stub_rx.c 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617
  1. /*
  2. * Copyright (C) 2003-2008 Takahiro Hirofuchi
  3. *
  4. * This is free software; you can redistribute it and/or modify
  5. * it under the terms of the GNU General Public License as published by
  6. * the Free Software Foundation; either version 2 of the License, or
  7. * (at your option) any later version.
  8. *
  9. * This is distributed in the hope that it will be useful,
  10. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  12. * GNU General Public License for more details.
  13. *
  14. * You should have received a copy of the GNU General Public License
  15. * along with this program; if not, write to the Free Software
  16. * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
  17. * USA.
  18. */
  19. #include <asm/byteorder.h>
  20. #include <linux/kthread.h>
  21. #include <linux/usb.h>
  22. #include <linux/usb/hcd.h>
  23. #include "usbip_common.h"
  24. #include "stub.h"
  25. static int is_clear_halt_cmd(struct urb *urb)
  26. {
  27. struct usb_ctrlrequest *req;
  28. req = (struct usb_ctrlrequest *) urb->setup_packet;
  29. return (req->bRequest == USB_REQ_CLEAR_FEATURE) &&
  30. (req->bRequestType == USB_RECIP_ENDPOINT) &&
  31. (req->wValue == USB_ENDPOINT_HALT);
  32. }
  33. static int is_set_interface_cmd(struct urb *urb)
  34. {
  35. struct usb_ctrlrequest *req;
  36. req = (struct usb_ctrlrequest *) urb->setup_packet;
  37. return (req->bRequest == USB_REQ_SET_INTERFACE) &&
  38. (req->bRequestType == USB_RECIP_INTERFACE);
  39. }
  40. static int is_set_configuration_cmd(struct urb *urb)
  41. {
  42. struct usb_ctrlrequest *req;
  43. req = (struct usb_ctrlrequest *) urb->setup_packet;
  44. return (req->bRequest == USB_REQ_SET_CONFIGURATION) &&
  45. (req->bRequestType == USB_RECIP_DEVICE);
  46. }
  47. static int is_reset_device_cmd(struct urb *urb)
  48. {
  49. struct usb_ctrlrequest *req;
  50. __u16 value;
  51. __u16 index;
  52. req = (struct usb_ctrlrequest *) urb->setup_packet;
  53. value = le16_to_cpu(req->wValue);
  54. index = le16_to_cpu(req->wIndex);
  55. if ((req->bRequest == USB_REQ_SET_FEATURE) &&
  56. (req->bRequestType == USB_RT_PORT) &&
  57. (value == USB_PORT_FEAT_RESET)) {
  58. usbip_dbg_stub_rx("reset_device_cmd, port %u\n", index);
  59. return 1;
  60. } else
  61. return 0;
  62. }
  63. static int tweak_clear_halt_cmd(struct urb *urb)
  64. {
  65. struct usb_ctrlrequest *req;
  66. int target_endp;
  67. int target_dir;
  68. int target_pipe;
  69. int ret;
  70. req = (struct usb_ctrlrequest *) urb->setup_packet;
  71. /*
  72. * The stalled endpoint is specified in the wIndex value. The endpoint
  73. * of the urb is the target of this clear_halt request (i.e., control
  74. * endpoint).
  75. */
  76. target_endp = le16_to_cpu(req->wIndex) & 0x000f;
  77. /* the stalled endpoint direction is IN or OUT?. USB_DIR_IN is 0x80. */
  78. target_dir = le16_to_cpu(req->wIndex) & 0x0080;
  79. if (target_dir)
  80. target_pipe = usb_rcvctrlpipe(urb->dev, target_endp);
  81. else
  82. target_pipe = usb_sndctrlpipe(urb->dev, target_endp);
  83. ret = usb_clear_halt(urb->dev, target_pipe);
  84. if (ret < 0)
  85. dev_err(&urb->dev->dev,
  86. "usb_clear_halt error: devnum %d endp %d ret %d\n",
  87. urb->dev->devnum, target_endp, ret);
  88. else
  89. dev_info(&urb->dev->dev,
  90. "usb_clear_halt done: devnum %d endp %d\n",
  91. urb->dev->devnum, target_endp);
  92. return ret;
  93. }
  94. static int tweak_set_interface_cmd(struct urb *urb)
  95. {
  96. struct usb_ctrlrequest *req;
  97. __u16 alternate;
  98. __u16 interface;
  99. int ret;
  100. req = (struct usb_ctrlrequest *) urb->setup_packet;
  101. alternate = le16_to_cpu(req->wValue);
  102. interface = le16_to_cpu(req->wIndex);
  103. usbip_dbg_stub_rx("set_interface: inf %u alt %u\n",
  104. interface, alternate);
  105. ret = usb_set_interface(urb->dev, interface, alternate);
  106. if (ret < 0)
  107. dev_err(&urb->dev->dev,
  108. "usb_set_interface error: inf %u alt %u ret %d\n",
  109. interface, alternate, ret);
  110. else
  111. dev_info(&urb->dev->dev,
  112. "usb_set_interface done: inf %u alt %u\n",
  113. interface, alternate);
  114. return ret;
  115. }
  116. static int tweak_set_configuration_cmd(struct urb *urb)
  117. {
  118. struct stub_priv *priv = (struct stub_priv *) urb->context;
  119. struct stub_device *sdev = priv->sdev;
  120. struct usb_ctrlrequest *req;
  121. __u16 config;
  122. int err;
  123. req = (struct usb_ctrlrequest *) urb->setup_packet;
  124. config = le16_to_cpu(req->wValue);
  125. err = usb_set_configuration(sdev->udev, config);
  126. if (err && err != -ENODEV)
  127. dev_err(&sdev->udev->dev, "can't set config #%d, error %d\n",
  128. config, err);
  129. return 0;
  130. }
  131. static int tweak_reset_device_cmd(struct urb *urb)
  132. {
  133. struct stub_priv *priv = (struct stub_priv *) urb->context;
  134. struct stub_device *sdev = priv->sdev;
  135. dev_info(&urb->dev->dev, "usb_queue_reset_device\n");
  136. if (usb_lock_device_for_reset(sdev->udev, NULL) < 0) {
  137. dev_err(&urb->dev->dev, "could not obtain lock to reset device\n");
  138. return 0;
  139. }
  140. usb_reset_device(sdev->udev);
  141. usb_unlock_device(sdev->udev);
  142. return 0;
  143. }
  144. /*
  145. * clear_halt, set_interface, and set_configuration require special tricks.
  146. */
  147. static void tweak_special_requests(struct urb *urb)
  148. {
  149. if (!urb || !urb->setup_packet)
  150. return;
  151. if (usb_pipetype(urb->pipe) != PIPE_CONTROL)
  152. return;
  153. if (is_clear_halt_cmd(urb))
  154. /* tweak clear_halt */
  155. tweak_clear_halt_cmd(urb);
  156. else if (is_set_interface_cmd(urb))
  157. /* tweak set_interface */
  158. tweak_set_interface_cmd(urb);
  159. else if (is_set_configuration_cmd(urb))
  160. /* tweak set_configuration */
  161. tweak_set_configuration_cmd(urb);
  162. else if (is_reset_device_cmd(urb))
  163. tweak_reset_device_cmd(urb);
  164. else
  165. usbip_dbg_stub_rx("no need to tweak\n");
  166. }
  167. /*
  168. * stub_recv_unlink() unlinks the URB by a call to usb_unlink_urb().
  169. * By unlinking the urb asynchronously, stub_rx can continuously
  170. * process coming urbs. Even if the urb is unlinked, its completion
  171. * handler will be called and stub_tx will send a return pdu.
  172. *
  173. * See also comments about unlinking strategy in vhci_hcd.c.
  174. */
  175. static int stub_recv_cmd_unlink(struct stub_device *sdev,
  176. struct usbip_header *pdu)
  177. {
  178. int ret;
  179. unsigned long flags;
  180. struct stub_priv *priv;
  181. spin_lock_irqsave(&sdev->priv_lock, flags);
  182. list_for_each_entry(priv, &sdev->priv_init, list) {
  183. if (priv->seqnum != pdu->u.cmd_unlink.seqnum)
  184. continue;
  185. /*
  186. * This matched urb is not completed yet (i.e., be in
  187. * flight in usb hcd hardware/driver). Now we are
  188. * cancelling it. The unlinking flag means that we are
  189. * now not going to return the normal result pdu of a
  190. * submission request, but going to return a result pdu
  191. * of the unlink request.
  192. */
  193. priv->unlinking = 1;
  194. /*
  195. * In the case that unlinking flag is on, prev->seqnum
  196. * is changed from the seqnum of the cancelling urb to
  197. * the seqnum of the unlink request. This will be used
  198. * to make the result pdu of the unlink request.
  199. */
  200. priv->seqnum = pdu->base.seqnum;
  201. spin_unlock_irqrestore(&sdev->priv_lock, flags);
  202. /*
  203. * usb_unlink_urb() is now out of spinlocking to avoid
  204. * spinlock recursion since stub_complete() is
  205. * sometimes called in this context but not in the
  206. * interrupt context. If stub_complete() is executed
  207. * before we call usb_unlink_urb(), usb_unlink_urb()
  208. * will return an error value. In this case, stub_tx
  209. * will return the result pdu of this unlink request
  210. * though submission is completed and actual unlinking
  211. * is not executed. OK?
  212. */
  213. /* In the above case, urb->status is not -ECONNRESET,
  214. * so a driver in a client host will know the failure
  215. * of the unlink request ?
  216. */
  217. ret = usb_unlink_urb(priv->urb);
  218. if (ret != -EINPROGRESS)
  219. dev_err(&priv->urb->dev->dev,
  220. "failed to unlink a urb # %lu, ret %d\n",
  221. priv->seqnum, ret);
  222. return 0;
  223. }
  224. usbip_dbg_stub_rx("seqnum %d is not pending\n",
  225. pdu->u.cmd_unlink.seqnum);
  226. /*
  227. * The urb of the unlink target is not found in priv_init queue. It was
  228. * already completed and its results is/was going to be sent by a
  229. * CMD_RET pdu. In this case, usb_unlink_urb() is not needed. We only
  230. * return the completeness of this unlink request to vhci_hcd.
  231. */
  232. stub_enqueue_ret_unlink(sdev, pdu->base.seqnum, 0);
  233. spin_unlock_irqrestore(&sdev->priv_lock, flags);
  234. return 0;
  235. }
  236. static int valid_request(struct stub_device *sdev, struct usbip_header *pdu)
  237. {
  238. struct usbip_device *ud = &sdev->ud;
  239. int valid = 0;
  240. if (pdu->base.devid == sdev->devid) {
  241. spin_lock_irq(&ud->lock);
  242. if (ud->status == SDEV_ST_USED) {
  243. /* A request is valid. */
  244. valid = 1;
  245. }
  246. spin_unlock_irq(&ud->lock);
  247. }
  248. return valid;
  249. }
  250. static struct stub_priv *stub_priv_alloc(struct stub_device *sdev,
  251. struct usbip_header *pdu)
  252. {
  253. struct stub_priv *priv;
  254. struct usbip_device *ud = &sdev->ud;
  255. unsigned long flags;
  256. spin_lock_irqsave(&sdev->priv_lock, flags);
  257. priv = kmem_cache_zalloc(stub_priv_cache, GFP_ATOMIC);
  258. if (!priv) {
  259. dev_err(&sdev->udev->dev, "alloc stub_priv\n");
  260. spin_unlock_irqrestore(&sdev->priv_lock, flags);
  261. usbip_event_add(ud, SDEV_EVENT_ERROR_MALLOC);
  262. return NULL;
  263. }
  264. priv->seqnum = pdu->base.seqnum;
  265. priv->sdev = sdev;
  266. /*
  267. * After a stub_priv is linked to a list_head,
  268. * our error handler can free allocated data.
  269. */
  270. list_add_tail(&priv->list, &sdev->priv_init);
  271. spin_unlock_irqrestore(&sdev->priv_lock, flags);
  272. return priv;
  273. }
  274. static int get_pipe(struct stub_device *sdev, struct usbip_header *pdu)
  275. {
  276. struct usb_device *udev = sdev->udev;
  277. struct usb_host_endpoint *ep;
  278. struct usb_endpoint_descriptor *epd = NULL;
  279. int epnum = pdu->base.ep;
  280. int dir = pdu->base.direction;
  281. if (epnum < 0 || epnum > 15)
  282. goto err_ret;
  283. if (dir == USBIP_DIR_IN)
  284. ep = udev->ep_in[epnum & 0x7f];
  285. else
  286. ep = udev->ep_out[epnum & 0x7f];
  287. if (!ep)
  288. goto err_ret;
  289. epd = &ep->desc;
  290. /* validate transfer_buffer_length */
  291. if (pdu->u.cmd_submit.transfer_buffer_length > INT_MAX) {
  292. dev_err(&sdev->udev->dev,
  293. "CMD_SUBMIT: -EMSGSIZE transfer_buffer_length %d\n",
  294. pdu->u.cmd_submit.transfer_buffer_length);
  295. return -1;
  296. }
  297. if (usb_endpoint_xfer_control(epd)) {
  298. if (dir == USBIP_DIR_OUT)
  299. return usb_sndctrlpipe(udev, epnum);
  300. else
  301. return usb_rcvctrlpipe(udev, epnum);
  302. }
  303. if (usb_endpoint_xfer_bulk(epd)) {
  304. if (dir == USBIP_DIR_OUT)
  305. return usb_sndbulkpipe(udev, epnum);
  306. else
  307. return usb_rcvbulkpipe(udev, epnum);
  308. }
  309. if (usb_endpoint_xfer_int(epd)) {
  310. if (dir == USBIP_DIR_OUT)
  311. return usb_sndintpipe(udev, epnum);
  312. else
  313. return usb_rcvintpipe(udev, epnum);
  314. }
  315. if (usb_endpoint_xfer_isoc(epd)) {
  316. /* validate packet size and number of packets */
  317. unsigned int maxp, packets, bytes;
  318. maxp = usb_endpoint_maxp(epd);
  319. maxp *= usb_endpoint_maxp_mult(epd);
  320. bytes = pdu->u.cmd_submit.transfer_buffer_length;
  321. packets = DIV_ROUND_UP(bytes, maxp);
  322. if (pdu->u.cmd_submit.number_of_packets < 0 ||
  323. pdu->u.cmd_submit.number_of_packets > packets) {
  324. dev_err(&sdev->udev->dev,
  325. "CMD_SUBMIT: isoc invalid num packets %d\n",
  326. pdu->u.cmd_submit.number_of_packets);
  327. return -1;
  328. }
  329. if (dir == USBIP_DIR_OUT)
  330. return usb_sndisocpipe(udev, epnum);
  331. else
  332. return usb_rcvisocpipe(udev, epnum);
  333. }
  334. err_ret:
  335. /* NOT REACHED */
  336. dev_err(&sdev->udev->dev, "CMD_SUBMIT: invalid epnum %d\n", epnum);
  337. return -1;
  338. }
  339. static void masking_bogus_flags(struct urb *urb)
  340. {
  341. int xfertype;
  342. struct usb_device *dev;
  343. struct usb_host_endpoint *ep;
  344. int is_out;
  345. unsigned int allowed;
  346. if (!urb || urb->hcpriv || !urb->complete)
  347. return;
  348. dev = urb->dev;
  349. if ((!dev) || (dev->state < USB_STATE_UNAUTHENTICATED))
  350. return;
  351. ep = (usb_pipein(urb->pipe) ? dev->ep_in : dev->ep_out)
  352. [usb_pipeendpoint(urb->pipe)];
  353. if (!ep)
  354. return;
  355. xfertype = usb_endpoint_type(&ep->desc);
  356. if (xfertype == USB_ENDPOINT_XFER_CONTROL) {
  357. struct usb_ctrlrequest *setup =
  358. (struct usb_ctrlrequest *) urb->setup_packet;
  359. if (!setup)
  360. return;
  361. is_out = !(setup->bRequestType & USB_DIR_IN) ||
  362. !setup->wLength;
  363. } else {
  364. is_out = usb_endpoint_dir_out(&ep->desc);
  365. }
  366. /* enforce simple/standard policy */
  367. allowed = (URB_NO_TRANSFER_DMA_MAP | URB_NO_INTERRUPT |
  368. URB_DIR_MASK | URB_FREE_BUFFER);
  369. switch (xfertype) {
  370. case USB_ENDPOINT_XFER_BULK:
  371. if (is_out)
  372. allowed |= URB_ZERO_PACKET;
  373. /* FALLTHROUGH */
  374. case USB_ENDPOINT_XFER_CONTROL:
  375. allowed |= URB_NO_FSBR; /* only affects UHCI */
  376. /* FALLTHROUGH */
  377. default: /* all non-iso endpoints */
  378. if (!is_out)
  379. allowed |= URB_SHORT_NOT_OK;
  380. break;
  381. case USB_ENDPOINT_XFER_ISOC:
  382. allowed |= URB_ISO_ASAP;
  383. break;
  384. }
  385. urb->transfer_flags &= allowed;
  386. }
  387. static void stub_recv_cmd_submit(struct stub_device *sdev,
  388. struct usbip_header *pdu)
  389. {
  390. int ret;
  391. struct stub_priv *priv;
  392. struct usbip_device *ud = &sdev->ud;
  393. struct usb_device *udev = sdev->udev;
  394. int pipe = get_pipe(sdev, pdu);
  395. if (pipe == -1)
  396. return;
  397. priv = stub_priv_alloc(sdev, pdu);
  398. if (!priv)
  399. return;
  400. /* setup a urb */
  401. if (usb_pipeisoc(pipe))
  402. priv->urb = usb_alloc_urb(pdu->u.cmd_submit.number_of_packets,
  403. GFP_KERNEL);
  404. else
  405. priv->urb = usb_alloc_urb(0, GFP_KERNEL);
  406. if (!priv->urb) {
  407. usbip_event_add(ud, SDEV_EVENT_ERROR_MALLOC);
  408. return;
  409. }
  410. /* allocate urb transfer buffer, if needed */
  411. if (pdu->u.cmd_submit.transfer_buffer_length > 0 &&
  412. pdu->u.cmd_submit.transfer_buffer_length <= INT_MAX) {
  413. priv->urb->transfer_buffer =
  414. kzalloc(pdu->u.cmd_submit.transfer_buffer_length,
  415. GFP_KERNEL);
  416. if (!priv->urb->transfer_buffer) {
  417. usbip_event_add(ud, SDEV_EVENT_ERROR_MALLOC);
  418. return;
  419. }
  420. }
  421. /* copy urb setup packet */
  422. priv->urb->setup_packet = kmemdup(&pdu->u.cmd_submit.setup, 8,
  423. GFP_KERNEL);
  424. if (!priv->urb->setup_packet) {
  425. dev_err(&udev->dev, "allocate setup_packet\n");
  426. usbip_event_add(ud, SDEV_EVENT_ERROR_MALLOC);
  427. return;
  428. }
  429. /* set other members from the base header of pdu */
  430. priv->urb->context = (void *) priv;
  431. priv->urb->dev = udev;
  432. priv->urb->pipe = pipe;
  433. priv->urb->complete = stub_complete;
  434. usbip_pack_pdu(pdu, priv->urb, USBIP_CMD_SUBMIT, 0);
  435. if (usbip_recv_xbuff(ud, priv->urb) < 0)
  436. return;
  437. if (usbip_recv_iso(ud, priv->urb) < 0)
  438. return;
  439. /* no need to submit an intercepted request, but harmless? */
  440. tweak_special_requests(priv->urb);
  441. masking_bogus_flags(priv->urb);
  442. /* urb is now ready to submit */
  443. ret = usb_submit_urb(priv->urb, GFP_KERNEL);
  444. if (ret == 0)
  445. usbip_dbg_stub_rx("submit urb ok, seqnum %u\n",
  446. pdu->base.seqnum);
  447. else {
  448. dev_err(&udev->dev, "submit_urb error, %d\n", ret);
  449. usbip_dump_header(pdu);
  450. usbip_dump_urb(priv->urb);
  451. /*
  452. * Pessimistic.
  453. * This connection will be discarded.
  454. */
  455. usbip_event_add(ud, SDEV_EVENT_ERROR_SUBMIT);
  456. }
  457. usbip_dbg_stub_rx("Leave\n");
  458. }
  459. /* recv a pdu */
  460. static void stub_rx_pdu(struct usbip_device *ud)
  461. {
  462. int ret;
  463. struct usbip_header pdu;
  464. struct stub_device *sdev = container_of(ud, struct stub_device, ud);
  465. struct device *dev = &sdev->udev->dev;
  466. usbip_dbg_stub_rx("Enter\n");
  467. memset(&pdu, 0, sizeof(pdu));
  468. /* receive a pdu header */
  469. ret = usbip_recv(ud->tcp_socket, &pdu, sizeof(pdu));
  470. if (ret != sizeof(pdu)) {
  471. dev_err(dev, "recv a header, %d\n", ret);
  472. usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
  473. return;
  474. }
  475. usbip_header_correct_endian(&pdu, 0);
  476. if (usbip_dbg_flag_stub_rx)
  477. usbip_dump_header(&pdu);
  478. if (!valid_request(sdev, &pdu)) {
  479. dev_err(dev, "recv invalid request\n");
  480. usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
  481. return;
  482. }
  483. switch (pdu.base.command) {
  484. case USBIP_CMD_UNLINK:
  485. stub_recv_cmd_unlink(sdev, &pdu);
  486. break;
  487. case USBIP_CMD_SUBMIT:
  488. stub_recv_cmd_submit(sdev, &pdu);
  489. break;
  490. default:
  491. /* NOTREACHED */
  492. dev_err(dev, "unknown pdu\n");
  493. usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
  494. break;
  495. }
  496. }
  497. int stub_rx_loop(void *data)
  498. {
  499. struct usbip_device *ud = data;
  500. while (!kthread_should_stop()) {
  501. if (usbip_event_happened(ud))
  502. break;
  503. stub_rx_pdu(ud);
  504. }
  505. return 0;
  506. }