inet: frag: enforce memory limits earlier
[linux/fpc-iii.git] / drivers / usb / usbip / vudc_rx.c
blobd020e72b312259d08fd19de03bf23052fedb910e
1 /*
2 * Copyright (C) 2015 Karol Kosik <karo9@interia.eu>
3 * Copyright (C) 2015-2016 Samsung Electronics
4 * Igor Kotrasinski <i.kotrasinsk@samsung.com>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program. If not, see <http://www.gnu.org/licenses/>.
20 #include <net/sock.h>
21 #include <linux/list.h>
22 #include <linux/kthread.h>
24 #include "usbip_common.h"
25 #include "vudc.h"
27 static int alloc_urb_from_cmd(struct urb **urbp,
28 struct usbip_header *pdu, u8 type)
30 struct urb *urb;
32 if (type == USB_ENDPOINT_XFER_ISOC)
33 urb = usb_alloc_urb(pdu->u.cmd_submit.number_of_packets,
34 GFP_KERNEL);
35 else
36 urb = usb_alloc_urb(0, GFP_KERNEL);
38 if (!urb)
39 goto err;
41 usbip_pack_pdu(pdu, urb, USBIP_CMD_SUBMIT, 0);
43 if (urb->transfer_buffer_length > 0) {
44 urb->transfer_buffer = kzalloc(urb->transfer_buffer_length,
45 GFP_KERNEL);
46 if (!urb->transfer_buffer)
47 goto free_urb;
50 urb->setup_packet = kmemdup(&pdu->u.cmd_submit.setup, 8,
51 GFP_KERNEL);
52 if (!urb->setup_packet)
53 goto free_buffer;
56 * FIXME - we only setup pipe enough for usbip functions
57 * to behave nicely
59 urb->pipe |= pdu->base.direction == USBIP_DIR_IN ?
60 USB_DIR_IN : USB_DIR_OUT;
62 *urbp = urb;
63 return 0;
65 free_buffer:
66 kfree(urb->transfer_buffer);
67 urb->transfer_buffer = NULL;
68 free_urb:
69 usb_free_urb(urb);
70 err:
71 return -ENOMEM;
74 static int v_recv_cmd_unlink(struct vudc *udc,
75 struct usbip_header *pdu)
77 unsigned long flags;
78 struct urbp *urb_p;
80 spin_lock_irqsave(&udc->lock, flags);
81 list_for_each_entry(urb_p, &udc->urb_queue, urb_entry) {
82 if (urb_p->seqnum != pdu->u.cmd_unlink.seqnum)
83 continue;
84 urb_p->urb->unlinked = -ECONNRESET;
85 urb_p->seqnum = pdu->base.seqnum;
86 v_kick_timer(udc, jiffies);
87 spin_unlock_irqrestore(&udc->lock, flags);
88 return 0;
90 /* Not found, completed / not queued */
91 spin_lock(&udc->lock_tx);
92 v_enqueue_ret_unlink(udc, pdu->base.seqnum, 0);
93 wake_up(&udc->tx_waitq);
94 spin_unlock(&udc->lock_tx);
95 spin_unlock_irqrestore(&udc->lock, flags);
97 return 0;
100 static int v_recv_cmd_submit(struct vudc *udc,
101 struct usbip_header *pdu)
103 int ret = 0;
104 struct urbp *urb_p;
105 u8 address;
106 unsigned long flags;
108 urb_p = alloc_urbp();
109 if (!urb_p) {
110 usbip_event_add(&udc->ud, VUDC_EVENT_ERROR_MALLOC);
111 return -ENOMEM;
114 /* base.ep is pipeendpoint(pipe) */
115 address = pdu->base.ep;
116 if (pdu->base.direction == USBIP_DIR_IN)
117 address |= USB_DIR_IN;
119 spin_lock_irq(&udc->lock);
120 urb_p->ep = vudc_find_endpoint(udc, address);
121 if (!urb_p->ep) {
122 /* we don't know the type, there may be isoc data! */
123 dev_err(&udc->pdev->dev, "request to nonexistent endpoint");
124 spin_unlock_irq(&udc->lock);
125 usbip_event_add(&udc->ud, VUDC_EVENT_ERROR_TCP);
126 ret = -EPIPE;
127 goto free_urbp;
129 urb_p->type = urb_p->ep->type;
130 spin_unlock_irq(&udc->lock);
132 urb_p->new = 1;
133 urb_p->seqnum = pdu->base.seqnum;
135 if (urb_p->ep->type == USB_ENDPOINT_XFER_ISOC) {
136 /* validate packet size and number of packets */
137 unsigned int maxp, packets, bytes;
139 maxp = usb_endpoint_maxp(urb_p->ep->desc);
140 maxp *= usb_endpoint_maxp_mult(urb_p->ep->desc);
141 bytes = pdu->u.cmd_submit.transfer_buffer_length;
142 packets = DIV_ROUND_UP(bytes, maxp);
144 if (pdu->u.cmd_submit.number_of_packets < 0 ||
145 pdu->u.cmd_submit.number_of_packets > packets) {
146 dev_err(&udc->gadget.dev,
147 "CMD_SUBMIT: isoc invalid num packets %d\n",
148 pdu->u.cmd_submit.number_of_packets);
149 ret = -EMSGSIZE;
150 goto free_urbp;
154 ret = alloc_urb_from_cmd(&urb_p->urb, pdu, urb_p->ep->type);
155 if (ret) {
156 usbip_event_add(&udc->ud, VUDC_EVENT_ERROR_MALLOC);
157 ret = -ENOMEM;
158 goto free_urbp;
161 urb_p->urb->status = -EINPROGRESS;
163 /* FIXME: more pipe setup to please usbip_common */
164 urb_p->urb->pipe &= ~(3 << 30);
165 switch (urb_p->ep->type) {
166 case USB_ENDPOINT_XFER_BULK:
167 urb_p->urb->pipe |= (PIPE_BULK << 30);
168 break;
169 case USB_ENDPOINT_XFER_INT:
170 urb_p->urb->pipe |= (PIPE_INTERRUPT << 30);
171 break;
172 case USB_ENDPOINT_XFER_CONTROL:
173 urb_p->urb->pipe |= (PIPE_CONTROL << 30);
174 break;
175 case USB_ENDPOINT_XFER_ISOC:
176 urb_p->urb->pipe |= (PIPE_ISOCHRONOUS << 30);
177 break;
179 ret = usbip_recv_xbuff(&udc->ud, urb_p->urb);
180 if (ret < 0)
181 goto free_urbp;
183 ret = usbip_recv_iso(&udc->ud, urb_p->urb);
184 if (ret < 0)
185 goto free_urbp;
187 spin_lock_irqsave(&udc->lock, flags);
188 v_kick_timer(udc, jiffies);
189 list_add_tail(&urb_p->urb_entry, &udc->urb_queue);
190 spin_unlock_irqrestore(&udc->lock, flags);
192 return 0;
194 free_urbp:
195 free_urbp_and_urb(urb_p);
196 return ret;
199 static int v_rx_pdu(struct usbip_device *ud)
201 int ret;
202 struct usbip_header pdu;
203 struct vudc *udc = container_of(ud, struct vudc, ud);
205 memset(&pdu, 0, sizeof(pdu));
206 ret = usbip_recv(ud->tcp_socket, &pdu, sizeof(pdu));
207 if (ret != sizeof(pdu)) {
208 usbip_event_add(ud, VUDC_EVENT_ERROR_TCP);
209 if (ret >= 0)
210 return -EPIPE;
211 return ret;
213 usbip_header_correct_endian(&pdu, 0);
215 spin_lock_irq(&ud->lock);
216 ret = (ud->status == SDEV_ST_USED);
217 spin_unlock_irq(&ud->lock);
218 if (!ret) {
219 usbip_event_add(ud, VUDC_EVENT_ERROR_TCP);
220 return -EBUSY;
223 switch (pdu.base.command) {
224 case USBIP_CMD_UNLINK:
225 ret = v_recv_cmd_unlink(udc, &pdu);
226 break;
227 case USBIP_CMD_SUBMIT:
228 ret = v_recv_cmd_submit(udc, &pdu);
229 break;
230 default:
231 ret = -EPIPE;
232 pr_err("rx: unknown command");
233 break;
235 return ret;
238 int v_rx_loop(void *data)
240 struct usbip_device *ud = data;
241 int ret = 0;
243 while (!kthread_should_stop()) {
244 if (usbip_event_happened(ud))
245 break;
246 ret = v_rx_pdu(ud);
247 if (ret < 0) {
248 pr_warn("v_rx exit with error %d", ret);
249 break;
252 return ret;