inet: frag: enforce memory limits earlier
[linux/fpc-iii.git] / drivers / usb / gadget / function / f_phonet.c
blob0473d619d5bf64d23154527ee597cc62706ada7c
1 /*
2 * f_phonet.c -- USB CDC Phonet function
4 * Copyright (C) 2007-2008 Nokia Corporation. All rights reserved.
6 * Author: Rémi Denis-Courmont
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * version 2 as published by the Free Software Foundation.
13 #include <linux/mm.h>
14 #include <linux/slab.h>
15 #include <linux/kernel.h>
16 #include <linux/module.h>
17 #include <linux/device.h>
19 #include <linux/netdevice.h>
20 #include <linux/if_ether.h>
21 #include <linux/if_phonet.h>
22 #include <linux/if_arp.h>
24 #include <linux/usb/ch9.h>
25 #include <linux/usb/cdc.h>
26 #include <linux/usb/composite.h>
28 #include "u_phonet.h"
29 #include "u_ether.h"
31 #define PN_MEDIA_USB 0x1B
32 #define MAXPACKET 512
33 #if (PAGE_SIZE % MAXPACKET)
34 #error MAXPACKET must divide PAGE_SIZE!
35 #endif
37 /*-------------------------------------------------------------------------*/
39 struct phonet_port {
40 struct f_phonet *usb;
41 spinlock_t lock;
44 struct f_phonet {
45 struct usb_function function;
46 struct {
47 struct sk_buff *skb;
48 spinlock_t lock;
49 } rx;
50 struct net_device *dev;
51 struct usb_ep *in_ep, *out_ep;
53 struct usb_request *in_req;
54 struct usb_request *out_reqv[0];
57 static int phonet_rxq_size = 17;
59 static inline struct f_phonet *func_to_pn(struct usb_function *f)
61 return container_of(f, struct f_phonet, function);
64 /*-------------------------------------------------------------------------*/
66 #define USB_CDC_SUBCLASS_PHONET 0xfe
67 #define USB_CDC_PHONET_TYPE 0xab
69 static struct usb_interface_descriptor
70 pn_control_intf_desc = {
71 .bLength = sizeof pn_control_intf_desc,
72 .bDescriptorType = USB_DT_INTERFACE,
74 /* .bInterfaceNumber = DYNAMIC, */
75 .bInterfaceClass = USB_CLASS_COMM,
76 .bInterfaceSubClass = USB_CDC_SUBCLASS_PHONET,
79 static const struct usb_cdc_header_desc
80 pn_header_desc = {
81 .bLength = sizeof pn_header_desc,
82 .bDescriptorType = USB_DT_CS_INTERFACE,
83 .bDescriptorSubType = USB_CDC_HEADER_TYPE,
84 .bcdCDC = cpu_to_le16(0x0110),
87 static const struct usb_cdc_header_desc
88 pn_phonet_desc = {
89 .bLength = sizeof pn_phonet_desc,
90 .bDescriptorType = USB_DT_CS_INTERFACE,
91 .bDescriptorSubType = USB_CDC_PHONET_TYPE,
92 .bcdCDC = cpu_to_le16(0x1505), /* ??? */
95 static struct usb_cdc_union_desc
96 pn_union_desc = {
97 .bLength = sizeof pn_union_desc,
98 .bDescriptorType = USB_DT_CS_INTERFACE,
99 .bDescriptorSubType = USB_CDC_UNION_TYPE,
101 /* .bMasterInterface0 = DYNAMIC, */
102 /* .bSlaveInterface0 = DYNAMIC, */
105 static struct usb_interface_descriptor
106 pn_data_nop_intf_desc = {
107 .bLength = sizeof pn_data_nop_intf_desc,
108 .bDescriptorType = USB_DT_INTERFACE,
110 /* .bInterfaceNumber = DYNAMIC, */
111 .bAlternateSetting = 0,
112 .bNumEndpoints = 0,
113 .bInterfaceClass = USB_CLASS_CDC_DATA,
116 static struct usb_interface_descriptor
117 pn_data_intf_desc = {
118 .bLength = sizeof pn_data_intf_desc,
119 .bDescriptorType = USB_DT_INTERFACE,
121 /* .bInterfaceNumber = DYNAMIC, */
122 .bAlternateSetting = 1,
123 .bNumEndpoints = 2,
124 .bInterfaceClass = USB_CLASS_CDC_DATA,
127 static struct usb_endpoint_descriptor
128 pn_fs_sink_desc = {
129 .bLength = USB_DT_ENDPOINT_SIZE,
130 .bDescriptorType = USB_DT_ENDPOINT,
132 .bEndpointAddress = USB_DIR_OUT,
133 .bmAttributes = USB_ENDPOINT_XFER_BULK,
136 static struct usb_endpoint_descriptor
137 pn_hs_sink_desc = {
138 .bLength = USB_DT_ENDPOINT_SIZE,
139 .bDescriptorType = USB_DT_ENDPOINT,
141 .bEndpointAddress = USB_DIR_OUT,
142 .bmAttributes = USB_ENDPOINT_XFER_BULK,
143 .wMaxPacketSize = cpu_to_le16(MAXPACKET),
146 static struct usb_endpoint_descriptor
147 pn_fs_source_desc = {
148 .bLength = USB_DT_ENDPOINT_SIZE,
149 .bDescriptorType = USB_DT_ENDPOINT,
151 .bEndpointAddress = USB_DIR_IN,
152 .bmAttributes = USB_ENDPOINT_XFER_BULK,
155 static struct usb_endpoint_descriptor
156 pn_hs_source_desc = {
157 .bLength = USB_DT_ENDPOINT_SIZE,
158 .bDescriptorType = USB_DT_ENDPOINT,
160 .bEndpointAddress = USB_DIR_IN,
161 .bmAttributes = USB_ENDPOINT_XFER_BULK,
162 .wMaxPacketSize = cpu_to_le16(512),
165 static struct usb_descriptor_header *fs_pn_function[] = {
166 (struct usb_descriptor_header *) &pn_control_intf_desc,
167 (struct usb_descriptor_header *) &pn_header_desc,
168 (struct usb_descriptor_header *) &pn_phonet_desc,
169 (struct usb_descriptor_header *) &pn_union_desc,
170 (struct usb_descriptor_header *) &pn_data_nop_intf_desc,
171 (struct usb_descriptor_header *) &pn_data_intf_desc,
172 (struct usb_descriptor_header *) &pn_fs_sink_desc,
173 (struct usb_descriptor_header *) &pn_fs_source_desc,
174 NULL,
177 static struct usb_descriptor_header *hs_pn_function[] = {
178 (struct usb_descriptor_header *) &pn_control_intf_desc,
179 (struct usb_descriptor_header *) &pn_header_desc,
180 (struct usb_descriptor_header *) &pn_phonet_desc,
181 (struct usb_descriptor_header *) &pn_union_desc,
182 (struct usb_descriptor_header *) &pn_data_nop_intf_desc,
183 (struct usb_descriptor_header *) &pn_data_intf_desc,
184 (struct usb_descriptor_header *) &pn_hs_sink_desc,
185 (struct usb_descriptor_header *) &pn_hs_source_desc,
186 NULL,
189 /*-------------------------------------------------------------------------*/
191 static int pn_net_open(struct net_device *dev)
193 netif_wake_queue(dev);
194 return 0;
197 static int pn_net_close(struct net_device *dev)
199 netif_stop_queue(dev);
200 return 0;
203 static void pn_tx_complete(struct usb_ep *ep, struct usb_request *req)
205 struct f_phonet *fp = ep->driver_data;
206 struct net_device *dev = fp->dev;
207 struct sk_buff *skb = req->context;
209 switch (req->status) {
210 case 0:
211 dev->stats.tx_packets++;
212 dev->stats.tx_bytes += skb->len;
213 break;
215 case -ESHUTDOWN: /* disconnected */
216 case -ECONNRESET: /* disabled */
217 dev->stats.tx_aborted_errors++;
218 default:
219 dev->stats.tx_errors++;
222 dev_kfree_skb_any(skb);
223 netif_wake_queue(dev);
226 static int pn_net_xmit(struct sk_buff *skb, struct net_device *dev)
228 struct phonet_port *port = netdev_priv(dev);
229 struct f_phonet *fp;
230 struct usb_request *req;
231 unsigned long flags;
233 if (skb->protocol != htons(ETH_P_PHONET))
234 goto out;
236 spin_lock_irqsave(&port->lock, flags);
237 fp = port->usb;
238 if (unlikely(!fp)) /* race with carrier loss */
239 goto out_unlock;
241 req = fp->in_req;
242 req->buf = skb->data;
243 req->length = skb->len;
244 req->complete = pn_tx_complete;
245 req->zero = 1;
246 req->context = skb;
248 if (unlikely(usb_ep_queue(fp->in_ep, req, GFP_ATOMIC)))
249 goto out_unlock;
251 netif_stop_queue(dev);
252 skb = NULL;
254 out_unlock:
255 spin_unlock_irqrestore(&port->lock, flags);
256 out:
257 if (unlikely(skb)) {
258 dev_kfree_skb(skb);
259 dev->stats.tx_dropped++;
261 return NETDEV_TX_OK;
264 static int pn_net_mtu(struct net_device *dev, int new_mtu)
266 if ((new_mtu < PHONET_MIN_MTU) || (new_mtu > PHONET_MAX_MTU))
267 return -EINVAL;
268 dev->mtu = new_mtu;
269 return 0;
272 static const struct net_device_ops pn_netdev_ops = {
273 .ndo_open = pn_net_open,
274 .ndo_stop = pn_net_close,
275 .ndo_start_xmit = pn_net_xmit,
276 .ndo_change_mtu = pn_net_mtu,
279 static void pn_net_setup(struct net_device *dev)
281 dev->features = 0;
282 dev->type = ARPHRD_PHONET;
283 dev->flags = IFF_POINTOPOINT | IFF_NOARP;
284 dev->mtu = PHONET_DEV_MTU;
285 dev->hard_header_len = 1;
286 dev->dev_addr[0] = PN_MEDIA_USB;
287 dev->addr_len = 1;
288 dev->tx_queue_len = 1;
290 dev->netdev_ops = &pn_netdev_ops;
291 dev->destructor = free_netdev;
292 dev->header_ops = &phonet_header_ops;
295 /*-------------------------------------------------------------------------*/
298 * Queue buffer for data from the host
300 static int
301 pn_rx_submit(struct f_phonet *fp, struct usb_request *req, gfp_t gfp_flags)
303 struct page *page;
304 int err;
306 page = __dev_alloc_page(gfp_flags | __GFP_NOMEMALLOC);
307 if (!page)
308 return -ENOMEM;
310 req->buf = page_address(page);
311 req->length = PAGE_SIZE;
312 req->context = page;
314 err = usb_ep_queue(fp->out_ep, req, gfp_flags);
315 if (unlikely(err))
316 put_page(page);
317 return err;
320 static void pn_rx_complete(struct usb_ep *ep, struct usb_request *req)
322 struct f_phonet *fp = ep->driver_data;
323 struct net_device *dev = fp->dev;
324 struct page *page = req->context;
325 struct sk_buff *skb;
326 unsigned long flags;
327 int status = req->status;
329 switch (status) {
330 case 0:
331 spin_lock_irqsave(&fp->rx.lock, flags);
332 skb = fp->rx.skb;
333 if (!skb)
334 skb = fp->rx.skb = netdev_alloc_skb(dev, 12);
335 if (req->actual < req->length) /* Last fragment */
336 fp->rx.skb = NULL;
337 spin_unlock_irqrestore(&fp->rx.lock, flags);
339 if (unlikely(!skb))
340 break;
342 if (skb->len == 0) { /* First fragment */
343 skb->protocol = htons(ETH_P_PHONET);
344 skb_reset_mac_header(skb);
345 /* Can't use pskb_pull() on page in IRQ */
346 memcpy(skb_put(skb, 1), page_address(page), 1);
349 skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
350 skb->len <= 1, req->actual, PAGE_SIZE);
351 page = NULL;
353 if (req->actual < req->length) { /* Last fragment */
354 skb->dev = dev;
355 dev->stats.rx_packets++;
356 dev->stats.rx_bytes += skb->len;
358 netif_rx(skb);
360 break;
362 /* Do not resubmit in these cases: */
363 case -ESHUTDOWN: /* disconnect */
364 case -ECONNABORTED: /* hw reset */
365 case -ECONNRESET: /* dequeued (unlink or netif down) */
366 req = NULL;
367 break;
369 /* Do resubmit in these cases: */
370 case -EOVERFLOW: /* request buffer overflow */
371 dev->stats.rx_over_errors++;
372 default:
373 dev->stats.rx_errors++;
374 break;
377 if (page)
378 put_page(page);
379 if (req)
380 pn_rx_submit(fp, req, GFP_ATOMIC);
383 /*-------------------------------------------------------------------------*/
385 static void __pn_reset(struct usb_function *f)
387 struct f_phonet *fp = func_to_pn(f);
388 struct net_device *dev = fp->dev;
389 struct phonet_port *port = netdev_priv(dev);
391 netif_carrier_off(dev);
392 port->usb = NULL;
394 usb_ep_disable(fp->out_ep);
395 usb_ep_disable(fp->in_ep);
396 if (fp->rx.skb) {
397 dev_kfree_skb_irq(fp->rx.skb);
398 fp->rx.skb = NULL;
402 static int pn_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
404 struct f_phonet *fp = func_to_pn(f);
405 struct usb_gadget *gadget = fp->function.config->cdev->gadget;
407 if (intf == pn_control_intf_desc.bInterfaceNumber)
408 /* control interface, no altsetting */
409 return (alt > 0) ? -EINVAL : 0;
411 if (intf == pn_data_intf_desc.bInterfaceNumber) {
412 struct net_device *dev = fp->dev;
413 struct phonet_port *port = netdev_priv(dev);
415 /* data intf (0: inactive, 1: active) */
416 if (alt > 1)
417 return -EINVAL;
419 spin_lock(&port->lock);
421 if (fp->in_ep->enabled)
422 __pn_reset(f);
424 if (alt == 1) {
425 int i;
427 if (config_ep_by_speed(gadget, f, fp->in_ep) ||
428 config_ep_by_speed(gadget, f, fp->out_ep)) {
429 fp->in_ep->desc = NULL;
430 fp->out_ep->desc = NULL;
431 spin_unlock(&port->lock);
432 return -EINVAL;
434 usb_ep_enable(fp->out_ep);
435 usb_ep_enable(fp->in_ep);
437 port->usb = fp;
438 fp->out_ep->driver_data = fp;
439 fp->in_ep->driver_data = fp;
441 netif_carrier_on(dev);
442 for (i = 0; i < phonet_rxq_size; i++)
443 pn_rx_submit(fp, fp->out_reqv[i], GFP_ATOMIC);
445 spin_unlock(&port->lock);
446 return 0;
449 return -EINVAL;
452 static int pn_get_alt(struct usb_function *f, unsigned intf)
454 struct f_phonet *fp = func_to_pn(f);
456 if (intf == pn_control_intf_desc.bInterfaceNumber)
457 return 0;
459 if (intf == pn_data_intf_desc.bInterfaceNumber) {
460 struct phonet_port *port = netdev_priv(fp->dev);
461 u8 alt;
463 spin_lock(&port->lock);
464 alt = port->usb != NULL;
465 spin_unlock(&port->lock);
466 return alt;
469 return -EINVAL;
472 static void pn_disconnect(struct usb_function *f)
474 struct f_phonet *fp = func_to_pn(f);
475 struct phonet_port *port = netdev_priv(fp->dev);
476 unsigned long flags;
478 /* remain disabled until set_alt */
479 spin_lock_irqsave(&port->lock, flags);
480 __pn_reset(f);
481 spin_unlock_irqrestore(&port->lock, flags);
484 /*-------------------------------------------------------------------------*/
486 static int pn_bind(struct usb_configuration *c, struct usb_function *f)
488 struct usb_composite_dev *cdev = c->cdev;
489 struct usb_gadget *gadget = cdev->gadget;
490 struct f_phonet *fp = func_to_pn(f);
491 struct usb_ep *ep;
492 int status, i;
494 struct f_phonet_opts *phonet_opts;
496 phonet_opts = container_of(f->fi, struct f_phonet_opts, func_inst);
499 * in drivers/usb/gadget/configfs.c:configfs_composite_bind()
500 * configurations are bound in sequence with list_for_each_entry,
501 * in each configuration its functions are bound in sequence
502 * with list_for_each_entry, so we assume no race condition
503 * with regard to phonet_opts->bound access
505 if (!phonet_opts->bound) {
506 gphonet_set_gadget(phonet_opts->net, gadget);
507 status = gphonet_register_netdev(phonet_opts->net);
508 if (status)
509 return status;
510 phonet_opts->bound = true;
513 /* Reserve interface IDs */
514 status = usb_interface_id(c, f);
515 if (status < 0)
516 goto err;
517 pn_control_intf_desc.bInterfaceNumber = status;
518 pn_union_desc.bMasterInterface0 = status;
520 status = usb_interface_id(c, f);
521 if (status < 0)
522 goto err;
523 pn_data_nop_intf_desc.bInterfaceNumber = status;
524 pn_data_intf_desc.bInterfaceNumber = status;
525 pn_union_desc.bSlaveInterface0 = status;
527 /* Reserve endpoints */
528 status = -ENODEV;
529 ep = usb_ep_autoconfig(gadget, &pn_fs_sink_desc);
530 if (!ep)
531 goto err;
532 fp->out_ep = ep;
534 ep = usb_ep_autoconfig(gadget, &pn_fs_source_desc);
535 if (!ep)
536 goto err;
537 fp->in_ep = ep;
539 pn_hs_sink_desc.bEndpointAddress = pn_fs_sink_desc.bEndpointAddress;
540 pn_hs_source_desc.bEndpointAddress = pn_fs_source_desc.bEndpointAddress;
542 /* Do not try to bind Phonet twice... */
543 status = usb_assign_descriptors(f, fs_pn_function, hs_pn_function,
544 NULL, NULL);
545 if (status)
546 goto err;
548 /* Incoming USB requests */
549 status = -ENOMEM;
550 for (i = 0; i < phonet_rxq_size; i++) {
551 struct usb_request *req;
553 req = usb_ep_alloc_request(fp->out_ep, GFP_KERNEL);
554 if (!req)
555 goto err_req;
557 req->complete = pn_rx_complete;
558 fp->out_reqv[i] = req;
561 /* Outgoing USB requests */
562 fp->in_req = usb_ep_alloc_request(fp->in_ep, GFP_KERNEL);
563 if (!fp->in_req)
564 goto err_req;
566 INFO(cdev, "USB CDC Phonet function\n");
567 INFO(cdev, "using %s, OUT %s, IN %s\n", cdev->gadget->name,
568 fp->out_ep->name, fp->in_ep->name);
569 return 0;
571 err_req:
572 for (i = 0; i < phonet_rxq_size && fp->out_reqv[i]; i++)
573 usb_ep_free_request(fp->out_ep, fp->out_reqv[i]);
574 usb_free_all_descriptors(f);
575 err:
576 ERROR(cdev, "USB CDC Phonet: cannot autoconfigure\n");
577 return status;
580 static inline struct f_phonet_opts *to_f_phonet_opts(struct config_item *item)
582 return container_of(to_config_group(item), struct f_phonet_opts,
583 func_inst.group);
586 static void phonet_attr_release(struct config_item *item)
588 struct f_phonet_opts *opts = to_f_phonet_opts(item);
590 usb_put_function_instance(&opts->func_inst);
593 static struct configfs_item_operations phonet_item_ops = {
594 .release = phonet_attr_release,
597 static ssize_t f_phonet_ifname_show(struct config_item *item, char *page)
599 return gether_get_ifname(to_f_phonet_opts(item)->net, page, PAGE_SIZE);
602 CONFIGFS_ATTR_RO(f_phonet_, ifname);
604 static struct configfs_attribute *phonet_attrs[] = {
605 &f_phonet_attr_ifname,
606 NULL,
609 static struct config_item_type phonet_func_type = {
610 .ct_item_ops = &phonet_item_ops,
611 .ct_attrs = phonet_attrs,
612 .ct_owner = THIS_MODULE,
615 static void phonet_free_inst(struct usb_function_instance *f)
617 struct f_phonet_opts *opts;
619 opts = container_of(f, struct f_phonet_opts, func_inst);
620 if (opts->bound)
621 gphonet_cleanup(opts->net);
622 else
623 free_netdev(opts->net);
624 kfree(opts);
627 static struct usb_function_instance *phonet_alloc_inst(void)
629 struct f_phonet_opts *opts;
631 opts = kzalloc(sizeof(*opts), GFP_KERNEL);
632 if (!opts)
633 return ERR_PTR(-ENOMEM);
635 opts->func_inst.free_func_inst = phonet_free_inst;
636 opts->net = gphonet_setup_default();
637 if (IS_ERR(opts->net)) {
638 struct net_device *net = opts->net;
639 kfree(opts);
640 return ERR_CAST(net);
643 config_group_init_type_name(&opts->func_inst.group, "",
644 &phonet_func_type);
646 return &opts->func_inst;
649 static void phonet_free(struct usb_function *f)
651 struct f_phonet *phonet;
653 phonet = func_to_pn(f);
654 kfree(phonet);
657 static void pn_unbind(struct usb_configuration *c, struct usb_function *f)
659 struct f_phonet *fp = func_to_pn(f);
660 int i;
662 /* We are already disconnected */
663 if (fp->in_req)
664 usb_ep_free_request(fp->in_ep, fp->in_req);
665 for (i = 0; i < phonet_rxq_size; i++)
666 if (fp->out_reqv[i])
667 usb_ep_free_request(fp->out_ep, fp->out_reqv[i]);
669 usb_free_all_descriptors(f);
672 static struct usb_function *phonet_alloc(struct usb_function_instance *fi)
674 struct f_phonet *fp;
675 struct f_phonet_opts *opts;
676 int size;
678 size = sizeof(*fp) + (phonet_rxq_size * sizeof(struct usb_request *));
679 fp = kzalloc(size, GFP_KERNEL);
680 if (!fp)
681 return ERR_PTR(-ENOMEM);
683 opts = container_of(fi, struct f_phonet_opts, func_inst);
685 fp->dev = opts->net;
686 fp->function.name = "phonet";
687 fp->function.bind = pn_bind;
688 fp->function.unbind = pn_unbind;
689 fp->function.set_alt = pn_set_alt;
690 fp->function.get_alt = pn_get_alt;
691 fp->function.disable = pn_disconnect;
692 fp->function.free_func = phonet_free;
693 spin_lock_init(&fp->rx.lock);
695 return &fp->function;
698 struct net_device *gphonet_setup_default(void)
700 struct net_device *dev;
701 struct phonet_port *port;
703 /* Create net device */
704 dev = alloc_netdev(sizeof(*port), "upnlink%d", NET_NAME_UNKNOWN,
705 pn_net_setup);
706 if (!dev)
707 return ERR_PTR(-ENOMEM);
709 port = netdev_priv(dev);
710 spin_lock_init(&port->lock);
711 netif_carrier_off(dev);
713 return dev;
716 void gphonet_set_gadget(struct net_device *net, struct usb_gadget *g)
718 SET_NETDEV_DEV(net, &g->dev);
721 int gphonet_register_netdev(struct net_device *net)
723 int status;
725 status = register_netdev(net);
726 if (status)
727 free_netdev(net);
729 return status;
732 void gphonet_cleanup(struct net_device *dev)
734 unregister_netdev(dev);
737 DECLARE_USB_FUNCTION_INIT(phonet, phonet_alloc_inst, phonet_alloc);
738 MODULE_AUTHOR("Rémi Denis-Courmont");
739 MODULE_LICENSE("GPL");