1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * f_fs.c -- user mode file system API for USB composite function controllers 4 * 5 * Copyright (C) 2010 Samsung Electronics 6 * Author: Michal Nazarewicz <mina86@mina86.com> 7 * 8 * Based on inode.c (GadgetFS) which was: 9 * Copyright (C) 2003-2004 David Brownell 10 * Copyright (C) 2003 Agilent Technologies 11 */ 12 13 14 /* #define DEBUG */ 15 /* #define VERBOSE_DEBUG */ 16 17 #include <linux/blkdev.h> 18 #include <linux/pagemap.h> 19 #include <linux/export.h> 20 #include <linux/fs_parser.h> 21 #include <linux/hid.h> 22 #include <linux/mm.h> 23 #include <linux/module.h> 24 #include <linux/scatterlist.h> 25 #include <linux/sched/signal.h> 26 #include <linux/uio.h> 27 #include <linux/vmalloc.h> 28 #include <asm/unaligned.h> 29 30 #include <linux/usb/ccid.h> 31 #include <linux/usb/composite.h> 32 #include <linux/usb/functionfs.h> 33 34 #include <linux/aio.h> 35 #include <linux/mmu_context.h> 36 #include <linux/poll.h> 37 #include <linux/eventfd.h> 38 39 #include "u_fs.h" 40 #include "u_f.h" 41 #include "u_os_desc.h" 42 #include "configfs.h" 43 44 #define FUNCTIONFS_MAGIC 0xa647361 /* Chosen by a honest dice roll ;) */ 45 46 /* Reference counter handling */ 47 static void ffs_data_get(struct ffs_data *ffs); 48 static void ffs_data_put(struct ffs_data *ffs); 49 /* Creates new ffs_data object. */ 50 static struct ffs_data *__must_check ffs_data_new(const char *dev_name) 51 __attribute__((malloc)); 52 53 /* Opened counter handling. */ 54 static void ffs_data_opened(struct ffs_data *ffs); 55 static void ffs_data_closed(struct ffs_data *ffs); 56 57 /* Called with ffs->mutex held; take over ownership of data. */ 58 static int __must_check 59 __ffs_data_got_descs(struct ffs_data *ffs, char *data, size_t len); 60 static int __must_check 61 __ffs_data_got_strings(struct ffs_data *ffs, char *data, size_t len); 62 63 64 /* The function structure ***************************************************/ 65 66 struct ffs_ep; 67 68 struct ffs_function { 69 struct usb_configuration *conf; 70 struct usb_gadget *gadget; 71 struct ffs_data *ffs; 72 73 struct ffs_ep *eps; 74 u8 eps_revmap[16]; 75 short *interfaces_nums; 76 77 struct usb_function function; 78 }; 79 80 81 static struct ffs_function *ffs_func_from_usb(struct usb_function *f) 82 { 83 return container_of(f, struct ffs_function, function); 84 } 85 86 87 static inline enum ffs_setup_state 88 ffs_setup_state_clear_cancelled(struct ffs_data *ffs) 89 { 90 return (enum ffs_setup_state) 91 cmpxchg(&ffs->setup_state, FFS_SETUP_CANCELLED, FFS_NO_SETUP); 92 } 93 94 95 static void ffs_func_eps_disable(struct ffs_function *func); 96 static int __must_check ffs_func_eps_enable(struct ffs_function *func); 97 98 static int ffs_func_bind(struct usb_configuration *, 99 struct usb_function *); 100 static int ffs_func_set_alt(struct usb_function *, unsigned, unsigned); 101 static void ffs_func_disable(struct usb_function *); 102 static int ffs_func_setup(struct usb_function *, 103 const struct usb_ctrlrequest *); 104 static bool ffs_func_req_match(struct usb_function *, 105 const struct usb_ctrlrequest *, 106 bool config0); 107 static void ffs_func_suspend(struct usb_function *); 108 static void ffs_func_resume(struct usb_function *); 109 110 111 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num); 112 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf); 113 114 115 /* The endpoints structures *************************************************/ 116 117 struct ffs_ep { 118 struct usb_ep *ep; /* P: ffs->eps_lock */ 119 struct usb_request *req; /* P: epfile->mutex */ 120 121 /* [0]: full speed, [1]: high speed, [2]: super speed */ 122 struct usb_endpoint_descriptor *descs[3]; 123 124 u8 num; 125 126 int status; /* P: epfile->mutex */ 127 }; 128 129 struct ffs_epfile { 130 /* Protects ep->ep and ep->req. */ 131 struct mutex mutex; 132 133 struct ffs_data *ffs; 134 struct ffs_ep *ep; /* P: ffs->eps_lock */ 135 136 struct dentry *dentry; 137 138 /* 139 * Buffer for holding data from partial reads which may happen since 140 * we’re rounding user read requests to a multiple of a max packet size. 141 * 142 * The pointer is initialised with NULL value and may be set by 143 * __ffs_epfile_read_data function to point to a temporary buffer. 144 * 145 * In normal operation, calls to __ffs_epfile_read_buffered will consume 146 * data from said buffer and eventually free it. Importantly, while the 147 * function is using the buffer, it sets the pointer to NULL. This is 148 * all right since __ffs_epfile_read_data and __ffs_epfile_read_buffered 149 * can never run concurrently (they are synchronised by epfile->mutex) 150 * so the latter will not assign a new value to the pointer. 151 * 152 * Meanwhile ffs_func_eps_disable frees the buffer (if the pointer is 153 * valid) and sets the pointer to READ_BUFFER_DROP value. This special 154 * value is crux of the synchronisation between ffs_func_eps_disable and 155 * __ffs_epfile_read_data. 156 * 157 * Once __ffs_epfile_read_data is about to finish it will try to set the 158 * pointer back to its old value (as described above), but seeing as the 159 * pointer is not-NULL (namely READ_BUFFER_DROP) it will instead free 160 * the buffer. 161 * 162 * == State transitions == 163 * 164 * • ptr == NULL: (initial state) 165 * ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP 166 * ◦ __ffs_epfile_read_buffered: nop 167 * ◦ __ffs_epfile_read_data allocates temp buffer: go to ptr == buf 168 * ◦ reading finishes: n/a, not in ‘and reading’ state 169 * • ptr == DROP: 170 * ◦ __ffs_epfile_read_buffer_free: nop 171 * ◦ __ffs_epfile_read_buffered: go to ptr == NULL 172 * ◦ __ffs_epfile_read_data allocates temp buffer: free buf, nop 173 * ◦ reading finishes: n/a, not in ‘and reading’ state 174 * • ptr == buf: 175 * ◦ __ffs_epfile_read_buffer_free: free buf, go to ptr == DROP 176 * ◦ __ffs_epfile_read_buffered: go to ptr == NULL and reading 177 * ◦ __ffs_epfile_read_data: n/a, __ffs_epfile_read_buffered 178 * is always called first 179 * ◦ reading finishes: n/a, not in ‘and reading’ state 180 * • ptr == NULL and reading: 181 * ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP and reading 182 * ◦ __ffs_epfile_read_buffered: n/a, mutex is held 183 * ◦ __ffs_epfile_read_data: n/a, mutex is held 184 * ◦ reading finishes and … 185 * … all data read: free buf, go to ptr == NULL 186 * … otherwise: go to ptr == buf and reading 187 * • ptr == DROP and reading: 188 * ◦ __ffs_epfile_read_buffer_free: nop 189 * ◦ __ffs_epfile_read_buffered: n/a, mutex is held 190 * ◦ __ffs_epfile_read_data: n/a, mutex is held 191 * ◦ reading finishes: free buf, go to ptr == DROP 192 */ 193 struct ffs_buffer *read_buffer; 194 #define READ_BUFFER_DROP ((struct ffs_buffer *)ERR_PTR(-ESHUTDOWN)) 195 196 char name[5]; 197 198 unsigned char in; /* P: ffs->eps_lock */ 199 unsigned char isoc; /* P: ffs->eps_lock */ 200 201 unsigned char _pad; 202 }; 203 204 struct ffs_buffer { 205 size_t length; 206 char *data; 207 char storage[]; 208 }; 209 210 /* ffs_io_data structure ***************************************************/ 211 212 struct ffs_io_data { 213 bool aio; 214 bool read; 215 216 struct kiocb *kiocb; 217 struct iov_iter data; 218 const void *to_free; 219 char *buf; 220 221 struct mm_struct *mm; 222 struct work_struct work; 223 224 struct usb_ep *ep; 225 struct usb_request *req; 226 struct sg_table sgt; 227 bool use_sg; 228 229 struct ffs_data *ffs; 230 }; 231 232 struct ffs_desc_helper { 233 struct ffs_data *ffs; 234 unsigned interfaces_count; 235 unsigned eps_count; 236 }; 237 238 static int __must_check ffs_epfiles_create(struct ffs_data *ffs); 239 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count); 240 241 static struct dentry * 242 ffs_sb_create_file(struct super_block *sb, const char *name, void *data, 243 const struct file_operations *fops); 244 245 /* Devices management *******************************************************/ 246 247 DEFINE_MUTEX(ffs_lock); 248 EXPORT_SYMBOL_GPL(ffs_lock); 249 250 static struct ffs_dev *_ffs_find_dev(const char *name); 251 static struct ffs_dev *_ffs_alloc_dev(void); 252 static void _ffs_free_dev(struct ffs_dev *dev); 253 static void *ffs_acquire_dev(const char *dev_name); 254 static void ffs_release_dev(struct ffs_data *ffs_data); 255 static int ffs_ready(struct ffs_data *ffs); 256 static void ffs_closed(struct ffs_data *ffs); 257 258 /* Misc helper functions ****************************************************/ 259 260 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock) 261 __attribute__((warn_unused_result, nonnull)); 262 static char *ffs_prepare_buffer(const char __user *buf, size_t len) 263 __attribute__((warn_unused_result, nonnull)); 264 265 266 /* Control file aka ep0 *****************************************************/ 267 268 static void ffs_ep0_complete(struct usb_ep *ep, struct usb_request *req) 269 { 270 struct ffs_data *ffs = req->context; 271 272 complete(&ffs->ep0req_completion); 273 } 274 275 static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len) 276 __releases(&ffs->ev.waitq.lock) 277 { 278 struct usb_request *req = ffs->ep0req; 279 int ret; 280 281 req->zero = len < le16_to_cpu(ffs->ev.setup.wLength); 282 283 spin_unlock_irq(&ffs->ev.waitq.lock); 284 285 req->buf = data; 286 req->length = len; 287 288 /* 289 * UDC layer requires to provide a buffer even for ZLP, but should 290 * not use it at all. Let's provide some poisoned pointer to catch 291 * possible bug in the driver. 292 */ 293 if (req->buf == NULL) 294 req->buf = (void *)0xDEADBABE; 295 296 reinit_completion(&ffs->ep0req_completion); 297 298 ret = usb_ep_queue(ffs->gadget->ep0, req, GFP_ATOMIC); 299 if (unlikely(ret < 0)) 300 return ret; 301 302 ret = wait_for_completion_interruptible(&ffs->ep0req_completion); 303 if (unlikely(ret)) { 304 usb_ep_dequeue(ffs->gadget->ep0, req); 305 return -EINTR; 306 } 307 308 ffs->setup_state = FFS_NO_SETUP; 309 return req->status ? req->status : req->actual; 310 } 311 312 static int __ffs_ep0_stall(struct ffs_data *ffs) 313 { 314 if (ffs->ev.can_stall) { 315 pr_vdebug("ep0 stall\n"); 316 usb_ep_set_halt(ffs->gadget->ep0); 317 ffs->setup_state = FFS_NO_SETUP; 318 return -EL2HLT; 319 } else { 320 pr_debug("bogus ep0 stall!\n"); 321 return -ESRCH; 322 } 323 } 324 325 static ssize_t ffs_ep0_write(struct file *file, const char __user *buf, 326 size_t len, loff_t *ptr) 327 { 328 struct ffs_data *ffs = file->private_data; 329 ssize_t ret; 330 char *data; 331 332 ENTER(); 333 334 /* Fast check if setup was canceled */ 335 if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED) 336 return -EIDRM; 337 338 /* Acquire mutex */ 339 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK); 340 if (unlikely(ret < 0)) 341 return ret; 342 343 /* Check state */ 344 switch (ffs->state) { 345 case FFS_READ_DESCRIPTORS: 346 case FFS_READ_STRINGS: 347 /* Copy data */ 348 if (unlikely(len < 16)) { 349 ret = -EINVAL; 350 break; 351 } 352 353 data = ffs_prepare_buffer(buf, len); 354 if (IS_ERR(data)) { 355 ret = PTR_ERR(data); 356 break; 357 } 358 359 /* Handle data */ 360 if (ffs->state == FFS_READ_DESCRIPTORS) { 361 pr_info("read descriptors\n"); 362 ret = __ffs_data_got_descs(ffs, data, len); 363 if (unlikely(ret < 0)) 364 break; 365 366 ffs->state = FFS_READ_STRINGS; 367 ret = len; 368 } else { 369 pr_info("read strings\n"); 370 ret = __ffs_data_got_strings(ffs, data, len); 371 if (unlikely(ret < 0)) 372 break; 373 374 ret = ffs_epfiles_create(ffs); 375 if (unlikely(ret)) { 376 ffs->state = FFS_CLOSING; 377 break; 378 } 379 380 ffs->state = FFS_ACTIVE; 381 mutex_unlock(&ffs->mutex); 382 383 ret = ffs_ready(ffs); 384 if (unlikely(ret < 0)) { 385 ffs->state = FFS_CLOSING; 386 return ret; 387 } 388 389 return len; 390 } 391 break; 392 393 case FFS_ACTIVE: 394 data = NULL; 395 /* 396 * We're called from user space, we can use _irq 397 * rather then _irqsave 398 */ 399 spin_lock_irq(&ffs->ev.waitq.lock); 400 switch (ffs_setup_state_clear_cancelled(ffs)) { 401 case FFS_SETUP_CANCELLED: 402 ret = -EIDRM; 403 goto done_spin; 404 405 case FFS_NO_SETUP: 406 ret = -ESRCH; 407 goto done_spin; 408 409 case FFS_SETUP_PENDING: 410 break; 411 } 412 413 /* FFS_SETUP_PENDING */ 414 if (!(ffs->ev.setup.bRequestType & USB_DIR_IN)) { 415 spin_unlock_irq(&ffs->ev.waitq.lock); 416 ret = __ffs_ep0_stall(ffs); 417 break; 418 } 419 420 /* FFS_SETUP_PENDING and not stall */ 421 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength)); 422 423 spin_unlock_irq(&ffs->ev.waitq.lock); 424 425 data = ffs_prepare_buffer(buf, len); 426 if (IS_ERR(data)) { 427 ret = PTR_ERR(data); 428 break; 429 } 430 431 spin_lock_irq(&ffs->ev.waitq.lock); 432 433 /* 434 * We are guaranteed to be still in FFS_ACTIVE state 435 * but the state of setup could have changed from 436 * FFS_SETUP_PENDING to FFS_SETUP_CANCELLED so we need 437 * to check for that. If that happened we copied data 438 * from user space in vain but it's unlikely. 439 * 440 * For sure we are not in FFS_NO_SETUP since this is 441 * the only place FFS_SETUP_PENDING -> FFS_NO_SETUP 442 * transition can be performed and it's protected by 443 * mutex. 444 */ 445 if (ffs_setup_state_clear_cancelled(ffs) == 446 FFS_SETUP_CANCELLED) { 447 ret = -EIDRM; 448 done_spin: 449 spin_unlock_irq(&ffs->ev.waitq.lock); 450 } else { 451 /* unlocks spinlock */ 452 ret = __ffs_ep0_queue_wait(ffs, data, len); 453 } 454 kfree(data); 455 break; 456 457 default: 458 ret = -EBADFD; 459 break; 460 } 461 462 mutex_unlock(&ffs->mutex); 463 return ret; 464 } 465 466 /* Called with ffs->ev.waitq.lock and ffs->mutex held, both released on exit. */ 467 static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf, 468 size_t n) 469 __releases(&ffs->ev.waitq.lock) 470 { 471 /* 472 * n cannot be bigger than ffs->ev.count, which cannot be bigger than 473 * size of ffs->ev.types array (which is four) so that's how much space 474 * we reserve. 475 */ 476 struct usb_functionfs_event events[ARRAY_SIZE(ffs->ev.types)]; 477 const size_t size = n * sizeof *events; 478 unsigned i = 0; 479 480 memset(events, 0, size); 481 482 do { 483 events[i].type = ffs->ev.types[i]; 484 if (events[i].type == FUNCTIONFS_SETUP) { 485 events[i].u.setup = ffs->ev.setup; 486 ffs->setup_state = FFS_SETUP_PENDING; 487 } 488 } while (++i < n); 489 490 ffs->ev.count -= n; 491 if (ffs->ev.count) 492 memmove(ffs->ev.types, ffs->ev.types + n, 493 ffs->ev.count * sizeof *ffs->ev.types); 494 495 spin_unlock_irq(&ffs->ev.waitq.lock); 496 mutex_unlock(&ffs->mutex); 497 498 return unlikely(copy_to_user(buf, events, size)) ? -EFAULT : size; 499 } 500 501 static ssize_t ffs_ep0_read(struct file *file, char __user *buf, 502 size_t len, loff_t *ptr) 503 { 504 struct ffs_data *ffs = file->private_data; 505 char *data = NULL; 506 size_t n; 507 int ret; 508 509 ENTER(); 510 511 /* Fast check if setup was canceled */ 512 if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED) 513 return -EIDRM; 514 515 /* Acquire mutex */ 516 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK); 517 if (unlikely(ret < 0)) 518 return ret; 519 520 /* Check state */ 521 if (ffs->state != FFS_ACTIVE) { 522 ret = -EBADFD; 523 goto done_mutex; 524 } 525 526 /* 527 * We're called from user space, we can use _irq rather then 528 * _irqsave 529 */ 530 spin_lock_irq(&ffs->ev.waitq.lock); 531 532 switch (ffs_setup_state_clear_cancelled(ffs)) { 533 case FFS_SETUP_CANCELLED: 534 ret = -EIDRM; 535 break; 536 537 case FFS_NO_SETUP: 538 n = len / sizeof(struct usb_functionfs_event); 539 if (unlikely(!n)) { 540 ret = -EINVAL; 541 break; 542 } 543 544 if ((file->f_flags & O_NONBLOCK) && !ffs->ev.count) { 545 ret = -EAGAIN; 546 break; 547 } 548 549 if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq, 550 ffs->ev.count)) { 551 ret = -EINTR; 552 break; 553 } 554 555 /* unlocks spinlock */ 556 return __ffs_ep0_read_events(ffs, buf, 557 min(n, (size_t)ffs->ev.count)); 558 559 case FFS_SETUP_PENDING: 560 if (ffs->ev.setup.bRequestType & USB_DIR_IN) { 561 spin_unlock_irq(&ffs->ev.waitq.lock); 562 ret = __ffs_ep0_stall(ffs); 563 goto done_mutex; 564 } 565 566 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength)); 567 568 spin_unlock_irq(&ffs->ev.waitq.lock); 569 570 if (likely(len)) { 571 data = kmalloc(len, GFP_KERNEL); 572 if (unlikely(!data)) { 573 ret = -ENOMEM; 574 goto done_mutex; 575 } 576 } 577 578 spin_lock_irq(&ffs->ev.waitq.lock); 579 580 /* See ffs_ep0_write() */ 581 if (ffs_setup_state_clear_cancelled(ffs) == 582 FFS_SETUP_CANCELLED) { 583 ret = -EIDRM; 584 break; 585 } 586 587 /* unlocks spinlock */ 588 ret = __ffs_ep0_queue_wait(ffs, data, len); 589 if (likely(ret > 0) && unlikely(copy_to_user(buf, data, len))) 590 ret = -EFAULT; 591 goto done_mutex; 592 593 default: 594 ret = -EBADFD; 595 break; 596 } 597 598 spin_unlock_irq(&ffs->ev.waitq.lock); 599 done_mutex: 600 mutex_unlock(&ffs->mutex); 601 kfree(data); 602 return ret; 603 } 604 605 static int ffs_ep0_open(struct inode *inode, struct file *file) 606 { 607 struct ffs_data *ffs = inode->i_private; 608 609 ENTER(); 610 611 if (unlikely(ffs->state == FFS_CLOSING)) 612 return -EBUSY; 613 614 file->private_data = ffs; 615 ffs_data_opened(ffs); 616 617 return 0; 618 } 619 620 static int ffs_ep0_release(struct inode *inode, struct file *file) 621 { 622 struct ffs_data *ffs = file->private_data; 623 624 ENTER(); 625 626 ffs_data_closed(ffs); 627 628 return 0; 629 } 630 631 static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value) 632 { 633 struct ffs_data *ffs = file->private_data; 634 struct usb_gadget *gadget = ffs->gadget; 635 long ret; 636 637 ENTER(); 638 639 if (code == FUNCTIONFS_INTERFACE_REVMAP) { 640 struct ffs_function *func = ffs->func; 641 ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV; 642 } else if (gadget && gadget->ops->ioctl) { 643 ret = gadget->ops->ioctl(gadget, code, value); 644 } else { 645 ret = -ENOTTY; 646 } 647 648 return ret; 649 } 650 651 static __poll_t ffs_ep0_poll(struct file *file, poll_table *wait) 652 { 653 struct ffs_data *ffs = file->private_data; 654 __poll_t mask = EPOLLWRNORM; 655 int ret; 656 657 poll_wait(file, &ffs->ev.waitq, wait); 658 659 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK); 660 if (unlikely(ret < 0)) 661 return mask; 662 663 switch (ffs->state) { 664 case FFS_READ_DESCRIPTORS: 665 case FFS_READ_STRINGS: 666 mask |= EPOLLOUT; 667 break; 668 669 case FFS_ACTIVE: 670 switch (ffs->setup_state) { 671 case FFS_NO_SETUP: 672 if (ffs->ev.count) 673 mask |= EPOLLIN; 674 break; 675 676 case FFS_SETUP_PENDING: 677 case FFS_SETUP_CANCELLED: 678 mask |= (EPOLLIN | EPOLLOUT); 679 break; 680 } 681 case FFS_CLOSING: 682 break; 683 case FFS_DEACTIVATED: 684 break; 685 } 686 687 mutex_unlock(&ffs->mutex); 688 689 return mask; 690 } 691 692 static const struct file_operations ffs_ep0_operations = { 693 .llseek = no_llseek, 694 695 .open = ffs_ep0_open, 696 .write = ffs_ep0_write, 697 .read = ffs_ep0_read, 698 .release = ffs_ep0_release, 699 .unlocked_ioctl = ffs_ep0_ioctl, 700 .poll = ffs_ep0_poll, 701 }; 702 703 704 /* "Normal" endpoints operations ********************************************/ 705 706 static void ffs_epfile_io_complete(struct usb_ep *_ep, struct usb_request *req) 707 { 708 ENTER(); 709 if (likely(req->context)) { 710 struct ffs_ep *ep = _ep->driver_data; 711 ep->status = req->status ? req->status : req->actual; 712 complete(req->context); 713 } 714 } 715 716 static ssize_t ffs_copy_to_iter(void *data, int data_len, struct iov_iter *iter) 717 { 718 ssize_t ret = copy_to_iter(data, data_len, iter); 719 if (likely(ret == data_len)) 720 return ret; 721 722 if (unlikely(iov_iter_count(iter))) 723 return -EFAULT; 724 725 /* 726 * Dear user space developer! 727 * 728 * TL;DR: To stop getting below error message in your kernel log, change 729 * user space code using functionfs to align read buffers to a max 730 * packet size. 731 * 732 * Some UDCs (e.g. dwc3) require request sizes to be a multiple of a max 733 * packet size. When unaligned buffer is passed to functionfs, it 734 * internally uses a larger, aligned buffer so that such UDCs are happy. 735 * 736 * Unfortunately, this means that host may send more data than was 737 * requested in read(2) system call. f_fs doesn’t know what to do with 738 * that excess data so it simply drops it. 739 * 740 * Was the buffer aligned in the first place, no such problem would 741 * happen. 742 * 743 * Data may be dropped only in AIO reads. Synchronous reads are handled 744 * by splitting a request into multiple parts. This splitting may still 745 * be a problem though so it’s likely best to align the buffer 746 * regardless of it being AIO or not.. 747 * 748 * This only affects OUT endpoints, i.e. reading data with a read(2), 749 * aio_read(2) etc. system calls. Writing data to an IN endpoint is not 750 * affected. 751 */ 752 pr_err("functionfs read size %d > requested size %zd, dropping excess data. " 753 "Align read buffer size to max packet size to avoid the problem.\n", 754 data_len, ret); 755 756 return ret; 757 } 758 759 /* 760 * allocate a virtually contiguous buffer and create a scatterlist describing it 761 * @sg_table - pointer to a place to be filled with sg_table contents 762 * @size - required buffer size 763 */ 764 static void *ffs_build_sg_list(struct sg_table *sgt, size_t sz) 765 { 766 struct page **pages; 767 void *vaddr, *ptr; 768 unsigned int n_pages; 769 int i; 770 771 vaddr = vmalloc(sz); 772 if (!vaddr) 773 return NULL; 774 775 n_pages = PAGE_ALIGN(sz) >> PAGE_SHIFT; 776 pages = kvmalloc_array(n_pages, sizeof(struct page *), GFP_KERNEL); 777 if (!pages) { 778 vfree(vaddr); 779 780 return NULL; 781 } 782 for (i = 0, ptr = vaddr; i < n_pages; ++i, ptr += PAGE_SIZE) 783 pages[i] = vmalloc_to_page(ptr); 784 785 if (sg_alloc_table_from_pages(sgt, pages, n_pages, 0, sz, GFP_KERNEL)) { 786 kvfree(pages); 787 vfree(vaddr); 788 789 return NULL; 790 } 791 kvfree(pages); 792 793 return vaddr; 794 } 795 796 static inline void *ffs_alloc_buffer(struct ffs_io_data *io_data, 797 size_t data_len) 798 { 799 if (io_data->use_sg) 800 return ffs_build_sg_list(&io_data->sgt, data_len); 801 802 return kmalloc(data_len, GFP_KERNEL); 803 } 804 805 static inline void ffs_free_buffer(struct ffs_io_data *io_data) 806 { 807 if (!io_data->buf) 808 return; 809 810 if (io_data->use_sg) { 811 sg_free_table(&io_data->sgt); 812 vfree(io_data->buf); 813 } else { 814 kfree(io_data->buf); 815 } 816 } 817 818 static void ffs_user_copy_worker(struct work_struct *work) 819 { 820 struct ffs_io_data *io_data = container_of(work, struct ffs_io_data, 821 work); 822 int ret = io_data->req->status ? io_data->req->status : 823 io_data->req->actual; 824 bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD; 825 826 if (io_data->read && ret > 0) { 827 mm_segment_t oldfs = get_fs(); 828 829 set_fs(USER_DS); 830 use_mm(io_data->mm); 831 ret = ffs_copy_to_iter(io_data->buf, ret, &io_data->data); 832 unuse_mm(io_data->mm); 833 set_fs(oldfs); 834 } 835 836 io_data->kiocb->ki_complete(io_data->kiocb, ret, ret); 837 838 if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd) 839 eventfd_signal(io_data->ffs->ffs_eventfd, 1); 840 841 usb_ep_free_request(io_data->ep, io_data->req); 842 843 if (io_data->read) 844 kfree(io_data->to_free); 845 ffs_free_buffer(io_data); 846 kfree(io_data); 847 } 848 849 static void ffs_epfile_async_io_complete(struct usb_ep *_ep, 850 struct usb_request *req) 851 { 852 struct ffs_io_data *io_data = req->context; 853 struct ffs_data *ffs = io_data->ffs; 854 855 ENTER(); 856 857 INIT_WORK(&io_data->work, ffs_user_copy_worker); 858 queue_work(ffs->io_completion_wq, &io_data->work); 859 } 860 861 static void __ffs_epfile_read_buffer_free(struct ffs_epfile *epfile) 862 { 863 /* 864 * See comment in struct ffs_epfile for full read_buffer pointer 865 * synchronisation story. 866 */ 867 struct ffs_buffer *buf = xchg(&epfile->read_buffer, READ_BUFFER_DROP); 868 if (buf && buf != READ_BUFFER_DROP) 869 kfree(buf); 870 } 871 872 /* Assumes epfile->mutex is held. */ 873 static ssize_t __ffs_epfile_read_buffered(struct ffs_epfile *epfile, 874 struct iov_iter *iter) 875 { 876 /* 877 * Null out epfile->read_buffer so ffs_func_eps_disable does not free 878 * the buffer while we are using it. See comment in struct ffs_epfile 879 * for full read_buffer pointer synchronisation story. 880 */ 881 struct ffs_buffer *buf = xchg(&epfile->read_buffer, NULL); 882 ssize_t ret; 883 if (!buf || buf == READ_BUFFER_DROP) 884 return 0; 885 886 ret = copy_to_iter(buf->data, buf->length, iter); 887 if (buf->length == ret) { 888 kfree(buf); 889 return ret; 890 } 891 892 if (unlikely(iov_iter_count(iter))) { 893 ret = -EFAULT; 894 } else { 895 buf->length -= ret; 896 buf->data += ret; 897 } 898 899 if (cmpxchg(&epfile->read_buffer, NULL, buf)) 900 kfree(buf); 901 902 return ret; 903 } 904 905 /* Assumes epfile->mutex is held. */ 906 static ssize_t __ffs_epfile_read_data(struct ffs_epfile *epfile, 907 void *data, int data_len, 908 struct iov_iter *iter) 909 { 910 struct ffs_buffer *buf; 911 912 ssize_t ret = copy_to_iter(data, data_len, iter); 913 if (likely(data_len == ret)) 914 return ret; 915 916 if (unlikely(iov_iter_count(iter))) 917 return -EFAULT; 918 919 /* See ffs_copy_to_iter for more context. */ 920 pr_warn("functionfs read size %d > requested size %zd, splitting request into multiple reads.", 921 data_len, ret); 922 923 data_len -= ret; 924 buf = kmalloc(sizeof(*buf) + data_len, GFP_KERNEL); 925 if (!buf) 926 return -ENOMEM; 927 buf->length = data_len; 928 buf->data = buf->storage; 929 memcpy(buf->storage, data + ret, data_len); 930 931 /* 932 * At this point read_buffer is NULL or READ_BUFFER_DROP (if 933 * ffs_func_eps_disable has been called in the meanwhile). See comment 934 * in struct ffs_epfile for full read_buffer pointer synchronisation 935 * story. 936 */ 937 if (unlikely(cmpxchg(&epfile->read_buffer, NULL, buf))) 938 kfree(buf); 939 940 return ret; 941 } 942 943 static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) 944 { 945 struct ffs_epfile *epfile = file->private_data; 946 struct usb_request *req; 947 struct ffs_ep *ep; 948 char *data = NULL; 949 ssize_t ret, data_len = -EINVAL; 950 int halt; 951 952 /* Are we still active? */ 953 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE)) 954 return -ENODEV; 955 956 /* Wait for endpoint to be enabled */ 957 ep = epfile->ep; 958 if (!ep) { 959 if (file->f_flags & O_NONBLOCK) 960 return -EAGAIN; 961 962 ret = wait_event_interruptible( 963 epfile->ffs->wait, (ep = epfile->ep)); 964 if (ret) 965 return -EINTR; 966 } 967 968 /* Do we halt? */ 969 halt = (!io_data->read == !epfile->in); 970 if (halt && epfile->isoc) 971 return -EINVAL; 972 973 /* We will be using request and read_buffer */ 974 ret = ffs_mutex_lock(&epfile->mutex, file->f_flags & O_NONBLOCK); 975 if (unlikely(ret)) 976 goto error; 977 978 /* Allocate & copy */ 979 if (!halt) { 980 struct usb_gadget *gadget; 981 982 /* 983 * Do we have buffered data from previous partial read? Check 984 * that for synchronous case only because we do not have 985 * facility to ‘wake up’ a pending asynchronous read and push 986 * buffered data to it which we would need to make things behave 987 * consistently. 988 */ 989 if (!io_data->aio && io_data->read) { 990 ret = __ffs_epfile_read_buffered(epfile, &io_data->data); 991 if (ret) 992 goto error_mutex; 993 } 994 995 /* 996 * if we _do_ wait above, the epfile->ffs->gadget might be NULL 997 * before the waiting completes, so do not assign to 'gadget' 998 * earlier 999 */ 1000 gadget = epfile->ffs->gadget; 1001 1002 spin_lock_irq(&epfile->ffs->eps_lock); 1003 /* In the meantime, endpoint got disabled or changed. */ 1004 if (epfile->ep != ep) { 1005 ret = -ESHUTDOWN; 1006 goto error_lock; 1007 } 1008 data_len = iov_iter_count(&io_data->data); 1009 /* 1010 * Controller may require buffer size to be aligned to 1011 * maxpacketsize of an out endpoint. 1012 */ 1013 if (io_data->read) 1014 data_len = usb_ep_align_maybe(gadget, ep->ep, data_len); 1015 1016 io_data->use_sg = gadget->sg_supported && data_len > PAGE_SIZE; 1017 spin_unlock_irq(&epfile->ffs->eps_lock); 1018 1019 data = ffs_alloc_buffer(io_data, data_len); 1020 if (unlikely(!data)) { 1021 ret = -ENOMEM; 1022 goto error_mutex; 1023 } 1024 if (!io_data->read && 1025 !copy_from_iter_full(data, data_len, &io_data->data)) { 1026 ret = -EFAULT; 1027 goto error_mutex; 1028 } 1029 } 1030 1031 spin_lock_irq(&epfile->ffs->eps_lock); 1032 1033 if (epfile->ep != ep) { 1034 /* In the meantime, endpoint got disabled or changed. */ 1035 ret = -ESHUTDOWN; 1036 } else if (halt) { 1037 ret = usb_ep_set_halt(ep->ep); 1038 if (!ret) 1039 ret = -EBADMSG; 1040 } else if (unlikely(data_len == -EINVAL)) { 1041 /* 1042 * Sanity Check: even though data_len can't be used 1043 * uninitialized at the time I write this comment, some 1044 * compilers complain about this situation. 1045 * In order to keep the code clean from warnings, data_len is 1046 * being initialized to -EINVAL during its declaration, which 1047 * means we can't rely on compiler anymore to warn no future 1048 * changes won't result in data_len being used uninitialized. 1049 * For such reason, we're adding this redundant sanity check 1050 * here. 1051 */ 1052 WARN(1, "%s: data_len == -EINVAL\n", __func__); 1053 ret = -EINVAL; 1054 } else if (!io_data->aio) { 1055 DECLARE_COMPLETION_ONSTACK(done); 1056 bool interrupted = false; 1057 1058 req = ep->req; 1059 if (io_data->use_sg) { 1060 req->buf = NULL; 1061 req->sg = io_data->sgt.sgl; 1062 req->num_sgs = io_data->sgt.nents; 1063 } else { 1064 req->buf = data; 1065 req->num_sgs = 0; 1066 } 1067 req->length = data_len; 1068 1069 io_data->buf = data; 1070 1071 req->context = &done; 1072 req->complete = ffs_epfile_io_complete; 1073 1074 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC); 1075 if (unlikely(ret < 0)) 1076 goto error_lock; 1077 1078 spin_unlock_irq(&epfile->ffs->eps_lock); 1079 1080 if (unlikely(wait_for_completion_interruptible(&done))) { 1081 /* 1082 * To avoid race condition with ffs_epfile_io_complete, 1083 * dequeue the request first then check 1084 * status. usb_ep_dequeue API should guarantee no race 1085 * condition with req->complete callback. 1086 */ 1087 usb_ep_dequeue(ep->ep, req); 1088 wait_for_completion(&done); 1089 interrupted = ep->status < 0; 1090 } 1091 1092 if (interrupted) 1093 ret = -EINTR; 1094 else if (io_data->read && ep->status > 0) 1095 ret = __ffs_epfile_read_data(epfile, data, ep->status, 1096 &io_data->data); 1097 else 1098 ret = ep->status; 1099 goto error_mutex; 1100 } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC))) { 1101 ret = -ENOMEM; 1102 } else { 1103 if (io_data->use_sg) { 1104 req->buf = NULL; 1105 req->sg = io_data->sgt.sgl; 1106 req->num_sgs = io_data->sgt.nents; 1107 } else { 1108 req->buf = data; 1109 req->num_sgs = 0; 1110 } 1111 req->length = data_len; 1112 1113 io_data->buf = data; 1114 io_data->ep = ep->ep; 1115 io_data->req = req; 1116 io_data->ffs = epfile->ffs; 1117 1118 req->context = io_data; 1119 req->complete = ffs_epfile_async_io_complete; 1120 1121 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC); 1122 if (unlikely(ret)) { 1123 usb_ep_free_request(ep->ep, req); 1124 goto error_lock; 1125 } 1126 1127 ret = -EIOCBQUEUED; 1128 /* 1129 * Do not kfree the buffer in this function. It will be freed 1130 * by ffs_user_copy_worker. 1131 */ 1132 data = NULL; 1133 } 1134 1135 error_lock: 1136 spin_unlock_irq(&epfile->ffs->eps_lock); 1137 error_mutex: 1138 mutex_unlock(&epfile->mutex); 1139 error: 1140 if (ret != -EIOCBQUEUED) /* don't free if there is iocb queued */ 1141 ffs_free_buffer(io_data); 1142 return ret; 1143 } 1144 1145 static int 1146 ffs_epfile_open(struct inode *inode, struct file *file) 1147 { 1148 struct ffs_epfile *epfile = inode->i_private; 1149 1150 ENTER(); 1151 1152 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE)) 1153 return -ENODEV; 1154 1155 file->private_data = epfile; 1156 ffs_data_opened(epfile->ffs); 1157 1158 return 0; 1159 } 1160 1161 static int ffs_aio_cancel(struct kiocb *kiocb) 1162 { 1163 struct ffs_io_data *io_data = kiocb->private; 1164 struct ffs_epfile *epfile = kiocb->ki_filp->private_data; 1165 int value; 1166 1167 ENTER(); 1168 1169 spin_lock_irq(&epfile->ffs->eps_lock); 1170 1171 if (likely(io_data && io_data->ep && io_data->req)) 1172 value = usb_ep_dequeue(io_data->ep, io_data->req); 1173 else 1174 value = -EINVAL; 1175 1176 spin_unlock_irq(&epfile->ffs->eps_lock); 1177 1178 return value; 1179 } 1180 1181 static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from) 1182 { 1183 struct ffs_io_data io_data, *p = &io_data; 1184 ssize_t res; 1185 1186 ENTER(); 1187 1188 if (!is_sync_kiocb(kiocb)) { 1189 p = kzalloc(sizeof(io_data), GFP_KERNEL); 1190 if (unlikely(!p)) 1191 return -ENOMEM; 1192 p->aio = true; 1193 } else { 1194 memset(p, 0, sizeof(*p)); 1195 p->aio = false; 1196 } 1197 1198 p->read = false; 1199 p->kiocb = kiocb; 1200 p->data = *from; 1201 p->mm = current->mm; 1202 1203 kiocb->private = p; 1204 1205 if (p->aio) 1206 kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); 1207 1208 res = ffs_epfile_io(kiocb->ki_filp, p); 1209 if (res == -EIOCBQUEUED) 1210 return res; 1211 if (p->aio) 1212 kfree(p); 1213 else 1214 *from = p->data; 1215 return res; 1216 } 1217 1218 static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to) 1219 { 1220 struct ffs_io_data io_data, *p = &io_data; 1221 ssize_t res; 1222 1223 ENTER(); 1224 1225 if (!is_sync_kiocb(kiocb)) { 1226 p = kzalloc(sizeof(io_data), GFP_KERNEL); 1227 if (unlikely(!p)) 1228 return -ENOMEM; 1229 p->aio = true; 1230 } else { 1231 memset(p, 0, sizeof(*p)); 1232 p->aio = false; 1233 } 1234 1235 p->read = true; 1236 p->kiocb = kiocb; 1237 if (p->aio) { 1238 p->to_free = dup_iter(&p->data, to, GFP_KERNEL); 1239 if (!p->to_free) { 1240 kfree(p); 1241 return -ENOMEM; 1242 } 1243 } else { 1244 p->data = *to; 1245 p->to_free = NULL; 1246 } 1247 p->mm = current->mm; 1248 1249 kiocb->private = p; 1250 1251 if (p->aio) 1252 kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); 1253 1254 res = ffs_epfile_io(kiocb->ki_filp, p); 1255 if (res == -EIOCBQUEUED) 1256 return res; 1257 1258 if (p->aio) { 1259 kfree(p->to_free); 1260 kfree(p); 1261 } else { 1262 *to = p->data; 1263 } 1264 return res; 1265 } 1266 1267 static int 1268 ffs_epfile_release(struct inode *inode, struct file *file) 1269 { 1270 struct ffs_epfile *epfile = inode->i_private; 1271 1272 ENTER(); 1273 1274 __ffs_epfile_read_buffer_free(epfile); 1275 ffs_data_closed(epfile->ffs); 1276 1277 return 0; 1278 } 1279 1280 static long ffs_epfile_ioctl(struct file *file, unsigned code, 1281 unsigned long value) 1282 { 1283 struct ffs_epfile *epfile = file->private_data; 1284 struct ffs_ep *ep; 1285 int ret; 1286 1287 ENTER(); 1288 1289 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE)) 1290 return -ENODEV; 1291 1292 /* Wait for endpoint to be enabled */ 1293 ep = epfile->ep; 1294 if (!ep) { 1295 if (file->f_flags & O_NONBLOCK) 1296 return -EAGAIN; 1297 1298 ret = wait_event_interruptible( 1299 epfile->ffs->wait, (ep = epfile->ep)); 1300 if (ret) 1301 return -EINTR; 1302 } 1303 1304 spin_lock_irq(&epfile->ffs->eps_lock); 1305 1306 /* In the meantime, endpoint got disabled or changed. */ 1307 if (epfile->ep != ep) { 1308 spin_unlock_irq(&epfile->ffs->eps_lock); 1309 return -ESHUTDOWN; 1310 } 1311 1312 switch (code) { 1313 case FUNCTIONFS_FIFO_STATUS: 1314 ret = usb_ep_fifo_status(epfile->ep->ep); 1315 break; 1316 case FUNCTIONFS_FIFO_FLUSH: 1317 usb_ep_fifo_flush(epfile->ep->ep); 1318 ret = 0; 1319 break; 1320 case FUNCTIONFS_CLEAR_HALT: 1321 ret = usb_ep_clear_halt(epfile->ep->ep); 1322 break; 1323 case FUNCTIONFS_ENDPOINT_REVMAP: 1324 ret = epfile->ep->num; 1325 break; 1326 case FUNCTIONFS_ENDPOINT_DESC: 1327 { 1328 int desc_idx; 1329 struct usb_endpoint_descriptor *desc; 1330 1331 switch (epfile->ffs->gadget->speed) { 1332 case USB_SPEED_SUPER: 1333 desc_idx = 2; 1334 break; 1335 case USB_SPEED_HIGH: 1336 desc_idx = 1; 1337 break; 1338 default: 1339 desc_idx = 0; 1340 } 1341 desc = epfile->ep->descs[desc_idx]; 1342 1343 spin_unlock_irq(&epfile->ffs->eps_lock); 1344 ret = copy_to_user((void __user *)value, desc, desc->bLength); 1345 if (ret) 1346 ret = -EFAULT; 1347 return ret; 1348 } 1349 default: 1350 ret = -ENOTTY; 1351 } 1352 spin_unlock_irq(&epfile->ffs->eps_lock); 1353 1354 return ret; 1355 } 1356 1357 static const struct file_operations ffs_epfile_operations = { 1358 .llseek = no_llseek, 1359 1360 .open = ffs_epfile_open, 1361 .write_iter = ffs_epfile_write_iter, 1362 .read_iter = ffs_epfile_read_iter, 1363 .release = ffs_epfile_release, 1364 .unlocked_ioctl = ffs_epfile_ioctl, 1365 .compat_ioctl = compat_ptr_ioctl, 1366 }; 1367 1368 1369 /* File system and super block operations ***********************************/ 1370 1371 /* 1372 * Mounting the file system creates a controller file, used first for 1373 * function configuration then later for event monitoring. 1374 */ 1375 1376 static struct inode *__must_check 1377 ffs_sb_make_inode(struct super_block *sb, void *data, 1378 const struct file_operations *fops, 1379 const struct inode_operations *iops, 1380 struct ffs_file_perms *perms) 1381 { 1382 struct inode *inode; 1383 1384 ENTER(); 1385 1386 inode = new_inode(sb); 1387 1388 if (likely(inode)) { 1389 struct timespec64 ts = current_time(inode); 1390 1391 inode->i_ino = get_next_ino(); 1392 inode->i_mode = perms->mode; 1393 inode->i_uid = perms->uid; 1394 inode->i_gid = perms->gid; 1395 inode->i_atime = ts; 1396 inode->i_mtime = ts; 1397 inode->i_ctime = ts; 1398 inode->i_private = data; 1399 if (fops) 1400 inode->i_fop = fops; 1401 if (iops) 1402 inode->i_op = iops; 1403 } 1404 1405 return inode; 1406 } 1407 1408 /* Create "regular" file */ 1409 static struct dentry *ffs_sb_create_file(struct super_block *sb, 1410 const char *name, void *data, 1411 const struct file_operations *fops) 1412 { 1413 struct ffs_data *ffs = sb->s_fs_info; 1414 struct dentry *dentry; 1415 struct inode *inode; 1416 1417 ENTER(); 1418 1419 dentry = d_alloc_name(sb->s_root, name); 1420 if (unlikely(!dentry)) 1421 return NULL; 1422 1423 inode = ffs_sb_make_inode(sb, data, fops, NULL, &ffs->file_perms); 1424 if (unlikely(!inode)) { 1425 dput(dentry); 1426 return NULL; 1427 } 1428 1429 d_add(dentry, inode); 1430 return dentry; 1431 } 1432 1433 /* Super block */ 1434 static const struct super_operations ffs_sb_operations = { 1435 .statfs = simple_statfs, 1436 .drop_inode = generic_delete_inode, 1437 }; 1438 1439 struct ffs_sb_fill_data { 1440 struct ffs_file_perms perms; 1441 umode_t root_mode; 1442 const char *dev_name; 1443 bool no_disconnect; 1444 struct ffs_data *ffs_data; 1445 }; 1446 1447 static int ffs_sb_fill(struct super_block *sb, struct fs_context *fc) 1448 { 1449 struct ffs_sb_fill_data *data = fc->fs_private; 1450 struct inode *inode; 1451 struct ffs_data *ffs = data->ffs_data; 1452 1453 ENTER(); 1454 1455 ffs->sb = sb; 1456 data->ffs_data = NULL; 1457 sb->s_fs_info = ffs; 1458 sb->s_blocksize = PAGE_SIZE; 1459 sb->s_blocksize_bits = PAGE_SHIFT; 1460 sb->s_magic = FUNCTIONFS_MAGIC; 1461 sb->s_op = &ffs_sb_operations; 1462 sb->s_time_gran = 1; 1463 1464 /* Root inode */ 1465 data->perms.mode = data->root_mode; 1466 inode = ffs_sb_make_inode(sb, NULL, 1467 &simple_dir_operations, 1468 &simple_dir_inode_operations, 1469 &data->perms); 1470 sb->s_root = d_make_root(inode); 1471 if (unlikely(!sb->s_root)) 1472 return -ENOMEM; 1473 1474 /* EP0 file */ 1475 if (unlikely(!ffs_sb_create_file(sb, "ep0", ffs, 1476 &ffs_ep0_operations))) 1477 return -ENOMEM; 1478 1479 return 0; 1480 } 1481 1482 enum { 1483 Opt_no_disconnect, 1484 Opt_rmode, 1485 Opt_fmode, 1486 Opt_mode, 1487 Opt_uid, 1488 Opt_gid, 1489 }; 1490 1491 static const struct fs_parameter_spec ffs_fs_param_specs[] = { 1492 fsparam_bool ("no_disconnect", Opt_no_disconnect), 1493 fsparam_u32 ("rmode", Opt_rmode), 1494 fsparam_u32 ("fmode", Opt_fmode), 1495 fsparam_u32 ("mode", Opt_mode), 1496 fsparam_u32 ("uid", Opt_uid), 1497 fsparam_u32 ("gid", Opt_gid), 1498 {} 1499 }; 1500 1501 static const struct fs_parameter_description ffs_fs_fs_parameters = { 1502 .name = "kAFS", 1503 .specs = ffs_fs_param_specs, 1504 }; 1505 1506 static int ffs_fs_parse_param(struct fs_context *fc, struct fs_parameter *param) 1507 { 1508 struct ffs_sb_fill_data *data = fc->fs_private; 1509 struct fs_parse_result result; 1510 int opt; 1511 1512 ENTER(); 1513 1514 opt = fs_parse(fc, &ffs_fs_fs_parameters, param, &result); 1515 if (opt < 0) 1516 return opt; 1517 1518 switch (opt) { 1519 case Opt_no_disconnect: 1520 data->no_disconnect = result.boolean; 1521 break; 1522 case Opt_rmode: 1523 data->root_mode = (result.uint_32 & 0555) | S_IFDIR; 1524 break; 1525 case Opt_fmode: 1526 data->perms.mode = (result.uint_32 & 0666) | S_IFREG; 1527 break; 1528 case Opt_mode: 1529 data->root_mode = (result.uint_32 & 0555) | S_IFDIR; 1530 data->perms.mode = (result.uint_32 & 0666) | S_IFREG; 1531 break; 1532 1533 case Opt_uid: 1534 data->perms.uid = make_kuid(current_user_ns(), result.uint_32); 1535 if (!uid_valid(data->perms.uid)) 1536 goto unmapped_value; 1537 break; 1538 case Opt_gid: 1539 data->perms.gid = make_kgid(current_user_ns(), result.uint_32); 1540 if (!gid_valid(data->perms.gid)) 1541 goto unmapped_value; 1542 break; 1543 1544 default: 1545 return -ENOPARAM; 1546 } 1547 1548 return 0; 1549 1550 unmapped_value: 1551 return invalf(fc, "%s: unmapped value: %u", param->key, result.uint_32); 1552 } 1553 1554 /* 1555 * Set up the superblock for a mount. 1556 */ 1557 static int ffs_fs_get_tree(struct fs_context *fc) 1558 { 1559 struct ffs_sb_fill_data *ctx = fc->fs_private; 1560 void *ffs_dev; 1561 struct ffs_data *ffs; 1562 1563 ENTER(); 1564 1565 if (!fc->source) 1566 return invalf(fc, "No source specified"); 1567 1568 ffs = ffs_data_new(fc->source); 1569 if (unlikely(!ffs)) 1570 return -ENOMEM; 1571 ffs->file_perms = ctx->perms; 1572 ffs->no_disconnect = ctx->no_disconnect; 1573 1574 ffs->dev_name = kstrdup(fc->source, GFP_KERNEL); 1575 if (unlikely(!ffs->dev_name)) { 1576 ffs_data_put(ffs); 1577 return -ENOMEM; 1578 } 1579 1580 ffs_dev = ffs_acquire_dev(ffs->dev_name); 1581 if (IS_ERR(ffs_dev)) { 1582 ffs_data_put(ffs); 1583 return PTR_ERR(ffs_dev); 1584 } 1585 1586 ffs->private_data = ffs_dev; 1587 ctx->ffs_data = ffs; 1588 return get_tree_nodev(fc, ffs_sb_fill); 1589 } 1590 1591 static void ffs_fs_free_fc(struct fs_context *fc) 1592 { 1593 struct ffs_sb_fill_data *ctx = fc->fs_private; 1594 1595 if (ctx) { 1596 if (ctx->ffs_data) { 1597 ffs_release_dev(ctx->ffs_data); 1598 ffs_data_put(ctx->ffs_data); 1599 } 1600 1601 kfree(ctx); 1602 } 1603 } 1604 1605 static const struct fs_context_operations ffs_fs_context_ops = { 1606 .free = ffs_fs_free_fc, 1607 .parse_param = ffs_fs_parse_param, 1608 .get_tree = ffs_fs_get_tree, 1609 }; 1610 1611 static int ffs_fs_init_fs_context(struct fs_context *fc) 1612 { 1613 struct ffs_sb_fill_data *ctx; 1614 1615 ctx = kzalloc(sizeof(struct ffs_sb_fill_data), GFP_KERNEL); 1616 if (!ctx) 1617 return -ENOMEM; 1618 1619 ctx->perms.mode = S_IFREG | 0600; 1620 ctx->perms.uid = GLOBAL_ROOT_UID; 1621 ctx->perms.gid = GLOBAL_ROOT_GID; 1622 ctx->root_mode = S_IFDIR | 0500; 1623 ctx->no_disconnect = false; 1624 1625 fc->fs_private = ctx; 1626 fc->ops = &ffs_fs_context_ops; 1627 return 0; 1628 } 1629 1630 static void 1631 ffs_fs_kill_sb(struct super_block *sb) 1632 { 1633 ENTER(); 1634 1635 kill_litter_super(sb); 1636 if (sb->s_fs_info) { 1637 ffs_release_dev(sb->s_fs_info); 1638 ffs_data_closed(sb->s_fs_info); 1639 } 1640 } 1641 1642 static struct file_system_type ffs_fs_type = { 1643 .owner = THIS_MODULE, 1644 .name = "functionfs", 1645 .init_fs_context = ffs_fs_init_fs_context, 1646 .parameters = &ffs_fs_fs_parameters, 1647 .kill_sb = ffs_fs_kill_sb, 1648 }; 1649 MODULE_ALIAS_FS("functionfs"); 1650 1651 1652 /* Driver's main init/cleanup functions *************************************/ 1653 1654 static int functionfs_init(void) 1655 { 1656 int ret; 1657 1658 ENTER(); 1659 1660 ret = register_filesystem(&ffs_fs_type); 1661 if (likely(!ret)) 1662 pr_info("file system registered\n"); 1663 else 1664 pr_err("failed registering file system (%d)\n", ret); 1665 1666 return ret; 1667 } 1668 1669 static void functionfs_cleanup(void) 1670 { 1671 ENTER(); 1672 1673 pr_info("unloading\n"); 1674 unregister_filesystem(&ffs_fs_type); 1675 } 1676 1677 1678 /* ffs_data and ffs_function construction and destruction code **************/ 1679 1680 static void ffs_data_clear(struct ffs_data *ffs); 1681 static void ffs_data_reset(struct ffs_data *ffs); 1682 1683 static void ffs_data_get(struct ffs_data *ffs) 1684 { 1685 ENTER(); 1686 1687 refcount_inc(&ffs->ref); 1688 } 1689 1690 static void ffs_data_opened(struct ffs_data *ffs) 1691 { 1692 ENTER(); 1693 1694 refcount_inc(&ffs->ref); 1695 if (atomic_add_return(1, &ffs->opened) == 1 && 1696 ffs->state == FFS_DEACTIVATED) { 1697 ffs->state = FFS_CLOSING; 1698 ffs_data_reset(ffs); 1699 } 1700 } 1701 1702 static void ffs_data_put(struct ffs_data *ffs) 1703 { 1704 ENTER(); 1705 1706 if (unlikely(refcount_dec_and_test(&ffs->ref))) { 1707 pr_info("%s(): freeing\n", __func__); 1708 ffs_data_clear(ffs); 1709 BUG_ON(waitqueue_active(&ffs->ev.waitq) || 1710 waitqueue_active(&ffs->ep0req_completion.wait) || 1711 waitqueue_active(&ffs->wait)); 1712 destroy_workqueue(ffs->io_completion_wq); 1713 kfree(ffs->dev_name); 1714 kfree(ffs); 1715 } 1716 } 1717 1718 static void ffs_data_closed(struct ffs_data *ffs) 1719 { 1720 ENTER(); 1721 1722 if (atomic_dec_and_test(&ffs->opened)) { 1723 if (ffs->no_disconnect) { 1724 ffs->state = FFS_DEACTIVATED; 1725 if (ffs->epfiles) { 1726 ffs_epfiles_destroy(ffs->epfiles, 1727 ffs->eps_count); 1728 ffs->epfiles = NULL; 1729 } 1730 if (ffs->setup_state == FFS_SETUP_PENDING) 1731 __ffs_ep0_stall(ffs); 1732 } else { 1733 ffs->state = FFS_CLOSING; 1734 ffs_data_reset(ffs); 1735 } 1736 } 1737 if (atomic_read(&ffs->opened) < 0) { 1738 ffs->state = FFS_CLOSING; 1739 ffs_data_reset(ffs); 1740 } 1741 1742 ffs_data_put(ffs); 1743 } 1744 1745 static struct ffs_data *ffs_data_new(const char *dev_name) 1746 { 1747 struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL); 1748 if (unlikely(!ffs)) 1749 return NULL; 1750 1751 ENTER(); 1752 1753 ffs->io_completion_wq = alloc_ordered_workqueue("%s", 0, dev_name); 1754 if (!ffs->io_completion_wq) { 1755 kfree(ffs); 1756 return NULL; 1757 } 1758 1759 refcount_set(&ffs->ref, 1); 1760 atomic_set(&ffs->opened, 0); 1761 ffs->state = FFS_READ_DESCRIPTORS; 1762 mutex_init(&ffs->mutex); 1763 spin_lock_init(&ffs->eps_lock); 1764 init_waitqueue_head(&ffs->ev.waitq); 1765 init_waitqueue_head(&ffs->wait); 1766 init_completion(&ffs->ep0req_completion); 1767 1768 /* XXX REVISIT need to update it in some places, or do we? */ 1769 ffs->ev.can_stall = 1; 1770 1771 return ffs; 1772 } 1773 1774 static void ffs_data_clear(struct ffs_data *ffs) 1775 { 1776 ENTER(); 1777 1778 ffs_closed(ffs); 1779 1780 BUG_ON(ffs->gadget); 1781 1782 if (ffs->epfiles) 1783 ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count); 1784 1785 if (ffs->ffs_eventfd) 1786 eventfd_ctx_put(ffs->ffs_eventfd); 1787 1788 kfree(ffs->raw_descs_data); 1789 kfree(ffs->raw_strings); 1790 kfree(ffs->stringtabs); 1791 } 1792 1793 static void ffs_data_reset(struct ffs_data *ffs) 1794 { 1795 ENTER(); 1796 1797 ffs_data_clear(ffs); 1798 1799 ffs->epfiles = NULL; 1800 ffs->raw_descs_data = NULL; 1801 ffs->raw_descs = NULL; 1802 ffs->raw_strings = NULL; 1803 ffs->stringtabs = NULL; 1804 1805 ffs->raw_descs_length = 0; 1806 ffs->fs_descs_count = 0; 1807 ffs->hs_descs_count = 0; 1808 ffs->ss_descs_count = 0; 1809 1810 ffs->strings_count = 0; 1811 ffs->interfaces_count = 0; 1812 ffs->eps_count = 0; 1813 1814 ffs->ev.count = 0; 1815 1816 ffs->state = FFS_READ_DESCRIPTORS; 1817 ffs->setup_state = FFS_NO_SETUP; 1818 ffs->flags = 0; 1819 } 1820 1821 1822 static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev) 1823 { 1824 struct usb_gadget_strings **lang; 1825 int first_id; 1826 1827 ENTER(); 1828 1829 if (WARN_ON(ffs->state != FFS_ACTIVE 1830 || test_and_set_bit(FFS_FL_BOUND, &ffs->flags))) 1831 return -EBADFD; 1832 1833 first_id = usb_string_ids_n(cdev, ffs->strings_count); 1834 if (unlikely(first_id < 0)) 1835 return first_id; 1836 1837 ffs->ep0req = usb_ep_alloc_request(cdev->gadget->ep0, GFP_KERNEL); 1838 if (unlikely(!ffs->ep0req)) 1839 return -ENOMEM; 1840 ffs->ep0req->complete = ffs_ep0_complete; 1841 ffs->ep0req->context = ffs; 1842 1843 lang = ffs->stringtabs; 1844 if (lang) { 1845 for (; *lang; ++lang) { 1846 struct usb_string *str = (*lang)->strings; 1847 int id = first_id; 1848 for (; str->s; ++id, ++str) 1849 str->id = id; 1850 } 1851 } 1852 1853 ffs->gadget = cdev->gadget; 1854 ffs_data_get(ffs); 1855 return 0; 1856 } 1857 1858 static void functionfs_unbind(struct ffs_data *ffs) 1859 { 1860 ENTER(); 1861 1862 if (!WARN_ON(!ffs->gadget)) { 1863 usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req); 1864 ffs->ep0req = NULL; 1865 ffs->gadget = NULL; 1866 clear_bit(FFS_FL_BOUND, &ffs->flags); 1867 ffs_data_put(ffs); 1868 } 1869 } 1870 1871 static int ffs_epfiles_create(struct ffs_data *ffs) 1872 { 1873 struct ffs_epfile *epfile, *epfiles; 1874 unsigned i, count; 1875 1876 ENTER(); 1877 1878 count = ffs->eps_count; 1879 epfiles = kcalloc(count, sizeof(*epfiles), GFP_KERNEL); 1880 if (!epfiles) 1881 return -ENOMEM; 1882 1883 epfile = epfiles; 1884 for (i = 1; i <= count; ++i, ++epfile) { 1885 epfile->ffs = ffs; 1886 mutex_init(&epfile->mutex); 1887 if (ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR) 1888 sprintf(epfile->name, "ep%02x", ffs->eps_addrmap[i]); 1889 else 1890 sprintf(epfile->name, "ep%u", i); 1891 epfile->dentry = ffs_sb_create_file(ffs->sb, epfile->name, 1892 epfile, 1893 &ffs_epfile_operations); 1894 if (unlikely(!epfile->dentry)) { 1895 ffs_epfiles_destroy(epfiles, i - 1); 1896 return -ENOMEM; 1897 } 1898 } 1899 1900 ffs->epfiles = epfiles; 1901 return 0; 1902 } 1903 1904 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count) 1905 { 1906 struct ffs_epfile *epfile = epfiles; 1907 1908 ENTER(); 1909 1910 for (; count; --count, ++epfile) { 1911 BUG_ON(mutex_is_locked(&epfile->mutex)); 1912 if (epfile->dentry) { 1913 d_delete(epfile->dentry); 1914 dput(epfile->dentry); 1915 epfile->dentry = NULL; 1916 } 1917 } 1918 1919 kfree(epfiles); 1920 } 1921 1922 static void ffs_func_eps_disable(struct ffs_function *func) 1923 { 1924 struct ffs_ep *ep = func->eps; 1925 struct ffs_epfile *epfile = func->ffs->epfiles; 1926 unsigned count = func->ffs->eps_count; 1927 unsigned long flags; 1928 1929 spin_lock_irqsave(&func->ffs->eps_lock, flags); 1930 while (count--) { 1931 /* pending requests get nuked */ 1932 if (likely(ep->ep)) 1933 usb_ep_disable(ep->ep); 1934 ++ep; 1935 1936 if (epfile) { 1937 epfile->ep = NULL; 1938 __ffs_epfile_read_buffer_free(epfile); 1939 ++epfile; 1940 } 1941 } 1942 spin_unlock_irqrestore(&func->ffs->eps_lock, flags); 1943 } 1944 1945 static int ffs_func_eps_enable(struct ffs_function *func) 1946 { 1947 struct ffs_data *ffs = func->ffs; 1948 struct ffs_ep *ep = func->eps; 1949 struct ffs_epfile *epfile = ffs->epfiles; 1950 unsigned count = ffs->eps_count; 1951 unsigned long flags; 1952 int ret = 0; 1953 1954 spin_lock_irqsave(&func->ffs->eps_lock, flags); 1955 while(count--) { 1956 ep->ep->driver_data = ep; 1957 1958 ret = config_ep_by_speed(func->gadget, &func->function, ep->ep); 1959 if (ret) { 1960 pr_err("%s: config_ep_by_speed(%s) returned %d\n", 1961 __func__, ep->ep->name, ret); 1962 break; 1963 } 1964 1965 ret = usb_ep_enable(ep->ep); 1966 if (likely(!ret)) { 1967 epfile->ep = ep; 1968 epfile->in = usb_endpoint_dir_in(ep->ep->desc); 1969 epfile->isoc = usb_endpoint_xfer_isoc(ep->ep->desc); 1970 } else { 1971 break; 1972 } 1973 1974 ++ep; 1975 ++epfile; 1976 } 1977 1978 wake_up_interruptible(&ffs->wait); 1979 spin_unlock_irqrestore(&func->ffs->eps_lock, flags); 1980 1981 return ret; 1982 } 1983 1984 1985 /* Parsing and building descriptors and strings *****************************/ 1986 1987 /* 1988 * This validates if data pointed by data is a valid USB descriptor as 1989 * well as record how many interfaces, endpoints and strings are 1990 * required by given configuration. Returns address after the 1991 * descriptor or NULL if data is invalid. 1992 */ 1993 1994 enum ffs_entity_type { 1995 FFS_DESCRIPTOR, FFS_INTERFACE, FFS_STRING, FFS_ENDPOINT 1996 }; 1997 1998 enum ffs_os_desc_type { 1999 FFS_OS_DESC, FFS_OS_DESC_EXT_COMPAT, FFS_OS_DESC_EXT_PROP 2000 }; 2001 2002 typedef int (*ffs_entity_callback)(enum ffs_entity_type entity, 2003 u8 *valuep, 2004 struct usb_descriptor_header *desc, 2005 void *priv); 2006 2007 typedef int (*ffs_os_desc_callback)(enum ffs_os_desc_type entity, 2008 struct usb_os_desc_header *h, void *data, 2009 unsigned len, void *priv); 2010 2011 static int __must_check ffs_do_single_desc(char *data, unsigned len, 2012 ffs_entity_callback entity, 2013 void *priv, int *current_class) 2014 { 2015 struct usb_descriptor_header *_ds = (void *)data; 2016 u8 length; 2017 int ret; 2018 2019 ENTER(); 2020 2021 /* At least two bytes are required: length and type */ 2022 if (len < 2) { 2023 pr_vdebug("descriptor too short\n"); 2024 return -EINVAL; 2025 } 2026 2027 /* If we have at least as many bytes as the descriptor takes? */ 2028 length = _ds->bLength; 2029 if (len < length) { 2030 pr_vdebug("descriptor longer then available data\n"); 2031 return -EINVAL; 2032 } 2033 2034 #define __entity_check_INTERFACE(val) 1 2035 #define __entity_check_STRING(val) (val) 2036 #define __entity_check_ENDPOINT(val) ((val) & USB_ENDPOINT_NUMBER_MASK) 2037 #define __entity(type, val) do { \ 2038 pr_vdebug("entity " #type "(%02x)\n", (val)); \ 2039 if (unlikely(!__entity_check_ ##type(val))) { \ 2040 pr_vdebug("invalid entity's value\n"); \ 2041 return -EINVAL; \ 2042 } \ 2043 ret = entity(FFS_ ##type, &val, _ds, priv); \ 2044 if (unlikely(ret < 0)) { \ 2045 pr_debug("entity " #type "(%02x); ret = %d\n", \ 2046 (val), ret); \ 2047 return ret; \ 2048 } \ 2049 } while (0) 2050 2051 /* Parse descriptor depending on type. */ 2052 switch (_ds->bDescriptorType) { 2053 case USB_DT_DEVICE: 2054 case USB_DT_CONFIG: 2055 case USB_DT_STRING: 2056 case USB_DT_DEVICE_QUALIFIER: 2057 /* function can't have any of those */ 2058 pr_vdebug("descriptor reserved for gadget: %d\n", 2059 _ds->bDescriptorType); 2060 return -EINVAL; 2061 2062 case USB_DT_INTERFACE: { 2063 struct usb_interface_descriptor *ds = (void *)_ds; 2064 pr_vdebug("interface descriptor\n"); 2065 if (length != sizeof *ds) 2066 goto inv_length; 2067 2068 __entity(INTERFACE, ds->bInterfaceNumber); 2069 if (ds->iInterface) 2070 __entity(STRING, ds->iInterface); 2071 *current_class = ds->bInterfaceClass; 2072 } 2073 break; 2074 2075 case USB_DT_ENDPOINT: { 2076 struct usb_endpoint_descriptor *ds = (void *)_ds; 2077 pr_vdebug("endpoint descriptor\n"); 2078 if (length != USB_DT_ENDPOINT_SIZE && 2079 length != USB_DT_ENDPOINT_AUDIO_SIZE) 2080 goto inv_length; 2081 __entity(ENDPOINT, ds->bEndpointAddress); 2082 } 2083 break; 2084 2085 case USB_TYPE_CLASS | 0x01: 2086 if (*current_class == USB_INTERFACE_CLASS_HID) { 2087 pr_vdebug("hid descriptor\n"); 2088 if (length != sizeof(struct hid_descriptor)) 2089 goto inv_length; 2090 break; 2091 } else if (*current_class == USB_INTERFACE_CLASS_CCID) { 2092 pr_vdebug("ccid descriptor\n"); 2093 if (length != sizeof(struct ccid_descriptor)) 2094 goto inv_length; 2095 break; 2096 } else { 2097 pr_vdebug("unknown descriptor: %d for class %d\n", 2098 _ds->bDescriptorType, *current_class); 2099 return -EINVAL; 2100 } 2101 2102 case USB_DT_OTG: 2103 if (length != sizeof(struct usb_otg_descriptor)) 2104 goto inv_length; 2105 break; 2106 2107 case USB_DT_INTERFACE_ASSOCIATION: { 2108 struct usb_interface_assoc_descriptor *ds = (void *)_ds; 2109 pr_vdebug("interface association descriptor\n"); 2110 if (length != sizeof *ds) 2111 goto inv_length; 2112 if (ds->iFunction) 2113 __entity(STRING, ds->iFunction); 2114 } 2115 break; 2116 2117 case USB_DT_SS_ENDPOINT_COMP: 2118 pr_vdebug("EP SS companion descriptor\n"); 2119 if (length != sizeof(struct usb_ss_ep_comp_descriptor)) 2120 goto inv_length; 2121 break; 2122 2123 case USB_DT_OTHER_SPEED_CONFIG: 2124 case USB_DT_INTERFACE_POWER: 2125 case USB_DT_DEBUG: 2126 case USB_DT_SECURITY: 2127 case USB_DT_CS_RADIO_CONTROL: 2128 /* TODO */ 2129 pr_vdebug("unimplemented descriptor: %d\n", _ds->bDescriptorType); 2130 return -EINVAL; 2131 2132 default: 2133 /* We should never be here */ 2134 pr_vdebug("unknown descriptor: %d\n", _ds->bDescriptorType); 2135 return -EINVAL; 2136 2137 inv_length: 2138 pr_vdebug("invalid length: %d (descriptor %d)\n", 2139 _ds->bLength, _ds->bDescriptorType); 2140 return -EINVAL; 2141 } 2142 2143 #undef __entity 2144 #undef __entity_check_DESCRIPTOR 2145 #undef __entity_check_INTERFACE 2146 #undef __entity_check_STRING 2147 #undef __entity_check_ENDPOINT 2148 2149 return length; 2150 } 2151 2152 static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len, 2153 ffs_entity_callback entity, void *priv) 2154 { 2155 const unsigned _len = len; 2156 unsigned long num = 0; 2157 int current_class = -1; 2158 2159 ENTER(); 2160 2161 for (;;) { 2162 int ret; 2163 2164 if (num == count) 2165 data = NULL; 2166 2167 /* Record "descriptor" entity */ 2168 ret = entity(FFS_DESCRIPTOR, (u8 *)num, (void *)data, priv); 2169 if (unlikely(ret < 0)) { 2170 pr_debug("entity DESCRIPTOR(%02lx); ret = %d\n", 2171 num, ret); 2172 return ret; 2173 } 2174 2175 if (!data) 2176 return _len - len; 2177 2178 ret = ffs_do_single_desc(data, len, entity, priv, 2179 ¤t_class); 2180 if (unlikely(ret < 0)) { 2181 pr_debug("%s returns %d\n", __func__, ret); 2182 return ret; 2183 } 2184 2185 len -= ret; 2186 data += ret; 2187 ++num; 2188 } 2189 } 2190 2191 static int __ffs_data_do_entity(enum ffs_entity_type type, 2192 u8 *valuep, struct usb_descriptor_header *desc, 2193 void *priv) 2194 { 2195 struct ffs_desc_helper *helper = priv; 2196 struct usb_endpoint_descriptor *d; 2197 2198 ENTER(); 2199 2200 switch (type) { 2201 case FFS_DESCRIPTOR: 2202 break; 2203 2204 case FFS_INTERFACE: 2205 /* 2206 * Interfaces are indexed from zero so if we 2207 * encountered interface "n" then there are at least 2208 * "n+1" interfaces. 2209 */ 2210 if (*valuep >= helper->interfaces_count) 2211 helper->interfaces_count = *valuep + 1; 2212 break; 2213 2214 case FFS_STRING: 2215 /* 2216 * Strings are indexed from 1 (0 is reserved 2217 * for languages list) 2218 */ 2219 if (*valuep > helper->ffs->strings_count) 2220 helper->ffs->strings_count = *valuep; 2221 break; 2222 2223 case FFS_ENDPOINT: 2224 d = (void *)desc; 2225 helper->eps_count++; 2226 if (helper->eps_count >= FFS_MAX_EPS_COUNT) 2227 return -EINVAL; 2228 /* Check if descriptors for any speed were already parsed */ 2229 if (!helper->ffs->eps_count && !helper->ffs->interfaces_count) 2230 helper->ffs->eps_addrmap[helper->eps_count] = 2231 d->bEndpointAddress; 2232 else if (helper->ffs->eps_addrmap[helper->eps_count] != 2233 d->bEndpointAddress) 2234 return -EINVAL; 2235 break; 2236 } 2237 2238 return 0; 2239 } 2240 2241 static int __ffs_do_os_desc_header(enum ffs_os_desc_type *next_type, 2242 struct usb_os_desc_header *desc) 2243 { 2244 u16 bcd_version = le16_to_cpu(desc->bcdVersion); 2245 u16 w_index = le16_to_cpu(desc->wIndex); 2246 2247 if (bcd_version != 1) { 2248 pr_vdebug("unsupported os descriptors version: %d", 2249 bcd_version); 2250 return -EINVAL; 2251 } 2252 switch (w_index) { 2253 case 0x4: 2254 *next_type = FFS_OS_DESC_EXT_COMPAT; 2255 break; 2256 case 0x5: 2257 *next_type = FFS_OS_DESC_EXT_PROP; 2258 break; 2259 default: 2260 pr_vdebug("unsupported os descriptor type: %d", w_index); 2261 return -EINVAL; 2262 } 2263 2264 return sizeof(*desc); 2265 } 2266 2267 /* 2268 * Process all extended compatibility/extended property descriptors 2269 * of a feature descriptor 2270 */ 2271 static int __must_check ffs_do_single_os_desc(char *data, unsigned len, 2272 enum ffs_os_desc_type type, 2273 u16 feature_count, 2274 ffs_os_desc_callback entity, 2275 void *priv, 2276 struct usb_os_desc_header *h) 2277 { 2278 int ret; 2279 const unsigned _len = len; 2280 2281 ENTER(); 2282 2283 /* loop over all ext compat/ext prop descriptors */ 2284 while (feature_count--) { 2285 ret = entity(type, h, data, len, priv); 2286 if (unlikely(ret < 0)) { 2287 pr_debug("bad OS descriptor, type: %d\n", type); 2288 return ret; 2289 } 2290 data += ret; 2291 len -= ret; 2292 } 2293 return _len - len; 2294 } 2295 2296 /* Process a number of complete Feature Descriptors (Ext Compat or Ext Prop) */ 2297 static int __must_check ffs_do_os_descs(unsigned count, 2298 char *data, unsigned len, 2299 ffs_os_desc_callback entity, void *priv) 2300 { 2301 const unsigned _len = len; 2302 unsigned long num = 0; 2303 2304 ENTER(); 2305 2306 for (num = 0; num < count; ++num) { 2307 int ret; 2308 enum ffs_os_desc_type type; 2309 u16 feature_count; 2310 struct usb_os_desc_header *desc = (void *)data; 2311 2312 if (len < sizeof(*desc)) 2313 return -EINVAL; 2314 2315 /* 2316 * Record "descriptor" entity. 2317 * Process dwLength, bcdVersion, wIndex, get b/wCount. 2318 * Move the data pointer to the beginning of extended 2319 * compatibilities proper or extended properties proper 2320 * portions of the data 2321 */ 2322 if (le32_to_cpu(desc->dwLength) > len) 2323 return -EINVAL; 2324 2325 ret = __ffs_do_os_desc_header(&type, desc); 2326 if (unlikely(ret < 0)) { 2327 pr_debug("entity OS_DESCRIPTOR(%02lx); ret = %d\n", 2328 num, ret); 2329 return ret; 2330 } 2331 /* 2332 * 16-bit hex "?? 00" Little Endian looks like 8-bit hex "??" 2333 */ 2334 feature_count = le16_to_cpu(desc->wCount); 2335 if (type == FFS_OS_DESC_EXT_COMPAT && 2336 (feature_count > 255 || desc->Reserved)) 2337 return -EINVAL; 2338 len -= ret; 2339 data += ret; 2340 2341 /* 2342 * Process all function/property descriptors 2343 * of this Feature Descriptor 2344 */ 2345 ret = ffs_do_single_os_desc(data, len, type, 2346 feature_count, entity, priv, desc); 2347 if (unlikely(ret < 0)) { 2348 pr_debug("%s returns %d\n", __func__, ret); 2349 return ret; 2350 } 2351 2352 len -= ret; 2353 data += ret; 2354 } 2355 return _len - len; 2356 } 2357 2358 /** 2359 * Validate contents of the buffer from userspace related to OS descriptors. 2360 */ 2361 static int __ffs_data_do_os_desc(enum ffs_os_desc_type type, 2362 struct usb_os_desc_header *h, void *data, 2363 unsigned len, void *priv) 2364 { 2365 struct ffs_data *ffs = priv; 2366 u8 length; 2367 2368 ENTER(); 2369 2370 switch (type) { 2371 case FFS_OS_DESC_EXT_COMPAT: { 2372 struct usb_ext_compat_desc *d = data; 2373 int i; 2374 2375 if (len < sizeof(*d) || 2376 d->bFirstInterfaceNumber >= ffs->interfaces_count) 2377 return -EINVAL; 2378 if (d->Reserved1 != 1) { 2379 /* 2380 * According to the spec, Reserved1 must be set to 1 2381 * but older kernels incorrectly rejected non-zero 2382 * values. We fix it here to avoid returning EINVAL 2383 * in response to values we used to accept. 2384 */ 2385 pr_debug("usb_ext_compat_desc::Reserved1 forced to 1\n"); 2386 d->Reserved1 = 1; 2387 } 2388 for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i) 2389 if (d->Reserved2[i]) 2390 return -EINVAL; 2391 2392 length = sizeof(struct usb_ext_compat_desc); 2393 } 2394 break; 2395 case FFS_OS_DESC_EXT_PROP: { 2396 struct usb_ext_prop_desc *d = data; 2397 u32 type, pdl; 2398 u16 pnl; 2399 2400 if (len < sizeof(*d) || h->interface >= ffs->interfaces_count) 2401 return -EINVAL; 2402 length = le32_to_cpu(d->dwSize); 2403 if (len < length) 2404 return -EINVAL; 2405 type = le32_to_cpu(d->dwPropertyDataType); 2406 if (type < USB_EXT_PROP_UNICODE || 2407 type > USB_EXT_PROP_UNICODE_MULTI) { 2408 pr_vdebug("unsupported os descriptor property type: %d", 2409 type); 2410 return -EINVAL; 2411 } 2412 pnl = le16_to_cpu(d->wPropertyNameLength); 2413 if (length < 14 + pnl) { 2414 pr_vdebug("invalid os descriptor length: %d pnl:%d (descriptor %d)\n", 2415 length, pnl, type); 2416 return -EINVAL; 2417 } 2418 pdl = le32_to_cpu(*(__le32 *)((u8 *)data + 10 + pnl)); 2419 if (length != 14 + pnl + pdl) { 2420 pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n", 2421 length, pnl, pdl, type); 2422 return -EINVAL; 2423 } 2424 ++ffs->ms_os_descs_ext_prop_count; 2425 /* property name reported to the host as "WCHAR"s */ 2426 ffs->ms_os_descs_ext_prop_name_len += pnl * 2; 2427 ffs->ms_os_descs_ext_prop_data_len += pdl; 2428 } 2429 break; 2430 default: 2431 pr_vdebug("unknown descriptor: %d\n", type); 2432 return -EINVAL; 2433 } 2434 return length; 2435 } 2436 2437 static int __ffs_data_got_descs(struct ffs_data *ffs, 2438 char *const _data, size_t len) 2439 { 2440 char *data = _data, *raw_descs; 2441 unsigned os_descs_count = 0, counts[3], flags; 2442 int ret = -EINVAL, i; 2443 struct ffs_desc_helper helper; 2444 2445 ENTER(); 2446 2447 if (get_unaligned_le32(data + 4) != len) 2448 goto error; 2449 2450 switch (get_unaligned_le32(data)) { 2451 case FUNCTIONFS_DESCRIPTORS_MAGIC: 2452 flags = FUNCTIONFS_HAS_FS_DESC | FUNCTIONFS_HAS_HS_DESC; 2453 data += 8; 2454 len -= 8; 2455 break; 2456 case FUNCTIONFS_DESCRIPTORS_MAGIC_V2: 2457 flags = get_unaligned_le32(data + 8); 2458 ffs->user_flags = flags; 2459 if (flags & ~(FUNCTIONFS_HAS_FS_DESC | 2460 FUNCTIONFS_HAS_HS_DESC | 2461 FUNCTIONFS_HAS_SS_DESC | 2462 FUNCTIONFS_HAS_MS_OS_DESC | 2463 FUNCTIONFS_VIRTUAL_ADDR | 2464 FUNCTIONFS_EVENTFD | 2465 FUNCTIONFS_ALL_CTRL_RECIP | 2466 FUNCTIONFS_CONFIG0_SETUP)) { 2467 ret = -ENOSYS; 2468 goto error; 2469 } 2470 data += 12; 2471 len -= 12; 2472 break; 2473 default: 2474 goto error; 2475 } 2476 2477 if (flags & FUNCTIONFS_EVENTFD) { 2478 if (len < 4) 2479 goto error; 2480 ffs->ffs_eventfd = 2481 eventfd_ctx_fdget((int)get_unaligned_le32(data)); 2482 if (IS_ERR(ffs->ffs_eventfd)) { 2483 ret = PTR_ERR(ffs->ffs_eventfd); 2484 ffs->ffs_eventfd = NULL; 2485 goto error; 2486 } 2487 data += 4; 2488 len -= 4; 2489 } 2490 2491 /* Read fs_count, hs_count and ss_count (if present) */ 2492 for (i = 0; i < 3; ++i) { 2493 if (!(flags & (1 << i))) { 2494 counts[i] = 0; 2495 } else if (len < 4) { 2496 goto error; 2497 } else { 2498 counts[i] = get_unaligned_le32(data); 2499 data += 4; 2500 len -= 4; 2501 } 2502 } 2503 if (flags & (1 << i)) { 2504 if (len < 4) { 2505 goto error; 2506 } 2507 os_descs_count = get_unaligned_le32(data); 2508 data += 4; 2509 len -= 4; 2510 }; 2511 2512 /* Read descriptors */ 2513 raw_descs = data; 2514 helper.ffs = ffs; 2515 for (i = 0; i < 3; ++i) { 2516 if (!counts[i]) 2517 continue; 2518 helper.interfaces_count = 0; 2519 helper.eps_count = 0; 2520 ret = ffs_do_descs(counts[i], data, len, 2521 __ffs_data_do_entity, &helper); 2522 if (ret < 0) 2523 goto error; 2524 if (!ffs->eps_count && !ffs->interfaces_count) { 2525 ffs->eps_count = helper.eps_count; 2526 ffs->interfaces_count = helper.interfaces_count; 2527 } else { 2528 if (ffs->eps_count != helper.eps_count) { 2529 ret = -EINVAL; 2530 goto error; 2531 } 2532 if (ffs->interfaces_count != helper.interfaces_count) { 2533 ret = -EINVAL; 2534 goto error; 2535 } 2536 } 2537 data += ret; 2538 len -= ret; 2539 } 2540 if (os_descs_count) { 2541 ret = ffs_do_os_descs(os_descs_count, data, len, 2542 __ffs_data_do_os_desc, ffs); 2543 if (ret < 0) 2544 goto error; 2545 data += ret; 2546 len -= ret; 2547 } 2548 2549 if (raw_descs == data || len) { 2550 ret = -EINVAL; 2551 goto error; 2552 } 2553 2554 ffs->raw_descs_data = _data; 2555 ffs->raw_descs = raw_descs; 2556 ffs->raw_descs_length = data - raw_descs; 2557 ffs->fs_descs_count = counts[0]; 2558 ffs->hs_descs_count = counts[1]; 2559 ffs->ss_descs_count = counts[2]; 2560 ffs->ms_os_descs_count = os_descs_count; 2561 2562 return 0; 2563 2564 error: 2565 kfree(_data); 2566 return ret; 2567 } 2568 2569 static int __ffs_data_got_strings(struct ffs_data *ffs, 2570 char *const _data, size_t len) 2571 { 2572 u32 str_count, needed_count, lang_count; 2573 struct usb_gadget_strings **stringtabs, *t; 2574 const char *data = _data; 2575 struct usb_string *s; 2576 2577 ENTER(); 2578 2579 if (unlikely(len < 16 || 2580 get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC || 2581 get_unaligned_le32(data + 4) != len)) 2582 goto error; 2583 str_count = get_unaligned_le32(data + 8); 2584 lang_count = get_unaligned_le32(data + 12); 2585 2586 /* if one is zero the other must be zero */ 2587 if (unlikely(!str_count != !lang_count)) 2588 goto error; 2589 2590 /* Do we have at least as many strings as descriptors need? */ 2591 needed_count = ffs->strings_count; 2592 if (unlikely(str_count < needed_count)) 2593 goto error; 2594 2595 /* 2596 * If we don't need any strings just return and free all 2597 * memory. 2598 */ 2599 if (!needed_count) { 2600 kfree(_data); 2601 return 0; 2602 } 2603 2604 /* Allocate everything in one chunk so there's less maintenance. */ 2605 { 2606 unsigned i = 0; 2607 vla_group(d); 2608 vla_item(d, struct usb_gadget_strings *, stringtabs, 2609 lang_count + 1); 2610 vla_item(d, struct usb_gadget_strings, stringtab, lang_count); 2611 vla_item(d, struct usb_string, strings, 2612 lang_count*(needed_count+1)); 2613 2614 char *vlabuf = kmalloc(vla_group_size(d), GFP_KERNEL); 2615 2616 if (unlikely(!vlabuf)) { 2617 kfree(_data); 2618 return -ENOMEM; 2619 } 2620 2621 /* Initialize the VLA pointers */ 2622 stringtabs = vla_ptr(vlabuf, d, stringtabs); 2623 t = vla_ptr(vlabuf, d, stringtab); 2624 i = lang_count; 2625 do { 2626 *stringtabs++ = t++; 2627 } while (--i); 2628 *stringtabs = NULL; 2629 2630 /* stringtabs = vlabuf = d_stringtabs for later kfree */ 2631 stringtabs = vla_ptr(vlabuf, d, stringtabs); 2632 t = vla_ptr(vlabuf, d, stringtab); 2633 s = vla_ptr(vlabuf, d, strings); 2634 } 2635 2636 /* For each language */ 2637 data += 16; 2638 len -= 16; 2639 2640 do { /* lang_count > 0 so we can use do-while */ 2641 unsigned needed = needed_count; 2642 2643 if (unlikely(len < 3)) 2644 goto error_free; 2645 t->language = get_unaligned_le16(data); 2646 t->strings = s; 2647 ++t; 2648 2649 data += 2; 2650 len -= 2; 2651 2652 /* For each string */ 2653 do { /* str_count > 0 so we can use do-while */ 2654 size_t length = strnlen(data, len); 2655 2656 if (unlikely(length == len)) 2657 goto error_free; 2658 2659 /* 2660 * User may provide more strings then we need, 2661 * if that's the case we simply ignore the 2662 * rest 2663 */ 2664 if (likely(needed)) { 2665 /* 2666 * s->id will be set while adding 2667 * function to configuration so for 2668 * now just leave garbage here. 2669 */ 2670 s->s = data; 2671 --needed; 2672 ++s; 2673 } 2674 2675 data += length + 1; 2676 len -= length + 1; 2677 } while (--str_count); 2678 2679 s->id = 0; /* terminator */ 2680 s->s = NULL; 2681 ++s; 2682 2683 } while (--lang_count); 2684 2685 /* Some garbage left? */ 2686 if (unlikely(len)) 2687 goto error_free; 2688 2689 /* Done! */ 2690 ffs->stringtabs = stringtabs; 2691 ffs->raw_strings = _data; 2692 2693 return 0; 2694 2695 error_free: 2696 kfree(stringtabs); 2697 error: 2698 kfree(_data); 2699 return -EINVAL; 2700 } 2701 2702 2703 /* Events handling and management *******************************************/ 2704 2705 static void __ffs_event_add(struct ffs_data *ffs, 2706 enum usb_functionfs_event_type type) 2707 { 2708 enum usb_functionfs_event_type rem_type1, rem_type2 = type; 2709 int neg = 0; 2710 2711 /* 2712 * Abort any unhandled setup 2713 * 2714 * We do not need to worry about some cmpxchg() changing value 2715 * of ffs->setup_state without holding the lock because when 2716 * state is FFS_SETUP_PENDING cmpxchg() in several places in 2717 * the source does nothing. 2718 */ 2719 if (ffs->setup_state == FFS_SETUP_PENDING) 2720 ffs->setup_state = FFS_SETUP_CANCELLED; 2721 2722 /* 2723 * Logic of this function guarantees that there are at most four pending 2724 * evens on ffs->ev.types queue. This is important because the queue 2725 * has space for four elements only and __ffs_ep0_read_events function 2726 * depends on that limit as well. If more event types are added, those 2727 * limits have to be revisited or guaranteed to still hold. 2728 */ 2729 switch (type) { 2730 case FUNCTIONFS_RESUME: 2731 rem_type2 = FUNCTIONFS_SUSPEND; 2732 /* FALL THROUGH */ 2733 case FUNCTIONFS_SUSPEND: 2734 case FUNCTIONFS_SETUP: 2735 rem_type1 = type; 2736 /* Discard all similar events */ 2737 break; 2738 2739 case FUNCTIONFS_BIND: 2740 case FUNCTIONFS_UNBIND: 2741 case FUNCTIONFS_DISABLE: 2742 case FUNCTIONFS_ENABLE: 2743 /* Discard everything other then power management. */ 2744 rem_type1 = FUNCTIONFS_SUSPEND; 2745 rem_type2 = FUNCTIONFS_RESUME; 2746 neg = 1; 2747 break; 2748 2749 default: 2750 WARN(1, "%d: unknown event, this should not happen\n", type); 2751 return; 2752 } 2753 2754 { 2755 u8 *ev = ffs->ev.types, *out = ev; 2756 unsigned n = ffs->ev.count; 2757 for (; n; --n, ++ev) 2758 if ((*ev == rem_type1 || *ev == rem_type2) == neg) 2759 *out++ = *ev; 2760 else 2761 pr_vdebug("purging event %d\n", *ev); 2762 ffs->ev.count = out - ffs->ev.types; 2763 } 2764 2765 pr_vdebug("adding event %d\n", type); 2766 ffs->ev.types[ffs->ev.count++] = type; 2767 wake_up_locked(&ffs->ev.waitq); 2768 if (ffs->ffs_eventfd) 2769 eventfd_signal(ffs->ffs_eventfd, 1); 2770 } 2771 2772 static void ffs_event_add(struct ffs_data *ffs, 2773 enum usb_functionfs_event_type type) 2774 { 2775 unsigned long flags; 2776 spin_lock_irqsave(&ffs->ev.waitq.lock, flags); 2777 __ffs_event_add(ffs, type); 2778 spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags); 2779 } 2780 2781 /* Bind/unbind USB function hooks *******************************************/ 2782 2783 static int ffs_ep_addr2idx(struct ffs_data *ffs, u8 endpoint_address) 2784 { 2785 int i; 2786 2787 for (i = 1; i < ARRAY_SIZE(ffs->eps_addrmap); ++i) 2788 if (ffs->eps_addrmap[i] == endpoint_address) 2789 return i; 2790 return -ENOENT; 2791 } 2792 2793 static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep, 2794 struct usb_descriptor_header *desc, 2795 void *priv) 2796 { 2797 struct usb_endpoint_descriptor *ds = (void *)desc; 2798 struct ffs_function *func = priv; 2799 struct ffs_ep *ffs_ep; 2800 unsigned ep_desc_id; 2801 int idx; 2802 static const char *speed_names[] = { "full", "high", "super" }; 2803 2804 if (type != FFS_DESCRIPTOR) 2805 return 0; 2806 2807 /* 2808 * If ss_descriptors is not NULL, we are reading super speed 2809 * descriptors; if hs_descriptors is not NULL, we are reading high 2810 * speed descriptors; otherwise, we are reading full speed 2811 * descriptors. 2812 */ 2813 if (func->function.ss_descriptors) { 2814 ep_desc_id = 2; 2815 func->function.ss_descriptors[(long)valuep] = desc; 2816 } else if (func->function.hs_descriptors) { 2817 ep_desc_id = 1; 2818 func->function.hs_descriptors[(long)valuep] = desc; 2819 } else { 2820 ep_desc_id = 0; 2821 func->function.fs_descriptors[(long)valuep] = desc; 2822 } 2823 2824 if (!desc || desc->bDescriptorType != USB_DT_ENDPOINT) 2825 return 0; 2826 2827 idx = ffs_ep_addr2idx(func->ffs, ds->bEndpointAddress) - 1; 2828 if (idx < 0) 2829 return idx; 2830 2831 ffs_ep = func->eps + idx; 2832 2833 if (unlikely(ffs_ep->descs[ep_desc_id])) { 2834 pr_err("two %sspeed descriptors for EP %d\n", 2835 speed_names[ep_desc_id], 2836 ds->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); 2837 return -EINVAL; 2838 } 2839 ffs_ep->descs[ep_desc_id] = ds; 2840 2841 ffs_dump_mem(": Original ep desc", ds, ds->bLength); 2842 if (ffs_ep->ep) { 2843 ds->bEndpointAddress = ffs_ep->descs[0]->bEndpointAddress; 2844 if (!ds->wMaxPacketSize) 2845 ds->wMaxPacketSize = ffs_ep->descs[0]->wMaxPacketSize; 2846 } else { 2847 struct usb_request *req; 2848 struct usb_ep *ep; 2849 u8 bEndpointAddress; 2850 u16 wMaxPacketSize; 2851 2852 /* 2853 * We back up bEndpointAddress because autoconfig overwrites 2854 * it with physical endpoint address. 2855 */ 2856 bEndpointAddress = ds->bEndpointAddress; 2857 /* 2858 * We back up wMaxPacketSize because autoconfig treats 2859 * endpoint descriptors as if they were full speed. 2860 */ 2861 wMaxPacketSize = ds->wMaxPacketSize; 2862 pr_vdebug("autoconfig\n"); 2863 ep = usb_ep_autoconfig(func->gadget, ds); 2864 if (unlikely(!ep)) 2865 return -ENOTSUPP; 2866 ep->driver_data = func->eps + idx; 2867 2868 req = usb_ep_alloc_request(ep, GFP_KERNEL); 2869 if (unlikely(!req)) 2870 return -ENOMEM; 2871 2872 ffs_ep->ep = ep; 2873 ffs_ep->req = req; 2874 func->eps_revmap[ds->bEndpointAddress & 2875 USB_ENDPOINT_NUMBER_MASK] = idx + 1; 2876 /* 2877 * If we use virtual address mapping, we restore 2878 * original bEndpointAddress value. 2879 */ 2880 if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR) 2881 ds->bEndpointAddress = bEndpointAddress; 2882 /* 2883 * Restore wMaxPacketSize which was potentially 2884 * overwritten by autoconfig. 2885 */ 2886 ds->wMaxPacketSize = wMaxPacketSize; 2887 } 2888 ffs_dump_mem(": Rewritten ep desc", ds, ds->bLength); 2889 2890 return 0; 2891 } 2892 2893 static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep, 2894 struct usb_descriptor_header *desc, 2895 void *priv) 2896 { 2897 struct ffs_function *func = priv; 2898 unsigned idx; 2899 u8 newValue; 2900 2901 switch (type) { 2902 default: 2903 case FFS_DESCRIPTOR: 2904 /* Handled in previous pass by __ffs_func_bind_do_descs() */ 2905 return 0; 2906 2907 case FFS_INTERFACE: 2908 idx = *valuep; 2909 if (func->interfaces_nums[idx] < 0) { 2910 int id = usb_interface_id(func->conf, &func->function); 2911 if (unlikely(id < 0)) 2912 return id; 2913 func->interfaces_nums[idx] = id; 2914 } 2915 newValue = func->interfaces_nums[idx]; 2916 break; 2917 2918 case FFS_STRING: 2919 /* String' IDs are allocated when fsf_data is bound to cdev */ 2920 newValue = func->ffs->stringtabs[0]->strings[*valuep - 1].id; 2921 break; 2922 2923 case FFS_ENDPOINT: 2924 /* 2925 * USB_DT_ENDPOINT are handled in 2926 * __ffs_func_bind_do_descs(). 2927 */ 2928 if (desc->bDescriptorType == USB_DT_ENDPOINT) 2929 return 0; 2930 2931 idx = (*valuep & USB_ENDPOINT_NUMBER_MASK) - 1; 2932 if (unlikely(!func->eps[idx].ep)) 2933 return -EINVAL; 2934 2935 { 2936 struct usb_endpoint_descriptor **descs; 2937 descs = func->eps[idx].descs; 2938 newValue = descs[descs[0] ? 0 : 1]->bEndpointAddress; 2939 } 2940 break; 2941 } 2942 2943 pr_vdebug("%02x -> %02x\n", *valuep, newValue); 2944 *valuep = newValue; 2945 return 0; 2946 } 2947 2948 static int __ffs_func_bind_do_os_desc(enum ffs_os_desc_type type, 2949 struct usb_os_desc_header *h, void *data, 2950 unsigned len, void *priv) 2951 { 2952 struct ffs_function *func = priv; 2953 u8 length = 0; 2954 2955 switch (type) { 2956 case FFS_OS_DESC_EXT_COMPAT: { 2957 struct usb_ext_compat_desc *desc = data; 2958 struct usb_os_desc_table *t; 2959 2960 t = &func->function.os_desc_table[desc->bFirstInterfaceNumber]; 2961 t->if_id = func->interfaces_nums[desc->bFirstInterfaceNumber]; 2962 memcpy(t->os_desc->ext_compat_id, &desc->CompatibleID, 2963 ARRAY_SIZE(desc->CompatibleID) + 2964 ARRAY_SIZE(desc->SubCompatibleID)); 2965 length = sizeof(*desc); 2966 } 2967 break; 2968 case FFS_OS_DESC_EXT_PROP: { 2969 struct usb_ext_prop_desc *desc = data; 2970 struct usb_os_desc_table *t; 2971 struct usb_os_desc_ext_prop *ext_prop; 2972 char *ext_prop_name; 2973 char *ext_prop_data; 2974 2975 t = &func->function.os_desc_table[h->interface]; 2976 t->if_id = func->interfaces_nums[h->interface]; 2977 2978 ext_prop = func->ffs->ms_os_descs_ext_prop_avail; 2979 func->ffs->ms_os_descs_ext_prop_avail += sizeof(*ext_prop); 2980 2981 ext_prop->type = le32_to_cpu(desc->dwPropertyDataType); 2982 ext_prop->name_len = le16_to_cpu(desc->wPropertyNameLength); 2983 ext_prop->data_len = le32_to_cpu(*(__le32 *) 2984 usb_ext_prop_data_len_ptr(data, ext_prop->name_len)); 2985 length = ext_prop->name_len + ext_prop->data_len + 14; 2986 2987 ext_prop_name = func->ffs->ms_os_descs_ext_prop_name_avail; 2988 func->ffs->ms_os_descs_ext_prop_name_avail += 2989 ext_prop->name_len; 2990 2991 ext_prop_data = func->ffs->ms_os_descs_ext_prop_data_avail; 2992 func->ffs->ms_os_descs_ext_prop_data_avail += 2993 ext_prop->data_len; 2994 memcpy(ext_prop_data, 2995 usb_ext_prop_data_ptr(data, ext_prop->name_len), 2996 ext_prop->data_len); 2997 /* unicode data reported to the host as "WCHAR"s */ 2998 switch (ext_prop->type) { 2999 case USB_EXT_PROP_UNICODE: 3000 case USB_EXT_PROP_UNICODE_ENV: 3001 case USB_EXT_PROP_UNICODE_LINK: 3002 case USB_EXT_PROP_UNICODE_MULTI: 3003 ext_prop->data_len *= 2; 3004 break; 3005 } 3006 ext_prop->data = ext_prop_data; 3007 3008 memcpy(ext_prop_name, usb_ext_prop_name_ptr(data), 3009 ext_prop->name_len); 3010 /* property name reported to the host as "WCHAR"s */ 3011 ext_prop->name_len *= 2; 3012 ext_prop->name = ext_prop_name; 3013 3014 t->os_desc->ext_prop_len += 3015 ext_prop->name_len + ext_prop->data_len + 14; 3016 ++t->os_desc->ext_prop_count; 3017 list_add_tail(&ext_prop->entry, &t->os_desc->ext_prop); 3018 } 3019 break; 3020 default: 3021 pr_vdebug("unknown descriptor: %d\n", type); 3022 } 3023 3024 return length; 3025 } 3026 3027 static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f, 3028 struct usb_configuration *c) 3029 { 3030 struct ffs_function *func = ffs_func_from_usb(f); 3031 struct f_fs_opts *ffs_opts = 3032 container_of(f->fi, struct f_fs_opts, func_inst); 3033 int ret; 3034 3035 ENTER(); 3036 3037 /* 3038 * Legacy gadget triggers binding in functionfs_ready_callback, 3039 * which already uses locking; taking the same lock here would 3040 * cause a deadlock. 3041 * 3042 * Configfs-enabled gadgets however do need ffs_dev_lock. 3043 */ 3044 if (!ffs_opts->no_configfs) 3045 ffs_dev_lock(); 3046 ret = ffs_opts->dev->desc_ready ? 0 : -ENODEV; 3047 func->ffs = ffs_opts->dev->ffs_data; 3048 if (!ffs_opts->no_configfs) 3049 ffs_dev_unlock(); 3050 if (ret) 3051 return ERR_PTR(ret); 3052 3053 func->conf = c; 3054 func->gadget = c->cdev->gadget; 3055 3056 /* 3057 * in drivers/usb/gadget/configfs.c:configfs_composite_bind() 3058 * configurations are bound in sequence with list_for_each_entry, 3059 * in each configuration its functions are bound in sequence 3060 * with list_for_each_entry, so we assume no race condition 3061 * with regard to ffs_opts->bound access 3062 */ 3063 if (!ffs_opts->refcnt) { 3064 ret = functionfs_bind(func->ffs, c->cdev); 3065 if (ret) 3066 return ERR_PTR(ret); 3067 } 3068 ffs_opts->refcnt++; 3069 func->function.strings = func->ffs->stringtabs; 3070 3071 return ffs_opts; 3072 } 3073 3074 static int _ffs_func_bind(struct usb_configuration *c, 3075 struct usb_function *f) 3076 { 3077 struct ffs_function *func = ffs_func_from_usb(f); 3078 struct ffs_data *ffs = func->ffs; 3079 3080 const int full = !!func->ffs->fs_descs_count; 3081 const int high = !!func->ffs->hs_descs_count; 3082 const int super = !!func->ffs->ss_descs_count; 3083 3084 int fs_len, hs_len, ss_len, ret, i; 3085 struct ffs_ep *eps_ptr; 3086 3087 /* Make it a single chunk, less management later on */ 3088 vla_group(d); 3089 vla_item_with_sz(d, struct ffs_ep, eps, ffs->eps_count); 3090 vla_item_with_sz(d, struct usb_descriptor_header *, fs_descs, 3091 full ? ffs->fs_descs_count + 1 : 0); 3092 vla_item_with_sz(d, struct usb_descriptor_header *, hs_descs, 3093 high ? ffs->hs_descs_count + 1 : 0); 3094 vla_item_with_sz(d, struct usb_descriptor_header *, ss_descs, 3095 super ? ffs->ss_descs_count + 1 : 0); 3096 vla_item_with_sz(d, short, inums, ffs->interfaces_count); 3097 vla_item_with_sz(d, struct usb_os_desc_table, os_desc_table, 3098 c->cdev->use_os_string ? ffs->interfaces_count : 0); 3099 vla_item_with_sz(d, char[16], ext_compat, 3100 c->cdev->use_os_string ? ffs->interfaces_count : 0); 3101 vla_item_with_sz(d, struct usb_os_desc, os_desc, 3102 c->cdev->use_os_string ? ffs->interfaces_count : 0); 3103 vla_item_with_sz(d, struct usb_os_desc_ext_prop, ext_prop, 3104 ffs->ms_os_descs_ext_prop_count); 3105 vla_item_with_sz(d, char, ext_prop_name, 3106 ffs->ms_os_descs_ext_prop_name_len); 3107 vla_item_with_sz(d, char, ext_prop_data, 3108 ffs->ms_os_descs_ext_prop_data_len); 3109 vla_item_with_sz(d, char, raw_descs, ffs->raw_descs_length); 3110 char *vlabuf; 3111 3112 ENTER(); 3113 3114 /* Has descriptors only for speeds gadget does not support */ 3115 if (unlikely(!(full | high | super))) 3116 return -ENOTSUPP; 3117 3118 /* Allocate a single chunk, less management later on */ 3119 vlabuf = kzalloc(vla_group_size(d), GFP_KERNEL); 3120 if (unlikely(!vlabuf)) 3121 return -ENOMEM; 3122 3123 ffs->ms_os_descs_ext_prop_avail = vla_ptr(vlabuf, d, ext_prop); 3124 ffs->ms_os_descs_ext_prop_name_avail = 3125 vla_ptr(vlabuf, d, ext_prop_name); 3126 ffs->ms_os_descs_ext_prop_data_avail = 3127 vla_ptr(vlabuf, d, ext_prop_data); 3128 3129 /* Copy descriptors */ 3130 memcpy(vla_ptr(vlabuf, d, raw_descs), ffs->raw_descs, 3131 ffs->raw_descs_length); 3132 3133 memset(vla_ptr(vlabuf, d, inums), 0xff, d_inums__sz); 3134 eps_ptr = vla_ptr(vlabuf, d, eps); 3135 for (i = 0; i < ffs->eps_count; i++) 3136 eps_ptr[i].num = -1; 3137 3138 /* Save pointers 3139 * d_eps == vlabuf, func->eps used to kfree vlabuf later 3140 */ 3141 func->eps = vla_ptr(vlabuf, d, eps); 3142 func->interfaces_nums = vla_ptr(vlabuf, d, inums); 3143 3144 /* 3145 * Go through all the endpoint descriptors and allocate 3146 * endpoints first, so that later we can rewrite the endpoint 3147 * numbers without worrying that it may be described later on. 3148 */ 3149 if (likely(full)) { 3150 func->function.fs_descriptors = vla_ptr(vlabuf, d, fs_descs); 3151 fs_len = ffs_do_descs(ffs->fs_descs_count, 3152 vla_ptr(vlabuf, d, raw_descs), 3153 d_raw_descs__sz, 3154 __ffs_func_bind_do_descs, func); 3155 if (unlikely(fs_len < 0)) { 3156 ret = fs_len; 3157 goto error; 3158 } 3159 } else { 3160 fs_len = 0; 3161 } 3162 3163 if (likely(high)) { 3164 func->function.hs_descriptors = vla_ptr(vlabuf, d, hs_descs); 3165 hs_len = ffs_do_descs(ffs->hs_descs_count, 3166 vla_ptr(vlabuf, d, raw_descs) + fs_len, 3167 d_raw_descs__sz - fs_len, 3168 __ffs_func_bind_do_descs, func); 3169 if (unlikely(hs_len < 0)) { 3170 ret = hs_len; 3171 goto error; 3172 } 3173 } else { 3174 hs_len = 0; 3175 } 3176 3177 if (likely(super)) { 3178 func->function.ss_descriptors = vla_ptr(vlabuf, d, ss_descs); 3179 ss_len = ffs_do_descs(ffs->ss_descs_count, 3180 vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len, 3181 d_raw_descs__sz - fs_len - hs_len, 3182 __ffs_func_bind_do_descs, func); 3183 if (unlikely(ss_len < 0)) { 3184 ret = ss_len; 3185 goto error; 3186 } 3187 } else { 3188 ss_len = 0; 3189 } 3190 3191 /* 3192 * Now handle interface numbers allocation and interface and 3193 * endpoint numbers rewriting. We can do that in one go 3194 * now. 3195 */ 3196 ret = ffs_do_descs(ffs->fs_descs_count + 3197 (high ? ffs->hs_descs_count : 0) + 3198 (super ? ffs->ss_descs_count : 0), 3199 vla_ptr(vlabuf, d, raw_descs), d_raw_descs__sz, 3200 __ffs_func_bind_do_nums, func); 3201 if (unlikely(ret < 0)) 3202 goto error; 3203 3204 func->function.os_desc_table = vla_ptr(vlabuf, d, os_desc_table); 3205 if (c->cdev->use_os_string) { 3206 for (i = 0; i < ffs->interfaces_count; ++i) { 3207 struct usb_os_desc *desc; 3208 3209 desc = func->function.os_desc_table[i].os_desc = 3210 vla_ptr(vlabuf, d, os_desc) + 3211 i * sizeof(struct usb_os_desc); 3212 desc->ext_compat_id = 3213 vla_ptr(vlabuf, d, ext_compat) + i * 16; 3214 INIT_LIST_HEAD(&desc->ext_prop); 3215 } 3216 ret = ffs_do_os_descs(ffs->ms_os_descs_count, 3217 vla_ptr(vlabuf, d, raw_descs) + 3218 fs_len + hs_len + ss_len, 3219 d_raw_descs__sz - fs_len - hs_len - 3220 ss_len, 3221 __ffs_func_bind_do_os_desc, func); 3222 if (unlikely(ret < 0)) 3223 goto error; 3224 } 3225 func->function.os_desc_n = 3226 c->cdev->use_os_string ? ffs->interfaces_count : 0; 3227 3228 /* And we're done */ 3229 ffs_event_add(ffs, FUNCTIONFS_BIND); 3230 return 0; 3231 3232 error: 3233 /* XXX Do we need to release all claimed endpoints here? */ 3234 return ret; 3235 } 3236 3237 static int ffs_func_bind(struct usb_configuration *c, 3238 struct usb_function *f) 3239 { 3240 struct f_fs_opts *ffs_opts = ffs_do_functionfs_bind(f, c); 3241 struct ffs_function *func = ffs_func_from_usb(f); 3242 int ret; 3243 3244 if (IS_ERR(ffs_opts)) 3245 return PTR_ERR(ffs_opts); 3246 3247 ret = _ffs_func_bind(c, f); 3248 if (ret && !--ffs_opts->refcnt) 3249 functionfs_unbind(func->ffs); 3250 3251 return ret; 3252 } 3253 3254 3255 /* Other USB function hooks *************************************************/ 3256 3257 static void ffs_reset_work(struct work_struct *work) 3258 { 3259 struct ffs_data *ffs = container_of(work, 3260 struct ffs_data, reset_work); 3261 ffs_data_reset(ffs); 3262 } 3263 3264 static int ffs_func_set_alt(struct usb_function *f, 3265 unsigned interface, unsigned alt) 3266 { 3267 struct ffs_function *func = ffs_func_from_usb(f); 3268 struct ffs_data *ffs = func->ffs; 3269 int ret = 0, intf; 3270 3271 if (alt != (unsigned)-1) { 3272 intf = ffs_func_revmap_intf(func, interface); 3273 if (unlikely(intf < 0)) 3274 return intf; 3275 } 3276 3277 if (ffs->func) 3278 ffs_func_eps_disable(ffs->func); 3279 3280 if (ffs->state == FFS_DEACTIVATED) { 3281 ffs->state = FFS_CLOSING; 3282 INIT_WORK(&ffs->reset_work, ffs_reset_work); 3283 schedule_work(&ffs->reset_work); 3284 return -ENODEV; 3285 } 3286 3287 if (ffs->state != FFS_ACTIVE) 3288 return -ENODEV; 3289 3290 if (alt == (unsigned)-1) { 3291 ffs->func = NULL; 3292 ffs_event_add(ffs, FUNCTIONFS_DISABLE); 3293 return 0; 3294 } 3295 3296 ffs->func = func; 3297 ret = ffs_func_eps_enable(func); 3298 if (likely(ret >= 0)) 3299 ffs_event_add(ffs, FUNCTIONFS_ENABLE); 3300 return ret; 3301 } 3302 3303 static void ffs_func_disable(struct usb_function *f) 3304 { 3305 ffs_func_set_alt(f, 0, (unsigned)-1); 3306 } 3307 3308 static int ffs_func_setup(struct usb_function *f, 3309 const struct usb_ctrlrequest *creq) 3310 { 3311 struct ffs_function *func = ffs_func_from_usb(f); 3312 struct ffs_data *ffs = func->ffs; 3313 unsigned long flags; 3314 int ret; 3315 3316 ENTER(); 3317 3318 pr_vdebug("creq->bRequestType = %02x\n", creq->bRequestType); 3319 pr_vdebug("creq->bRequest = %02x\n", creq->bRequest); 3320 pr_vdebug("creq->wValue = %04x\n", le16_to_cpu(creq->wValue)); 3321 pr_vdebug("creq->wIndex = %04x\n", le16_to_cpu(creq->wIndex)); 3322 pr_vdebug("creq->wLength = %04x\n", le16_to_cpu(creq->wLength)); 3323 3324 /* 3325 * Most requests directed to interface go through here 3326 * (notable exceptions are set/get interface) so we need to 3327 * handle them. All other either handled by composite or 3328 * passed to usb_configuration->setup() (if one is set). No 3329 * matter, we will handle requests directed to endpoint here 3330 * as well (as it's straightforward). Other request recipient 3331 * types are only handled when the user flag FUNCTIONFS_ALL_CTRL_RECIP 3332 * is being used. 3333 */ 3334 if (ffs->state != FFS_ACTIVE) 3335 return -ENODEV; 3336 3337 switch (creq->bRequestType & USB_RECIP_MASK) { 3338 case USB_RECIP_INTERFACE: 3339 ret = ffs_func_revmap_intf(func, le16_to_cpu(creq->wIndex)); 3340 if (unlikely(ret < 0)) 3341 return ret; 3342 break; 3343 3344 case USB_RECIP_ENDPOINT: 3345 ret = ffs_func_revmap_ep(func, le16_to_cpu(creq->wIndex)); 3346 if (unlikely(ret < 0)) 3347 return ret; 3348 if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR) 3349 ret = func->ffs->eps_addrmap[ret]; 3350 break; 3351 3352 default: 3353 if (func->ffs->user_flags & FUNCTIONFS_ALL_CTRL_RECIP) 3354 ret = le16_to_cpu(creq->wIndex); 3355 else 3356 return -EOPNOTSUPP; 3357 } 3358 3359 spin_lock_irqsave(&ffs->ev.waitq.lock, flags); 3360 ffs->ev.setup = *creq; 3361 ffs->ev.setup.wIndex = cpu_to_le16(ret); 3362 __ffs_event_add(ffs, FUNCTIONFS_SETUP); 3363 spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags); 3364 3365 return creq->wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0; 3366 } 3367 3368 static bool ffs_func_req_match(struct usb_function *f, 3369 const struct usb_ctrlrequest *creq, 3370 bool config0) 3371 { 3372 struct ffs_function *func = ffs_func_from_usb(f); 3373 3374 if (config0 && !(func->ffs->user_flags & FUNCTIONFS_CONFIG0_SETUP)) 3375 return false; 3376 3377 switch (creq->bRequestType & USB_RECIP_MASK) { 3378 case USB_RECIP_INTERFACE: 3379 return (ffs_func_revmap_intf(func, 3380 le16_to_cpu(creq->wIndex)) >= 0); 3381 case USB_RECIP_ENDPOINT: 3382 return (ffs_func_revmap_ep(func, 3383 le16_to_cpu(creq->wIndex)) >= 0); 3384 default: 3385 return (bool) (func->ffs->user_flags & 3386 FUNCTIONFS_ALL_CTRL_RECIP); 3387 } 3388 } 3389 3390 static void ffs_func_suspend(struct usb_function *f) 3391 { 3392 ENTER(); 3393 ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_SUSPEND); 3394 } 3395 3396 static void ffs_func_resume(struct usb_function *f) 3397 { 3398 ENTER(); 3399 ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_RESUME); 3400 } 3401 3402 3403 /* Endpoint and interface numbers reverse mapping ***************************/ 3404 3405 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num) 3406 { 3407 num = func->eps_revmap[num & USB_ENDPOINT_NUMBER_MASK]; 3408 return num ? num : -EDOM; 3409 } 3410 3411 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf) 3412 { 3413 short *nums = func->interfaces_nums; 3414 unsigned count = func->ffs->interfaces_count; 3415 3416 for (; count; --count, ++nums) { 3417 if (*nums >= 0 && *nums == intf) 3418 return nums - func->interfaces_nums; 3419 } 3420 3421 return -EDOM; 3422 } 3423 3424 3425 /* Devices management *******************************************************/ 3426 3427 static LIST_HEAD(ffs_devices); 3428 3429 static struct ffs_dev *_ffs_do_find_dev(const char *name) 3430 { 3431 struct ffs_dev *dev; 3432 3433 if (!name) 3434 return NULL; 3435 3436 list_for_each_entry(dev, &ffs_devices, entry) { 3437 if (strcmp(dev->name, name) == 0) 3438 return dev; 3439 } 3440 3441 return NULL; 3442 } 3443 3444 /* 3445 * ffs_lock must be taken by the caller of this function 3446 */ 3447 static struct ffs_dev *_ffs_get_single_dev(void) 3448 { 3449 struct ffs_dev *dev; 3450 3451 if (list_is_singular(&ffs_devices)) { 3452 dev = list_first_entry(&ffs_devices, struct ffs_dev, entry); 3453 if (dev->single) 3454 return dev; 3455 } 3456 3457 return NULL; 3458 } 3459 3460 /* 3461 * ffs_lock must be taken by the caller of this function 3462 */ 3463 static struct ffs_dev *_ffs_find_dev(const char *name) 3464 { 3465 struct ffs_dev *dev; 3466 3467 dev = _ffs_get_single_dev(); 3468 if (dev) 3469 return dev; 3470 3471 return _ffs_do_find_dev(name); 3472 } 3473 3474 /* Configfs support *********************************************************/ 3475 3476 static inline struct f_fs_opts *to_ffs_opts(struct config_item *item) 3477 { 3478 return container_of(to_config_group(item), struct f_fs_opts, 3479 func_inst.group); 3480 } 3481 3482 static void ffs_attr_release(struct config_item *item) 3483 { 3484 struct f_fs_opts *opts = to_ffs_opts(item); 3485 3486 usb_put_function_instance(&opts->func_inst); 3487 } 3488 3489 static struct configfs_item_operations ffs_item_ops = { 3490 .release = ffs_attr_release, 3491 }; 3492 3493 static const struct config_item_type ffs_func_type = { 3494 .ct_item_ops = &ffs_item_ops, 3495 .ct_owner = THIS_MODULE, 3496 }; 3497 3498 3499 /* Function registration interface ******************************************/ 3500 3501 static void ffs_free_inst(struct usb_function_instance *f) 3502 { 3503 struct f_fs_opts *opts; 3504 3505 opts = to_f_fs_opts(f); 3506 ffs_dev_lock(); 3507 _ffs_free_dev(opts->dev); 3508 ffs_dev_unlock(); 3509 kfree(opts); 3510 } 3511 3512 static int ffs_set_inst_name(struct usb_function_instance *fi, const char *name) 3513 { 3514 if (strlen(name) >= sizeof_field(struct ffs_dev, name)) 3515 return -ENAMETOOLONG; 3516 return ffs_name_dev(to_f_fs_opts(fi)->dev, name); 3517 } 3518 3519 static struct usb_function_instance *ffs_alloc_inst(void) 3520 { 3521 struct f_fs_opts *opts; 3522 struct ffs_dev *dev; 3523 3524 opts = kzalloc(sizeof(*opts), GFP_KERNEL); 3525 if (!opts) 3526 return ERR_PTR(-ENOMEM); 3527 3528 opts->func_inst.set_inst_name = ffs_set_inst_name; 3529 opts->func_inst.free_func_inst = ffs_free_inst; 3530 ffs_dev_lock(); 3531 dev = _ffs_alloc_dev(); 3532 ffs_dev_unlock(); 3533 if (IS_ERR(dev)) { 3534 kfree(opts); 3535 return ERR_CAST(dev); 3536 } 3537 opts->dev = dev; 3538 dev->opts = opts; 3539 3540 config_group_init_type_name(&opts->func_inst.group, "", 3541 &ffs_func_type); 3542 return &opts->func_inst; 3543 } 3544 3545 static void ffs_free(struct usb_function *f) 3546 { 3547 kfree(ffs_func_from_usb(f)); 3548 } 3549 3550 static void ffs_func_unbind(struct usb_configuration *c, 3551 struct usb_function *f) 3552 { 3553 struct ffs_function *func = ffs_func_from_usb(f); 3554 struct ffs_data *ffs = func->ffs; 3555 struct f_fs_opts *opts = 3556 container_of(f->fi, struct f_fs_opts, func_inst); 3557 struct ffs_ep *ep = func->eps; 3558 unsigned count = ffs->eps_count; 3559 unsigned long flags; 3560 3561 ENTER(); 3562 if (ffs->func == func) { 3563 ffs_func_eps_disable(func); 3564 ffs->func = NULL; 3565 } 3566 3567 if (!--opts->refcnt) 3568 functionfs_unbind(ffs); 3569 3570 /* cleanup after autoconfig */ 3571 spin_lock_irqsave(&func->ffs->eps_lock, flags); 3572 while (count--) { 3573 if (ep->ep && ep->req) 3574 usb_ep_free_request(ep->ep, ep->req); 3575 ep->req = NULL; 3576 ++ep; 3577 } 3578 spin_unlock_irqrestore(&func->ffs->eps_lock, flags); 3579 kfree(func->eps); 3580 func->eps = NULL; 3581 /* 3582 * eps, descriptors and interfaces_nums are allocated in the 3583 * same chunk so only one free is required. 3584 */ 3585 func->function.fs_descriptors = NULL; 3586 func->function.hs_descriptors = NULL; 3587 func->function.ss_descriptors = NULL; 3588 func->interfaces_nums = NULL; 3589 3590 ffs_event_add(ffs, FUNCTIONFS_UNBIND); 3591 } 3592 3593 static struct usb_function *ffs_alloc(struct usb_function_instance *fi) 3594 { 3595 struct ffs_function *func; 3596 3597 ENTER(); 3598 3599 func = kzalloc(sizeof(*func), GFP_KERNEL); 3600 if (unlikely(!func)) 3601 return ERR_PTR(-ENOMEM); 3602 3603 func->function.name = "Function FS Gadget"; 3604 3605 func->function.bind = ffs_func_bind; 3606 func->function.unbind = ffs_func_unbind; 3607 func->function.set_alt = ffs_func_set_alt; 3608 func->function.disable = ffs_func_disable; 3609 func->function.setup = ffs_func_setup; 3610 func->function.req_match = ffs_func_req_match; 3611 func->function.suspend = ffs_func_suspend; 3612 func->function.resume = ffs_func_resume; 3613 func->function.free_func = ffs_free; 3614 3615 return &func->function; 3616 } 3617 3618 /* 3619 * ffs_lock must be taken by the caller of this function 3620 */ 3621 static struct ffs_dev *_ffs_alloc_dev(void) 3622 { 3623 struct ffs_dev *dev; 3624 int ret; 3625 3626 if (_ffs_get_single_dev()) 3627 return ERR_PTR(-EBUSY); 3628 3629 dev = kzalloc(sizeof(*dev), GFP_KERNEL); 3630 if (!dev) 3631 return ERR_PTR(-ENOMEM); 3632 3633 if (list_empty(&ffs_devices)) { 3634 ret = functionfs_init(); 3635 if (ret) { 3636 kfree(dev); 3637 return ERR_PTR(ret); 3638 } 3639 } 3640 3641 list_add(&dev->entry, &ffs_devices); 3642 3643 return dev; 3644 } 3645 3646 int ffs_name_dev(struct ffs_dev *dev, const char *name) 3647 { 3648 struct ffs_dev *existing; 3649 int ret = 0; 3650 3651 ffs_dev_lock(); 3652 3653 existing = _ffs_do_find_dev(name); 3654 if (!existing) 3655 strlcpy(dev->name, name, ARRAY_SIZE(dev->name)); 3656 else if (existing != dev) 3657 ret = -EBUSY; 3658 3659 ffs_dev_unlock(); 3660 3661 return ret; 3662 } 3663 EXPORT_SYMBOL_GPL(ffs_name_dev); 3664 3665 int ffs_single_dev(struct ffs_dev *dev) 3666 { 3667 int ret; 3668 3669 ret = 0; 3670 ffs_dev_lock(); 3671 3672 if (!list_is_singular(&ffs_devices)) 3673 ret = -EBUSY; 3674 else 3675 dev->single = true; 3676 3677 ffs_dev_unlock(); 3678 return ret; 3679 } 3680 EXPORT_SYMBOL_GPL(ffs_single_dev); 3681 3682 /* 3683 * ffs_lock must be taken by the caller of this function 3684 */ 3685 static void _ffs_free_dev(struct ffs_dev *dev) 3686 { 3687 list_del(&dev->entry); 3688 3689 /* Clear the private_data pointer to stop incorrect dev access */ 3690 if (dev->ffs_data) 3691 dev->ffs_data->private_data = NULL; 3692 3693 kfree(dev); 3694 if (list_empty(&ffs_devices)) 3695 functionfs_cleanup(); 3696 } 3697 3698 static void *ffs_acquire_dev(const char *dev_name) 3699 { 3700 struct ffs_dev *ffs_dev; 3701 3702 ENTER(); 3703 ffs_dev_lock(); 3704 3705 ffs_dev = _ffs_find_dev(dev_name); 3706 if (!ffs_dev) 3707 ffs_dev = ERR_PTR(-ENOENT); 3708 else if (ffs_dev->mounted) 3709 ffs_dev = ERR_PTR(-EBUSY); 3710 else if (ffs_dev->ffs_acquire_dev_callback && 3711 ffs_dev->ffs_acquire_dev_callback(ffs_dev)) 3712 ffs_dev = ERR_PTR(-ENOENT); 3713 else 3714 ffs_dev->mounted = true; 3715 3716 ffs_dev_unlock(); 3717 return ffs_dev; 3718 } 3719 3720 static void ffs_release_dev(struct ffs_data *ffs_data) 3721 { 3722 struct ffs_dev *ffs_dev; 3723 3724 ENTER(); 3725 ffs_dev_lock(); 3726 3727 ffs_dev = ffs_data->private_data; 3728 if (ffs_dev) { 3729 ffs_dev->mounted = false; 3730 3731 if (ffs_dev->ffs_release_dev_callback) 3732 ffs_dev->ffs_release_dev_callback(ffs_dev); 3733 } 3734 3735 ffs_dev_unlock(); 3736 } 3737 3738 static int ffs_ready(struct ffs_data *ffs) 3739 { 3740 struct ffs_dev *ffs_obj; 3741 int ret = 0; 3742 3743 ENTER(); 3744 ffs_dev_lock(); 3745 3746 ffs_obj = ffs->private_data; 3747 if (!ffs_obj) { 3748 ret = -EINVAL; 3749 goto done; 3750 } 3751 if (WARN_ON(ffs_obj->desc_ready)) { 3752 ret = -EBUSY; 3753 goto done; 3754 } 3755 3756 ffs_obj->desc_ready = true; 3757 ffs_obj->ffs_data = ffs; 3758 3759 if (ffs_obj->ffs_ready_callback) { 3760 ret = ffs_obj->ffs_ready_callback(ffs); 3761 if (ret) 3762 goto done; 3763 } 3764 3765 set_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags); 3766 done: 3767 ffs_dev_unlock(); 3768 return ret; 3769 } 3770 3771 static void ffs_closed(struct ffs_data *ffs) 3772 { 3773 struct ffs_dev *ffs_obj; 3774 struct f_fs_opts *opts; 3775 struct config_item *ci; 3776 3777 ENTER(); 3778 ffs_dev_lock(); 3779 3780 ffs_obj = ffs->private_data; 3781 if (!ffs_obj) 3782 goto done; 3783 3784 ffs_obj->desc_ready = false; 3785 ffs_obj->ffs_data = NULL; 3786 3787 if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) && 3788 ffs_obj->ffs_closed_callback) 3789 ffs_obj->ffs_closed_callback(ffs); 3790 3791 if (ffs_obj->opts) 3792 opts = ffs_obj->opts; 3793 else 3794 goto done; 3795 3796 if (opts->no_configfs || !opts->func_inst.group.cg_item.ci_parent 3797 || !kref_read(&opts->func_inst.group.cg_item.ci_kref)) 3798 goto done; 3799 3800 ci = opts->func_inst.group.cg_item.ci_parent->ci_parent; 3801 ffs_dev_unlock(); 3802 3803 if (test_bit(FFS_FL_BOUND, &ffs->flags)) 3804 unregister_gadget_item(ci); 3805 return; 3806 done: 3807 ffs_dev_unlock(); 3808 } 3809 3810 /* Misc helper functions ****************************************************/ 3811 3812 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock) 3813 { 3814 return nonblock 3815 ? likely(mutex_trylock(mutex)) ? 0 : -EAGAIN 3816 : mutex_lock_interruptible(mutex); 3817 } 3818 3819 static char *ffs_prepare_buffer(const char __user *buf, size_t len) 3820 { 3821 char *data; 3822 3823 if (unlikely(!len)) 3824 return NULL; 3825 3826 data = kmalloc(len, GFP_KERNEL); 3827 if (unlikely(!data)) 3828 return ERR_PTR(-ENOMEM); 3829 3830 if (unlikely(copy_from_user(data, buf, len))) { 3831 kfree(data); 3832 return ERR_PTR(-EFAULT); 3833 } 3834 3835 pr_vdebug("Buffer from user space:\n"); 3836 ffs_dump_mem("", data, len); 3837 3838 return data; 3839 } 3840 3841 DECLARE_USB_FUNCTION_INIT(ffs, ffs_alloc_inst, ffs_alloc); 3842 MODULE_LICENSE("GPL"); 3843 MODULE_AUTHOR("Michal Nazarewicz"); 3844