1 /* 2 * f_fs.c -- user mode file system API for USB composite function controllers 3 * 4 * Copyright (C) 2010 Samsung Electronics 5 * Author: Michal Nazarewicz <mina86@mina86.com> 6 * 7 * Based on inode.c (GadgetFS) which was: 8 * Copyright (C) 2003-2004 David Brownell 9 * Copyright (C) 2003 Agilent Technologies 10 * 11 * This program is free software; you can redistribute it and/or modify 12 * it under the terms of the GNU General Public License as published by 13 * the Free Software Foundation; either version 2 of the License, or 14 * (at your option) any later version. 15 */ 16 17 18 /* #define DEBUG */ 19 /* #define VERBOSE_DEBUG */ 20 21 #include <linux/blkdev.h> 22 #include <linux/pagemap.h> 23 #include <linux/export.h> 24 #include <linux/hid.h> 25 #include <linux/module.h> 26 #include <linux/uio.h> 27 #include <asm/unaligned.h> 28 29 #include <linux/usb/composite.h> 30 #include <linux/usb/functionfs.h> 31 32 #include <linux/aio.h> 33 #include <linux/mmu_context.h> 34 #include <linux/poll.h> 35 #include <linux/eventfd.h> 36 37 #include "u_fs.h" 38 #include "u_f.h" 39 #include "u_os_desc.h" 40 #include "configfs.h" 41 42 #define FUNCTIONFS_MAGIC 0xa647361 /* Chosen by a honest dice roll ;) */ 43 44 /* Reference counter handling */ 45 static void ffs_data_get(struct ffs_data *ffs); 46 static void ffs_data_put(struct ffs_data *ffs); 47 /* Creates new ffs_data object. */ 48 static struct ffs_data *__must_check ffs_data_new(void) __attribute__((malloc)); 49 50 /* Opened counter handling. */ 51 static void ffs_data_opened(struct ffs_data *ffs); 52 static void ffs_data_closed(struct ffs_data *ffs); 53 54 /* Called with ffs->mutex held; take over ownership of data. */ 55 static int __must_check 56 __ffs_data_got_descs(struct ffs_data *ffs, char *data, size_t len); 57 static int __must_check 58 __ffs_data_got_strings(struct ffs_data *ffs, char *data, size_t len); 59 60 61 /* The function structure ***************************************************/ 62 63 struct ffs_ep; 64 65 struct ffs_function { 66 struct usb_configuration *conf; 67 struct usb_gadget *gadget; 68 struct ffs_data *ffs; 69 70 struct ffs_ep *eps; 71 u8 eps_revmap[16]; 72 short *interfaces_nums; 73 74 struct usb_function function; 75 }; 76 77 78 static struct ffs_function *ffs_func_from_usb(struct usb_function *f) 79 { 80 return container_of(f, struct ffs_function, function); 81 } 82 83 84 static inline enum ffs_setup_state 85 ffs_setup_state_clear_cancelled(struct ffs_data *ffs) 86 { 87 return (enum ffs_setup_state) 88 cmpxchg(&ffs->setup_state, FFS_SETUP_CANCELLED, FFS_NO_SETUP); 89 } 90 91 92 static void ffs_func_eps_disable(struct ffs_function *func); 93 static int __must_check ffs_func_eps_enable(struct ffs_function *func); 94 95 static int ffs_func_bind(struct usb_configuration *, 96 struct usb_function *); 97 static int ffs_func_set_alt(struct usb_function *, unsigned, unsigned); 98 static void ffs_func_disable(struct usb_function *); 99 static int ffs_func_setup(struct usb_function *, 100 const struct usb_ctrlrequest *); 101 static void ffs_func_suspend(struct usb_function *); 102 static void ffs_func_resume(struct usb_function *); 103 104 105 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num); 106 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf); 107 108 109 /* The endpoints structures *************************************************/ 110 111 struct ffs_ep { 112 struct usb_ep *ep; /* P: ffs->eps_lock */ 113 struct usb_request *req; /* P: epfile->mutex */ 114 115 /* [0]: full speed, [1]: high speed, [2]: super speed */ 116 struct usb_endpoint_descriptor *descs[3]; 117 118 u8 num; 119 120 int status; /* P: epfile->mutex */ 121 }; 122 123 struct ffs_epfile { 124 /* Protects ep->ep and ep->req. */ 125 struct mutex mutex; 126 wait_queue_head_t wait; 127 128 struct ffs_data *ffs; 129 struct ffs_ep *ep; /* P: ffs->eps_lock */ 130 131 struct dentry *dentry; 132 133 char name[5]; 134 135 unsigned char in; /* P: ffs->eps_lock */ 136 unsigned char isoc; /* P: ffs->eps_lock */ 137 138 unsigned char _pad; 139 }; 140 141 /* ffs_io_data structure ***************************************************/ 142 143 struct ffs_io_data { 144 bool aio; 145 bool read; 146 147 struct kiocb *kiocb; 148 struct iov_iter data; 149 const void *to_free; 150 char *buf; 151 152 struct mm_struct *mm; 153 struct work_struct work; 154 155 struct usb_ep *ep; 156 struct usb_request *req; 157 158 struct ffs_data *ffs; 159 }; 160 161 struct ffs_desc_helper { 162 struct ffs_data *ffs; 163 unsigned interfaces_count; 164 unsigned eps_count; 165 }; 166 167 static int __must_check ffs_epfiles_create(struct ffs_data *ffs); 168 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count); 169 170 static struct dentry * 171 ffs_sb_create_file(struct super_block *sb, const char *name, void *data, 172 const struct file_operations *fops); 173 174 /* Devices management *******************************************************/ 175 176 DEFINE_MUTEX(ffs_lock); 177 EXPORT_SYMBOL_GPL(ffs_lock); 178 179 static struct ffs_dev *_ffs_find_dev(const char *name); 180 static struct ffs_dev *_ffs_alloc_dev(void); 181 static int _ffs_name_dev(struct ffs_dev *dev, const char *name); 182 static void _ffs_free_dev(struct ffs_dev *dev); 183 static void *ffs_acquire_dev(const char *dev_name); 184 static void ffs_release_dev(struct ffs_data *ffs_data); 185 static int ffs_ready(struct ffs_data *ffs); 186 static void ffs_closed(struct ffs_data *ffs); 187 188 /* Misc helper functions ****************************************************/ 189 190 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock) 191 __attribute__((warn_unused_result, nonnull)); 192 static char *ffs_prepare_buffer(const char __user *buf, size_t len) 193 __attribute__((warn_unused_result, nonnull)); 194 195 196 /* Control file aka ep0 *****************************************************/ 197 198 static void ffs_ep0_complete(struct usb_ep *ep, struct usb_request *req) 199 { 200 struct ffs_data *ffs = req->context; 201 202 complete_all(&ffs->ep0req_completion); 203 } 204 205 static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len) 206 { 207 struct usb_request *req = ffs->ep0req; 208 int ret; 209 210 req->zero = len < le16_to_cpu(ffs->ev.setup.wLength); 211 212 spin_unlock_irq(&ffs->ev.waitq.lock); 213 214 req->buf = data; 215 req->length = len; 216 217 /* 218 * UDC layer requires to provide a buffer even for ZLP, but should 219 * not use it at all. Let's provide some poisoned pointer to catch 220 * possible bug in the driver. 221 */ 222 if (req->buf == NULL) 223 req->buf = (void *)0xDEADBABE; 224 225 reinit_completion(&ffs->ep0req_completion); 226 227 ret = usb_ep_queue(ffs->gadget->ep0, req, GFP_ATOMIC); 228 if (unlikely(ret < 0)) 229 return ret; 230 231 ret = wait_for_completion_interruptible(&ffs->ep0req_completion); 232 if (unlikely(ret)) { 233 usb_ep_dequeue(ffs->gadget->ep0, req); 234 return -EINTR; 235 } 236 237 ffs->setup_state = FFS_NO_SETUP; 238 return req->status ? req->status : req->actual; 239 } 240 241 static int __ffs_ep0_stall(struct ffs_data *ffs) 242 { 243 if (ffs->ev.can_stall) { 244 pr_vdebug("ep0 stall\n"); 245 usb_ep_set_halt(ffs->gadget->ep0); 246 ffs->setup_state = FFS_NO_SETUP; 247 return -EL2HLT; 248 } else { 249 pr_debug("bogus ep0 stall!\n"); 250 return -ESRCH; 251 } 252 } 253 254 static ssize_t ffs_ep0_write(struct file *file, const char __user *buf, 255 size_t len, loff_t *ptr) 256 { 257 struct ffs_data *ffs = file->private_data; 258 ssize_t ret; 259 char *data; 260 261 ENTER(); 262 263 /* Fast check if setup was canceled */ 264 if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED) 265 return -EIDRM; 266 267 /* Acquire mutex */ 268 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK); 269 if (unlikely(ret < 0)) 270 return ret; 271 272 /* Check state */ 273 switch (ffs->state) { 274 case FFS_READ_DESCRIPTORS: 275 case FFS_READ_STRINGS: 276 /* Copy data */ 277 if (unlikely(len < 16)) { 278 ret = -EINVAL; 279 break; 280 } 281 282 data = ffs_prepare_buffer(buf, len); 283 if (IS_ERR(data)) { 284 ret = PTR_ERR(data); 285 break; 286 } 287 288 /* Handle data */ 289 if (ffs->state == FFS_READ_DESCRIPTORS) { 290 pr_info("read descriptors\n"); 291 ret = __ffs_data_got_descs(ffs, data, len); 292 if (unlikely(ret < 0)) 293 break; 294 295 ffs->state = FFS_READ_STRINGS; 296 ret = len; 297 } else { 298 pr_info("read strings\n"); 299 ret = __ffs_data_got_strings(ffs, data, len); 300 if (unlikely(ret < 0)) 301 break; 302 303 ret = ffs_epfiles_create(ffs); 304 if (unlikely(ret)) { 305 ffs->state = FFS_CLOSING; 306 break; 307 } 308 309 ffs->state = FFS_ACTIVE; 310 mutex_unlock(&ffs->mutex); 311 312 ret = ffs_ready(ffs); 313 if (unlikely(ret < 0)) { 314 ffs->state = FFS_CLOSING; 315 return ret; 316 } 317 318 return len; 319 } 320 break; 321 322 case FFS_ACTIVE: 323 data = NULL; 324 /* 325 * We're called from user space, we can use _irq 326 * rather then _irqsave 327 */ 328 spin_lock_irq(&ffs->ev.waitq.lock); 329 switch (ffs_setup_state_clear_cancelled(ffs)) { 330 case FFS_SETUP_CANCELLED: 331 ret = -EIDRM; 332 goto done_spin; 333 334 case FFS_NO_SETUP: 335 ret = -ESRCH; 336 goto done_spin; 337 338 case FFS_SETUP_PENDING: 339 break; 340 } 341 342 /* FFS_SETUP_PENDING */ 343 if (!(ffs->ev.setup.bRequestType & USB_DIR_IN)) { 344 spin_unlock_irq(&ffs->ev.waitq.lock); 345 ret = __ffs_ep0_stall(ffs); 346 break; 347 } 348 349 /* FFS_SETUP_PENDING and not stall */ 350 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength)); 351 352 spin_unlock_irq(&ffs->ev.waitq.lock); 353 354 data = ffs_prepare_buffer(buf, len); 355 if (IS_ERR(data)) { 356 ret = PTR_ERR(data); 357 break; 358 } 359 360 spin_lock_irq(&ffs->ev.waitq.lock); 361 362 /* 363 * We are guaranteed to be still in FFS_ACTIVE state 364 * but the state of setup could have changed from 365 * FFS_SETUP_PENDING to FFS_SETUP_CANCELLED so we need 366 * to check for that. If that happened we copied data 367 * from user space in vain but it's unlikely. 368 * 369 * For sure we are not in FFS_NO_SETUP since this is 370 * the only place FFS_SETUP_PENDING -> FFS_NO_SETUP 371 * transition can be performed and it's protected by 372 * mutex. 373 */ 374 if (ffs_setup_state_clear_cancelled(ffs) == 375 FFS_SETUP_CANCELLED) { 376 ret = -EIDRM; 377 done_spin: 378 spin_unlock_irq(&ffs->ev.waitq.lock); 379 } else { 380 /* unlocks spinlock */ 381 ret = __ffs_ep0_queue_wait(ffs, data, len); 382 } 383 kfree(data); 384 break; 385 386 default: 387 ret = -EBADFD; 388 break; 389 } 390 391 mutex_unlock(&ffs->mutex); 392 return ret; 393 } 394 395 /* Called with ffs->ev.waitq.lock and ffs->mutex held, both released on exit. */ 396 static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf, 397 size_t n) 398 { 399 /* 400 * n cannot be bigger than ffs->ev.count, which cannot be bigger than 401 * size of ffs->ev.types array (which is four) so that's how much space 402 * we reserve. 403 */ 404 struct usb_functionfs_event events[ARRAY_SIZE(ffs->ev.types)]; 405 const size_t size = n * sizeof *events; 406 unsigned i = 0; 407 408 memset(events, 0, size); 409 410 do { 411 events[i].type = ffs->ev.types[i]; 412 if (events[i].type == FUNCTIONFS_SETUP) { 413 events[i].u.setup = ffs->ev.setup; 414 ffs->setup_state = FFS_SETUP_PENDING; 415 } 416 } while (++i < n); 417 418 ffs->ev.count -= n; 419 if (ffs->ev.count) 420 memmove(ffs->ev.types, ffs->ev.types + n, 421 ffs->ev.count * sizeof *ffs->ev.types); 422 423 spin_unlock_irq(&ffs->ev.waitq.lock); 424 mutex_unlock(&ffs->mutex); 425 426 return unlikely(__copy_to_user(buf, events, size)) ? -EFAULT : size; 427 } 428 429 static ssize_t ffs_ep0_read(struct file *file, char __user *buf, 430 size_t len, loff_t *ptr) 431 { 432 struct ffs_data *ffs = file->private_data; 433 char *data = NULL; 434 size_t n; 435 int ret; 436 437 ENTER(); 438 439 /* Fast check if setup was canceled */ 440 if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED) 441 return -EIDRM; 442 443 /* Acquire mutex */ 444 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK); 445 if (unlikely(ret < 0)) 446 return ret; 447 448 /* Check state */ 449 if (ffs->state != FFS_ACTIVE) { 450 ret = -EBADFD; 451 goto done_mutex; 452 } 453 454 /* 455 * We're called from user space, we can use _irq rather then 456 * _irqsave 457 */ 458 spin_lock_irq(&ffs->ev.waitq.lock); 459 460 switch (ffs_setup_state_clear_cancelled(ffs)) { 461 case FFS_SETUP_CANCELLED: 462 ret = -EIDRM; 463 break; 464 465 case FFS_NO_SETUP: 466 n = len / sizeof(struct usb_functionfs_event); 467 if (unlikely(!n)) { 468 ret = -EINVAL; 469 break; 470 } 471 472 if ((file->f_flags & O_NONBLOCK) && !ffs->ev.count) { 473 ret = -EAGAIN; 474 break; 475 } 476 477 if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq, 478 ffs->ev.count)) { 479 ret = -EINTR; 480 break; 481 } 482 483 return __ffs_ep0_read_events(ffs, buf, 484 min(n, (size_t)ffs->ev.count)); 485 486 case FFS_SETUP_PENDING: 487 if (ffs->ev.setup.bRequestType & USB_DIR_IN) { 488 spin_unlock_irq(&ffs->ev.waitq.lock); 489 ret = __ffs_ep0_stall(ffs); 490 goto done_mutex; 491 } 492 493 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength)); 494 495 spin_unlock_irq(&ffs->ev.waitq.lock); 496 497 if (likely(len)) { 498 data = kmalloc(len, GFP_KERNEL); 499 if (unlikely(!data)) { 500 ret = -ENOMEM; 501 goto done_mutex; 502 } 503 } 504 505 spin_lock_irq(&ffs->ev.waitq.lock); 506 507 /* See ffs_ep0_write() */ 508 if (ffs_setup_state_clear_cancelled(ffs) == 509 FFS_SETUP_CANCELLED) { 510 ret = -EIDRM; 511 break; 512 } 513 514 /* unlocks spinlock */ 515 ret = __ffs_ep0_queue_wait(ffs, data, len); 516 if (likely(ret > 0) && unlikely(__copy_to_user(buf, data, len))) 517 ret = -EFAULT; 518 goto done_mutex; 519 520 default: 521 ret = -EBADFD; 522 break; 523 } 524 525 spin_unlock_irq(&ffs->ev.waitq.lock); 526 done_mutex: 527 mutex_unlock(&ffs->mutex); 528 kfree(data); 529 return ret; 530 } 531 532 static int ffs_ep0_open(struct inode *inode, struct file *file) 533 { 534 struct ffs_data *ffs = inode->i_private; 535 536 ENTER(); 537 538 if (unlikely(ffs->state == FFS_CLOSING)) 539 return -EBUSY; 540 541 file->private_data = ffs; 542 ffs_data_opened(ffs); 543 544 return 0; 545 } 546 547 static int ffs_ep0_release(struct inode *inode, struct file *file) 548 { 549 struct ffs_data *ffs = file->private_data; 550 551 ENTER(); 552 553 ffs_data_closed(ffs); 554 555 return 0; 556 } 557 558 static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value) 559 { 560 struct ffs_data *ffs = file->private_data; 561 struct usb_gadget *gadget = ffs->gadget; 562 long ret; 563 564 ENTER(); 565 566 if (code == FUNCTIONFS_INTERFACE_REVMAP) { 567 struct ffs_function *func = ffs->func; 568 ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV; 569 } else if (gadget && gadget->ops->ioctl) { 570 ret = gadget->ops->ioctl(gadget, code, value); 571 } else { 572 ret = -ENOTTY; 573 } 574 575 return ret; 576 } 577 578 static unsigned int ffs_ep0_poll(struct file *file, poll_table *wait) 579 { 580 struct ffs_data *ffs = file->private_data; 581 unsigned int mask = POLLWRNORM; 582 int ret; 583 584 poll_wait(file, &ffs->ev.waitq, wait); 585 586 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK); 587 if (unlikely(ret < 0)) 588 return mask; 589 590 switch (ffs->state) { 591 case FFS_READ_DESCRIPTORS: 592 case FFS_READ_STRINGS: 593 mask |= POLLOUT; 594 break; 595 596 case FFS_ACTIVE: 597 switch (ffs->setup_state) { 598 case FFS_NO_SETUP: 599 if (ffs->ev.count) 600 mask |= POLLIN; 601 break; 602 603 case FFS_SETUP_PENDING: 604 case FFS_SETUP_CANCELLED: 605 mask |= (POLLIN | POLLOUT); 606 break; 607 } 608 case FFS_CLOSING: 609 break; 610 case FFS_DEACTIVATED: 611 break; 612 } 613 614 mutex_unlock(&ffs->mutex); 615 616 return mask; 617 } 618 619 static const struct file_operations ffs_ep0_operations = { 620 .llseek = no_llseek, 621 622 .open = ffs_ep0_open, 623 .write = ffs_ep0_write, 624 .read = ffs_ep0_read, 625 .release = ffs_ep0_release, 626 .unlocked_ioctl = ffs_ep0_ioctl, 627 .poll = ffs_ep0_poll, 628 }; 629 630 631 /* "Normal" endpoints operations ********************************************/ 632 633 static void ffs_epfile_io_complete(struct usb_ep *_ep, struct usb_request *req) 634 { 635 ENTER(); 636 if (likely(req->context)) { 637 struct ffs_ep *ep = _ep->driver_data; 638 ep->status = req->status ? req->status : req->actual; 639 complete(req->context); 640 } 641 } 642 643 static void ffs_user_copy_worker(struct work_struct *work) 644 { 645 struct ffs_io_data *io_data = container_of(work, struct ffs_io_data, 646 work); 647 int ret = io_data->req->status ? io_data->req->status : 648 io_data->req->actual; 649 650 if (io_data->read && ret > 0) { 651 use_mm(io_data->mm); 652 ret = copy_to_iter(io_data->buf, ret, &io_data->data); 653 if (iov_iter_count(&io_data->data)) 654 ret = -EFAULT; 655 unuse_mm(io_data->mm); 656 } 657 658 io_data->kiocb->ki_complete(io_data->kiocb, ret, ret); 659 660 if (io_data->ffs->ffs_eventfd && 661 !(io_data->kiocb->ki_flags & IOCB_EVENTFD)) 662 eventfd_signal(io_data->ffs->ffs_eventfd, 1); 663 664 usb_ep_free_request(io_data->ep, io_data->req); 665 666 io_data->kiocb->private = NULL; 667 if (io_data->read) 668 kfree(io_data->to_free); 669 kfree(io_data->buf); 670 kfree(io_data); 671 } 672 673 static void ffs_epfile_async_io_complete(struct usb_ep *_ep, 674 struct usb_request *req) 675 { 676 struct ffs_io_data *io_data = req->context; 677 678 ENTER(); 679 680 INIT_WORK(&io_data->work, ffs_user_copy_worker); 681 schedule_work(&io_data->work); 682 } 683 684 static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) 685 { 686 struct ffs_epfile *epfile = file->private_data; 687 struct ffs_ep *ep; 688 char *data = NULL; 689 ssize_t ret, data_len = -EINVAL; 690 int halt; 691 692 /* Are we still active? */ 693 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE)) { 694 ret = -ENODEV; 695 goto error; 696 } 697 698 /* Wait for endpoint to be enabled */ 699 ep = epfile->ep; 700 if (!ep) { 701 if (file->f_flags & O_NONBLOCK) { 702 ret = -EAGAIN; 703 goto error; 704 } 705 706 ret = wait_event_interruptible(epfile->wait, (ep = epfile->ep)); 707 if (ret) { 708 ret = -EINTR; 709 goto error; 710 } 711 } 712 713 /* Do we halt? */ 714 halt = (!io_data->read == !epfile->in); 715 if (halt && epfile->isoc) { 716 ret = -EINVAL; 717 goto error; 718 } 719 720 /* Allocate & copy */ 721 if (!halt) { 722 /* 723 * if we _do_ wait above, the epfile->ffs->gadget might be NULL 724 * before the waiting completes, so do not assign to 'gadget' earlier 725 */ 726 struct usb_gadget *gadget = epfile->ffs->gadget; 727 size_t copied; 728 729 spin_lock_irq(&epfile->ffs->eps_lock); 730 /* In the meantime, endpoint got disabled or changed. */ 731 if (epfile->ep != ep) { 732 spin_unlock_irq(&epfile->ffs->eps_lock); 733 return -ESHUTDOWN; 734 } 735 data_len = iov_iter_count(&io_data->data); 736 /* 737 * Controller may require buffer size to be aligned to 738 * maxpacketsize of an out endpoint. 739 */ 740 if (io_data->read) 741 data_len = usb_ep_align_maybe(gadget, ep->ep, data_len); 742 spin_unlock_irq(&epfile->ffs->eps_lock); 743 744 data = kmalloc(data_len, GFP_KERNEL); 745 if (unlikely(!data)) 746 return -ENOMEM; 747 if (!io_data->read) { 748 copied = copy_from_iter(data, data_len, &io_data->data); 749 if (copied != data_len) { 750 ret = -EFAULT; 751 goto error; 752 } 753 } 754 } 755 756 /* We will be using request */ 757 ret = ffs_mutex_lock(&epfile->mutex, file->f_flags & O_NONBLOCK); 758 if (unlikely(ret)) 759 goto error; 760 761 spin_lock_irq(&epfile->ffs->eps_lock); 762 763 if (epfile->ep != ep) { 764 /* In the meantime, endpoint got disabled or changed. */ 765 ret = -ESHUTDOWN; 766 spin_unlock_irq(&epfile->ffs->eps_lock); 767 } else if (halt) { 768 /* Halt */ 769 if (likely(epfile->ep == ep) && !WARN_ON(!ep->ep)) 770 usb_ep_set_halt(ep->ep); 771 spin_unlock_irq(&epfile->ffs->eps_lock); 772 ret = -EBADMSG; 773 } else { 774 /* Fire the request */ 775 struct usb_request *req; 776 777 /* 778 * Sanity Check: even though data_len can't be used 779 * uninitialized at the time I write this comment, some 780 * compilers complain about this situation. 781 * In order to keep the code clean from warnings, data_len is 782 * being initialized to -EINVAL during its declaration, which 783 * means we can't rely on compiler anymore to warn no future 784 * changes won't result in data_len being used uninitialized. 785 * For such reason, we're adding this redundant sanity check 786 * here. 787 */ 788 if (unlikely(data_len == -EINVAL)) { 789 WARN(1, "%s: data_len == -EINVAL\n", __func__); 790 ret = -EINVAL; 791 goto error_lock; 792 } 793 794 if (io_data->aio) { 795 req = usb_ep_alloc_request(ep->ep, GFP_KERNEL); 796 if (unlikely(!req)) 797 goto error_lock; 798 799 req->buf = data; 800 req->length = data_len; 801 802 io_data->buf = data; 803 io_data->ep = ep->ep; 804 io_data->req = req; 805 io_data->ffs = epfile->ffs; 806 807 req->context = io_data; 808 req->complete = ffs_epfile_async_io_complete; 809 810 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC); 811 if (unlikely(ret)) { 812 usb_ep_free_request(ep->ep, req); 813 goto error_lock; 814 } 815 ret = -EIOCBQUEUED; 816 817 spin_unlock_irq(&epfile->ffs->eps_lock); 818 } else { 819 DECLARE_COMPLETION_ONSTACK(done); 820 821 req = ep->req; 822 req->buf = data; 823 req->length = data_len; 824 825 req->context = &done; 826 req->complete = ffs_epfile_io_complete; 827 828 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC); 829 830 spin_unlock_irq(&epfile->ffs->eps_lock); 831 832 if (unlikely(ret < 0)) { 833 /* nop */ 834 } else if (unlikely( 835 wait_for_completion_interruptible(&done))) { 836 ret = -EINTR; 837 usb_ep_dequeue(ep->ep, req); 838 } else { 839 /* 840 * XXX We may end up silently droping data 841 * here. Since data_len (i.e. req->length) may 842 * be bigger than len (after being rounded up 843 * to maxpacketsize), we may end up with more 844 * data then user space has space for. 845 */ 846 ret = ep->status; 847 if (io_data->read && ret > 0) { 848 ret = copy_to_iter(data, ret, &io_data->data); 849 if (!ret) 850 ret = -EFAULT; 851 } 852 } 853 kfree(data); 854 } 855 } 856 857 mutex_unlock(&epfile->mutex); 858 return ret; 859 860 error_lock: 861 spin_unlock_irq(&epfile->ffs->eps_lock); 862 mutex_unlock(&epfile->mutex); 863 error: 864 kfree(data); 865 return ret; 866 } 867 868 static int 869 ffs_epfile_open(struct inode *inode, struct file *file) 870 { 871 struct ffs_epfile *epfile = inode->i_private; 872 873 ENTER(); 874 875 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE)) 876 return -ENODEV; 877 878 file->private_data = epfile; 879 ffs_data_opened(epfile->ffs); 880 881 return 0; 882 } 883 884 static int ffs_aio_cancel(struct kiocb *kiocb) 885 { 886 struct ffs_io_data *io_data = kiocb->private; 887 struct ffs_epfile *epfile = kiocb->ki_filp->private_data; 888 int value; 889 890 ENTER(); 891 892 spin_lock_irq(&epfile->ffs->eps_lock); 893 894 if (likely(io_data && io_data->ep && io_data->req)) 895 value = usb_ep_dequeue(io_data->ep, io_data->req); 896 else 897 value = -EINVAL; 898 899 spin_unlock_irq(&epfile->ffs->eps_lock); 900 901 return value; 902 } 903 904 static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from) 905 { 906 struct ffs_io_data io_data, *p = &io_data; 907 ssize_t res; 908 909 ENTER(); 910 911 if (!is_sync_kiocb(kiocb)) { 912 p = kmalloc(sizeof(io_data), GFP_KERNEL); 913 if (unlikely(!p)) 914 return -ENOMEM; 915 p->aio = true; 916 } else { 917 p->aio = false; 918 } 919 920 p->read = false; 921 p->kiocb = kiocb; 922 p->data = *from; 923 p->mm = current->mm; 924 925 kiocb->private = p; 926 927 kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); 928 929 res = ffs_epfile_io(kiocb->ki_filp, p); 930 if (res == -EIOCBQUEUED) 931 return res; 932 if (p->aio) 933 kfree(p); 934 else 935 *from = p->data; 936 return res; 937 } 938 939 static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to) 940 { 941 struct ffs_io_data io_data, *p = &io_data; 942 ssize_t res; 943 944 ENTER(); 945 946 if (!is_sync_kiocb(kiocb)) { 947 p = kmalloc(sizeof(io_data), GFP_KERNEL); 948 if (unlikely(!p)) 949 return -ENOMEM; 950 p->aio = true; 951 } else { 952 p->aio = false; 953 } 954 955 p->read = true; 956 p->kiocb = kiocb; 957 if (p->aio) { 958 p->to_free = dup_iter(&p->data, to, GFP_KERNEL); 959 if (!p->to_free) { 960 kfree(p); 961 return -ENOMEM; 962 } 963 } else { 964 p->data = *to; 965 p->to_free = NULL; 966 } 967 p->mm = current->mm; 968 969 kiocb->private = p; 970 971 kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); 972 973 res = ffs_epfile_io(kiocb->ki_filp, p); 974 if (res == -EIOCBQUEUED) 975 return res; 976 977 if (p->aio) { 978 kfree(p->to_free); 979 kfree(p); 980 } else { 981 *to = p->data; 982 } 983 return res; 984 } 985 986 static int 987 ffs_epfile_release(struct inode *inode, struct file *file) 988 { 989 struct ffs_epfile *epfile = inode->i_private; 990 991 ENTER(); 992 993 ffs_data_closed(epfile->ffs); 994 995 return 0; 996 } 997 998 static long ffs_epfile_ioctl(struct file *file, unsigned code, 999 unsigned long value) 1000 { 1001 struct ffs_epfile *epfile = file->private_data; 1002 int ret; 1003 1004 ENTER(); 1005 1006 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE)) 1007 return -ENODEV; 1008 1009 spin_lock_irq(&epfile->ffs->eps_lock); 1010 if (likely(epfile->ep)) { 1011 switch (code) { 1012 case FUNCTIONFS_FIFO_STATUS: 1013 ret = usb_ep_fifo_status(epfile->ep->ep); 1014 break; 1015 case FUNCTIONFS_FIFO_FLUSH: 1016 usb_ep_fifo_flush(epfile->ep->ep); 1017 ret = 0; 1018 break; 1019 case FUNCTIONFS_CLEAR_HALT: 1020 ret = usb_ep_clear_halt(epfile->ep->ep); 1021 break; 1022 case FUNCTIONFS_ENDPOINT_REVMAP: 1023 ret = epfile->ep->num; 1024 break; 1025 case FUNCTIONFS_ENDPOINT_DESC: 1026 { 1027 int desc_idx; 1028 struct usb_endpoint_descriptor *desc; 1029 1030 switch (epfile->ffs->gadget->speed) { 1031 case USB_SPEED_SUPER: 1032 desc_idx = 2; 1033 break; 1034 case USB_SPEED_HIGH: 1035 desc_idx = 1; 1036 break; 1037 default: 1038 desc_idx = 0; 1039 } 1040 desc = epfile->ep->descs[desc_idx]; 1041 1042 spin_unlock_irq(&epfile->ffs->eps_lock); 1043 ret = copy_to_user((void *)value, desc, sizeof(*desc)); 1044 if (ret) 1045 ret = -EFAULT; 1046 return ret; 1047 } 1048 default: 1049 ret = -ENOTTY; 1050 } 1051 } else { 1052 ret = -ENODEV; 1053 } 1054 spin_unlock_irq(&epfile->ffs->eps_lock); 1055 1056 return ret; 1057 } 1058 1059 static const struct file_operations ffs_epfile_operations = { 1060 .llseek = no_llseek, 1061 1062 .open = ffs_epfile_open, 1063 .write_iter = ffs_epfile_write_iter, 1064 .read_iter = ffs_epfile_read_iter, 1065 .release = ffs_epfile_release, 1066 .unlocked_ioctl = ffs_epfile_ioctl, 1067 }; 1068 1069 1070 /* File system and super block operations ***********************************/ 1071 1072 /* 1073 * Mounting the file system creates a controller file, used first for 1074 * function configuration then later for event monitoring. 1075 */ 1076 1077 static struct inode *__must_check 1078 ffs_sb_make_inode(struct super_block *sb, void *data, 1079 const struct file_operations *fops, 1080 const struct inode_operations *iops, 1081 struct ffs_file_perms *perms) 1082 { 1083 struct inode *inode; 1084 1085 ENTER(); 1086 1087 inode = new_inode(sb); 1088 1089 if (likely(inode)) { 1090 struct timespec current_time = CURRENT_TIME; 1091 1092 inode->i_ino = get_next_ino(); 1093 inode->i_mode = perms->mode; 1094 inode->i_uid = perms->uid; 1095 inode->i_gid = perms->gid; 1096 inode->i_atime = current_time; 1097 inode->i_mtime = current_time; 1098 inode->i_ctime = current_time; 1099 inode->i_private = data; 1100 if (fops) 1101 inode->i_fop = fops; 1102 if (iops) 1103 inode->i_op = iops; 1104 } 1105 1106 return inode; 1107 } 1108 1109 /* Create "regular" file */ 1110 static struct dentry *ffs_sb_create_file(struct super_block *sb, 1111 const char *name, void *data, 1112 const struct file_operations *fops) 1113 { 1114 struct ffs_data *ffs = sb->s_fs_info; 1115 struct dentry *dentry; 1116 struct inode *inode; 1117 1118 ENTER(); 1119 1120 dentry = d_alloc_name(sb->s_root, name); 1121 if (unlikely(!dentry)) 1122 return NULL; 1123 1124 inode = ffs_sb_make_inode(sb, data, fops, NULL, &ffs->file_perms); 1125 if (unlikely(!inode)) { 1126 dput(dentry); 1127 return NULL; 1128 } 1129 1130 d_add(dentry, inode); 1131 return dentry; 1132 } 1133 1134 /* Super block */ 1135 static const struct super_operations ffs_sb_operations = { 1136 .statfs = simple_statfs, 1137 .drop_inode = generic_delete_inode, 1138 }; 1139 1140 struct ffs_sb_fill_data { 1141 struct ffs_file_perms perms; 1142 umode_t root_mode; 1143 const char *dev_name; 1144 bool no_disconnect; 1145 struct ffs_data *ffs_data; 1146 }; 1147 1148 static int ffs_sb_fill(struct super_block *sb, void *_data, int silent) 1149 { 1150 struct ffs_sb_fill_data *data = _data; 1151 struct inode *inode; 1152 struct ffs_data *ffs = data->ffs_data; 1153 1154 ENTER(); 1155 1156 ffs->sb = sb; 1157 data->ffs_data = NULL; 1158 sb->s_fs_info = ffs; 1159 sb->s_blocksize = PAGE_CACHE_SIZE; 1160 sb->s_blocksize_bits = PAGE_CACHE_SHIFT; 1161 sb->s_magic = FUNCTIONFS_MAGIC; 1162 sb->s_op = &ffs_sb_operations; 1163 sb->s_time_gran = 1; 1164 1165 /* Root inode */ 1166 data->perms.mode = data->root_mode; 1167 inode = ffs_sb_make_inode(sb, NULL, 1168 &simple_dir_operations, 1169 &simple_dir_inode_operations, 1170 &data->perms); 1171 sb->s_root = d_make_root(inode); 1172 if (unlikely(!sb->s_root)) 1173 return -ENOMEM; 1174 1175 /* EP0 file */ 1176 if (unlikely(!ffs_sb_create_file(sb, "ep0", ffs, 1177 &ffs_ep0_operations))) 1178 return -ENOMEM; 1179 1180 return 0; 1181 } 1182 1183 static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts) 1184 { 1185 ENTER(); 1186 1187 if (!opts || !*opts) 1188 return 0; 1189 1190 for (;;) { 1191 unsigned long value; 1192 char *eq, *comma; 1193 1194 /* Option limit */ 1195 comma = strchr(opts, ','); 1196 if (comma) 1197 *comma = 0; 1198 1199 /* Value limit */ 1200 eq = strchr(opts, '='); 1201 if (unlikely(!eq)) { 1202 pr_err("'=' missing in %s\n", opts); 1203 return -EINVAL; 1204 } 1205 *eq = 0; 1206 1207 /* Parse value */ 1208 if (kstrtoul(eq + 1, 0, &value)) { 1209 pr_err("%s: invalid value: %s\n", opts, eq + 1); 1210 return -EINVAL; 1211 } 1212 1213 /* Interpret option */ 1214 switch (eq - opts) { 1215 case 13: 1216 if (!memcmp(opts, "no_disconnect", 13)) 1217 data->no_disconnect = !!value; 1218 else 1219 goto invalid; 1220 break; 1221 case 5: 1222 if (!memcmp(opts, "rmode", 5)) 1223 data->root_mode = (value & 0555) | S_IFDIR; 1224 else if (!memcmp(opts, "fmode", 5)) 1225 data->perms.mode = (value & 0666) | S_IFREG; 1226 else 1227 goto invalid; 1228 break; 1229 1230 case 4: 1231 if (!memcmp(opts, "mode", 4)) { 1232 data->root_mode = (value & 0555) | S_IFDIR; 1233 data->perms.mode = (value & 0666) | S_IFREG; 1234 } else { 1235 goto invalid; 1236 } 1237 break; 1238 1239 case 3: 1240 if (!memcmp(opts, "uid", 3)) { 1241 data->perms.uid = make_kuid(current_user_ns(), value); 1242 if (!uid_valid(data->perms.uid)) { 1243 pr_err("%s: unmapped value: %lu\n", opts, value); 1244 return -EINVAL; 1245 } 1246 } else if (!memcmp(opts, "gid", 3)) { 1247 data->perms.gid = make_kgid(current_user_ns(), value); 1248 if (!gid_valid(data->perms.gid)) { 1249 pr_err("%s: unmapped value: %lu\n", opts, value); 1250 return -EINVAL; 1251 } 1252 } else { 1253 goto invalid; 1254 } 1255 break; 1256 1257 default: 1258 invalid: 1259 pr_err("%s: invalid option\n", opts); 1260 return -EINVAL; 1261 } 1262 1263 /* Next iteration */ 1264 if (!comma) 1265 break; 1266 opts = comma + 1; 1267 } 1268 1269 return 0; 1270 } 1271 1272 /* "mount -t functionfs dev_name /dev/function" ends up here */ 1273 1274 static struct dentry * 1275 ffs_fs_mount(struct file_system_type *t, int flags, 1276 const char *dev_name, void *opts) 1277 { 1278 struct ffs_sb_fill_data data = { 1279 .perms = { 1280 .mode = S_IFREG | 0600, 1281 .uid = GLOBAL_ROOT_UID, 1282 .gid = GLOBAL_ROOT_GID, 1283 }, 1284 .root_mode = S_IFDIR | 0500, 1285 .no_disconnect = false, 1286 }; 1287 struct dentry *rv; 1288 int ret; 1289 void *ffs_dev; 1290 struct ffs_data *ffs; 1291 1292 ENTER(); 1293 1294 ret = ffs_fs_parse_opts(&data, opts); 1295 if (unlikely(ret < 0)) 1296 return ERR_PTR(ret); 1297 1298 ffs = ffs_data_new(); 1299 if (unlikely(!ffs)) 1300 return ERR_PTR(-ENOMEM); 1301 ffs->file_perms = data.perms; 1302 ffs->no_disconnect = data.no_disconnect; 1303 1304 ffs->dev_name = kstrdup(dev_name, GFP_KERNEL); 1305 if (unlikely(!ffs->dev_name)) { 1306 ffs_data_put(ffs); 1307 return ERR_PTR(-ENOMEM); 1308 } 1309 1310 ffs_dev = ffs_acquire_dev(dev_name); 1311 if (IS_ERR(ffs_dev)) { 1312 ffs_data_put(ffs); 1313 return ERR_CAST(ffs_dev); 1314 } 1315 ffs->private_data = ffs_dev; 1316 data.ffs_data = ffs; 1317 1318 rv = mount_nodev(t, flags, &data, ffs_sb_fill); 1319 if (IS_ERR(rv) && data.ffs_data) { 1320 ffs_release_dev(data.ffs_data); 1321 ffs_data_put(data.ffs_data); 1322 } 1323 return rv; 1324 } 1325 1326 static void 1327 ffs_fs_kill_sb(struct super_block *sb) 1328 { 1329 ENTER(); 1330 1331 kill_litter_super(sb); 1332 if (sb->s_fs_info) { 1333 ffs_release_dev(sb->s_fs_info); 1334 ffs_data_closed(sb->s_fs_info); 1335 ffs_data_put(sb->s_fs_info); 1336 } 1337 } 1338 1339 static struct file_system_type ffs_fs_type = { 1340 .owner = THIS_MODULE, 1341 .name = "functionfs", 1342 .mount = ffs_fs_mount, 1343 .kill_sb = ffs_fs_kill_sb, 1344 }; 1345 MODULE_ALIAS_FS("functionfs"); 1346 1347 1348 /* Driver's main init/cleanup functions *************************************/ 1349 1350 static int functionfs_init(void) 1351 { 1352 int ret; 1353 1354 ENTER(); 1355 1356 ret = register_filesystem(&ffs_fs_type); 1357 if (likely(!ret)) 1358 pr_info("file system registered\n"); 1359 else 1360 pr_err("failed registering file system (%d)\n", ret); 1361 1362 return ret; 1363 } 1364 1365 static void functionfs_cleanup(void) 1366 { 1367 ENTER(); 1368 1369 pr_info("unloading\n"); 1370 unregister_filesystem(&ffs_fs_type); 1371 } 1372 1373 1374 /* ffs_data and ffs_function construction and destruction code **************/ 1375 1376 static void ffs_data_clear(struct ffs_data *ffs); 1377 static void ffs_data_reset(struct ffs_data *ffs); 1378 1379 static void ffs_data_get(struct ffs_data *ffs) 1380 { 1381 ENTER(); 1382 1383 atomic_inc(&ffs->ref); 1384 } 1385 1386 static void ffs_data_opened(struct ffs_data *ffs) 1387 { 1388 ENTER(); 1389 1390 atomic_inc(&ffs->ref); 1391 if (atomic_add_return(1, &ffs->opened) == 1 && 1392 ffs->state == FFS_DEACTIVATED) { 1393 ffs->state = FFS_CLOSING; 1394 ffs_data_reset(ffs); 1395 } 1396 } 1397 1398 static void ffs_data_put(struct ffs_data *ffs) 1399 { 1400 ENTER(); 1401 1402 if (unlikely(atomic_dec_and_test(&ffs->ref))) { 1403 pr_info("%s(): freeing\n", __func__); 1404 ffs_data_clear(ffs); 1405 BUG_ON(waitqueue_active(&ffs->ev.waitq) || 1406 waitqueue_active(&ffs->ep0req_completion.wait)); 1407 kfree(ffs->dev_name); 1408 kfree(ffs); 1409 } 1410 } 1411 1412 static void ffs_data_closed(struct ffs_data *ffs) 1413 { 1414 ENTER(); 1415 1416 if (atomic_dec_and_test(&ffs->opened)) { 1417 if (ffs->no_disconnect) { 1418 ffs->state = FFS_DEACTIVATED; 1419 if (ffs->epfiles) { 1420 ffs_epfiles_destroy(ffs->epfiles, 1421 ffs->eps_count); 1422 ffs->epfiles = NULL; 1423 } 1424 if (ffs->setup_state == FFS_SETUP_PENDING) 1425 __ffs_ep0_stall(ffs); 1426 } else { 1427 ffs->state = FFS_CLOSING; 1428 ffs_data_reset(ffs); 1429 } 1430 } 1431 if (atomic_read(&ffs->opened) < 0) { 1432 ffs->state = FFS_CLOSING; 1433 ffs_data_reset(ffs); 1434 } 1435 1436 ffs_data_put(ffs); 1437 } 1438 1439 static struct ffs_data *ffs_data_new(void) 1440 { 1441 struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL); 1442 if (unlikely(!ffs)) 1443 return NULL; 1444 1445 ENTER(); 1446 1447 atomic_set(&ffs->ref, 1); 1448 atomic_set(&ffs->opened, 0); 1449 ffs->state = FFS_READ_DESCRIPTORS; 1450 mutex_init(&ffs->mutex); 1451 spin_lock_init(&ffs->eps_lock); 1452 init_waitqueue_head(&ffs->ev.waitq); 1453 init_completion(&ffs->ep0req_completion); 1454 1455 /* XXX REVISIT need to update it in some places, or do we? */ 1456 ffs->ev.can_stall = 1; 1457 1458 return ffs; 1459 } 1460 1461 static void ffs_data_clear(struct ffs_data *ffs) 1462 { 1463 ENTER(); 1464 1465 ffs_closed(ffs); 1466 1467 BUG_ON(ffs->gadget); 1468 1469 if (ffs->epfiles) 1470 ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count); 1471 1472 if (ffs->ffs_eventfd) 1473 eventfd_ctx_put(ffs->ffs_eventfd); 1474 1475 kfree(ffs->raw_descs_data); 1476 kfree(ffs->raw_strings); 1477 kfree(ffs->stringtabs); 1478 } 1479 1480 static void ffs_data_reset(struct ffs_data *ffs) 1481 { 1482 ENTER(); 1483 1484 ffs_data_clear(ffs); 1485 1486 ffs->epfiles = NULL; 1487 ffs->raw_descs_data = NULL; 1488 ffs->raw_descs = NULL; 1489 ffs->raw_strings = NULL; 1490 ffs->stringtabs = NULL; 1491 1492 ffs->raw_descs_length = 0; 1493 ffs->fs_descs_count = 0; 1494 ffs->hs_descs_count = 0; 1495 ffs->ss_descs_count = 0; 1496 1497 ffs->strings_count = 0; 1498 ffs->interfaces_count = 0; 1499 ffs->eps_count = 0; 1500 1501 ffs->ev.count = 0; 1502 1503 ffs->state = FFS_READ_DESCRIPTORS; 1504 ffs->setup_state = FFS_NO_SETUP; 1505 ffs->flags = 0; 1506 } 1507 1508 1509 static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev) 1510 { 1511 struct usb_gadget_strings **lang; 1512 int first_id; 1513 1514 ENTER(); 1515 1516 if (WARN_ON(ffs->state != FFS_ACTIVE 1517 || test_and_set_bit(FFS_FL_BOUND, &ffs->flags))) 1518 return -EBADFD; 1519 1520 first_id = usb_string_ids_n(cdev, ffs->strings_count); 1521 if (unlikely(first_id < 0)) 1522 return first_id; 1523 1524 ffs->ep0req = usb_ep_alloc_request(cdev->gadget->ep0, GFP_KERNEL); 1525 if (unlikely(!ffs->ep0req)) 1526 return -ENOMEM; 1527 ffs->ep0req->complete = ffs_ep0_complete; 1528 ffs->ep0req->context = ffs; 1529 1530 lang = ffs->stringtabs; 1531 if (lang) { 1532 for (; *lang; ++lang) { 1533 struct usb_string *str = (*lang)->strings; 1534 int id = first_id; 1535 for (; str->s; ++id, ++str) 1536 str->id = id; 1537 } 1538 } 1539 1540 ffs->gadget = cdev->gadget; 1541 ffs_data_get(ffs); 1542 return 0; 1543 } 1544 1545 static void functionfs_unbind(struct ffs_data *ffs) 1546 { 1547 ENTER(); 1548 1549 if (!WARN_ON(!ffs->gadget)) { 1550 usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req); 1551 ffs->ep0req = NULL; 1552 ffs->gadget = NULL; 1553 clear_bit(FFS_FL_BOUND, &ffs->flags); 1554 ffs_data_put(ffs); 1555 } 1556 } 1557 1558 static int ffs_epfiles_create(struct ffs_data *ffs) 1559 { 1560 struct ffs_epfile *epfile, *epfiles; 1561 unsigned i, count; 1562 1563 ENTER(); 1564 1565 count = ffs->eps_count; 1566 epfiles = kcalloc(count, sizeof(*epfiles), GFP_KERNEL); 1567 if (!epfiles) 1568 return -ENOMEM; 1569 1570 epfile = epfiles; 1571 for (i = 1; i <= count; ++i, ++epfile) { 1572 epfile->ffs = ffs; 1573 mutex_init(&epfile->mutex); 1574 init_waitqueue_head(&epfile->wait); 1575 if (ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR) 1576 sprintf(epfile->name, "ep%02x", ffs->eps_addrmap[i]); 1577 else 1578 sprintf(epfile->name, "ep%u", i); 1579 epfile->dentry = ffs_sb_create_file(ffs->sb, epfile->name, 1580 epfile, 1581 &ffs_epfile_operations); 1582 if (unlikely(!epfile->dentry)) { 1583 ffs_epfiles_destroy(epfiles, i - 1); 1584 return -ENOMEM; 1585 } 1586 } 1587 1588 ffs->epfiles = epfiles; 1589 return 0; 1590 } 1591 1592 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count) 1593 { 1594 struct ffs_epfile *epfile = epfiles; 1595 1596 ENTER(); 1597 1598 for (; count; --count, ++epfile) { 1599 BUG_ON(mutex_is_locked(&epfile->mutex) || 1600 waitqueue_active(&epfile->wait)); 1601 if (epfile->dentry) { 1602 d_delete(epfile->dentry); 1603 dput(epfile->dentry); 1604 epfile->dentry = NULL; 1605 } 1606 } 1607 1608 kfree(epfiles); 1609 } 1610 1611 static void ffs_func_eps_disable(struct ffs_function *func) 1612 { 1613 struct ffs_ep *ep = func->eps; 1614 struct ffs_epfile *epfile = func->ffs->epfiles; 1615 unsigned count = func->ffs->eps_count; 1616 unsigned long flags; 1617 1618 spin_lock_irqsave(&func->ffs->eps_lock, flags); 1619 do { 1620 /* pending requests get nuked */ 1621 if (likely(ep->ep)) 1622 usb_ep_disable(ep->ep); 1623 ++ep; 1624 1625 if (epfile) { 1626 epfile->ep = NULL; 1627 ++epfile; 1628 } 1629 } while (--count); 1630 spin_unlock_irqrestore(&func->ffs->eps_lock, flags); 1631 } 1632 1633 static int ffs_func_eps_enable(struct ffs_function *func) 1634 { 1635 struct ffs_data *ffs = func->ffs; 1636 struct ffs_ep *ep = func->eps; 1637 struct ffs_epfile *epfile = ffs->epfiles; 1638 unsigned count = ffs->eps_count; 1639 unsigned long flags; 1640 int ret = 0; 1641 1642 spin_lock_irqsave(&func->ffs->eps_lock, flags); 1643 do { 1644 struct usb_endpoint_descriptor *ds; 1645 int desc_idx; 1646 1647 if (ffs->gadget->speed == USB_SPEED_SUPER) 1648 desc_idx = 2; 1649 else if (ffs->gadget->speed == USB_SPEED_HIGH) 1650 desc_idx = 1; 1651 else 1652 desc_idx = 0; 1653 1654 /* fall-back to lower speed if desc missing for current speed */ 1655 do { 1656 ds = ep->descs[desc_idx]; 1657 } while (!ds && --desc_idx >= 0); 1658 1659 if (!ds) { 1660 ret = -EINVAL; 1661 break; 1662 } 1663 1664 ep->ep->driver_data = ep; 1665 ep->ep->desc = ds; 1666 ret = usb_ep_enable(ep->ep); 1667 if (likely(!ret)) { 1668 epfile->ep = ep; 1669 epfile->in = usb_endpoint_dir_in(ds); 1670 epfile->isoc = usb_endpoint_xfer_isoc(ds); 1671 } else { 1672 break; 1673 } 1674 1675 wake_up(&epfile->wait); 1676 1677 ++ep; 1678 ++epfile; 1679 } while (--count); 1680 spin_unlock_irqrestore(&func->ffs->eps_lock, flags); 1681 1682 return ret; 1683 } 1684 1685 1686 /* Parsing and building descriptors and strings *****************************/ 1687 1688 /* 1689 * This validates if data pointed by data is a valid USB descriptor as 1690 * well as record how many interfaces, endpoints and strings are 1691 * required by given configuration. Returns address after the 1692 * descriptor or NULL if data is invalid. 1693 */ 1694 1695 enum ffs_entity_type { 1696 FFS_DESCRIPTOR, FFS_INTERFACE, FFS_STRING, FFS_ENDPOINT 1697 }; 1698 1699 enum ffs_os_desc_type { 1700 FFS_OS_DESC, FFS_OS_DESC_EXT_COMPAT, FFS_OS_DESC_EXT_PROP 1701 }; 1702 1703 typedef int (*ffs_entity_callback)(enum ffs_entity_type entity, 1704 u8 *valuep, 1705 struct usb_descriptor_header *desc, 1706 void *priv); 1707 1708 typedef int (*ffs_os_desc_callback)(enum ffs_os_desc_type entity, 1709 struct usb_os_desc_header *h, void *data, 1710 unsigned len, void *priv); 1711 1712 static int __must_check ffs_do_single_desc(char *data, unsigned len, 1713 ffs_entity_callback entity, 1714 void *priv) 1715 { 1716 struct usb_descriptor_header *_ds = (void *)data; 1717 u8 length; 1718 int ret; 1719 1720 ENTER(); 1721 1722 /* At least two bytes are required: length and type */ 1723 if (len < 2) { 1724 pr_vdebug("descriptor too short\n"); 1725 return -EINVAL; 1726 } 1727 1728 /* If we have at least as many bytes as the descriptor takes? */ 1729 length = _ds->bLength; 1730 if (len < length) { 1731 pr_vdebug("descriptor longer then available data\n"); 1732 return -EINVAL; 1733 } 1734 1735 #define __entity_check_INTERFACE(val) 1 1736 #define __entity_check_STRING(val) (val) 1737 #define __entity_check_ENDPOINT(val) ((val) & USB_ENDPOINT_NUMBER_MASK) 1738 #define __entity(type, val) do { \ 1739 pr_vdebug("entity " #type "(%02x)\n", (val)); \ 1740 if (unlikely(!__entity_check_ ##type(val))) { \ 1741 pr_vdebug("invalid entity's value\n"); \ 1742 return -EINVAL; \ 1743 } \ 1744 ret = entity(FFS_ ##type, &val, _ds, priv); \ 1745 if (unlikely(ret < 0)) { \ 1746 pr_debug("entity " #type "(%02x); ret = %d\n", \ 1747 (val), ret); \ 1748 return ret; \ 1749 } \ 1750 } while (0) 1751 1752 /* Parse descriptor depending on type. */ 1753 switch (_ds->bDescriptorType) { 1754 case USB_DT_DEVICE: 1755 case USB_DT_CONFIG: 1756 case USB_DT_STRING: 1757 case USB_DT_DEVICE_QUALIFIER: 1758 /* function can't have any of those */ 1759 pr_vdebug("descriptor reserved for gadget: %d\n", 1760 _ds->bDescriptorType); 1761 return -EINVAL; 1762 1763 case USB_DT_INTERFACE: { 1764 struct usb_interface_descriptor *ds = (void *)_ds; 1765 pr_vdebug("interface descriptor\n"); 1766 if (length != sizeof *ds) 1767 goto inv_length; 1768 1769 __entity(INTERFACE, ds->bInterfaceNumber); 1770 if (ds->iInterface) 1771 __entity(STRING, ds->iInterface); 1772 } 1773 break; 1774 1775 case USB_DT_ENDPOINT: { 1776 struct usb_endpoint_descriptor *ds = (void *)_ds; 1777 pr_vdebug("endpoint descriptor\n"); 1778 if (length != USB_DT_ENDPOINT_SIZE && 1779 length != USB_DT_ENDPOINT_AUDIO_SIZE) 1780 goto inv_length; 1781 __entity(ENDPOINT, ds->bEndpointAddress); 1782 } 1783 break; 1784 1785 case HID_DT_HID: 1786 pr_vdebug("hid descriptor\n"); 1787 if (length != sizeof(struct hid_descriptor)) 1788 goto inv_length; 1789 break; 1790 1791 case USB_DT_OTG: 1792 if (length != sizeof(struct usb_otg_descriptor)) 1793 goto inv_length; 1794 break; 1795 1796 case USB_DT_INTERFACE_ASSOCIATION: { 1797 struct usb_interface_assoc_descriptor *ds = (void *)_ds; 1798 pr_vdebug("interface association descriptor\n"); 1799 if (length != sizeof *ds) 1800 goto inv_length; 1801 if (ds->iFunction) 1802 __entity(STRING, ds->iFunction); 1803 } 1804 break; 1805 1806 case USB_DT_SS_ENDPOINT_COMP: 1807 pr_vdebug("EP SS companion descriptor\n"); 1808 if (length != sizeof(struct usb_ss_ep_comp_descriptor)) 1809 goto inv_length; 1810 break; 1811 1812 case USB_DT_OTHER_SPEED_CONFIG: 1813 case USB_DT_INTERFACE_POWER: 1814 case USB_DT_DEBUG: 1815 case USB_DT_SECURITY: 1816 case USB_DT_CS_RADIO_CONTROL: 1817 /* TODO */ 1818 pr_vdebug("unimplemented descriptor: %d\n", _ds->bDescriptorType); 1819 return -EINVAL; 1820 1821 default: 1822 /* We should never be here */ 1823 pr_vdebug("unknown descriptor: %d\n", _ds->bDescriptorType); 1824 return -EINVAL; 1825 1826 inv_length: 1827 pr_vdebug("invalid length: %d (descriptor %d)\n", 1828 _ds->bLength, _ds->bDescriptorType); 1829 return -EINVAL; 1830 } 1831 1832 #undef __entity 1833 #undef __entity_check_DESCRIPTOR 1834 #undef __entity_check_INTERFACE 1835 #undef __entity_check_STRING 1836 #undef __entity_check_ENDPOINT 1837 1838 return length; 1839 } 1840 1841 static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len, 1842 ffs_entity_callback entity, void *priv) 1843 { 1844 const unsigned _len = len; 1845 unsigned long num = 0; 1846 1847 ENTER(); 1848 1849 for (;;) { 1850 int ret; 1851 1852 if (num == count) 1853 data = NULL; 1854 1855 /* Record "descriptor" entity */ 1856 ret = entity(FFS_DESCRIPTOR, (u8 *)num, (void *)data, priv); 1857 if (unlikely(ret < 0)) { 1858 pr_debug("entity DESCRIPTOR(%02lx); ret = %d\n", 1859 num, ret); 1860 return ret; 1861 } 1862 1863 if (!data) 1864 return _len - len; 1865 1866 ret = ffs_do_single_desc(data, len, entity, priv); 1867 if (unlikely(ret < 0)) { 1868 pr_debug("%s returns %d\n", __func__, ret); 1869 return ret; 1870 } 1871 1872 len -= ret; 1873 data += ret; 1874 ++num; 1875 } 1876 } 1877 1878 static int __ffs_data_do_entity(enum ffs_entity_type type, 1879 u8 *valuep, struct usb_descriptor_header *desc, 1880 void *priv) 1881 { 1882 struct ffs_desc_helper *helper = priv; 1883 struct usb_endpoint_descriptor *d; 1884 1885 ENTER(); 1886 1887 switch (type) { 1888 case FFS_DESCRIPTOR: 1889 break; 1890 1891 case FFS_INTERFACE: 1892 /* 1893 * Interfaces are indexed from zero so if we 1894 * encountered interface "n" then there are at least 1895 * "n+1" interfaces. 1896 */ 1897 if (*valuep >= helper->interfaces_count) 1898 helper->interfaces_count = *valuep + 1; 1899 break; 1900 1901 case FFS_STRING: 1902 /* 1903 * Strings are indexed from 1 (0 is magic ;) reserved 1904 * for languages list or some such) 1905 */ 1906 if (*valuep > helper->ffs->strings_count) 1907 helper->ffs->strings_count = *valuep; 1908 break; 1909 1910 case FFS_ENDPOINT: 1911 d = (void *)desc; 1912 helper->eps_count++; 1913 if (helper->eps_count >= 15) 1914 return -EINVAL; 1915 /* Check if descriptors for any speed were already parsed */ 1916 if (!helper->ffs->eps_count && !helper->ffs->interfaces_count) 1917 helper->ffs->eps_addrmap[helper->eps_count] = 1918 d->bEndpointAddress; 1919 else if (helper->ffs->eps_addrmap[helper->eps_count] != 1920 d->bEndpointAddress) 1921 return -EINVAL; 1922 break; 1923 } 1924 1925 return 0; 1926 } 1927 1928 static int __ffs_do_os_desc_header(enum ffs_os_desc_type *next_type, 1929 struct usb_os_desc_header *desc) 1930 { 1931 u16 bcd_version = le16_to_cpu(desc->bcdVersion); 1932 u16 w_index = le16_to_cpu(desc->wIndex); 1933 1934 if (bcd_version != 1) { 1935 pr_vdebug("unsupported os descriptors version: %d", 1936 bcd_version); 1937 return -EINVAL; 1938 } 1939 switch (w_index) { 1940 case 0x4: 1941 *next_type = FFS_OS_DESC_EXT_COMPAT; 1942 break; 1943 case 0x5: 1944 *next_type = FFS_OS_DESC_EXT_PROP; 1945 break; 1946 default: 1947 pr_vdebug("unsupported os descriptor type: %d", w_index); 1948 return -EINVAL; 1949 } 1950 1951 return sizeof(*desc); 1952 } 1953 1954 /* 1955 * Process all extended compatibility/extended property descriptors 1956 * of a feature descriptor 1957 */ 1958 static int __must_check ffs_do_single_os_desc(char *data, unsigned len, 1959 enum ffs_os_desc_type type, 1960 u16 feature_count, 1961 ffs_os_desc_callback entity, 1962 void *priv, 1963 struct usb_os_desc_header *h) 1964 { 1965 int ret; 1966 const unsigned _len = len; 1967 1968 ENTER(); 1969 1970 /* loop over all ext compat/ext prop descriptors */ 1971 while (feature_count--) { 1972 ret = entity(type, h, data, len, priv); 1973 if (unlikely(ret < 0)) { 1974 pr_debug("bad OS descriptor, type: %d\n", type); 1975 return ret; 1976 } 1977 data += ret; 1978 len -= ret; 1979 } 1980 return _len - len; 1981 } 1982 1983 /* Process a number of complete Feature Descriptors (Ext Compat or Ext Prop) */ 1984 static int __must_check ffs_do_os_descs(unsigned count, 1985 char *data, unsigned len, 1986 ffs_os_desc_callback entity, void *priv) 1987 { 1988 const unsigned _len = len; 1989 unsigned long num = 0; 1990 1991 ENTER(); 1992 1993 for (num = 0; num < count; ++num) { 1994 int ret; 1995 enum ffs_os_desc_type type; 1996 u16 feature_count; 1997 struct usb_os_desc_header *desc = (void *)data; 1998 1999 if (len < sizeof(*desc)) 2000 return -EINVAL; 2001 2002 /* 2003 * Record "descriptor" entity. 2004 * Process dwLength, bcdVersion, wIndex, get b/wCount. 2005 * Move the data pointer to the beginning of extended 2006 * compatibilities proper or extended properties proper 2007 * portions of the data 2008 */ 2009 if (le32_to_cpu(desc->dwLength) > len) 2010 return -EINVAL; 2011 2012 ret = __ffs_do_os_desc_header(&type, desc); 2013 if (unlikely(ret < 0)) { 2014 pr_debug("entity OS_DESCRIPTOR(%02lx); ret = %d\n", 2015 num, ret); 2016 return ret; 2017 } 2018 /* 2019 * 16-bit hex "?? 00" Little Endian looks like 8-bit hex "??" 2020 */ 2021 feature_count = le16_to_cpu(desc->wCount); 2022 if (type == FFS_OS_DESC_EXT_COMPAT && 2023 (feature_count > 255 || desc->Reserved)) 2024 return -EINVAL; 2025 len -= ret; 2026 data += ret; 2027 2028 /* 2029 * Process all function/property descriptors 2030 * of this Feature Descriptor 2031 */ 2032 ret = ffs_do_single_os_desc(data, len, type, 2033 feature_count, entity, priv, desc); 2034 if (unlikely(ret < 0)) { 2035 pr_debug("%s returns %d\n", __func__, ret); 2036 return ret; 2037 } 2038 2039 len -= ret; 2040 data += ret; 2041 } 2042 return _len - len; 2043 } 2044 2045 /** 2046 * Validate contents of the buffer from userspace related to OS descriptors. 2047 */ 2048 static int __ffs_data_do_os_desc(enum ffs_os_desc_type type, 2049 struct usb_os_desc_header *h, void *data, 2050 unsigned len, void *priv) 2051 { 2052 struct ffs_data *ffs = priv; 2053 u8 length; 2054 2055 ENTER(); 2056 2057 switch (type) { 2058 case FFS_OS_DESC_EXT_COMPAT: { 2059 struct usb_ext_compat_desc *d = data; 2060 int i; 2061 2062 if (len < sizeof(*d) || 2063 d->bFirstInterfaceNumber >= ffs->interfaces_count || 2064 d->Reserved1) 2065 return -EINVAL; 2066 for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i) 2067 if (d->Reserved2[i]) 2068 return -EINVAL; 2069 2070 length = sizeof(struct usb_ext_compat_desc); 2071 } 2072 break; 2073 case FFS_OS_DESC_EXT_PROP: { 2074 struct usb_ext_prop_desc *d = data; 2075 u32 type, pdl; 2076 u16 pnl; 2077 2078 if (len < sizeof(*d) || h->interface >= ffs->interfaces_count) 2079 return -EINVAL; 2080 length = le32_to_cpu(d->dwSize); 2081 type = le32_to_cpu(d->dwPropertyDataType); 2082 if (type < USB_EXT_PROP_UNICODE || 2083 type > USB_EXT_PROP_UNICODE_MULTI) { 2084 pr_vdebug("unsupported os descriptor property type: %d", 2085 type); 2086 return -EINVAL; 2087 } 2088 pnl = le16_to_cpu(d->wPropertyNameLength); 2089 pdl = le32_to_cpu(*(u32 *)((u8 *)data + 10 + pnl)); 2090 if (length != 14 + pnl + pdl) { 2091 pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n", 2092 length, pnl, pdl, type); 2093 return -EINVAL; 2094 } 2095 ++ffs->ms_os_descs_ext_prop_count; 2096 /* property name reported to the host as "WCHAR"s */ 2097 ffs->ms_os_descs_ext_prop_name_len += pnl * 2; 2098 ffs->ms_os_descs_ext_prop_data_len += pdl; 2099 } 2100 break; 2101 default: 2102 pr_vdebug("unknown descriptor: %d\n", type); 2103 return -EINVAL; 2104 } 2105 return length; 2106 } 2107 2108 static int __ffs_data_got_descs(struct ffs_data *ffs, 2109 char *const _data, size_t len) 2110 { 2111 char *data = _data, *raw_descs; 2112 unsigned os_descs_count = 0, counts[3], flags; 2113 int ret = -EINVAL, i; 2114 struct ffs_desc_helper helper; 2115 2116 ENTER(); 2117 2118 if (get_unaligned_le32(data + 4) != len) 2119 goto error; 2120 2121 switch (get_unaligned_le32(data)) { 2122 case FUNCTIONFS_DESCRIPTORS_MAGIC: 2123 flags = FUNCTIONFS_HAS_FS_DESC | FUNCTIONFS_HAS_HS_DESC; 2124 data += 8; 2125 len -= 8; 2126 break; 2127 case FUNCTIONFS_DESCRIPTORS_MAGIC_V2: 2128 flags = get_unaligned_le32(data + 8); 2129 ffs->user_flags = flags; 2130 if (flags & ~(FUNCTIONFS_HAS_FS_DESC | 2131 FUNCTIONFS_HAS_HS_DESC | 2132 FUNCTIONFS_HAS_SS_DESC | 2133 FUNCTIONFS_HAS_MS_OS_DESC | 2134 FUNCTIONFS_VIRTUAL_ADDR | 2135 FUNCTIONFS_EVENTFD)) { 2136 ret = -ENOSYS; 2137 goto error; 2138 } 2139 data += 12; 2140 len -= 12; 2141 break; 2142 default: 2143 goto error; 2144 } 2145 2146 if (flags & FUNCTIONFS_EVENTFD) { 2147 if (len < 4) 2148 goto error; 2149 ffs->ffs_eventfd = 2150 eventfd_ctx_fdget((int)get_unaligned_le32(data)); 2151 if (IS_ERR(ffs->ffs_eventfd)) { 2152 ret = PTR_ERR(ffs->ffs_eventfd); 2153 ffs->ffs_eventfd = NULL; 2154 goto error; 2155 } 2156 data += 4; 2157 len -= 4; 2158 } 2159 2160 /* Read fs_count, hs_count and ss_count (if present) */ 2161 for (i = 0; i < 3; ++i) { 2162 if (!(flags & (1 << i))) { 2163 counts[i] = 0; 2164 } else if (len < 4) { 2165 goto error; 2166 } else { 2167 counts[i] = get_unaligned_le32(data); 2168 data += 4; 2169 len -= 4; 2170 } 2171 } 2172 if (flags & (1 << i)) { 2173 os_descs_count = get_unaligned_le32(data); 2174 data += 4; 2175 len -= 4; 2176 }; 2177 2178 /* Read descriptors */ 2179 raw_descs = data; 2180 helper.ffs = ffs; 2181 for (i = 0; i < 3; ++i) { 2182 if (!counts[i]) 2183 continue; 2184 helper.interfaces_count = 0; 2185 helper.eps_count = 0; 2186 ret = ffs_do_descs(counts[i], data, len, 2187 __ffs_data_do_entity, &helper); 2188 if (ret < 0) 2189 goto error; 2190 if (!ffs->eps_count && !ffs->interfaces_count) { 2191 ffs->eps_count = helper.eps_count; 2192 ffs->interfaces_count = helper.interfaces_count; 2193 } else { 2194 if (ffs->eps_count != helper.eps_count) { 2195 ret = -EINVAL; 2196 goto error; 2197 } 2198 if (ffs->interfaces_count != helper.interfaces_count) { 2199 ret = -EINVAL; 2200 goto error; 2201 } 2202 } 2203 data += ret; 2204 len -= ret; 2205 } 2206 if (os_descs_count) { 2207 ret = ffs_do_os_descs(os_descs_count, data, len, 2208 __ffs_data_do_os_desc, ffs); 2209 if (ret < 0) 2210 goto error; 2211 data += ret; 2212 len -= ret; 2213 } 2214 2215 if (raw_descs == data || len) { 2216 ret = -EINVAL; 2217 goto error; 2218 } 2219 2220 ffs->raw_descs_data = _data; 2221 ffs->raw_descs = raw_descs; 2222 ffs->raw_descs_length = data - raw_descs; 2223 ffs->fs_descs_count = counts[0]; 2224 ffs->hs_descs_count = counts[1]; 2225 ffs->ss_descs_count = counts[2]; 2226 ffs->ms_os_descs_count = os_descs_count; 2227 2228 return 0; 2229 2230 error: 2231 kfree(_data); 2232 return ret; 2233 } 2234 2235 static int __ffs_data_got_strings(struct ffs_data *ffs, 2236 char *const _data, size_t len) 2237 { 2238 u32 str_count, needed_count, lang_count; 2239 struct usb_gadget_strings **stringtabs, *t; 2240 struct usb_string *strings, *s; 2241 const char *data = _data; 2242 2243 ENTER(); 2244 2245 if (unlikely(get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC || 2246 get_unaligned_le32(data + 4) != len)) 2247 goto error; 2248 str_count = get_unaligned_le32(data + 8); 2249 lang_count = get_unaligned_le32(data + 12); 2250 2251 /* if one is zero the other must be zero */ 2252 if (unlikely(!str_count != !lang_count)) 2253 goto error; 2254 2255 /* Do we have at least as many strings as descriptors need? */ 2256 needed_count = ffs->strings_count; 2257 if (unlikely(str_count < needed_count)) 2258 goto error; 2259 2260 /* 2261 * If we don't need any strings just return and free all 2262 * memory. 2263 */ 2264 if (!needed_count) { 2265 kfree(_data); 2266 return 0; 2267 } 2268 2269 /* Allocate everything in one chunk so there's less maintenance. */ 2270 { 2271 unsigned i = 0; 2272 vla_group(d); 2273 vla_item(d, struct usb_gadget_strings *, stringtabs, 2274 lang_count + 1); 2275 vla_item(d, struct usb_gadget_strings, stringtab, lang_count); 2276 vla_item(d, struct usb_string, strings, 2277 lang_count*(needed_count+1)); 2278 2279 char *vlabuf = kmalloc(vla_group_size(d), GFP_KERNEL); 2280 2281 if (unlikely(!vlabuf)) { 2282 kfree(_data); 2283 return -ENOMEM; 2284 } 2285 2286 /* Initialize the VLA pointers */ 2287 stringtabs = vla_ptr(vlabuf, d, stringtabs); 2288 t = vla_ptr(vlabuf, d, stringtab); 2289 i = lang_count; 2290 do { 2291 *stringtabs++ = t++; 2292 } while (--i); 2293 *stringtabs = NULL; 2294 2295 /* stringtabs = vlabuf = d_stringtabs for later kfree */ 2296 stringtabs = vla_ptr(vlabuf, d, stringtabs); 2297 t = vla_ptr(vlabuf, d, stringtab); 2298 s = vla_ptr(vlabuf, d, strings); 2299 strings = s; 2300 } 2301 2302 /* For each language */ 2303 data += 16; 2304 len -= 16; 2305 2306 do { /* lang_count > 0 so we can use do-while */ 2307 unsigned needed = needed_count; 2308 2309 if (unlikely(len < 3)) 2310 goto error_free; 2311 t->language = get_unaligned_le16(data); 2312 t->strings = s; 2313 ++t; 2314 2315 data += 2; 2316 len -= 2; 2317 2318 /* For each string */ 2319 do { /* str_count > 0 so we can use do-while */ 2320 size_t length = strnlen(data, len); 2321 2322 if (unlikely(length == len)) 2323 goto error_free; 2324 2325 /* 2326 * User may provide more strings then we need, 2327 * if that's the case we simply ignore the 2328 * rest 2329 */ 2330 if (likely(needed)) { 2331 /* 2332 * s->id will be set while adding 2333 * function to configuration so for 2334 * now just leave garbage here. 2335 */ 2336 s->s = data; 2337 --needed; 2338 ++s; 2339 } 2340 2341 data += length + 1; 2342 len -= length + 1; 2343 } while (--str_count); 2344 2345 s->id = 0; /* terminator */ 2346 s->s = NULL; 2347 ++s; 2348 2349 } while (--lang_count); 2350 2351 /* Some garbage left? */ 2352 if (unlikely(len)) 2353 goto error_free; 2354 2355 /* Done! */ 2356 ffs->stringtabs = stringtabs; 2357 ffs->raw_strings = _data; 2358 2359 return 0; 2360 2361 error_free: 2362 kfree(stringtabs); 2363 error: 2364 kfree(_data); 2365 return -EINVAL; 2366 } 2367 2368 2369 /* Events handling and management *******************************************/ 2370 2371 static void __ffs_event_add(struct ffs_data *ffs, 2372 enum usb_functionfs_event_type type) 2373 { 2374 enum usb_functionfs_event_type rem_type1, rem_type2 = type; 2375 int neg = 0; 2376 2377 /* 2378 * Abort any unhandled setup 2379 * 2380 * We do not need to worry about some cmpxchg() changing value 2381 * of ffs->setup_state without holding the lock because when 2382 * state is FFS_SETUP_PENDING cmpxchg() in several places in 2383 * the source does nothing. 2384 */ 2385 if (ffs->setup_state == FFS_SETUP_PENDING) 2386 ffs->setup_state = FFS_SETUP_CANCELLED; 2387 2388 /* 2389 * Logic of this function guarantees that there are at most four pending 2390 * evens on ffs->ev.types queue. This is important because the queue 2391 * has space for four elements only and __ffs_ep0_read_events function 2392 * depends on that limit as well. If more event types are added, those 2393 * limits have to be revisited or guaranteed to still hold. 2394 */ 2395 switch (type) { 2396 case FUNCTIONFS_RESUME: 2397 rem_type2 = FUNCTIONFS_SUSPEND; 2398 /* FALL THROUGH */ 2399 case FUNCTIONFS_SUSPEND: 2400 case FUNCTIONFS_SETUP: 2401 rem_type1 = type; 2402 /* Discard all similar events */ 2403 break; 2404 2405 case FUNCTIONFS_BIND: 2406 case FUNCTIONFS_UNBIND: 2407 case FUNCTIONFS_DISABLE: 2408 case FUNCTIONFS_ENABLE: 2409 /* Discard everything other then power management. */ 2410 rem_type1 = FUNCTIONFS_SUSPEND; 2411 rem_type2 = FUNCTIONFS_RESUME; 2412 neg = 1; 2413 break; 2414 2415 default: 2416 WARN(1, "%d: unknown event, this should not happen\n", type); 2417 return; 2418 } 2419 2420 { 2421 u8 *ev = ffs->ev.types, *out = ev; 2422 unsigned n = ffs->ev.count; 2423 for (; n; --n, ++ev) 2424 if ((*ev == rem_type1 || *ev == rem_type2) == neg) 2425 *out++ = *ev; 2426 else 2427 pr_vdebug("purging event %d\n", *ev); 2428 ffs->ev.count = out - ffs->ev.types; 2429 } 2430 2431 pr_vdebug("adding event %d\n", type); 2432 ffs->ev.types[ffs->ev.count++] = type; 2433 wake_up_locked(&ffs->ev.waitq); 2434 if (ffs->ffs_eventfd) 2435 eventfd_signal(ffs->ffs_eventfd, 1); 2436 } 2437 2438 static void ffs_event_add(struct ffs_data *ffs, 2439 enum usb_functionfs_event_type type) 2440 { 2441 unsigned long flags; 2442 spin_lock_irqsave(&ffs->ev.waitq.lock, flags); 2443 __ffs_event_add(ffs, type); 2444 spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags); 2445 } 2446 2447 /* Bind/unbind USB function hooks *******************************************/ 2448 2449 static int ffs_ep_addr2idx(struct ffs_data *ffs, u8 endpoint_address) 2450 { 2451 int i; 2452 2453 for (i = 1; i < ARRAY_SIZE(ffs->eps_addrmap); ++i) 2454 if (ffs->eps_addrmap[i] == endpoint_address) 2455 return i; 2456 return -ENOENT; 2457 } 2458 2459 static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep, 2460 struct usb_descriptor_header *desc, 2461 void *priv) 2462 { 2463 struct usb_endpoint_descriptor *ds = (void *)desc; 2464 struct ffs_function *func = priv; 2465 struct ffs_ep *ffs_ep; 2466 unsigned ep_desc_id; 2467 int idx; 2468 static const char *speed_names[] = { "full", "high", "super" }; 2469 2470 if (type != FFS_DESCRIPTOR) 2471 return 0; 2472 2473 /* 2474 * If ss_descriptors is not NULL, we are reading super speed 2475 * descriptors; if hs_descriptors is not NULL, we are reading high 2476 * speed descriptors; otherwise, we are reading full speed 2477 * descriptors. 2478 */ 2479 if (func->function.ss_descriptors) { 2480 ep_desc_id = 2; 2481 func->function.ss_descriptors[(long)valuep] = desc; 2482 } else if (func->function.hs_descriptors) { 2483 ep_desc_id = 1; 2484 func->function.hs_descriptors[(long)valuep] = desc; 2485 } else { 2486 ep_desc_id = 0; 2487 func->function.fs_descriptors[(long)valuep] = desc; 2488 } 2489 2490 if (!desc || desc->bDescriptorType != USB_DT_ENDPOINT) 2491 return 0; 2492 2493 idx = ffs_ep_addr2idx(func->ffs, ds->bEndpointAddress) - 1; 2494 if (idx < 0) 2495 return idx; 2496 2497 ffs_ep = func->eps + idx; 2498 2499 if (unlikely(ffs_ep->descs[ep_desc_id])) { 2500 pr_err("two %sspeed descriptors for EP %d\n", 2501 speed_names[ep_desc_id], 2502 ds->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); 2503 return -EINVAL; 2504 } 2505 ffs_ep->descs[ep_desc_id] = ds; 2506 2507 ffs_dump_mem(": Original ep desc", ds, ds->bLength); 2508 if (ffs_ep->ep) { 2509 ds->bEndpointAddress = ffs_ep->descs[0]->bEndpointAddress; 2510 if (!ds->wMaxPacketSize) 2511 ds->wMaxPacketSize = ffs_ep->descs[0]->wMaxPacketSize; 2512 } else { 2513 struct usb_request *req; 2514 struct usb_ep *ep; 2515 u8 bEndpointAddress; 2516 2517 /* 2518 * We back up bEndpointAddress because autoconfig overwrites 2519 * it with physical endpoint address. 2520 */ 2521 bEndpointAddress = ds->bEndpointAddress; 2522 pr_vdebug("autoconfig\n"); 2523 ep = usb_ep_autoconfig(func->gadget, ds); 2524 if (unlikely(!ep)) 2525 return -ENOTSUPP; 2526 ep->driver_data = func->eps + idx; 2527 2528 req = usb_ep_alloc_request(ep, GFP_KERNEL); 2529 if (unlikely(!req)) 2530 return -ENOMEM; 2531 2532 ffs_ep->ep = ep; 2533 ffs_ep->req = req; 2534 func->eps_revmap[ds->bEndpointAddress & 2535 USB_ENDPOINT_NUMBER_MASK] = idx + 1; 2536 /* 2537 * If we use virtual address mapping, we restore 2538 * original bEndpointAddress value. 2539 */ 2540 if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR) 2541 ds->bEndpointAddress = bEndpointAddress; 2542 } 2543 ffs_dump_mem(": Rewritten ep desc", ds, ds->bLength); 2544 2545 return 0; 2546 } 2547 2548 static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep, 2549 struct usb_descriptor_header *desc, 2550 void *priv) 2551 { 2552 struct ffs_function *func = priv; 2553 unsigned idx; 2554 u8 newValue; 2555 2556 switch (type) { 2557 default: 2558 case FFS_DESCRIPTOR: 2559 /* Handled in previous pass by __ffs_func_bind_do_descs() */ 2560 return 0; 2561 2562 case FFS_INTERFACE: 2563 idx = *valuep; 2564 if (func->interfaces_nums[idx] < 0) { 2565 int id = usb_interface_id(func->conf, &func->function); 2566 if (unlikely(id < 0)) 2567 return id; 2568 func->interfaces_nums[idx] = id; 2569 } 2570 newValue = func->interfaces_nums[idx]; 2571 break; 2572 2573 case FFS_STRING: 2574 /* String' IDs are allocated when fsf_data is bound to cdev */ 2575 newValue = func->ffs->stringtabs[0]->strings[*valuep - 1].id; 2576 break; 2577 2578 case FFS_ENDPOINT: 2579 /* 2580 * USB_DT_ENDPOINT are handled in 2581 * __ffs_func_bind_do_descs(). 2582 */ 2583 if (desc->bDescriptorType == USB_DT_ENDPOINT) 2584 return 0; 2585 2586 idx = (*valuep & USB_ENDPOINT_NUMBER_MASK) - 1; 2587 if (unlikely(!func->eps[idx].ep)) 2588 return -EINVAL; 2589 2590 { 2591 struct usb_endpoint_descriptor **descs; 2592 descs = func->eps[idx].descs; 2593 newValue = descs[descs[0] ? 0 : 1]->bEndpointAddress; 2594 } 2595 break; 2596 } 2597 2598 pr_vdebug("%02x -> %02x\n", *valuep, newValue); 2599 *valuep = newValue; 2600 return 0; 2601 } 2602 2603 static int __ffs_func_bind_do_os_desc(enum ffs_os_desc_type type, 2604 struct usb_os_desc_header *h, void *data, 2605 unsigned len, void *priv) 2606 { 2607 struct ffs_function *func = priv; 2608 u8 length = 0; 2609 2610 switch (type) { 2611 case FFS_OS_DESC_EXT_COMPAT: { 2612 struct usb_ext_compat_desc *desc = data; 2613 struct usb_os_desc_table *t; 2614 2615 t = &func->function.os_desc_table[desc->bFirstInterfaceNumber]; 2616 t->if_id = func->interfaces_nums[desc->bFirstInterfaceNumber]; 2617 memcpy(t->os_desc->ext_compat_id, &desc->CompatibleID, 2618 ARRAY_SIZE(desc->CompatibleID) + 2619 ARRAY_SIZE(desc->SubCompatibleID)); 2620 length = sizeof(*desc); 2621 } 2622 break; 2623 case FFS_OS_DESC_EXT_PROP: { 2624 struct usb_ext_prop_desc *desc = data; 2625 struct usb_os_desc_table *t; 2626 struct usb_os_desc_ext_prop *ext_prop; 2627 char *ext_prop_name; 2628 char *ext_prop_data; 2629 2630 t = &func->function.os_desc_table[h->interface]; 2631 t->if_id = func->interfaces_nums[h->interface]; 2632 2633 ext_prop = func->ffs->ms_os_descs_ext_prop_avail; 2634 func->ffs->ms_os_descs_ext_prop_avail += sizeof(*ext_prop); 2635 2636 ext_prop->type = le32_to_cpu(desc->dwPropertyDataType); 2637 ext_prop->name_len = le16_to_cpu(desc->wPropertyNameLength); 2638 ext_prop->data_len = le32_to_cpu(*(u32 *) 2639 usb_ext_prop_data_len_ptr(data, ext_prop->name_len)); 2640 length = ext_prop->name_len + ext_prop->data_len + 14; 2641 2642 ext_prop_name = func->ffs->ms_os_descs_ext_prop_name_avail; 2643 func->ffs->ms_os_descs_ext_prop_name_avail += 2644 ext_prop->name_len; 2645 2646 ext_prop_data = func->ffs->ms_os_descs_ext_prop_data_avail; 2647 func->ffs->ms_os_descs_ext_prop_data_avail += 2648 ext_prop->data_len; 2649 memcpy(ext_prop_data, 2650 usb_ext_prop_data_ptr(data, ext_prop->name_len), 2651 ext_prop->data_len); 2652 /* unicode data reported to the host as "WCHAR"s */ 2653 switch (ext_prop->type) { 2654 case USB_EXT_PROP_UNICODE: 2655 case USB_EXT_PROP_UNICODE_ENV: 2656 case USB_EXT_PROP_UNICODE_LINK: 2657 case USB_EXT_PROP_UNICODE_MULTI: 2658 ext_prop->data_len *= 2; 2659 break; 2660 } 2661 ext_prop->data = ext_prop_data; 2662 2663 memcpy(ext_prop_name, usb_ext_prop_name_ptr(data), 2664 ext_prop->name_len); 2665 /* property name reported to the host as "WCHAR"s */ 2666 ext_prop->name_len *= 2; 2667 ext_prop->name = ext_prop_name; 2668 2669 t->os_desc->ext_prop_len += 2670 ext_prop->name_len + ext_prop->data_len + 14; 2671 ++t->os_desc->ext_prop_count; 2672 list_add_tail(&ext_prop->entry, &t->os_desc->ext_prop); 2673 } 2674 break; 2675 default: 2676 pr_vdebug("unknown descriptor: %d\n", type); 2677 } 2678 2679 return length; 2680 } 2681 2682 static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f, 2683 struct usb_configuration *c) 2684 { 2685 struct ffs_function *func = ffs_func_from_usb(f); 2686 struct f_fs_opts *ffs_opts = 2687 container_of(f->fi, struct f_fs_opts, func_inst); 2688 int ret; 2689 2690 ENTER(); 2691 2692 /* 2693 * Legacy gadget triggers binding in functionfs_ready_callback, 2694 * which already uses locking; taking the same lock here would 2695 * cause a deadlock. 2696 * 2697 * Configfs-enabled gadgets however do need ffs_dev_lock. 2698 */ 2699 if (!ffs_opts->no_configfs) 2700 ffs_dev_lock(); 2701 ret = ffs_opts->dev->desc_ready ? 0 : -ENODEV; 2702 func->ffs = ffs_opts->dev->ffs_data; 2703 if (!ffs_opts->no_configfs) 2704 ffs_dev_unlock(); 2705 if (ret) 2706 return ERR_PTR(ret); 2707 2708 func->conf = c; 2709 func->gadget = c->cdev->gadget; 2710 2711 /* 2712 * in drivers/usb/gadget/configfs.c:configfs_composite_bind() 2713 * configurations are bound in sequence with list_for_each_entry, 2714 * in each configuration its functions are bound in sequence 2715 * with list_for_each_entry, so we assume no race condition 2716 * with regard to ffs_opts->bound access 2717 */ 2718 if (!ffs_opts->refcnt) { 2719 ret = functionfs_bind(func->ffs, c->cdev); 2720 if (ret) 2721 return ERR_PTR(ret); 2722 } 2723 ffs_opts->refcnt++; 2724 func->function.strings = func->ffs->stringtabs; 2725 2726 return ffs_opts; 2727 } 2728 2729 static int _ffs_func_bind(struct usb_configuration *c, 2730 struct usb_function *f) 2731 { 2732 struct ffs_function *func = ffs_func_from_usb(f); 2733 struct ffs_data *ffs = func->ffs; 2734 2735 const int full = !!func->ffs->fs_descs_count; 2736 const int high = gadget_is_dualspeed(func->gadget) && 2737 func->ffs->hs_descs_count; 2738 const int super = gadget_is_superspeed(func->gadget) && 2739 func->ffs->ss_descs_count; 2740 2741 int fs_len, hs_len, ss_len, ret, i; 2742 2743 /* Make it a single chunk, less management later on */ 2744 vla_group(d); 2745 vla_item_with_sz(d, struct ffs_ep, eps, ffs->eps_count); 2746 vla_item_with_sz(d, struct usb_descriptor_header *, fs_descs, 2747 full ? ffs->fs_descs_count + 1 : 0); 2748 vla_item_with_sz(d, struct usb_descriptor_header *, hs_descs, 2749 high ? ffs->hs_descs_count + 1 : 0); 2750 vla_item_with_sz(d, struct usb_descriptor_header *, ss_descs, 2751 super ? ffs->ss_descs_count + 1 : 0); 2752 vla_item_with_sz(d, short, inums, ffs->interfaces_count); 2753 vla_item_with_sz(d, struct usb_os_desc_table, os_desc_table, 2754 c->cdev->use_os_string ? ffs->interfaces_count : 0); 2755 vla_item_with_sz(d, char[16], ext_compat, 2756 c->cdev->use_os_string ? ffs->interfaces_count : 0); 2757 vla_item_with_sz(d, struct usb_os_desc, os_desc, 2758 c->cdev->use_os_string ? ffs->interfaces_count : 0); 2759 vla_item_with_sz(d, struct usb_os_desc_ext_prop, ext_prop, 2760 ffs->ms_os_descs_ext_prop_count); 2761 vla_item_with_sz(d, char, ext_prop_name, 2762 ffs->ms_os_descs_ext_prop_name_len); 2763 vla_item_with_sz(d, char, ext_prop_data, 2764 ffs->ms_os_descs_ext_prop_data_len); 2765 vla_item_with_sz(d, char, raw_descs, ffs->raw_descs_length); 2766 char *vlabuf; 2767 2768 ENTER(); 2769 2770 /* Has descriptors only for speeds gadget does not support */ 2771 if (unlikely(!(full | high | super))) 2772 return -ENOTSUPP; 2773 2774 /* Allocate a single chunk, less management later on */ 2775 vlabuf = kzalloc(vla_group_size(d), GFP_KERNEL); 2776 if (unlikely(!vlabuf)) 2777 return -ENOMEM; 2778 2779 ffs->ms_os_descs_ext_prop_avail = vla_ptr(vlabuf, d, ext_prop); 2780 ffs->ms_os_descs_ext_prop_name_avail = 2781 vla_ptr(vlabuf, d, ext_prop_name); 2782 ffs->ms_os_descs_ext_prop_data_avail = 2783 vla_ptr(vlabuf, d, ext_prop_data); 2784 2785 /* Copy descriptors */ 2786 memcpy(vla_ptr(vlabuf, d, raw_descs), ffs->raw_descs, 2787 ffs->raw_descs_length); 2788 2789 memset(vla_ptr(vlabuf, d, inums), 0xff, d_inums__sz); 2790 for (ret = ffs->eps_count; ret; --ret) { 2791 struct ffs_ep *ptr; 2792 2793 ptr = vla_ptr(vlabuf, d, eps); 2794 ptr[ret].num = -1; 2795 } 2796 2797 /* Save pointers 2798 * d_eps == vlabuf, func->eps used to kfree vlabuf later 2799 */ 2800 func->eps = vla_ptr(vlabuf, d, eps); 2801 func->interfaces_nums = vla_ptr(vlabuf, d, inums); 2802 2803 /* 2804 * Go through all the endpoint descriptors and allocate 2805 * endpoints first, so that later we can rewrite the endpoint 2806 * numbers without worrying that it may be described later on. 2807 */ 2808 if (likely(full)) { 2809 func->function.fs_descriptors = vla_ptr(vlabuf, d, fs_descs); 2810 fs_len = ffs_do_descs(ffs->fs_descs_count, 2811 vla_ptr(vlabuf, d, raw_descs), 2812 d_raw_descs__sz, 2813 __ffs_func_bind_do_descs, func); 2814 if (unlikely(fs_len < 0)) { 2815 ret = fs_len; 2816 goto error; 2817 } 2818 } else { 2819 fs_len = 0; 2820 } 2821 2822 if (likely(high)) { 2823 func->function.hs_descriptors = vla_ptr(vlabuf, d, hs_descs); 2824 hs_len = ffs_do_descs(ffs->hs_descs_count, 2825 vla_ptr(vlabuf, d, raw_descs) + fs_len, 2826 d_raw_descs__sz - fs_len, 2827 __ffs_func_bind_do_descs, func); 2828 if (unlikely(hs_len < 0)) { 2829 ret = hs_len; 2830 goto error; 2831 } 2832 } else { 2833 hs_len = 0; 2834 } 2835 2836 if (likely(super)) { 2837 func->function.ss_descriptors = vla_ptr(vlabuf, d, ss_descs); 2838 ss_len = ffs_do_descs(ffs->ss_descs_count, 2839 vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len, 2840 d_raw_descs__sz - fs_len - hs_len, 2841 __ffs_func_bind_do_descs, func); 2842 if (unlikely(ss_len < 0)) { 2843 ret = ss_len; 2844 goto error; 2845 } 2846 } else { 2847 ss_len = 0; 2848 } 2849 2850 /* 2851 * Now handle interface numbers allocation and interface and 2852 * endpoint numbers rewriting. We can do that in one go 2853 * now. 2854 */ 2855 ret = ffs_do_descs(ffs->fs_descs_count + 2856 (high ? ffs->hs_descs_count : 0) + 2857 (super ? ffs->ss_descs_count : 0), 2858 vla_ptr(vlabuf, d, raw_descs), d_raw_descs__sz, 2859 __ffs_func_bind_do_nums, func); 2860 if (unlikely(ret < 0)) 2861 goto error; 2862 2863 func->function.os_desc_table = vla_ptr(vlabuf, d, os_desc_table); 2864 if (c->cdev->use_os_string) 2865 for (i = 0; i < ffs->interfaces_count; ++i) { 2866 struct usb_os_desc *desc; 2867 2868 desc = func->function.os_desc_table[i].os_desc = 2869 vla_ptr(vlabuf, d, os_desc) + 2870 i * sizeof(struct usb_os_desc); 2871 desc->ext_compat_id = 2872 vla_ptr(vlabuf, d, ext_compat) + i * 16; 2873 INIT_LIST_HEAD(&desc->ext_prop); 2874 } 2875 ret = ffs_do_os_descs(ffs->ms_os_descs_count, 2876 vla_ptr(vlabuf, d, raw_descs) + 2877 fs_len + hs_len + ss_len, 2878 d_raw_descs__sz - fs_len - hs_len - ss_len, 2879 __ffs_func_bind_do_os_desc, func); 2880 if (unlikely(ret < 0)) 2881 goto error; 2882 func->function.os_desc_n = 2883 c->cdev->use_os_string ? ffs->interfaces_count : 0; 2884 2885 /* And we're done */ 2886 ffs_event_add(ffs, FUNCTIONFS_BIND); 2887 return 0; 2888 2889 error: 2890 /* XXX Do we need to release all claimed endpoints here? */ 2891 return ret; 2892 } 2893 2894 static int ffs_func_bind(struct usb_configuration *c, 2895 struct usb_function *f) 2896 { 2897 struct f_fs_opts *ffs_opts = ffs_do_functionfs_bind(f, c); 2898 2899 if (IS_ERR(ffs_opts)) 2900 return PTR_ERR(ffs_opts); 2901 2902 return _ffs_func_bind(c, f); 2903 } 2904 2905 2906 /* Other USB function hooks *************************************************/ 2907 2908 static void ffs_reset_work(struct work_struct *work) 2909 { 2910 struct ffs_data *ffs = container_of(work, 2911 struct ffs_data, reset_work); 2912 ffs_data_reset(ffs); 2913 } 2914 2915 static int ffs_func_set_alt(struct usb_function *f, 2916 unsigned interface, unsigned alt) 2917 { 2918 struct ffs_function *func = ffs_func_from_usb(f); 2919 struct ffs_data *ffs = func->ffs; 2920 int ret = 0, intf; 2921 2922 if (alt != (unsigned)-1) { 2923 intf = ffs_func_revmap_intf(func, interface); 2924 if (unlikely(intf < 0)) 2925 return intf; 2926 } 2927 2928 if (ffs->func) 2929 ffs_func_eps_disable(ffs->func); 2930 2931 if (ffs->state == FFS_DEACTIVATED) { 2932 ffs->state = FFS_CLOSING; 2933 INIT_WORK(&ffs->reset_work, ffs_reset_work); 2934 schedule_work(&ffs->reset_work); 2935 return -ENODEV; 2936 } 2937 2938 if (ffs->state != FFS_ACTIVE) 2939 return -ENODEV; 2940 2941 if (alt == (unsigned)-1) { 2942 ffs->func = NULL; 2943 ffs_event_add(ffs, FUNCTIONFS_DISABLE); 2944 return 0; 2945 } 2946 2947 ffs->func = func; 2948 ret = ffs_func_eps_enable(func); 2949 if (likely(ret >= 0)) 2950 ffs_event_add(ffs, FUNCTIONFS_ENABLE); 2951 return ret; 2952 } 2953 2954 static void ffs_func_disable(struct usb_function *f) 2955 { 2956 ffs_func_set_alt(f, 0, (unsigned)-1); 2957 } 2958 2959 static int ffs_func_setup(struct usb_function *f, 2960 const struct usb_ctrlrequest *creq) 2961 { 2962 struct ffs_function *func = ffs_func_from_usb(f); 2963 struct ffs_data *ffs = func->ffs; 2964 unsigned long flags; 2965 int ret; 2966 2967 ENTER(); 2968 2969 pr_vdebug("creq->bRequestType = %02x\n", creq->bRequestType); 2970 pr_vdebug("creq->bRequest = %02x\n", creq->bRequest); 2971 pr_vdebug("creq->wValue = %04x\n", le16_to_cpu(creq->wValue)); 2972 pr_vdebug("creq->wIndex = %04x\n", le16_to_cpu(creq->wIndex)); 2973 pr_vdebug("creq->wLength = %04x\n", le16_to_cpu(creq->wLength)); 2974 2975 /* 2976 * Most requests directed to interface go through here 2977 * (notable exceptions are set/get interface) so we need to 2978 * handle them. All other either handled by composite or 2979 * passed to usb_configuration->setup() (if one is set). No 2980 * matter, we will handle requests directed to endpoint here 2981 * as well (as it's straightforward) but what to do with any 2982 * other request? 2983 */ 2984 if (ffs->state != FFS_ACTIVE) 2985 return -ENODEV; 2986 2987 switch (creq->bRequestType & USB_RECIP_MASK) { 2988 case USB_RECIP_INTERFACE: 2989 ret = ffs_func_revmap_intf(func, le16_to_cpu(creq->wIndex)); 2990 if (unlikely(ret < 0)) 2991 return ret; 2992 break; 2993 2994 case USB_RECIP_ENDPOINT: 2995 ret = ffs_func_revmap_ep(func, le16_to_cpu(creq->wIndex)); 2996 if (unlikely(ret < 0)) 2997 return ret; 2998 if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR) 2999 ret = func->ffs->eps_addrmap[ret]; 3000 break; 3001 3002 default: 3003 return -EOPNOTSUPP; 3004 } 3005 3006 spin_lock_irqsave(&ffs->ev.waitq.lock, flags); 3007 ffs->ev.setup = *creq; 3008 ffs->ev.setup.wIndex = cpu_to_le16(ret); 3009 __ffs_event_add(ffs, FUNCTIONFS_SETUP); 3010 spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags); 3011 3012 return 0; 3013 } 3014 3015 static void ffs_func_suspend(struct usb_function *f) 3016 { 3017 ENTER(); 3018 ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_SUSPEND); 3019 } 3020 3021 static void ffs_func_resume(struct usb_function *f) 3022 { 3023 ENTER(); 3024 ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_RESUME); 3025 } 3026 3027 3028 /* Endpoint and interface numbers reverse mapping ***************************/ 3029 3030 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num) 3031 { 3032 num = func->eps_revmap[num & USB_ENDPOINT_NUMBER_MASK]; 3033 return num ? num : -EDOM; 3034 } 3035 3036 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf) 3037 { 3038 short *nums = func->interfaces_nums; 3039 unsigned count = func->ffs->interfaces_count; 3040 3041 for (; count; --count, ++nums) { 3042 if (*nums >= 0 && *nums == intf) 3043 return nums - func->interfaces_nums; 3044 } 3045 3046 return -EDOM; 3047 } 3048 3049 3050 /* Devices management *******************************************************/ 3051 3052 static LIST_HEAD(ffs_devices); 3053 3054 static struct ffs_dev *_ffs_do_find_dev(const char *name) 3055 { 3056 struct ffs_dev *dev; 3057 3058 list_for_each_entry(dev, &ffs_devices, entry) { 3059 if (!dev->name || !name) 3060 continue; 3061 if (strcmp(dev->name, name) == 0) 3062 return dev; 3063 } 3064 3065 return NULL; 3066 } 3067 3068 /* 3069 * ffs_lock must be taken by the caller of this function 3070 */ 3071 static struct ffs_dev *_ffs_get_single_dev(void) 3072 { 3073 struct ffs_dev *dev; 3074 3075 if (list_is_singular(&ffs_devices)) { 3076 dev = list_first_entry(&ffs_devices, struct ffs_dev, entry); 3077 if (dev->single) 3078 return dev; 3079 } 3080 3081 return NULL; 3082 } 3083 3084 /* 3085 * ffs_lock must be taken by the caller of this function 3086 */ 3087 static struct ffs_dev *_ffs_find_dev(const char *name) 3088 { 3089 struct ffs_dev *dev; 3090 3091 dev = _ffs_get_single_dev(); 3092 if (dev) 3093 return dev; 3094 3095 return _ffs_do_find_dev(name); 3096 } 3097 3098 /* Configfs support *********************************************************/ 3099 3100 static inline struct f_fs_opts *to_ffs_opts(struct config_item *item) 3101 { 3102 return container_of(to_config_group(item), struct f_fs_opts, 3103 func_inst.group); 3104 } 3105 3106 static void ffs_attr_release(struct config_item *item) 3107 { 3108 struct f_fs_opts *opts = to_ffs_opts(item); 3109 3110 usb_put_function_instance(&opts->func_inst); 3111 } 3112 3113 static struct configfs_item_operations ffs_item_ops = { 3114 .release = ffs_attr_release, 3115 }; 3116 3117 static struct config_item_type ffs_func_type = { 3118 .ct_item_ops = &ffs_item_ops, 3119 .ct_owner = THIS_MODULE, 3120 }; 3121 3122 3123 /* Function registration interface ******************************************/ 3124 3125 static void ffs_free_inst(struct usb_function_instance *f) 3126 { 3127 struct f_fs_opts *opts; 3128 3129 opts = to_f_fs_opts(f); 3130 ffs_dev_lock(); 3131 _ffs_free_dev(opts->dev); 3132 ffs_dev_unlock(); 3133 kfree(opts); 3134 } 3135 3136 #define MAX_INST_NAME_LEN 40 3137 3138 static int ffs_set_inst_name(struct usb_function_instance *fi, const char *name) 3139 { 3140 struct f_fs_opts *opts; 3141 char *ptr; 3142 const char *tmp; 3143 int name_len, ret; 3144 3145 name_len = strlen(name) + 1; 3146 if (name_len > MAX_INST_NAME_LEN) 3147 return -ENAMETOOLONG; 3148 3149 ptr = kstrndup(name, name_len, GFP_KERNEL); 3150 if (!ptr) 3151 return -ENOMEM; 3152 3153 opts = to_f_fs_opts(fi); 3154 tmp = NULL; 3155 3156 ffs_dev_lock(); 3157 3158 tmp = opts->dev->name_allocated ? opts->dev->name : NULL; 3159 ret = _ffs_name_dev(opts->dev, ptr); 3160 if (ret) { 3161 kfree(ptr); 3162 ffs_dev_unlock(); 3163 return ret; 3164 } 3165 opts->dev->name_allocated = true; 3166 3167 ffs_dev_unlock(); 3168 3169 kfree(tmp); 3170 3171 return 0; 3172 } 3173 3174 static struct usb_function_instance *ffs_alloc_inst(void) 3175 { 3176 struct f_fs_opts *opts; 3177 struct ffs_dev *dev; 3178 3179 opts = kzalloc(sizeof(*opts), GFP_KERNEL); 3180 if (!opts) 3181 return ERR_PTR(-ENOMEM); 3182 3183 opts->func_inst.set_inst_name = ffs_set_inst_name; 3184 opts->func_inst.free_func_inst = ffs_free_inst; 3185 ffs_dev_lock(); 3186 dev = _ffs_alloc_dev(); 3187 ffs_dev_unlock(); 3188 if (IS_ERR(dev)) { 3189 kfree(opts); 3190 return ERR_CAST(dev); 3191 } 3192 opts->dev = dev; 3193 dev->opts = opts; 3194 3195 config_group_init_type_name(&opts->func_inst.group, "", 3196 &ffs_func_type); 3197 return &opts->func_inst; 3198 } 3199 3200 static void ffs_free(struct usb_function *f) 3201 { 3202 kfree(ffs_func_from_usb(f)); 3203 } 3204 3205 static void ffs_func_unbind(struct usb_configuration *c, 3206 struct usb_function *f) 3207 { 3208 struct ffs_function *func = ffs_func_from_usb(f); 3209 struct ffs_data *ffs = func->ffs; 3210 struct f_fs_opts *opts = 3211 container_of(f->fi, struct f_fs_opts, func_inst); 3212 struct ffs_ep *ep = func->eps; 3213 unsigned count = ffs->eps_count; 3214 unsigned long flags; 3215 3216 ENTER(); 3217 if (ffs->func == func) { 3218 ffs_func_eps_disable(func); 3219 ffs->func = NULL; 3220 } 3221 3222 if (!--opts->refcnt) 3223 functionfs_unbind(ffs); 3224 3225 /* cleanup after autoconfig */ 3226 spin_lock_irqsave(&func->ffs->eps_lock, flags); 3227 do { 3228 if (ep->ep && ep->req) 3229 usb_ep_free_request(ep->ep, ep->req); 3230 ep->req = NULL; 3231 ++ep; 3232 } while (--count); 3233 spin_unlock_irqrestore(&func->ffs->eps_lock, flags); 3234 kfree(func->eps); 3235 func->eps = NULL; 3236 /* 3237 * eps, descriptors and interfaces_nums are allocated in the 3238 * same chunk so only one free is required. 3239 */ 3240 func->function.fs_descriptors = NULL; 3241 func->function.hs_descriptors = NULL; 3242 func->function.ss_descriptors = NULL; 3243 func->interfaces_nums = NULL; 3244 3245 ffs_event_add(ffs, FUNCTIONFS_UNBIND); 3246 } 3247 3248 static struct usb_function *ffs_alloc(struct usb_function_instance *fi) 3249 { 3250 struct ffs_function *func; 3251 3252 ENTER(); 3253 3254 func = kzalloc(sizeof(*func), GFP_KERNEL); 3255 if (unlikely(!func)) 3256 return ERR_PTR(-ENOMEM); 3257 3258 func->function.name = "Function FS Gadget"; 3259 3260 func->function.bind = ffs_func_bind; 3261 func->function.unbind = ffs_func_unbind; 3262 func->function.set_alt = ffs_func_set_alt; 3263 func->function.disable = ffs_func_disable; 3264 func->function.setup = ffs_func_setup; 3265 func->function.suspend = ffs_func_suspend; 3266 func->function.resume = ffs_func_resume; 3267 func->function.free_func = ffs_free; 3268 3269 return &func->function; 3270 } 3271 3272 /* 3273 * ffs_lock must be taken by the caller of this function 3274 */ 3275 static struct ffs_dev *_ffs_alloc_dev(void) 3276 { 3277 struct ffs_dev *dev; 3278 int ret; 3279 3280 if (_ffs_get_single_dev()) 3281 return ERR_PTR(-EBUSY); 3282 3283 dev = kzalloc(sizeof(*dev), GFP_KERNEL); 3284 if (!dev) 3285 return ERR_PTR(-ENOMEM); 3286 3287 if (list_empty(&ffs_devices)) { 3288 ret = functionfs_init(); 3289 if (ret) { 3290 kfree(dev); 3291 return ERR_PTR(ret); 3292 } 3293 } 3294 3295 list_add(&dev->entry, &ffs_devices); 3296 3297 return dev; 3298 } 3299 3300 /* 3301 * ffs_lock must be taken by the caller of this function 3302 * The caller is responsible for "name" being available whenever f_fs needs it 3303 */ 3304 static int _ffs_name_dev(struct ffs_dev *dev, const char *name) 3305 { 3306 struct ffs_dev *existing; 3307 3308 existing = _ffs_do_find_dev(name); 3309 if (existing) 3310 return -EBUSY; 3311 3312 dev->name = name; 3313 3314 return 0; 3315 } 3316 3317 /* 3318 * The caller is responsible for "name" being available whenever f_fs needs it 3319 */ 3320 int ffs_name_dev(struct ffs_dev *dev, const char *name) 3321 { 3322 int ret; 3323 3324 ffs_dev_lock(); 3325 ret = _ffs_name_dev(dev, name); 3326 ffs_dev_unlock(); 3327 3328 return ret; 3329 } 3330 EXPORT_SYMBOL_GPL(ffs_name_dev); 3331 3332 int ffs_single_dev(struct ffs_dev *dev) 3333 { 3334 int ret; 3335 3336 ret = 0; 3337 ffs_dev_lock(); 3338 3339 if (!list_is_singular(&ffs_devices)) 3340 ret = -EBUSY; 3341 else 3342 dev->single = true; 3343 3344 ffs_dev_unlock(); 3345 return ret; 3346 } 3347 EXPORT_SYMBOL_GPL(ffs_single_dev); 3348 3349 /* 3350 * ffs_lock must be taken by the caller of this function 3351 */ 3352 static void _ffs_free_dev(struct ffs_dev *dev) 3353 { 3354 list_del(&dev->entry); 3355 if (dev->name_allocated) 3356 kfree(dev->name); 3357 kfree(dev); 3358 if (list_empty(&ffs_devices)) 3359 functionfs_cleanup(); 3360 } 3361 3362 static void *ffs_acquire_dev(const char *dev_name) 3363 { 3364 struct ffs_dev *ffs_dev; 3365 3366 ENTER(); 3367 ffs_dev_lock(); 3368 3369 ffs_dev = _ffs_find_dev(dev_name); 3370 if (!ffs_dev) 3371 ffs_dev = ERR_PTR(-ENOENT); 3372 else if (ffs_dev->mounted) 3373 ffs_dev = ERR_PTR(-EBUSY); 3374 else if (ffs_dev->ffs_acquire_dev_callback && 3375 ffs_dev->ffs_acquire_dev_callback(ffs_dev)) 3376 ffs_dev = ERR_PTR(-ENOENT); 3377 else 3378 ffs_dev->mounted = true; 3379 3380 ffs_dev_unlock(); 3381 return ffs_dev; 3382 } 3383 3384 static void ffs_release_dev(struct ffs_data *ffs_data) 3385 { 3386 struct ffs_dev *ffs_dev; 3387 3388 ENTER(); 3389 ffs_dev_lock(); 3390 3391 ffs_dev = ffs_data->private_data; 3392 if (ffs_dev) { 3393 ffs_dev->mounted = false; 3394 3395 if (ffs_dev->ffs_release_dev_callback) 3396 ffs_dev->ffs_release_dev_callback(ffs_dev); 3397 } 3398 3399 ffs_dev_unlock(); 3400 } 3401 3402 static int ffs_ready(struct ffs_data *ffs) 3403 { 3404 struct ffs_dev *ffs_obj; 3405 int ret = 0; 3406 3407 ENTER(); 3408 ffs_dev_lock(); 3409 3410 ffs_obj = ffs->private_data; 3411 if (!ffs_obj) { 3412 ret = -EINVAL; 3413 goto done; 3414 } 3415 if (WARN_ON(ffs_obj->desc_ready)) { 3416 ret = -EBUSY; 3417 goto done; 3418 } 3419 3420 ffs_obj->desc_ready = true; 3421 ffs_obj->ffs_data = ffs; 3422 3423 if (ffs_obj->ffs_ready_callback) { 3424 ret = ffs_obj->ffs_ready_callback(ffs); 3425 if (ret) 3426 goto done; 3427 } 3428 3429 set_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags); 3430 done: 3431 ffs_dev_unlock(); 3432 return ret; 3433 } 3434 3435 static void ffs_closed(struct ffs_data *ffs) 3436 { 3437 struct ffs_dev *ffs_obj; 3438 struct f_fs_opts *opts; 3439 3440 ENTER(); 3441 ffs_dev_lock(); 3442 3443 ffs_obj = ffs->private_data; 3444 if (!ffs_obj) 3445 goto done; 3446 3447 ffs_obj->desc_ready = false; 3448 3449 if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) && 3450 ffs_obj->ffs_closed_callback) 3451 ffs_obj->ffs_closed_callback(ffs); 3452 3453 if (ffs_obj->opts) 3454 opts = ffs_obj->opts; 3455 else 3456 goto done; 3457 3458 if (opts->no_configfs || !opts->func_inst.group.cg_item.ci_parent 3459 || !atomic_read(&opts->func_inst.group.cg_item.ci_kref.refcount)) 3460 goto done; 3461 3462 unregister_gadget_item(ffs_obj->opts-> 3463 func_inst.group.cg_item.ci_parent->ci_parent); 3464 done: 3465 ffs_dev_unlock(); 3466 } 3467 3468 /* Misc helper functions ****************************************************/ 3469 3470 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock) 3471 { 3472 return nonblock 3473 ? likely(mutex_trylock(mutex)) ? 0 : -EAGAIN 3474 : mutex_lock_interruptible(mutex); 3475 } 3476 3477 static char *ffs_prepare_buffer(const char __user *buf, size_t len) 3478 { 3479 char *data; 3480 3481 if (unlikely(!len)) 3482 return NULL; 3483 3484 data = kmalloc(len, GFP_KERNEL); 3485 if (unlikely(!data)) 3486 return ERR_PTR(-ENOMEM); 3487 3488 if (unlikely(__copy_from_user(data, buf, len))) { 3489 kfree(data); 3490 return ERR_PTR(-EFAULT); 3491 } 3492 3493 pr_vdebug("Buffer from user space:\n"); 3494 ffs_dump_mem("", data, len); 3495 3496 return data; 3497 } 3498 3499 DECLARE_USB_FUNCTION_INIT(ffs, ffs_alloc_inst, ffs_alloc); 3500 MODULE_LICENSE("GPL"); 3501 MODULE_AUTHOR("Michal Nazarewicz"); 3502