIP_URB_DIR_OUT},
396 {URB_DIR_MASK, USBIP_URB_DIR_MASK},
397 {URB_DMA_MAP_SINGLE, USBIP_URB_DMA_MAP_SINGLE},
398 {URB_DMA_MAP_PAGE, USBIP_URB_DMA_MAP_PAGE},
399 {URB_DMA_MAP_SG, USBIP_URB_DMA_MAP_SG},
400 {URB_MAP_LOCAL, USBIP_URB_MAP_LOCAL},
401 {URB_SETUP_MAP_SINGLE, USBIP_URB_SETUP_MAP_SINGLE},
402 {URB_SETUP_MAP_LOCAL, USBIP_URB_SETUP_MAP_LOCAL},
403 {URB_DMA_SG_COMBINED, USBIP_URB_DMA_SG_COMBINED},
404 {URB_ALIGNED_TEMP_BUFFER, USBIP_URB_ALIGNED_TEMP_BUFFER},
405};
406
407static unsigned int urb_to_usbip(unsigned int flags)
408{
409 unsigned int map_flags = 0;
410 int loop;
411
412 for (loop = 0; loop < NUM_USBIP_FLAGS; loop++) {
413 if (flags & flag_map[loop].urb_flag)
414 map_flags |= flag_map[loop].usbip_flag;
415 }
416
417 return map_flags;
418}
419
420static unsigned int usbip_to_urb(unsigned int flags)
421{
422 unsigned int map_flags = 0;
423 int loop;
424
425 for (loop = 0; loop < NUM_USBIP_FLAGS; loop++) {
426 if (flags & flag_map[loop].usbip_flag)
427 map_flags |= flag_map[loop].urb_flag;
428 }
429
430 return map_flags;
431}
432
433static void usbip_pack_cmd_submit(struct usbip_header *pdu, struct urb *urb,
434 int pack)
435{
436 struct usbip_header_cmd_submit *spdu = &pdu->u.cmd_submit;
437
438 /*
439 * Some members are not still implemented in usbip. I hope this issue
440 * will be discussed when usbip is ported to other operating systems.
441 */
442 if (pack) {
443 /* map after tweaking the urb flags */
444 spdu->transfer_flags = urb_to_usbip(tweak_transfer_flags(urb->transfer_flags));
445 spdu->transfer_buffer_length = urb->transfer_buffer_length;
446 spdu->start_frame = urb->start_frame;
447 spdu->number_of_packets = urb->number_of_packets;
448 spdu->interval = urb->interval;
449 } else {
450 urb->transfer_flags = usbip_to_urb(spdu->transfer_flags);
451 urb->transfer_buffer_length = spdu->transfer_buffer_length;
452 urb->start_frame = spdu->start_frame;
453 urb->number_of_packets = spdu->number_of_packets;
454 urb->interval = spdu->interval;
455 }
456}
457
458static void usbip_pack_ret_submit(struct usbip_header *pdu, struct urb *urb,
459 int pack)
460{
461 struct usbip_header_ret_submit *rpdu = &pdu->u.ret_submit;
462
463 if (pack) {
464 rpdu->status = urb->status;
465 rpdu->actual_length = urb->actual_length;
466 rpdu->start_frame = urb->start_frame;
467 rpdu->number_of_packets = urb->number_of_packets;
468 rpdu->error_count = urb->error_count;
469 } else {
470 urb->status = rpdu->status;
471 urb->actual_length = rpdu->actual_length;
472 urb->start_frame = rpdu->start_frame;
473 /*
474 * The number_of_packets field determines the length of
475 * iso_frame_desc[], which is a flexible array allocated
476 * at URB creation time. A response must never claim more
477 * packets than originally submitted; doing so would cause
478 * an out-of-bounds write in usbip_recv_iso() and
479 * usbip_pad_iso(). Clamp to zero on violation so both
480 * functions safely return early.
481 */
482 if (rpdu->number_of_packets < 0 ||
483 rpdu->number_of_packets > urb->number_of_packets)
484 rpdu->number_of_packets = 0;
485 urb->number_of_packets = rpdu->number_of_packets;
486 urb->error_count = rpdu->error_count;
487 }
488}
489
490void usbip_pack_pdu(struct usbip_header *pdu, struct urb *urb, int cmd,
491 int pack)
492{
493 switch (cmd) {
494 case USBIP_CMD_SUBMIT:
495 usbip_pack_cmd_submit(pdu, urb, pack);
496 break;
497 case USBIP_RET_SUBMIT:
498 usbip_pack_ret_submit(pdu, urb, pack);
499 break;
500 default:
501 /* NOT REACHED */
502 pr_err("unknown command\n");
503 break;
504 }
505}
506EXPORT_SYMBOL_GPL(usbip_pack_pdu);
507
508static void correct_endian_basic(struct usbip_header_basic *base, int send)
509{
510 if (send) {
511 base->command = cpu_to_be32(base->command);
512 base->seqnum = cpu_to_be32(base->seqnum);
513 base->devid = cpu_to_be32(base->devid);
514 base->direction = cpu_to_be32(base->direction);
515 base->ep = cpu_to_be32(base->ep);
516 } else {
517 base->command = be32_to_cpu(base->command);
518 base->seqnum = be32_to_cpu(base->seqnum);
519 base->devid = be32_to_cpu(base->devid);
520 base->direction = be32_to_cpu(base->direction);
521 base->ep = be32_to_cpu(base->ep);
522 }
523}
524
525static void correct_endian_cmd_submit(struct usbip_header_cmd_submit *pdu,
526 int send)
527{
528 if (send) {
529 pdu->transfer_flags = cpu_to_be32(pdu->transfer_flags);
530
531 cpu_to_be32s(&pdu->transfer_buffer_length);
532 cpu_to_be32s(&pdu->start_frame);
533 cpu_to_be32s(&pdu->number_of_packets);
534 cpu_to_be32s(&pdu->interval);
535 } else {
536 pdu->transfer_flags = be32_to_cpu(pdu->transfer_flags);
537
538 be32_to_cpus(&pdu->transfer_buffer_length);
539 be32_to_cpus(&pdu->start_frame);
540 be32_to_cpus(&pdu->number_of_packets);
541 be32_to_cpus(&pdu->interval);
542 }
543}
544
545static void correct_endian_ret_submit(struct usbip_header_ret_submit *pdu,
546 int send)
547{
548 if (send) {
549 cpu_to_be32s(&pdu->status);
550 cpu_to_be32s(&pdu->actual_length);
551 cpu_to_be32s(&pdu->start_frame);
552 cpu_to_be32s(&pdu->number_of_packets);
553 cpu_to_be32s(&pdu->error_count);
554 } else {
555 be32_to_cpus(&pdu->status);
556 be32_to_cpus(&pdu->actual_length);
557 be32_to_cpus(&pdu->start_frame);
558 be32_to_cpus(&pdu->number_of_packets);
559 be32_to_cpus(&pdu->error_count);
560 }
561}
562
563static void correct_endian_cmd_unlink(struct usbip_header_cmd_unlink *pdu,
564 int send)
565{
566 if (send)
567 pdu->seqnum = cpu_to_be32(pdu->seqnum);
568 else
569 pdu->seqnum = be32_to_cpu(pdu->seqnum);
570}
571
572static void correct_endian_ret_unlink(struct usbip_header_ret_unlink *pdu,
573 int send)
574{
575 if (send)
576 cpu_to_be32s(&pdu->status);
577 else
578 be32_to_cpus(&pdu->status);
579}
580
581void usbip_header_correct_endian(struct usbip_header *pdu, int send)
582{
583 __u32 cmd = 0;
584
585 if (send)
586 cmd = pdu->base.command;
587
588 correct_endian_basic(&pdu->base, send);
589
590 if (!send)
591 cmd = pdu->base.command;
592
593 switch (cmd) {
594 case USBIP_CMD_SUBMIT:
595 correct_endian_cmd_submit(&pdu->u.cmd_submit, send);
596 break;
597 case USBIP_RET_SUBMIT:
598 correct_endian_ret_submit(&pdu->u.ret_submit, send);
599 break;
600 case USBIP_CMD_UNLINK:
601 correct_endian_cmd_unlink(&pdu->u.cmd_unlink, send);
602 break;
603 case USBIP_RET_UNLINK:
604 correct_endian_ret_unlink(&pdu->u.ret_unlink, send);
605 break;
606 default:
607 /* NOT REACHED */
608 pr_err("unknown command\n");
609 break;
610 }
611}
612EXPORT_SYMBOL_GPL(usbip_header_correct_endian);
613
614static void usbip_iso_packet_correct_endian(
615 struct usbip_iso_packet_descriptor *iso, int send)
616{
617 /* does not need all members. but copy all simply. */
618 if (send) {
619 iso->offset = cpu_to_be32(iso->offset);
620 iso->length = cpu_to_be32(iso->length);
621 iso->status = cpu_to_be32(iso->status);
622 iso->actual_length = cpu_to_be32(iso->actual_length);
623 } else {
624 iso->offset = be32_to_cpu(iso->offset);
625 iso->length = be32_to_cpu(iso->length);
626 iso->status = be32_to_cpu(iso->status);
627 iso->actual_length = be32_to_cpu(iso->actual_length);
628 }
629}
630
631static void usbip_pack_iso(struct usbip_iso_packet_descriptor *iso,
632 struct usb_iso_packet_descriptor *uiso, int pack)
633{
634 if (pack) {
635 iso->offset = uiso->offset;
636 iso->length = uiso->length;
637 iso->status = uiso->status;
638 iso->actual_length = uiso->actual_length;
639 } else {
640 uiso->offset = iso->offset;
641 uiso->length = iso->length;
642 uiso->status = iso->status;
643 uiso->actual_length = iso->actual_length;
644 }
645}
646
647/* must free buffer */
648struct usbip_iso_packet_descriptor*
649usbip_alloc_iso_desc_pdu(struct urb *urb, ssize_t *bufflen)
650{
651 struct usbip_iso_packet_descriptor *iso;
652 int np = urb->number_of_packets;
653 ssize_t size = np * sizeof(*iso);
654 int i;
655
656 iso = kzalloc(size, GFP_KERNEL);
657 if (!iso)
658 return NULL;
659
660 for (i = 0; i < np; i++) {
661 usbip_pack_iso(&iso[i], &urb->iso_frame_desc[i], 1);
662 usbip_iso_packet_correct_endian(&iso[i], 1);
663 }
664
665 *bufflen = size;
666
667 return iso;
668}
669EXPORT_SYMBOL_GPL(usbip_alloc_iso_desc_pdu);
670
671/* some members of urb must be substituted before. */
672int usbip_recv_iso(struct usbip_device *ud, struct urb *urb)
673{
674 void *buff;
675 struct usbip_iso_packet_descriptor *iso;
676 int np = urb->number_of_packets;
677 int size;
678 int i;
679 int ret;
680 u32 total_length = 0;
681
682 if (!usb_pipeisoc(urb->pipe))
683 return 0;
684
685 if (np <= 0 || np > USBIP_MAX_ISO_PACKETS) {
686 dev_err(&urb->dev->dev,
687 "recv iso: invalid number_of_packets %d\n", np);
688 /*
689 * usbip_pack_ret_submit() already set urb->number_of_packets
690 * from the wire. Zero it so processcompl() does not iterate
691 * OOB descriptors on the way out.
692 */
693 urb->number_of_packets = 0;
694 return -EPROTO;
695 }
696
697 size = np * sizeof(*iso);
698
699 buff = kcalloc(np, sizeof(*iso), GFP_KERNEL);
700 if (!buff)
701 return -ENOMEM;
702
703 ret = usbip_recv(ud->tcp_socket, buff, size);
704 if (ret != size) {
705 dev_err(&urb->dev->dev, "recv iso_frame_descriptor, %d\n",
706 ret);
707 kfree(buff);
708
709 if (ud->side == USBIP_STUB || ud->side == USBIP_VUDC)
710 usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
711 else
712 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
713
714 return -EPIPE;
715 }
716
717 iso = (struct usbip_iso_packet_descriptor *) buff;
718 for (i = 0; i < np; i++) {
719 usbip_iso_packet_correct_endian(&iso[i], 0);
720 usbip_pack_iso(&iso[i], &urb->iso_frame_desc[i], 0);
721 if (urb->iso_frame_desc[i].actual_length >
722 (unsigned int)urb->transfer_buffer_length) {
723 dev_err(&urb->dev->dev,
724 "recv iso: frame actual_length %u exceeds buffer %d\n",
725 urb->iso_frame_desc[i].actual_length,
726 urb->transfer_buffer_length);
727 kfree(buff);
728 return -EPROTO;
729 }
730 total_length += urb->iso_frame_desc[i].actual_length;
731 }
732
733 kfree(buff);
734
735 if (total_length != (u32)urb->actual_length) {
736 dev_err(&urb->dev->dev,
737 "total length of iso packets %u not equal to actual length of buffer %d\n",
738 total_length, urb->actual_length);
739
740 if (ud->side == USBIP_STUB || ud->side == USBIP_VUDC)
741 usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
742 else
743 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
744
745 return -EPIPE;
746 }
747
748 return ret;
749}
750EXPORT_SYMBOL_GPL(usbip_recv_iso);
751
752/*
753 * This functions restores the padding which was removed for optimizing
754 * the bandwidth during transfer over tcp/ip
755 *
756 * buffer and iso packets need to be stored and be in propeper endian in urb
757 * before calling this function
758 */
759void usbip_pad_iso(struct usbip_device *ud, struct urb *urb)
760{
761 int np = urb->number_of_packets;
762 int i;
763 int actualoffset = urb->actual_length;
764
765 if (!usb_pipeisoc(urb->pipe))
766 return;
767
768 /* if no packets or length of data is 0, then nothing to unpack */
769 if (np == 0 || urb->actual_length == 0)
770 return;
771
772 /*
773 * if actual_length is transfer_buffer_length then no padding is
774 * present.
775 */
776 if (urb->actual_length == urb->transfer_buffer_length)
777 return;
778
779 /*
780 * loop over all packets from last to first (to prevent overwriting
781 * memory when padding) and move them into the proper place
782 */
783 for (i = np-1; i > 0; i--) {
784 actualoffset -= urb->iso_frame_desc[i].actual_length;
785
786 /*
787 * Validate source range: actualoffset can go negative
788 * via crafted actual_length values from the wire.
789 */
790 if (actualoffset < 0 ||
791 (unsigned int)actualoffset >
792 (unsigned int)urb->transfer_buffer_length ||
793 urb->iso_frame_desc[i].actual_length >
794 (unsigned int)urb->transfer_buffer_length -
795 (unsigned int)actualoffset) {
796 dev_err(&urb->dev->dev,
797 "pad_iso: bad src off=%d len=%u bufsz=%d\n",
798 actualoffset,
799 urb->iso_frame_desc[i].actual_length,
800 urb->transfer_buffer_length);
801 return;
802 }
803
804 /*
805 * Validate destination range: iso_frame_desc[i].offset
806 * is wire-supplied and must not exceed the buffer.
807 */
808 if (urb->iso_frame_desc[i].offset >
809 (unsigned int)urb->transfer_buffer_length ||
810 urb->iso_frame_desc[i].actual_length >
811 (unsigned int)urb->transfer_buffer_length -
812 urb->iso_frame_desc[i].offset) {
813 dev_err(&urb->dev->dev,
814 "pad_iso: bad dst off=%u len=%u bufsz=%d\n",
815 urb->iso_frame_desc[i].offset,
816 urb->iso_frame_desc[i].actual_length,
817 urb->transfer_buffer_length);
818 return;
819 }
820
821 memmove(urb->transfer_buffer + urb->iso_frame_desc[i].offset,
822 urb->transfer_buffer + actualoffset,
823 urb->iso_frame_desc[i].actual_length);
824 }
825}
826EXPORT_SYMBOL_GPL(usbip_pad_iso);
827
828/* some members of urb must be substituted before. */
829int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb)
830{
831 struct scatterlist *sg;
832 int ret = 0;
833 int recv;
834 int size;
835 int copy;
836 int i;
837
838 if (ud->side == USBIP_STUB || ud->side == USBIP_VUDC) {
839 /* the direction of urb must be OUT. */
840 if (usb_pipein(urb->pipe))
841 return 0;
842
843 size = urb->transfer_buffer_length;
844 } else {
845 /* the direction of urb must be IN. */
846 if (usb_pipeout(urb->pipe))
847 return 0;
848
849 size = urb->actual_length;
850 }
851
852 /* no need to recv xbuff */
853 if (!(size > 0))
854 return 0;
855
856 if (size > urb->transfer_buffer_length)
857 /* should not happen, probably malicious packet */
858 goto error;
859
860 if (urb->num_sgs) {
861 copy = size;
862 for_each_sg(urb->sg, sg, urb->num_sgs, i) {
863 int recv_size;
864
865 if (copy < sg->length)
866 recv_size = copy;
867 else
868 recv_size = sg->length;
869
870 recv = usbip_recv(ud->tcp_socket, sg_virt(sg),
871 recv_size);
872
873 if (recv != recv_size)
874 goto error;
875
876 copy -= recv;
877 ret += recv;
878
879 if (!copy)
880 break;
881 }
882
883 if (ret != size)
884 goto error;
885 } else {
886 ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
887 if (ret != size)
888 goto error;
889 }
890
891 return ret;
892
893error:
894 dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret);
895 if (ud->side == USBIP_STUB || ud->side == USBIP_VUDC)
896 usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
897 else
898 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
899
900 return -EPIPE;
901}
902EXPORT_SYMBOL_GPL(usbip_recv_xbuff);
903
904static int __init usbip_core_init(void)
905{
906 return usbip_init_eh();
907}
908
909static void __exit usbip_core_exit(void)
910{
911 usbip_finish_eh();
912 return;
913}
914
915module_init(usbip_core_init);
916module_exit(usbip_core_exit);
917
918MODULE_AUTHOR(DRIVER_AUTHOR);
919MODULE_DESCRIPTION(DRIVER_DESC);
920MODULE_LICENSE("GPL");