Commit e3fb2f64 authored by Duncan Sands's avatar Duncan Sands Committed by Greg Kroah-Hartman
Browse files

[PATCH] USBATM: handle urbs containing partial cells 



The receive logic has always assumed that urbs contain an integral
number of ATM cells, which is a bit naughty, though it never caused
any problems with bulk transfers.  Isochronous urbs spank us soundly
for this.  Fixed thanks to this patch, mostly by Stanislaw Gruszka.

Signed-off-by: default avatarDuncan Sands <baldrick@free.fr>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 80aae7a1

drivers/usb/atm/usbatm.c

+175 −96
Original line number Diff line number Diff line
@@ -296,38 +296,30 @@ static inline struct usbatm_vcc_data *usbatm_find_vcc(struct usbatm_data *instan 
	return NULL;

}



static void usbatm_extract_cells(struct usbatm_data *instance,

			       unsigned char *source, unsigned int avail_data)

static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char *source)

{

	struct usbatm_vcc_data *cached_vcc = NULL;

	struct atm_vcc *vcc;

	struct sk_buff *sarb;

	unsigned int stride = instance->rx_channel.stride;

	int vci, cached_vci = 0;

	short vpi, cached_vpi = 0;

	u8 pti;



	for (; avail_data >= stride; avail_data -= stride, source += stride) {

		vpi = ((source[0] & 0x0f) << 4)  | (source[1] >> 4);

		vci = ((source[1] & 0x0f) << 12) | (source[2] << 4) | (source[3] >> 4);

		pti = ((source[3] & 0xe) >> 1);

	short vpi = ((source[0] & 0x0f) << 4)  | (source[1] >> 4);

	int vci = ((source[1] & 0x0f) << 12) | (source[2] << 4) | (source[3] >> 4);

	u8 pti = ((source[3] & 0xe) >> 1);



	vdbg("%s: vpi %hd, vci %d, pti %d", __func__, vpi, vci, pti);



		if ((vci != cached_vci) || (vpi != cached_vpi)) {

			cached_vpi = vpi;

			cached_vci = vci;

	if ((vci != instance->cached_vci) || (vpi != instance->cached_vpi)) {

		instance->cached_vpi = vpi;

		instance->cached_vci = vci;



			cached_vcc = usbatm_find_vcc(instance, vpi, vci);

		instance->cached_vcc = usbatm_find_vcc(instance, vpi, vci);



			if (!cached_vcc)

		if (!instance->cached_vcc)

			atm_rldbg(instance, "%s: unknown vpi/vci (%hd/%d)!\n", __func__, vpi, vci);

	}



		if (!cached_vcc)

			continue;

	if (!instance->cached_vcc)

		return;



		vcc = cached_vcc->vcc;

	vcc = instance->cached_vcc->vcc;



	/* OAM F5 end-to-end */

	if (pti == ATM_PTI_E2EF5) {
@@ -335,10 +327,10 @@ static void usbatm_extract_cells(struct usbatm_data *instance, 
			atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",

				__func__, vpi, vci);

		atomic_inc(&vcc->stats->rx_err);

			continue;

		return;

	}



		sarb = cached_vcc->sarb;

	sarb = instance->cached_vcc->sarb;



	if (sarb->tail + ATM_CELL_PAYLOAD > sarb->end) {

		atm_rldbg(instance, "%s: buffer overrun (sarb->len %u, vcc: 0x%p)!\n",
@@ -416,6 +408,47 @@ static void usbatm_extract_cells(struct usbatm_data *instance, 
		skb_trim(sarb, 0);

	}

}



static void usbatm_extract_cells(struct usbatm_data *instance,

		unsigned char *source, unsigned int avail_data)

{

	unsigned int stride = instance->rx_channel.stride;

	unsigned int buf_usage = instance->buf_usage;



	/* extract cells from incoming data, taking into account that

	 * the length of avail data may not be a multiple of stride */



	if (buf_usage > 0) {

		/* we have a partially received atm cell */

		unsigned char *cell_buf = instance->cell_buf;

		unsigned int space_left = stride - buf_usage;



		UDSL_ASSERT(buf_usage <= stride);



		if (avail_data >= space_left) {

			/* add new data and process cell */

			memcpy(cell_buf + buf_usage, source, space_left);

			source += space_left;

			avail_data -= space_left;

			usbatm_extract_one_cell(instance, cell_buf);

			instance->buf_usage = 0;

		} else {

			/* not enough data to fill the cell */

			memcpy(cell_buf + buf_usage, source, avail_data);

			instance->buf_usage = buf_usage + avail_data;

			return;

		}

	}



	for (; avail_data >= stride; avail_data -= stride, source += stride)

		usbatm_extract_one_cell(instance, source);



	if (avail_data > 0) {

		/* length was not a multiple of stride -

		 * save remaining data for next call */

		memcpy(instance->cell_buf, source, avail_data);

		instance->buf_usage = avail_data;

	}

}
@@ -496,16 +529,40 @@ static void usbatm_rx_process(unsigned long data) 
		vdbg("%s: processing urb 0x%p", __func__, urb);



		if (usb_pipeisoc(urb->pipe)) {

			unsigned char *merge_start = NULL;

			unsigned int merge_length = 0;

			const unsigned int packet_size = instance->rx_channel.packet_size;

			int i;

			for (i = 0; i < urb->number_of_packets; i++)

				if (!urb->iso_frame_desc[i].status)

					usbatm_extract_cells(instance,

							     (u8 *)urb->transfer_buffer + urb->iso_frame_desc[i].offset,

							     urb->iso_frame_desc[i].actual_length);



			for (i = 0; i < urb->number_of_packets; i++) {

				if (!urb->iso_frame_desc[i].status) {

					unsigned int actual_length = urb->iso_frame_desc[i].actual_length;



					UDSL_ASSERT(actual_length <= packet_size);



					if (!merge_length)

						merge_start = (unsigned char *)urb->transfer_buffer + urb->iso_frame_desc[i].offset;

					merge_length += actual_length;

					if (merge_length && (actual_length < packet_size)) {

						usbatm_extract_cells(instance, merge_start, merge_length);

						merge_length = 0;

					}

		else

				} else {

					atm_rldbg(instance, "%s: status %d in frame %d!\n", __func__, urb->status, i);

					if (merge_length)

						usbatm_extract_cells(instance, merge_start, merge_length);

					merge_length = 0;

					instance->buf_usage = 0;

				}

			}



			if (merge_length)

				usbatm_extract_cells(instance, merge_start, merge_length);

		} else

			if (!urb->status)

				usbatm_extract_cells(instance, urb->transfer_buffer, urb->actual_length);

			else

				instance->buf_usage = 0;



		if (usbatm_submit_urb(urb))

			return;
@@ -797,6 +854,9 @@ static int usbatm_atm_open(struct atm_vcc *vcc) 
	vcc->dev_data = new;



	tasklet_disable(&instance->rx_channel.tasklet);

	instance->cached_vcc = new;

	instance->cached_vpi = vpi;

	instance->cached_vci = vci;

	list_add(&new->list, &instance->vcc_list);

	tasklet_enable(&instance->rx_channel.tasklet);
@@ -836,6 +896,11 @@ static void usbatm_atm_close(struct atm_vcc *vcc) 
	down(&instance->serialize);	/* vs self, usbatm_atm_open, usbatm_usb_disconnect */



	tasklet_disable(&instance->rx_channel.tasklet);

	if (instance->cached_vcc == vcc_data) {

		instance->cached_vcc = NULL;

		instance->cached_vpi = ATM_VPI_UNSPEC;

		instance->cached_vci = ATM_VCI_UNSPEC;

	}

	list_del(&vcc_data->list);

	tasklet_enable(&instance->rx_channel.tasklet);
@@ -1146,6 +1211,16 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id, 
		     __func__, urb->transfer_buffer, urb->transfer_buffer_length, urb);

	}



	instance->cached_vpi = ATM_VPI_UNSPEC;

	instance->cached_vci = ATM_VCI_UNSPEC;

	instance->cell_buf = kmalloc(instance->rx_channel.stride, GFP_KERNEL);



	if (!instance->cell_buf) {

		dev_err(dev, "%s: no memory for cell buffer!\n", __func__);

		error = -ENOMEM;

		goto fail_unbind;

	}



	if (!(instance->flags & UDSL_SKIP_HEAVY_INIT) && driver->heavy_init) {

		error = usbatm_heavy_init(instance);

	} else {
@@ -1165,6 +1240,8 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id, 
	if (instance->driver->unbind)

		instance->driver->unbind(instance, intf);

 fail_free:

	kfree(instance->cell_buf);



	for (i = 0; i < num_rcv_urbs + num_snd_urbs; i++) {

		if (instance->urbs[i])

			kfree(instance->urbs[i]->transfer_buffer);
@@ -1236,6 +1313,8 @@ void usbatm_usb_disconnect(struct usb_interface *intf) 
		usb_free_urb(instance->urbs[i]);

	}



	kfree(instance->cell_buf);



	/* ATM finalize */

	if (instance->atm_dev)

		atm_dev_deregister(instance->atm_dev);

drivers/usb/atm/usbatm.h

+7 −0
Original line number Diff line number Diff line
@@ -187,6 +187,13 @@ struct usbatm_data { 
	struct sk_buff_head sndqueue;

	struct sk_buff *current_skb;	/* being emptied */



	struct usbatm_vcc_data *cached_vcc;

	int cached_vci;

	short cached_vpi;



	unsigned char *cell_buf;	/* holds partial rx cell */

	unsigned int buf_usage;



	struct urb *urbs[0];

};

CRA Git | Maintained and supported by SUSTech CRA and CCSE