1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * f_fs.c -- user mode file system API for USB composite function controllers 4 * 5 * Copyright (C) 2010 Samsung Electronics 6 * Author: Michal Nazarewicz <mina86@mina86.com> 7 * 8 * Based on inode.c (GadgetFS) which was: 9 * Copyright (C) 2003-2004 David Brownell 10 * Copyright (C) 2003 Agilent Technologies 11 */ 12 13 14 /* #define DEBUG */ 15 /* #define VERBOSE_DEBUG */ 16 17 #include <linux/blkdev.h> 18 #include <linux/dma-buf.h> 19 #include <linux/dma-fence.h> 20 #include <linux/dma-resv.h> 21 #include <linux/pagemap.h> 22 #include <linux/export.h> 23 #include <linux/fs_parser.h> 24 #include <linux/hid.h> 25 #include <linux/mm.h> 26 #include <linux/module.h> 27 #include <linux/scatterlist.h> 28 #include <linux/sched/signal.h> 29 #include <linux/uio.h> 30 #include <linux/vmalloc.h> 31 #include <linux/unaligned.h> 32 33 #include <linux/usb/ccid.h> 34 #include <linux/usb/composite.h> 35 #include <linux/usb/functionfs.h> 36 #include <linux/usb/func_utils.h> 37 38 #include <linux/aio.h> 39 #include <linux/kthread.h> 40 #include <linux/poll.h> 41 #include <linux/eventfd.h> 42 43 #include "u_fs.h" 44 #include "u_os_desc.h" 45 #include "configfs.h" 46 47 #define FUNCTIONFS_MAGIC 0xa647361 /* Chosen by a honest dice roll ;) */ 48 #define MAX_ALT_SETTINGS 2 /* Allow up to 2 alt settings to be set. */ 49 50 #define DMABUF_ENQUEUE_TIMEOUT_MS 5000 51 52 MODULE_IMPORT_NS("DMA_BUF"); 53 54 /* Reference counter handling */ 55 static void ffs_data_get(struct ffs_data *ffs); 56 static void ffs_data_put(struct ffs_data *ffs); 57 /* Creates new ffs_data object. */ 58 static struct ffs_data *__must_check ffs_data_new(const char *dev_name) 59 __attribute__((malloc)); 60 61 /* Opened counter handling. */ 62 static void ffs_data_closed(struct ffs_data *ffs); 63 64 /* Called with ffs->mutex held; take over ownership of data. */ 65 static int __must_check 66 __ffs_data_got_descs(struct ffs_data *ffs, char *data, size_t len); 67 static int __must_check 68 __ffs_data_got_strings(struct ffs_data *ffs, char *data, size_t len); 69 70 71 /* The function structure ***************************************************/ 72 73 struct ffs_ep; 74 75 struct ffs_function { 76 struct usb_configuration *conf; 77 struct usb_gadget *gadget; 78 struct ffs_data *ffs; 79 80 struct ffs_ep *eps; 81 u8 eps_revmap[16]; 82 short *interfaces_nums; 83 84 struct usb_function function; 85 int cur_alt[MAX_CONFIG_INTERFACES]; 86 }; 87 88 89 static struct ffs_function *ffs_func_from_usb(struct usb_function *f) 90 { 91 return container_of(f, struct ffs_function, function); 92 } 93 94 95 static inline enum ffs_setup_state 96 ffs_setup_state_clear_cancelled(struct ffs_data *ffs) 97 { 98 return (enum ffs_setup_state) 99 cmpxchg(&ffs->setup_state, FFS_SETUP_CANCELLED, FFS_NO_SETUP); 100 } 101 102 103 static void ffs_func_eps_disable(struct ffs_function *func); 104 static int __must_check ffs_func_eps_enable(struct ffs_function *func); 105 106 static int ffs_func_bind(struct usb_configuration *, 107 struct usb_function *); 108 static int ffs_func_set_alt(struct usb_function *, unsigned, unsigned); 109 static int ffs_func_get_alt(struct usb_function *f, unsigned int intf); 110 static void ffs_func_disable(struct usb_function *); 111 static int ffs_func_setup(struct usb_function *, 112 const struct usb_ctrlrequest *); 113 static bool ffs_func_req_match(struct usb_function *, 114 const struct usb_ctrlrequest *, 115 bool config0); 116 static void ffs_func_suspend(struct usb_function *); 117 static void ffs_func_resume(struct usb_function *); 118 119 120 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num); 121 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf); 122 123 124 /* The endpoints structures *************************************************/ 125 126 struct ffs_ep { 127 struct usb_ep *ep; /* P: ffs->eps_lock */ 128 struct usb_request *req; /* P: epfile->mutex */ 129 130 /* [0]: full speed, [1]: high speed, [2]: super speed */ 131 struct usb_endpoint_descriptor *descs[3]; 132 133 u8 num; 134 }; 135 136 struct ffs_dmabuf_priv { 137 struct list_head entry; 138 struct kref ref; 139 struct ffs_data *ffs; 140 struct dma_buf_attachment *attach; 141 struct sg_table *sgt; 142 enum dma_data_direction dir; 143 spinlock_t lock; 144 u64 context; 145 struct usb_request *req; /* P: ffs->eps_lock */ 146 struct usb_ep *ep; /* P: ffs->eps_lock */ 147 }; 148 149 struct ffs_dma_fence { 150 struct dma_fence base; 151 struct ffs_dmabuf_priv *priv; 152 struct work_struct work; 153 struct usb_ep *ep; 154 struct usb_request *req; 155 }; 156 157 struct ffs_epfile { 158 /* Protects ep->ep and ep->req. */ 159 struct mutex mutex; 160 161 struct ffs_data *ffs; 162 struct ffs_ep *ep; /* P: ffs->eps_lock */ 163 164 /* 165 * Buffer for holding data from partial reads which may happen since 166 * we’re rounding user read requests to a multiple of a max packet size. 167 * 168 * The pointer is initialised with NULL value and may be set by 169 * __ffs_epfile_read_data function to point to a temporary buffer. 170 * 171 * In normal operation, calls to __ffs_epfile_read_buffered will consume 172 * data from said buffer and eventually free it. Importantly, while the 173 * function is using the buffer, it sets the pointer to NULL. This is 174 * all right since __ffs_epfile_read_data and __ffs_epfile_read_buffered 175 * can never run concurrently (they are synchronised by epfile->mutex) 176 * so the latter will not assign a new value to the pointer. 177 * 178 * Meanwhile ffs_func_eps_disable frees the buffer (if the pointer is 179 * valid) and sets the pointer to READ_BUFFER_DROP value. This special 180 * value is crux of the synchronisation between ffs_func_eps_disable and 181 * __ffs_epfile_read_data. 182 * 183 * Once __ffs_epfile_read_data is about to finish it will try to set the 184 * pointer back to its old value (as described above), but seeing as the 185 * pointer is not-NULL (namely READ_BUFFER_DROP) it will instead free 186 * the buffer. 187 * 188 * == State transitions == 189 * 190 * • ptr == NULL: (initial state) 191 * ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP 192 * ◦ __ffs_epfile_read_buffered: nop 193 * ◦ __ffs_epfile_read_data allocates temp buffer: go to ptr == buf 194 * ◦ reading finishes: n/a, not in ‘and reading’ state 195 * • ptr == DROP: 196 * ◦ __ffs_epfile_read_buffer_free: nop 197 * ◦ __ffs_epfile_read_buffered: go to ptr == NULL 198 * ◦ __ffs_epfile_read_data allocates temp buffer: free buf, nop 199 * ◦ reading finishes: n/a, not in ‘and reading’ state 200 * • ptr == buf: 201 * ◦ __ffs_epfile_read_buffer_free: free buf, go to ptr == DROP 202 * ◦ __ffs_epfile_read_buffered: go to ptr == NULL and reading 203 * ◦ __ffs_epfile_read_data: n/a, __ffs_epfile_read_buffered 204 * is always called first 205 * ◦ reading finishes: n/a, not in ‘and reading’ state 206 * • ptr == NULL and reading: 207 * ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP and reading 208 * ◦ __ffs_epfile_read_buffered: n/a, mutex is held 209 * ◦ __ffs_epfile_read_data: n/a, mutex is held 210 * ◦ reading finishes and … 211 * … all data read: free buf, go to ptr == NULL 212 * … otherwise: go to ptr == buf and reading 213 * • ptr == DROP and reading: 214 * ◦ __ffs_epfile_read_buffer_free: nop 215 * ◦ __ffs_epfile_read_buffered: n/a, mutex is held 216 * ◦ __ffs_epfile_read_data: n/a, mutex is held 217 * ◦ reading finishes: free buf, go to ptr == DROP 218 */ 219 struct ffs_buffer *read_buffer; 220 #define READ_BUFFER_DROP ((struct ffs_buffer *)ERR_PTR(-ESHUTDOWN)) 221 222 char name[5]; 223 224 unsigned char in; /* P: ffs->eps_lock */ 225 unsigned char isoc; /* P: ffs->eps_lock */ 226 227 unsigned char _pad; 228 229 /* Protects dmabufs */ 230 struct mutex dmabufs_mutex; 231 struct list_head dmabufs; /* P: dmabufs_mutex */ 232 atomic_t seqno; 233 }; 234 235 struct ffs_buffer { 236 size_t length; 237 char *data; 238 char storage[] __counted_by(length); 239 }; 240 241 /* ffs_io_data structure ***************************************************/ 242 243 struct ffs_io_data { 244 bool aio; 245 bool read; 246 247 struct kiocb *kiocb; 248 struct iov_iter data; 249 const void *to_free; 250 char *buf; 251 252 struct mm_struct *mm; 253 struct work_struct work; 254 255 struct usb_ep *ep; 256 struct usb_request *req; 257 struct sg_table sgt; 258 bool use_sg; 259 260 struct ffs_data *ffs; 261 262 int status; 263 struct completion done; 264 }; 265 266 struct ffs_desc_helper { 267 struct ffs_data *ffs; 268 unsigned interfaces_count; 269 unsigned eps_count; 270 }; 271 272 static int __must_check ffs_epfiles_create(struct ffs_data *ffs); 273 static void ffs_epfiles_destroy(struct super_block *sb, 274 struct ffs_epfile *epfiles, unsigned count); 275 276 static int ffs_sb_create_file(struct super_block *sb, const char *name, 277 void *data, const struct file_operations *fops); 278 279 /* Devices management *******************************************************/ 280 281 DEFINE_MUTEX(ffs_lock); 282 EXPORT_SYMBOL_GPL(ffs_lock); 283 284 static struct ffs_dev *_ffs_find_dev(const char *name); 285 static struct ffs_dev *_ffs_alloc_dev(void); 286 static void _ffs_free_dev(struct ffs_dev *dev); 287 static int ffs_acquire_dev(const char *dev_name, struct ffs_data *ffs_data); 288 static void ffs_release_dev(struct ffs_dev *ffs_dev); 289 static int ffs_ready(struct ffs_data *ffs); 290 static void ffs_closed(struct ffs_data *ffs); 291 static void ffs_reset_work(struct work_struct *work); 292 293 /* Misc helper functions ****************************************************/ 294 295 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock) 296 __attribute__((warn_unused_result, nonnull)); 297 static char *ffs_prepare_buffer(const char __user *buf, size_t len) 298 __attribute__((warn_unused_result, nonnull)); 299 300 301 /* Control file aka ep0 *****************************************************/ 302 303 static void ffs_ep0_complete(struct usb_ep *ep, struct usb_request *req) 304 { 305 struct ffs_data *ffs = req->context; 306 307 complete(&ffs->ep0req_completion); 308 } 309 310 static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len) 311 __releases(&ffs->ev.waitq.lock) 312 { 313 struct usb_request *req = ffs->ep0req; 314 int ret; 315 316 if (!req) { 317 spin_unlock_irq(&ffs->ev.waitq.lock); 318 return -EINVAL; 319 } 320 321 req->zero = len < le16_to_cpu(ffs->ev.setup.wLength); 322 323 spin_unlock_irq(&ffs->ev.waitq.lock); 324 325 req->buf = data; 326 req->length = len; 327 328 /* 329 * UDC layer requires to provide a buffer even for ZLP, but should 330 * not use it at all. Let's provide some poisoned pointer to catch 331 * possible bug in the driver. 332 */ 333 if (req->buf == NULL) 334 req->buf = (void *)0xDEADBABE; 335 336 reinit_completion(&ffs->ep0req_completion); 337 338 ret = usb_ep_queue(ffs->gadget->ep0, req, GFP_ATOMIC); 339 if (ret < 0) 340 return ret; 341 342 ret = wait_for_completion_interruptible(&ffs->ep0req_completion); 343 if (ret) { 344 usb_ep_dequeue(ffs->gadget->ep0, req); 345 return -EINTR; 346 } 347 348 ffs->setup_state = FFS_NO_SETUP; 349 return req->status ? req->status : req->actual; 350 } 351 352 static int __ffs_ep0_stall(struct ffs_data *ffs) 353 { 354 if (ffs->ev.can_stall) { 355 pr_vdebug("ep0 stall\n"); 356 usb_ep_set_halt(ffs->gadget->ep0); 357 ffs->setup_state = FFS_NO_SETUP; 358 return -EL2HLT; 359 } else { 360 pr_debug("bogus ep0 stall!\n"); 361 return -ESRCH; 362 } 363 } 364 365 static ssize_t ffs_ep0_write(struct file *file, const char __user *buf, 366 size_t len, loff_t *ptr) 367 { 368 struct ffs_data *ffs = file->private_data; 369 ssize_t ret; 370 char *data; 371 372 /* Fast check if setup was canceled */ 373 if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED) 374 return -EIDRM; 375 376 /* Acquire mutex */ 377 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK); 378 if (ret < 0) 379 return ret; 380 381 /* Check state */ 382 switch (ffs->state) { 383 case FFS_READ_DESCRIPTORS: 384 case FFS_READ_STRINGS: 385 /* Copy data */ 386 if (len < 16) { 387 ret = -EINVAL; 388 break; 389 } 390 391 data = ffs_prepare_buffer(buf, len); 392 if (IS_ERR(data)) { 393 ret = PTR_ERR(data); 394 break; 395 } 396 397 /* Handle data */ 398 if (ffs->state == FFS_READ_DESCRIPTORS) { 399 pr_info("read descriptors\n"); 400 ret = __ffs_data_got_descs(ffs, data, len); 401 if (ret < 0) 402 break; 403 404 ffs->state = FFS_READ_STRINGS; 405 ret = len; 406 } else { 407 pr_info("read strings\n"); 408 ret = __ffs_data_got_strings(ffs, data, len); 409 if (ret < 0) 410 break; 411 412 ret = ffs_epfiles_create(ffs); 413 if (ret) { 414 ffs->state = FFS_CLOSING; 415 break; 416 } 417 418 ffs->state = FFS_ACTIVE; 419 mutex_unlock(&ffs->mutex); 420 421 ret = ffs_ready(ffs); 422 if (ret < 0) { 423 ffs->state = FFS_CLOSING; 424 return ret; 425 } 426 427 return len; 428 } 429 break; 430 431 case FFS_ACTIVE: 432 data = NULL; 433 /* 434 * We're called from user space, we can use _irq 435 * rather then _irqsave 436 */ 437 spin_lock_irq(&ffs->ev.waitq.lock); 438 switch (ffs_setup_state_clear_cancelled(ffs)) { 439 case FFS_SETUP_CANCELLED: 440 ret = -EIDRM; 441 goto done_spin; 442 443 case FFS_NO_SETUP: 444 ret = -ESRCH; 445 goto done_spin; 446 447 case FFS_SETUP_PENDING: 448 break; 449 } 450 451 /* FFS_SETUP_PENDING */ 452 if (!(ffs->ev.setup.bRequestType & USB_DIR_IN)) { 453 spin_unlock_irq(&ffs->ev.waitq.lock); 454 ret = __ffs_ep0_stall(ffs); 455 break; 456 } 457 458 /* FFS_SETUP_PENDING and not stall */ 459 len = min_t(size_t, len, le16_to_cpu(ffs->ev.setup.wLength)); 460 461 spin_unlock_irq(&ffs->ev.waitq.lock); 462 463 data = ffs_prepare_buffer(buf, len); 464 if (IS_ERR(data)) { 465 ret = PTR_ERR(data); 466 break; 467 } 468 469 spin_lock_irq(&ffs->ev.waitq.lock); 470 471 /* 472 * We are guaranteed to be still in FFS_ACTIVE state 473 * but the state of setup could have changed from 474 * FFS_SETUP_PENDING to FFS_SETUP_CANCELLED so we need 475 * to check for that. If that happened we copied data 476 * from user space in vain but it's unlikely. 477 * 478 * For sure we are not in FFS_NO_SETUP since this is 479 * the only place FFS_SETUP_PENDING -> FFS_NO_SETUP 480 * transition can be performed and it's protected by 481 * mutex. 482 */ 483 if (ffs_setup_state_clear_cancelled(ffs) == 484 FFS_SETUP_CANCELLED) { 485 ret = -EIDRM; 486 done_spin: 487 spin_unlock_irq(&ffs->ev.waitq.lock); 488 } else { 489 /* unlocks spinlock */ 490 ret = __ffs_ep0_queue_wait(ffs, data, len); 491 } 492 kfree(data); 493 break; 494 495 default: 496 ret = -EBADFD; 497 break; 498 } 499 500 mutex_unlock(&ffs->mutex); 501 return ret; 502 } 503 504 /* Called with ffs->ev.waitq.lock and ffs->mutex held, both released on exit. */ 505 static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf, 506 size_t n) 507 __releases(&ffs->ev.waitq.lock) 508 { 509 /* 510 * n cannot be bigger than ffs->ev.count, which cannot be bigger than 511 * size of ffs->ev.types array (which is four) so that's how much space 512 * we reserve. 513 */ 514 struct usb_functionfs_event events[ARRAY_SIZE(ffs->ev.types)]; 515 const size_t size = n * sizeof *events; 516 unsigned i = 0; 517 518 memset(events, 0, size); 519 520 do { 521 events[i].type = ffs->ev.types[i]; 522 if (events[i].type == FUNCTIONFS_SETUP) { 523 events[i].u.setup = ffs->ev.setup; 524 ffs->setup_state = FFS_SETUP_PENDING; 525 } 526 } while (++i < n); 527 528 ffs->ev.count -= n; 529 if (ffs->ev.count) 530 memmove(ffs->ev.types, ffs->ev.types + n, 531 ffs->ev.count * sizeof *ffs->ev.types); 532 533 spin_unlock_irq(&ffs->ev.waitq.lock); 534 mutex_unlock(&ffs->mutex); 535 536 return copy_to_user(buf, events, size) ? -EFAULT : size; 537 } 538 539 static ssize_t ffs_ep0_read(struct file *file, char __user *buf, 540 size_t len, loff_t *ptr) 541 { 542 struct ffs_data *ffs = file->private_data; 543 char *data = NULL; 544 size_t n; 545 int ret; 546 547 /* Fast check if setup was canceled */ 548 if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED) 549 return -EIDRM; 550 551 /* Acquire mutex */ 552 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK); 553 if (ret < 0) 554 return ret; 555 556 /* Check state */ 557 if (ffs->state != FFS_ACTIVE) { 558 ret = -EBADFD; 559 goto done_mutex; 560 } 561 562 /* 563 * We're called from user space, we can use _irq rather then 564 * _irqsave 565 */ 566 spin_lock_irq(&ffs->ev.waitq.lock); 567 568 switch (ffs_setup_state_clear_cancelled(ffs)) { 569 case FFS_SETUP_CANCELLED: 570 ret = -EIDRM; 571 break; 572 573 case FFS_NO_SETUP: 574 n = len / sizeof(struct usb_functionfs_event); 575 if (!n) { 576 ret = -EINVAL; 577 break; 578 } 579 580 if ((file->f_flags & O_NONBLOCK) && !ffs->ev.count) { 581 ret = -EAGAIN; 582 break; 583 } 584 585 if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq, 586 ffs->ev.count)) { 587 ret = -EINTR; 588 break; 589 } 590 591 /* unlocks spinlock */ 592 return __ffs_ep0_read_events(ffs, buf, 593 min_t(size_t, n, ffs->ev.count)); 594 595 case FFS_SETUP_PENDING: 596 if (ffs->ev.setup.bRequestType & USB_DIR_IN) { 597 spin_unlock_irq(&ffs->ev.waitq.lock); 598 ret = __ffs_ep0_stall(ffs); 599 goto done_mutex; 600 } 601 602 len = min_t(size_t, len, le16_to_cpu(ffs->ev.setup.wLength)); 603 604 spin_unlock_irq(&ffs->ev.waitq.lock); 605 606 if (len) { 607 data = kmalloc(len, GFP_KERNEL); 608 if (!data) { 609 ret = -ENOMEM; 610 goto done_mutex; 611 } 612 } 613 614 spin_lock_irq(&ffs->ev.waitq.lock); 615 616 /* See ffs_ep0_write() */ 617 if (ffs_setup_state_clear_cancelled(ffs) == 618 FFS_SETUP_CANCELLED) { 619 ret = -EIDRM; 620 break; 621 } 622 623 /* unlocks spinlock */ 624 ret = __ffs_ep0_queue_wait(ffs, data, len); 625 if ((ret > 0) && (copy_to_user(buf, data, ret))) 626 ret = -EFAULT; 627 goto done_mutex; 628 629 default: 630 ret = -EBADFD; 631 break; 632 } 633 634 spin_unlock_irq(&ffs->ev.waitq.lock); 635 done_mutex: 636 mutex_unlock(&ffs->mutex); 637 kfree(data); 638 return ret; 639 } 640 641 642 static void ffs_data_reset(struct ffs_data *ffs); 643 644 static int ffs_ep0_open(struct inode *inode, struct file *file) 645 { 646 struct ffs_data *ffs = inode->i_sb->s_fs_info; 647 648 spin_lock_irq(&ffs->eps_lock); 649 if (ffs->state == FFS_CLOSING) { 650 spin_unlock_irq(&ffs->eps_lock); 651 return -EBUSY; 652 } 653 if (!ffs->opened++ && ffs->state == FFS_DEACTIVATED) { 654 ffs->state = FFS_CLOSING; 655 spin_unlock_irq(&ffs->eps_lock); 656 ffs_data_reset(ffs); 657 } else { 658 spin_unlock_irq(&ffs->eps_lock); 659 } 660 file->private_data = ffs; 661 662 return stream_open(inode, file); 663 } 664 665 static int ffs_ep0_release(struct inode *inode, struct file *file) 666 { 667 struct ffs_data *ffs = file->private_data; 668 669 ffs_data_closed(ffs); 670 671 return 0; 672 } 673 674 static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value) 675 { 676 struct ffs_data *ffs = file->private_data; 677 struct usb_gadget *gadget = ffs->gadget; 678 long ret; 679 680 if (code == FUNCTIONFS_INTERFACE_REVMAP) { 681 struct ffs_function *func = ffs->func; 682 ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV; 683 } else if (gadget && gadget->ops->ioctl) { 684 ret = gadget->ops->ioctl(gadget, code, value); 685 } else { 686 ret = -ENOTTY; 687 } 688 689 return ret; 690 } 691 692 static __poll_t ffs_ep0_poll(struct file *file, poll_table *wait) 693 { 694 struct ffs_data *ffs = file->private_data; 695 __poll_t mask = EPOLLWRNORM; 696 int ret; 697 698 poll_wait(file, &ffs->ev.waitq, wait); 699 700 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK); 701 if (ret < 0) 702 return mask; 703 704 switch (ffs->state) { 705 case FFS_READ_DESCRIPTORS: 706 case FFS_READ_STRINGS: 707 mask |= EPOLLOUT; 708 break; 709 710 case FFS_ACTIVE: 711 switch (ffs->setup_state) { 712 case FFS_NO_SETUP: 713 if (ffs->ev.count) 714 mask |= EPOLLIN; 715 break; 716 717 case FFS_SETUP_PENDING: 718 case FFS_SETUP_CANCELLED: 719 mask |= (EPOLLIN | EPOLLOUT); 720 break; 721 } 722 break; 723 724 case FFS_CLOSING: 725 break; 726 case FFS_DEACTIVATED: 727 break; 728 } 729 730 mutex_unlock(&ffs->mutex); 731 732 return mask; 733 } 734 735 static const struct file_operations ffs_ep0_operations = { 736 737 .open = ffs_ep0_open, 738 .write = ffs_ep0_write, 739 .read = ffs_ep0_read, 740 .release = ffs_ep0_release, 741 .unlocked_ioctl = ffs_ep0_ioctl, 742 .poll = ffs_ep0_poll, 743 }; 744 745 746 /* "Normal" endpoints operations ********************************************/ 747 748 static void ffs_epfile_io_complete(struct usb_ep *_ep, struct usb_request *req) 749 { 750 struct ffs_io_data *io_data = req->context; 751 752 if (req->status) 753 io_data->status = req->status; 754 else 755 io_data->status = req->actual; 756 757 complete(&io_data->done); 758 } 759 760 static ssize_t ffs_copy_to_iter(void *data, int data_len, struct iov_iter *iter) 761 { 762 ssize_t ret = copy_to_iter(data, data_len, iter); 763 if (ret == data_len) 764 return ret; 765 766 if (iov_iter_count(iter)) 767 return -EFAULT; 768 769 /* 770 * Dear user space developer! 771 * 772 * TL;DR: To stop getting below error message in your kernel log, change 773 * user space code using functionfs to align read buffers to a max 774 * packet size. 775 * 776 * Some UDCs (e.g. dwc3) require request sizes to be a multiple of a max 777 * packet size. When unaligned buffer is passed to functionfs, it 778 * internally uses a larger, aligned buffer so that such UDCs are happy. 779 * 780 * Unfortunately, this means that host may send more data than was 781 * requested in read(2) system call. f_fs doesn’t know what to do with 782 * that excess data so it simply drops it. 783 * 784 * Was the buffer aligned in the first place, no such problem would 785 * happen. 786 * 787 * Data may be dropped only in AIO reads. Synchronous reads are handled 788 * by splitting a request into multiple parts. This splitting may still 789 * be a problem though so it’s likely best to align the buffer 790 * regardless of it being AIO or not.. 791 * 792 * This only affects OUT endpoints, i.e. reading data with a read(2), 793 * aio_read(2) etc. system calls. Writing data to an IN endpoint is not 794 * affected. 795 */ 796 pr_err("functionfs read size %d > requested size %zd, dropping excess data. " 797 "Align read buffer size to max packet size to avoid the problem.\n", 798 data_len, ret); 799 800 return ret; 801 } 802 803 /* 804 * allocate a virtually contiguous buffer and create a scatterlist describing it 805 * @sg_table - pointer to a place to be filled with sg_table contents 806 * @size - required buffer size 807 */ 808 static void *ffs_build_sg_list(struct sg_table *sgt, size_t sz) 809 { 810 struct page **pages; 811 void *vaddr, *ptr; 812 unsigned int n_pages; 813 int i; 814 815 vaddr = vmalloc(sz); 816 if (!vaddr) 817 return NULL; 818 819 n_pages = PAGE_ALIGN(sz) >> PAGE_SHIFT; 820 pages = kvmalloc_objs(struct page *, n_pages); 821 if (!pages) { 822 vfree(vaddr); 823 824 return NULL; 825 } 826 for (i = 0, ptr = vaddr; i < n_pages; ++i, ptr += PAGE_SIZE) 827 pages[i] = vmalloc_to_page(ptr); 828 829 if (sg_alloc_table_from_pages(sgt, pages, n_pages, 0, sz, GFP_KERNEL)) { 830 kvfree(pages); 831 vfree(vaddr); 832 833 return NULL; 834 } 835 kvfree(pages); 836 837 return vaddr; 838 } 839 840 static inline void *ffs_alloc_buffer(struct ffs_io_data *io_data, 841 size_t data_len) 842 { 843 if (io_data->use_sg) 844 return ffs_build_sg_list(&io_data->sgt, data_len); 845 846 return kmalloc(data_len, GFP_KERNEL); 847 } 848 849 static inline void ffs_free_buffer(struct ffs_io_data *io_data) 850 { 851 if (!io_data->buf) 852 return; 853 854 if (io_data->use_sg) { 855 sg_free_table(&io_data->sgt); 856 vfree(io_data->buf); 857 } else { 858 kfree(io_data->buf); 859 } 860 } 861 862 static void ffs_user_copy_worker(struct work_struct *work) 863 { 864 struct ffs_io_data *io_data = container_of(work, struct ffs_io_data, 865 work); 866 int ret = io_data->status; 867 bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD; 868 869 if (io_data->read && ret > 0) { 870 kthread_use_mm(io_data->mm); 871 ret = ffs_copy_to_iter(io_data->buf, ret, &io_data->data); 872 kthread_unuse_mm(io_data->mm); 873 } 874 875 io_data->kiocb->ki_complete(io_data->kiocb, ret); 876 877 if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd) 878 eventfd_signal(io_data->ffs->ffs_eventfd); 879 880 usb_ep_free_request(io_data->ep, io_data->req); 881 882 if (io_data->read) 883 kfree(io_data->to_free); 884 ffs_free_buffer(io_data); 885 kfree(io_data); 886 } 887 888 static void ffs_epfile_async_io_complete(struct usb_ep *_ep, 889 struct usb_request *req) 890 { 891 struct ffs_io_data *io_data = req->context; 892 struct ffs_data *ffs = io_data->ffs; 893 894 io_data->status = req->status ? req->status : req->actual; 895 896 INIT_WORK(&io_data->work, ffs_user_copy_worker); 897 queue_work(ffs->io_completion_wq, &io_data->work); 898 } 899 900 static void __ffs_epfile_read_buffer_free(struct ffs_epfile *epfile) 901 { 902 /* 903 * See comment in struct ffs_epfile for full read_buffer pointer 904 * synchronisation story. 905 */ 906 struct ffs_buffer *buf = xchg(&epfile->read_buffer, READ_BUFFER_DROP); 907 if (buf && buf != READ_BUFFER_DROP) 908 kfree(buf); 909 } 910 911 /* Assumes epfile->mutex is held. */ 912 static ssize_t __ffs_epfile_read_buffered(struct ffs_epfile *epfile, 913 struct iov_iter *iter) 914 { 915 /* 916 * Null out epfile->read_buffer so ffs_func_eps_disable does not free 917 * the buffer while we are using it. See comment in struct ffs_epfile 918 * for full read_buffer pointer synchronisation story. 919 */ 920 struct ffs_buffer *buf = xchg(&epfile->read_buffer, NULL); 921 ssize_t ret; 922 if (!buf || buf == READ_BUFFER_DROP) 923 return 0; 924 925 ret = copy_to_iter(buf->data, buf->length, iter); 926 if (buf->length == ret) { 927 kfree(buf); 928 return ret; 929 } 930 931 if (iov_iter_count(iter)) { 932 ret = -EFAULT; 933 } else { 934 buf->length -= ret; 935 buf->data += ret; 936 } 937 938 if (cmpxchg(&epfile->read_buffer, NULL, buf)) 939 kfree(buf); 940 941 return ret; 942 } 943 944 /* Assumes epfile->mutex is held. */ 945 static ssize_t __ffs_epfile_read_data(struct ffs_epfile *epfile, 946 void *data, int data_len, 947 struct iov_iter *iter) 948 { 949 struct ffs_buffer *buf; 950 951 ssize_t ret = copy_to_iter(data, data_len, iter); 952 if (data_len == ret) 953 return ret; 954 955 if (iov_iter_count(iter)) 956 return -EFAULT; 957 958 /* See ffs_copy_to_iter for more context. */ 959 pr_warn("functionfs read size %d > requested size %zd, splitting request into multiple reads.", 960 data_len, ret); 961 962 data_len -= ret; 963 buf = kmalloc_flex(*buf, storage, data_len); 964 if (!buf) 965 return -ENOMEM; 966 buf->length = data_len; 967 buf->data = buf->storage; 968 memcpy(buf->storage, data + ret, flex_array_size(buf, storage, data_len)); 969 970 /* 971 * At this point read_buffer is NULL or READ_BUFFER_DROP (if 972 * ffs_func_eps_disable has been called in the meanwhile). See comment 973 * in struct ffs_epfile for full read_buffer pointer synchronisation 974 * story. 975 */ 976 if (cmpxchg(&epfile->read_buffer, NULL, buf)) 977 kfree(buf); 978 979 return ret; 980 } 981 982 static struct ffs_ep *ffs_epfile_wait_ep(struct file *file) 983 { 984 struct ffs_epfile *epfile = file->private_data; 985 struct ffs_ep *ep; 986 int ret; 987 988 /* Wait for endpoint to be enabled */ 989 ep = epfile->ep; 990 if (!ep) { 991 if (file->f_flags & O_NONBLOCK) 992 return ERR_PTR(-EAGAIN); 993 994 ret = wait_event_interruptible( 995 epfile->ffs->wait, (ep = epfile->ep)); 996 if (ret) 997 return ERR_PTR(-EINTR); 998 } 999 1000 return ep; 1001 } 1002 1003 static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) 1004 { 1005 struct ffs_epfile *epfile = file->private_data; 1006 struct usb_request *req; 1007 struct ffs_ep *ep; 1008 char *data = NULL; 1009 ssize_t ret, data_len = -EINVAL; 1010 int halt; 1011 1012 /* Are we still active? */ 1013 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE)) 1014 return -ENODEV; 1015 1016 ep = ffs_epfile_wait_ep(file); 1017 if (IS_ERR(ep)) 1018 return PTR_ERR(ep); 1019 1020 /* Do we halt? */ 1021 halt = (!io_data->read == !epfile->in); 1022 if (halt && epfile->isoc) 1023 return -EINVAL; 1024 1025 /* We will be using request and read_buffer */ 1026 ret = ffs_mutex_lock(&epfile->mutex, file->f_flags & O_NONBLOCK); 1027 if (ret) 1028 goto error; 1029 1030 /* Allocate & copy */ 1031 if (!halt) { 1032 struct usb_gadget *gadget; 1033 1034 /* 1035 * Do we have buffered data from previous partial read? Check 1036 * that for synchronous case only because we do not have 1037 * facility to ‘wake up’ a pending asynchronous read and push 1038 * buffered data to it which we would need to make things behave 1039 * consistently. 1040 */ 1041 if (!io_data->aio && io_data->read) { 1042 ret = __ffs_epfile_read_buffered(epfile, &io_data->data); 1043 if (ret) 1044 goto error_mutex; 1045 } 1046 1047 /* 1048 * if we _do_ wait above, the epfile->ffs->gadget might be NULL 1049 * before the waiting completes, so do not assign to 'gadget' 1050 * earlier 1051 */ 1052 gadget = epfile->ffs->gadget; 1053 1054 spin_lock_irq(&epfile->ffs->eps_lock); 1055 /* In the meantime, endpoint got disabled or changed. */ 1056 if (epfile->ep != ep) { 1057 ret = -ESHUTDOWN; 1058 goto error_lock; 1059 } 1060 data_len = iov_iter_count(&io_data->data); 1061 /* 1062 * Controller may require buffer size to be aligned to 1063 * maxpacketsize of an out endpoint. 1064 */ 1065 if (io_data->read) 1066 data_len = usb_ep_align_maybe(gadget, ep->ep, data_len); 1067 1068 io_data->use_sg = gadget->sg_supported && data_len > PAGE_SIZE; 1069 spin_unlock_irq(&epfile->ffs->eps_lock); 1070 1071 data = ffs_alloc_buffer(io_data, data_len); 1072 if (!data) { 1073 ret = -ENOMEM; 1074 goto error_mutex; 1075 } 1076 if (!io_data->read && 1077 !copy_from_iter_full(data, data_len, &io_data->data)) { 1078 ret = -EFAULT; 1079 goto error_mutex; 1080 } 1081 } 1082 1083 spin_lock_irq(&epfile->ffs->eps_lock); 1084 1085 if (epfile->ep != ep) { 1086 /* In the meantime, endpoint got disabled or changed. */ 1087 ret = -ESHUTDOWN; 1088 } else if (halt) { 1089 ret = usb_ep_set_halt(ep->ep); 1090 if (!ret) 1091 ret = -EBADMSG; 1092 } else if (data_len == -EINVAL) { 1093 /* 1094 * Sanity Check: even though data_len can't be used 1095 * uninitialized at the time I write this comment, some 1096 * compilers complain about this situation. 1097 * In order to keep the code clean from warnings, data_len is 1098 * being initialized to -EINVAL during its declaration, which 1099 * means we can't rely on compiler anymore to warn no future 1100 * changes won't result in data_len being used uninitialized. 1101 * For such reason, we're adding this redundant sanity check 1102 * here. 1103 */ 1104 WARN(1, "%s: data_len == -EINVAL\n", __func__); 1105 ret = -EINVAL; 1106 } else if (!io_data->aio) { 1107 bool interrupted = false; 1108 1109 req = ep->req; 1110 if (io_data->use_sg) { 1111 req->buf = NULL; 1112 req->sg = io_data->sgt.sgl; 1113 req->num_sgs = io_data->sgt.nents; 1114 } else { 1115 req->buf = data; 1116 req->num_sgs = 0; 1117 } 1118 req->length = data_len; 1119 1120 io_data->buf = data; 1121 1122 init_completion(&io_data->done); 1123 req->context = io_data; 1124 req->complete = ffs_epfile_io_complete; 1125 1126 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC); 1127 if (ret < 0) 1128 goto error_lock; 1129 1130 spin_unlock_irq(&epfile->ffs->eps_lock); 1131 1132 if (wait_for_completion_interruptible(&io_data->done)) { 1133 spin_lock_irq(&epfile->ffs->eps_lock); 1134 if (epfile->ep != ep) { 1135 ret = -ESHUTDOWN; 1136 goto error_lock; 1137 } 1138 /* 1139 * To avoid race condition with ffs_epfile_io_complete, 1140 * dequeue the request first then check 1141 * status. usb_ep_dequeue API should guarantee no race 1142 * condition with req->complete callback. 1143 */ 1144 usb_ep_dequeue(ep->ep, req); 1145 spin_unlock_irq(&epfile->ffs->eps_lock); 1146 wait_for_completion(&io_data->done); 1147 interrupted = io_data->status < 0; 1148 } 1149 1150 if (interrupted) 1151 ret = -EINTR; 1152 else if (io_data->read && io_data->status > 0) 1153 ret = __ffs_epfile_read_data(epfile, data, io_data->status, 1154 &io_data->data); 1155 else 1156 ret = io_data->status; 1157 goto error_mutex; 1158 } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC))) { 1159 ret = -ENOMEM; 1160 } else { 1161 if (io_data->use_sg) { 1162 req->buf = NULL; 1163 req->sg = io_data->sgt.sgl; 1164 req->num_sgs = io_data->sgt.nents; 1165 } else { 1166 req->buf = data; 1167 req->num_sgs = 0; 1168 } 1169 req->length = data_len; 1170 1171 io_data->buf = data; 1172 io_data->ep = ep->ep; 1173 io_data->req = req; 1174 io_data->ffs = epfile->ffs; 1175 1176 req->context = io_data; 1177 req->complete = ffs_epfile_async_io_complete; 1178 1179 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC); 1180 if (ret) { 1181 io_data->req = NULL; 1182 usb_ep_free_request(ep->ep, req); 1183 goto error_lock; 1184 } 1185 1186 ret = -EIOCBQUEUED; 1187 /* 1188 * Do not kfree the buffer in this function. It will be freed 1189 * by ffs_user_copy_worker. 1190 */ 1191 data = NULL; 1192 } 1193 1194 error_lock: 1195 spin_unlock_irq(&epfile->ffs->eps_lock); 1196 error_mutex: 1197 mutex_unlock(&epfile->mutex); 1198 error: 1199 if (ret != -EIOCBQUEUED) /* don't free if there is iocb queued */ 1200 ffs_free_buffer(io_data); 1201 return ret; 1202 } 1203 1204 static int 1205 ffs_epfile_open(struct inode *inode, struct file *file) 1206 { 1207 struct ffs_data *ffs = inode->i_sb->s_fs_info; 1208 struct ffs_epfile *epfile; 1209 1210 spin_lock_irq(&ffs->eps_lock); 1211 if (!ffs->opened) { 1212 spin_unlock_irq(&ffs->eps_lock); 1213 return -ENODEV; 1214 } 1215 /* 1216 * we want the state to be FFS_ACTIVE; FFS_ACTIVE alone is 1217 * not enough, though - we might have been through FFS_CLOSING 1218 * and back to FFS_ACTIVE, with our file already removed. 1219 */ 1220 epfile = smp_load_acquire(&inode->i_private); 1221 if (unlikely(ffs->state != FFS_ACTIVE || !epfile)) { 1222 spin_unlock_irq(&ffs->eps_lock); 1223 return -ENODEV; 1224 } 1225 ffs->opened++; 1226 spin_unlock_irq(&ffs->eps_lock); 1227 1228 file->private_data = epfile; 1229 return stream_open(inode, file); 1230 } 1231 1232 static int ffs_aio_cancel(struct kiocb *kiocb) 1233 { 1234 struct ffs_io_data *io_data = kiocb->private; 1235 int value; 1236 1237 if (io_data && io_data->ep && io_data->req) 1238 value = usb_ep_dequeue(io_data->ep, io_data->req); 1239 else 1240 value = -EINVAL; 1241 1242 return value; 1243 } 1244 1245 static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from) 1246 { 1247 struct ffs_io_data io_data, *p = &io_data; 1248 ssize_t res; 1249 1250 if (!is_sync_kiocb(kiocb)) { 1251 p = kzalloc_obj(io_data); 1252 if (!p) 1253 return -ENOMEM; 1254 p->aio = true; 1255 } else { 1256 memset(p, 0, sizeof(*p)); 1257 p->aio = false; 1258 } 1259 1260 p->read = false; 1261 p->kiocb = kiocb; 1262 p->data = *from; 1263 p->mm = current->mm; 1264 1265 kiocb->private = p; 1266 1267 if (p->aio) 1268 kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); 1269 1270 res = ffs_epfile_io(kiocb->ki_filp, p); 1271 if (res == -EIOCBQUEUED) 1272 return res; 1273 if (p->aio) 1274 kfree(p); 1275 else 1276 *from = p->data; 1277 return res; 1278 } 1279 1280 static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to) 1281 { 1282 struct ffs_io_data io_data, *p = &io_data; 1283 ssize_t res; 1284 1285 if (!is_sync_kiocb(kiocb)) { 1286 p = kzalloc_obj(io_data); 1287 if (!p) 1288 return -ENOMEM; 1289 p->aio = true; 1290 } else { 1291 memset(p, 0, sizeof(*p)); 1292 p->aio = false; 1293 } 1294 1295 p->read = true; 1296 p->kiocb = kiocb; 1297 if (p->aio) { 1298 p->to_free = dup_iter(&p->data, to, GFP_KERNEL); 1299 if (!iter_is_ubuf(&p->data) && !p->to_free) { 1300 kfree(p); 1301 return -ENOMEM; 1302 } 1303 } else { 1304 p->data = *to; 1305 p->to_free = NULL; 1306 } 1307 p->mm = current->mm; 1308 1309 kiocb->private = p; 1310 1311 if (p->aio) 1312 kiocb_set_cancel_fn(kiocb, ffs_aio_cancel); 1313 1314 res = ffs_epfile_io(kiocb->ki_filp, p); 1315 if (res == -EIOCBQUEUED) 1316 return res; 1317 1318 if (p->aio) { 1319 kfree(p->to_free); 1320 kfree(p); 1321 } else { 1322 *to = p->data; 1323 } 1324 return res; 1325 } 1326 1327 static void ffs_dmabuf_release(struct kref *ref) 1328 { 1329 struct ffs_dmabuf_priv *priv = container_of(ref, struct ffs_dmabuf_priv, ref); 1330 struct dma_buf_attachment *attach = priv->attach; 1331 struct dma_buf *dmabuf = attach->dmabuf; 1332 1333 pr_vdebug("FFS DMABUF release\n"); 1334 dma_buf_unmap_attachment_unlocked(attach, priv->sgt, priv->dir); 1335 1336 dma_buf_detach(attach->dmabuf, attach); 1337 dma_buf_put(dmabuf); 1338 kfree(priv); 1339 } 1340 1341 static void ffs_dmabuf_get(struct dma_buf_attachment *attach) 1342 { 1343 struct ffs_dmabuf_priv *priv = attach->importer_priv; 1344 1345 kref_get(&priv->ref); 1346 } 1347 1348 static void ffs_dmabuf_put(struct dma_buf_attachment *attach) 1349 { 1350 struct ffs_dmabuf_priv *priv = attach->importer_priv; 1351 1352 kref_put(&priv->ref, ffs_dmabuf_release); 1353 } 1354 1355 static int 1356 ffs_epfile_release(struct inode *inode, struct file *file) 1357 { 1358 struct ffs_epfile *epfile = file->private_data; 1359 struct ffs_dmabuf_priv *priv, *tmp; 1360 struct ffs_data *ffs = epfile->ffs; 1361 1362 mutex_lock(&epfile->dmabufs_mutex); 1363 1364 /* Close all attached DMABUFs */ 1365 list_for_each_entry_safe(priv, tmp, &epfile->dmabufs, entry) { 1366 /* Cancel any pending transfer */ 1367 spin_lock_irq(&ffs->eps_lock); 1368 if (priv->ep && priv->req) 1369 usb_ep_dequeue(priv->ep, priv->req); 1370 spin_unlock_irq(&ffs->eps_lock); 1371 1372 list_del(&priv->entry); 1373 ffs_dmabuf_put(priv->attach); 1374 } 1375 1376 mutex_unlock(&epfile->dmabufs_mutex); 1377 1378 ffs_data_closed(epfile->ffs); 1379 1380 return 0; 1381 } 1382 1383 static void ffs_dmabuf_cleanup(struct work_struct *work) 1384 { 1385 struct ffs_dma_fence *dma_fence = 1386 container_of(work, struct ffs_dma_fence, work); 1387 struct ffs_dmabuf_priv *priv = dma_fence->priv; 1388 struct dma_buf_attachment *attach = priv->attach; 1389 struct dma_fence *fence = &dma_fence->base; 1390 struct usb_request *req = dma_fence->req; 1391 struct usb_ep *ep = dma_fence->ep; 1392 1393 /* 1394 * eps_lock pairs with the cancel paths so they cannot pass a freed 1395 * req to usb_ep_dequeue(). Only clear if priv->req still names ours; 1396 * a re-queue on the same attachment may have taken that slot. 1397 */ 1398 spin_lock_irq(&priv->ffs->eps_lock); 1399 if (priv->req == req) 1400 priv->req = NULL; 1401 spin_unlock_irq(&priv->ffs->eps_lock); 1402 1403 if (ep && req) 1404 usb_ep_free_request(ep, req); 1405 1406 ffs_dmabuf_put(attach); 1407 dma_fence_put(fence); 1408 } 1409 1410 static void ffs_dmabuf_signal_done(struct ffs_dma_fence *dma_fence, int ret) 1411 { 1412 struct ffs_dmabuf_priv *priv = dma_fence->priv; 1413 struct dma_fence *fence = &dma_fence->base; 1414 bool cookie = dma_fence_begin_signalling(); 1415 1416 dma_fence_get(fence); 1417 fence->error = ret; 1418 dma_fence_signal(fence); 1419 dma_fence_end_signalling(cookie); 1420 1421 /* 1422 * The fence will be unref'd in ffs_dmabuf_cleanup. 1423 * It can't be done here, as the unref functions might try to lock 1424 * the resv object, which would deadlock. 1425 */ 1426 INIT_WORK(&dma_fence->work, ffs_dmabuf_cleanup); 1427 queue_work(priv->ffs->io_completion_wq, &dma_fence->work); 1428 } 1429 1430 static void ffs_epfile_dmabuf_io_complete(struct usb_ep *ep, 1431 struct usb_request *req) 1432 { 1433 pr_vdebug("FFS: DMABUF transfer complete, status=%d\n", req->status); 1434 /* req is freed by ffs_dmabuf_cleanup() under eps_lock. */ 1435 ffs_dmabuf_signal_done(req->context, req->status); 1436 } 1437 1438 static const char *ffs_dmabuf_get_driver_name(struct dma_fence *fence) 1439 { 1440 return "functionfs"; 1441 } 1442 1443 static const char *ffs_dmabuf_get_timeline_name(struct dma_fence *fence) 1444 { 1445 return ""; 1446 } 1447 1448 static void ffs_dmabuf_fence_release(struct dma_fence *fence) 1449 { 1450 struct ffs_dma_fence *dma_fence = 1451 container_of(fence, struct ffs_dma_fence, base); 1452 1453 kfree(dma_fence); 1454 } 1455 1456 static const struct dma_fence_ops ffs_dmabuf_fence_ops = { 1457 .get_driver_name = ffs_dmabuf_get_driver_name, 1458 .get_timeline_name = ffs_dmabuf_get_timeline_name, 1459 .release = ffs_dmabuf_fence_release, 1460 }; 1461 1462 static int ffs_dma_resv_lock(struct dma_buf *dmabuf, bool nonblock) 1463 { 1464 if (!nonblock) 1465 return dma_resv_lock_interruptible(dmabuf->resv, NULL); 1466 1467 if (!dma_resv_trylock(dmabuf->resv)) 1468 return -EBUSY; 1469 1470 return 0; 1471 } 1472 1473 static struct dma_buf_attachment * 1474 ffs_dmabuf_find_attachment(struct ffs_epfile *epfile, struct dma_buf *dmabuf) 1475 { 1476 struct device *dev = epfile->ffs->gadget->dev.parent; 1477 struct dma_buf_attachment *attach = NULL; 1478 struct ffs_dmabuf_priv *priv; 1479 1480 mutex_lock(&epfile->dmabufs_mutex); 1481 1482 list_for_each_entry(priv, &epfile->dmabufs, entry) { 1483 if (priv->attach->dev == dev 1484 && priv->attach->dmabuf == dmabuf) { 1485 attach = priv->attach; 1486 break; 1487 } 1488 } 1489 1490 if (attach) 1491 ffs_dmabuf_get(attach); 1492 1493 mutex_unlock(&epfile->dmabufs_mutex); 1494 1495 return attach ?: ERR_PTR(-EPERM); 1496 } 1497 1498 static int ffs_dmabuf_attach(struct file *file, int fd) 1499 { 1500 bool nonblock = file->f_flags & O_NONBLOCK; 1501 struct ffs_epfile *epfile = file->private_data; 1502 struct usb_gadget *gadget = epfile->ffs->gadget; 1503 struct dma_buf_attachment *attach; 1504 struct ffs_dmabuf_priv *priv; 1505 enum dma_data_direction dir; 1506 struct sg_table *sg_table; 1507 struct dma_buf *dmabuf; 1508 int err; 1509 1510 if (!gadget || !gadget->sg_supported) 1511 return -EPERM; 1512 1513 dmabuf = dma_buf_get(fd); 1514 if (IS_ERR(dmabuf)) 1515 return PTR_ERR(dmabuf); 1516 1517 attach = dma_buf_attach(dmabuf, gadget->dev.parent); 1518 if (IS_ERR(attach)) { 1519 err = PTR_ERR(attach); 1520 goto err_dmabuf_put; 1521 } 1522 1523 priv = kzalloc_obj(*priv); 1524 if (!priv) { 1525 err = -ENOMEM; 1526 goto err_dmabuf_detach; 1527 } 1528 1529 dir = epfile->in ? DMA_TO_DEVICE : DMA_FROM_DEVICE; 1530 1531 err = ffs_dma_resv_lock(dmabuf, nonblock); 1532 if (err) 1533 goto err_free_priv; 1534 1535 sg_table = dma_buf_map_attachment(attach, dir); 1536 dma_resv_unlock(dmabuf->resv); 1537 1538 if (IS_ERR(sg_table)) { 1539 err = PTR_ERR(sg_table); 1540 goto err_free_priv; 1541 } 1542 1543 attach->importer_priv = priv; 1544 1545 priv->sgt = sg_table; 1546 priv->dir = dir; 1547 priv->ffs = epfile->ffs; 1548 priv->attach = attach; 1549 spin_lock_init(&priv->lock); 1550 kref_init(&priv->ref); 1551 priv->context = dma_fence_context_alloc(1); 1552 1553 mutex_lock(&epfile->dmabufs_mutex); 1554 list_add(&priv->entry, &epfile->dmabufs); 1555 mutex_unlock(&epfile->dmabufs_mutex); 1556 1557 return 0; 1558 1559 err_free_priv: 1560 kfree(priv); 1561 err_dmabuf_detach: 1562 dma_buf_detach(dmabuf, attach); 1563 err_dmabuf_put: 1564 dma_buf_put(dmabuf); 1565 1566 return err; 1567 } 1568 1569 static int ffs_dmabuf_detach(struct file *file, int fd) 1570 { 1571 struct ffs_epfile *epfile = file->private_data; 1572 struct ffs_data *ffs = epfile->ffs; 1573 struct device *dev = ffs->gadget->dev.parent; 1574 struct ffs_dmabuf_priv *priv, *tmp; 1575 struct dma_buf *dmabuf; 1576 int ret = -EPERM; 1577 1578 dmabuf = dma_buf_get(fd); 1579 if (IS_ERR(dmabuf)) 1580 return PTR_ERR(dmabuf); 1581 1582 mutex_lock(&epfile->dmabufs_mutex); 1583 1584 list_for_each_entry_safe(priv, tmp, &epfile->dmabufs, entry) { 1585 if (priv->attach->dev == dev 1586 && priv->attach->dmabuf == dmabuf) { 1587 /* Cancel any pending transfer */ 1588 spin_lock_irq(&ffs->eps_lock); 1589 if (priv->ep && priv->req) 1590 usb_ep_dequeue(priv->ep, priv->req); 1591 spin_unlock_irq(&ffs->eps_lock); 1592 1593 list_del(&priv->entry); 1594 1595 /* Unref the reference from ffs_dmabuf_attach() */ 1596 ffs_dmabuf_put(priv->attach); 1597 ret = 0; 1598 break; 1599 } 1600 } 1601 1602 mutex_unlock(&epfile->dmabufs_mutex); 1603 dma_buf_put(dmabuf); 1604 1605 return ret; 1606 } 1607 1608 static int ffs_dmabuf_transfer(struct file *file, 1609 const struct usb_ffs_dmabuf_transfer_req *req) 1610 { 1611 bool nonblock = file->f_flags & O_NONBLOCK; 1612 struct ffs_epfile *epfile = file->private_data; 1613 struct dma_buf_attachment *attach; 1614 struct ffs_dmabuf_priv *priv; 1615 struct ffs_dma_fence *fence; 1616 struct usb_request *usb_req; 1617 enum dma_resv_usage resv_dir; 1618 struct dma_buf *dmabuf; 1619 unsigned long timeout; 1620 struct ffs_ep *ep; 1621 bool cookie; 1622 u32 seqno; 1623 long retl; 1624 int ret; 1625 1626 if (req->flags & ~USB_FFS_DMABUF_TRANSFER_MASK) 1627 return -EINVAL; 1628 1629 dmabuf = dma_buf_get(req->fd); 1630 if (IS_ERR(dmabuf)) 1631 return PTR_ERR(dmabuf); 1632 1633 if (req->length > dmabuf->size || req->length == 0) { 1634 ret = -EINVAL; 1635 goto err_dmabuf_put; 1636 } 1637 1638 attach = ffs_dmabuf_find_attachment(epfile, dmabuf); 1639 if (IS_ERR(attach)) { 1640 ret = PTR_ERR(attach); 1641 goto err_dmabuf_put; 1642 } 1643 1644 priv = attach->importer_priv; 1645 1646 ep = ffs_epfile_wait_ep(file); 1647 if (IS_ERR(ep)) { 1648 ret = PTR_ERR(ep); 1649 goto err_attachment_put; 1650 } 1651 1652 ret = ffs_dma_resv_lock(dmabuf, nonblock); 1653 if (ret) 1654 goto err_attachment_put; 1655 1656 /* Make sure we don't have writers */ 1657 timeout = nonblock ? 0 : msecs_to_jiffies(DMABUF_ENQUEUE_TIMEOUT_MS); 1658 retl = dma_resv_wait_timeout(dmabuf->resv, 1659 dma_resv_usage_rw(!epfile->in), 1660 true, timeout); 1661 if (retl == 0) 1662 retl = -EBUSY; 1663 if (retl < 0) { 1664 ret = (int)retl; 1665 goto err_resv_unlock; 1666 } 1667 1668 ret = dma_resv_reserve_fences(dmabuf->resv, 1); 1669 if (ret) 1670 goto err_resv_unlock; 1671 1672 fence = kmalloc_obj(*fence); 1673 if (!fence) { 1674 ret = -ENOMEM; 1675 goto err_resv_unlock; 1676 } 1677 1678 fence->priv = priv; 1679 1680 spin_lock_irq(&epfile->ffs->eps_lock); 1681 1682 /* In the meantime, endpoint got disabled or changed. */ 1683 if (epfile->ep != ep) { 1684 ret = -ESHUTDOWN; 1685 goto err_fence_put; 1686 } 1687 1688 usb_req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC); 1689 if (!usb_req) { 1690 ret = -ENOMEM; 1691 goto err_fence_put; 1692 } 1693 1694 /* 1695 * usb_ep_queue() guarantees that all transfers are processed in the 1696 * order they are enqueued, so we can use a simple incrementing 1697 * sequence number for the dma_fence. 1698 */ 1699 seqno = atomic_add_return(1, &epfile->seqno); 1700 1701 dma_fence_init(&fence->base, &ffs_dmabuf_fence_ops, 1702 &priv->lock, priv->context, seqno); 1703 1704 resv_dir = epfile->in ? DMA_RESV_USAGE_READ : DMA_RESV_USAGE_WRITE; 1705 1706 dma_resv_add_fence(dmabuf->resv, &fence->base, resv_dir); 1707 dma_fence_put(&fence->base); 1708 dma_resv_unlock(dmabuf->resv); 1709 1710 /* Now that the dma_fence is in place, queue the transfer. */ 1711 1712 usb_req->length = req->length; 1713 usb_req->buf = NULL; 1714 usb_req->sg = priv->sgt->sgl; 1715 usb_req->num_sgs = sg_nents_for_len(priv->sgt->sgl, req->length); 1716 usb_req->sg_was_mapped = true; 1717 usb_req->context = fence; 1718 usb_req->complete = ffs_epfile_dmabuf_io_complete; 1719 1720 /* ffs_dmabuf_cleanup() frees usb_req via these two fields. */ 1721 fence->req = usb_req; 1722 fence->ep = ep->ep; 1723 1724 cookie = dma_fence_begin_signalling(); 1725 ret = usb_ep_queue(ep->ep, usb_req, GFP_ATOMIC); 1726 dma_fence_end_signalling(cookie); 1727 if (!ret) { 1728 priv->req = usb_req; 1729 priv->ep = ep->ep; 1730 } else { 1731 pr_warn("FFS: Failed to queue DMABUF: %d\n", ret); 1732 ffs_dmabuf_signal_done(fence, ret); 1733 } 1734 1735 spin_unlock_irq(&epfile->ffs->eps_lock); 1736 dma_buf_put(dmabuf); 1737 1738 return ret; 1739 1740 err_fence_put: 1741 spin_unlock_irq(&epfile->ffs->eps_lock); 1742 dma_fence_put(&fence->base); 1743 err_resv_unlock: 1744 dma_resv_unlock(dmabuf->resv); 1745 err_attachment_put: 1746 ffs_dmabuf_put(attach); 1747 err_dmabuf_put: 1748 dma_buf_put(dmabuf); 1749 1750 return ret; 1751 } 1752 1753 static long ffs_epfile_ioctl(struct file *file, unsigned code, 1754 unsigned long value) 1755 { 1756 struct ffs_epfile *epfile = file->private_data; 1757 struct ffs_ep *ep; 1758 int ret; 1759 1760 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE)) 1761 return -ENODEV; 1762 1763 switch (code) { 1764 case FUNCTIONFS_DMABUF_ATTACH: 1765 { 1766 int fd; 1767 1768 if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) 1769 return -EFAULT; 1770 1771 return ffs_dmabuf_attach(file, fd); 1772 } 1773 case FUNCTIONFS_DMABUF_DETACH: 1774 { 1775 int fd; 1776 1777 if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) 1778 return -EFAULT; 1779 1780 return ffs_dmabuf_detach(file, fd); 1781 } 1782 case FUNCTIONFS_DMABUF_TRANSFER: 1783 { 1784 struct usb_ffs_dmabuf_transfer_req req; 1785 1786 if (copy_from_user(&req, (void __user *)value, sizeof(req))) 1787 return -EFAULT; 1788 1789 return ffs_dmabuf_transfer(file, &req); 1790 } 1791 default: 1792 break; 1793 } 1794 1795 /* Wait for endpoint to be enabled */ 1796 ep = ffs_epfile_wait_ep(file); 1797 if (IS_ERR(ep)) 1798 return PTR_ERR(ep); 1799 1800 spin_lock_irq(&epfile->ffs->eps_lock); 1801 1802 /* In the meantime, endpoint got disabled or changed. */ 1803 if (epfile->ep != ep) { 1804 spin_unlock_irq(&epfile->ffs->eps_lock); 1805 return -ESHUTDOWN; 1806 } 1807 1808 switch (code) { 1809 case FUNCTIONFS_FIFO_STATUS: 1810 ret = usb_ep_fifo_status(epfile->ep->ep); 1811 break; 1812 case FUNCTIONFS_FIFO_FLUSH: 1813 usb_ep_fifo_flush(epfile->ep->ep); 1814 ret = 0; 1815 break; 1816 case FUNCTIONFS_CLEAR_HALT: 1817 ret = usb_ep_clear_halt(epfile->ep->ep); 1818 break; 1819 case FUNCTIONFS_ENDPOINT_REVMAP: 1820 ret = epfile->ep->num; 1821 break; 1822 case FUNCTIONFS_ENDPOINT_DESC: 1823 { 1824 int desc_idx; 1825 struct usb_endpoint_descriptor desc1, *desc; 1826 1827 switch (epfile->ffs->gadget->speed) { 1828 case USB_SPEED_SUPER: 1829 case USB_SPEED_SUPER_PLUS: 1830 desc_idx = 2; 1831 break; 1832 case USB_SPEED_HIGH: 1833 desc_idx = 1; 1834 break; 1835 default: 1836 desc_idx = 0; 1837 } 1838 1839 desc = epfile->ep->descs[desc_idx]; 1840 memcpy(&desc1, desc, desc->bLength); 1841 1842 spin_unlock_irq(&epfile->ffs->eps_lock); 1843 ret = copy_to_user((void __user *)value, &desc1, desc1.bLength); 1844 if (ret) 1845 ret = -EFAULT; 1846 return ret; 1847 } 1848 default: 1849 ret = -ENOTTY; 1850 } 1851 spin_unlock_irq(&epfile->ffs->eps_lock); 1852 1853 return ret; 1854 } 1855 1856 static const struct file_operations ffs_epfile_operations = { 1857 1858 .open = ffs_epfile_open, 1859 .write_iter = ffs_epfile_write_iter, 1860 .read_iter = ffs_epfile_read_iter, 1861 .release = ffs_epfile_release, 1862 .unlocked_ioctl = ffs_epfile_ioctl, 1863 .compat_ioctl = compat_ptr_ioctl, 1864 }; 1865 1866 1867 /* File system and super block operations ***********************************/ 1868 1869 /* 1870 * Mounting the file system creates a controller file, used first for 1871 * function configuration then later for event monitoring. 1872 */ 1873 1874 static struct inode *__must_check 1875 ffs_sb_make_inode(struct super_block *sb, void *data, 1876 const struct file_operations *fops, 1877 const struct inode_operations *iops, 1878 struct ffs_file_perms *perms) 1879 { 1880 struct inode *inode; 1881 1882 inode = new_inode(sb); 1883 1884 if (inode) { 1885 struct timespec64 ts = inode_set_ctime_current(inode); 1886 1887 inode->i_ino = get_next_ino(); 1888 inode->i_mode = perms->mode; 1889 inode->i_uid = perms->uid; 1890 inode->i_gid = perms->gid; 1891 inode_set_atime_to_ts(inode, ts); 1892 inode_set_mtime_to_ts(inode, ts); 1893 inode->i_private = data; 1894 if (fops) 1895 inode->i_fop = fops; 1896 if (iops) 1897 inode->i_op = iops; 1898 } 1899 1900 return inode; 1901 } 1902 1903 /* Create "regular" file */ 1904 static int ffs_sb_create_file(struct super_block *sb, const char *name, 1905 void *data, const struct file_operations *fops) 1906 { 1907 struct ffs_data *ffs = sb->s_fs_info; 1908 struct dentry *dentry; 1909 struct inode *inode; 1910 1911 inode = ffs_sb_make_inode(sb, data, fops, NULL, &ffs->file_perms); 1912 if (!inode) 1913 return -ENOMEM; 1914 dentry = simple_start_creating(sb->s_root, name); 1915 if (IS_ERR(dentry)) { 1916 iput(inode); 1917 return PTR_ERR(dentry); 1918 } 1919 1920 d_make_persistent(dentry, inode); 1921 1922 simple_done_creating(dentry); 1923 return 0; 1924 } 1925 1926 /* Super block */ 1927 static const struct super_operations ffs_sb_operations = { 1928 .statfs = simple_statfs, 1929 .drop_inode = inode_just_drop, 1930 }; 1931 1932 struct ffs_sb_fill_data { 1933 struct ffs_file_perms perms; 1934 umode_t root_mode; 1935 const char *dev_name; 1936 bool no_disconnect; 1937 struct ffs_data *ffs_data; 1938 }; 1939 1940 static int ffs_sb_fill(struct super_block *sb, struct fs_context *fc) 1941 { 1942 struct ffs_sb_fill_data *data = fc->fs_private; 1943 struct inode *inode; 1944 struct ffs_data *ffs = data->ffs_data; 1945 1946 ffs->sb = sb; 1947 data->ffs_data = NULL; 1948 sb->s_fs_info = ffs; 1949 sb->s_blocksize = PAGE_SIZE; 1950 sb->s_blocksize_bits = PAGE_SHIFT; 1951 sb->s_magic = FUNCTIONFS_MAGIC; 1952 sb->s_op = &ffs_sb_operations; 1953 sb->s_time_gran = 1; 1954 1955 /* Root inode */ 1956 data->perms.mode = data->root_mode; 1957 inode = ffs_sb_make_inode(sb, NULL, 1958 &simple_dir_operations, 1959 &simple_dir_inode_operations, 1960 &data->perms); 1961 sb->s_root = d_make_root(inode); 1962 if (!sb->s_root) 1963 return -ENOMEM; 1964 1965 /* EP0 file */ 1966 return ffs_sb_create_file(sb, "ep0", ffs, &ffs_ep0_operations); 1967 } 1968 1969 enum { 1970 Opt_no_disconnect, 1971 Opt_rmode, 1972 Opt_fmode, 1973 Opt_mode, 1974 Opt_uid, 1975 Opt_gid, 1976 }; 1977 1978 static const struct fs_parameter_spec ffs_fs_fs_parameters[] = { 1979 fsparam_bool ("no_disconnect", Opt_no_disconnect), 1980 fsparam_u32 ("rmode", Opt_rmode), 1981 fsparam_u32 ("fmode", Opt_fmode), 1982 fsparam_u32 ("mode", Opt_mode), 1983 fsparam_u32 ("uid", Opt_uid), 1984 fsparam_u32 ("gid", Opt_gid), 1985 {} 1986 }; 1987 1988 static int ffs_fs_parse_param(struct fs_context *fc, struct fs_parameter *param) 1989 { 1990 struct ffs_sb_fill_data *data = fc->fs_private; 1991 struct fs_parse_result result; 1992 int opt; 1993 1994 opt = fs_parse(fc, ffs_fs_fs_parameters, param, &result); 1995 if (opt < 0) 1996 return opt; 1997 1998 switch (opt) { 1999 case Opt_no_disconnect: 2000 data->no_disconnect = result.boolean; 2001 break; 2002 case Opt_rmode: 2003 data->root_mode = (result.uint_32 & 0555) | S_IFDIR; 2004 break; 2005 case Opt_fmode: 2006 data->perms.mode = (result.uint_32 & 0666) | S_IFREG; 2007 break; 2008 case Opt_mode: 2009 data->root_mode = (result.uint_32 & 0555) | S_IFDIR; 2010 data->perms.mode = (result.uint_32 & 0666) | S_IFREG; 2011 break; 2012 2013 case Opt_uid: 2014 data->perms.uid = make_kuid(current_user_ns(), result.uint_32); 2015 if (!uid_valid(data->perms.uid)) 2016 goto unmapped_value; 2017 break; 2018 case Opt_gid: 2019 data->perms.gid = make_kgid(current_user_ns(), result.uint_32); 2020 if (!gid_valid(data->perms.gid)) 2021 goto unmapped_value; 2022 break; 2023 2024 default: 2025 return -ENOPARAM; 2026 } 2027 2028 return 0; 2029 2030 unmapped_value: 2031 return invalf(fc, "%s: unmapped value: %u", param->key, result.uint_32); 2032 } 2033 2034 /* 2035 * Set up the superblock for a mount. 2036 */ 2037 static int ffs_fs_get_tree(struct fs_context *fc) 2038 { 2039 struct ffs_sb_fill_data *ctx = fc->fs_private; 2040 struct ffs_data *ffs; 2041 int ret; 2042 2043 if (!fc->source) 2044 return invalf(fc, "No source specified"); 2045 2046 ffs = ffs_data_new(fc->source); 2047 if (!ffs) 2048 return -ENOMEM; 2049 ffs->file_perms = ctx->perms; 2050 ffs->no_disconnect = ctx->no_disconnect; 2051 2052 ffs->dev_name = kstrdup(fc->source, GFP_KERNEL); 2053 if (!ffs->dev_name) { 2054 ffs_data_put(ffs); 2055 return -ENOMEM; 2056 } 2057 2058 ret = ffs_acquire_dev(ffs->dev_name, ffs); 2059 if (ret) { 2060 ffs_data_put(ffs); 2061 return ret; 2062 } 2063 2064 ctx->ffs_data = ffs; 2065 return get_tree_nodev(fc, ffs_sb_fill); 2066 } 2067 2068 static void ffs_fs_free_fc(struct fs_context *fc) 2069 { 2070 struct ffs_sb_fill_data *ctx = fc->fs_private; 2071 2072 if (ctx) { 2073 if (ctx->ffs_data) { 2074 ffs_data_put(ctx->ffs_data); 2075 } 2076 2077 kfree(ctx); 2078 } 2079 } 2080 2081 static const struct fs_context_operations ffs_fs_context_ops = { 2082 .free = ffs_fs_free_fc, 2083 .parse_param = ffs_fs_parse_param, 2084 .get_tree = ffs_fs_get_tree, 2085 }; 2086 2087 static int ffs_fs_init_fs_context(struct fs_context *fc) 2088 { 2089 struct ffs_sb_fill_data *ctx; 2090 2091 ctx = kzalloc_obj(struct ffs_sb_fill_data); 2092 if (!ctx) 2093 return -ENOMEM; 2094 2095 ctx->perms.mode = S_IFREG | 0600; 2096 ctx->perms.uid = GLOBAL_ROOT_UID; 2097 ctx->perms.gid = GLOBAL_ROOT_GID; 2098 ctx->root_mode = S_IFDIR | 0500; 2099 ctx->no_disconnect = false; 2100 2101 fc->fs_private = ctx; 2102 fc->ops = &ffs_fs_context_ops; 2103 return 0; 2104 } 2105 2106 static void 2107 ffs_fs_kill_sb(struct super_block *sb) 2108 { 2109 kill_anon_super(sb); 2110 if (sb->s_fs_info) { 2111 struct ffs_data *ffs = sb->s_fs_info; 2112 ffs->state = FFS_CLOSING; 2113 ffs_data_reset(ffs); 2114 // no configfs accesses from that point on, 2115 // so no further schedule_work() is possible 2116 cancel_work_sync(&ffs->reset_work); 2117 ffs_data_put(ffs); 2118 } 2119 } 2120 2121 static struct file_system_type ffs_fs_type = { 2122 .owner = THIS_MODULE, 2123 .name = "functionfs", 2124 .init_fs_context = ffs_fs_init_fs_context, 2125 .parameters = ffs_fs_fs_parameters, 2126 .kill_sb = ffs_fs_kill_sb, 2127 }; 2128 MODULE_ALIAS_FS("functionfs"); 2129 2130 2131 /* Driver's main init/cleanup functions *************************************/ 2132 2133 static int functionfs_init(void) 2134 { 2135 int ret; 2136 2137 ret = register_filesystem(&ffs_fs_type); 2138 if (!ret) 2139 pr_info("file system registered\n"); 2140 else 2141 pr_err("failed registering file system (%d)\n", ret); 2142 2143 return ret; 2144 } 2145 2146 static void functionfs_cleanup(void) 2147 { 2148 pr_info("unloading\n"); 2149 unregister_filesystem(&ffs_fs_type); 2150 } 2151 2152 2153 /* ffs_data and ffs_function construction and destruction code **************/ 2154 2155 static void ffs_data_clear(struct ffs_data *ffs); 2156 2157 static void ffs_data_get(struct ffs_data *ffs) 2158 { 2159 refcount_inc(&ffs->ref); 2160 } 2161 2162 static void ffs_data_put(struct ffs_data *ffs) 2163 { 2164 if (refcount_dec_and_test(&ffs->ref)) { 2165 pr_info("%s(): freeing\n", __func__); 2166 ffs_data_clear(ffs); 2167 ffs_release_dev(ffs->private_data); 2168 BUG_ON(waitqueue_active(&ffs->ev.waitq) || 2169 swait_active(&ffs->ep0req_completion.wait) || 2170 waitqueue_active(&ffs->wait)); 2171 destroy_workqueue(ffs->io_completion_wq); 2172 kfree(ffs->dev_name); 2173 kfree(ffs); 2174 } 2175 } 2176 2177 static void ffs_data_closed(struct ffs_data *ffs) 2178 { 2179 spin_lock_irq(&ffs->eps_lock); 2180 if (--ffs->opened) { // not the last opener? 2181 spin_unlock_irq(&ffs->eps_lock); 2182 return; 2183 } 2184 if (ffs->no_disconnect) { 2185 struct ffs_epfile *epfiles; 2186 2187 ffs->state = FFS_DEACTIVATED; 2188 epfiles = ffs->epfiles; 2189 ffs->epfiles = NULL; 2190 spin_unlock_irq(&ffs->eps_lock); 2191 2192 if (epfiles) 2193 ffs_epfiles_destroy(ffs->sb, epfiles, 2194 ffs->eps_count); 2195 2196 if (ffs->setup_state == FFS_SETUP_PENDING) 2197 __ffs_ep0_stall(ffs); 2198 } else { 2199 ffs->state = FFS_CLOSING; 2200 spin_unlock_irq(&ffs->eps_lock); 2201 ffs_data_reset(ffs); 2202 } 2203 } 2204 2205 static struct ffs_data *ffs_data_new(const char *dev_name) 2206 { 2207 struct ffs_data *ffs = kzalloc_obj(*ffs); 2208 if (!ffs) 2209 return NULL; 2210 2211 ffs->io_completion_wq = alloc_ordered_workqueue("%s", 0, dev_name); 2212 if (!ffs->io_completion_wq) { 2213 kfree(ffs); 2214 return NULL; 2215 } 2216 2217 refcount_set(&ffs->ref, 1); 2218 ffs->opened = 0; 2219 ffs->state = FFS_READ_DESCRIPTORS; 2220 mutex_init(&ffs->mutex); 2221 spin_lock_init(&ffs->eps_lock); 2222 init_waitqueue_head(&ffs->ev.waitq); 2223 init_waitqueue_head(&ffs->wait); 2224 init_completion(&ffs->ep0req_completion); 2225 INIT_WORK(&ffs->reset_work, ffs_reset_work); 2226 2227 /* XXX REVISIT need to update it in some places, or do we? */ 2228 ffs->ev.can_stall = 1; 2229 2230 return ffs; 2231 } 2232 2233 static void ffs_data_clear(struct ffs_data *ffs) 2234 { 2235 struct ffs_epfile *epfiles; 2236 unsigned long flags; 2237 2238 ffs_closed(ffs); 2239 2240 BUG_ON(ffs->gadget); 2241 2242 spin_lock_irqsave(&ffs->eps_lock, flags); 2243 epfiles = ffs->epfiles; 2244 ffs->epfiles = NULL; 2245 spin_unlock_irqrestore(&ffs->eps_lock, flags); 2246 2247 /* 2248 * potential race possible between ffs_func_eps_disable 2249 * & ffs_epfile_release therefore maintaining a local 2250 * copy of epfile will save us from use-after-free. 2251 */ 2252 if (epfiles) { 2253 ffs_epfiles_destroy(ffs->sb, epfiles, ffs->eps_count); 2254 ffs->epfiles = NULL; 2255 } 2256 2257 if (ffs->ffs_eventfd) { 2258 eventfd_ctx_put(ffs->ffs_eventfd); 2259 ffs->ffs_eventfd = NULL; 2260 } 2261 2262 kfree(ffs->raw_descs_data); 2263 kfree(ffs->raw_strings); 2264 kfree(ffs->stringtabs); 2265 } 2266 2267 static void ffs_data_reset(struct ffs_data *ffs) 2268 { 2269 ffs_data_clear(ffs); 2270 2271 spin_lock_irq(&ffs->eps_lock); 2272 ffs->raw_descs_data = NULL; 2273 ffs->raw_descs = NULL; 2274 ffs->raw_strings = NULL; 2275 ffs->stringtabs = NULL; 2276 2277 ffs->raw_descs_length = 0; 2278 ffs->fs_descs_count = 0; 2279 ffs->hs_descs_count = 0; 2280 ffs->ss_descs_count = 0; 2281 2282 ffs->strings_count = 0; 2283 ffs->interfaces_count = 0; 2284 ffs->eps_count = 0; 2285 2286 ffs->ev.count = 0; 2287 2288 ffs->state = FFS_READ_DESCRIPTORS; 2289 ffs->setup_state = FFS_NO_SETUP; 2290 ffs->flags = 0; 2291 2292 ffs->ms_os_descs_ext_prop_count = 0; 2293 ffs->ms_os_descs_ext_prop_name_len = 0; 2294 ffs->ms_os_descs_ext_prop_data_len = 0; 2295 spin_unlock_irq(&ffs->eps_lock); 2296 } 2297 2298 2299 static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev) 2300 { 2301 struct usb_gadget_strings **lang; 2302 int first_id; 2303 2304 if ((ffs->state != FFS_ACTIVE 2305 || test_and_set_bit(FFS_FL_BOUND, &ffs->flags))) 2306 return -EBADFD; 2307 2308 first_id = usb_string_ids_n(cdev, ffs->strings_count); 2309 if (first_id < 0) 2310 return first_id; 2311 2312 ffs->ep0req = usb_ep_alloc_request(cdev->gadget->ep0, GFP_KERNEL); 2313 if (!ffs->ep0req) 2314 return -ENOMEM; 2315 ffs->ep0req->complete = ffs_ep0_complete; 2316 ffs->ep0req->context = ffs; 2317 2318 lang = ffs->stringtabs; 2319 if (lang) { 2320 for (; *lang; ++lang) { 2321 struct usb_string *str = (*lang)->strings; 2322 int id = first_id; 2323 for (; str->s; ++id, ++str) 2324 str->id = id; 2325 } 2326 } 2327 2328 ffs->gadget = cdev->gadget; 2329 ffs_data_get(ffs); 2330 return 0; 2331 } 2332 2333 static void functionfs_unbind(struct ffs_data *ffs) 2334 { 2335 if (!WARN_ON(!ffs->gadget)) { 2336 /* dequeue before freeing ep0req */ 2337 usb_ep_dequeue(ffs->gadget->ep0, ffs->ep0req); 2338 mutex_lock(&ffs->mutex); 2339 usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req); 2340 ffs->ep0req = NULL; 2341 ffs->gadget = NULL; 2342 clear_bit(FFS_FL_BOUND, &ffs->flags); 2343 mutex_unlock(&ffs->mutex); 2344 ffs_data_put(ffs); 2345 } 2346 } 2347 2348 static int ffs_epfiles_create(struct ffs_data *ffs) 2349 { 2350 struct ffs_epfile *epfile, *epfiles; 2351 unsigned i, count; 2352 int err; 2353 2354 count = ffs->eps_count; 2355 epfiles = kzalloc_objs(*epfiles, count); 2356 if (!epfiles) 2357 return -ENOMEM; 2358 2359 epfile = epfiles; 2360 for (i = 1; i <= count; ++i, ++epfile) { 2361 epfile->ffs = ffs; 2362 mutex_init(&epfile->mutex); 2363 mutex_init(&epfile->dmabufs_mutex); 2364 INIT_LIST_HEAD(&epfile->dmabufs); 2365 if (ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR) 2366 sprintf(epfile->name, "ep%02x", ffs->eps_addrmap[i]); 2367 else 2368 sprintf(epfile->name, "ep%u", i); 2369 epfile->in = (ffs->eps_addrmap[i] & USB_ENDPOINT_DIR_MASK) ? 1 : 0; 2370 err = ffs_sb_create_file(ffs->sb, epfile->name, 2371 epfile, &ffs_epfile_operations); 2372 if (err) { 2373 ffs_epfiles_destroy(ffs->sb, epfiles, i - 1); 2374 return err; 2375 } 2376 } 2377 2378 ffs->epfiles = epfiles; 2379 return 0; 2380 } 2381 2382 static void clear_one(struct dentry *dentry) 2383 { 2384 smp_store_release(&dentry->d_inode->i_private, NULL); 2385 } 2386 2387 static void ffs_epfiles_destroy(struct super_block *sb, 2388 struct ffs_epfile *epfiles, unsigned count) 2389 { 2390 struct ffs_epfile *epfile = epfiles; 2391 struct dentry *root = sb->s_root; 2392 2393 for (; count; --count, ++epfile) { 2394 BUG_ON(mutex_is_locked(&epfile->mutex)); 2395 __ffs_epfile_read_buffer_free(epfile); 2396 simple_remove_by_name(root, epfile->name, clear_one); 2397 } 2398 2399 kfree(epfiles); 2400 } 2401 2402 static void ffs_func_eps_disable(struct ffs_function *func) 2403 { 2404 struct ffs_ep *ep; 2405 struct ffs_epfile *epfile; 2406 unsigned short count; 2407 unsigned long flags; 2408 2409 spin_lock_irqsave(&func->ffs->eps_lock, flags); 2410 count = func->ffs->eps_count; 2411 epfile = func->ffs->epfiles; 2412 ep = func->eps; 2413 while (count--) { 2414 /* pending requests get nuked */ 2415 if (ep->ep) 2416 usb_ep_disable(ep->ep); 2417 ++ep; 2418 2419 if (epfile) { 2420 epfile->ep = NULL; 2421 __ffs_epfile_read_buffer_free(epfile); 2422 ++epfile; 2423 } 2424 } 2425 spin_unlock_irqrestore(&func->ffs->eps_lock, flags); 2426 } 2427 2428 static int ffs_func_eps_enable(struct ffs_function *func) 2429 { 2430 struct ffs_data *ffs; 2431 struct ffs_ep *ep; 2432 struct ffs_epfile *epfile; 2433 unsigned short count; 2434 unsigned long flags; 2435 int ret = 0; 2436 2437 spin_lock_irqsave(&func->ffs->eps_lock, flags); 2438 ffs = func->ffs; 2439 ep = func->eps; 2440 epfile = ffs->epfiles; 2441 count = ffs->eps_count; 2442 if (!epfile) { 2443 ret = -ENOMEM; 2444 goto done; 2445 } 2446 2447 while (count--) { 2448 ep->ep->driver_data = ep; 2449 2450 ret = config_ep_by_speed(func->gadget, &func->function, ep->ep); 2451 if (ret) { 2452 pr_err("%s: config_ep_by_speed(%s) returned %d\n", 2453 __func__, ep->ep->name, ret); 2454 break; 2455 } 2456 2457 ret = usb_ep_enable(ep->ep); 2458 if (!ret) { 2459 epfile->ep = ep; 2460 epfile->isoc = usb_endpoint_xfer_isoc(ep->ep->desc); 2461 } else { 2462 break; 2463 } 2464 2465 ++ep; 2466 ++epfile; 2467 } 2468 2469 wake_up_interruptible(&ffs->wait); 2470 done: 2471 spin_unlock_irqrestore(&func->ffs->eps_lock, flags); 2472 2473 return ret; 2474 } 2475 2476 2477 /* Parsing and building descriptors and strings *****************************/ 2478 2479 /* 2480 * This validates if data pointed by data is a valid USB descriptor as 2481 * well as record how many interfaces, endpoints and strings are 2482 * required by given configuration. Returns address after the 2483 * descriptor or NULL if data is invalid. 2484 */ 2485 2486 enum ffs_entity_type { 2487 FFS_DESCRIPTOR, FFS_INTERFACE, FFS_STRING, FFS_ENDPOINT 2488 }; 2489 2490 enum ffs_os_desc_type { 2491 FFS_OS_DESC, FFS_OS_DESC_EXT_COMPAT, FFS_OS_DESC_EXT_PROP 2492 }; 2493 2494 typedef int (*ffs_entity_callback)(enum ffs_entity_type entity, 2495 u8 *valuep, 2496 struct usb_descriptor_header *desc, 2497 void *priv); 2498 2499 typedef int (*ffs_os_desc_callback)(enum ffs_os_desc_type entity, 2500 struct usb_os_desc_header *h, void *data, 2501 unsigned len, void *priv); 2502 2503 static int __must_check ffs_do_single_desc(char *data, unsigned len, 2504 ffs_entity_callback entity, 2505 void *priv, int *current_class, int *current_subclass) 2506 { 2507 struct usb_descriptor_header *_ds = (void *)data; 2508 u8 length; 2509 int ret; 2510 2511 /* At least two bytes are required: length and type */ 2512 if (len < 2) { 2513 pr_vdebug("descriptor too short\n"); 2514 return -EINVAL; 2515 } 2516 2517 /* If we have at least as many bytes as the descriptor takes? */ 2518 length = _ds->bLength; 2519 if (len < length) { 2520 pr_vdebug("descriptor longer then available data\n"); 2521 return -EINVAL; 2522 } 2523 2524 #define __entity_check_INTERFACE(val) 1 2525 #define __entity_check_STRING(val) (val) 2526 #define __entity_check_ENDPOINT(val) ((val) & USB_ENDPOINT_NUMBER_MASK) 2527 #define __entity(type, val) do { \ 2528 pr_vdebug("entity " #type "(%02x)\n", (val)); \ 2529 if (!__entity_check_ ##type(val)) { \ 2530 pr_vdebug("invalid entity's value\n"); \ 2531 return -EINVAL; \ 2532 } \ 2533 ret = entity(FFS_ ##type, &val, _ds, priv); \ 2534 if (ret < 0) { \ 2535 pr_debug("entity " #type "(%02x); ret = %d\n", \ 2536 (val), ret); \ 2537 return ret; \ 2538 } \ 2539 } while (0) 2540 2541 /* Parse descriptor depending on type. */ 2542 switch (_ds->bDescriptorType) { 2543 case USB_DT_DEVICE: 2544 case USB_DT_CONFIG: 2545 case USB_DT_STRING: 2546 case USB_DT_DEVICE_QUALIFIER: 2547 /* function can't have any of those */ 2548 pr_vdebug("descriptor reserved for gadget: %d\n", 2549 _ds->bDescriptorType); 2550 return -EINVAL; 2551 2552 case USB_DT_INTERFACE: { 2553 struct usb_interface_descriptor *ds = (void *)_ds; 2554 pr_vdebug("interface descriptor\n"); 2555 if (length != sizeof *ds) 2556 goto inv_length; 2557 2558 __entity(INTERFACE, ds->bInterfaceNumber); 2559 if (ds->iInterface) 2560 __entity(STRING, ds->iInterface); 2561 *current_class = ds->bInterfaceClass; 2562 *current_subclass = ds->bInterfaceSubClass; 2563 } 2564 break; 2565 2566 case USB_DT_ENDPOINT: { 2567 struct usb_endpoint_descriptor *ds = (void *)_ds; 2568 pr_vdebug("endpoint descriptor\n"); 2569 if (length != USB_DT_ENDPOINT_SIZE && 2570 length != USB_DT_ENDPOINT_AUDIO_SIZE) 2571 goto inv_length; 2572 __entity(ENDPOINT, ds->bEndpointAddress); 2573 } 2574 break; 2575 2576 case USB_TYPE_CLASS | 0x01: 2577 if (*current_class == USB_INTERFACE_CLASS_HID) { 2578 pr_vdebug("hid descriptor\n"); 2579 if (length != sizeof(struct hid_descriptor)) 2580 goto inv_length; 2581 break; 2582 } else if (*current_class == USB_INTERFACE_CLASS_CCID) { 2583 pr_vdebug("ccid descriptor\n"); 2584 if (length != sizeof(struct ccid_descriptor)) 2585 goto inv_length; 2586 break; 2587 } else if (*current_class == USB_CLASS_APP_SPEC && 2588 *current_subclass == USB_SUBCLASS_DFU) { 2589 pr_vdebug("dfu functional descriptor\n"); 2590 if (length != sizeof(struct usb_dfu_functional_descriptor)) 2591 goto inv_length; 2592 break; 2593 } else { 2594 pr_vdebug("unknown descriptor: %d for class %d\n", 2595 _ds->bDescriptorType, *current_class); 2596 return -EINVAL; 2597 } 2598 2599 case USB_DT_OTG: 2600 if (length != sizeof(struct usb_otg_descriptor)) 2601 goto inv_length; 2602 break; 2603 2604 case USB_DT_INTERFACE_ASSOCIATION: { 2605 struct usb_interface_assoc_descriptor *ds = (void *)_ds; 2606 pr_vdebug("interface association descriptor\n"); 2607 if (length != sizeof *ds) 2608 goto inv_length; 2609 if (ds->iFunction) 2610 __entity(STRING, ds->iFunction); 2611 } 2612 break; 2613 2614 case USB_DT_SS_ENDPOINT_COMP: 2615 pr_vdebug("EP SS companion descriptor\n"); 2616 if (length != sizeof(struct usb_ss_ep_comp_descriptor)) 2617 goto inv_length; 2618 break; 2619 2620 case USB_DT_OTHER_SPEED_CONFIG: 2621 case USB_DT_INTERFACE_POWER: 2622 case USB_DT_DEBUG: 2623 case USB_DT_SECURITY: 2624 case USB_DT_CS_RADIO_CONTROL: 2625 /* TODO */ 2626 pr_vdebug("unimplemented descriptor: %d\n", _ds->bDescriptorType); 2627 return -EINVAL; 2628 2629 default: 2630 /* We should never be here */ 2631 pr_vdebug("unknown descriptor: %d\n", _ds->bDescriptorType); 2632 return -EINVAL; 2633 2634 inv_length: 2635 pr_vdebug("invalid length: %d (descriptor %d)\n", 2636 _ds->bLength, _ds->bDescriptorType); 2637 return -EINVAL; 2638 } 2639 2640 #undef __entity 2641 #undef __entity_check_DESCRIPTOR 2642 #undef __entity_check_INTERFACE 2643 #undef __entity_check_STRING 2644 #undef __entity_check_ENDPOINT 2645 2646 return length; 2647 } 2648 2649 static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len, 2650 ffs_entity_callback entity, void *priv) 2651 { 2652 const unsigned _len = len; 2653 unsigned long num = 0; 2654 int current_class = -1; 2655 int current_subclass = -1; 2656 2657 for (;;) { 2658 int ret; 2659 2660 if (num == count) 2661 data = NULL; 2662 2663 /* Record "descriptor" entity */ 2664 ret = entity(FFS_DESCRIPTOR, (u8 *)num, (void *)data, priv); 2665 if (ret < 0) { 2666 pr_debug("entity DESCRIPTOR(%02lx); ret = %d\n", 2667 num, ret); 2668 return ret; 2669 } 2670 2671 if (!data) 2672 return _len - len; 2673 2674 ret = ffs_do_single_desc(data, len, entity, priv, 2675 ¤t_class, ¤t_subclass); 2676 if (ret < 0) { 2677 pr_debug("%s returns %d\n", __func__, ret); 2678 return ret; 2679 } 2680 2681 len -= ret; 2682 data += ret; 2683 ++num; 2684 } 2685 } 2686 2687 static int __ffs_data_do_entity(enum ffs_entity_type type, 2688 u8 *valuep, struct usb_descriptor_header *desc, 2689 void *priv) 2690 { 2691 struct ffs_desc_helper *helper = priv; 2692 struct usb_endpoint_descriptor *d; 2693 2694 switch (type) { 2695 case FFS_DESCRIPTOR: 2696 break; 2697 2698 case FFS_INTERFACE: 2699 /* 2700 * Interfaces are indexed from zero so if we 2701 * encountered interface "n" then there are at least 2702 * "n+1" interfaces. 2703 */ 2704 if (*valuep >= helper->interfaces_count) 2705 helper->interfaces_count = *valuep + 1; 2706 break; 2707 2708 case FFS_STRING: 2709 /* 2710 * Strings are indexed from 1 (0 is reserved 2711 * for languages list) 2712 */ 2713 if (*valuep > helper->ffs->strings_count) 2714 helper->ffs->strings_count = *valuep; 2715 break; 2716 2717 case FFS_ENDPOINT: 2718 d = (void *)desc; 2719 helper->eps_count++; 2720 if (helper->eps_count >= FFS_MAX_EPS_COUNT) 2721 return -EINVAL; 2722 /* Check if descriptors for any speed were already parsed */ 2723 if (!helper->ffs->eps_count && !helper->ffs->interfaces_count) 2724 helper->ffs->eps_addrmap[helper->eps_count] = 2725 d->bEndpointAddress; 2726 else if (helper->ffs->eps_addrmap[helper->eps_count] != 2727 d->bEndpointAddress) 2728 return -EINVAL; 2729 break; 2730 } 2731 2732 return 0; 2733 } 2734 2735 static int __ffs_do_os_desc_header(enum ffs_os_desc_type *next_type, 2736 struct usb_os_desc_header *desc) 2737 { 2738 u16 bcd_version = le16_to_cpu(desc->bcdVersion); 2739 u16 w_index = le16_to_cpu(desc->wIndex); 2740 2741 if (bcd_version == 0x1) { 2742 pr_warn("bcdVersion must be 0x0100, stored in Little Endian order. " 2743 "Userspace driver should be fixed, accepting 0x0001 for compatibility.\n"); 2744 } else if (bcd_version != 0x100) { 2745 pr_vdebug("unsupported os descriptors version: 0x%x\n", 2746 bcd_version); 2747 return -EINVAL; 2748 } 2749 switch (w_index) { 2750 case 0x4: 2751 *next_type = FFS_OS_DESC_EXT_COMPAT; 2752 break; 2753 case 0x5: 2754 *next_type = FFS_OS_DESC_EXT_PROP; 2755 break; 2756 default: 2757 pr_vdebug("unsupported os descriptor type: %d", w_index); 2758 return -EINVAL; 2759 } 2760 2761 return sizeof(*desc); 2762 } 2763 2764 /* 2765 * Process all extended compatibility/extended property descriptors 2766 * of a feature descriptor 2767 */ 2768 static int __must_check ffs_do_single_os_desc(char *data, unsigned len, 2769 enum ffs_os_desc_type type, 2770 u16 feature_count, 2771 ffs_os_desc_callback entity, 2772 void *priv, 2773 struct usb_os_desc_header *h) 2774 { 2775 int ret; 2776 const unsigned _len = len; 2777 2778 /* loop over all ext compat/ext prop descriptors */ 2779 while (feature_count--) { 2780 ret = entity(type, h, data, len, priv); 2781 if (ret < 0) { 2782 pr_debug("bad OS descriptor, type: %d\n", type); 2783 return ret; 2784 } 2785 data += ret; 2786 len -= ret; 2787 } 2788 return _len - len; 2789 } 2790 2791 /* Process a number of complete Feature Descriptors (Ext Compat or Ext Prop) */ 2792 static int __must_check ffs_do_os_descs(unsigned count, 2793 char *data, unsigned len, 2794 ffs_os_desc_callback entity, void *priv) 2795 { 2796 const unsigned _len = len; 2797 unsigned long num = 0; 2798 2799 for (num = 0; num < count; ++num) { 2800 int ret; 2801 enum ffs_os_desc_type type; 2802 u16 feature_count; 2803 struct usb_os_desc_header *desc = (void *)data; 2804 2805 if (len < sizeof(*desc)) 2806 return -EINVAL; 2807 2808 /* 2809 * Record "descriptor" entity. 2810 * Process dwLength, bcdVersion, wIndex, get b/wCount. 2811 * Move the data pointer to the beginning of extended 2812 * compatibilities proper or extended properties proper 2813 * portions of the data 2814 */ 2815 if (le32_to_cpu(desc->dwLength) > len) 2816 return -EINVAL; 2817 2818 ret = __ffs_do_os_desc_header(&type, desc); 2819 if (ret < 0) { 2820 pr_debug("entity OS_DESCRIPTOR(%02lx); ret = %d\n", 2821 num, ret); 2822 return ret; 2823 } 2824 /* 2825 * 16-bit hex "?? 00" Little Endian looks like 8-bit hex "??" 2826 */ 2827 feature_count = le16_to_cpu(desc->wCount); 2828 if (type == FFS_OS_DESC_EXT_COMPAT && 2829 (feature_count > 255 || desc->Reserved)) 2830 return -EINVAL; 2831 len -= ret; 2832 data += ret; 2833 2834 /* 2835 * Process all function/property descriptors 2836 * of this Feature Descriptor 2837 */ 2838 ret = ffs_do_single_os_desc(data, len, type, 2839 feature_count, entity, priv, desc); 2840 if (ret < 0) { 2841 pr_debug("%s returns %d\n", __func__, ret); 2842 return ret; 2843 } 2844 2845 len -= ret; 2846 data += ret; 2847 } 2848 return _len - len; 2849 } 2850 2851 /* 2852 * Validate contents of the buffer from userspace related to OS descriptors. 2853 */ 2854 static int __ffs_data_do_os_desc(enum ffs_os_desc_type type, 2855 struct usb_os_desc_header *h, void *data, 2856 unsigned len, void *priv) 2857 { 2858 struct ffs_data *ffs = priv; 2859 u8 length; 2860 2861 switch (type) { 2862 case FFS_OS_DESC_EXT_COMPAT: { 2863 struct usb_ext_compat_desc *d = data; 2864 int i; 2865 2866 if (len < sizeof(*d) || 2867 d->bFirstInterfaceNumber >= ffs->interfaces_count) 2868 return -EINVAL; 2869 if (d->Reserved1 != 1) { 2870 /* 2871 * According to the spec, Reserved1 must be set to 1 2872 * but older kernels incorrectly rejected non-zero 2873 * values. We fix it here to avoid returning EINVAL 2874 * in response to values we used to accept. 2875 */ 2876 pr_debug("usb_ext_compat_desc::Reserved1 forced to 1\n"); 2877 d->Reserved1 = 1; 2878 } 2879 for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i) 2880 if (d->Reserved2[i]) 2881 return -EINVAL; 2882 2883 length = sizeof(struct usb_ext_compat_desc); 2884 } 2885 break; 2886 case FFS_OS_DESC_EXT_PROP: { 2887 struct usb_ext_prop_desc *d = data; 2888 u32 type, pdl; 2889 u16 pnl; 2890 2891 if (len < sizeof(*d) || h->interface >= ffs->interfaces_count) 2892 return -EINVAL; 2893 length = le32_to_cpu(d->dwSize); 2894 if (len < length) 2895 return -EINVAL; 2896 type = le32_to_cpu(d->dwPropertyDataType); 2897 if (type < USB_EXT_PROP_UNICODE || 2898 type > USB_EXT_PROP_UNICODE_MULTI) { 2899 pr_vdebug("unsupported os descriptor property type: %d", 2900 type); 2901 return -EINVAL; 2902 } 2903 pnl = le16_to_cpu(d->wPropertyNameLength); 2904 if (length < 14 + pnl) { 2905 pr_vdebug("invalid os descriptor length: %d pnl:%d (descriptor %d)\n", 2906 length, pnl, type); 2907 return -EINVAL; 2908 } 2909 pdl = le32_to_cpu(*(__le32 *)((u8 *)data + 10 + pnl)); 2910 if (length != 14 + pnl + pdl) { 2911 pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n", 2912 length, pnl, pdl, type); 2913 return -EINVAL; 2914 } 2915 ++ffs->ms_os_descs_ext_prop_count; 2916 /* property name reported to the host as "WCHAR"s */ 2917 ffs->ms_os_descs_ext_prop_name_len += pnl * 2; 2918 ffs->ms_os_descs_ext_prop_data_len += pdl; 2919 } 2920 break; 2921 default: 2922 pr_vdebug("unknown descriptor: %d\n", type); 2923 return -EINVAL; 2924 } 2925 return length; 2926 } 2927 2928 static int __ffs_data_got_descs(struct ffs_data *ffs, 2929 char *const _data, size_t len) 2930 { 2931 char *data = _data, *raw_descs; 2932 unsigned os_descs_count = 0, counts[3], flags; 2933 int ret = -EINVAL, i; 2934 struct ffs_desc_helper helper; 2935 2936 if (get_unaligned_le32(data + 4) != len) 2937 goto error; 2938 2939 switch (get_unaligned_le32(data)) { 2940 case FUNCTIONFS_DESCRIPTORS_MAGIC: 2941 flags = FUNCTIONFS_HAS_FS_DESC | FUNCTIONFS_HAS_HS_DESC; 2942 data += 8; 2943 len -= 8; 2944 break; 2945 case FUNCTIONFS_DESCRIPTORS_MAGIC_V2: 2946 flags = get_unaligned_le32(data + 8); 2947 ffs->user_flags = flags; 2948 if (flags & ~(FUNCTIONFS_HAS_FS_DESC | 2949 FUNCTIONFS_HAS_HS_DESC | 2950 FUNCTIONFS_HAS_SS_DESC | 2951 FUNCTIONFS_HAS_MS_OS_DESC | 2952 FUNCTIONFS_VIRTUAL_ADDR | 2953 FUNCTIONFS_EVENTFD | 2954 FUNCTIONFS_ALL_CTRL_RECIP | 2955 FUNCTIONFS_CONFIG0_SETUP)) { 2956 ret = -ENOSYS; 2957 goto error; 2958 } 2959 data += 12; 2960 len -= 12; 2961 break; 2962 default: 2963 goto error; 2964 } 2965 2966 if (flags & FUNCTIONFS_EVENTFD) { 2967 if (len < 4) 2968 goto error; 2969 ffs->ffs_eventfd = 2970 eventfd_ctx_fdget((int)get_unaligned_le32(data)); 2971 if (IS_ERR(ffs->ffs_eventfd)) { 2972 ret = PTR_ERR(ffs->ffs_eventfd); 2973 ffs->ffs_eventfd = NULL; 2974 goto error; 2975 } 2976 data += 4; 2977 len -= 4; 2978 } 2979 2980 /* Read fs_count, hs_count and ss_count (if present) */ 2981 for (i = 0; i < 3; ++i) { 2982 if (!(flags & (1 << i))) { 2983 counts[i] = 0; 2984 } else if (len < 4) { 2985 goto error; 2986 } else { 2987 counts[i] = get_unaligned_le32(data); 2988 data += 4; 2989 len -= 4; 2990 } 2991 } 2992 if (flags & (1 << i)) { 2993 if (len < 4) { 2994 goto error; 2995 } 2996 os_descs_count = get_unaligned_le32(data); 2997 data += 4; 2998 len -= 4; 2999 } 3000 3001 /* Read descriptors */ 3002 raw_descs = data; 3003 helper.ffs = ffs; 3004 for (i = 0; i < 3; ++i) { 3005 if (!counts[i]) 3006 continue; 3007 helper.interfaces_count = 0; 3008 helper.eps_count = 0; 3009 ret = ffs_do_descs(counts[i], data, len, 3010 __ffs_data_do_entity, &helper); 3011 if (ret < 0) 3012 goto error; 3013 if (!ffs->eps_count && !ffs->interfaces_count) { 3014 ffs->eps_count = helper.eps_count; 3015 ffs->interfaces_count = helper.interfaces_count; 3016 } else { 3017 if (ffs->eps_count != helper.eps_count) { 3018 ret = -EINVAL; 3019 goto error; 3020 } 3021 if (ffs->interfaces_count != helper.interfaces_count) { 3022 ret = -EINVAL; 3023 goto error; 3024 } 3025 } 3026 data += ret; 3027 len -= ret; 3028 } 3029 if (os_descs_count) { 3030 ret = ffs_do_os_descs(os_descs_count, data, len, 3031 __ffs_data_do_os_desc, ffs); 3032 if (ret < 0) 3033 goto error; 3034 data += ret; 3035 len -= ret; 3036 } 3037 3038 if (raw_descs == data || len) { 3039 ret = -EINVAL; 3040 goto error; 3041 } 3042 3043 ffs->raw_descs_data = _data; 3044 ffs->raw_descs = raw_descs; 3045 ffs->raw_descs_length = data - raw_descs; 3046 ffs->fs_descs_count = counts[0]; 3047 ffs->hs_descs_count = counts[1]; 3048 ffs->ss_descs_count = counts[2]; 3049 ffs->ms_os_descs_count = os_descs_count; 3050 3051 return 0; 3052 3053 error: 3054 kfree(_data); 3055 return ret; 3056 } 3057 3058 static int __ffs_data_got_strings(struct ffs_data *ffs, 3059 char *const _data, size_t len) 3060 { 3061 u32 str_count, needed_count, lang_count; 3062 struct usb_gadget_strings **stringtabs, *t; 3063 const char *data = _data; 3064 struct usb_string *s; 3065 3066 if (len < 16 || 3067 get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC || 3068 get_unaligned_le32(data + 4) != len) 3069 goto error; 3070 str_count = get_unaligned_le32(data + 8); 3071 lang_count = get_unaligned_le32(data + 12); 3072 3073 /* if one is zero the other must be zero */ 3074 if (!str_count != !lang_count) 3075 goto error; 3076 3077 /* Do we have at least as many strings as descriptors need? */ 3078 needed_count = ffs->strings_count; 3079 if (str_count < needed_count) 3080 goto error; 3081 3082 /* 3083 * If we don't need any strings just return and free all 3084 * memory. 3085 */ 3086 if (!needed_count) { 3087 kfree(_data); 3088 return 0; 3089 } 3090 3091 /* Allocate everything in one chunk so there's less maintenance. */ 3092 { 3093 unsigned i = 0; 3094 vla_group(d); 3095 vla_item(d, struct usb_gadget_strings *, stringtabs, 3096 size_add(lang_count, 1)); 3097 vla_item(d, struct usb_gadget_strings, stringtab, lang_count); 3098 vla_item(d, struct usb_string, strings, 3099 size_mul(lang_count, (needed_count + 1))); 3100 3101 char *vlabuf = kmalloc(vla_group_size(d), GFP_KERNEL); 3102 3103 if (!vlabuf) { 3104 kfree(_data); 3105 return -ENOMEM; 3106 } 3107 3108 /* Initialize the VLA pointers */ 3109 stringtabs = vla_ptr(vlabuf, d, stringtabs); 3110 t = vla_ptr(vlabuf, d, stringtab); 3111 i = lang_count; 3112 do { 3113 *stringtabs++ = t++; 3114 } while (--i); 3115 *stringtabs = NULL; 3116 3117 /* stringtabs = vlabuf = d_stringtabs for later kfree */ 3118 stringtabs = vla_ptr(vlabuf, d, stringtabs); 3119 t = vla_ptr(vlabuf, d, stringtab); 3120 s = vla_ptr(vlabuf, d, strings); 3121 } 3122 3123 /* For each language */ 3124 data += 16; 3125 len -= 16; 3126 3127 do { /* lang_count > 0 so we can use do-while */ 3128 unsigned needed = needed_count; 3129 u32 str_per_lang = str_count; 3130 3131 if (len < 3) 3132 goto error_free; 3133 t->language = get_unaligned_le16(data); 3134 t->strings = s; 3135 ++t; 3136 3137 data += 2; 3138 len -= 2; 3139 3140 /* For each string */ 3141 do { /* str_count > 0 so we can use do-while */ 3142 size_t length = strnlen(data, len); 3143 3144 if (length == len) 3145 goto error_free; 3146 3147 /* 3148 * User may provide more strings then we need, 3149 * if that's the case we simply ignore the 3150 * rest 3151 */ 3152 if (needed) { 3153 /* 3154 * s->id will be set while adding 3155 * function to configuration so for 3156 * now just leave garbage here. 3157 */ 3158 s->s = data; 3159 --needed; 3160 ++s; 3161 } 3162 3163 data += length + 1; 3164 len -= length + 1; 3165 } while (--str_per_lang); 3166 3167 s->id = 0; /* terminator */ 3168 s->s = NULL; 3169 ++s; 3170 3171 } while (--lang_count); 3172 3173 /* Some garbage left? */ 3174 if (len) 3175 goto error_free; 3176 3177 /* Done! */ 3178 ffs->stringtabs = stringtabs; 3179 ffs->raw_strings = _data; 3180 3181 return 0; 3182 3183 error_free: 3184 kfree(stringtabs); 3185 error: 3186 kfree(_data); 3187 return -EINVAL; 3188 } 3189 3190 3191 /* Events handling and management *******************************************/ 3192 3193 static void __ffs_event_add(struct ffs_data *ffs, 3194 enum usb_functionfs_event_type type) 3195 { 3196 enum usb_functionfs_event_type rem_type1, rem_type2 = type; 3197 int neg = 0; 3198 3199 /* 3200 * Abort any unhandled setup 3201 * 3202 * We do not need to worry about some cmpxchg() changing value 3203 * of ffs->setup_state without holding the lock because when 3204 * state is FFS_SETUP_PENDING cmpxchg() in several places in 3205 * the source does nothing. 3206 */ 3207 if (ffs->setup_state == FFS_SETUP_PENDING) 3208 ffs->setup_state = FFS_SETUP_CANCELLED; 3209 3210 /* 3211 * Logic of this function guarantees that there are at most four pending 3212 * evens on ffs->ev.types queue. This is important because the queue 3213 * has space for four elements only and __ffs_ep0_read_events function 3214 * depends on that limit as well. If more event types are added, those 3215 * limits have to be revisited or guaranteed to still hold. 3216 */ 3217 switch (type) { 3218 case FUNCTIONFS_RESUME: 3219 rem_type2 = FUNCTIONFS_SUSPEND; 3220 fallthrough; 3221 case FUNCTIONFS_SUSPEND: 3222 case FUNCTIONFS_SETUP: 3223 rem_type1 = type; 3224 /* Discard all similar events */ 3225 break; 3226 3227 case FUNCTIONFS_BIND: 3228 case FUNCTIONFS_UNBIND: 3229 case FUNCTIONFS_DISABLE: 3230 case FUNCTIONFS_ENABLE: 3231 /* Discard everything other then power management. */ 3232 rem_type1 = FUNCTIONFS_SUSPEND; 3233 rem_type2 = FUNCTIONFS_RESUME; 3234 neg = 1; 3235 break; 3236 3237 default: 3238 WARN(1, "%d: unknown event, this should not happen\n", type); 3239 return; 3240 } 3241 3242 { 3243 u8 *ev = ffs->ev.types, *out = ev; 3244 unsigned n = ffs->ev.count; 3245 for (; n; --n, ++ev) 3246 if ((*ev == rem_type1 || *ev == rem_type2) == neg) 3247 *out++ = *ev; 3248 else 3249 pr_vdebug("purging event %d\n", *ev); 3250 ffs->ev.count = out - ffs->ev.types; 3251 } 3252 3253 pr_vdebug("adding event %d\n", type); 3254 ffs->ev.types[ffs->ev.count++] = type; 3255 wake_up_locked(&ffs->ev.waitq); 3256 if (ffs->ffs_eventfd) 3257 eventfd_signal(ffs->ffs_eventfd); 3258 } 3259 3260 static void ffs_event_add(struct ffs_data *ffs, 3261 enum usb_functionfs_event_type type) 3262 { 3263 unsigned long flags; 3264 spin_lock_irqsave(&ffs->ev.waitq.lock, flags); 3265 __ffs_event_add(ffs, type); 3266 spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags); 3267 } 3268 3269 /* Bind/unbind USB function hooks *******************************************/ 3270 3271 static int ffs_ep_addr2idx(struct ffs_data *ffs, u8 endpoint_address) 3272 { 3273 int i; 3274 3275 for (i = 1; i < ARRAY_SIZE(ffs->eps_addrmap); ++i) 3276 if (ffs->eps_addrmap[i] == endpoint_address) 3277 return i; 3278 return -ENOENT; 3279 } 3280 3281 static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep, 3282 struct usb_descriptor_header *desc, 3283 void *priv) 3284 { 3285 struct usb_endpoint_descriptor *ds = (void *)desc; 3286 struct ffs_function *func = priv; 3287 struct ffs_ep *ffs_ep; 3288 unsigned ep_desc_id; 3289 int idx; 3290 static const char *speed_names[] = { "full", "high", "super" }; 3291 3292 if (type != FFS_DESCRIPTOR) 3293 return 0; 3294 3295 /* 3296 * If ss_descriptors is not NULL, we are reading super speed 3297 * descriptors; if hs_descriptors is not NULL, we are reading high 3298 * speed descriptors; otherwise, we are reading full speed 3299 * descriptors. 3300 */ 3301 if (func->function.ss_descriptors) { 3302 ep_desc_id = 2; 3303 func->function.ss_descriptors[(long)valuep] = desc; 3304 } else if (func->function.hs_descriptors) { 3305 ep_desc_id = 1; 3306 func->function.hs_descriptors[(long)valuep] = desc; 3307 } else { 3308 ep_desc_id = 0; 3309 func->function.fs_descriptors[(long)valuep] = desc; 3310 } 3311 3312 if (!desc || desc->bDescriptorType != USB_DT_ENDPOINT) 3313 return 0; 3314 3315 idx = ffs_ep_addr2idx(func->ffs, ds->bEndpointAddress) - 1; 3316 if (idx < 0) 3317 return idx; 3318 3319 ffs_ep = func->eps + idx; 3320 3321 if (ffs_ep->descs[ep_desc_id]) { 3322 pr_err("two %sspeed descriptors for EP %d\n", 3323 speed_names[ep_desc_id], 3324 usb_endpoint_num(ds)); 3325 return -EINVAL; 3326 } 3327 ffs_ep->descs[ep_desc_id] = ds; 3328 3329 ffs_dump_mem(": Original ep desc", ds, ds->bLength); 3330 if (ffs_ep->ep) { 3331 ds->bEndpointAddress = ffs_ep->descs[0]->bEndpointAddress; 3332 if (!ds->wMaxPacketSize) 3333 ds->wMaxPacketSize = ffs_ep->descs[0]->wMaxPacketSize; 3334 } else { 3335 struct usb_request *req; 3336 struct usb_ep *ep; 3337 u8 bEndpointAddress; 3338 u16 wMaxPacketSize; 3339 3340 /* 3341 * We back up bEndpointAddress because autoconfig overwrites 3342 * it with physical endpoint address. 3343 */ 3344 bEndpointAddress = ds->bEndpointAddress; 3345 /* 3346 * We back up wMaxPacketSize because autoconfig treats 3347 * endpoint descriptors as if they were full speed. 3348 */ 3349 wMaxPacketSize = ds->wMaxPacketSize; 3350 pr_vdebug("autoconfig\n"); 3351 ep = usb_ep_autoconfig(func->gadget, ds); 3352 if (!ep) 3353 return -ENOTSUPP; 3354 ep->driver_data = func->eps + idx; 3355 3356 req = usb_ep_alloc_request(ep, GFP_KERNEL); 3357 if (!req) 3358 return -ENOMEM; 3359 3360 ffs_ep->ep = ep; 3361 ffs_ep->req = req; 3362 func->eps_revmap[ds->bEndpointAddress & 3363 USB_ENDPOINT_NUMBER_MASK] = idx + 1; 3364 /* 3365 * If we use virtual address mapping, we restore 3366 * original bEndpointAddress value. 3367 */ 3368 if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR) 3369 ds->bEndpointAddress = bEndpointAddress; 3370 /* 3371 * Restore wMaxPacketSize which was potentially 3372 * overwritten by autoconfig. 3373 */ 3374 ds->wMaxPacketSize = wMaxPacketSize; 3375 } 3376 ffs_dump_mem(": Rewritten ep desc", ds, ds->bLength); 3377 3378 return 0; 3379 } 3380 3381 static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep, 3382 struct usb_descriptor_header *desc, 3383 void *priv) 3384 { 3385 struct ffs_function *func = priv; 3386 unsigned idx; 3387 u8 newValue; 3388 3389 switch (type) { 3390 default: 3391 case FFS_DESCRIPTOR: 3392 /* Handled in previous pass by __ffs_func_bind_do_descs() */ 3393 return 0; 3394 3395 case FFS_INTERFACE: 3396 idx = *valuep; 3397 if (func->interfaces_nums[idx] < 0) { 3398 int id = usb_interface_id(func->conf, &func->function); 3399 if (id < 0) 3400 return id; 3401 func->interfaces_nums[idx] = id; 3402 } 3403 newValue = func->interfaces_nums[idx]; 3404 break; 3405 3406 case FFS_STRING: 3407 /* String' IDs are allocated when fsf_data is bound to cdev */ 3408 newValue = func->ffs->stringtabs[0]->strings[*valuep - 1].id; 3409 break; 3410 3411 case FFS_ENDPOINT: 3412 /* 3413 * USB_DT_ENDPOINT are handled in 3414 * __ffs_func_bind_do_descs(). 3415 */ 3416 if (desc->bDescriptorType == USB_DT_ENDPOINT) 3417 return 0; 3418 3419 idx = (*valuep & USB_ENDPOINT_NUMBER_MASK) - 1; 3420 if (!func->eps[idx].ep) 3421 return -EINVAL; 3422 3423 { 3424 struct usb_endpoint_descriptor **descs; 3425 descs = func->eps[idx].descs; 3426 newValue = descs[descs[0] ? 0 : 1]->bEndpointAddress; 3427 } 3428 break; 3429 } 3430 3431 pr_vdebug("%02x -> %02x\n", *valuep, newValue); 3432 *valuep = newValue; 3433 return 0; 3434 } 3435 3436 static int __ffs_func_bind_do_os_desc(enum ffs_os_desc_type type, 3437 struct usb_os_desc_header *h, void *data, 3438 unsigned len, void *priv) 3439 { 3440 struct ffs_function *func = priv; 3441 u8 length = 0; 3442 3443 switch (type) { 3444 case FFS_OS_DESC_EXT_COMPAT: { 3445 struct usb_ext_compat_desc *desc = data; 3446 struct usb_os_desc_table *t; 3447 3448 t = &func->function.os_desc_table[desc->bFirstInterfaceNumber]; 3449 t->if_id = func->interfaces_nums[desc->bFirstInterfaceNumber]; 3450 memcpy(t->os_desc->ext_compat_id, &desc->IDs, 3451 sizeof_field(struct usb_ext_compat_desc, IDs)); 3452 length = sizeof(*desc); 3453 } 3454 break; 3455 case FFS_OS_DESC_EXT_PROP: { 3456 struct usb_ext_prop_desc *desc = data; 3457 struct usb_os_desc_table *t; 3458 struct usb_os_desc_ext_prop *ext_prop; 3459 char *ext_prop_name; 3460 char *ext_prop_data; 3461 3462 t = &func->function.os_desc_table[h->interface]; 3463 t->if_id = func->interfaces_nums[h->interface]; 3464 3465 ext_prop = func->ffs->ms_os_descs_ext_prop_avail; 3466 func->ffs->ms_os_descs_ext_prop_avail += sizeof(*ext_prop); 3467 3468 ext_prop->type = le32_to_cpu(desc->dwPropertyDataType); 3469 ext_prop->name_len = le16_to_cpu(desc->wPropertyNameLength); 3470 ext_prop->data_len = le32_to_cpu(*(__le32 *) 3471 usb_ext_prop_data_len_ptr(data, ext_prop->name_len)); 3472 length = ext_prop->name_len + ext_prop->data_len + 14; 3473 3474 ext_prop_name = func->ffs->ms_os_descs_ext_prop_name_avail; 3475 func->ffs->ms_os_descs_ext_prop_name_avail += 3476 ext_prop->name_len; 3477 3478 ext_prop_data = func->ffs->ms_os_descs_ext_prop_data_avail; 3479 func->ffs->ms_os_descs_ext_prop_data_avail += 3480 ext_prop->data_len; 3481 memcpy(ext_prop_data, 3482 usb_ext_prop_data_ptr(data, ext_prop->name_len), 3483 ext_prop->data_len); 3484 /* unicode data reported to the host as "WCHAR"s */ 3485 switch (ext_prop->type) { 3486 case USB_EXT_PROP_UNICODE: 3487 case USB_EXT_PROP_UNICODE_ENV: 3488 case USB_EXT_PROP_UNICODE_LINK: 3489 case USB_EXT_PROP_UNICODE_MULTI: 3490 ext_prop->data_len *= 2; 3491 break; 3492 } 3493 ext_prop->data = ext_prop_data; 3494 3495 memcpy(ext_prop_name, usb_ext_prop_name_ptr(data), 3496 ext_prop->name_len); 3497 /* property name reported to the host as "WCHAR"s */ 3498 ext_prop->name_len *= 2; 3499 ext_prop->name = ext_prop_name; 3500 3501 t->os_desc->ext_prop_len += 3502 ext_prop->name_len + ext_prop->data_len + 14; 3503 ++t->os_desc->ext_prop_count; 3504 list_add_tail(&ext_prop->entry, &t->os_desc->ext_prop); 3505 } 3506 break; 3507 default: 3508 pr_vdebug("unknown descriptor: %d\n", type); 3509 } 3510 3511 return length; 3512 } 3513 3514 static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f, 3515 struct usb_configuration *c) 3516 { 3517 struct ffs_function *func = ffs_func_from_usb(f); 3518 struct f_fs_opts *ffs_opts = 3519 container_of(f->fi, struct f_fs_opts, func_inst); 3520 struct ffs_data *ffs_data; 3521 int ret; 3522 3523 /* 3524 * Legacy gadget triggers binding in functionfs_ready_callback, 3525 * which already uses locking; taking the same lock here would 3526 * cause a deadlock. 3527 * 3528 * Configfs-enabled gadgets however do need ffs_dev_lock. 3529 */ 3530 if (!ffs_opts->no_configfs) 3531 ffs_dev_lock(); 3532 ret = ffs_opts->dev->desc_ready ? 0 : -ENODEV; 3533 ffs_data = ffs_opts->dev->ffs_data; 3534 if (!ffs_opts->no_configfs) 3535 ffs_dev_unlock(); 3536 if (ret) 3537 return ERR_PTR(ret); 3538 3539 func->ffs = ffs_data; 3540 func->conf = c; 3541 func->gadget = c->cdev->gadget; 3542 3543 /* 3544 * in drivers/usb/gadget/configfs.c:configfs_composite_bind() 3545 * configurations are bound in sequence with list_for_each_entry, 3546 * in each configuration its functions are bound in sequence 3547 * with list_for_each_entry, so we assume no race condition 3548 * with regard to ffs_opts->bound access 3549 */ 3550 if (!ffs_opts->refcnt) { 3551 ret = functionfs_bind(func->ffs, c->cdev); 3552 if (ret) 3553 return ERR_PTR(ret); 3554 } 3555 ffs_opts->refcnt++; 3556 func->function.strings = func->ffs->stringtabs; 3557 3558 return ffs_opts; 3559 } 3560 3561 static int _ffs_func_bind(struct usb_configuration *c, 3562 struct usb_function *f) 3563 { 3564 struct ffs_function *func = ffs_func_from_usb(f); 3565 struct ffs_data *ffs = func->ffs; 3566 3567 const int full = !!func->ffs->fs_descs_count; 3568 const int high = !!func->ffs->hs_descs_count; 3569 const int super = !!func->ffs->ss_descs_count; 3570 3571 int fs_len, hs_len, ss_len, ret, i; 3572 struct ffs_ep *eps_ptr; 3573 3574 /* Make it a single chunk, less management later on */ 3575 vla_group(d); 3576 vla_item_with_sz(d, struct ffs_ep, eps, ffs->eps_count); 3577 vla_item_with_sz(d, struct usb_descriptor_header *, fs_descs, 3578 full ? ffs->fs_descs_count + 1 : 0); 3579 vla_item_with_sz(d, struct usb_descriptor_header *, hs_descs, 3580 high ? ffs->hs_descs_count + 1 : 0); 3581 vla_item_with_sz(d, struct usb_descriptor_header *, ss_descs, 3582 super ? ffs->ss_descs_count + 1 : 0); 3583 vla_item_with_sz(d, short, inums, ffs->interfaces_count); 3584 vla_item_with_sz(d, struct usb_os_desc_table, os_desc_table, 3585 c->cdev->use_os_string ? ffs->interfaces_count : 0); 3586 vla_item_with_sz(d, char[16], ext_compat, 3587 c->cdev->use_os_string ? ffs->interfaces_count : 0); 3588 vla_item_with_sz(d, struct usb_os_desc, os_desc, 3589 c->cdev->use_os_string ? ffs->interfaces_count : 0); 3590 vla_item_with_sz(d, struct usb_os_desc_ext_prop, ext_prop, 3591 ffs->ms_os_descs_ext_prop_count); 3592 vla_item_with_sz(d, char, ext_prop_name, 3593 ffs->ms_os_descs_ext_prop_name_len); 3594 vla_item_with_sz(d, char, ext_prop_data, 3595 ffs->ms_os_descs_ext_prop_data_len); 3596 vla_item_with_sz(d, char, raw_descs, ffs->raw_descs_length); 3597 char *vlabuf; 3598 3599 /* Has descriptors only for speeds gadget does not support */ 3600 if (!(full | high | super)) 3601 return -ENOTSUPP; 3602 3603 /* Allocate a single chunk, less management later on */ 3604 vlabuf = kzalloc(vla_group_size(d), GFP_KERNEL); 3605 if (!vlabuf) 3606 return -ENOMEM; 3607 3608 ffs->ms_os_descs_ext_prop_avail = vla_ptr(vlabuf, d, ext_prop); 3609 ffs->ms_os_descs_ext_prop_name_avail = 3610 vla_ptr(vlabuf, d, ext_prop_name); 3611 ffs->ms_os_descs_ext_prop_data_avail = 3612 vla_ptr(vlabuf, d, ext_prop_data); 3613 3614 /* Copy descriptors */ 3615 memcpy(vla_ptr(vlabuf, d, raw_descs), ffs->raw_descs, 3616 ffs->raw_descs_length); 3617 3618 memset(vla_ptr(vlabuf, d, inums), 0xff, d_inums__sz); 3619 eps_ptr = vla_ptr(vlabuf, d, eps); 3620 for (i = 0; i < ffs->eps_count; i++) 3621 eps_ptr[i].num = -1; 3622 3623 /* Save pointers 3624 * d_eps == vlabuf, func->eps used to kfree vlabuf later 3625 */ 3626 func->eps = vla_ptr(vlabuf, d, eps); 3627 func->interfaces_nums = vla_ptr(vlabuf, d, inums); 3628 3629 /* 3630 * Go through all the endpoint descriptors and allocate 3631 * endpoints first, so that later we can rewrite the endpoint 3632 * numbers without worrying that it may be described later on. 3633 */ 3634 if (full) { 3635 func->function.fs_descriptors = vla_ptr(vlabuf, d, fs_descs); 3636 fs_len = ffs_do_descs(ffs->fs_descs_count, 3637 vla_ptr(vlabuf, d, raw_descs), 3638 d_raw_descs__sz, 3639 __ffs_func_bind_do_descs, func); 3640 if (fs_len < 0) { 3641 ret = fs_len; 3642 goto error; 3643 } 3644 } else { 3645 fs_len = 0; 3646 } 3647 3648 if (high) { 3649 func->function.hs_descriptors = vla_ptr(vlabuf, d, hs_descs); 3650 hs_len = ffs_do_descs(ffs->hs_descs_count, 3651 vla_ptr(vlabuf, d, raw_descs) + fs_len, 3652 d_raw_descs__sz - fs_len, 3653 __ffs_func_bind_do_descs, func); 3654 if (hs_len < 0) { 3655 ret = hs_len; 3656 goto error; 3657 } 3658 } else { 3659 hs_len = 0; 3660 } 3661 3662 if (super) { 3663 func->function.ss_descriptors = func->function.ssp_descriptors = 3664 vla_ptr(vlabuf, d, ss_descs); 3665 ss_len = ffs_do_descs(ffs->ss_descs_count, 3666 vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len, 3667 d_raw_descs__sz - fs_len - hs_len, 3668 __ffs_func_bind_do_descs, func); 3669 if (ss_len < 0) { 3670 ret = ss_len; 3671 goto error; 3672 } 3673 } else { 3674 ss_len = 0; 3675 } 3676 3677 /* 3678 * Now handle interface numbers allocation and interface and 3679 * endpoint numbers rewriting. We can do that in one go 3680 * now. 3681 */ 3682 ret = ffs_do_descs(ffs->fs_descs_count + 3683 (high ? ffs->hs_descs_count : 0) + 3684 (super ? ffs->ss_descs_count : 0), 3685 vla_ptr(vlabuf, d, raw_descs), d_raw_descs__sz, 3686 __ffs_func_bind_do_nums, func); 3687 if (ret < 0) 3688 goto error; 3689 3690 func->function.os_desc_table = vla_ptr(vlabuf, d, os_desc_table); 3691 if (c->cdev->use_os_string) { 3692 for (i = 0; i < ffs->interfaces_count; ++i) { 3693 struct usb_os_desc *desc; 3694 3695 desc = func->function.os_desc_table[i].os_desc = 3696 vla_ptr(vlabuf, d, os_desc) + 3697 i * sizeof(struct usb_os_desc); 3698 desc->ext_compat_id = 3699 vla_ptr(vlabuf, d, ext_compat) + i * 16; 3700 INIT_LIST_HEAD(&desc->ext_prop); 3701 } 3702 ret = ffs_do_os_descs(ffs->ms_os_descs_count, 3703 vla_ptr(vlabuf, d, raw_descs) + 3704 fs_len + hs_len + ss_len, 3705 d_raw_descs__sz - fs_len - hs_len - 3706 ss_len, 3707 __ffs_func_bind_do_os_desc, func); 3708 if (ret < 0) 3709 goto error; 3710 } 3711 func->function.os_desc_n = 3712 c->cdev->use_os_string ? ffs->interfaces_count : 0; 3713 3714 /* And we're done */ 3715 ffs_event_add(ffs, FUNCTIONFS_BIND); 3716 return 0; 3717 3718 error: 3719 /* XXX Do we need to release all claimed endpoints here? */ 3720 return ret; 3721 } 3722 3723 static int ffs_func_bind(struct usb_configuration *c, 3724 struct usb_function *f) 3725 { 3726 struct f_fs_opts *ffs_opts = ffs_do_functionfs_bind(f, c); 3727 struct ffs_function *func = ffs_func_from_usb(f); 3728 int ret; 3729 3730 if (IS_ERR(ffs_opts)) 3731 return PTR_ERR(ffs_opts); 3732 3733 ret = _ffs_func_bind(c, f); 3734 if (ret && !--ffs_opts->refcnt) 3735 functionfs_unbind(func->ffs); 3736 3737 return ret; 3738 } 3739 3740 3741 /* Other USB function hooks *************************************************/ 3742 3743 static void ffs_reset_work(struct work_struct *work) 3744 { 3745 struct ffs_data *ffs = container_of(work, 3746 struct ffs_data, reset_work); 3747 ffs_data_reset(ffs); 3748 } 3749 3750 static int ffs_func_get_alt(struct usb_function *f, 3751 unsigned int interface) 3752 { 3753 struct ffs_function *func = ffs_func_from_usb(f); 3754 int intf = ffs_func_revmap_intf(func, interface); 3755 3756 return (intf < 0) ? intf : func->cur_alt[interface]; 3757 } 3758 3759 static int ffs_func_set_alt(struct usb_function *f, 3760 unsigned interface, unsigned alt) 3761 { 3762 struct ffs_function *func = ffs_func_from_usb(f); 3763 struct ffs_data *ffs = func->ffs; 3764 unsigned long flags; 3765 int ret = 0, intf; 3766 3767 if (alt > MAX_ALT_SETTINGS) 3768 return -EINVAL; 3769 3770 intf = ffs_func_revmap_intf(func, interface); 3771 if (intf < 0) 3772 return intf; 3773 3774 if (ffs->func) 3775 ffs_func_eps_disable(ffs->func); 3776 3777 spin_lock_irqsave(&ffs->eps_lock, flags); 3778 if (ffs->state == FFS_DEACTIVATED) { 3779 ffs->state = FFS_CLOSING; 3780 spin_unlock_irqrestore(&ffs->eps_lock, flags); 3781 schedule_work(&ffs->reset_work); 3782 return -ENODEV; 3783 } 3784 spin_unlock_irqrestore(&ffs->eps_lock, flags); 3785 3786 if (ffs->state != FFS_ACTIVE) 3787 return -ENODEV; 3788 3789 ffs->func = func; 3790 ret = ffs_func_eps_enable(func); 3791 if (ret >= 0) { 3792 ffs_event_add(ffs, FUNCTIONFS_ENABLE); 3793 func->cur_alt[interface] = alt; 3794 } 3795 return ret; 3796 } 3797 3798 static void ffs_func_disable(struct usb_function *f) 3799 { 3800 struct ffs_function *func = ffs_func_from_usb(f); 3801 struct ffs_data *ffs = func->ffs; 3802 unsigned long flags; 3803 3804 if (ffs->func) 3805 ffs_func_eps_disable(ffs->func); 3806 3807 spin_lock_irqsave(&ffs->eps_lock, flags); 3808 if (ffs->state == FFS_DEACTIVATED) { 3809 ffs->state = FFS_CLOSING; 3810 spin_unlock_irqrestore(&ffs->eps_lock, flags); 3811 schedule_work(&ffs->reset_work); 3812 return; 3813 } 3814 spin_unlock_irqrestore(&ffs->eps_lock, flags); 3815 3816 if (ffs->state == FFS_ACTIVE) { 3817 ffs->func = NULL; 3818 ffs_event_add(ffs, FUNCTIONFS_DISABLE); 3819 } 3820 } 3821 3822 static int ffs_func_setup(struct usb_function *f, 3823 const struct usb_ctrlrequest *creq) 3824 { 3825 struct ffs_function *func = ffs_func_from_usb(f); 3826 struct ffs_data *ffs = func->ffs; 3827 unsigned long flags; 3828 int ret; 3829 3830 pr_vdebug("creq->bRequestType = %02x\n", creq->bRequestType); 3831 pr_vdebug("creq->bRequest = %02x\n", creq->bRequest); 3832 pr_vdebug("creq->wValue = %04x\n", le16_to_cpu(creq->wValue)); 3833 pr_vdebug("creq->wIndex = %04x\n", le16_to_cpu(creq->wIndex)); 3834 pr_vdebug("creq->wLength = %04x\n", le16_to_cpu(creq->wLength)); 3835 3836 /* 3837 * Most requests directed to interface go through here 3838 * (notable exceptions are set/get interface) so we need to 3839 * handle them. All other either handled by composite or 3840 * passed to usb_configuration->setup() (if one is set). No 3841 * matter, we will handle requests directed to endpoint here 3842 * as well (as it's straightforward). Other request recipient 3843 * types are only handled when the user flag FUNCTIONFS_ALL_CTRL_RECIP 3844 * is being used. 3845 */ 3846 if (ffs->state != FFS_ACTIVE) 3847 return -ENODEV; 3848 3849 switch (creq->bRequestType & USB_RECIP_MASK) { 3850 case USB_RECIP_INTERFACE: 3851 ret = ffs_func_revmap_intf(func, le16_to_cpu(creq->wIndex)); 3852 if (ret < 0) 3853 return ret; 3854 break; 3855 3856 case USB_RECIP_ENDPOINT: 3857 ret = ffs_func_revmap_ep(func, le16_to_cpu(creq->wIndex)); 3858 if (ret < 0) 3859 return ret; 3860 if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR) 3861 ret = func->ffs->eps_addrmap[ret]; 3862 break; 3863 3864 default: 3865 if (func->ffs->user_flags & FUNCTIONFS_ALL_CTRL_RECIP) 3866 ret = le16_to_cpu(creq->wIndex); 3867 else 3868 return -EOPNOTSUPP; 3869 } 3870 3871 spin_lock_irqsave(&ffs->ev.waitq.lock, flags); 3872 ffs->ev.setup = *creq; 3873 ffs->ev.setup.wIndex = cpu_to_le16(ret); 3874 __ffs_event_add(ffs, FUNCTIONFS_SETUP); 3875 spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags); 3876 3877 return ffs->ev.setup.wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0; 3878 } 3879 3880 static bool ffs_func_req_match(struct usb_function *f, 3881 const struct usb_ctrlrequest *creq, 3882 bool config0) 3883 { 3884 struct ffs_function *func = ffs_func_from_usb(f); 3885 3886 if (config0 && !(func->ffs->user_flags & FUNCTIONFS_CONFIG0_SETUP)) 3887 return false; 3888 3889 switch (creq->bRequestType & USB_RECIP_MASK) { 3890 case USB_RECIP_INTERFACE: 3891 return (ffs_func_revmap_intf(func, 3892 le16_to_cpu(creq->wIndex)) >= 0); 3893 case USB_RECIP_ENDPOINT: 3894 return (ffs_func_revmap_ep(func, 3895 le16_to_cpu(creq->wIndex)) >= 0); 3896 default: 3897 return (bool) (func->ffs->user_flags & 3898 FUNCTIONFS_ALL_CTRL_RECIP); 3899 } 3900 } 3901 3902 static void ffs_func_suspend(struct usb_function *f) 3903 { 3904 ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_SUSPEND); 3905 } 3906 3907 static void ffs_func_resume(struct usb_function *f) 3908 { 3909 ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_RESUME); 3910 } 3911 3912 3913 /* Endpoint and interface numbers reverse mapping ***************************/ 3914 3915 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num) 3916 { 3917 num = func->eps_revmap[num & USB_ENDPOINT_NUMBER_MASK]; 3918 return num ? num : -EDOM; 3919 } 3920 3921 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf) 3922 { 3923 short *nums = func->interfaces_nums; 3924 unsigned count = func->ffs->interfaces_count; 3925 3926 for (; count; --count, ++nums) { 3927 if (*nums >= 0 && *nums == intf) 3928 return nums - func->interfaces_nums; 3929 } 3930 3931 return -EDOM; 3932 } 3933 3934 3935 /* Devices management *******************************************************/ 3936 3937 static LIST_HEAD(ffs_devices); 3938 3939 static struct ffs_dev *_ffs_do_find_dev(const char *name) 3940 { 3941 struct ffs_dev *dev; 3942 3943 if (!name) 3944 return NULL; 3945 3946 list_for_each_entry(dev, &ffs_devices, entry) { 3947 if (strcmp(dev->name, name) == 0) 3948 return dev; 3949 } 3950 3951 return NULL; 3952 } 3953 3954 /* 3955 * ffs_lock must be taken by the caller of this function 3956 */ 3957 static struct ffs_dev *_ffs_get_single_dev(void) 3958 { 3959 struct ffs_dev *dev; 3960 3961 if (list_is_singular(&ffs_devices)) { 3962 dev = list_first_entry(&ffs_devices, struct ffs_dev, entry); 3963 if (dev->single) 3964 return dev; 3965 } 3966 3967 return NULL; 3968 } 3969 3970 /* 3971 * ffs_lock must be taken by the caller of this function 3972 */ 3973 static struct ffs_dev *_ffs_find_dev(const char *name) 3974 { 3975 struct ffs_dev *dev; 3976 3977 dev = _ffs_get_single_dev(); 3978 if (dev) 3979 return dev; 3980 3981 return _ffs_do_find_dev(name); 3982 } 3983 3984 /* Configfs support *********************************************************/ 3985 3986 static inline struct f_fs_opts *to_ffs_opts(struct config_item *item) 3987 { 3988 return container_of(to_config_group(item), struct f_fs_opts, 3989 func_inst.group); 3990 } 3991 3992 static ssize_t f_fs_opts_ready_show(struct config_item *item, char *page) 3993 { 3994 struct f_fs_opts *opts = to_ffs_opts(item); 3995 int ready; 3996 3997 ffs_dev_lock(); 3998 ready = opts->dev->desc_ready; 3999 ffs_dev_unlock(); 4000 4001 return sprintf(page, "%d\n", ready); 4002 } 4003 4004 CONFIGFS_ATTR_RO(f_fs_opts_, ready); 4005 4006 static struct configfs_attribute *ffs_attrs[] = { 4007 &f_fs_opts_attr_ready, 4008 NULL, 4009 }; 4010 4011 static void ffs_attr_release(struct config_item *item) 4012 { 4013 struct f_fs_opts *opts = to_ffs_opts(item); 4014 4015 usb_put_function_instance(&opts->func_inst); 4016 } 4017 4018 static const struct configfs_item_operations ffs_item_ops = { 4019 .release = ffs_attr_release, 4020 }; 4021 4022 static const struct config_item_type ffs_func_type = { 4023 .ct_item_ops = &ffs_item_ops, 4024 .ct_attrs = ffs_attrs, 4025 .ct_owner = THIS_MODULE, 4026 }; 4027 4028 4029 /* Function registration interface ******************************************/ 4030 4031 static void ffs_free_inst(struct usb_function_instance *f) 4032 { 4033 struct f_fs_opts *opts; 4034 4035 opts = to_f_fs_opts(f); 4036 ffs_release_dev(opts->dev); 4037 ffs_dev_lock(); 4038 _ffs_free_dev(opts->dev); 4039 ffs_dev_unlock(); 4040 kfree(opts); 4041 } 4042 4043 static int ffs_set_inst_name(struct usb_function_instance *fi, const char *name) 4044 { 4045 if (strlen(name) >= sizeof_field(struct ffs_dev, name)) 4046 return -ENAMETOOLONG; 4047 return ffs_name_dev(to_f_fs_opts(fi)->dev, name); 4048 } 4049 4050 static struct usb_function_instance *ffs_alloc_inst(void) 4051 { 4052 struct f_fs_opts *opts; 4053 struct ffs_dev *dev; 4054 4055 opts = kzalloc_obj(*opts); 4056 if (!opts) 4057 return ERR_PTR(-ENOMEM); 4058 4059 opts->func_inst.set_inst_name = ffs_set_inst_name; 4060 opts->func_inst.free_func_inst = ffs_free_inst; 4061 ffs_dev_lock(); 4062 dev = _ffs_alloc_dev(); 4063 ffs_dev_unlock(); 4064 if (IS_ERR(dev)) { 4065 kfree(opts); 4066 return ERR_CAST(dev); 4067 } 4068 opts->dev = dev; 4069 dev->opts = opts; 4070 4071 config_group_init_type_name(&opts->func_inst.group, "", 4072 &ffs_func_type); 4073 return &opts->func_inst; 4074 } 4075 4076 static void ffs_free(struct usb_function *f) 4077 { 4078 kfree(ffs_func_from_usb(f)); 4079 } 4080 4081 static void ffs_func_unbind(struct usb_configuration *c, 4082 struct usb_function *f) 4083 { 4084 struct ffs_function *func = ffs_func_from_usb(f); 4085 struct ffs_data *ffs = func->ffs; 4086 struct f_fs_opts *opts = 4087 container_of(f->fi, struct f_fs_opts, func_inst); 4088 struct ffs_ep *ep = func->eps; 4089 unsigned count = ffs->eps_count; 4090 unsigned long flags; 4091 4092 if (ffs->func == func) { 4093 ffs_func_eps_disable(func); 4094 ffs->func = NULL; 4095 } 4096 4097 /* Drain any pending AIO completions */ 4098 drain_workqueue(ffs->io_completion_wq); 4099 4100 ffs_event_add(ffs, FUNCTIONFS_UNBIND); 4101 if (!--opts->refcnt) 4102 functionfs_unbind(ffs); 4103 4104 /* cleanup after autoconfig */ 4105 spin_lock_irqsave(&func->ffs->eps_lock, flags); 4106 while (count--) { 4107 if (ep->ep && ep->req) 4108 usb_ep_free_request(ep->ep, ep->req); 4109 ep->req = NULL; 4110 ++ep; 4111 } 4112 spin_unlock_irqrestore(&func->ffs->eps_lock, flags); 4113 kfree(func->eps); 4114 func->eps = NULL; 4115 /* 4116 * eps, descriptors and interfaces_nums are allocated in the 4117 * same chunk so only one free is required. 4118 */ 4119 func->function.fs_descriptors = NULL; 4120 func->function.hs_descriptors = NULL; 4121 func->function.ss_descriptors = NULL; 4122 func->function.ssp_descriptors = NULL; 4123 func->interfaces_nums = NULL; 4124 4125 } 4126 4127 static struct usb_function *ffs_alloc(struct usb_function_instance *fi) 4128 { 4129 struct ffs_function *func; 4130 4131 func = kzalloc_obj(*func); 4132 if (!func) 4133 return ERR_PTR(-ENOMEM); 4134 4135 func->function.name = "Function FS Gadget"; 4136 4137 func->function.bind = ffs_func_bind; 4138 func->function.unbind = ffs_func_unbind; 4139 func->function.set_alt = ffs_func_set_alt; 4140 func->function.get_alt = ffs_func_get_alt; 4141 func->function.disable = ffs_func_disable; 4142 func->function.setup = ffs_func_setup; 4143 func->function.req_match = ffs_func_req_match; 4144 func->function.suspend = ffs_func_suspend; 4145 func->function.resume = ffs_func_resume; 4146 func->function.free_func = ffs_free; 4147 4148 return &func->function; 4149 } 4150 4151 /* 4152 * ffs_lock must be taken by the caller of this function 4153 */ 4154 static struct ffs_dev *_ffs_alloc_dev(void) 4155 { 4156 struct ffs_dev *dev; 4157 int ret; 4158 4159 if (_ffs_get_single_dev()) 4160 return ERR_PTR(-EBUSY); 4161 4162 dev = kzalloc_obj(*dev); 4163 if (!dev) 4164 return ERR_PTR(-ENOMEM); 4165 4166 if (list_empty(&ffs_devices)) { 4167 ret = functionfs_init(); 4168 if (ret) { 4169 kfree(dev); 4170 return ERR_PTR(ret); 4171 } 4172 } 4173 4174 list_add(&dev->entry, &ffs_devices); 4175 4176 return dev; 4177 } 4178 4179 int ffs_name_dev(struct ffs_dev *dev, const char *name) 4180 { 4181 struct ffs_dev *existing; 4182 int ret = 0; 4183 4184 ffs_dev_lock(); 4185 4186 existing = _ffs_do_find_dev(name); 4187 if (!existing) 4188 strscpy(dev->name, name, ARRAY_SIZE(dev->name)); 4189 else if (existing != dev) 4190 ret = -EBUSY; 4191 4192 ffs_dev_unlock(); 4193 4194 return ret; 4195 } 4196 EXPORT_SYMBOL_GPL(ffs_name_dev); 4197 4198 int ffs_single_dev(struct ffs_dev *dev) 4199 { 4200 int ret; 4201 4202 ret = 0; 4203 ffs_dev_lock(); 4204 4205 if (!list_is_singular(&ffs_devices)) 4206 ret = -EBUSY; 4207 else 4208 dev->single = true; 4209 4210 ffs_dev_unlock(); 4211 return ret; 4212 } 4213 EXPORT_SYMBOL_GPL(ffs_single_dev); 4214 4215 /* 4216 * ffs_lock must be taken by the caller of this function 4217 */ 4218 static void _ffs_free_dev(struct ffs_dev *dev) 4219 { 4220 list_del(&dev->entry); 4221 4222 kfree(dev); 4223 if (list_empty(&ffs_devices)) 4224 functionfs_cleanup(); 4225 } 4226 4227 static int ffs_acquire_dev(const char *dev_name, struct ffs_data *ffs_data) 4228 { 4229 int ret = 0; 4230 struct ffs_dev *ffs_dev; 4231 4232 ffs_dev_lock(); 4233 4234 ffs_dev = _ffs_find_dev(dev_name); 4235 if (!ffs_dev) { 4236 ret = -ENOENT; 4237 } else if (ffs_dev->mounted) { 4238 ret = -EBUSY; 4239 } else if (ffs_dev->ffs_acquire_dev_callback && 4240 ffs_dev->ffs_acquire_dev_callback(ffs_dev)) { 4241 ret = -ENOENT; 4242 } else { 4243 ffs_dev->mounted = true; 4244 ffs_dev->ffs_data = ffs_data; 4245 ffs_data->private_data = ffs_dev; 4246 } 4247 4248 ffs_dev_unlock(); 4249 return ret; 4250 } 4251 4252 static void ffs_release_dev(struct ffs_dev *ffs_dev) 4253 { 4254 ffs_dev_lock(); 4255 4256 if (ffs_dev && ffs_dev->mounted) { 4257 ffs_dev->mounted = false; 4258 if (ffs_dev->ffs_data) { 4259 ffs_dev->ffs_data->private_data = NULL; 4260 ffs_dev->ffs_data = NULL; 4261 } 4262 4263 if (ffs_dev->ffs_release_dev_callback) 4264 ffs_dev->ffs_release_dev_callback(ffs_dev); 4265 } 4266 4267 ffs_dev_unlock(); 4268 } 4269 4270 static int ffs_ready(struct ffs_data *ffs) 4271 { 4272 struct ffs_dev *ffs_obj; 4273 int ret = 0; 4274 4275 ffs_dev_lock(); 4276 4277 ffs_obj = ffs->private_data; 4278 if (!ffs_obj) { 4279 ret = -EINVAL; 4280 goto done; 4281 } 4282 if (WARN_ON(ffs_obj->desc_ready)) { 4283 ret = -EBUSY; 4284 goto done; 4285 } 4286 4287 ffs_obj->desc_ready = true; 4288 4289 if (ffs_obj->ffs_ready_callback) { 4290 ret = ffs_obj->ffs_ready_callback(ffs); 4291 if (ret) 4292 goto done; 4293 } 4294 4295 set_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags); 4296 done: 4297 ffs_dev_unlock(); 4298 return ret; 4299 } 4300 4301 static void ffs_closed(struct ffs_data *ffs) 4302 { 4303 struct ffs_dev *ffs_obj; 4304 struct f_fs_opts *opts; 4305 struct config_item *ci; 4306 4307 ffs_dev_lock(); 4308 4309 ffs_obj = ffs->private_data; 4310 if (!ffs_obj) 4311 goto done; 4312 4313 ffs_obj->desc_ready = false; 4314 4315 if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) && 4316 ffs_obj->ffs_closed_callback) 4317 ffs_obj->ffs_closed_callback(ffs); 4318 4319 if (ffs_obj->opts) 4320 opts = ffs_obj->opts; 4321 else 4322 goto done; 4323 4324 if (opts->no_configfs || !opts->func_inst.group.cg_item.ci_parent 4325 || !kref_read(&opts->func_inst.group.cg_item.ci_kref)) 4326 goto done; 4327 4328 ci = opts->func_inst.group.cg_item.ci_parent->ci_parent; 4329 ffs_dev_unlock(); 4330 4331 if (test_bit(FFS_FL_BOUND, &ffs->flags)) 4332 unregister_gadget_item(ci); 4333 return; 4334 done: 4335 ffs_dev_unlock(); 4336 } 4337 4338 /* Misc helper functions ****************************************************/ 4339 4340 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock) 4341 { 4342 return nonblock 4343 ? mutex_trylock(mutex) ? 0 : -EAGAIN 4344 : mutex_lock_interruptible(mutex); 4345 } 4346 4347 static char *ffs_prepare_buffer(const char __user *buf, size_t len) 4348 { 4349 char *data; 4350 4351 if (!len) 4352 return NULL; 4353 4354 data = memdup_user(buf, len); 4355 if (IS_ERR(data)) 4356 return data; 4357 4358 pr_vdebug("Buffer from user space:\n"); 4359 ffs_dump_mem("", data, len); 4360 4361 return data; 4362 } 4363 4364 DECLARE_USB_FUNCTION_INIT(ffs, ffs_alloc_inst, ffs_alloc); 4365 MODULE_DESCRIPTION("user mode file system API for USB composite function controllers"); 4366 MODULE_LICENSE("GPL"); 4367 MODULE_AUTHOR("Michal Nazarewicz"); 4368