USB: gadget: Add EEM gadget driver (9b39e9dd) · Commits · e / devices / android_kernel_xiaomi_sm6125

drivers/usb/gadget/Kconfig

+23 −3

Original line number	Diff line number	Diff line
		@@ -628,8 +628,8 @@ config USB_ETH
		tristate "Ethernet Gadget (with CDC Ethernet support)"
		depends on NET
		help
		This driver implements Ethernet style communication, in either
		of two ways:
		This driver implements Ethernet style communication, in one of
		several ways:

		- The "Communication Device Class" (CDC) Ethernet Control Model.
		That protocol is often avoided with pure Ethernet adapters, in
		@@ -639,7 +639,11 @@ config USB_ETH
		- On hardware can't implement that protocol, a simple CDC subset
		is used, placing fewer demands on USB.

		RNDIS support is a third option, more demanding than that subset.
		- CDC Ethernet Emulation Model (EEM) is a newer standard that has
		a simpler interface that can be used by more USB hardware.

		RNDIS support is an additional option, more demanding than than
		subset.

		Within the USB device, this gadget driver exposes a network device
		"usbX", where X depends on what other networking devices you have.
		@@ -672,6 +676,22 @@ config USB_ETH_RNDIS
		XP, you'll need to download drivers from Microsoft's website; a URL
		is given in comments found in that info file.

		config USB_ETH_EEM
		bool "Ethernet Emulation Model (EEM) support"
		depends on USB_ETH
		default n
		help
		CDC EEM is a newer USB standard that is somewhat simpler than CDC ECM
		and therefore can be supported by more hardware. Technically ECM and
		EEM are designed for different applications. The ECM model extends
		the network interface to the target (e.g. a USB cable modem), and the
		EEM model is for mobile devices to communicate with hosts using
		ethernet over USB. For Linux gadgets, however, the interface with
		the host is the same (a usbX device), so the differences are minimal.

		If you say "y" here, the Ethernet gadget driver will use the EEM
		protocol rather than ECM. If unsure, say "n".

		config USB_GADGETFS
		tristate "Gadget Filesystem (EXPERIMENTAL)"
		depends on EXPERIMENTAL

drivers/usb/gadget/ether.c

+28 −3

Original line number	Diff line number	Diff line
		@@ -61,6 +61,11 @@
		* simpler, Microsoft pushes their own approach: RNDIS. The published
		* RNDIS specs are ambiguous and appear to be incomplete, and are also
		* needlessly complex. They borrow more from CDC ACM than CDC ECM.
		*
		* While CDC ECM, CDC Subset, and RNDIS are designed to extend the ethernet
		* interface to the target, CDC EEM was designed to use ethernet over the USB
		* link between the host and target. CDC EEM is implemented as an alternative
		* to those other protocols when that communication model is more appropriate
		*/

		#define DRIVER_DESC "Ethernet Gadget"
		@@ -114,6 +119,7 @@ static inline bool has_rndis(void)
		#include "f_rndis.c"
		#include "rndis.c"
		#endif
		#include "f_eem.c"
		#include "u_ether.c"

		/-------------------------------------------------------------------------/
		@@ -150,6 +156,10 @@ static inline bool has_rndis(void)
		#define RNDIS_VENDOR_NUM 0x0525 /* NetChip */
		#define RNDIS_PRODUCT_NUM 0xa4a2 /* Ethernet/RNDIS Gadget */

		/* For EEM gadgets */
		#define EEM_VENDOR_NUM 0x0525 /* INVALID - NEEDS TO BE ALLOCATED */
		#define EEM_PRODUCT_NUM 0xa4a1 /* INVALID - NEEDS TO BE ALLOCATED */

		/-------------------------------------------------------------------------/

		static struct usb_device_descriptor device_desc = {
		@@ -246,8 +256,16 @@ static struct usb_configuration rndis_config_driver = {

		/-------------------------------------------------------------------------/

		#ifdef CONFIG_USB_ETH_EEM
		static int use_eem = 1;
		#else
		static int use_eem;
		#endif
		module_param(use_eem, bool, 0);
		MODULE_PARM_DESC(use_eem, "use CDC EEM mode");

		/*
		* We _always_ have an ECM or CDC Subset configuration.
		* We _always_ have an ECM, CDC Subset, or EEM configuration.
		*/
		static int __init eth_do_config(struct usb_configuration *c)
		{
		@@ -258,7 +276,9 @@ static int __init eth_do_config(struct usb_configuration *c)
		c->bmAttributes \|= USB_CONFIG_ATT_WAKEUP;
		}

		if (can_support_ecm(c->cdev->gadget))
		if (use_eem)
		return eem_bind_config(c);
		else if (can_support_ecm(c->cdev->gadget))
		return ecm_bind_config(c, hostaddr);
		else
		return geth_bind_config(c, hostaddr);
		@@ -286,7 +306,12 @@ static int __init eth_bind(struct usb_composite_dev *cdev)
		return status;

		/* set up main config label and device descriptor */
		if (can_support_ecm(cdev->gadget)) {
		if (use_eem) {
		/* EEM */
		eth_config_driver.label = "CDC Ethernet (EEM)";
		device_desc.idVendor = cpu_to_le16(EEM_VENDOR_NUM);
		device_desc.idProduct = cpu_to_le16(EEM_PRODUCT_NUM);
		} else if (can_support_ecm(cdev->gadget)) {
		/* ECM */
		eth_config_driver.label = "CDC Ethernet (ECM)";
		} else {

drivers/usb/gadget/f_eem.c

0 → 100644

+562 −0

Original line number	Diff line number	Diff line
		/*
		* f_eem.c -- USB CDC Ethernet (EEM) link function driver
		*
		* Copyright (C) 2003-2005,2008 David Brownell
		* Copyright (C) 2008 Nokia Corporation
		* Copyright (C) 2009 EF Johnson Technologies
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License as published by
		* the Free Software Foundation; either version 2 of the License, or
		* (at your option) any later version.
		*
		* This program is distributed in the hope that it will be useful,
		* but WITHOUT ANY WARRANTY; without even the implied warranty of
		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		* GNU General Public License for more details.
		*
		* You should have received a copy of the GNU General Public License
		* along with this program; if not, write to the Free Software
		* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
		*/

		#include <linux/kernel.h>
		#include <linux/device.h>
		#include <linux/etherdevice.h>
		#include <linux/crc32.h>

		#include "u_ether.h"

		#define EEM_HLEN 2

		/*
		* This function is a "CDC Ethernet Emulation Model" (CDC EEM)
		* Ethernet link.
		*/

		struct eem_ep_descs {
		struct usb_endpoint_descriptor *in;
		struct usb_endpoint_descriptor *out;
		};

		struct f_eem {
		struct gether port;
		u8 ctrl_id;

		struct eem_ep_descs fs;
		struct eem_ep_descs hs;
		};

		static inline struct f_eem func_to_eem(struct usb_function f)
		{
		return container_of(f, struct f_eem, port.func);
		}

		/-------------------------------------------------------------------------/

		/* interface descriptor: */

		static struct usb_interface_descriptor eem_intf __initdata = {
		.bLength = sizeof eem_intf,
		.bDescriptorType = USB_DT_INTERFACE,

		/* .bInterfaceNumber = DYNAMIC */
		.bNumEndpoints = 2,
		.bInterfaceClass = USB_CLASS_COMM,
		.bInterfaceSubClass = USB_CDC_SUBCLASS_EEM,
		.bInterfaceProtocol = USB_CDC_PROTO_EEM,
		/* .iInterface = DYNAMIC */
		};

		/* full speed support: */

		static struct usb_endpoint_descriptor eem_fs_in_desc __initdata = {
		.bLength = USB_DT_ENDPOINT_SIZE,
		.bDescriptorType = USB_DT_ENDPOINT,

		.bEndpointAddress = USB_DIR_IN,
		.bmAttributes = USB_ENDPOINT_XFER_BULK,
		};

		static struct usb_endpoint_descriptor eem_fs_out_desc __initdata = {
		.bLength = USB_DT_ENDPOINT_SIZE,
		.bDescriptorType = USB_DT_ENDPOINT,

		.bEndpointAddress = USB_DIR_OUT,
		.bmAttributes = USB_ENDPOINT_XFER_BULK,
		};

		static struct usb_descriptor_header *eem_fs_function[] __initdata = {
		/* CDC EEM control descriptors */
		(struct usb_descriptor_header *) &eem_intf,
		(struct usb_descriptor_header *) &eem_fs_in_desc,
		(struct usb_descriptor_header *) &eem_fs_out_desc,
		NULL,
		};

		/* high speed support: */

		static struct usb_endpoint_descriptor eem_hs_in_desc __initdata = {
		.bLength = USB_DT_ENDPOINT_SIZE,
		.bDescriptorType = USB_DT_ENDPOINT,

		.bEndpointAddress = USB_DIR_IN,
		.bmAttributes = USB_ENDPOINT_XFER_BULK,
		.wMaxPacketSize = cpu_to_le16(512),
		};

		static struct usb_endpoint_descriptor eem_hs_out_desc __initdata = {
		.bLength = USB_DT_ENDPOINT_SIZE,
		.bDescriptorType = USB_DT_ENDPOINT,

		.bEndpointAddress = USB_DIR_OUT,
		.bmAttributes = USB_ENDPOINT_XFER_BULK,
		.wMaxPacketSize = cpu_to_le16(512),
		};

		static struct usb_descriptor_header *eem_hs_function[] __initdata = {
		/* CDC EEM control descriptors */
		(struct usb_descriptor_header *) &eem_intf,
		(struct usb_descriptor_header *) &eem_hs_in_desc,
		(struct usb_descriptor_header *) &eem_hs_out_desc,
		NULL,
		};

		/* string descriptors: */

		static struct usb_string eem_string_defs[] = {
		[0].s = "CDC Ethernet Emulation Model (EEM)",
		{ } /* end of list */
		};

		static struct usb_gadget_strings eem_string_table = {
		.language = 0x0409, /* en-us */
		.strings = eem_string_defs,
		};

		static struct usb_gadget_strings *eem_strings[] = {
		&eem_string_table,
		NULL,
		};

		/-------------------------------------------------------------------------/

		static int eem_setup(struct usb_function f, const struct usb_ctrlrequest ctrl)
		{
		struct usb_composite_dev *cdev = f->config->cdev;
		int value = -EOPNOTSUPP;
		u16 w_index = le16_to_cpu(ctrl->wIndex);
		u16 w_value = le16_to_cpu(ctrl->wValue);
		u16 w_length = le16_to_cpu(ctrl->wLength);

		DBG(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n",
		ctrl->bRequestType, ctrl->bRequest,
		w_value, w_index, w_length);

		/* device either stalls (value < 0) or reports success */
		return value;
		}


		static int eem_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
		{
		struct f_eem *eem = func_to_eem(f);
		struct usb_composite_dev *cdev = f->config->cdev;
		struct net_device *net;

		/* we know alt == 0, so this is an activation or a reset */
		if (alt != 0)
		goto fail;

		if (intf == eem->ctrl_id) {

		if (eem->port.in_ep->driver_data) {
		DBG(cdev, "reset eem\n");
		gether_disconnect(&eem->port);
		}

		if (!eem->port.in) {
		DBG(cdev, "init eem\n");
		eem->port.in = ep_choose(cdev->gadget,
		eem->hs.in, eem->fs.in);
		eem->port.out = ep_choose(cdev->gadget,
		eem->hs.out, eem->fs.out);
		}

		/* zlps should not occur because zero-length EEM packets
		* will be inserted in those cases where they would occur
		*/
		eem->port.is_zlp_ok = 1;
		eem->port.cdc_filter = DEFAULT_FILTER;
		DBG(cdev, "activate eem\n");
		net = gether_connect(&eem->port);
		if (IS_ERR(net))
		return PTR_ERR(net);
		} else
		goto fail;

		return 0;
		fail:
		return -EINVAL;
		}

		static void eem_disable(struct usb_function *f)
		{
		struct f_eem *eem = func_to_eem(f);
		struct usb_composite_dev *cdev = f->config->cdev;

		DBG(cdev, "eem deactivated\n");

		if (eem->port.in_ep->driver_data)
		gether_disconnect(&eem->port);
		}

		/-------------------------------------------------------------------------/

		/* EEM function driver setup/binding */

		static int __init
		eem_bind(struct usb_configuration c, struct usb_function f)
		{
		struct usb_composite_dev *cdev = c->cdev;
		struct f_eem *eem = func_to_eem(f);
		int status;
		struct usb_ep *ep;

		/* allocate instance-specific interface IDs */
		status = usb_interface_id(c, f);
		if (status < 0)
		goto fail;
		eem->ctrl_id = status;
		eem_intf.bInterfaceNumber = status;

		status = -ENODEV;

		/* allocate instance-specific endpoints */
		ep = usb_ep_autoconfig(cdev->gadget, &eem_fs_in_desc);
		if (!ep)
		goto fail;
		eem->port.in_ep = ep;
		ep->driver_data = cdev; /* claim */

		ep = usb_ep_autoconfig(cdev->gadget, &eem_fs_out_desc);
		if (!ep)
		goto fail;
		eem->port.out_ep = ep;
		ep->driver_data = cdev; /* claim */

		status = -ENOMEM;

		/* copy descriptors, and track endpoint copies */
		f->descriptors = usb_copy_descriptors(eem_fs_function);
		if (!f->descriptors)
		goto fail;

		eem->fs.in = usb_find_endpoint(eem_fs_function,
		f->descriptors, &eem_fs_in_desc);
		eem->fs.out = usb_find_endpoint(eem_fs_function,
		f->descriptors, &eem_fs_out_desc);

		/* support all relevant hardware speeds... we expect that when
		* hardware is dual speed, all bulk-capable endpoints work at
		* both speeds
		*/
		if (gadget_is_dualspeed(c->cdev->gadget)) {
		eem_hs_in_desc.bEndpointAddress =
		eem_fs_in_desc.bEndpointAddress;
		eem_hs_out_desc.bEndpointAddress =
		eem_fs_out_desc.bEndpointAddress;

		/* copy descriptors, and track endpoint copies */
		f->hs_descriptors = usb_copy_descriptors(eem_hs_function);
		if (!f->hs_descriptors)
		goto fail;

		eem->hs.in = usb_find_endpoint(eem_hs_function,
		f->hs_descriptors, &eem_hs_in_desc);
		eem->hs.out = usb_find_endpoint(eem_hs_function,
		f->hs_descriptors, &eem_hs_out_desc);
		}

		DBG(cdev, "CDC Ethernet (EEM): %s speed IN/%s OUT/%s\n",
		gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
		eem->port.in_ep->name, eem->port.out_ep->name);
		return 0;

		fail:
		if (f->descriptors)
		usb_free_descriptors(f->descriptors);

		/* we might as well release our claims on endpoints */
		if (eem->port.out)
		eem->port.out_ep->driver_data = NULL;
		if (eem->port.in)
		eem->port.in_ep->driver_data = NULL;

		ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);

		return status;
		}

		static void
		eem_unbind(struct usb_configuration c, struct usb_function f)
		{
		struct f_eem *eem = func_to_eem(f);

		DBG(c->cdev, "eem unbind\n");

		if (gadget_is_dualspeed(c->cdev->gadget))
		usb_free_descriptors(f->hs_descriptors);
		usb_free_descriptors(f->descriptors);
		kfree(eem);
		}

		static void eem_cmd_complete(struct usb_ep ep, struct usb_request req)
		{
		}

		/*
		* Add the EEM header and ethernet checksum.
		* We currently do not attempt to put multiple ethernet frames
		* into a single USB transfer
		*/
		static struct sk_buff eem_wrap(struct gether port, struct sk_buff *skb)
		{
		struct sk_buff *skb2 = NULL;
		struct usb_ep *in = port->in_ep;
		int padlen = 0;
		u16 len = skb->len;

		if (!skb_cloned(skb)) {
		int headroom = skb_headroom(skb);
		int tailroom = skb_tailroom(skb);

		/* When (len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) is 0,
		* stick two bytes of zero-length EEM packet on the end.
		*/
		if (((len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) == 0)
		padlen += 2;

		if ((tailroom >= (ETH_FCS_LEN + padlen)) &&
		(headroom >= EEM_HLEN))
		goto done;
		}

		skb2 = skb_copy_expand(skb, EEM_HLEN, ETH_FCS_LEN + padlen, GFP_ATOMIC);
		dev_kfree_skb_any(skb);
		skb = skb2;
		if (!skb)
		return skb;

		done:
		/* use the "no CRC" option */
		put_unaligned_be32(0xdeadbeef, skb_put(skb, 4));

		/* EEM packet header format:
		* b0..13: length of ethernet frame
		* b14: bmCRC (0 == sentinel CRC)
		* b15: bmType (0 == data)
		*/
		len = skb->len;
		put_unaligned_le16((len & 0x3FFF) \| BIT(14), skb_push(skb, 2));

		/* add a zero-length EEM packet, if needed */
		if (padlen)
		put_unaligned_le16(0, skb_put(skb, 2));

		return skb;
		}

		/*
		* Remove the EEM header. Note that there can be many EEM packets in a single
		* USB transfer, so we need to break them out and handle them independently.
		*/
		static int eem_unwrap(struct gether *port,
		struct sk_buff *skb,
		struct sk_buff_head *list)
		{
		struct usb_composite_dev *cdev = port->func.config->cdev;
		int status = 0;

		do {
		struct sk_buff *skb2;
		u16 header;
		u16 len = 0;

		if (skb->len < EEM_HLEN) {
		status = -EINVAL;
		DBG(cdev, "invalid EEM header\n");
		goto error;
		}

		/* remove the EEM header */
		header = get_unaligned_le16(skb->data);
		skb_pull(skb, EEM_HLEN);

		/* EEM packet header format:
		* b0..14: EEM type dependent (data or command)
		* b15: bmType (0 == data, 1 == command)
		*/
		if (header & BIT(15)) {
		struct usb_request *req = cdev->req;
		u16 bmEEMCmd;

		/* EEM command packet format:
		* b0..10: bmEEMCmdParam
		* b11..13: bmEEMCmd
		* b14: reserved (must be zero)
		* b15: bmType (1 == command)
		*/
		if (header & BIT(14))
		continue;

		bmEEMCmd = (header >> 11) & 0x7;
		switch (bmEEMCmd) {
		case 0: /* echo */
		len = header & 0x7FF;
		if (skb->len < len) {
		status = -EOVERFLOW;
		goto error;
		}

		skb2 = skb_clone(skb, GFP_ATOMIC);
		if (unlikely(!skb2)) {
		DBG(cdev, "EEM echo response error\n");
		goto next;
		}
		skb_trim(skb2, len);
		put_unaligned_le16(BIT(15) \| BIT(11) \| len,
		skb_push(skb2, 2));
		skb_copy_bits(skb, 0, req->buf, skb->len);
		req->length = skb->len;
		req->complete = eem_cmd_complete;
		req->zero = 1;
		if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC))
		DBG(cdev, "echo response queue fail\n");
		break;

		case 1: /* echo response */
		case 2: /* suspend hint */
		case 3: /* response hint */
		case 4: /* response complete hint */
		case 5: /* tickle */
		default: /* reserved */
		continue;
		}
		} else {
		u32 crc, crc2;
		struct sk_buff *skb3;

		/* check for zero-length EEM packet */
		if (header == 0)
		continue;

		/* EEM data packet format:
		* b0..13: length of ethernet frame
		* b14: bmCRC (0 == sentinel, 1 == calculated)
		* b15: bmType (0 == data)
		*/
		len = header & 0x3FFF;
		if ((skb->len < len)
		\|\| (len < (ETH_HLEN + ETH_FCS_LEN))) {
		status = -EINVAL;
		goto error;
		}

		/* validate CRC */
		crc = get_unaligned_le32(skb->data + len - ETH_FCS_LEN);
		if (header & BIT(14)) {
		crc = get_unaligned_le32(skb->data + len
		- ETH_FCS_LEN);
		crc2 = ~crc32_le(~0,
		skb->data,
		skb->len - ETH_FCS_LEN);
		} else {
		crc = get_unaligned_be32(skb->data + len
		- ETH_FCS_LEN);
		crc2 = 0xdeadbeef;
		}
		if (crc != crc2) {
		DBG(cdev, "invalid EEM CRC\n");
		goto next;
		}

		skb2 = skb_clone(skb, GFP_ATOMIC);
		if (unlikely(!skb2)) {
		DBG(cdev, "unable to unframe EEM packet\n");
		continue;
		}
		skb_trim(skb2, len - ETH_FCS_LEN);

		skb3 = skb_copy_expand(skb2,
		NET_IP_ALIGN,
		0,
		GFP_ATOMIC);
		if (unlikely(!skb3)) {
		DBG(cdev, "unable to realign EEM packet\n");
		dev_kfree_skb_any(skb2);
		continue;
		}
		dev_kfree_skb_any(skb2);
		skb_queue_tail(list, skb3);
		}
		next:
		skb_pull(skb, len);
		} while (skb->len);

		error:
		dev_kfree_skb_any(skb);
		return status;
		}

		/**
		* eem_bind_config - add CDC Ethernet (EEM) network link to a configuration
		* @c: the configuration to support the network link
		* Context: single threaded during gadget setup
		*
		* Returns zero on success, else negative errno.
		*
		* Caller must have called @gether_setup(). Caller is also responsible
		* for calling @gether_cleanup() before module unload.
		*/
		int __init eem_bind_config(struct usb_configuration *c)
		{
		struct f_eem *eem;
		int status;

		/* maybe allocate device-global string IDs */
		if (eem_string_defs[0].id == 0) {

		/* control interface label */
		status = usb_string_id(c->cdev);
		if (status < 0)
		return status;
		eem_string_defs[0].id = status;
		eem_intf.iInterface = status;
		}

		/* allocate and initialize one new instance */
		eem = kzalloc(sizeof *eem, GFP_KERNEL);
		if (!eem)
		return -ENOMEM;

		eem->port.cdc_filter = DEFAULT_FILTER;

		eem->port.func.name = "cdc_eem";
		eem->port.func.strings = eem_strings;
		/* descriptors are per-instance copies */
		eem->port.func.bind = eem_bind;
		eem->port.func.unbind = eem_unbind;
		eem->port.func.set_alt = eem_set_alt;
		eem->port.func.setup = eem_setup;
		eem->port.func.disable = eem_disable;
		eem->port.wrap = eem_wrap;
		eem->port.unwrap = eem_unwrap;
		eem->port.header_len = EEM_HLEN;

		status = usb_add_function(c, &eem->port.func);
		if (status)
		kfree(eem);
		return status;
		}

drivers/usb/gadget/f_rndis.c

+10 −5

Original line number	Diff line number	Diff line
		@@ -286,12 +286,17 @@ static struct usb_gadget_strings *rndis_strings[] = {

		/-------------------------------------------------------------------------/

		static struct sk_buff rndis_add_header(struct sk_buff skb)
		static struct sk_buff rndis_add_header(struct gether port,
		struct sk_buff *skb)
		{
		skb = skb_realloc_headroom(skb, sizeof(struct rndis_packet_msg_type));
		if (skb)
		rndis_add_hdr(skb);
		return skb;
		struct sk_buff *skb2;

		skb2 = skb_realloc_headroom(skb, sizeof(struct rndis_packet_msg_type));
		if (skb2)
		rndis_add_hdr(skb2);

		dev_kfree_skb_any(skb);
		return skb2;
		}

		static void rndis_response_available(void *_rndis)

drivers/usb/gadget/rndis.c

+10 −3

Original line number	Diff line number	Diff line
		@@ -1022,22 +1022,29 @@ static rndis_resp_t *rndis_add_response (int configNr, u32 length)
		return r;
		}

		int rndis_rm_hdr(struct sk_buff *skb)
		int rndis_rm_hdr(struct gether *port,
		struct sk_buff *skb,
		struct sk_buff_head *list)
		{
		/* tmp points to a struct rndis_packet_msg_type */
		__le32 tmp = (void ) skb->data;

		/* MessageType, MessageLength */
		if (cpu_to_le32(REMOTE_NDIS_PACKET_MSG)
		!= get_unaligned(tmp++))
		!= get_unaligned(tmp++)) {
		dev_kfree_skb_any(skb);
		return -EINVAL;
		}
		tmp++;

		/* DataOffset, DataLength */
		if (!skb_pull(skb, get_unaligned_le32(tmp++) + 8))
		if (!skb_pull(skb, get_unaligned_le32(tmp++) + 8)) {
		dev_kfree_skb_any(skb);
		return -EOVERFLOW;
		}
		skb_trim(skb, get_unaligned_le32(tmp++));

		skb_queue_tail(list, skb);
		return 0;
		}