1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * SSH message parser.
4  *
5  * Copyright (C) 2019-2020 Maximilian Luz <luzmaximilian@gmail.com>
6  */
7 
8 #include <asm/unaligned.h>
9 #include <linux/compiler.h>
10 #include <linux/device.h>
11 #include <linux/types.h>
12 
13 #include <linux/surface_aggregator/serial_hub.h>
14 #include "ssh_parser.h"
15 
16 /**
17  * sshp_validate_crc() - Validate a CRC in raw message data.
18  * @src: The span of data over which the CRC should be computed.
19  * @crc: The pointer to the expected u16 CRC value.
20  *
21  * Computes the CRC of the provided data span (@src), compares it to the CRC
22  * stored at the given address (@crc), and returns the result of this
23  * comparison, i.e. %true if equal. This function is intended to run on raw
24  * input/message data.
25  *
26  * Return: Returns %true if the computed CRC matches the stored CRC, %false
27  * otherwise.
28  */
29 static bool sshp_validate_crc(const struct ssam_span *src, const u8 *crc)
30 {
31 	u16 actual = ssh_crc(src->ptr, src->len);
32 	u16 expected = get_unaligned_le16(crc);
33 
34 	return actual == expected;
35 }
36 
37 /**
38  * sshp_starts_with_syn() - Check if the given data starts with SSH SYN bytes.
39  * @src: The data span to check the start of.
40  */
41 static bool sshp_starts_with_syn(const struct ssam_span *src)
42 {
43 	return src->len >= 2 && get_unaligned_le16(src->ptr) == SSH_MSG_SYN;
44 }
45 
46 /**
47  * sshp_find_syn() - Find SSH SYN bytes in the given data span.
48  * @src: The data span to search in.
49  * @rem: The span (output) indicating the remaining data, starting with SSH
50  *       SYN bytes, if found.
51  *
52  * Search for SSH SYN bytes in the given source span. If found, set the @rem
53  * span to the remaining data, starting with the first SYN bytes and capped by
54  * the source span length, and return %true. This function does not copy any
55  * data, but rather only sets pointers to the respective start addresses and
56  * length values.
57  *
58  * If no SSH SYN bytes could be found, set the @rem span to the zero-length
59  * span at the end of the source span and return %false.
60  *
61  * If partial SSH SYN bytes could be found at the end of the source span, set
62  * the @rem span to cover these partial SYN bytes, capped by the end of the
63  * source span, and return %false. This function should then be re-run once
64  * more data is available.
65  *
66  * Return: Returns %true if a complete SSH SYN sequence could be found,
67  * %false otherwise.
68  */
69 bool sshp_find_syn(const struct ssam_span *src, struct ssam_span *rem)
70 {
71 	size_t i;
72 
73 	for (i = 0; i < src->len - 1; i++) {
74 		if (likely(get_unaligned_le16(src->ptr + i) == SSH_MSG_SYN)) {
75 			rem->ptr = src->ptr + i;
76 			rem->len = src->len - i;
77 			return true;
78 		}
79 	}
80 
81 	if (unlikely(src->ptr[src->len - 1] == (SSH_MSG_SYN & 0xff))) {
82 		rem->ptr = src->ptr + src->len - 1;
83 		rem->len = 1;
84 		return false;
85 	}
86 
87 	rem->ptr = src->ptr + src->len;
88 	rem->len = 0;
89 	return false;
90 }
91 
92 /**
93  * sshp_parse_frame() - Parse SSH frame.
94  * @dev: The device used for logging.
95  * @source: The source to parse from.
96  * @frame: The parsed frame (output).
97  * @payload: The parsed payload (output).
98  * @maxlen: The maximum supported message length.
99  *
100  * Parses and validates a SSH frame, including its payload, from the given
101  * source. Sets the provided @frame pointer to the start of the frame and
102  * writes the limits of the frame payload to the provided @payload span
103  * pointer.
104  *
105  * This function does not copy any data, but rather only validates the message
106  * data and sets pointers (and length values) to indicate the respective parts.
107  *
108  * If no complete SSH frame could be found, the frame pointer will be set to
109  * the %NULL pointer and the payload span will be set to the null span (start
110  * pointer %NULL, size zero).
111  *
112  * Return: Returns zero on success or if the frame is incomplete, %-ENOMSG if
113  * the start of the message is invalid, %-EBADMSG if any (frame-header or
114  * payload) CRC is invalid, or %-EMSGSIZE if the SSH message is bigger than
115  * the maximum message length specified in the @maxlen parameter.
116  */
117 int sshp_parse_frame(const struct device *dev, const struct ssam_span *source,
118 		     struct ssh_frame **frame, struct ssam_span *payload,
119 		     size_t maxlen)
120 {
121 	struct ssam_span sf;
122 	struct ssam_span sp;
123 
124 	/* Initialize output. */
125 	*frame = NULL;
126 	payload->ptr = NULL;
127 	payload->len = 0;
128 
129 	if (!sshp_starts_with_syn(source)) {
130 		dev_warn(dev, "rx: parser: invalid start of frame\n");
131 		return -ENOMSG;
132 	}
133 
134 	/* Check for minimum packet length. */
135 	if (unlikely(source->len < SSH_MESSAGE_LENGTH(0))) {
136 		dev_dbg(dev, "rx: parser: not enough data for frame\n");
137 		return 0;
138 	}
139 
140 	/* Pin down frame. */
141 	sf.ptr = source->ptr + sizeof(u16);
142 	sf.len = sizeof(struct ssh_frame);
143 
144 	/* Validate frame CRC. */
145 	if (unlikely(!sshp_validate_crc(&sf, sf.ptr + sf.len))) {
146 		dev_warn(dev, "rx: parser: invalid frame CRC\n");
147 		return -EBADMSG;
148 	}
149 
150 	/* Ensure packet does not exceed maximum length. */
151 	sp.len = get_unaligned_le16(&((struct ssh_frame *)sf.ptr)->len);
152 	if (unlikely(SSH_MESSAGE_LENGTH(sp.len) > maxlen)) {
153 		dev_warn(dev, "rx: parser: frame too large: %llu bytes\n",
154 			 SSH_MESSAGE_LENGTH(sp.len));
155 		return -EMSGSIZE;
156 	}
157 
158 	/* Pin down payload. */
159 	sp.ptr = sf.ptr + sf.len + sizeof(u16);
160 
161 	/* Check for frame + payload length. */
162 	if (source->len < SSH_MESSAGE_LENGTH(sp.len)) {
163 		dev_dbg(dev, "rx: parser: not enough data for payload\n");
164 		return 0;
165 	}
166 
167 	/* Validate payload CRC. */
168 	if (unlikely(!sshp_validate_crc(&sp, sp.ptr + sp.len))) {
169 		dev_warn(dev, "rx: parser: invalid payload CRC\n");
170 		return -EBADMSG;
171 	}
172 
173 	*frame = (struct ssh_frame *)sf.ptr;
174 	*payload = sp;
175 
176 	dev_dbg(dev, "rx: parser: valid frame found (type: %#04x, len: %u)\n",
177 		(*frame)->type, (*frame)->len);
178 
179 	return 0;
180 }
181 
182 /**
183  * sshp_parse_command() - Parse SSH command frame payload.
184  * @dev: The device used for logging.
185  * @source: The source to parse from.
186  * @command: The parsed command (output).
187  * @command_data: The parsed command data/payload (output).
188  *
189  * Parses and validates a SSH command frame payload. Sets the @command pointer
190  * to the command header and the @command_data span to the command data (i.e.
191  * payload of the command). This will result in a zero-length span if the
192  * command does not have any associated data/payload. This function does not
193  * check the frame-payload-type field, which should be checked by the caller
194  * before calling this function.
195  *
196  * The @source parameter should be the complete frame payload, e.g. returned
197  * by the sshp_parse_frame() command.
198  *
199  * This function does not copy any data, but rather only validates the frame
200  * payload data and sets pointers (and length values) to indicate the
201  * respective parts.
202  *
203  * Return: Returns zero on success or %-ENOMSG if @source does not represent a
204  * valid command-type frame payload, i.e. is too short.
205  */
206 int sshp_parse_command(const struct device *dev, const struct ssam_span *source,
207 		       struct ssh_command **command,
208 		       struct ssam_span *command_data)
209 {
210 	/* Check for minimum length. */
211 	if (unlikely(source->len < sizeof(struct ssh_command))) {
212 		*command = NULL;
213 		command_data->ptr = NULL;
214 		command_data->len = 0;
215 
216 		dev_err(dev, "rx: parser: command payload is too short\n");
217 		return -ENOMSG;
218 	}
219 
220 	*command = (struct ssh_command *)source->ptr;
221 	command_data->ptr = source->ptr + sizeof(struct ssh_command);
222 	command_data->len = source->len - sizeof(struct ssh_command);
223 
224 	dev_dbg(dev, "rx: parser: valid command found (tc: %#04x, cid: %#04x)\n",
225 		(*command)->tc, (*command)->cid);
226 
227 	return 0;
228 }
229