1 /* 2 * f_fs.c -- user mode file system API for USB composite function controllers 3 * 4 * Copyright (C) 2010 Samsung Electronics 5 * Author: Michal Nazarewicz <mina86@mina86.com> 6 * 7 * Based on inode.c (GadgetFS) which was: 8 * Copyright (C) 2003-2004 David Brownell 9 * Copyright (C) 2003 Agilent Technologies 10 * 11 * This program is free software; you can redistribute it and/or modify 12 * it under the terms of the GNU General Public License as published by 13 * the Free Software Foundation; either version 2 of the License, or 14 * (at your option) any later version. 15 */ 16 17 18 /* #define DEBUG */ 19 /* #define VERBOSE_DEBUG */ 20 21 #include <linux/blkdev.h> 22 #include <linux/pagemap.h> 23 #include <linux/export.h> 24 #include <linux/hid.h> 25 #include <linux/module.h> 26 #include <linux/uio.h> 27 #include <asm/unaligned.h> 28 29 #include <linux/usb/composite.h> 30 #include <linux/usb/functionfs.h> 31 32 #include <linux/aio.h> 33 #include <linux/mmu_context.h> 34 #include <linux/poll.h> 35 #include <linux/eventfd.h> 36 37 #include "u_fs.h" 38 #include "u_f.h" 39 #include "u_os_desc.h" 40 #include "configfs.h" 41 42 #define FUNCTIONFS_MAGIC 0xa647361 /* Chosen by a honest dice roll ;) */ 43 44 /* Reference counter handling */ 45 static void ffs_data_get(struct ffs_data *ffs); 46 static void ffs_data_put(struct ffs_data *ffs); 47 /* Creates new ffs_data object. */ 48 static struct ffs_data *__must_check ffs_data_new(void) __attribute__((malloc)); 49 50 /* Opened counter handling. */ 51 static void ffs_data_opened(struct ffs_data *ffs); 52 static void ffs_data_closed(struct ffs_data *ffs); 53 54 /* Called with ffs->mutex held; take over ownership of data. */ 55 static int __must_check 56 __ffs_data_got_descs(struct ffs_data *ffs, char *data, size_t len); 57 static int __must_check 58 __ffs_data_got_strings(struct ffs_data *ffs, char *data, size_t len); 59 60 61 /* The function structure ***************************************************/ 62 63 struct ffs_ep; 64 65 struct ffs_function { 66 struct usb_configuration *conf; 67 struct usb_gadget *gadget; 68 struct ffs_data *ffs; 69 70 struct ffs_ep *eps; 71 u8 eps_revmap[16]; 72 short *interfaces_nums; 73 74 struct usb_function function; 75 }; 76 77 78 static struct ffs_function *ffs_func_from_usb(struct usb_function *f) 79 { 80 return container_of(f, struct ffs_function, function); 81 } 82 83 84 static inline enum ffs_setup_state 85 ffs_setup_state_clear_cancelled(struct ffs_data *ffs) 86 { 87 return (enum ffs_setup_state) 88 cmpxchg(&ffs->setup_state, FFS_SETUP_CANCELLED, FFS_NO_SETUP); 89 } 90 91 92 static void ffs_func_eps_disable(struct ffs_function *func); 93 static int __must_check ffs_func_eps_enable(struct ffs_function *func); 94 95 static int ffs_func_bind(struct usb_configuration *, 96 struct usb_function *); 97 static int ffs_func_set_alt(struct usb_function *, unsigned, unsigned); 98 static void ffs_func_disable(struct usb_function *); 99 static int ffs_func_setup(struct usb_function *, 100 const struct usb_ctrlrequest *); 101 static bool ffs_func_req_match(struct usb_function *, 102 const struct usb_ctrlrequest *, 103 bool config0); 104 static void ffs_func_suspend(struct usb_function *); 105 static void ffs_func_resume(struct usb_function *); 106 107 108 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num); 109 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf); 110 111 112 /* The endpoints structures *************************************************/ 113 114 struct ffs_ep { 115 struct usb_ep *ep; /* P: ffs->eps_lock */ 116 struct usb_request *req; /* P: epfile->mutex */ 117 118 /* [0]: full speed, [1]: high speed, [2]: super speed */ 119 struct usb_endpoint_descriptor *descs[3]; 120 121 u8 num; 122 123 int status; /* P: epfile->mutex */ 124 }; 125 126 struct ffs_epfile { 127 /* Protects ep->ep and ep->req. */ 128 struct mutex mutex; 129 wait_queue_head_t wait; 130 131 struct ffs_data *ffs; 132 struct ffs_ep *ep; /* P: ffs->eps_lock */ 133 134 struct dentry *dentry; 135 136 /* 137 * Buffer for holding data from partial reads which may happen since 138 * we’re rounding user read requests to a multiple of a max packet size. 139 * 140 * The pointer is initialised with NULL value and may be set by 141 * __ffs_epfile_read_data function to point to a temporary buffer. 142 * 143 * In normal operation, calls to __ffs_epfile_read_buffered will consume 144 * data from said buffer and eventually free it. Importantly, while the 145 * function is using the buffer, it sets the pointer to NULL. This is 146 * all right since __ffs_epfile_read_data and __ffs_epfile_read_buffered 147 * can never run concurrently (they are synchronised by epfile->mutex) 148 * so the latter will not assign a new value to the pointer. 149 * 150 * Meanwhile ffs_func_eps_disable frees the buffer (if the pointer is 151 * valid) and sets the pointer to READ_BUFFER_DROP value. This special 152 * value is crux of the synchronisation between ffs_func_eps_disable and 153 * __ffs_epfile_read_data. 154 * 155 * Once __ffs_epfile_read_data is about to finish it will try to set the 156 * pointer back to its old value (as described above), but seeing as the 157 * pointer is not-NULL (namely READ_BUFFER_DROP) it will instead free 158 * the buffer. 159 * 160 * == State transitions == 161 * 162 * • ptr == NULL: (initial state) 163 * ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP 164 * ◦ __ffs_epfile_read_buffered: nop 165 * ◦ __ffs_epfile_read_data allocates temp buffer: go to ptr == buf 166 * ◦ reading finishes: n/a, not in ‘and reading’ state 167 * • ptr == DROP: 168 * ◦ __ffs_epfile_read_buffer_free: nop 169 * ◦ __ffs_epfile_read_buffered: go to ptr == NULL 170 * ◦ __ffs_epfile_read_data allocates temp buffer: free buf, nop 171 * ◦ reading finishes: n/a, not in ‘and reading’ state 172 * • ptr == buf: 173 * ◦ __ffs_epfile_read_buffer_free: free buf, go to ptr == DROP 174 * ◦ __ffs_epfile_read_buffered: go to ptr == NULL and reading 175 * ◦ __ffs_epfile_read_data: n/a, __ffs_epfile_read_buffered 176 * is always called first 177 * ◦ reading finishes: n/a, not in ‘and reading’ state 178 * • ptr == NULL and reading: 179 * ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP and reading 180 * ◦ __ffs_epfile_read_buffered: n/a, mutex is held 181 * ◦ __ffs_epfile_read_data: n/a, mutex is held 182 * ◦ reading finishes and … 183 * … all data read: free buf, go to ptr == NULL 184 * … otherwise: go to ptr == buf and reading 185 * • ptr == DROP and reading: 186 * ◦ __ffs_epfile_read_buffer_free: nop 187 * ◦ __ffs_epfile_read_buffered: n/a, mutex is held 188 * ◦ __ffs_epfile_read_data: n/a, mutex is held 189 * ◦ reading finishes: free buf, go to ptr == DROP 190 */ 191 struct ffs_buffer *read_buffer; 192 #define READ_BUFFER_DROP ((struct ffs_buffer *)ERR_PTR(-ESHUTDOWN)) 193 194 char name[5]; 195 196 unsigned char in; /* P: ffs->eps_lock */ 197 unsigned char isoc; /* P: ffs->eps_lock */ 198 199 unsigned char _pad; 200 }; 201 202 struct ffs_buffer { 203 size_t length; 204 char *data; 205 char storage[]; 206 }; 207 208 /* ffs_io_data structure ***************************************************/ 209 210 struct ffs_io_data { 211 bool aio; 212 bool read; 213 214 struct kiocb *kiocb; 215 struct iov_iter data; 216 const void *to_free; 217 char *buf; 218 219 struct mm_struct *mm; 220 struct work_struct work; 221 222 struct usb_ep *ep; 223 struct usb_request *req; 224 225 struct ffs_data *ffs; 226 }; 227 228 struct ffs_desc_helper { 229 struct ffs_data *ffs; 230 unsigned interfaces_count; 231 unsigned eps_count; 232 }; 233 234 static int __must_check ffs_epfiles_create(struct ffs_data *ffs); 235 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count); 236 237 static struct dentry * 238 ffs_sb_create_file(struct super_block *sb, const char *name, void *data, 239 const struct file_operations *fops); 240 241 /* Devices management *******************************************************/ 242 243 DEFINE_MUTEX(ffs_lock); 244 EXPORT_SYMBOL_GPL(ffs_lock); 245 246 static struct ffs_dev *_ffs_find_dev(const char *name); 247 static struct ffs_dev *_ffs_alloc_dev(void); 248 static int _ffs_name_dev(struct ffs_dev *dev, const char *name); 249 static void _ffs_free_dev(struct ffs_dev *dev); 250 static void *ffs_acquire_dev(const char *dev_name); 251 static void ffs_release_dev(struct ffs_data *ffs_data); 252 static int ffs_ready(struct ffs_data *ffs); 253 static void ffs_closed(struct ffs_data *ffs); 254 255 /* Misc helper functions ****************************************************/ 256 257 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock) 258 __attribute__((warn_unused_result, nonnull)); 259 static char *ffs_prepare_buffer(const char __user *buf, size_t len) 260 __attribute__((warn_unused_result, nonnull)); 261 262 263 /* Control file aka ep0 *****************************************************/ 264 265 static void ffs_ep0_complete(struct usb_ep *ep, struct usb_request *req) 266 { 267 struct ffs_data *ffs = req->context; 268 269 complete(&ffs->ep0req_completion); 270 } 271 272 static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len) 273 { 274 struct usb_request *req = ffs->ep0req; 275 int ret; 276 277 req->zero = len < le16_to_cpu(ffs->ev.setup.wLength); 278 279 spin_unlock_irq(&ffs->ev.waitq.lock); 280 281 req->buf = data; 282 req->length = len; 283 284 /* 285 * UDC layer requires to provide a buffer even for ZLP, but should 286 * not use it at all. Let's provide some poisoned pointer to catch 287 * possible bug in the driver. 288 */ 289 if (req->buf == NULL) 290 req->buf = (void *)0xDEADBABE; 291 292 reinit_completion(&ffs->ep0req_completion); 293 294 ret = usb_ep_queue(ffs->gadget->ep0, req, GFP_ATOMIC); 295 if (unlikely(ret < 0)) 296 return ret; 297 298 ret = wait_for_completion_interruptible(&ffs->ep0req_completion); 299 if (unlikely(ret)) { 300 usb_ep_dequeue(ffs->gadget->ep0, req); 301 return -EINTR; 302 } 303 304 ffs->setup_state = FFS_NO_SETUP; 305 return req->status ? req->status : req->actual; 306 } 307 308 static int __ffs_ep0_stall(struct ffs_data *ffs) 309 { 310 if (ffs->ev.can_stall) { 311 pr_vdebug("ep0 stall\n"); 312 usb_ep_set_halt(ffs->gadget->ep0); 313 ffs->setup_state = FFS_NO_SETUP; 314 return -EL2HLT; 315 } else { 316 pr_debug("bogus ep0 stall!\n"); 317 return -ESRCH; 318 } 319 } 320 321 static ssize_t ffs_ep0_write(struct file *file, const char __user *buf, 322 size_t len, loff_t *ptr) 323 { 324 struct ffs_data *ffs = file->private_data; 325 ssize_t ret; 326 char *data; 327 328 ENTER(); 329 330 /* Fast check if setup was canceled */ 331 if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED) 332 return -EIDRM; 333 334 /* Acquire mutex */ 335 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK); 336 if (unlikely(ret < 0)) 337 return ret; 338 339 /* Check state */ 340 switch (ffs->state) { 341 case FFS_READ_DESCRIPTORS: 342 case FFS_READ_STRINGS: 343 /* Copy data */ 344 if (unlikely(len < 16)) { 345 ret = -EINVAL; 346 break; 347 } 348 349 data = ffs_prepare_buffer(buf, len); 350 if (IS_ERR(data)) { 351 ret = PTR_ERR(data); 352 break; 353 } 354 355 /* Handle data */ 356 if (ffs->state == FFS_READ_DESCRIPTORS) { 357 pr_info("read descriptors\n"); 358 ret = __ffs_data_got_descs(ffs, data, len); 359 if (unlikely(ret < 0)) 360 break; 361 362 ffs->state = FFS_READ_STRINGS; 363 ret = len; 364 } else { 365 pr_info("read strings\n"); 366 ret = __ffs_data_got_strings(ffs, data, len); 367 if (unlikely(ret < 0)) 368 break; 369 370 ret = ffs_epfiles_create(ffs); 371 if (unlikely(ret)) { 372 ffs->state = FFS_CLOSING; 373 break; 374 } 375 376 ffs->state = FFS_ACTIVE; 377 mutex_unlock(&ffs->mutex); 378 379 ret = ffs_ready(ffs); 380 if (unlikely(ret < 0)) { 381 ffs->state = FFS_CLOSING; 382 return ret; 383 } 384 385 return len; 386 } 387 break; 388 389 case FFS_ACTIVE: 390 data = NULL; 391 /* 392 * We're called from user space, we can use _irq 393 * rather then _irqsave 394 */ 395 spin_lock_irq(&ffs->ev.waitq.lock); 396 switch (ffs_setup_state_clear_cancelled(ffs)) { 397 case FFS_SETUP_CANCELLED: 398 ret = -EIDRM; 399 goto done_spin; 400 401 case FFS_NO_SETUP: 402 ret = -ESRCH; 403 goto done_spin; 404 405 case FFS_SETUP_PENDING: 406 break; 407 } 408 409 /* FFS_SETUP_PENDING */ 410 if (!(ffs->ev.setup.bRequestType & USB_DIR_IN)) { 411 spin_unlock_irq(&ffs->ev.waitq.lock); 412 ret = __ffs_ep0_stall(ffs); 413 break; 414 } 415 416 /* FFS_SETUP_PENDING and not stall */ 417 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength)); 418 419 spin_unlock_irq(&ffs->ev.waitq.lock); 420 421 data = ffs_prepare_buffer(buf, len); 422 if (IS_ERR(data)) { 423 ret = PTR_ERR(data); 424 break; 425 } 426 427 spin_lock_irq(&ffs->ev.waitq.lock); 428 429 /* 430 * We are guaranteed to be still in FFS_ACTIVE state 431 * but the state of setup could have changed from 432 * FFS_SETUP_PENDING to FFS_SETUP_CANCELLED so we need 433 * to check for that. If that happened we copied data 434 * from user space in vain but it's unlikely. 435 * 436 * For sure we are not in FFS_NO_SETUP since this is 437 * the only place FFS_SETUP_PENDING -> FFS_NO_SETUP 438 * transition can be performed and it's protected by 439 * mutex. 440 */ 441 if (ffs_setup_state_clear_cancelled(ffs) == 442 FFS_SETUP_CANCELLED) { 443 ret = -EIDRM; 444 done_spin: 445 spin_unlock_irq(&ffs->ev.waitq.lock); 446 } else { 447 /* unlocks spinlock */ 448 ret = __ffs_ep0_queue_wait(ffs, data, len); 449 } 450 kfree(data); 451 break; 452 453 default: 454 ret = -EBADFD; 455 break; 456 } 457 458 mutex_unlock(&ffs->mutex); 459 return ret; 460 } 461 462 /* Called with ffs->ev.waitq.lock and ffs->mutex held, both released on exit. */ 463 static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf, 464 size_t n) 465 { 466 /* 467 * n cannot be bigger than ffs->ev.count, which cannot be bigger than 468 * size of ffs->ev.types array (which is four) so that's how much space 469 * we reserve. 470 */ 471 struct usb_functionfs_event events[ARRAY_SIZE(ffs->ev.types)]; 472 const size_t size = n * sizeof *events; 473 unsigned i = 0; 474 475 memset(events, 0, size); 476 477 do { 478 events[i].type = ffs->ev.types[i]; 479 if (events[i].type == FUNCTIONFS_SETUP) { 480 events[i].u.setup = ffs->ev.setup; 481 ffs->setup_state = FFS_SETUP_PENDING; 482 } 483 } while (++i < n); 484 485 ffs->ev.count -= n; 486 if (ffs->ev.count) 487 memmove(ffs->ev.types, ffs->ev.types + n, 488 ffs->ev.count * sizeof *ffs->ev.types); 489 490 spin_unlock_irq(&ffs->ev.waitq.lock); 491 mutex_unlock(&ffs->mutex); 492 493 return unlikely(copy_to_user(buf, events, size)) ? -EFAULT : size; 494 } 495 496 static ssize_t ffs_ep0_read(struct file *file, char __user *buf, 497 size_t len, loff_t *ptr) 498 { 499 struct ffs_data *ffs = file->private_data; 500 char *data = NULL; 501 size_t n; 502 int ret; 503 504 ENTER(); 505 506 /* Fast check if setup was canceled */ 507 if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED) 508 return -EIDRM; 509 510 /* Acquire mutex */ 511 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK); 512 if (unlikely(ret < 0)) 513 return ret; 514 515 /* Check state */ 516 if (ffs->state != FFS_ACTIVE) { 517 ret = -EBADFD; 518 goto done_mutex; 519 } 520 521 /* 522 * We're called from user space, we can use _irq rather then 523 * _irqsave 524 */ 525 spin_lock_irq(&ffs->ev.waitq.lock); 526 527 switch (ffs_setup_state_clear_cancelled(ffs)) { 528 case FFS_SETUP_CANCELLED: 529 ret = -EIDRM; 530 break; 531 532 case FFS_NO_SETUP: 533 n = len / sizeof(struct usb_functionfs_event); 534 if (unlikely(!n)) { 535 ret = -EINVAL; 536 break; 537 } 538 539 if ((file->f_flags & O_NONBLOCK) && !ffs->ev.count) { 540 ret = -EAGAIN; 541 break; 542 } 543 544 if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq, 545 ffs->ev.count)) { 546 ret = -EINTR; 547 break; 548 } 549 550 return __ffs_ep0_read_events(ffs, buf, 551 min(n, (size_t)ffs->ev.count)); 552 553 case FFS_SETUP_PENDING: 554 if (ffs->ev.setup.bRequestType & USB_DIR_IN) { 555 spin_unlock_irq(&ffs->ev.waitq.lock); 556 ret = __ffs_ep0_stall(ffs); 557 goto done_mutex; 558 } 559 560 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength)); 561 562 spin_unlock_irq(&ffs->ev.waitq.lock); 563 564 if (likely(len)) { 565 data = kmalloc(len, GFP_KERNEL); 566 if (unlikely(!data)) { 567 ret = -ENOMEM; 568 goto done_mutex; 569 } 570 } 571 572 spin_lock_irq(&ffs->ev.waitq.lock); 573 574 /* See ffs_ep0_write() */ 575 if (ffs_setup_state_clear_cancelled(ffs) == 576 FFS_SETUP_CANCELLED) { 577 ret = -EIDRM; 578 break; 579 } 580 581 /* unlocks spinlock */ 582 ret = __ffs_ep0_queue_wait(ffs, data, len); 583 if (likely(ret > 0) && unlikely(copy_to_user(buf, data, len))) 584 ret = -EFAULT; 585 goto done_mutex; 586 587 default: 588 ret = -EBADFD; 589 break; 590 } 591 592 spin_unlock_irq(&ffs->ev.waitq.lock); 593 done_mutex: 594 mutex_unlock(&ffs->mutex); 595 kfree(data); 596 return ret; 597 } 598 599 static int ffs_ep0_open(struct inode *inode, struct file *file) 600 { 601 struct ffs_data *ffs = inode->i_private; 602 603 ENTER(); 604 605 if (unlikely(ffs->state == FFS_CLOSING)) 606 return -EBUSY; 607 608 file->private_data = ffs; 609 ffs_data_opened(ffs); 610 611 return 0; 612 } 613 614 static int ffs_ep0_release(struct inode *inode, struct file *file) 615 { 616 struct ffs_data *ffs = file->private_data; 617 618 ENTER(); 619 620 ffs_data_closed(ffs); 621 622 return 0; 623 } 624 625 static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value) 626 { 627 struct ffs_data *ffs = file->private_data; 628 struct usb_gadget *gadget = ffs->gadget; 629 long ret; 630 631 ENTER(); 632 633 if (code == FUNCTIONFS_INTERFACE_REVMAP) { 634 struct ffs_function *func = ffs->func; 635 ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV; 636 } else if (gadget && gadget->ops->ioctl) { 637 ret = gadget->ops->ioctl(gadget, code, value); 638 } else { 639 ret = -ENOTTY; 640 } 641 642 return ret; 643 } 644 645 static unsigned int ffs_ep0_poll(struct file *file, poll_table *wait) 646 { 647 struct ffs_data *ffs = file->private_data; 648 unsigned int mask = POLLWRNORM; 649 int ret; 650 651 poll_wait(file, &ffs->ev.waitq, wait); 652 653 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK); 654 if (unlikely(ret < 0)) 655 return mask; 656 657 switch (ffs->state) { 658 case FFS_READ_DESCRIPTORS: 659 case FFS_READ_STRINGS: 660 mask |= POLLOUT; 661 break; 662 663 case FFS_ACTIVE: 664 switch (ffs->setup_state) { 665 case FFS_NO_SETUP: 666 if (ffs->ev.count) 667 mask |= POLLIN; 668 break; 669 670 case FFS_SETUP_PENDING: 671 case FFS_SETUP_CANCELLED: 672 mask |= (POLLIN | POLLOUT); 673 break; 674 } 675 case FFS_CLOSING: 676 break; 677 case FFS_DEACTIVATED: 678 break; 679 } 680 681 mutex_unlock(&ffs->mutex); 682 683 return mask; 684 } 685 686 static const struct file_operations ffs_ep0_operations = { 687 .llseek = no_llseek, 688 689 .open = ffs_ep0_open, 690 .write = ffs_ep0_write, 691 .read = ffs_ep0_read, 692 .release = ffs_ep0_release, 693 .unlocked_ioctl = ffs_ep0_ioctl, 694 .poll = ffs_ep0_poll, 695 }; 696 697 698 /* "Normal" endpoints operations ********************************************/ 699 700 static void ffs_epfile_io_complete(struct usb_ep *_ep, struct usb_request *req) 701 { 702 ENTER(); 703 if (likely(req->context)) { 704 struct ffs_ep *ep = _ep->driver_data; 705 ep->status = req->status ? req->status : req->actual; 706 complete(req->context); 707 } 708 } 709 710 static ssize_t ffs_copy_to_iter(void *data, int data_len, struct iov_iter *iter) 711 { 712 ssize_t ret = copy_to_iter(data, data_len, iter); 713 if (likely(ret == data_len)) 714 return ret; 715 716 if (unlikely(iov_iter_count(iter))) 717 return -EFAULT; 718 719 /* 720 * Dear user space developer! 721 * 722 * TL;DR: To stop getting below error message in your kernel log, change 723 * user space code using functionfs to align read buffers to a max 724 * packet size. 725 * 726 * Some UDCs (e.g. dwc3) require request sizes to be a multiple of a max 727 * packet size. When unaligned buffer is passed to functionfs, it 728 * internally uses a larger, aligned buffer so that such UDCs are happy. 729 * 730 * Unfortunately, this means that host may send more data than was 731 * requested in read(2) system call. f_fs doesn’t know what to do with 732 * that excess data so it simply drops it. 733 * 734 * Was the buffer aligned in the first place, no such problem would 735 * happen. 736 * 737 * Data may be dropped only in AIO reads. Synchronous reads are handled 738 * by splitting a request into multiple parts. This splitting may still 739 * be a problem though so it’s likely best to align the buffer 740 * regardless of it being AIO or not.. 741 * 742 * This only affects OUT endpoints, i.e. reading data with a read(2), 743 * aio_read(2) etc. system calls. Writing data to an IN endpoint is not 744 * affected. 745 */ 746 pr_err("functionfs read size %d > requested size %zd, dropping excess data. " 747 "Align read buffer size to max packet size to avoid the problem.\n", 748 data_len, ret); 749 750 return ret; 751 } 752 753 static void ffs_user_copy_worker(struct work_struct *work) 754 { 755 struct ffs_io_data *io_data = container_of(work, struct ffs_io_data, 756 work); 757 int ret = io_data->req->status ? io_data->req->status : 758 io_data->req->actual; 759 bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD; 760 761 if (io_data->read && ret > 0) { 762 use_mm(io_data->mm); 763 ret = ffs_copy_to_iter(io_data->buf, ret, &io_data->data); 764 unuse_mm(io_data->mm); 765 } 766 767 io_data->kiocb->ki_complete(io_data->kiocb, ret, ret); 768 769 if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd) 770 eventfd_signal(io_data->ffs->ffs_eventfd, 1); 771 772 usb_ep_free_request(io_data->ep, io_data->req); 773 774 if (io_data->read) 775 kfree(io_data->to_free); 776 kfree(io_data->buf); 777 kfree(io_data); 778 } 779 780 static void ffs_epfile_async_io_complete(struct usb_ep *_ep, 781 struct usb_request *req) 782 { 783 struct ffs_io_data *io_data = req->context; 784 785 ENTER(); 786 787 INIT_WORK(&io_data->work, ffs_user_copy_worker); 788 schedule_work(&io_data->work); 789 } 790 791 static void __ffs_epfile_read_buffer_free(struct ffs_epfile *epfile) 792 { 793 /* 794 * See comment in struct ffs_epfile for full read_buffer pointer 795 * synchronisation story. 796 */ 797 struct ffs_buffer *buf = xchg(&epfile->read_buffer, READ_BUFFER_DROP); 798 if (buf && buf != READ_BUFFER_DROP) 799 kfree(buf); 800 } 801 802 /* Assumes epfile->mutex is held. */ 803 static ssize_t __ffs_epfile_read_buffered(struct ffs_epfile *epfile, 804 struct iov_iter *iter) 805 { 806 /* 807 * Null out epfile->read_buffer so ffs_func_eps_disable does not free 808 * the buffer while we are using it. See comment in struct ffs_epfile 809 * for full read_buffer pointer synchronisation story. 810 */ 811 struct ffs_buffer *buf = xchg(&epfile->read_buffer, NULL); 812 ssize_t ret; 813 if (!buf || buf == READ_BUFFER_DROP) 814 return 0; 815 816 ret = copy_to_iter(buf->data, buf->length, iter); 817 if (buf->length == ret) { 818 kfree(buf); 819 return ret; 820 } 821 822 if (unlikely(iov_iter_count(iter))) { 823 ret = -EFAULT; 824 } else { 825 buf->length -= ret; 826 buf->data += ret; 827 } 828 829 if (cmpxchg(&epfile->read_buffer, NULL, buf)) 830 kfree(buf); 831 832 return ret; 833 } 834 835 /* Assumes epfile->mutex is held. */ 836 static ssize_t __ffs_epfile_read_data(struct ffs_epfile *epfile, 837 void *data, int data_len, 838 struct iov_iter *iter) 839 { 840 struct ffs_buffer *buf; 841 842 ssize_t ret = copy_to_iter(data, data_len, iter); 843 if (likely(data_len == ret)) 844 return ret; 845 846 if (unlikely(iov_iter_count(iter))) 847 return -EFAULT; 848 849 /* See ffs_copy_to_iter for more context. */ 850 pr_warn("functionfs read size %d > requested size %zd, splitting request into multiple reads.", 851 data_len, ret); 852 853 data_len -= ret; 854 buf = kmalloc(sizeof(*buf) + data_len, GFP_KERNEL); 855 if (!buf) 856 return -ENOMEM; 857 buf->length = data_len; 858 buf->data = buf->storage; 859 memcpy(buf->storage, data + ret, data_len); 860 861 /* 862 * At this point read_buffer is NULL or READ_BUFFER_DROP (if 863 * ffs_func_eps_disable has been called in the meanwhile). See comment 864 * in struct ffs_epfile for full read_buffer pointer synchronisation 865 * story. 866 */ 867 if (unlikely(cmpxchg(&epfile->read_buffer, NULL, buf))) 868 kfree(buf); 869 870 return ret; 871 } 872 873 static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) 874 { 875 struct ffs_epfile *epfile = file->private_data; 876 struct usb_request *req; 877 struct ffs_ep *ep; 878 char *data = NULL; 879 ssize_t ret, data_len = -EINVAL; 880 int halt; 881 882 /* Are we still active? */ 883 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE)) 884 return -ENODEV; 885 886 /* Wait for endpoint to be enabled */ 887 ep = epfile->ep; 888 if (!ep) { 889 if (file->f_flags & O_NONBLOCK) 890 return -EAGAIN; 891 892 ret = wait_event_interruptible(epfile->wait, (ep = epfile->ep)); 893 if (ret) 894 return -EINTR; 895 } 896 897 /* Do we halt? */ 898 halt = (!io_data->read == !epfile->in); 899 if (halt && epfile->isoc) 900 return -EINVAL; 901 902 /* We will be using request and read_buffer */ 903 ret = ffs_mutex_lock(&epfile->mutex, file->f_flags & O_NONBLOCK); 904 if (unlikely(ret)) 905 goto error; 906 907 /* Allocate & copy */ 908 if (!halt) { 909 struct usb_gadget *gadget; 910 911 /* 912 * Do we have buffered data from previous partial read? Check 913 * that for synchronous case only because we do not have 914 * facility to ‘wake up’ a pending asynchronous read and push 915 * buffered data to it which we would need to make things behave 916 * consistently. 917 */ 918 if (!io_data->aio && io_data->read) { 919 ret = __ffs_epfile_read_buffered(epfile, &io_data->data); 920 if (ret) 921 goto error_mutex; 922 } 923 924 /* 925 * if we _do_ wait above, the epfile->ffs->gadget might be NULL 926 * before the waiting completes, so do not assign to 'gadget' 927 * earlier 928 */ 929 gadget = epfile->ffs->gadget; 930 931 spin_lock_irq(&epfile->ffs->eps_lock); 932 /* In the meantime, endpoint got disabled or changed. */ 933 if (epfile->ep != ep) { 934 ret = -ESHUTDOWN; 935 goto error_lock; 936 } 937 data_len = iov_iter_count(&io_data->data); 938 /* 939 * Controller may require buffer size to be aligned to 940 * maxpacketsize of an out endpoint. 941 */ 942 if (io_data->read) 943 data_len = usb_ep_align_maybe(gadget, ep->ep, data_len); 944 spin_unlock_irq(&epfile->ffs->eps_lock); 945 946 data = kmalloc(data_len, GFP_KERNEL); 947 if (unlikely(!data)) { 948 ret = -ENOMEM; 949 goto error_mutex; 950 } 951 if (!io_data->read && 952 !copy_from_iter_full(data, data_len, &io_data->data)) { 953 ret = -EFAULT; 954 goto error_mutex; 955 } 956 } 957 958 spin_lock_irq(&epfile->ffs->eps_lock); 959 960 if (epfile->ep != ep) { 961 /* In the meantime, endpoint got disabled or changed. */ 962 ret = -ESHUTDOWN; 963 } else if (halt) { 964 /* Halt */ 965 if (likely(epfile->ep == ep) && !WARN_ON(!ep->ep)) 966 usb_ep_set_halt(ep->ep); 967 ret = -EBADMSG; 968 } else if (unlikely(data_len == -EINVAL)) { 969 /* 970 * Sanity Check: even though data_len can't be used 971 * uninitialized at the time I write this comment, some 972 * compilers complain about this situation. 973 * In order to keep the code clean from warnings, data_len is 974 * being initialized to -EINVAL during its declaration, which 975 * means we can't rely on compiler anymore to warn no future 976 * changes won't result in data_len being used uninitialized. 977 * For such reason, we're adding this redundant sanity check 978 * here. 979 */ 980 WARN(1, "%s: data_len == -EINVAL\n", __func__); 981 ret = -EINVAL; 982 } else if (!io_data->aio) { 983 DECLARE_COMPLETION_ONSTACK(done); 984 bool interrupted = false; 985 986 req = ep->req; 987 req->buf = data; 988 req->length = data_len; 989 990 req->context = &done; 991 req->complete = ffs_epfile_io_complete; 992 993 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC); 994 if (unlikely(ret < 0)) 995 goto error_lock; 996 997 spin_unlock_irq(&epfile->ffs->eps_lock); 998 999 if (unlikely(wait_for_completion_interruptible(&done))) { 1000 /* 1001 * To avoid race condition with ffs_epfile_io_complete, 1002 * dequeue the request first then check 1003 * status. usb_ep_dequeue API should guarantee no race 1004 * condition with req->complete callback. 1005 */ 1006 usb_ep_dequeue(ep->ep, req); 1007 interrupted = ep->status < 0; 1008 } 1009 1010 if (interrupted) 1011 ret = -EINTR; 1012 else if (io_data->read && ep->status > 0) 1013 ret = __ffs_epfile_read_data(epfile, data, ep->status, 1014 &io_data->data); 1015 else 1016 ret = ep->status; 1017 goto error_mutex; 1018 } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_KERNEL))) { 1019 ret = -ENOMEM; 1020 } else { 1021 req->buf = data; 1022 req->length = data_len; 1023 1024 io_data->buf = data; 1025 io_data->ep = ep->ep; 1026 io_data->req = req; 1027 io_data->ffs = epfile->ffs; 1028 1029 req->context = io_data; 1030 req->complete = ffs_epfile_async_io_complete; 1031 1032 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC); 1033 if (unlikely(ret)) { 1034 usb_ep_free_request(ep->ep, req); 1035 goto error_lock; 1036 } 1037 1038 ret = -EIOCBQUEUED; 1039 /* 1040 * Do not kfree the buffer in this function. It will be freed 1041 * by ffs_user_copy_worker. 1042 */ 1043 data = NULL; 1044 } 1045 1046 error_lock: 1047 spin_unlock_irq(&epfile->ffs->eps_lock); 1048 error_mutex: 1049 mutex_unlock(&epfile->mutex); 1050 error: 1051 kfree(data); 1052 return ret; 1053 } 1054 1055 static int 1056 ffs_epfile_open(struct inode *inode, struct file *file) 1057 { 1058 struct ffs_epfile *epfile = inode->i_private; 1059 1060 ENTER(); 1061 1062 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE)) 1063 return -ENODEV; 1064 1065 file->private_data = epfile; 1066 ffs_data_opened(epfile->ffs); 1067 1068 return 0; 1069 } 1070 1071 static int ffs_aio_cancel(struct kiocb *kiocb) 1072 { 1073 struct ffs_io_data *io_data = kiocb->private; 1074 struct ffs_epfile *epfile = kiocb->ki_filp->private_data; 1075 int value; 1076 1077 ENTER(); 1078 1079 spin_lock_irq(&epfile->ffs->eps_lock); 1080 1081 if (likely(io_data && io_data->ep && io_data->req)) 1082 value = usb_ep_dequeue(io_data->ep, io_data->req); 1083 else 1084 value = -EINVAL; 1085 1086 spin_unlock_irq(&epfile->ffs->eps_lock); 1087 1088 return value; 1089 } 1090 1091 static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from) 1092 { 1093 struct ffs_io_data io_data, *p = &io_data; 1094 ssize_t res; 1095 1096 ENTER(); 1097 1098 if (!is_sync_kiocb(kiocb)) { 1099 p = kmalloc(sizeof(io_data), GFP_KERNEL); 1100 if (unlikely(!p)) 1101 return -ENOMEM; 1102 p->aio = true; 1103 } else { 1104 p->aio = false; 1105 } 1106 1107 p->read = false; 1108 p->kiocb = kiocb; 1109 p->data = *from; 1110 p->mm = current->mm; 1111 1112 kiocb->private = p; 1113 1114 if (p->aio) 1115 kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); 1116 1117 res = ffs_epfile_io(kiocb->ki_filp, p); 1118 if (res == -EIOCBQUEUED) 1119 return res; 1120 if (p->aio) 1121 kfree(p); 1122 else 1123 *from = p->data; 1124 return res; 1125 } 1126 1127 static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to) 1128 { 1129 struct ffs_io_data io_data, *p = &io_data; 1130 ssize_t res; 1131 1132 ENTER(); 1133 1134 if (!is_sync_kiocb(kiocb)) { 1135 p = kmalloc(sizeof(io_data), GFP_KERNEL); 1136 if (unlikely(!p)) 1137 return -ENOMEM; 1138 p->aio = true; 1139 } else { 1140 p->aio = false; 1141 } 1142 1143 p->read = true; 1144 p->kiocb = kiocb; 1145 if (p->aio) { 1146 p->to_free = dup_iter(&p->data, to, GFP_KERNEL); 1147 if (!p->to_free) { 1148 kfree(p); 1149 return -ENOMEM; 1150 } 1151 } else { 1152 p->data = *to; 1153 p->to_free = NULL; 1154 } 1155 p->mm = current->mm; 1156 1157 kiocb->private = p; 1158 1159 if (p->aio) 1160 kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); 1161 1162 res = ffs_epfile_io(kiocb->ki_filp, p); 1163 if (res == -EIOCBQUEUED) 1164 return res; 1165 1166 if (p->aio) { 1167 kfree(p->to_free); 1168 kfree(p); 1169 } else { 1170 *to = p->data; 1171 } 1172 return res; 1173 } 1174 1175 static int 1176 ffs_epfile_release(struct inode *inode, struct file *file) 1177 { 1178 struct ffs_epfile *epfile = inode->i_private; 1179 1180 ENTER(); 1181 1182 __ffs_epfile_read_buffer_free(epfile); 1183 ffs_data_closed(epfile->ffs); 1184 1185 return 0; 1186 } 1187 1188 static long ffs_epfile_ioctl(struct file *file, unsigned code, 1189 unsigned long value) 1190 { 1191 struct ffs_epfile *epfile = file->private_data; 1192 int ret; 1193 1194 ENTER(); 1195 1196 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE)) 1197 return -ENODEV; 1198 1199 spin_lock_irq(&epfile->ffs->eps_lock); 1200 if (likely(epfile->ep)) { 1201 switch (code) { 1202 case FUNCTIONFS_FIFO_STATUS: 1203 ret = usb_ep_fifo_status(epfile->ep->ep); 1204 break; 1205 case FUNCTIONFS_FIFO_FLUSH: 1206 usb_ep_fifo_flush(epfile->ep->ep); 1207 ret = 0; 1208 break; 1209 case FUNCTIONFS_CLEAR_HALT: 1210 ret = usb_ep_clear_halt(epfile->ep->ep); 1211 break; 1212 case FUNCTIONFS_ENDPOINT_REVMAP: 1213 ret = epfile->ep->num; 1214 break; 1215 case FUNCTIONFS_ENDPOINT_DESC: 1216 { 1217 int desc_idx; 1218 struct usb_endpoint_descriptor *desc; 1219 1220 switch (epfile->ffs->gadget->speed) { 1221 case USB_SPEED_SUPER: 1222 desc_idx = 2; 1223 break; 1224 case USB_SPEED_HIGH: 1225 desc_idx = 1; 1226 break; 1227 default: 1228 desc_idx = 0; 1229 } 1230 desc = epfile->ep->descs[desc_idx]; 1231 1232 spin_unlock_irq(&epfile->ffs->eps_lock); 1233 ret = copy_to_user((void *)value, desc, sizeof(*desc)); 1234 if (ret) 1235 ret = -EFAULT; 1236 return ret; 1237 } 1238 default: 1239 ret = -ENOTTY; 1240 } 1241 } else { 1242 ret = -ENODEV; 1243 } 1244 spin_unlock_irq(&epfile->ffs->eps_lock); 1245 1246 return ret; 1247 } 1248 1249 static const struct file_operations ffs_epfile_operations = { 1250 .llseek = no_llseek, 1251 1252 .open = ffs_epfile_open, 1253 .write_iter = ffs_epfile_write_iter, 1254 .read_iter = ffs_epfile_read_iter, 1255 .release = ffs_epfile_release, 1256 .unlocked_ioctl = ffs_epfile_ioctl, 1257 }; 1258 1259 1260 /* File system and super block operations ***********************************/ 1261 1262 /* 1263 * Mounting the file system creates a controller file, used first for 1264 * function configuration then later for event monitoring. 1265 */ 1266 1267 static struct inode *__must_check 1268 ffs_sb_make_inode(struct super_block *sb, void *data, 1269 const struct file_operations *fops, 1270 const struct inode_operations *iops, 1271 struct ffs_file_perms *perms) 1272 { 1273 struct inode *inode; 1274 1275 ENTER(); 1276 1277 inode = new_inode(sb); 1278 1279 if (likely(inode)) { 1280 struct timespec ts = current_time(inode); 1281 1282 inode->i_ino = get_next_ino(); 1283 inode->i_mode = perms->mode; 1284 inode->i_uid = perms->uid; 1285 inode->i_gid = perms->gid; 1286 inode->i_atime = ts; 1287 inode->i_mtime = ts; 1288 inode->i_ctime = ts; 1289 inode->i_private = data; 1290 if (fops) 1291 inode->i_fop = fops; 1292 if (iops) 1293 inode->i_op = iops; 1294 } 1295 1296 return inode; 1297 } 1298 1299 /* Create "regular" file */ 1300 static struct dentry *ffs_sb_create_file(struct super_block *sb, 1301 const char *name, void *data, 1302 const struct file_operations *fops) 1303 { 1304 struct ffs_data *ffs = sb->s_fs_info; 1305 struct dentry *dentry; 1306 struct inode *inode; 1307 1308 ENTER(); 1309 1310 dentry = d_alloc_name(sb->s_root, name); 1311 if (unlikely(!dentry)) 1312 return NULL; 1313 1314 inode = ffs_sb_make_inode(sb, data, fops, NULL, &ffs->file_perms); 1315 if (unlikely(!inode)) { 1316 dput(dentry); 1317 return NULL; 1318 } 1319 1320 d_add(dentry, inode); 1321 return dentry; 1322 } 1323 1324 /* Super block */ 1325 static const struct super_operations ffs_sb_operations = { 1326 .statfs = simple_statfs, 1327 .drop_inode = generic_delete_inode, 1328 }; 1329 1330 struct ffs_sb_fill_data { 1331 struct ffs_file_perms perms; 1332 umode_t root_mode; 1333 const char *dev_name; 1334 bool no_disconnect; 1335 struct ffs_data *ffs_data; 1336 }; 1337 1338 static int ffs_sb_fill(struct super_block *sb, void *_data, int silent) 1339 { 1340 struct ffs_sb_fill_data *data = _data; 1341 struct inode *inode; 1342 struct ffs_data *ffs = data->ffs_data; 1343 1344 ENTER(); 1345 1346 ffs->sb = sb; 1347 data->ffs_data = NULL; 1348 sb->s_fs_info = ffs; 1349 sb->s_blocksize = PAGE_SIZE; 1350 sb->s_blocksize_bits = PAGE_SHIFT; 1351 sb->s_magic = FUNCTIONFS_MAGIC; 1352 sb->s_op = &ffs_sb_operations; 1353 sb->s_time_gran = 1; 1354 1355 /* Root inode */ 1356 data->perms.mode = data->root_mode; 1357 inode = ffs_sb_make_inode(sb, NULL, 1358 &simple_dir_operations, 1359 &simple_dir_inode_operations, 1360 &data->perms); 1361 sb->s_root = d_make_root(inode); 1362 if (unlikely(!sb->s_root)) 1363 return -ENOMEM; 1364 1365 /* EP0 file */ 1366 if (unlikely(!ffs_sb_create_file(sb, "ep0", ffs, 1367 &ffs_ep0_operations))) 1368 return -ENOMEM; 1369 1370 return 0; 1371 } 1372 1373 static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts) 1374 { 1375 ENTER(); 1376 1377 if (!opts || !*opts) 1378 return 0; 1379 1380 for (;;) { 1381 unsigned long value; 1382 char *eq, *comma; 1383 1384 /* Option limit */ 1385 comma = strchr(opts, ','); 1386 if (comma) 1387 *comma = 0; 1388 1389 /* Value limit */ 1390 eq = strchr(opts, '='); 1391 if (unlikely(!eq)) { 1392 pr_err("'=' missing in %s\n", opts); 1393 return -EINVAL; 1394 } 1395 *eq = 0; 1396 1397 /* Parse value */ 1398 if (kstrtoul(eq + 1, 0, &value)) { 1399 pr_err("%s: invalid value: %s\n", opts, eq + 1); 1400 return -EINVAL; 1401 } 1402 1403 /* Interpret option */ 1404 switch (eq - opts) { 1405 case 13: 1406 if (!memcmp(opts, "no_disconnect", 13)) 1407 data->no_disconnect = !!value; 1408 else 1409 goto invalid; 1410 break; 1411 case 5: 1412 if (!memcmp(opts, "rmode", 5)) 1413 data->root_mode = (value & 0555) | S_IFDIR; 1414 else if (!memcmp(opts, "fmode", 5)) 1415 data->perms.mode = (value & 0666) | S_IFREG; 1416 else 1417 goto invalid; 1418 break; 1419 1420 case 4: 1421 if (!memcmp(opts, "mode", 4)) { 1422 data->root_mode = (value & 0555) | S_IFDIR; 1423 data->perms.mode = (value & 0666) | S_IFREG; 1424 } else { 1425 goto invalid; 1426 } 1427 break; 1428 1429 case 3: 1430 if (!memcmp(opts, "uid", 3)) { 1431 data->perms.uid = make_kuid(current_user_ns(), value); 1432 if (!uid_valid(data->perms.uid)) { 1433 pr_err("%s: unmapped value: %lu\n", opts, value); 1434 return -EINVAL; 1435 } 1436 } else if (!memcmp(opts, "gid", 3)) { 1437 data->perms.gid = make_kgid(current_user_ns(), value); 1438 if (!gid_valid(data->perms.gid)) { 1439 pr_err("%s: unmapped value: %lu\n", opts, value); 1440 return -EINVAL; 1441 } 1442 } else { 1443 goto invalid; 1444 } 1445 break; 1446 1447 default: 1448 invalid: 1449 pr_err("%s: invalid option\n", opts); 1450 return -EINVAL; 1451 } 1452 1453 /* Next iteration */ 1454 if (!comma) 1455 break; 1456 opts = comma + 1; 1457 } 1458 1459 return 0; 1460 } 1461 1462 /* "mount -t functionfs dev_name /dev/function" ends up here */ 1463 1464 static struct dentry * 1465 ffs_fs_mount(struct file_system_type *t, int flags, 1466 const char *dev_name, void *opts) 1467 { 1468 struct ffs_sb_fill_data data = { 1469 .perms = { 1470 .mode = S_IFREG | 0600, 1471 .uid = GLOBAL_ROOT_UID, 1472 .gid = GLOBAL_ROOT_GID, 1473 }, 1474 .root_mode = S_IFDIR | 0500, 1475 .no_disconnect = false, 1476 }; 1477 struct dentry *rv; 1478 int ret; 1479 void *ffs_dev; 1480 struct ffs_data *ffs; 1481 1482 ENTER(); 1483 1484 ret = ffs_fs_parse_opts(&data, opts); 1485 if (unlikely(ret < 0)) 1486 return ERR_PTR(ret); 1487 1488 ffs = ffs_data_new(); 1489 if (unlikely(!ffs)) 1490 return ERR_PTR(-ENOMEM); 1491 ffs->file_perms = data.perms; 1492 ffs->no_disconnect = data.no_disconnect; 1493 1494 ffs->dev_name = kstrdup(dev_name, GFP_KERNEL); 1495 if (unlikely(!ffs->dev_name)) { 1496 ffs_data_put(ffs); 1497 return ERR_PTR(-ENOMEM); 1498 } 1499 1500 ffs_dev = ffs_acquire_dev(dev_name); 1501 if (IS_ERR(ffs_dev)) { 1502 ffs_data_put(ffs); 1503 return ERR_CAST(ffs_dev); 1504 } 1505 ffs->private_data = ffs_dev; 1506 data.ffs_data = ffs; 1507 1508 rv = mount_nodev(t, flags, &data, ffs_sb_fill); 1509 if (IS_ERR(rv) && data.ffs_data) { 1510 ffs_release_dev(data.ffs_data); 1511 ffs_data_put(data.ffs_data); 1512 } 1513 return rv; 1514 } 1515 1516 static void 1517 ffs_fs_kill_sb(struct super_block *sb) 1518 { 1519 ENTER(); 1520 1521 kill_litter_super(sb); 1522 if (sb->s_fs_info) { 1523 ffs_release_dev(sb->s_fs_info); 1524 ffs_data_closed(sb->s_fs_info); 1525 ffs_data_put(sb->s_fs_info); 1526 } 1527 } 1528 1529 static struct file_system_type ffs_fs_type = { 1530 .owner = THIS_MODULE, 1531 .name = "functionfs", 1532 .mount = ffs_fs_mount, 1533 .kill_sb = ffs_fs_kill_sb, 1534 }; 1535 MODULE_ALIAS_FS("functionfs"); 1536 1537 1538 /* Driver's main init/cleanup functions *************************************/ 1539 1540 static int functionfs_init(void) 1541 { 1542 int ret; 1543 1544 ENTER(); 1545 1546 ret = register_filesystem(&ffs_fs_type); 1547 if (likely(!ret)) 1548 pr_info("file system registered\n"); 1549 else 1550 pr_err("failed registering file system (%d)\n", ret); 1551 1552 return ret; 1553 } 1554 1555 static void functionfs_cleanup(void) 1556 { 1557 ENTER(); 1558 1559 pr_info("unloading\n"); 1560 unregister_filesystem(&ffs_fs_type); 1561 } 1562 1563 1564 /* ffs_data and ffs_function construction and destruction code **************/ 1565 1566 static void ffs_data_clear(struct ffs_data *ffs); 1567 static void ffs_data_reset(struct ffs_data *ffs); 1568 1569 static void ffs_data_get(struct ffs_data *ffs) 1570 { 1571 ENTER(); 1572 1573 atomic_inc(&ffs->ref); 1574 } 1575 1576 static void ffs_data_opened(struct ffs_data *ffs) 1577 { 1578 ENTER(); 1579 1580 atomic_inc(&ffs->ref); 1581 if (atomic_add_return(1, &ffs->opened) == 1 && 1582 ffs->state == FFS_DEACTIVATED) { 1583 ffs->state = FFS_CLOSING; 1584 ffs_data_reset(ffs); 1585 } 1586 } 1587 1588 static void ffs_data_put(struct ffs_data *ffs) 1589 { 1590 ENTER(); 1591 1592 if (unlikely(atomic_dec_and_test(&ffs->ref))) { 1593 pr_info("%s(): freeing\n", __func__); 1594 ffs_data_clear(ffs); 1595 BUG_ON(waitqueue_active(&ffs->ev.waitq) || 1596 waitqueue_active(&ffs->ep0req_completion.wait)); 1597 kfree(ffs->dev_name); 1598 kfree(ffs); 1599 } 1600 } 1601 1602 static void ffs_data_closed(struct ffs_data *ffs) 1603 { 1604 ENTER(); 1605 1606 if (atomic_dec_and_test(&ffs->opened)) { 1607 if (ffs->no_disconnect) { 1608 ffs->state = FFS_DEACTIVATED; 1609 if (ffs->epfiles) { 1610 ffs_epfiles_destroy(ffs->epfiles, 1611 ffs->eps_count); 1612 ffs->epfiles = NULL; 1613 } 1614 if (ffs->setup_state == FFS_SETUP_PENDING) 1615 __ffs_ep0_stall(ffs); 1616 } else { 1617 ffs->state = FFS_CLOSING; 1618 ffs_data_reset(ffs); 1619 } 1620 } 1621 if (atomic_read(&ffs->opened) < 0) { 1622 ffs->state = FFS_CLOSING; 1623 ffs_data_reset(ffs); 1624 } 1625 1626 ffs_data_put(ffs); 1627 } 1628 1629 static struct ffs_data *ffs_data_new(void) 1630 { 1631 struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL); 1632 if (unlikely(!ffs)) 1633 return NULL; 1634 1635 ENTER(); 1636 1637 atomic_set(&ffs->ref, 1); 1638 atomic_set(&ffs->opened, 0); 1639 ffs->state = FFS_READ_DESCRIPTORS; 1640 mutex_init(&ffs->mutex); 1641 spin_lock_init(&ffs->eps_lock); 1642 init_waitqueue_head(&ffs->ev.waitq); 1643 init_completion(&ffs->ep0req_completion); 1644 1645 /* XXX REVISIT need to update it in some places, or do we? */ 1646 ffs->ev.can_stall = 1; 1647 1648 return ffs; 1649 } 1650 1651 static void ffs_data_clear(struct ffs_data *ffs) 1652 { 1653 ENTER(); 1654 1655 ffs_closed(ffs); 1656 1657 BUG_ON(ffs->gadget); 1658 1659 if (ffs->epfiles) 1660 ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count); 1661 1662 if (ffs->ffs_eventfd) 1663 eventfd_ctx_put(ffs->ffs_eventfd); 1664 1665 kfree(ffs->raw_descs_data); 1666 kfree(ffs->raw_strings); 1667 kfree(ffs->stringtabs); 1668 } 1669 1670 static void ffs_data_reset(struct ffs_data *ffs) 1671 { 1672 ENTER(); 1673 1674 ffs_data_clear(ffs); 1675 1676 ffs->epfiles = NULL; 1677 ffs->raw_descs_data = NULL; 1678 ffs->raw_descs = NULL; 1679 ffs->raw_strings = NULL; 1680 ffs->stringtabs = NULL; 1681 1682 ffs->raw_descs_length = 0; 1683 ffs->fs_descs_count = 0; 1684 ffs->hs_descs_count = 0; 1685 ffs->ss_descs_count = 0; 1686 1687 ffs->strings_count = 0; 1688 ffs->interfaces_count = 0; 1689 ffs->eps_count = 0; 1690 1691 ffs->ev.count = 0; 1692 1693 ffs->state = FFS_READ_DESCRIPTORS; 1694 ffs->setup_state = FFS_NO_SETUP; 1695 ffs->flags = 0; 1696 } 1697 1698 1699 static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev) 1700 { 1701 struct usb_gadget_strings **lang; 1702 int first_id; 1703 1704 ENTER(); 1705 1706 if (WARN_ON(ffs->state != FFS_ACTIVE 1707 || test_and_set_bit(FFS_FL_BOUND, &ffs->flags))) 1708 return -EBADFD; 1709 1710 first_id = usb_string_ids_n(cdev, ffs->strings_count); 1711 if (unlikely(first_id < 0)) 1712 return first_id; 1713 1714 ffs->ep0req = usb_ep_alloc_request(cdev->gadget->ep0, GFP_KERNEL); 1715 if (unlikely(!ffs->ep0req)) 1716 return -ENOMEM; 1717 ffs->ep0req->complete = ffs_ep0_complete; 1718 ffs->ep0req->context = ffs; 1719 1720 lang = ffs->stringtabs; 1721 if (lang) { 1722 for (; *lang; ++lang) { 1723 struct usb_string *str = (*lang)->strings; 1724 int id = first_id; 1725 for (; str->s; ++id, ++str) 1726 str->id = id; 1727 } 1728 } 1729 1730 ffs->gadget = cdev->gadget; 1731 ffs_data_get(ffs); 1732 return 0; 1733 } 1734 1735 static void functionfs_unbind(struct ffs_data *ffs) 1736 { 1737 ENTER(); 1738 1739 if (!WARN_ON(!ffs->gadget)) { 1740 usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req); 1741 ffs->ep0req = NULL; 1742 ffs->gadget = NULL; 1743 clear_bit(FFS_FL_BOUND, &ffs->flags); 1744 ffs_data_put(ffs); 1745 } 1746 } 1747 1748 static int ffs_epfiles_create(struct ffs_data *ffs) 1749 { 1750 struct ffs_epfile *epfile, *epfiles; 1751 unsigned i, count; 1752 1753 ENTER(); 1754 1755 count = ffs->eps_count; 1756 epfiles = kcalloc(count, sizeof(*epfiles), GFP_KERNEL); 1757 if (!epfiles) 1758 return -ENOMEM; 1759 1760 epfile = epfiles; 1761 for (i = 1; i <= count; ++i, ++epfile) { 1762 epfile->ffs = ffs; 1763 mutex_init(&epfile->mutex); 1764 init_waitqueue_head(&epfile->wait); 1765 if (ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR) 1766 sprintf(epfile->name, "ep%02x", ffs->eps_addrmap[i]); 1767 else 1768 sprintf(epfile->name, "ep%u", i); 1769 epfile->dentry = ffs_sb_create_file(ffs->sb, epfile->name, 1770 epfile, 1771 &ffs_epfile_operations); 1772 if (unlikely(!epfile->dentry)) { 1773 ffs_epfiles_destroy(epfiles, i - 1); 1774 return -ENOMEM; 1775 } 1776 } 1777 1778 ffs->epfiles = epfiles; 1779 return 0; 1780 } 1781 1782 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count) 1783 { 1784 struct ffs_epfile *epfile = epfiles; 1785 1786 ENTER(); 1787 1788 for (; count; --count, ++epfile) { 1789 BUG_ON(mutex_is_locked(&epfile->mutex) || 1790 waitqueue_active(&epfile->wait)); 1791 if (epfile->dentry) { 1792 d_delete(epfile->dentry); 1793 dput(epfile->dentry); 1794 epfile->dentry = NULL; 1795 } 1796 } 1797 1798 kfree(epfiles); 1799 } 1800 1801 static void ffs_func_eps_disable(struct ffs_function *func) 1802 { 1803 struct ffs_ep *ep = func->eps; 1804 struct ffs_epfile *epfile = func->ffs->epfiles; 1805 unsigned count = func->ffs->eps_count; 1806 unsigned long flags; 1807 1808 spin_lock_irqsave(&func->ffs->eps_lock, flags); 1809 while (count--) { 1810 /* pending requests get nuked */ 1811 if (likely(ep->ep)) 1812 usb_ep_disable(ep->ep); 1813 ++ep; 1814 1815 if (epfile) { 1816 epfile->ep = NULL; 1817 __ffs_epfile_read_buffer_free(epfile); 1818 ++epfile; 1819 } 1820 } 1821 spin_unlock_irqrestore(&func->ffs->eps_lock, flags); 1822 } 1823 1824 static int ffs_func_eps_enable(struct ffs_function *func) 1825 { 1826 struct ffs_data *ffs = func->ffs; 1827 struct ffs_ep *ep = func->eps; 1828 struct ffs_epfile *epfile = ffs->epfiles; 1829 unsigned count = ffs->eps_count; 1830 unsigned long flags; 1831 int ret = 0; 1832 1833 spin_lock_irqsave(&func->ffs->eps_lock, flags); 1834 while(count--) { 1835 struct usb_endpoint_descriptor *ds; 1836 int desc_idx; 1837 1838 if (ffs->gadget->speed == USB_SPEED_SUPER) 1839 desc_idx = 2; 1840 else if (ffs->gadget->speed == USB_SPEED_HIGH) 1841 desc_idx = 1; 1842 else 1843 desc_idx = 0; 1844 1845 /* fall-back to lower speed if desc missing for current speed */ 1846 do { 1847 ds = ep->descs[desc_idx]; 1848 } while (!ds && --desc_idx >= 0); 1849 1850 if (!ds) { 1851 ret = -EINVAL; 1852 break; 1853 } 1854 1855 ep->ep->driver_data = ep; 1856 ep->ep->desc = ds; 1857 ret = usb_ep_enable(ep->ep); 1858 if (likely(!ret)) { 1859 epfile->ep = ep; 1860 epfile->in = usb_endpoint_dir_in(ds); 1861 epfile->isoc = usb_endpoint_xfer_isoc(ds); 1862 } else { 1863 break; 1864 } 1865 1866 wake_up(&epfile->wait); 1867 1868 ++ep; 1869 ++epfile; 1870 } 1871 spin_unlock_irqrestore(&func->ffs->eps_lock, flags); 1872 1873 return ret; 1874 } 1875 1876 1877 /* Parsing and building descriptors and strings *****************************/ 1878 1879 /* 1880 * This validates if data pointed by data is a valid USB descriptor as 1881 * well as record how many interfaces, endpoints and strings are 1882 * required by given configuration. Returns address after the 1883 * descriptor or NULL if data is invalid. 1884 */ 1885 1886 enum ffs_entity_type { 1887 FFS_DESCRIPTOR, FFS_INTERFACE, FFS_STRING, FFS_ENDPOINT 1888 }; 1889 1890 enum ffs_os_desc_type { 1891 FFS_OS_DESC, FFS_OS_DESC_EXT_COMPAT, FFS_OS_DESC_EXT_PROP 1892 }; 1893 1894 typedef int (*ffs_entity_callback)(enum ffs_entity_type entity, 1895 u8 *valuep, 1896 struct usb_descriptor_header *desc, 1897 void *priv); 1898 1899 typedef int (*ffs_os_desc_callback)(enum ffs_os_desc_type entity, 1900 struct usb_os_desc_header *h, void *data, 1901 unsigned len, void *priv); 1902 1903 static int __must_check ffs_do_single_desc(char *data, unsigned len, 1904 ffs_entity_callback entity, 1905 void *priv) 1906 { 1907 struct usb_descriptor_header *_ds = (void *)data; 1908 u8 length; 1909 int ret; 1910 1911 ENTER(); 1912 1913 /* At least two bytes are required: length and type */ 1914 if (len < 2) { 1915 pr_vdebug("descriptor too short\n"); 1916 return -EINVAL; 1917 } 1918 1919 /* If we have at least as many bytes as the descriptor takes? */ 1920 length = _ds->bLength; 1921 if (len < length) { 1922 pr_vdebug("descriptor longer then available data\n"); 1923 return -EINVAL; 1924 } 1925 1926 #define __entity_check_INTERFACE(val) 1 1927 #define __entity_check_STRING(val) (val) 1928 #define __entity_check_ENDPOINT(val) ((val) & USB_ENDPOINT_NUMBER_MASK) 1929 #define __entity(type, val) do { \ 1930 pr_vdebug("entity " #type "(%02x)\n", (val)); \ 1931 if (unlikely(!__entity_check_ ##type(val))) { \ 1932 pr_vdebug("invalid entity's value\n"); \ 1933 return -EINVAL; \ 1934 } \ 1935 ret = entity(FFS_ ##type, &val, _ds, priv); \ 1936 if (unlikely(ret < 0)) { \ 1937 pr_debug("entity " #type "(%02x); ret = %d\n", \ 1938 (val), ret); \ 1939 return ret; \ 1940 } \ 1941 } while (0) 1942 1943 /* Parse descriptor depending on type. */ 1944 switch (_ds->bDescriptorType) { 1945 case USB_DT_DEVICE: 1946 case USB_DT_CONFIG: 1947 case USB_DT_STRING: 1948 case USB_DT_DEVICE_QUALIFIER: 1949 /* function can't have any of those */ 1950 pr_vdebug("descriptor reserved for gadget: %d\n", 1951 _ds->bDescriptorType); 1952 return -EINVAL; 1953 1954 case USB_DT_INTERFACE: { 1955 struct usb_interface_descriptor *ds = (void *)_ds; 1956 pr_vdebug("interface descriptor\n"); 1957 if (length != sizeof *ds) 1958 goto inv_length; 1959 1960 __entity(INTERFACE, ds->bInterfaceNumber); 1961 if (ds->iInterface) 1962 __entity(STRING, ds->iInterface); 1963 } 1964 break; 1965 1966 case USB_DT_ENDPOINT: { 1967 struct usb_endpoint_descriptor *ds = (void *)_ds; 1968 pr_vdebug("endpoint descriptor\n"); 1969 if (length != USB_DT_ENDPOINT_SIZE && 1970 length != USB_DT_ENDPOINT_AUDIO_SIZE) 1971 goto inv_length; 1972 __entity(ENDPOINT, ds->bEndpointAddress); 1973 } 1974 break; 1975 1976 case HID_DT_HID: 1977 pr_vdebug("hid descriptor\n"); 1978 if (length != sizeof(struct hid_descriptor)) 1979 goto inv_length; 1980 break; 1981 1982 case USB_DT_OTG: 1983 if (length != sizeof(struct usb_otg_descriptor)) 1984 goto inv_length; 1985 break; 1986 1987 case USB_DT_INTERFACE_ASSOCIATION: { 1988 struct usb_interface_assoc_descriptor *ds = (void *)_ds; 1989 pr_vdebug("interface association descriptor\n"); 1990 if (length != sizeof *ds) 1991 goto inv_length; 1992 if (ds->iFunction) 1993 __entity(STRING, ds->iFunction); 1994 } 1995 break; 1996 1997 case USB_DT_SS_ENDPOINT_COMP: 1998 pr_vdebug("EP SS companion descriptor\n"); 1999 if (length != sizeof(struct usb_ss_ep_comp_descriptor)) 2000 goto inv_length; 2001 break; 2002 2003 case USB_DT_OTHER_SPEED_CONFIG: 2004 case USB_DT_INTERFACE_POWER: 2005 case USB_DT_DEBUG: 2006 case USB_DT_SECURITY: 2007 case USB_DT_CS_RADIO_CONTROL: 2008 /* TODO */ 2009 pr_vdebug("unimplemented descriptor: %d\n", _ds->bDescriptorType); 2010 return -EINVAL; 2011 2012 default: 2013 /* We should never be here */ 2014 pr_vdebug("unknown descriptor: %d\n", _ds->bDescriptorType); 2015 return -EINVAL; 2016 2017 inv_length: 2018 pr_vdebug("invalid length: %d (descriptor %d)\n", 2019 _ds->bLength, _ds->bDescriptorType); 2020 return -EINVAL; 2021 } 2022 2023 #undef __entity 2024 #undef __entity_check_DESCRIPTOR 2025 #undef __entity_check_INTERFACE 2026 #undef __entity_check_STRING 2027 #undef __entity_check_ENDPOINT 2028 2029 return length; 2030 } 2031 2032 static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len, 2033 ffs_entity_callback entity, void *priv) 2034 { 2035 const unsigned _len = len; 2036 unsigned long num = 0; 2037 2038 ENTER(); 2039 2040 for (;;) { 2041 int ret; 2042 2043 if (num == count) 2044 data = NULL; 2045 2046 /* Record "descriptor" entity */ 2047 ret = entity(FFS_DESCRIPTOR, (u8 *)num, (void *)data, priv); 2048 if (unlikely(ret < 0)) { 2049 pr_debug("entity DESCRIPTOR(%02lx); ret = %d\n", 2050 num, ret); 2051 return ret; 2052 } 2053 2054 if (!data) 2055 return _len - len; 2056 2057 ret = ffs_do_single_desc(data, len, entity, priv); 2058 if (unlikely(ret < 0)) { 2059 pr_debug("%s returns %d\n", __func__, ret); 2060 return ret; 2061 } 2062 2063 len -= ret; 2064 data += ret; 2065 ++num; 2066 } 2067 } 2068 2069 static int __ffs_data_do_entity(enum ffs_entity_type type, 2070 u8 *valuep, struct usb_descriptor_header *desc, 2071 void *priv) 2072 { 2073 struct ffs_desc_helper *helper = priv; 2074 struct usb_endpoint_descriptor *d; 2075 2076 ENTER(); 2077 2078 switch (type) { 2079 case FFS_DESCRIPTOR: 2080 break; 2081 2082 case FFS_INTERFACE: 2083 /* 2084 * Interfaces are indexed from zero so if we 2085 * encountered interface "n" then there are at least 2086 * "n+1" interfaces. 2087 */ 2088 if (*valuep >= helper->interfaces_count) 2089 helper->interfaces_count = *valuep + 1; 2090 break; 2091 2092 case FFS_STRING: 2093 /* 2094 * Strings are indexed from 1 (0 is reserved 2095 * for languages list) 2096 */ 2097 if (*valuep > helper->ffs->strings_count) 2098 helper->ffs->strings_count = *valuep; 2099 break; 2100 2101 case FFS_ENDPOINT: 2102 d = (void *)desc; 2103 helper->eps_count++; 2104 if (helper->eps_count >= 15) 2105 return -EINVAL; 2106 /* Check if descriptors for any speed were already parsed */ 2107 if (!helper->ffs->eps_count && !helper->ffs->interfaces_count) 2108 helper->ffs->eps_addrmap[helper->eps_count] = 2109 d->bEndpointAddress; 2110 else if (helper->ffs->eps_addrmap[helper->eps_count] != 2111 d->bEndpointAddress) 2112 return -EINVAL; 2113 break; 2114 } 2115 2116 return 0; 2117 } 2118 2119 static int __ffs_do_os_desc_header(enum ffs_os_desc_type *next_type, 2120 struct usb_os_desc_header *desc) 2121 { 2122 u16 bcd_version = le16_to_cpu(desc->bcdVersion); 2123 u16 w_index = le16_to_cpu(desc->wIndex); 2124 2125 if (bcd_version != 1) { 2126 pr_vdebug("unsupported os descriptors version: %d", 2127 bcd_version); 2128 return -EINVAL; 2129 } 2130 switch (w_index) { 2131 case 0x4: 2132 *next_type = FFS_OS_DESC_EXT_COMPAT; 2133 break; 2134 case 0x5: 2135 *next_type = FFS_OS_DESC_EXT_PROP; 2136 break; 2137 default: 2138 pr_vdebug("unsupported os descriptor type: %d", w_index); 2139 return -EINVAL; 2140 } 2141 2142 return sizeof(*desc); 2143 } 2144 2145 /* 2146 * Process all extended compatibility/extended property descriptors 2147 * of a feature descriptor 2148 */ 2149 static int __must_check ffs_do_single_os_desc(char *data, unsigned len, 2150 enum ffs_os_desc_type type, 2151 u16 feature_count, 2152 ffs_os_desc_callback entity, 2153 void *priv, 2154 struct usb_os_desc_header *h) 2155 { 2156 int ret; 2157 const unsigned _len = len; 2158 2159 ENTER(); 2160 2161 /* loop over all ext compat/ext prop descriptors */ 2162 while (feature_count--) { 2163 ret = entity(type, h, data, len, priv); 2164 if (unlikely(ret < 0)) { 2165 pr_debug("bad OS descriptor, type: %d\n", type); 2166 return ret; 2167 } 2168 data += ret; 2169 len -= ret; 2170 } 2171 return _len - len; 2172 } 2173 2174 /* Process a number of complete Feature Descriptors (Ext Compat or Ext Prop) */ 2175 static int __must_check ffs_do_os_descs(unsigned count, 2176 char *data, unsigned len, 2177 ffs_os_desc_callback entity, void *priv) 2178 { 2179 const unsigned _len = len; 2180 unsigned long num = 0; 2181 2182 ENTER(); 2183 2184 for (num = 0; num < count; ++num) { 2185 int ret; 2186 enum ffs_os_desc_type type; 2187 u16 feature_count; 2188 struct usb_os_desc_header *desc = (void *)data; 2189 2190 if (len < sizeof(*desc)) 2191 return -EINVAL; 2192 2193 /* 2194 * Record "descriptor" entity. 2195 * Process dwLength, bcdVersion, wIndex, get b/wCount. 2196 * Move the data pointer to the beginning of extended 2197 * compatibilities proper or extended properties proper 2198 * portions of the data 2199 */ 2200 if (le32_to_cpu(desc->dwLength) > len) 2201 return -EINVAL; 2202 2203 ret = __ffs_do_os_desc_header(&type, desc); 2204 if (unlikely(ret < 0)) { 2205 pr_debug("entity OS_DESCRIPTOR(%02lx); ret = %d\n", 2206 num, ret); 2207 return ret; 2208 } 2209 /* 2210 * 16-bit hex "?? 00" Little Endian looks like 8-bit hex "??" 2211 */ 2212 feature_count = le16_to_cpu(desc->wCount); 2213 if (type == FFS_OS_DESC_EXT_COMPAT && 2214 (feature_count > 255 || desc->Reserved)) 2215 return -EINVAL; 2216 len -= ret; 2217 data += ret; 2218 2219 /* 2220 * Process all function/property descriptors 2221 * of this Feature Descriptor 2222 */ 2223 ret = ffs_do_single_os_desc(data, len, type, 2224 feature_count, entity, priv, desc); 2225 if (unlikely(ret < 0)) { 2226 pr_debug("%s returns %d\n", __func__, ret); 2227 return ret; 2228 } 2229 2230 len -= ret; 2231 data += ret; 2232 } 2233 return _len - len; 2234 } 2235 2236 /** 2237 * Validate contents of the buffer from userspace related to OS descriptors. 2238 */ 2239 static int __ffs_data_do_os_desc(enum ffs_os_desc_type type, 2240 struct usb_os_desc_header *h, void *data, 2241 unsigned len, void *priv) 2242 { 2243 struct ffs_data *ffs = priv; 2244 u8 length; 2245 2246 ENTER(); 2247 2248 switch (type) { 2249 case FFS_OS_DESC_EXT_COMPAT: { 2250 struct usb_ext_compat_desc *d = data; 2251 int i; 2252 2253 if (len < sizeof(*d) || 2254 d->bFirstInterfaceNumber >= ffs->interfaces_count || 2255 d->Reserved1) 2256 return -EINVAL; 2257 for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i) 2258 if (d->Reserved2[i]) 2259 return -EINVAL; 2260 2261 length = sizeof(struct usb_ext_compat_desc); 2262 } 2263 break; 2264 case FFS_OS_DESC_EXT_PROP: { 2265 struct usb_ext_prop_desc *d = data; 2266 u32 type, pdl; 2267 u16 pnl; 2268 2269 if (len < sizeof(*d) || h->interface >= ffs->interfaces_count) 2270 return -EINVAL; 2271 length = le32_to_cpu(d->dwSize); 2272 if (len < length) 2273 return -EINVAL; 2274 type = le32_to_cpu(d->dwPropertyDataType); 2275 if (type < USB_EXT_PROP_UNICODE || 2276 type > USB_EXT_PROP_UNICODE_MULTI) { 2277 pr_vdebug("unsupported os descriptor property type: %d", 2278 type); 2279 return -EINVAL; 2280 } 2281 pnl = le16_to_cpu(d->wPropertyNameLength); 2282 if (length < 14 + pnl) { 2283 pr_vdebug("invalid os descriptor length: %d pnl:%d (descriptor %d)\n", 2284 length, pnl, type); 2285 return -EINVAL; 2286 } 2287 pdl = le32_to_cpu(*(u32 *)((u8 *)data + 10 + pnl)); 2288 if (length != 14 + pnl + pdl) { 2289 pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n", 2290 length, pnl, pdl, type); 2291 return -EINVAL; 2292 } 2293 ++ffs->ms_os_descs_ext_prop_count; 2294 /* property name reported to the host as "WCHAR"s */ 2295 ffs->ms_os_descs_ext_prop_name_len += pnl * 2; 2296 ffs->ms_os_descs_ext_prop_data_len += pdl; 2297 } 2298 break; 2299 default: 2300 pr_vdebug("unknown descriptor: %d\n", type); 2301 return -EINVAL; 2302 } 2303 return length; 2304 } 2305 2306 static int __ffs_data_got_descs(struct ffs_data *ffs, 2307 char *const _data, size_t len) 2308 { 2309 char *data = _data, *raw_descs; 2310 unsigned os_descs_count = 0, counts[3], flags; 2311 int ret = -EINVAL, i; 2312 struct ffs_desc_helper helper; 2313 2314 ENTER(); 2315 2316 if (get_unaligned_le32(data + 4) != len) 2317 goto error; 2318 2319 switch (get_unaligned_le32(data)) { 2320 case FUNCTIONFS_DESCRIPTORS_MAGIC: 2321 flags = FUNCTIONFS_HAS_FS_DESC | FUNCTIONFS_HAS_HS_DESC; 2322 data += 8; 2323 len -= 8; 2324 break; 2325 case FUNCTIONFS_DESCRIPTORS_MAGIC_V2: 2326 flags = get_unaligned_le32(data + 8); 2327 ffs->user_flags = flags; 2328 if (flags & ~(FUNCTIONFS_HAS_FS_DESC | 2329 FUNCTIONFS_HAS_HS_DESC | 2330 FUNCTIONFS_HAS_SS_DESC | 2331 FUNCTIONFS_HAS_MS_OS_DESC | 2332 FUNCTIONFS_VIRTUAL_ADDR | 2333 FUNCTIONFS_EVENTFD | 2334 FUNCTIONFS_ALL_CTRL_RECIP | 2335 FUNCTIONFS_CONFIG0_SETUP)) { 2336 ret = -ENOSYS; 2337 goto error; 2338 } 2339 data += 12; 2340 len -= 12; 2341 break; 2342 default: 2343 goto error; 2344 } 2345 2346 if (flags & FUNCTIONFS_EVENTFD) { 2347 if (len < 4) 2348 goto error; 2349 ffs->ffs_eventfd = 2350 eventfd_ctx_fdget((int)get_unaligned_le32(data)); 2351 if (IS_ERR(ffs->ffs_eventfd)) { 2352 ret = PTR_ERR(ffs->ffs_eventfd); 2353 ffs->ffs_eventfd = NULL; 2354 goto error; 2355 } 2356 data += 4; 2357 len -= 4; 2358 } 2359 2360 /* Read fs_count, hs_count and ss_count (if present) */ 2361 for (i = 0; i < 3; ++i) { 2362 if (!(flags & (1 << i))) { 2363 counts[i] = 0; 2364 } else if (len < 4) { 2365 goto error; 2366 } else { 2367 counts[i] = get_unaligned_le32(data); 2368 data += 4; 2369 len -= 4; 2370 } 2371 } 2372 if (flags & (1 << i)) { 2373 if (len < 4) { 2374 goto error; 2375 } 2376 os_descs_count = get_unaligned_le32(data); 2377 data += 4; 2378 len -= 4; 2379 }; 2380 2381 /* Read descriptors */ 2382 raw_descs = data; 2383 helper.ffs = ffs; 2384 for (i = 0; i < 3; ++i) { 2385 if (!counts[i]) 2386 continue; 2387 helper.interfaces_count = 0; 2388 helper.eps_count = 0; 2389 ret = ffs_do_descs(counts[i], data, len, 2390 __ffs_data_do_entity, &helper); 2391 if (ret < 0) 2392 goto error; 2393 if (!ffs->eps_count && !ffs->interfaces_count) { 2394 ffs->eps_count = helper.eps_count; 2395 ffs->interfaces_count = helper.interfaces_count; 2396 } else { 2397 if (ffs->eps_count != helper.eps_count) { 2398 ret = -EINVAL; 2399 goto error; 2400 } 2401 if (ffs->interfaces_count != helper.interfaces_count) { 2402 ret = -EINVAL; 2403 goto error; 2404 } 2405 } 2406 data += ret; 2407 len -= ret; 2408 } 2409 if (os_descs_count) { 2410 ret = ffs_do_os_descs(os_descs_count, data, len, 2411 __ffs_data_do_os_desc, ffs); 2412 if (ret < 0) 2413 goto error; 2414 data += ret; 2415 len -= ret; 2416 } 2417 2418 if (raw_descs == data || len) { 2419 ret = -EINVAL; 2420 goto error; 2421 } 2422 2423 ffs->raw_descs_data = _data; 2424 ffs->raw_descs = raw_descs; 2425 ffs->raw_descs_length = data - raw_descs; 2426 ffs->fs_descs_count = counts[0]; 2427 ffs->hs_descs_count = counts[1]; 2428 ffs->ss_descs_count = counts[2]; 2429 ffs->ms_os_descs_count = os_descs_count; 2430 2431 return 0; 2432 2433 error: 2434 kfree(_data); 2435 return ret; 2436 } 2437 2438 static int __ffs_data_got_strings(struct ffs_data *ffs, 2439 char *const _data, size_t len) 2440 { 2441 u32 str_count, needed_count, lang_count; 2442 struct usb_gadget_strings **stringtabs, *t; 2443 const char *data = _data; 2444 struct usb_string *s; 2445 2446 ENTER(); 2447 2448 if (unlikely(len < 16 || 2449 get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC || 2450 get_unaligned_le32(data + 4) != len)) 2451 goto error; 2452 str_count = get_unaligned_le32(data + 8); 2453 lang_count = get_unaligned_le32(data + 12); 2454 2455 /* if one is zero the other must be zero */ 2456 if (unlikely(!str_count != !lang_count)) 2457 goto error; 2458 2459 /* Do we have at least as many strings as descriptors need? */ 2460 needed_count = ffs->strings_count; 2461 if (unlikely(str_count < needed_count)) 2462 goto error; 2463 2464 /* 2465 * If we don't need any strings just return and free all 2466 * memory. 2467 */ 2468 if (!needed_count) { 2469 kfree(_data); 2470 return 0; 2471 } 2472 2473 /* Allocate everything in one chunk so there's less maintenance. */ 2474 { 2475 unsigned i = 0; 2476 vla_group(d); 2477 vla_item(d, struct usb_gadget_strings *, stringtabs, 2478 lang_count + 1); 2479 vla_item(d, struct usb_gadget_strings, stringtab, lang_count); 2480 vla_item(d, struct usb_string, strings, 2481 lang_count*(needed_count+1)); 2482 2483 char *vlabuf = kmalloc(vla_group_size(d), GFP_KERNEL); 2484 2485 if (unlikely(!vlabuf)) { 2486 kfree(_data); 2487 return -ENOMEM; 2488 } 2489 2490 /* Initialize the VLA pointers */ 2491 stringtabs = vla_ptr(vlabuf, d, stringtabs); 2492 t = vla_ptr(vlabuf, d, stringtab); 2493 i = lang_count; 2494 do { 2495 *stringtabs++ = t++; 2496 } while (--i); 2497 *stringtabs = NULL; 2498 2499 /* stringtabs = vlabuf = d_stringtabs for later kfree */ 2500 stringtabs = vla_ptr(vlabuf, d, stringtabs); 2501 t = vla_ptr(vlabuf, d, stringtab); 2502 s = vla_ptr(vlabuf, d, strings); 2503 } 2504 2505 /* For each language */ 2506 data += 16; 2507 len -= 16; 2508 2509 do { /* lang_count > 0 so we can use do-while */ 2510 unsigned needed = needed_count; 2511 2512 if (unlikely(len < 3)) 2513 goto error_free; 2514 t->language = get_unaligned_le16(data); 2515 t->strings = s; 2516 ++t; 2517 2518 data += 2; 2519 len -= 2; 2520 2521 /* For each string */ 2522 do { /* str_count > 0 so we can use do-while */ 2523 size_t length = strnlen(data, len); 2524 2525 if (unlikely(length == len)) 2526 goto error_free; 2527 2528 /* 2529 * User may provide more strings then we need, 2530 * if that's the case we simply ignore the 2531 * rest 2532 */ 2533 if (likely(needed)) { 2534 /* 2535 * s->id will be set while adding 2536 * function to configuration so for 2537 * now just leave garbage here. 2538 */ 2539 s->s = data; 2540 --needed; 2541 ++s; 2542 } 2543 2544 data += length + 1; 2545 len -= length + 1; 2546 } while (--str_count); 2547 2548 s->id = 0; /* terminator */ 2549 s->s = NULL; 2550 ++s; 2551 2552 } while (--lang_count); 2553 2554 /* Some garbage left? */ 2555 if (unlikely(len)) 2556 goto error_free; 2557 2558 /* Done! */ 2559 ffs->stringtabs = stringtabs; 2560 ffs->raw_strings = _data; 2561 2562 return 0; 2563 2564 error_free: 2565 kfree(stringtabs); 2566 error: 2567 kfree(_data); 2568 return -EINVAL; 2569 } 2570 2571 2572 /* Events handling and management *******************************************/ 2573 2574 static void __ffs_event_add(struct ffs_data *ffs, 2575 enum usb_functionfs_event_type type) 2576 { 2577 enum usb_functionfs_event_type rem_type1, rem_type2 = type; 2578 int neg = 0; 2579 2580 /* 2581 * Abort any unhandled setup 2582 * 2583 * We do not need to worry about some cmpxchg() changing value 2584 * of ffs->setup_state without holding the lock because when 2585 * state is FFS_SETUP_PENDING cmpxchg() in several places in 2586 * the source does nothing. 2587 */ 2588 if (ffs->setup_state == FFS_SETUP_PENDING) 2589 ffs->setup_state = FFS_SETUP_CANCELLED; 2590 2591 /* 2592 * Logic of this function guarantees that there are at most four pending 2593 * evens on ffs->ev.types queue. This is important because the queue 2594 * has space for four elements only and __ffs_ep0_read_events function 2595 * depends on that limit as well. If more event types are added, those 2596 * limits have to be revisited or guaranteed to still hold. 2597 */ 2598 switch (type) { 2599 case FUNCTIONFS_RESUME: 2600 rem_type2 = FUNCTIONFS_SUSPEND; 2601 /* FALL THROUGH */ 2602 case FUNCTIONFS_SUSPEND: 2603 case FUNCTIONFS_SETUP: 2604 rem_type1 = type; 2605 /* Discard all similar events */ 2606 break; 2607 2608 case FUNCTIONFS_BIND: 2609 case FUNCTIONFS_UNBIND: 2610 case FUNCTIONFS_DISABLE: 2611 case FUNCTIONFS_ENABLE: 2612 /* Discard everything other then power management. */ 2613 rem_type1 = FUNCTIONFS_SUSPEND; 2614 rem_type2 = FUNCTIONFS_RESUME; 2615 neg = 1; 2616 break; 2617 2618 default: 2619 WARN(1, "%d: unknown event, this should not happen\n", type); 2620 return; 2621 } 2622 2623 { 2624 u8 *ev = ffs->ev.types, *out = ev; 2625 unsigned n = ffs->ev.count; 2626 for (; n; --n, ++ev) 2627 if ((*ev == rem_type1 || *ev == rem_type2) == neg) 2628 *out++ = *ev; 2629 else 2630 pr_vdebug("purging event %d\n", *ev); 2631 ffs->ev.count = out - ffs->ev.types; 2632 } 2633 2634 pr_vdebug("adding event %d\n", type); 2635 ffs->ev.types[ffs->ev.count++] = type; 2636 wake_up_locked(&ffs->ev.waitq); 2637 if (ffs->ffs_eventfd) 2638 eventfd_signal(ffs->ffs_eventfd, 1); 2639 } 2640 2641 static void ffs_event_add(struct ffs_data *ffs, 2642 enum usb_functionfs_event_type type) 2643 { 2644 unsigned long flags; 2645 spin_lock_irqsave(&ffs->ev.waitq.lock, flags); 2646 __ffs_event_add(ffs, type); 2647 spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags); 2648 } 2649 2650 /* Bind/unbind USB function hooks *******************************************/ 2651 2652 static int ffs_ep_addr2idx(struct ffs_data *ffs, u8 endpoint_address) 2653 { 2654 int i; 2655 2656 for (i = 1; i < ARRAY_SIZE(ffs->eps_addrmap); ++i) 2657 if (ffs->eps_addrmap[i] == endpoint_address) 2658 return i; 2659 return -ENOENT; 2660 } 2661 2662 static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep, 2663 struct usb_descriptor_header *desc, 2664 void *priv) 2665 { 2666 struct usb_endpoint_descriptor *ds = (void *)desc; 2667 struct ffs_function *func = priv; 2668 struct ffs_ep *ffs_ep; 2669 unsigned ep_desc_id; 2670 int idx; 2671 static const char *speed_names[] = { "full", "high", "super" }; 2672 2673 if (type != FFS_DESCRIPTOR) 2674 return 0; 2675 2676 /* 2677 * If ss_descriptors is not NULL, we are reading super speed 2678 * descriptors; if hs_descriptors is not NULL, we are reading high 2679 * speed descriptors; otherwise, we are reading full speed 2680 * descriptors. 2681 */ 2682 if (func->function.ss_descriptors) { 2683 ep_desc_id = 2; 2684 func->function.ss_descriptors[(long)valuep] = desc; 2685 } else if (func->function.hs_descriptors) { 2686 ep_desc_id = 1; 2687 func->function.hs_descriptors[(long)valuep] = desc; 2688 } else { 2689 ep_desc_id = 0; 2690 func->function.fs_descriptors[(long)valuep] = desc; 2691 } 2692 2693 if (!desc || desc->bDescriptorType != USB_DT_ENDPOINT) 2694 return 0; 2695 2696 idx = ffs_ep_addr2idx(func->ffs, ds->bEndpointAddress) - 1; 2697 if (idx < 0) 2698 return idx; 2699 2700 ffs_ep = func->eps + idx; 2701 2702 if (unlikely(ffs_ep->descs[ep_desc_id])) { 2703 pr_err("two %sspeed descriptors for EP %d\n", 2704 speed_names[ep_desc_id], 2705 ds->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); 2706 return -EINVAL; 2707 } 2708 ffs_ep->descs[ep_desc_id] = ds; 2709 2710 ffs_dump_mem(": Original ep desc", ds, ds->bLength); 2711 if (ffs_ep->ep) { 2712 ds->bEndpointAddress = ffs_ep->descs[0]->bEndpointAddress; 2713 if (!ds->wMaxPacketSize) 2714 ds->wMaxPacketSize = ffs_ep->descs[0]->wMaxPacketSize; 2715 } else { 2716 struct usb_request *req; 2717 struct usb_ep *ep; 2718 u8 bEndpointAddress; 2719 2720 /* 2721 * We back up bEndpointAddress because autoconfig overwrites 2722 * it with physical endpoint address. 2723 */ 2724 bEndpointAddress = ds->bEndpointAddress; 2725 pr_vdebug("autoconfig\n"); 2726 ep = usb_ep_autoconfig(func->gadget, ds); 2727 if (unlikely(!ep)) 2728 return -ENOTSUPP; 2729 ep->driver_data = func->eps + idx; 2730 2731 req = usb_ep_alloc_request(ep, GFP_KERNEL); 2732 if (unlikely(!req)) 2733 return -ENOMEM; 2734 2735 ffs_ep->ep = ep; 2736 ffs_ep->req = req; 2737 func->eps_revmap[ds->bEndpointAddress & 2738 USB_ENDPOINT_NUMBER_MASK] = idx + 1; 2739 /* 2740 * If we use virtual address mapping, we restore 2741 * original bEndpointAddress value. 2742 */ 2743 if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR) 2744 ds->bEndpointAddress = bEndpointAddress; 2745 } 2746 ffs_dump_mem(": Rewritten ep desc", ds, ds->bLength); 2747 2748 return 0; 2749 } 2750 2751 static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep, 2752 struct usb_descriptor_header *desc, 2753 void *priv) 2754 { 2755 struct ffs_function *func = priv; 2756 unsigned idx; 2757 u8 newValue; 2758 2759 switch (type) { 2760 default: 2761 case FFS_DESCRIPTOR: 2762 /* Handled in previous pass by __ffs_func_bind_do_descs() */ 2763 return 0; 2764 2765 case FFS_INTERFACE: 2766 idx = *valuep; 2767 if (func->interfaces_nums[idx] < 0) { 2768 int id = usb_interface_id(func->conf, &func->function); 2769 if (unlikely(id < 0)) 2770 return id; 2771 func->interfaces_nums[idx] = id; 2772 } 2773 newValue = func->interfaces_nums[idx]; 2774 break; 2775 2776 case FFS_STRING: 2777 /* String' IDs are allocated when fsf_data is bound to cdev */ 2778 newValue = func->ffs->stringtabs[0]->strings[*valuep - 1].id; 2779 break; 2780 2781 case FFS_ENDPOINT: 2782 /* 2783 * USB_DT_ENDPOINT are handled in 2784 * __ffs_func_bind_do_descs(). 2785 */ 2786 if (desc->bDescriptorType == USB_DT_ENDPOINT) 2787 return 0; 2788 2789 idx = (*valuep & USB_ENDPOINT_NUMBER_MASK) - 1; 2790 if (unlikely(!func->eps[idx].ep)) 2791 return -EINVAL; 2792 2793 { 2794 struct usb_endpoint_descriptor **descs; 2795 descs = func->eps[idx].descs; 2796 newValue = descs[descs[0] ? 0 : 1]->bEndpointAddress; 2797 } 2798 break; 2799 } 2800 2801 pr_vdebug("%02x -> %02x\n", *valuep, newValue); 2802 *valuep = newValue; 2803 return 0; 2804 } 2805 2806 static int __ffs_func_bind_do_os_desc(enum ffs_os_desc_type type, 2807 struct usb_os_desc_header *h, void *data, 2808 unsigned len, void *priv) 2809 { 2810 struct ffs_function *func = priv; 2811 u8 length = 0; 2812 2813 switch (type) { 2814 case FFS_OS_DESC_EXT_COMPAT: { 2815 struct usb_ext_compat_desc *desc = data; 2816 struct usb_os_desc_table *t; 2817 2818 t = &func->function.os_desc_table[desc->bFirstInterfaceNumber]; 2819 t->if_id = func->interfaces_nums[desc->bFirstInterfaceNumber]; 2820 memcpy(t->os_desc->ext_compat_id, &desc->CompatibleID, 2821 ARRAY_SIZE(desc->CompatibleID) + 2822 ARRAY_SIZE(desc->SubCompatibleID)); 2823 length = sizeof(*desc); 2824 } 2825 break; 2826 case FFS_OS_DESC_EXT_PROP: { 2827 struct usb_ext_prop_desc *desc = data; 2828 struct usb_os_desc_table *t; 2829 struct usb_os_desc_ext_prop *ext_prop; 2830 char *ext_prop_name; 2831 char *ext_prop_data; 2832 2833 t = &func->function.os_desc_table[h->interface]; 2834 t->if_id = func->interfaces_nums[h->interface]; 2835 2836 ext_prop = func->ffs->ms_os_descs_ext_prop_avail; 2837 func->ffs->ms_os_descs_ext_prop_avail += sizeof(*ext_prop); 2838 2839 ext_prop->type = le32_to_cpu(desc->dwPropertyDataType); 2840 ext_prop->name_len = le16_to_cpu(desc->wPropertyNameLength); 2841 ext_prop->data_len = le32_to_cpu(*(u32 *) 2842 usb_ext_prop_data_len_ptr(data, ext_prop->name_len)); 2843 length = ext_prop->name_len + ext_prop->data_len + 14; 2844 2845 ext_prop_name = func->ffs->ms_os_descs_ext_prop_name_avail; 2846 func->ffs->ms_os_descs_ext_prop_name_avail += 2847 ext_prop->name_len; 2848 2849 ext_prop_data = func->ffs->ms_os_descs_ext_prop_data_avail; 2850 func->ffs->ms_os_descs_ext_prop_data_avail += 2851 ext_prop->data_len; 2852 memcpy(ext_prop_data, 2853 usb_ext_prop_data_ptr(data, ext_prop->name_len), 2854 ext_prop->data_len); 2855 /* unicode data reported to the host as "WCHAR"s */ 2856 switch (ext_prop->type) { 2857 case USB_EXT_PROP_UNICODE: 2858 case USB_EXT_PROP_UNICODE_ENV: 2859 case USB_EXT_PROP_UNICODE_LINK: 2860 case USB_EXT_PROP_UNICODE_MULTI: 2861 ext_prop->data_len *= 2; 2862 break; 2863 } 2864 ext_prop->data = ext_prop_data; 2865 2866 memcpy(ext_prop_name, usb_ext_prop_name_ptr(data), 2867 ext_prop->name_len); 2868 /* property name reported to the host as "WCHAR"s */ 2869 ext_prop->name_len *= 2; 2870 ext_prop->name = ext_prop_name; 2871 2872 t->os_desc->ext_prop_len += 2873 ext_prop->name_len + ext_prop->data_len + 14; 2874 ++t->os_desc->ext_prop_count; 2875 list_add_tail(&ext_prop->entry, &t->os_desc->ext_prop); 2876 } 2877 break; 2878 default: 2879 pr_vdebug("unknown descriptor: %d\n", type); 2880 } 2881 2882 return length; 2883 } 2884 2885 static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f, 2886 struct usb_configuration *c) 2887 { 2888 struct ffs_function *func = ffs_func_from_usb(f); 2889 struct f_fs_opts *ffs_opts = 2890 container_of(f->fi, struct f_fs_opts, func_inst); 2891 int ret; 2892 2893 ENTER(); 2894 2895 /* 2896 * Legacy gadget triggers binding in functionfs_ready_callback, 2897 * which already uses locking; taking the same lock here would 2898 * cause a deadlock. 2899 * 2900 * Configfs-enabled gadgets however do need ffs_dev_lock. 2901 */ 2902 if (!ffs_opts->no_configfs) 2903 ffs_dev_lock(); 2904 ret = ffs_opts->dev->desc_ready ? 0 : -ENODEV; 2905 func->ffs = ffs_opts->dev->ffs_data; 2906 if (!ffs_opts->no_configfs) 2907 ffs_dev_unlock(); 2908 if (ret) 2909 return ERR_PTR(ret); 2910 2911 func->conf = c; 2912 func->gadget = c->cdev->gadget; 2913 2914 /* 2915 * in drivers/usb/gadget/configfs.c:configfs_composite_bind() 2916 * configurations are bound in sequence with list_for_each_entry, 2917 * in each configuration its functions are bound in sequence 2918 * with list_for_each_entry, so we assume no race condition 2919 * with regard to ffs_opts->bound access 2920 */ 2921 if (!ffs_opts->refcnt) { 2922 ret = functionfs_bind(func->ffs, c->cdev); 2923 if (ret) 2924 return ERR_PTR(ret); 2925 } 2926 ffs_opts->refcnt++; 2927 func->function.strings = func->ffs->stringtabs; 2928 2929 return ffs_opts; 2930 } 2931 2932 static int _ffs_func_bind(struct usb_configuration *c, 2933 struct usb_function *f) 2934 { 2935 struct ffs_function *func = ffs_func_from_usb(f); 2936 struct ffs_data *ffs = func->ffs; 2937 2938 const int full = !!func->ffs->fs_descs_count; 2939 const int high = gadget_is_dualspeed(func->gadget) && 2940 func->ffs->hs_descs_count; 2941 const int super = gadget_is_superspeed(func->gadget) && 2942 func->ffs->ss_descs_count; 2943 2944 int fs_len, hs_len, ss_len, ret, i; 2945 struct ffs_ep *eps_ptr; 2946 2947 /* Make it a single chunk, less management later on */ 2948 vla_group(d); 2949 vla_item_with_sz(d, struct ffs_ep, eps, ffs->eps_count); 2950 vla_item_with_sz(d, struct usb_descriptor_header *, fs_descs, 2951 full ? ffs->fs_descs_count + 1 : 0); 2952 vla_item_with_sz(d, struct usb_descriptor_header *, hs_descs, 2953 high ? ffs->hs_descs_count + 1 : 0); 2954 vla_item_with_sz(d, struct usb_descriptor_header *, ss_descs, 2955 super ? ffs->ss_descs_count + 1 : 0); 2956 vla_item_with_sz(d, short, inums, ffs->interfaces_count); 2957 vla_item_with_sz(d, struct usb_os_desc_table, os_desc_table, 2958 c->cdev->use_os_string ? ffs->interfaces_count : 0); 2959 vla_item_with_sz(d, char[16], ext_compat, 2960 c->cdev->use_os_string ? ffs->interfaces_count : 0); 2961 vla_item_with_sz(d, struct usb_os_desc, os_desc, 2962 c->cdev->use_os_string ? ffs->interfaces_count : 0); 2963 vla_item_with_sz(d, struct usb_os_desc_ext_prop, ext_prop, 2964 ffs->ms_os_descs_ext_prop_count); 2965 vla_item_with_sz(d, char, ext_prop_name, 2966 ffs->ms_os_descs_ext_prop_name_len); 2967 vla_item_with_sz(d, char, ext_prop_data, 2968 ffs->ms_os_descs_ext_prop_data_len); 2969 vla_item_with_sz(d, char, raw_descs, ffs->raw_descs_length); 2970 char *vlabuf; 2971 2972 ENTER(); 2973 2974 /* Has descriptors only for speeds gadget does not support */ 2975 if (unlikely(!(full | high | super))) 2976 return -ENOTSUPP; 2977 2978 /* Allocate a single chunk, less management later on */ 2979 vlabuf = kzalloc(vla_group_size(d), GFP_KERNEL); 2980 if (unlikely(!vlabuf)) 2981 return -ENOMEM; 2982 2983 ffs->ms_os_descs_ext_prop_avail = vla_ptr(vlabuf, d, ext_prop); 2984 ffs->ms_os_descs_ext_prop_name_avail = 2985 vla_ptr(vlabuf, d, ext_prop_name); 2986 ffs->ms_os_descs_ext_prop_data_avail = 2987 vla_ptr(vlabuf, d, ext_prop_data); 2988 2989 /* Copy descriptors */ 2990 memcpy(vla_ptr(vlabuf, d, raw_descs), ffs->raw_descs, 2991 ffs->raw_descs_length); 2992 2993 memset(vla_ptr(vlabuf, d, inums), 0xff, d_inums__sz); 2994 eps_ptr = vla_ptr(vlabuf, d, eps); 2995 for (i = 0; i < ffs->eps_count; i++) 2996 eps_ptr[i].num = -1; 2997 2998 /* Save pointers 2999 * d_eps == vlabuf, func->eps used to kfree vlabuf later 3000 */ 3001 func->eps = vla_ptr(vlabuf, d, eps); 3002 func->interfaces_nums = vla_ptr(vlabuf, d, inums); 3003 3004 /* 3005 * Go through all the endpoint descriptors and allocate 3006 * endpoints first, so that later we can rewrite the endpoint 3007 * numbers without worrying that it may be described later on. 3008 */ 3009 if (likely(full)) { 3010 func->function.fs_descriptors = vla_ptr(vlabuf, d, fs_descs); 3011 fs_len = ffs_do_descs(ffs->fs_descs_count, 3012 vla_ptr(vlabuf, d, raw_descs), 3013 d_raw_descs__sz, 3014 __ffs_func_bind_do_descs, func); 3015 if (unlikely(fs_len < 0)) { 3016 ret = fs_len; 3017 goto error; 3018 } 3019 } else { 3020 fs_len = 0; 3021 } 3022 3023 if (likely(high)) { 3024 func->function.hs_descriptors = vla_ptr(vlabuf, d, hs_descs); 3025 hs_len = ffs_do_descs(ffs->hs_descs_count, 3026 vla_ptr(vlabuf, d, raw_descs) + fs_len, 3027 d_raw_descs__sz - fs_len, 3028 __ffs_func_bind_do_descs, func); 3029 if (unlikely(hs_len < 0)) { 3030 ret = hs_len; 3031 goto error; 3032 } 3033 } else { 3034 hs_len = 0; 3035 } 3036 3037 if (likely(super)) { 3038 func->function.ss_descriptors = vla_ptr(vlabuf, d, ss_descs); 3039 ss_len = ffs_do_descs(ffs->ss_descs_count, 3040 vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len, 3041 d_raw_descs__sz - fs_len - hs_len, 3042 __ffs_func_bind_do_descs, func); 3043 if (unlikely(ss_len < 0)) { 3044 ret = ss_len; 3045 goto error; 3046 } 3047 } else { 3048 ss_len = 0; 3049 } 3050 3051 /* 3052 * Now handle interface numbers allocation and interface and 3053 * endpoint numbers rewriting. We can do that in one go 3054 * now. 3055 */ 3056 ret = ffs_do_descs(ffs->fs_descs_count + 3057 (high ? ffs->hs_descs_count : 0) + 3058 (super ? ffs->ss_descs_count : 0), 3059 vla_ptr(vlabuf, d, raw_descs), d_raw_descs__sz, 3060 __ffs_func_bind_do_nums, func); 3061 if (unlikely(ret < 0)) 3062 goto error; 3063 3064 func->function.os_desc_table = vla_ptr(vlabuf, d, os_desc_table); 3065 if (c->cdev->use_os_string) { 3066 for (i = 0; i < ffs->interfaces_count; ++i) { 3067 struct usb_os_desc *desc; 3068 3069 desc = func->function.os_desc_table[i].os_desc = 3070 vla_ptr(vlabuf, d, os_desc) + 3071 i * sizeof(struct usb_os_desc); 3072 desc->ext_compat_id = 3073 vla_ptr(vlabuf, d, ext_compat) + i * 16; 3074 INIT_LIST_HEAD(&desc->ext_prop); 3075 } 3076 ret = ffs_do_os_descs(ffs->ms_os_descs_count, 3077 vla_ptr(vlabuf, d, raw_descs) + 3078 fs_len + hs_len + ss_len, 3079 d_raw_descs__sz - fs_len - hs_len - 3080 ss_len, 3081 __ffs_func_bind_do_os_desc, func); 3082 if (unlikely(ret < 0)) 3083 goto error; 3084 } 3085 func->function.os_desc_n = 3086 c->cdev->use_os_string ? ffs->interfaces_count : 0; 3087 3088 /* And we're done */ 3089 ffs_event_add(ffs, FUNCTIONFS_BIND); 3090 return 0; 3091 3092 error: 3093 /* XXX Do we need to release all claimed endpoints here? */ 3094 return ret; 3095 } 3096 3097 static int ffs_func_bind(struct usb_configuration *c, 3098 struct usb_function *f) 3099 { 3100 struct f_fs_opts *ffs_opts = ffs_do_functionfs_bind(f, c); 3101 struct ffs_function *func = ffs_func_from_usb(f); 3102 int ret; 3103 3104 if (IS_ERR(ffs_opts)) 3105 return PTR_ERR(ffs_opts); 3106 3107 ret = _ffs_func_bind(c, f); 3108 if (ret && !--ffs_opts->refcnt) 3109 functionfs_unbind(func->ffs); 3110 3111 return ret; 3112 } 3113 3114 3115 /* Other USB function hooks *************************************************/ 3116 3117 static void ffs_reset_work(struct work_struct *work) 3118 { 3119 struct ffs_data *ffs = container_of(work, 3120 struct ffs_data, reset_work); 3121 ffs_data_reset(ffs); 3122 } 3123 3124 static int ffs_func_set_alt(struct usb_function *f, 3125 unsigned interface, unsigned alt) 3126 { 3127 struct ffs_function *func = ffs_func_from_usb(f); 3128 struct ffs_data *ffs = func->ffs; 3129 int ret = 0, intf; 3130 3131 if (alt != (unsigned)-1) { 3132 intf = ffs_func_revmap_intf(func, interface); 3133 if (unlikely(intf < 0)) 3134 return intf; 3135 } 3136 3137 if (ffs->func) 3138 ffs_func_eps_disable(ffs->func); 3139 3140 if (ffs->state == FFS_DEACTIVATED) { 3141 ffs->state = FFS_CLOSING; 3142 INIT_WORK(&ffs->reset_work, ffs_reset_work); 3143 schedule_work(&ffs->reset_work); 3144 return -ENODEV; 3145 } 3146 3147 if (ffs->state != FFS_ACTIVE) 3148 return -ENODEV; 3149 3150 if (alt == (unsigned)-1) { 3151 ffs->func = NULL; 3152 ffs_event_add(ffs, FUNCTIONFS_DISABLE); 3153 return 0; 3154 } 3155 3156 ffs->func = func; 3157 ret = ffs_func_eps_enable(func); 3158 if (likely(ret >= 0)) 3159 ffs_event_add(ffs, FUNCTIONFS_ENABLE); 3160 return ret; 3161 } 3162 3163 static void ffs_func_disable(struct usb_function *f) 3164 { 3165 ffs_func_set_alt(f, 0, (unsigned)-1); 3166 } 3167 3168 static int ffs_func_setup(struct usb_function *f, 3169 const struct usb_ctrlrequest *creq) 3170 { 3171 struct ffs_function *func = ffs_func_from_usb(f); 3172 struct ffs_data *ffs = func->ffs; 3173 unsigned long flags; 3174 int ret; 3175 3176 ENTER(); 3177 3178 pr_vdebug("creq->bRequestType = %02x\n", creq->bRequestType); 3179 pr_vdebug("creq->bRequest = %02x\n", creq->bRequest); 3180 pr_vdebug("creq->wValue = %04x\n", le16_to_cpu(creq->wValue)); 3181 pr_vdebug("creq->wIndex = %04x\n", le16_to_cpu(creq->wIndex)); 3182 pr_vdebug("creq->wLength = %04x\n", le16_to_cpu(creq->wLength)); 3183 3184 /* 3185 * Most requests directed to interface go through here 3186 * (notable exceptions are set/get interface) so we need to 3187 * handle them. All other either handled by composite or 3188 * passed to usb_configuration->setup() (if one is set). No 3189 * matter, we will handle requests directed to endpoint here 3190 * as well (as it's straightforward). Other request recipient 3191 * types are only handled when the user flag FUNCTIONFS_ALL_CTRL_RECIP 3192 * is being used. 3193 */ 3194 if (ffs->state != FFS_ACTIVE) 3195 return -ENODEV; 3196 3197 switch (creq->bRequestType & USB_RECIP_MASK) { 3198 case USB_RECIP_INTERFACE: 3199 ret = ffs_func_revmap_intf(func, le16_to_cpu(creq->wIndex)); 3200 if (unlikely(ret < 0)) 3201 return ret; 3202 break; 3203 3204 case USB_RECIP_ENDPOINT: 3205 ret = ffs_func_revmap_ep(func, le16_to_cpu(creq->wIndex)); 3206 if (unlikely(ret < 0)) 3207 return ret; 3208 if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR) 3209 ret = func->ffs->eps_addrmap[ret]; 3210 break; 3211 3212 default: 3213 if (func->ffs->user_flags & FUNCTIONFS_ALL_CTRL_RECIP) 3214 ret = le16_to_cpu(creq->wIndex); 3215 else 3216 return -EOPNOTSUPP; 3217 } 3218 3219 spin_lock_irqsave(&ffs->ev.waitq.lock, flags); 3220 ffs->ev.setup = *creq; 3221 ffs->ev.setup.wIndex = cpu_to_le16(ret); 3222 __ffs_event_add(ffs, FUNCTIONFS_SETUP); 3223 spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags); 3224 3225 return 0; 3226 } 3227 3228 static bool ffs_func_req_match(struct usb_function *f, 3229 const struct usb_ctrlrequest *creq, 3230 bool config0) 3231 { 3232 struct ffs_function *func = ffs_func_from_usb(f); 3233 3234 if (config0 && !(func->ffs->user_flags & FUNCTIONFS_CONFIG0_SETUP)) 3235 return false; 3236 3237 switch (creq->bRequestType & USB_RECIP_MASK) { 3238 case USB_RECIP_INTERFACE: 3239 return (ffs_func_revmap_intf(func, 3240 le16_to_cpu(creq->wIndex)) >= 0); 3241 case USB_RECIP_ENDPOINT: 3242 return (ffs_func_revmap_ep(func, 3243 le16_to_cpu(creq->wIndex)) >= 0); 3244 default: 3245 return (bool) (func->ffs->user_flags & 3246 FUNCTIONFS_ALL_CTRL_RECIP); 3247 } 3248 } 3249 3250 static void ffs_func_suspend(struct usb_function *f) 3251 { 3252 ENTER(); 3253 ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_SUSPEND); 3254 } 3255 3256 static void ffs_func_resume(struct usb_function *f) 3257 { 3258 ENTER(); 3259 ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_RESUME); 3260 } 3261 3262 3263 /* Endpoint and interface numbers reverse mapping ***************************/ 3264 3265 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num) 3266 { 3267 num = func->eps_revmap[num & USB_ENDPOINT_NUMBER_MASK]; 3268 return num ? num : -EDOM; 3269 } 3270 3271 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf) 3272 { 3273 short *nums = func->interfaces_nums; 3274 unsigned count = func->ffs->interfaces_count; 3275 3276 for (; count; --count, ++nums) { 3277 if (*nums >= 0 && *nums == intf) 3278 return nums - func->interfaces_nums; 3279 } 3280 3281 return -EDOM; 3282 } 3283 3284 3285 /* Devices management *******************************************************/ 3286 3287 static LIST_HEAD(ffs_devices); 3288 3289 static struct ffs_dev *_ffs_do_find_dev(const char *name) 3290 { 3291 struct ffs_dev *dev; 3292 3293 list_for_each_entry(dev, &ffs_devices, entry) { 3294 if (!dev->name || !name) 3295 continue; 3296 if (strcmp(dev->name, name) == 0) 3297 return dev; 3298 } 3299 3300 return NULL; 3301 } 3302 3303 /* 3304 * ffs_lock must be taken by the caller of this function 3305 */ 3306 static struct ffs_dev *_ffs_get_single_dev(void) 3307 { 3308 struct ffs_dev *dev; 3309 3310 if (list_is_singular(&ffs_devices)) { 3311 dev = list_first_entry(&ffs_devices, struct ffs_dev, entry); 3312 if (dev->single) 3313 return dev; 3314 } 3315 3316 return NULL; 3317 } 3318 3319 /* 3320 * ffs_lock must be taken by the caller of this function 3321 */ 3322 static struct ffs_dev *_ffs_find_dev(const char *name) 3323 { 3324 struct ffs_dev *dev; 3325 3326 dev = _ffs_get_single_dev(); 3327 if (dev) 3328 return dev; 3329 3330 return _ffs_do_find_dev(name); 3331 } 3332 3333 /* Configfs support *********************************************************/ 3334 3335 static inline struct f_fs_opts *to_ffs_opts(struct config_item *item) 3336 { 3337 return container_of(to_config_group(item), struct f_fs_opts, 3338 func_inst.group); 3339 } 3340 3341 static void ffs_attr_release(struct config_item *item) 3342 { 3343 struct f_fs_opts *opts = to_ffs_opts(item); 3344 3345 usb_put_function_instance(&opts->func_inst); 3346 } 3347 3348 static struct configfs_item_operations ffs_item_ops = { 3349 .release = ffs_attr_release, 3350 }; 3351 3352 static struct config_item_type ffs_func_type = { 3353 .ct_item_ops = &ffs_item_ops, 3354 .ct_owner = THIS_MODULE, 3355 }; 3356 3357 3358 /* Function registration interface ******************************************/ 3359 3360 static void ffs_free_inst(struct usb_function_instance *f) 3361 { 3362 struct f_fs_opts *opts; 3363 3364 opts = to_f_fs_opts(f); 3365 ffs_dev_lock(); 3366 _ffs_free_dev(opts->dev); 3367 ffs_dev_unlock(); 3368 kfree(opts); 3369 } 3370 3371 #define MAX_INST_NAME_LEN 40 3372 3373 static int ffs_set_inst_name(struct usb_function_instance *fi, const char *name) 3374 { 3375 struct f_fs_opts *opts; 3376 char *ptr; 3377 const char *tmp; 3378 int name_len, ret; 3379 3380 name_len = strlen(name) + 1; 3381 if (name_len > MAX_INST_NAME_LEN) 3382 return -ENAMETOOLONG; 3383 3384 ptr = kstrndup(name, name_len, GFP_KERNEL); 3385 if (!ptr) 3386 return -ENOMEM; 3387 3388 opts = to_f_fs_opts(fi); 3389 tmp = NULL; 3390 3391 ffs_dev_lock(); 3392 3393 tmp = opts->dev->name_allocated ? opts->dev->name : NULL; 3394 ret = _ffs_name_dev(opts->dev, ptr); 3395 if (ret) { 3396 kfree(ptr); 3397 ffs_dev_unlock(); 3398 return ret; 3399 } 3400 opts->dev->name_allocated = true; 3401 3402 ffs_dev_unlock(); 3403 3404 kfree(tmp); 3405 3406 return 0; 3407 } 3408 3409 static struct usb_function_instance *ffs_alloc_inst(void) 3410 { 3411 struct f_fs_opts *opts; 3412 struct ffs_dev *dev; 3413 3414 opts = kzalloc(sizeof(*opts), GFP_KERNEL); 3415 if (!opts) 3416 return ERR_PTR(-ENOMEM); 3417 3418 opts->func_inst.set_inst_name = ffs_set_inst_name; 3419 opts->func_inst.free_func_inst = ffs_free_inst; 3420 ffs_dev_lock(); 3421 dev = _ffs_alloc_dev(); 3422 ffs_dev_unlock(); 3423 if (IS_ERR(dev)) { 3424 kfree(opts); 3425 return ERR_CAST(dev); 3426 } 3427 opts->dev = dev; 3428 dev->opts = opts; 3429 3430 config_group_init_type_name(&opts->func_inst.group, "", 3431 &ffs_func_type); 3432 return &opts->func_inst; 3433 } 3434 3435 static void ffs_free(struct usb_function *f) 3436 { 3437 kfree(ffs_func_from_usb(f)); 3438 } 3439 3440 static void ffs_func_unbind(struct usb_configuration *c, 3441 struct usb_function *f) 3442 { 3443 struct ffs_function *func = ffs_func_from_usb(f); 3444 struct ffs_data *ffs = func->ffs; 3445 struct f_fs_opts *opts = 3446 container_of(f->fi, struct f_fs_opts, func_inst); 3447 struct ffs_ep *ep = func->eps; 3448 unsigned count = ffs->eps_count; 3449 unsigned long flags; 3450 3451 ENTER(); 3452 if (ffs->func == func) { 3453 ffs_func_eps_disable(func); 3454 ffs->func = NULL; 3455 } 3456 3457 if (!--opts->refcnt) 3458 functionfs_unbind(ffs); 3459 3460 /* cleanup after autoconfig */ 3461 spin_lock_irqsave(&func->ffs->eps_lock, flags); 3462 while (count--) { 3463 if (ep->ep && ep->req) 3464 usb_ep_free_request(ep->ep, ep->req); 3465 ep->req = NULL; 3466 ++ep; 3467 } 3468 spin_unlock_irqrestore(&func->ffs->eps_lock, flags); 3469 kfree(func->eps); 3470 func->eps = NULL; 3471 /* 3472 * eps, descriptors and interfaces_nums are allocated in the 3473 * same chunk so only one free is required. 3474 */ 3475 func->function.fs_descriptors = NULL; 3476 func->function.hs_descriptors = NULL; 3477 func->function.ss_descriptors = NULL; 3478 func->interfaces_nums = NULL; 3479 3480 ffs_event_add(ffs, FUNCTIONFS_UNBIND); 3481 } 3482 3483 static struct usb_function *ffs_alloc(struct usb_function_instance *fi) 3484 { 3485 struct ffs_function *func; 3486 3487 ENTER(); 3488 3489 func = kzalloc(sizeof(*func), GFP_KERNEL); 3490 if (unlikely(!func)) 3491 return ERR_PTR(-ENOMEM); 3492 3493 func->function.name = "Function FS Gadget"; 3494 3495 func->function.bind = ffs_func_bind; 3496 func->function.unbind = ffs_func_unbind; 3497 func->function.set_alt = ffs_func_set_alt; 3498 func->function.disable = ffs_func_disable; 3499 func->function.setup = ffs_func_setup; 3500 func->function.req_match = ffs_func_req_match; 3501 func->function.suspend = ffs_func_suspend; 3502 func->function.resume = ffs_func_resume; 3503 func->function.free_func = ffs_free; 3504 3505 return &func->function; 3506 } 3507 3508 /* 3509 * ffs_lock must be taken by the caller of this function 3510 */ 3511 static struct ffs_dev *_ffs_alloc_dev(void) 3512 { 3513 struct ffs_dev *dev; 3514 int ret; 3515 3516 if (_ffs_get_single_dev()) 3517 return ERR_PTR(-EBUSY); 3518 3519 dev = kzalloc(sizeof(*dev), GFP_KERNEL); 3520 if (!dev) 3521 return ERR_PTR(-ENOMEM); 3522 3523 if (list_empty(&ffs_devices)) { 3524 ret = functionfs_init(); 3525 if (ret) { 3526 kfree(dev); 3527 return ERR_PTR(ret); 3528 } 3529 } 3530 3531 list_add(&dev->entry, &ffs_devices); 3532 3533 return dev; 3534 } 3535 3536 /* 3537 * ffs_lock must be taken by the caller of this function 3538 * The caller is responsible for "name" being available whenever f_fs needs it 3539 */ 3540 static int _ffs_name_dev(struct ffs_dev *dev, const char *name) 3541 { 3542 struct ffs_dev *existing; 3543 3544 existing = _ffs_do_find_dev(name); 3545 if (existing) 3546 return -EBUSY; 3547 3548 dev->name = name; 3549 3550 return 0; 3551 } 3552 3553 /* 3554 * The caller is responsible for "name" being available whenever f_fs needs it 3555 */ 3556 int ffs_name_dev(struct ffs_dev *dev, const char *name) 3557 { 3558 int ret; 3559 3560 ffs_dev_lock(); 3561 ret = _ffs_name_dev(dev, name); 3562 ffs_dev_unlock(); 3563 3564 return ret; 3565 } 3566 EXPORT_SYMBOL_GPL(ffs_name_dev); 3567 3568 int ffs_single_dev(struct ffs_dev *dev) 3569 { 3570 int ret; 3571 3572 ret = 0; 3573 ffs_dev_lock(); 3574 3575 if (!list_is_singular(&ffs_devices)) 3576 ret = -EBUSY; 3577 else 3578 dev->single = true; 3579 3580 ffs_dev_unlock(); 3581 return ret; 3582 } 3583 EXPORT_SYMBOL_GPL(ffs_single_dev); 3584 3585 /* 3586 * ffs_lock must be taken by the caller of this function 3587 */ 3588 static void _ffs_free_dev(struct ffs_dev *dev) 3589 { 3590 list_del(&dev->entry); 3591 if (dev->name_allocated) 3592 kfree(dev->name); 3593 3594 /* Clear the private_data pointer to stop incorrect dev access */ 3595 if (dev->ffs_data) 3596 dev->ffs_data->private_data = NULL; 3597 3598 kfree(dev); 3599 if (list_empty(&ffs_devices)) 3600 functionfs_cleanup(); 3601 } 3602 3603 static void *ffs_acquire_dev(const char *dev_name) 3604 { 3605 struct ffs_dev *ffs_dev; 3606 3607 ENTER(); 3608 ffs_dev_lock(); 3609 3610 ffs_dev = _ffs_find_dev(dev_name); 3611 if (!ffs_dev) 3612 ffs_dev = ERR_PTR(-ENOENT); 3613 else if (ffs_dev->mounted) 3614 ffs_dev = ERR_PTR(-EBUSY); 3615 else if (ffs_dev->ffs_acquire_dev_callback && 3616 ffs_dev->ffs_acquire_dev_callback(ffs_dev)) 3617 ffs_dev = ERR_PTR(-ENOENT); 3618 else 3619 ffs_dev->mounted = true; 3620 3621 ffs_dev_unlock(); 3622 return ffs_dev; 3623 } 3624 3625 static void ffs_release_dev(struct ffs_data *ffs_data) 3626 { 3627 struct ffs_dev *ffs_dev; 3628 3629 ENTER(); 3630 ffs_dev_lock(); 3631 3632 ffs_dev = ffs_data->private_data; 3633 if (ffs_dev) { 3634 ffs_dev->mounted = false; 3635 3636 if (ffs_dev->ffs_release_dev_callback) 3637 ffs_dev->ffs_release_dev_callback(ffs_dev); 3638 } 3639 3640 ffs_dev_unlock(); 3641 } 3642 3643 static int ffs_ready(struct ffs_data *ffs) 3644 { 3645 struct ffs_dev *ffs_obj; 3646 int ret = 0; 3647 3648 ENTER(); 3649 ffs_dev_lock(); 3650 3651 ffs_obj = ffs->private_data; 3652 if (!ffs_obj) { 3653 ret = -EINVAL; 3654 goto done; 3655 } 3656 if (WARN_ON(ffs_obj->desc_ready)) { 3657 ret = -EBUSY; 3658 goto done; 3659 } 3660 3661 ffs_obj->desc_ready = true; 3662 ffs_obj->ffs_data = ffs; 3663 3664 if (ffs_obj->ffs_ready_callback) { 3665 ret = ffs_obj->ffs_ready_callback(ffs); 3666 if (ret) 3667 goto done; 3668 } 3669 3670 set_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags); 3671 done: 3672 ffs_dev_unlock(); 3673 return ret; 3674 } 3675 3676 static void ffs_closed(struct ffs_data *ffs) 3677 { 3678 struct ffs_dev *ffs_obj; 3679 struct f_fs_opts *opts; 3680 struct config_item *ci; 3681 3682 ENTER(); 3683 ffs_dev_lock(); 3684 3685 ffs_obj = ffs->private_data; 3686 if (!ffs_obj) 3687 goto done; 3688 3689 ffs_obj->desc_ready = false; 3690 3691 if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) && 3692 ffs_obj->ffs_closed_callback) 3693 ffs_obj->ffs_closed_callback(ffs); 3694 3695 if (ffs_obj->opts) 3696 opts = ffs_obj->opts; 3697 else 3698 goto done; 3699 3700 if (opts->no_configfs || !opts->func_inst.group.cg_item.ci_parent 3701 || !atomic_read(&opts->func_inst.group.cg_item.ci_kref.refcount)) 3702 goto done; 3703 3704 ci = opts->func_inst.group.cg_item.ci_parent->ci_parent; 3705 ffs_dev_unlock(); 3706 3707 unregister_gadget_item(ci); 3708 return; 3709 done: 3710 ffs_dev_unlock(); 3711 } 3712 3713 /* Misc helper functions ****************************************************/ 3714 3715 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock) 3716 { 3717 return nonblock 3718 ? likely(mutex_trylock(mutex)) ? 0 : -EAGAIN 3719 : mutex_lock_interruptible(mutex); 3720 } 3721 3722 static char *ffs_prepare_buffer(const char __user *buf, size_t len) 3723 { 3724 char *data; 3725 3726 if (unlikely(!len)) 3727 return NULL; 3728 3729 data = kmalloc(len, GFP_KERNEL); 3730 if (unlikely(!data)) 3731 return ERR_PTR(-ENOMEM); 3732 3733 if (unlikely(copy_from_user(data, buf, len))) { 3734 kfree(data); 3735 return ERR_PTR(-EFAULT); 3736 } 3737 3738 pr_vdebug("Buffer from user space:\n"); 3739 ffs_dump_mem("", data, len); 3740 3741 return data; 3742 } 3743 3744 DECLARE_USB_FUNCTION_INIT(ffs, ffs_alloc_inst, ffs_alloc); 3745 MODULE_LICENSE("GPL"); 3746 MODULE_AUTHOR("Michal Nazarewicz"); 3747