1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * Copyright (C) 2003-2008 Takahiro Hirofuchi 4 * Copyright (C) 2015-2016 Samsung Electronics 5 * Krzysztof Opasiak <k.opasiak@samsung.com> 6 */ 7 8 #include <asm/byteorder.h> 9 #include <linux/file.h> 10 #include <linux/fs.h> 11 #include <linux/kernel.h> 12 #include <linux/slab.h> 13 #include <linux/stat.h> 14 #include <linux/module.h> 15 #include <linux/moduleparam.h> 16 #include <net/sock.h> 17 18 #include "usbip_common.h" 19 20 #define DRIVER_AUTHOR "Takahiro Hirofuchi <hirofuchi@users.sourceforge.net>" 21 #define DRIVER_DESC "USB/IP Core" 22 23 #ifdef CONFIG_USBIP_DEBUG 24 unsigned long usbip_debug_flag = 0xffffffff; 25 #else 26 unsigned long usbip_debug_flag; 27 #endif 28 EXPORT_SYMBOL_GPL(usbip_debug_flag); 29 module_param(usbip_debug_flag, ulong, S_IRUGO|S_IWUSR); 30 MODULE_PARM_DESC(usbip_debug_flag, "debug flags (defined in usbip_common.h)"); 31 32 /* FIXME */ 33 struct device_attribute dev_attr_usbip_debug; 34 EXPORT_SYMBOL_GPL(dev_attr_usbip_debug); 35 36 static ssize_t usbip_debug_show(struct device *dev, 37 struct device_attribute *attr, char *buf) 38 { 39 return sprintf(buf, "%lx\n", usbip_debug_flag); 40 } 41 42 static ssize_t usbip_debug_store(struct device *dev, 43 struct device_attribute *attr, const char *buf, 44 size_t count) 45 { 46 if (sscanf(buf, "%lx", &usbip_debug_flag) != 1) 47 return -EINVAL; 48 return count; 49 } 50 DEVICE_ATTR_RW(usbip_debug); 51 52 static void usbip_dump_buffer(char *buff, int bufflen) 53 { 54 print_hex_dump(KERN_DEBUG, "usbip-core", DUMP_PREFIX_OFFSET, 16, 4, 55 buff, bufflen, false); 56 } 57 58 static void usbip_dump_pipe(unsigned int p) 59 { 60 unsigned char type = usb_pipetype(p); 61 unsigned char ep = usb_pipeendpoint(p); 62 unsigned char dev = usb_pipedevice(p); 63 unsigned char dir = usb_pipein(p); 64 65 pr_debug("dev(%d) ep(%d) [%s] ", dev, ep, dir ? "IN" : "OUT"); 66 67 switch (type) { 68 case PIPE_ISOCHRONOUS: 69 pr_debug("ISO\n"); 70 break; 71 case PIPE_INTERRUPT: 72 pr_debug("INT\n"); 73 break; 74 case PIPE_CONTROL: 75 pr_debug("CTRL\n"); 76 break; 77 case PIPE_BULK: 78 pr_debug("BULK\n"); 79 break; 80 default: 81 pr_debug("ERR\n"); 82 break; 83 } 84 } 85 86 static void usbip_dump_usb_device(struct usb_device *udev) 87 { 88 struct device *dev = &udev->dev; 89 int i; 90 91 dev_dbg(dev, " devnum(%d) devpath(%s) usb speed(%s)", 92 udev->devnum, udev->devpath, usb_speed_string(udev->speed)); 93 94 pr_debug("tt hub ttport %d\n", udev->ttport); 95 96 dev_dbg(dev, " "); 97 for (i = 0; i < 16; i++) 98 pr_debug(" %2u", i); 99 pr_debug("\n"); 100 101 dev_dbg(dev, " toggle0(IN) :"); 102 for (i = 0; i < 16; i++) 103 pr_debug(" %2u", (udev->toggle[0] & (1 << i)) ? 1 : 0); 104 pr_debug("\n"); 105 106 dev_dbg(dev, " toggle1(OUT):"); 107 for (i = 0; i < 16; i++) 108 pr_debug(" %2u", (udev->toggle[1] & (1 << i)) ? 1 : 0); 109 pr_debug("\n"); 110 111 dev_dbg(dev, " epmaxp_in :"); 112 for (i = 0; i < 16; i++) { 113 if (udev->ep_in[i]) 114 pr_debug(" %2u", 115 le16_to_cpu(udev->ep_in[i]->desc.wMaxPacketSize)); 116 } 117 pr_debug("\n"); 118 119 dev_dbg(dev, " epmaxp_out :"); 120 for (i = 0; i < 16; i++) { 121 if (udev->ep_out[i]) 122 pr_debug(" %2u", 123 le16_to_cpu(udev->ep_out[i]->desc.wMaxPacketSize)); 124 } 125 pr_debug("\n"); 126 127 dev_dbg(dev, "parent %s, bus %s\n", dev_name(&udev->parent->dev), 128 udev->bus->bus_name); 129 130 dev_dbg(dev, "have_langid %d, string_langid %d\n", 131 udev->have_langid, udev->string_langid); 132 133 dev_dbg(dev, "maxchild %d\n", udev->maxchild); 134 } 135 136 static void usbip_dump_request_type(__u8 rt) 137 { 138 switch (rt & USB_RECIP_MASK) { 139 case USB_RECIP_DEVICE: 140 pr_debug("DEVICE"); 141 break; 142 case USB_RECIP_INTERFACE: 143 pr_debug("INTERF"); 144 break; 145 case USB_RECIP_ENDPOINT: 146 pr_debug("ENDPOI"); 147 break; 148 case USB_RECIP_OTHER: 149 pr_debug("OTHER "); 150 break; 151 default: 152 pr_debug("------"); 153 break; 154 } 155 } 156 157 static void usbip_dump_usb_ctrlrequest(struct usb_ctrlrequest *cmd) 158 { 159 if (!cmd) { 160 pr_debug(" : null pointer\n"); 161 return; 162 } 163 164 pr_debug(" "); 165 pr_debug("bRequestType(%02X) bRequest(%02X) wValue(%04X) wIndex(%04X) wLength(%04X) ", 166 cmd->bRequestType, cmd->bRequest, 167 cmd->wValue, cmd->wIndex, cmd->wLength); 168 pr_debug("\n "); 169 170 if ((cmd->bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD) { 171 pr_debug("STANDARD "); 172 switch (cmd->bRequest) { 173 case USB_REQ_GET_STATUS: 174 pr_debug("GET_STATUS\n"); 175 break; 176 case USB_REQ_CLEAR_FEATURE: 177 pr_debug("CLEAR_FEAT\n"); 178 break; 179 case USB_REQ_SET_FEATURE: 180 pr_debug("SET_FEAT\n"); 181 break; 182 case USB_REQ_SET_ADDRESS: 183 pr_debug("SET_ADDRRS\n"); 184 break; 185 case USB_REQ_GET_DESCRIPTOR: 186 pr_debug("GET_DESCRI\n"); 187 break; 188 case USB_REQ_SET_DESCRIPTOR: 189 pr_debug("SET_DESCRI\n"); 190 break; 191 case USB_REQ_GET_CONFIGURATION: 192 pr_debug("GET_CONFIG\n"); 193 break; 194 case USB_REQ_SET_CONFIGURATION: 195 pr_debug("SET_CONFIG\n"); 196 break; 197 case USB_REQ_GET_INTERFACE: 198 pr_debug("GET_INTERF\n"); 199 break; 200 case USB_REQ_SET_INTERFACE: 201 pr_debug("SET_INTERF\n"); 202 break; 203 case USB_REQ_SYNCH_FRAME: 204 pr_debug("SYNC_FRAME\n"); 205 break; 206 default: 207 pr_debug("REQ(%02X)\n", cmd->bRequest); 208 break; 209 } 210 usbip_dump_request_type(cmd->bRequestType); 211 } else if ((cmd->bRequestType & USB_TYPE_MASK) == USB_TYPE_CLASS) { 212 pr_debug("CLASS\n"); 213 } else if ((cmd->bRequestType & USB_TYPE_MASK) == USB_TYPE_VENDOR) { 214 pr_debug("VENDOR\n"); 215 } else if ((cmd->bRequestType & USB_TYPE_MASK) == USB_TYPE_RESERVED) { 216 pr_debug("RESERVED\n"); 217 } 218 } 219 220 void usbip_dump_urb(struct urb *urb) 221 { 222 struct device *dev; 223 224 if (!urb) { 225 pr_debug("urb: null pointer!!\n"); 226 return; 227 } 228 229 if (!urb->dev) { 230 pr_debug("urb->dev: null pointer!!\n"); 231 return; 232 } 233 234 dev = &urb->dev->dev; 235 236 usbip_dump_usb_device(urb->dev); 237 238 dev_dbg(dev, " pipe :%08x ", urb->pipe); 239 240 usbip_dump_pipe(urb->pipe); 241 242 dev_dbg(dev, " status :%d\n", urb->status); 243 dev_dbg(dev, " transfer_flags :%08X\n", urb->transfer_flags); 244 dev_dbg(dev, " transfer_buffer_length:%d\n", 245 urb->transfer_buffer_length); 246 dev_dbg(dev, " actual_length :%d\n", urb->actual_length); 247 248 if (urb->setup_packet && usb_pipetype(urb->pipe) == PIPE_CONTROL) 249 usbip_dump_usb_ctrlrequest( 250 (struct usb_ctrlrequest *)urb->setup_packet); 251 252 dev_dbg(dev, " start_frame :%d\n", urb->start_frame); 253 dev_dbg(dev, " number_of_packets :%d\n", urb->number_of_packets); 254 dev_dbg(dev, " interval :%d\n", urb->interval); 255 dev_dbg(dev, " error_count :%d\n", urb->error_count); 256 } 257 EXPORT_SYMBOL_GPL(usbip_dump_urb); 258 259 void usbip_dump_header(struct usbip_header *pdu) 260 { 261 pr_debug("BASE: cmd %u seq %u devid %u dir %u ep %u\n", 262 pdu->base.command, 263 pdu->base.seqnum, 264 pdu->base.devid, 265 pdu->base.direction, 266 pdu->base.ep); 267 268 switch (pdu->base.command) { 269 case USBIP_CMD_SUBMIT: 270 pr_debug("USBIP_CMD_SUBMIT: x_flags %u x_len %u sf %u #p %d iv %d\n", 271 pdu->u.cmd_submit.transfer_flags, 272 pdu->u.cmd_submit.transfer_buffer_length, 273 pdu->u.cmd_submit.start_frame, 274 pdu->u.cmd_submit.number_of_packets, 275 pdu->u.cmd_submit.interval); 276 break; 277 case USBIP_CMD_UNLINK: 278 pr_debug("USBIP_CMD_UNLINK: seq %u\n", 279 pdu->u.cmd_unlink.seqnum); 280 break; 281 case USBIP_RET_SUBMIT: 282 pr_debug("USBIP_RET_SUBMIT: st %d al %u sf %d #p %d ec %d\n", 283 pdu->u.ret_submit.status, 284 pdu->u.ret_submit.actual_length, 285 pdu->u.ret_submit.start_frame, 286 pdu->u.ret_submit.number_of_packets, 287 pdu->u.ret_submit.error_count); 288 break; 289 case USBIP_RET_UNLINK: 290 pr_debug("USBIP_RET_UNLINK: status %d\n", 291 pdu->u.ret_unlink.status); 292 break; 293 default: 294 /* NOT REACHED */ 295 pr_err("unknown command\n"); 296 break; 297 } 298 } 299 EXPORT_SYMBOL_GPL(usbip_dump_header); 300 301 /* Receive data over TCP/IP. */ 302 int usbip_recv(struct socket *sock, void *buf, int size) 303 { 304 int result; 305 struct kvec iov = {.iov_base = buf, .iov_len = size}; 306 struct msghdr msg = {.msg_flags = MSG_NOSIGNAL}; 307 int total = 0; 308 309 if (!sock || !buf || !size) 310 return -EINVAL; 311 312 iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, size); 313 314 usbip_dbg_xmit("enter\n"); 315 316 do { 317 sock->sk->sk_allocation = GFP_NOIO; 318 sock->sk->sk_use_task_frag = false; 319 320 result = sock_recvmsg(sock, &msg, MSG_WAITALL); 321 if (result <= 0) 322 goto err; 323 324 total += result; 325 } while (msg_data_left(&msg)); 326 327 if (usbip_dbg_flag_xmit) { 328 pr_debug("receiving....\n"); 329 usbip_dump_buffer(buf, size); 330 pr_debug("received, osize %d ret %d size %zd total %d\n", 331 size, result, msg_data_left(&msg), total); 332 } 333 334 return total; 335 336 err: 337 return result; 338 } 339 EXPORT_SYMBOL_GPL(usbip_recv); 340 341 /* there may be more cases to tweak the flags. */ 342 static unsigned int tweak_transfer_flags(unsigned int flags) 343 { 344 flags &= ~URB_NO_TRANSFER_DMA_MAP; 345 return flags; 346 } 347 348 /* 349 * USBIP driver packs URB transfer flags in PDUs that are exchanged 350 * between Server (usbip_host) and Client (vhci_hcd). URB_* flags 351 * are internal to kernel and could change. Where as USBIP URB flags 352 * exchanged in PDUs are USBIP user API must not change. 353 * 354 * USBIP_URB* flags are exported as explicit API and client and server 355 * do mapping from kernel flags to USBIP_URB*. Details as follows: 356 * 357 * Client tx path (USBIP_CMD_SUBMIT): 358 * - Maps URB_* to USBIP_URB_* when it sends USBIP_CMD_SUBMIT packet. 359 * 360 * Server rx path (USBIP_CMD_SUBMIT): 361 * - Maps USBIP_URB_* to URB_* when it receives USBIP_CMD_SUBMIT packet. 362 * 363 * Flags aren't included in USBIP_CMD_UNLINK and USBIP_RET_SUBMIT packets 364 * and no special handling is needed for them in the following cases: 365 * - Server rx path (USBIP_CMD_UNLINK) 366 * - Client rx path & Server tx path (USBIP_RET_SUBMIT) 367 * 368 * Code paths: 369 * usbip_pack_pdu() is the common routine that handles packing pdu from 370 * urb and unpack pdu to an urb. 371 * 372 * usbip_pack_cmd_submit() and usbip_pack_ret_submit() handle 373 * USBIP_CMD_SUBMIT and USBIP_RET_SUBMIT respectively. 374 * 375 * usbip_map_urb_to_usbip() and usbip_map_usbip_to_urb() are used 376 * by usbip_pack_cmd_submit() and usbip_pack_ret_submit() to map 377 * flags. 378 */ 379 380 struct urb_to_usbip_flags { 381 u32 urb_flag; 382 u32 usbip_flag; 383 }; 384 385 #define NUM_USBIP_FLAGS 17 386 387 static const struct urb_to_usbip_flags flag_map[NUM_USBIP_FLAGS] = { 388 {URB_SHORT_NOT_OK, USBIP_URB_SHORT_NOT_OK}, 389 {URB_ISO_ASAP, USBIP_URB_ISO_ASAP}, 390 {URB_NO_TRANSFER_DMA_MAP, USBIP_URB_NO_TRANSFER_DMA_MAP}, 391 {URB_ZERO_PACKET, USBIP_URB_ZERO_PACKET}, 392 {URB_NO_INTERRUPT, USBIP_URB_NO_INTERRUPT}, 393 {URB_FREE_BUFFER, USBIP_URB_FREE_BUFFER}, 394 {URB_DIR_IN, USBIP_URB_DIR_IN}, 395 {URB_DIR_OUT, USBIP_URB_DIR_OUT}, 396 {URB_DIR_MASK, USBIP_URB_DIR_MASK}, 397 {URB_DMA_MAP_SINGLE, USBIP_URB_DMA_MAP_SINGLE}, 398 {URB_DMA_MAP_PAGE, USBIP_URB_DMA_MAP_PAGE}, 399 {URB_DMA_MAP_SG, USBIP_URB_DMA_MAP_SG}, 400 {URB_MAP_LOCAL, USBIP_URB_MAP_LOCAL}, 401 {URB_SETUP_MAP_SINGLE, USBIP_URB_SETUP_MAP_SINGLE}, 402 {URB_SETUP_MAP_LOCAL, USBIP_URB_SETUP_MAP_LOCAL}, 403 {URB_DMA_SG_COMBINED, USBIP_URB_DMA_SG_COMBINED}, 404 {URB_ALIGNED_TEMP_BUFFER, USBIP_URB_ALIGNED_TEMP_BUFFER}, 405 }; 406 407 static unsigned int urb_to_usbip(unsigned int flags) 408 { 409 unsigned int map_flags = 0; 410 int loop; 411 412 for (loop = 0; loop < NUM_USBIP_FLAGS; loop++) { 413 if (flags & flag_map[loop].urb_flag) 414 map_flags |= flag_map[loop].usbip_flag; 415 } 416 417 return map_flags; 418 } 419 420 static unsigned int usbip_to_urb(unsigned int flags) 421 { 422 unsigned int map_flags = 0; 423 int loop; 424 425 for (loop = 0; loop < NUM_USBIP_FLAGS; loop++) { 426 if (flags & flag_map[loop].usbip_flag) 427 map_flags |= flag_map[loop].urb_flag; 428 } 429 430 return map_flags; 431 } 432 433 static void usbip_pack_cmd_submit(struct usbip_header *pdu, struct urb *urb, 434 int pack) 435 { 436 struct usbip_header_cmd_submit *spdu = &pdu->u.cmd_submit; 437 438 /* 439 * Some members are not still implemented in usbip. I hope this issue 440 * will be discussed when usbip is ported to other operating systems. 441 */ 442 if (pack) { 443 /* map after tweaking the urb flags */ 444 spdu->transfer_flags = urb_to_usbip(tweak_transfer_flags(urb->transfer_flags)); 445 spdu->transfer_buffer_length = urb->transfer_buffer_length; 446 spdu->start_frame = urb->start_frame; 447 spdu->number_of_packets = urb->number_of_packets; 448 spdu->interval = urb->interval; 449 } else { 450 urb->transfer_flags = usbip_to_urb(spdu->transfer_flags); 451 urb->transfer_buffer_length = spdu->transfer_buffer_length; 452 urb->start_frame = spdu->start_frame; 453 urb->number_of_packets = spdu->number_of_packets; 454 urb->interval = spdu->interval; 455 } 456 } 457 458 static void usbip_pack_ret_submit(struct usbip_header *pdu, struct urb *urb, 459 int pack) 460 { 461 struct usbip_header_ret_submit *rpdu = &pdu->u.ret_submit; 462 463 if (pack) { 464 rpdu->status = urb->status; 465 rpdu->actual_length = urb->actual_length; 466 rpdu->start_frame = urb->start_frame; 467 rpdu->number_of_packets = urb->number_of_packets; 468 rpdu->error_count = urb->error_count; 469 } else { 470 urb->status = rpdu->status; 471 urb->actual_length = rpdu->actual_length; 472 urb->start_frame = rpdu->start_frame; 473 /* 474 * The number_of_packets field determines the length of 475 * iso_frame_desc[], which is a flexible array allocated 476 * at URB creation time. A response must never claim more 477 * packets than originally submitted; doing so would cause 478 * an out-of-bounds write in usbip_recv_iso() and 479 * usbip_pad_iso(). Clamp to zero on violation so both 480 * functions safely return early. 481 */ 482 if (rpdu->number_of_packets < 0 || 483 rpdu->number_of_packets > urb->number_of_packets) 484 rpdu->number_of_packets = 0; 485 urb->number_of_packets = rpdu->number_of_packets; 486 urb->error_count = rpdu->error_count; 487 } 488 } 489 490 void usbip_pack_pdu(struct usbip_header *pdu, struct urb *urb, int cmd, 491 int pack) 492 { 493 switch (cmd) { 494 case USBIP_CMD_SUBMIT: 495 usbip_pack_cmd_submit(pdu, urb, pack); 496 break; 497 case USBIP_RET_SUBMIT: 498 usbip_pack_ret_submit(pdu, urb, pack); 499 break; 500 default: 501 /* NOT REACHED */ 502 pr_err("unknown command\n"); 503 break; 504 } 505 } 506 EXPORT_SYMBOL_GPL(usbip_pack_pdu); 507 508 static void correct_endian_basic(struct usbip_header_basic *base, int send) 509 { 510 if (send) { 511 base->command = cpu_to_be32(base->command); 512 base->seqnum = cpu_to_be32(base->seqnum); 513 base->devid = cpu_to_be32(base->devid); 514 base->direction = cpu_to_be32(base->direction); 515 base->ep = cpu_to_be32(base->ep); 516 } else { 517 base->command = be32_to_cpu(base->command); 518 base->seqnum = be32_to_cpu(base->seqnum); 519 base->devid = be32_to_cpu(base->devid); 520 base->direction = be32_to_cpu(base->direction); 521 base->ep = be32_to_cpu(base->ep); 522 } 523 } 524 525 static void correct_endian_cmd_submit(struct usbip_header_cmd_submit *pdu, 526 int send) 527 { 528 if (send) { 529 pdu->transfer_flags = cpu_to_be32(pdu->transfer_flags); 530 531 cpu_to_be32s(&pdu->transfer_buffer_length); 532 cpu_to_be32s(&pdu->start_frame); 533 cpu_to_be32s(&pdu->number_of_packets); 534 cpu_to_be32s(&pdu->interval); 535 } else { 536 pdu->transfer_flags = be32_to_cpu(pdu->transfer_flags); 537 538 be32_to_cpus(&pdu->transfer_buffer_length); 539 be32_to_cpus(&pdu->start_frame); 540 be32_to_cpus(&pdu->number_of_packets); 541 be32_to_cpus(&pdu->interval); 542 } 543 } 544 545 static void correct_endian_ret_submit(struct usbip_header_ret_submit *pdu, 546 int send) 547 { 548 if (send) { 549 cpu_to_be32s(&pdu->status); 550 cpu_to_be32s(&pdu->actual_length); 551 cpu_to_be32s(&pdu->start_frame); 552 cpu_to_be32s(&pdu->number_of_packets); 553 cpu_to_be32s(&pdu->error_count); 554 } else { 555 be32_to_cpus(&pdu->status); 556 be32_to_cpus(&pdu->actual_length); 557 be32_to_cpus(&pdu->start_frame); 558 be32_to_cpus(&pdu->number_of_packets); 559 be32_to_cpus(&pdu->error_count); 560 } 561 } 562 563 static void correct_endian_cmd_unlink(struct usbip_header_cmd_unlink *pdu, 564 int send) 565 { 566 if (send) 567 pdu->seqnum = cpu_to_be32(pdu->seqnum); 568 else 569 pdu->seqnum = be32_to_cpu(pdu->seqnum); 570 } 571 572 static void correct_endian_ret_unlink(struct usbip_header_ret_unlink *pdu, 573 int send) 574 { 575 if (send) 576 cpu_to_be32s(&pdu->status); 577 else 578 be32_to_cpus(&pdu->status); 579 } 580 581 void usbip_header_correct_endian(struct usbip_header *pdu, int send) 582 { 583 __u32 cmd = 0; 584 585 if (send) 586 cmd = pdu->base.command; 587 588 correct_endian_basic(&pdu->base, send); 589 590 if (!send) 591 cmd = pdu->base.command; 592 593 switch (cmd) { 594 case USBIP_CMD_SUBMIT: 595 correct_endian_cmd_submit(&pdu->u.cmd_submit, send); 596 break; 597 case USBIP_RET_SUBMIT: 598 correct_endian_ret_submit(&pdu->u.ret_submit, send); 599 break; 600 case USBIP_CMD_UNLINK: 601 correct_endian_cmd_unlink(&pdu->u.cmd_unlink, send); 602 break; 603 case USBIP_RET_UNLINK: 604 correct_endian_ret_unlink(&pdu->u.ret_unlink, send); 605 break; 606 default: 607 /* NOT REACHED */ 608 pr_err("unknown command\n"); 609 break; 610 } 611 } 612 EXPORT_SYMBOL_GPL(usbip_header_correct_endian); 613 614 static void usbip_iso_packet_correct_endian( 615 struct usbip_iso_packet_descriptor *iso, int send) 616 { 617 /* does not need all members. but copy all simply. */ 618 if (send) { 619 iso->offset = cpu_to_be32(iso->offset); 620 iso->length = cpu_to_be32(iso->length); 621 iso->status = cpu_to_be32(iso->status); 622 iso->actual_length = cpu_to_be32(iso->actual_length); 623 } else { 624 iso->offset = be32_to_cpu(iso->offset); 625 iso->length = be32_to_cpu(iso->length); 626 iso->status = be32_to_cpu(iso->status); 627 iso->actual_length = be32_to_cpu(iso->actual_length); 628 } 629 } 630 631 static void usbip_pack_iso(struct usbip_iso_packet_descriptor *iso, 632 struct usb_iso_packet_descriptor *uiso, int pack) 633 { 634 if (pack) { 635 iso->offset = uiso->offset; 636 iso->length = uiso->length; 637 iso->status = uiso->status; 638 iso->actual_length = uiso->actual_length; 639 } else { 640 uiso->offset = iso->offset; 641 uiso->length = iso->length; 642 uiso->status = iso->status; 643 uiso->actual_length = iso->actual_length; 644 } 645 } 646 647 /* must free buffer */ 648 struct usbip_iso_packet_descriptor* 649 usbip_alloc_iso_desc_pdu(struct urb *urb, ssize_t *bufflen) 650 { 651 struct usbip_iso_packet_descriptor *iso; 652 int np = urb->number_of_packets; 653 ssize_t size = np * sizeof(*iso); 654 int i; 655 656 iso = kzalloc(size, GFP_KERNEL); 657 if (!iso) 658 return NULL; 659 660 for (i = 0; i < np; i++) { 661 usbip_pack_iso(&iso[i], &urb->iso_frame_desc[i], 1); 662 usbip_iso_packet_correct_endian(&iso[i], 1); 663 } 664 665 *bufflen = size; 666 667 return iso; 668 } 669 EXPORT_SYMBOL_GPL(usbip_alloc_iso_desc_pdu); 670 671 /* some members of urb must be substituted before. */ 672 int usbip_recv_iso(struct usbip_device *ud, struct urb *urb) 673 { 674 void *buff; 675 struct usbip_iso_packet_descriptor *iso; 676 int np = urb->number_of_packets; 677 int size; 678 int i; 679 int ret; 680 u32 total_length = 0; 681 682 if (!usb_pipeisoc(urb->pipe)) 683 return 0; 684 685 if (np <= 0 || np > USBIP_MAX_ISO_PACKETS) { 686 dev_err(&urb->dev->dev, 687 "recv iso: invalid number_of_packets %d\n", np); 688 /* 689 * usbip_pack_ret_submit() already set urb->number_of_packets 690 * from the wire. Zero it so processcompl() does not iterate 691 * OOB descriptors on the way out. 692 */ 693 urb->number_of_packets = 0; 694 return -EPROTO; 695 } 696 697 size = np * sizeof(*iso); 698 699 buff = kcalloc(np, sizeof(*iso), GFP_KERNEL); 700 if (!buff) 701 return -ENOMEM; 702 703 ret = usbip_recv(ud->tcp_socket, buff, size); 704 if (ret != size) { 705 dev_err(&urb->dev->dev, "recv iso_frame_descriptor, %d\n", 706 ret); 707 kfree(buff); 708 709 if (ud->side == USBIP_STUB || ud->side == USBIP_VUDC) 710 usbip_event_add(ud, SDEV_EVENT_ERROR_TCP); 711 else 712 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP); 713 714 return -EPIPE; 715 } 716 717 iso = (struct usbip_iso_packet_descriptor *) buff; 718 for (i = 0; i < np; i++) { 719 usbip_iso_packet_correct_endian(&iso[i], 0); 720 usbip_pack_iso(&iso[i], &urb->iso_frame_desc[i], 0); 721 if (urb->iso_frame_desc[i].actual_length > 722 (unsigned int)urb->transfer_buffer_length) { 723 dev_err(&urb->dev->dev, 724 "recv iso: frame actual_length %u exceeds buffer %d\n", 725 urb->iso_frame_desc[i].actual_length, 726 urb->transfer_buffer_length); 727 kfree(buff); 728 return -EPROTO; 729 } 730 total_length += urb->iso_frame_desc[i].actual_length; 731 } 732 733 kfree(buff); 734 735 if (total_length != (u32)urb->actual_length) { 736 dev_err(&urb->dev->dev, 737 "total length of iso packets %u not equal to actual length of buffer %d\n", 738 total_length, urb->actual_length); 739 740 if (ud->side == USBIP_STUB || ud->side == USBIP_VUDC) 741 usbip_event_add(ud, SDEV_EVENT_ERROR_TCP); 742 else 743 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP); 744 745 return -EPIPE; 746 } 747 748 return ret; 749 } 750 EXPORT_SYMBOL_GPL(usbip_recv_iso); 751 752 /* 753 * This functions restores the padding which was removed for optimizing 754 * the bandwidth during transfer over tcp/ip 755 * 756 * buffer and iso packets need to be stored and be in propeper endian in urb 757 * before calling this function 758 */ 759 void usbip_pad_iso(struct usbip_device *ud, struct urb *urb) 760 { 761 int np = urb->number_of_packets; 762 int i; 763 int actualoffset = urb->actual_length; 764 765 if (!usb_pipeisoc(urb->pipe)) 766 return; 767 768 /* if no packets or length of data is 0, then nothing to unpack */ 769 if (np == 0 || urb->actual_length == 0) 770 return; 771 772 /* 773 * if actual_length is transfer_buffer_length then no padding is 774 * present. 775 */ 776 if (urb->actual_length == urb->transfer_buffer_length) 777 return; 778 779 /* 780 * loop over all packets from last to first (to prevent overwriting 781 * memory when padding) and move them into the proper place 782 */ 783 for (i = np-1; i > 0; i--) { 784 actualoffset -= urb->iso_frame_desc[i].actual_length; 785 786 /* 787 * Validate source range: actualoffset can go negative 788 * via crafted actual_length values from the wire. 789 */ 790 if (actualoffset < 0 || 791 (unsigned int)actualoffset > 792 (unsigned int)urb->transfer_buffer_length || 793 urb->iso_frame_desc[i].actual_length > 794 (unsigned int)urb->transfer_buffer_length - 795 (unsigned int)actualoffset) { 796 dev_err(&urb->dev->dev, 797 "pad_iso: bad src off=%d len=%u bufsz=%d\n", 798 actualoffset, 799 urb->iso_frame_desc[i].actual_length, 800 urb->transfer_buffer_length); 801 return; 802 } 803 804 /* 805 * Validate destination range: iso_frame_desc[i].offset 806 * is wire-supplied and must not exceed the buffer. 807 */ 808 if (urb->iso_frame_desc[i].offset > 809 (unsigned int)urb->transfer_buffer_length || 810 urb->iso_frame_desc[i].actual_length > 811 (unsigned int)urb->transfer_buffer_length - 812 urb->iso_frame_desc[i].offset) { 813 dev_err(&urb->dev->dev, 814 "pad_iso: bad dst off=%u len=%u bufsz=%d\n", 815 urb->iso_frame_desc[i].offset, 816 urb->iso_frame_desc[i].actual_length, 817 urb->transfer_buffer_length); 818 return; 819 } 820 821 memmove(urb->transfer_buffer + urb->iso_frame_desc[i].offset, 822 urb->transfer_buffer + actualoffset, 823 urb->iso_frame_desc[i].actual_length); 824 } 825 } 826 EXPORT_SYMBOL_GPL(usbip_pad_iso); 827 828 /* some members of urb must be substituted before. */ 829 int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) 830 { 831 struct scatterlist *sg; 832 int ret = 0; 833 int recv; 834 int size; 835 int copy; 836 int i; 837 838 if (ud->side == USBIP_STUB || ud->side == USBIP_VUDC) { 839 /* the direction of urb must be OUT. */ 840 if (usb_pipein(urb->pipe)) 841 return 0; 842 843 size = urb->transfer_buffer_length; 844 } else { 845 /* the direction of urb must be IN. */ 846 if (usb_pipeout(urb->pipe)) 847 return 0; 848 849 size = urb->actual_length; 850 } 851 852 /* no need to recv xbuff */ 853 if (!(size > 0)) 854 return 0; 855 856 if (size > urb->transfer_buffer_length) 857 /* should not happen, probably malicious packet */ 858 goto error; 859 860 if (urb->num_sgs) { 861 copy = size; 862 for_each_sg(urb->sg, sg, urb->num_sgs, i) { 863 int recv_size; 864 865 if (copy < sg->length) 866 recv_size = copy; 867 else 868 recv_size = sg->length; 869 870 recv = usbip_recv(ud->tcp_socket, sg_virt(sg), 871 recv_size); 872 873 if (recv != recv_size) 874 goto error; 875 876 copy -= recv; 877 ret += recv; 878 879 if (!copy) 880 break; 881 } 882 883 if (ret != size) 884 goto error; 885 } else { 886 ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size); 887 if (ret != size) 888 goto error; 889 } 890 891 return ret; 892 893 error: 894 dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret); 895 if (ud->side == USBIP_STUB || ud->side == USBIP_VUDC) 896 usbip_event_add(ud, SDEV_EVENT_ERROR_TCP); 897 else 898 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP); 899 900 return -EPIPE; 901 } 902 EXPORT_SYMBOL_GPL(usbip_recv_xbuff); 903 904 static int __init usbip_core_init(void) 905 { 906 return usbip_init_eh(); 907 } 908 909 static void __exit usbip_core_exit(void) 910 { 911 usbip_finish_eh(); 912 return; 913 } 914 915 module_init(usbip_core_init); 916 module_exit(usbip_core_exit); 917 918 MODULE_AUTHOR(DRIVER_AUTHOR); 919 MODULE_DESCRIPTION(DRIVER_DESC); 920 MODULE_LICENSE("GPL"); 921