?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
inet: frag: enforce memory limits earlier
[linux/fpc-iii.git] / drivers / usb / gadget / function / f_fs.c
blob04eb64381d92e7cd66c9235490549202c78779a4
1 /*
2 * f_fs.c -- user mode file system API for USB composite function controllers
3 *
4 * Copyright (C) 2010 Samsung Electronics
5 * Author: Michal Nazarewicz <mina86@mina86.com>
6 *
7 * Based on inode.c (GadgetFS) which was:
8 * Copyright (C) 2003-2004 David Brownell
9 * Copyright (C) 2003 Agilent Technologies
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
15 */
16
17
18 /* #define DEBUG */
19 /* #define VERBOSE_DEBUG */
20
21 #include <linux/blkdev.h>
22 #include <linux/pagemap.h>
23 #include <linux/export.h>
24 #include <linux/hid.h>
25 #include <linux/module.h>
26 #include <linux/uio.h>
27 #include <asm/unaligned.h>
28
29 #include <linux/usb/composite.h>
30 #include <linux/usb/functionfs.h>
31
32 #include <linux/aio.h>
33 #include <linux/mmu_context.h>
34 #include <linux/poll.h>
35 #include <linux/eventfd.h>
36
37 #include "u_fs.h"
38 #include "u_f.h"
39 #include "u_os_desc.h"
40 #include "configfs.h"
41
42 #define FUNCTIONFS_MAGIC 0xa647361 /* Chosen by a honest dice roll ;) */
43
44 /* Reference counter handling */
45 static void ffs_data_get(struct ffs_data *ffs);
46 static void ffs_data_put(struct ffs_data *ffs);
47 /* Creates new ffs_data object. */
48 static struct ffs_data *__must_check ffs_data_new(void) __attribute__((malloc));
49
50 /* Opened counter handling. */
51 static void ffs_data_opened(struct ffs_data *ffs);
52 static void ffs_data_closed(struct ffs_data *ffs);
53
54 /* Called with ffs->mutex held; take over ownership of data. */
55 static int __must_check
56 __ffs_data_got_descs(struct ffs_data *ffs, char *data, size_t len);
57 static int __must_check
58 __ffs_data_got_strings(struct ffs_data *ffs, char *data, size_t len);
59
60
61 /* The function structure ***************************************************/
62
63 struct ffs_ep;
64
65 struct ffs_function {
66 struct usb_configuration *conf;
67 struct usb_gadget *gadget;
68 struct ffs_data *ffs;
69
70 struct ffs_ep *eps;
71 u8 eps_revmap[16];
72 short *interfaces_nums;
73
74 struct usb_function function;
75 };
76
77
78 static struct ffs_function *ffs_func_from_usb(struct usb_function *f)
79 {
80 return container_of(f, struct ffs_function, function);
81 }
82
83
84 static inline enum ffs_setup_state
85 ffs_setup_state_clear_cancelled(struct ffs_data *ffs)
86 {
87 return (enum ffs_setup_state)
88 cmpxchg(&ffs->setup_state, FFS_SETUP_CANCELLED, FFS_NO_SETUP);
89 }
90
91
92 static void ffs_func_eps_disable(struct ffs_function *func);
93 static int __must_check ffs_func_eps_enable(struct ffs_function *func);
94
95 static int ffs_func_bind(struct usb_configuration *,
96 struct usb_function *);
97 static int ffs_func_set_alt(struct usb_function *, unsigned, unsigned);
98 static void ffs_func_disable(struct usb_function *);
99 static int ffs_func_setup(struct usb_function *,
100 const struct usb_ctrlrequest *);
101 static bool ffs_func_req_match(struct usb_function *,
102 const struct usb_ctrlrequest *,
103 bool config0);
104 static void ffs_func_suspend(struct usb_function *);
105 static void ffs_func_resume(struct usb_function *);
106
107
108 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num);
109 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf);
110
111
112 /* The endpoints structures *************************************************/
113
114 struct ffs_ep {
115 struct usb_ep *ep; /* P: ffs->eps_lock */
116 struct usb_request *req; /* P: epfile->mutex */
117
118 /* [0]: full speed, [1]: high speed, [2]: super speed */
119 struct usb_endpoint_descriptor *descs[3];
120
121 u8 num;
122
123 int status; /* P: epfile->mutex */
124 };
125
126 struct ffs_epfile {
127 /* Protects ep->ep and ep->req. */
128 struct mutex mutex;
129 wait_queue_head_t wait;
130
131 struct ffs_data *ffs;
132 struct ffs_ep *ep; /* P: ffs->eps_lock */
133
134 struct dentry *dentry;
135
136 /*
137 * Buffer for holding data from partial reads which may happen since
138 * we’re rounding user read requests to a multiple of a max packet size.
139 *
140 * The pointer is initialised with NULL value and may be set by
141 * __ffs_epfile_read_data function to point to a temporary buffer.
142 *
143 * In normal operation, calls to __ffs_epfile_read_buffered will consume
144 * data from said buffer and eventually free it. Importantly, while the
145 * function is using the buffer, it sets the pointer to NULL. This is
146 * all right since __ffs_epfile_read_data and __ffs_epfile_read_buffered
147 * can never run concurrently (they are synchronised by epfile->mutex)
148 * so the latter will not assign a new value to the pointer.
149 *
150 * Meanwhile ffs_func_eps_disable frees the buffer (if the pointer is
151 * valid) and sets the pointer to READ_BUFFER_DROP value. This special
152 * value is crux of the synchronisation between ffs_func_eps_disable and
153 * __ffs_epfile_read_data.
154 *
155 * Once __ffs_epfile_read_data is about to finish it will try to set the
156 * pointer back to its old value (as described above), but seeing as the
157 * pointer is not-NULL (namely READ_BUFFER_DROP) it will instead free
158 * the buffer.
159 *
160 * == State transitions ==
161 *
162 * • ptr == NULL: (initial state)
163 * ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP
164 * ◦ __ffs_epfile_read_buffered: nop
165 * ◦ __ffs_epfile_read_data allocates temp buffer: go to ptr == buf
166 * ◦ reading finishes: n/a, not in ‘and reading’ state
167 * • ptr == DROP:
168 * ◦ __ffs_epfile_read_buffer_free: nop
169 * ◦ __ffs_epfile_read_buffered: go to ptr == NULL
170 * ◦ __ffs_epfile_read_data allocates temp buffer: free buf, nop
171 * ◦ reading finishes: n/a, not in ‘and reading’ state
172 * • ptr == buf:
173 * ◦ __ffs_epfile_read_buffer_free: free buf, go to ptr == DROP
174 * ◦ __ffs_epfile_read_buffered: go to ptr == NULL and reading
175 * ◦ __ffs_epfile_read_data: n/a, __ffs_epfile_read_buffered
176 * is always called first
177 * ◦ reading finishes: n/a, not in ‘and reading’ state
178 * • ptr == NULL and reading:
179 * ◦ __ffs_epfile_read_buffer_free: go to ptr == DROP and reading
180 * ◦ __ffs_epfile_read_buffered: n/a, mutex is held
181 * ◦ __ffs_epfile_read_data: n/a, mutex is held
182 * ◦ reading finishes and …
183 * … all data read: free buf, go to ptr == NULL
184 * … otherwise: go to ptr == buf and reading
185 * • ptr == DROP and reading:
186 * ◦ __ffs_epfile_read_buffer_free: nop
187 * ◦ __ffs_epfile_read_buffered: n/a, mutex is held
188 * ◦ __ffs_epfile_read_data: n/a, mutex is held
189 * ◦ reading finishes: free buf, go to ptr == DROP
190 */
191 struct ffs_buffer *read_buffer;
192 #define READ_BUFFER_DROP ((struct ffs_buffer *)ERR_PTR(-ESHUTDOWN))
193
194 char name[5];
195
196 unsigned char in; /* P: ffs->eps_lock */
197 unsigned char isoc; /* P: ffs->eps_lock */
198
199 unsigned char _pad;
200 };
201
202 struct ffs_buffer {
203 size_t length;
204 char *data;
205 char storage[];
206 };
207
208 /* ffs_io_data structure ***************************************************/
209
210 struct ffs_io_data {
211 bool aio;
212 bool read;
213
214 struct kiocb *kiocb;
215 struct iov_iter data;
216 const void *to_free;
217 char *buf;
218
219 struct mm_struct *mm;
220 struct work_struct work;
221
222 struct usb_ep *ep;
223 struct usb_request *req;
224
225 struct ffs_data *ffs;
226 };
227
228 struct ffs_desc_helper {
229 struct ffs_data *ffs;
230 unsigned interfaces_count;
231 unsigned eps_count;
232 };
233
234 static int __must_check ffs_epfiles_create(struct ffs_data *ffs);
235 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count);
236
237 static struct dentry *
238 ffs_sb_create_file(struct super_block *sb, const char *name, void *data,
239 const struct file_operations *fops);
240
241 /* Devices management *******************************************************/
242
243 DEFINE_MUTEX(ffs_lock);
244 EXPORT_SYMBOL_GPL(ffs_lock);
245
246 static struct ffs_dev *_ffs_find_dev(const char *name);
247 static struct ffs_dev *_ffs_alloc_dev(void);
248 static int _ffs_name_dev(struct ffs_dev *dev, const char *name);
249 static void _ffs_free_dev(struct ffs_dev *dev);
250 static void *ffs_acquire_dev(const char *dev_name);
251 static void ffs_release_dev(struct ffs_data *ffs_data);
252 static int ffs_ready(struct ffs_data *ffs);
253 static void ffs_closed(struct ffs_data *ffs);
254
255 /* Misc helper functions ****************************************************/
256
257 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
258 __attribute__((warn_unused_result, nonnull));
259 static char *ffs_prepare_buffer(const char __user *buf, size_t len)
260 __attribute__((warn_unused_result, nonnull));
261
262
263 /* Control file aka ep0 *****************************************************/
264
265 static void ffs_ep0_complete(struct usb_ep *ep, struct usb_request *req)
266 {
267 struct ffs_data *ffs = req->context;
268
269 complete_all(&ffs->ep0req_completion);
270 }
271
272 static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)
273 {
274 struct usb_request *req = ffs->ep0req;
275 int ret;
276
277 req->zero = len < le16_to_cpu(ffs->ev.setup.wLength);
278
279 spin_unlock_irq(&ffs->ev.waitq.lock);
280
281 req->buf = data;
282 req->length = len;
283
284 /*
285 * UDC layer requires to provide a buffer even for ZLP, but should
286 * not use it at all. Let's provide some poisoned pointer to catch
287 * possible bug in the driver.
288 */
289 if (req->buf == NULL)
290 req->buf = (void *)0xDEADBABE;
291
292 reinit_completion(&ffs->ep0req_completion);
293
294 ret = usb_ep_queue(ffs->gadget->ep0, req, GFP_ATOMIC);
295 if (unlikely(ret < 0))
296 return ret;
297
298 ret = wait_for_completion_interruptible(&ffs->ep0req_completion);
299 if (unlikely(ret)) {
300 usb_ep_dequeue(ffs->gadget->ep0, req);
301 return -EINTR;
302 }
303
304 ffs->setup_state = FFS_NO_SETUP;
305 return req->status ? req->status : req->actual;
306 }
307
308 static int __ffs_ep0_stall(struct ffs_data *ffs)
309 {
310 if (ffs->ev.can_stall) {
311 pr_vdebug("ep0 stall\n");
312 usb_ep_set_halt(ffs->gadget->ep0);
313 ffs->setup_state = FFS_NO_SETUP;
314 return -EL2HLT;
315 } else {
316 pr_debug("bogus ep0 stall!\n");
317 return -ESRCH;
318 }
319 }
320
321 static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
322 size_t len, loff_t *ptr)
323 {
324 struct ffs_data *ffs = file->private_data;
325 ssize_t ret;
326 char *data;
327
328 ENTER();
329
330 /* Fast check if setup was canceled */
331 if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
332 return -EIDRM;
333
334 /* Acquire mutex */
335 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
336 if (unlikely(ret < 0))
337 return ret;
338
339 /* Check state */
340 switch (ffs->state) {
341 case FFS_READ_DESCRIPTORS:
342 case FFS_READ_STRINGS:
343 /* Copy data */
344 if (unlikely(len < 16)) {
345 ret = -EINVAL;
346 break;
347 }
348
349 data = ffs_prepare_buffer(buf, len);
350 if (IS_ERR(data)) {
351 ret = PTR_ERR(data);
352 break;
353 }
354
355 /* Handle data */
356 if (ffs->state == FFS_READ_DESCRIPTORS) {
357 pr_info("read descriptors\n");
358 ret = __ffs_data_got_descs(ffs, data, len);
359 if (unlikely(ret < 0))
360 break;
361
362 ffs->state = FFS_READ_STRINGS;
363 ret = len;
364 } else {
365 pr_info("read strings\n");
366 ret = __ffs_data_got_strings(ffs, data, len);
367 if (unlikely(ret < 0))
368 break;
369
370 ret = ffs_epfiles_create(ffs);
371 if (unlikely(ret)) {
372 ffs->state = FFS_CLOSING;
373 break;
374 }
375
376 ffs->state = FFS_ACTIVE;
377 mutex_unlock(&ffs->mutex);
378
379 ret = ffs_ready(ffs);
380 if (unlikely(ret < 0)) {
381 ffs->state = FFS_CLOSING;
382 return ret;
383 }
384
385 return len;
386 }
387 break;
388
389 case FFS_ACTIVE:
390 data = NULL;
391 /*
392 * We're called from user space, we can use _irq
393 * rather then _irqsave
394 */
395 spin_lock_irq(&ffs->ev.waitq.lock);
396 switch (ffs_setup_state_clear_cancelled(ffs)) {
397 case FFS_SETUP_CANCELLED:
398 ret = -EIDRM;
399 goto done_spin;
400
401 case FFS_NO_SETUP:
402 ret = -ESRCH;
403 goto done_spin;
404
405 case FFS_SETUP_PENDING:
406 break;
407 }
408
409 /* FFS_SETUP_PENDING */
410 if (!(ffs->ev.setup.bRequestType & USB_DIR_IN)) {
411 spin_unlock_irq(&ffs->ev.waitq.lock);
412 ret = __ffs_ep0_stall(ffs);
413 break;
414 }
415
416 /* FFS_SETUP_PENDING and not stall */
417 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength));
418
419 spin_unlock_irq(&ffs->ev.waitq.lock);
420
421 data = ffs_prepare_buffer(buf, len);
422 if (IS_ERR(data)) {
423 ret = PTR_ERR(data);
424 break;
425 }
426
427 spin_lock_irq(&ffs->ev.waitq.lock);
428
429 /*
430 * We are guaranteed to be still in FFS_ACTIVE state
431 * but the state of setup could have changed from
432 * FFS_SETUP_PENDING to FFS_SETUP_CANCELLED so we need
433 * to check for that. If that happened we copied data
434 * from user space in vain but it's unlikely.
435 *
436 * For sure we are not in FFS_NO_SETUP since this is
437 * the only place FFS_SETUP_PENDING -> FFS_NO_SETUP
438 * transition can be performed and it's protected by
439 * mutex.
440 */
441 if (ffs_setup_state_clear_cancelled(ffs) ==
442 FFS_SETUP_CANCELLED) {
443 ret = -EIDRM;
444 done_spin:
445 spin_unlock_irq(&ffs->ev.waitq.lock);
446 } else {
447 /* unlocks spinlock */
448 ret = __ffs_ep0_queue_wait(ffs, data, len);
449 }
450 kfree(data);
451 break;
452
453 default:
454 ret = -EBADFD;
455 break;
456 }
457
458 mutex_unlock(&ffs->mutex);
459 return ret;
460 }
461
462 /* Called with ffs->ev.waitq.lock and ffs->mutex held, both released on exit. */
463 static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
464 size_t n)
465 {
466 /*
467 * n cannot be bigger than ffs->ev.count, which cannot be bigger than
468 * size of ffs->ev.types array (which is four) so that's how much space
469 * we reserve.
470 */
471 struct usb_functionfs_event events[ARRAY_SIZE(ffs->ev.types)];
472 const size_t size = n * sizeof *events;
473 unsigned i = 0;
474
475 memset(events, 0, size);
476
477 do {
478 events[i].type = ffs->ev.types[i];
479 if (events[i].type == FUNCTIONFS_SETUP) {
480 events[i].u.setup = ffs->ev.setup;
481 ffs->setup_state = FFS_SETUP_PENDING;
482 }
483 } while (++i < n);
484
485 ffs->ev.count -= n;
486 if (ffs->ev.count)
487 memmove(ffs->ev.types, ffs->ev.types + n,
488 ffs->ev.count * sizeof *ffs->ev.types);
489
490 spin_unlock_irq(&ffs->ev.waitq.lock);
491 mutex_unlock(&ffs->mutex);
492
493 return unlikely(copy_to_user(buf, events, size)) ? -EFAULT : size;
494 }
495
496 static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
497 size_t len, loff_t *ptr)
498 {
499 struct ffs_data *ffs = file->private_data;
500 char *data = NULL;
501 size_t n;
502 int ret;
503
504 ENTER();
505
506 /* Fast check if setup was canceled */
507 if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
508 return -EIDRM;
509
510 /* Acquire mutex */
511 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
512 if (unlikely(ret < 0))
513 return ret;
514
515 /* Check state */
516 if (ffs->state != FFS_ACTIVE) {
517 ret = -EBADFD;
518 goto done_mutex;
519 }
520
521 /*
522 * We're called from user space, we can use _irq rather then
523 * _irqsave
524 */
525 spin_lock_irq(&ffs->ev.waitq.lock);
526
527 switch (ffs_setup_state_clear_cancelled(ffs)) {
528 case FFS_SETUP_CANCELLED:
529 ret = -EIDRM;
530 break;
531
532 case FFS_NO_SETUP:
533 n = len / sizeof(struct usb_functionfs_event);
534 if (unlikely(!n)) {
535 ret = -EINVAL;
536 break;
537 }
538
539 if ((file->f_flags & O_NONBLOCK) && !ffs->ev.count) {
540 ret = -EAGAIN;
541 break;
542 }
543
544 if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq,
545 ffs->ev.count)) {
546 ret = -EINTR;
547 break;
548 }
549
550 return __ffs_ep0_read_events(ffs, buf,
551 min(n, (size_t)ffs->ev.count));
552
553 case FFS_SETUP_PENDING:
554 if (ffs->ev.setup.bRequestType & USB_DIR_IN) {
555 spin_unlock_irq(&ffs->ev.waitq.lock);
556 ret = __ffs_ep0_stall(ffs);
557 goto done_mutex;
558 }
559
560 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength));
561
562 spin_unlock_irq(&ffs->ev.waitq.lock);
563
564 if (likely(len)) {
565 data = kmalloc(len, GFP_KERNEL);
566 if (unlikely(!data)) {
567 ret = -ENOMEM;
568 goto done_mutex;
569 }
570 }
571
572 spin_lock_irq(&ffs->ev.waitq.lock);
573
574 /* See ffs_ep0_write() */
575 if (ffs_setup_state_clear_cancelled(ffs) ==
576 FFS_SETUP_CANCELLED) {
577 ret = -EIDRM;
578 break;
579 }
580
581 /* unlocks spinlock */
582 ret = __ffs_ep0_queue_wait(ffs, data, len);
583 if (likely(ret > 0) && unlikely(copy_to_user(buf, data, len)))
584 ret = -EFAULT;
585 goto done_mutex;
586
587 default:
588 ret = -EBADFD;
589 break;
590 }
591
592 spin_unlock_irq(&ffs->ev.waitq.lock);
593 done_mutex:
594 mutex_unlock(&ffs->mutex);
595 kfree(data);
596 return ret;
597 }
598
599 static int ffs_ep0_open(struct inode *inode, struct file *file)
600 {
601 struct ffs_data *ffs = inode->i_private;
602
603 ENTER();
604
605 if (unlikely(ffs->state == FFS_CLOSING))
606 return -EBUSY;
607
608 file->private_data = ffs;
609 ffs_data_opened(ffs);
610
611 return 0;
612 }
613
614 static int ffs_ep0_release(struct inode *inode, struct file *file)
615 {
616 struct ffs_data *ffs = file->private_data;
617
618 ENTER();
619
620 ffs_data_closed(ffs);
621
622 return 0;
623 }
624
625 static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
626 {
627 struct ffs_data *ffs = file->private_data;
628 struct usb_gadget *gadget = ffs->gadget;
629 long ret;
630
631 ENTER();
632
633 if (code == FUNCTIONFS_INTERFACE_REVMAP) {
634 struct ffs_function *func = ffs->func;
635 ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV;
636 } else if (gadget && gadget->ops->ioctl) {
637 ret = gadget->ops->ioctl(gadget, code, value);
638 } else {
639 ret = -ENOTTY;
640 }
641
642 return ret;
643 }
644
645 static unsigned int ffs_ep0_poll(struct file *file, poll_table *wait)
646 {
647 struct ffs_data *ffs = file->private_data;
648 unsigned int mask = POLLWRNORM;
649 int ret;
650
651 poll_wait(file, &ffs->ev.waitq, wait);
652
653 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
654 if (unlikely(ret < 0))
655 return mask;
656
657 switch (ffs->state) {
658 case FFS_READ_DESCRIPTORS:
659 case FFS_READ_STRINGS:
660 mask |= POLLOUT;
661 break;
662
663 case FFS_ACTIVE:
664 switch (ffs->setup_state) {
665 case FFS_NO_SETUP:
666 if (ffs->ev.count)
667 mask |= POLLIN;
668 break;
669
670 case FFS_SETUP_PENDING:
671 case FFS_SETUP_CANCELLED:
672 mask |= (POLLIN | POLLOUT);
673 break;
674 }
675 case FFS_CLOSING:
676 break;
677 case FFS_DEACTIVATED:
678 break;
679 }
680
681 mutex_unlock(&ffs->mutex);
682
683 return mask;
684 }
685
686 static const struct file_operations ffs_ep0_operations = {
687 .llseek = no_llseek,
688
689 .open = ffs_ep0_open,
690 .write = ffs_ep0_write,
691 .read = ffs_ep0_read,
692 .release = ffs_ep0_release,
693 .unlocked_ioctl = ffs_ep0_ioctl,
694 .poll = ffs_ep0_poll,
695 };
696
697
698 /* "Normal" endpoints operations ********************************************/
699
700 static void ffs_epfile_io_complete(struct usb_ep *_ep, struct usb_request *req)
701 {
702 ENTER();
703 if (likely(req->context)) {
704 struct ffs_ep *ep = _ep->driver_data;
705 ep->status = req->status ? req->status : req->actual;
706 complete(req->context);
707 }
708 }
709
710 static ssize_t ffs_copy_to_iter(void *data, int data_len, struct iov_iter *iter)
711 {
712 ssize_t ret = copy_to_iter(data, data_len, iter);
713 if (likely(ret == data_len))
714 return ret;
715
716 if (unlikely(iov_iter_count(iter)))
717 return -EFAULT;
718
719 /*
720 * Dear user space developer!
721 *
722 * TL;DR: To stop getting below error message in your kernel log, change
723 * user space code using functionfs to align read buffers to a max
724 * packet size.
725 *
726 * Some UDCs (e.g. dwc3) require request sizes to be a multiple of a max
727 * packet size. When unaligned buffer is passed to functionfs, it
728 * internally uses a larger, aligned buffer so that such UDCs are happy.
729 *
730 * Unfortunately, this means that host may send more data than was
731 * requested in read(2) system call. f_fs doesn’t know what to do with
732 * that excess data so it simply drops it.
733 *
734 * Was the buffer aligned in the first place, no such problem would
735 * happen.
736 *
737 * Data may be dropped only in AIO reads. Synchronous reads are handled
738 * by splitting a request into multiple parts. This splitting may still
739 * be a problem though so it’s likely best to align the buffer
740 * regardless of it being AIO or not..
741 *
742 * This only affects OUT endpoints, i.e. reading data with a read(2),
743 * aio_read(2) etc. system calls. Writing data to an IN endpoint is not
744 * affected.
745 */
746 pr_err("functionfs read size %d > requested size %zd, dropping excess data. "
747 "Align read buffer size to max packet size to avoid the problem.\n",
748 data_len, ret);
749
750 return ret;
751 }
752
753 static void ffs_user_copy_worker(struct work_struct *work)
754 {
755 struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,
756 work);
757 int ret = io_data->req->status ? io_data->req->status :
758 io_data->req->actual;
759 bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD;
760
761 if (io_data->read && ret > 0) {
762 mm_segment_t oldfs = get_fs();
763
764 set_fs(USER_DS);
765 use_mm(io_data->mm);
766 ret = ffs_copy_to_iter(io_data->buf, ret, &io_data->data);
767 unuse_mm(io_data->mm);
768 set_fs(oldfs);
769 }
770
771 io_data->kiocb->ki_complete(io_data->kiocb, ret, ret);
772
773 if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd)
774 eventfd_signal(io_data->ffs->ffs_eventfd, 1);
775
776 usb_ep_free_request(io_data->ep, io_data->req);
777
778 if (io_data->read)
779 kfree(io_data->to_free);
780 kfree(io_data->buf);
781 kfree(io_data);
782 }
783
784 static void ffs_epfile_async_io_complete(struct usb_ep *_ep,
785 struct usb_request *req)
786 {
787 struct ffs_io_data *io_data = req->context;
788
789 ENTER();
790
791 INIT_WORK(&io_data->work, ffs_user_copy_worker);
792 schedule_work(&io_data->work);
793 }
794
795 static void __ffs_epfile_read_buffer_free(struct ffs_epfile *epfile)
796 {
797 /*
798 * See comment in struct ffs_epfile for full read_buffer pointer
799 * synchronisation story.
800 */
801 struct ffs_buffer *buf = xchg(&epfile->read_buffer, READ_BUFFER_DROP);
802 if (buf && buf != READ_BUFFER_DROP)
803 kfree(buf);
804 }
805
806 /* Assumes epfile->mutex is held. */
807 static ssize_t __ffs_epfile_read_buffered(struct ffs_epfile *epfile,
808 struct iov_iter *iter)
809 {
810 /*
811 * Null out epfile->read_buffer so ffs_func_eps_disable does not free
812 * the buffer while we are using it. See comment in struct ffs_epfile
813 * for full read_buffer pointer synchronisation story.
814 */
815 struct ffs_buffer *buf = xchg(&epfile->read_buffer, NULL);
816 ssize_t ret;
817 if (!buf || buf == READ_BUFFER_DROP)
818 return 0;
819
820 ret = copy_to_iter(buf->data, buf->length, iter);
821 if (buf->length == ret) {
822 kfree(buf);
823 return ret;
824 }
825
826 if (unlikely(iov_iter_count(iter))) {
827 ret = -EFAULT;
828 } else {
829 buf->length -= ret;
830 buf->data += ret;
831 }
832
833 if (cmpxchg(&epfile->read_buffer, NULL, buf))
834 kfree(buf);
835
836 return ret;
837 }
838
839 /* Assumes epfile->mutex is held. */
840 static ssize_t __ffs_epfile_read_data(struct ffs_epfile *epfile,
841 void *data, int data_len,
842 struct iov_iter *iter)
843 {
844 struct ffs_buffer *buf;
845
846 ssize_t ret = copy_to_iter(data, data_len, iter);
847 if (likely(data_len == ret))
848 return ret;
849
850 if (unlikely(iov_iter_count(iter)))
851 return -EFAULT;
852
853 /* See ffs_copy_to_iter for more context. */
854 pr_warn("functionfs read size %d > requested size %zd, splitting request into multiple reads.",
855 data_len, ret);
856
857 data_len -= ret;
858 buf = kmalloc(sizeof(*buf) + data_len, GFP_KERNEL);
859 if (!buf)
860 return -ENOMEM;
861 buf->length = data_len;
862 buf->data = buf->storage;
863 memcpy(buf->storage, data + ret, data_len);
864
865 /*
866 * At this point read_buffer is NULL or READ_BUFFER_DROP (if
867 * ffs_func_eps_disable has been called in the meanwhile). See comment
868 * in struct ffs_epfile for full read_buffer pointer synchronisation
869 * story.
870 */
871 if (unlikely(cmpxchg(&epfile->read_buffer, NULL, buf)))
872 kfree(buf);
873
874 return ret;
875 }
876
877 static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
878 {
879 struct ffs_epfile *epfile = file->private_data;
880 struct usb_request *req;
881 struct ffs_ep *ep;
882 char *data = NULL;
883 ssize_t ret, data_len = -EINVAL;
884 int halt;
885
886 /* Are we still active? */
887 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
888 return -ENODEV;
889
890 /* Wait for endpoint to be enabled */
891 ep = epfile->ep;
892 if (!ep) {
893 if (file->f_flags & O_NONBLOCK)
894 return -EAGAIN;
895
896 ret = wait_event_interruptible(epfile->wait, (ep = epfile->ep));
897 if (ret)
898 return -EINTR;
899 }
900
901 /* Do we halt? */
902 halt = (!io_data->read == !epfile->in);
903 if (halt && epfile->isoc)
904 return -EINVAL;
905
906 /* We will be using request and read_buffer */
907 ret = ffs_mutex_lock(&epfile->mutex, file->f_flags & O_NONBLOCK);
908 if (unlikely(ret))
909 goto error;
910
911 /* Allocate & copy */
912 if (!halt) {
913 struct usb_gadget *gadget;
914
915 /*
916 * Do we have buffered data from previous partial read? Check
917 * that for synchronous case only because we do not have
918 * facility to ‘wake up’ a pending asynchronous read and push
919 * buffered data to it which we would need to make things behave
920 * consistently.
921 */
922 if (!io_data->aio && io_data->read) {
923 ret = __ffs_epfile_read_buffered(epfile, &io_data->data);
924 if (ret)
925 goto error_mutex;
926 }
927
928 /*
929 * if we _do_ wait above, the epfile->ffs->gadget might be NULL
930 * before the waiting completes, so do not assign to 'gadget'
931 * earlier
932 */
933 gadget = epfile->ffs->gadget;
934
935 spin_lock_irq(&epfile->ffs->eps_lock);
936 /* In the meantime, endpoint got disabled or changed. */
937 if (epfile->ep != ep) {
938 ret = -ESHUTDOWN;
939 goto error_lock;
940 }
941 data_len = iov_iter_count(&io_data->data);
942 /*
943 * Controller may require buffer size to be aligned to
944 * maxpacketsize of an out endpoint.
945 */
946 if (io_data->read)
947 data_len = usb_ep_align_maybe(gadget, ep->ep, data_len);
948 spin_unlock_irq(&epfile->ffs->eps_lock);
949
950 data = kmalloc(data_len, GFP_KERNEL);
951 if (unlikely(!data)) {
952 ret = -ENOMEM;
953 goto error_mutex;
954 }
955 if (!io_data->read &&
956 copy_from_iter(data, data_len, &io_data->data) != data_len) {
957 ret = -EFAULT;
958 goto error_mutex;
959 }
960 }
961
962 spin_lock_irq(&epfile->ffs->eps_lock);
963
964 if (epfile->ep != ep) {
965 /* In the meantime, endpoint got disabled or changed. */
966 ret = -ESHUTDOWN;
967 } else if (halt) {
968 /* Halt */
969 if (likely(epfile->ep == ep) && !WARN_ON(!ep->ep))
970 usb_ep_set_halt(ep->ep);
971 ret = -EBADMSG;
972 } else if (unlikely(data_len == -EINVAL)) {
973 /*
974 * Sanity Check: even though data_len can't be used
975 * uninitialized at the time I write this comment, some
976 * compilers complain about this situation.
977 * In order to keep the code clean from warnings, data_len is
978 * being initialized to -EINVAL during its declaration, which
979 * means we can't rely on compiler anymore to warn no future
980 * changes won't result in data_len being used uninitialized.
981 * For such reason, we're adding this redundant sanity check
982 * here.
983 */
984 WARN(1, "%s: data_len == -EINVAL\n", __func__);
985 ret = -EINVAL;
986 } else if (!io_data->aio) {
987 DECLARE_COMPLETION_ONSTACK(done);
988 bool interrupted = false;
989
990 req = ep->req;
991 req->buf = data;
992 req->length = data_len;
993
994 req->context = &done;
995 req->complete = ffs_epfile_io_complete;
996
997 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
998 if (unlikely(ret < 0))
999 goto error_lock;
1000
1001 spin_unlock_irq(&epfile->ffs->eps_lock);
1002
1003 if (unlikely(wait_for_completion_interruptible(&done))) {
1004 /*
1005 * To avoid race condition with ffs_epfile_io_complete,
1006 * dequeue the request first then check
1007 * status. usb_ep_dequeue API should guarantee no race
1008 * condition with req->complete callback.
1009 */
1010 usb_ep_dequeue(ep->ep, req);
1011 interrupted = ep->status < 0;
1012 }
1013
1014 if (interrupted)
1015 ret = -EINTR;
1016 else if (io_data->read && ep->status > 0)
1017 ret = __ffs_epfile_read_data(epfile, data, ep->status,
1018 &io_data->data);
1019 else
1020 ret = ep->status;
1021 goto error_mutex;
1022 } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC))) {
1023 ret = -ENOMEM;
1024 } else {
1025 req->buf = data;
1026 req->length = data_len;
1027
1028 io_data->buf = data;
1029 io_data->ep = ep->ep;
1030 io_data->req = req;
1031 io_data->ffs = epfile->ffs;
1032
1033 req->context = io_data;
1034 req->complete = ffs_epfile_async_io_complete;
1035
1036 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
1037 if (unlikely(ret)) {
1038 usb_ep_free_request(ep->ep, req);
1039 goto error_lock;
1040 }
1041
1042 ret = -EIOCBQUEUED;
1043 /*
1044 * Do not kfree the buffer in this function. It will be freed
1045 * by ffs_user_copy_worker.
1046 */
1047 data = NULL;
1048 }
1049
1050 error_lock:
1051 spin_unlock_irq(&epfile->ffs->eps_lock);
1052 error_mutex:
1053 mutex_unlock(&epfile->mutex);
1054 error:
1055 kfree(data);
1056 return ret;
1057 }
1058
1059 static int
1060 ffs_epfile_open(struct inode *inode, struct file *file)
1061 {
1062 struct ffs_epfile *epfile = inode->i_private;
1063
1064 ENTER();
1065
1066 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
1067 return -ENODEV;
1068
1069 file->private_data = epfile;
1070 ffs_data_opened(epfile->ffs);
1071
1072 return 0;
1073 }
1074
1075 static int ffs_aio_cancel(struct kiocb *kiocb)
1076 {
1077 struct ffs_io_data *io_data = kiocb->private;
1078 struct ffs_epfile *epfile = kiocb->ki_filp->private_data;
1079 int value;
1080
1081 ENTER();
1082
1083 spin_lock_irq(&epfile->ffs->eps_lock);
1084
1085 if (likely(io_data && io_data->ep && io_data->req))
1086 value = usb_ep_dequeue(io_data->ep, io_data->req);
1087 else
1088 value = -EINVAL;
1089
1090 spin_unlock_irq(&epfile->ffs->eps_lock);
1091
1092 return value;
1093 }
1094
1095 static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
1096 {
1097 struct ffs_io_data io_data, *p = &io_data;
1098 ssize_t res;
1099
1100 ENTER();
1101
1102 if (!is_sync_kiocb(kiocb)) {
1103 p = kmalloc(sizeof(io_data), GFP_KERNEL);
1104 if (unlikely(!p))
1105 return -ENOMEM;
1106 p->aio = true;
1107 } else {
1108 p->aio = false;
1109 }
1110
1111 p->read = false;
1112 p->kiocb = kiocb;
1113 p->data = *from;
1114 p->mm = current->mm;
1115
1116 kiocb->private = p;
1117
1118 if (p->aio)
1119 kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
1120
1121 res = ffs_epfile_io(kiocb->ki_filp, p);
1122 if (res == -EIOCBQUEUED)
1123 return res;
1124 if (p->aio)
1125 kfree(p);
1126 else
1127 *from = p->data;
1128 return res;
1129 }
1130
1131 static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
1132 {
1133 struct ffs_io_data io_data, *p = &io_data;
1134 ssize_t res;
1135
1136 ENTER();
1137
1138 if (!is_sync_kiocb(kiocb)) {
1139 p = kmalloc(sizeof(io_data), GFP_KERNEL);
1140 if (unlikely(!p))
1141 return -ENOMEM;
1142 p->aio = true;
1143 } else {
1144 p->aio = false;
1145 }
1146
1147 p->read = true;
1148 p->kiocb = kiocb;
1149 if (p->aio) {
1150 p->to_free = dup_iter(&p->data, to, GFP_KERNEL);
1151 if (!p->to_free) {
1152 kfree(p);
1153 return -ENOMEM;
1154 }
1155 } else {
1156 p->data = *to;
1157 p->to_free = NULL;
1158 }
1159 p->mm = current->mm;
1160
1161 kiocb->private = p;
1162
1163 if (p->aio)
1164 kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
1165
1166 res = ffs_epfile_io(kiocb->ki_filp, p);
1167 if (res == -EIOCBQUEUED)
1168 return res;
1169
1170 if (p->aio) {
1171 kfree(p->to_free);
1172 kfree(p);
1173 } else {
1174 *to = p->data;
1175 }
1176 return res;
1177 }
1178
1179 static int
1180 ffs_epfile_release(struct inode *inode, struct file *file)
1181 {
1182 struct ffs_epfile *epfile = inode->i_private;
1183
1184 ENTER();
1185
1186 __ffs_epfile_read_buffer_free(epfile);
1187 ffs_data_closed(epfile->ffs);
1188
1189 return 0;
1190 }
1191
1192 static long ffs_epfile_ioctl(struct file *file, unsigned code,
1193 unsigned long value)
1194 {
1195 struct ffs_epfile *epfile = file->private_data;
1196 int ret;
1197
1198 ENTER();
1199
1200 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
1201 return -ENODEV;
1202
1203 spin_lock_irq(&epfile->ffs->eps_lock);
1204 if (likely(epfile->ep)) {
1205 switch (code) {
1206 case FUNCTIONFS_FIFO_STATUS:
1207 ret = usb_ep_fifo_status(epfile->ep->ep);
1208 break;
1209 case FUNCTIONFS_FIFO_FLUSH:
1210 usb_ep_fifo_flush(epfile->ep->ep);
1211 ret = 0;
1212 break;
1213 case FUNCTIONFS_CLEAR_HALT:
1214 ret = usb_ep_clear_halt(epfile->ep->ep);
1215 break;
1216 case FUNCTIONFS_ENDPOINT_REVMAP:
1217 ret = epfile->ep->num;
1218 break;
1219 case FUNCTIONFS_ENDPOINT_DESC:
1220 {
1221 int desc_idx;
1222 struct usb_endpoint_descriptor *desc;
1223
1224 switch (epfile->ffs->gadget->speed) {
1225 case USB_SPEED_SUPER:
1226 desc_idx = 2;
1227 break;
1228 case USB_SPEED_HIGH:
1229 desc_idx = 1;
1230 break;
1231 default:
1232 desc_idx = 0;
1233 }
1234 desc = epfile->ep->descs[desc_idx];
1235
1236 spin_unlock_irq(&epfile->ffs->eps_lock);
1237 ret = copy_to_user((void *)value, desc, sizeof(*desc));
1238 if (ret)
1239 ret = -EFAULT;
1240 return ret;
1241 }
1242 default:
1243 ret = -ENOTTY;
1244 }
1245 } else {
1246 ret = -ENODEV;
1247 }
1248 spin_unlock_irq(&epfile->ffs->eps_lock);
1249
1250 return ret;
1251 }
1252
1253 static const struct file_operations ffs_epfile_operations = {
1254 .llseek = no_llseek,
1255
1256 .open = ffs_epfile_open,
1257 .write_iter = ffs_epfile_write_iter,
1258 .read_iter = ffs_epfile_read_iter,
1259 .release = ffs_epfile_release,
1260 .unlocked_ioctl = ffs_epfile_ioctl,
1261 };
1262
1263
1264 /* File system and super block operations ***********************************/
1265
1266 /*
1267 * Mounting the file system creates a controller file, used first for
1268 * function configuration then later for event monitoring.
1269 */
1270
1271 static struct inode *__must_check
1272 ffs_sb_make_inode(struct super_block *sb, void *data,
1273 const struct file_operations *fops,
1274 const struct inode_operations *iops,
1275 struct ffs_file_perms *perms)
1276 {
1277 struct inode *inode;
1278
1279 ENTER();
1280
1281 inode = new_inode(sb);
1282
1283 if (likely(inode)) {
1284 struct timespec ts = current_time(inode);
1285
1286 inode->i_ino = get_next_ino();
1287 inode->i_mode = perms->mode;
1288 inode->i_uid = perms->uid;
1289 inode->i_gid = perms->gid;
1290 inode->i_atime = ts;
1291 inode->i_mtime = ts;
1292 inode->i_ctime = ts;
1293 inode->i_private = data;
1294 if (fops)
1295 inode->i_fop = fops;
1296 if (iops)
1297 inode->i_op = iops;
1298 }
1299
1300 return inode;
1301 }
1302
1303 /* Create "regular" file */
1304 static struct dentry *ffs_sb_create_file(struct super_block *sb,
1305 const char *name, void *data,
1306 const struct file_operations *fops)
1307 {
1308 struct ffs_data *ffs = sb->s_fs_info;
1309 struct dentry *dentry;
1310 struct inode *inode;
1311
1312 ENTER();
1313
1314 dentry = d_alloc_name(sb->s_root, name);
1315 if (unlikely(!dentry))
1316 return NULL;
1317
1318 inode = ffs_sb_make_inode(sb, data, fops, NULL, &ffs->file_perms);
1319 if (unlikely(!inode)) {
1320 dput(dentry);
1321 return NULL;
1322 }
1323
1324 d_add(dentry, inode);
1325 return dentry;
1326 }
1327
1328 /* Super block */
1329 static const struct super_operations ffs_sb_operations = {
1330 .statfs = simple_statfs,
1331 .drop_inode = generic_delete_inode,
1332 };
1333
1334 struct ffs_sb_fill_data {
1335 struct ffs_file_perms perms;
1336 umode_t root_mode;
1337 const char *dev_name;
1338 bool no_disconnect;
1339 struct ffs_data *ffs_data;
1340 };
1341
1342 static int ffs_sb_fill(struct super_block *sb, void *_data, int silent)
1343 {
1344 struct ffs_sb_fill_data *data = _data;
1345 struct inode *inode;
1346 struct ffs_data *ffs = data->ffs_data;
1347
1348 ENTER();
1349
1350 ffs->sb = sb;
1351 data->ffs_data = NULL;
1352 sb->s_fs_info = ffs;
1353 sb->s_blocksize = PAGE_SIZE;
1354 sb->s_blocksize_bits = PAGE_SHIFT;
1355 sb->s_magic = FUNCTIONFS_MAGIC;
1356 sb->s_op = &ffs_sb_operations;
1357 sb->s_time_gran = 1;
1358
1359 /* Root inode */
1360 data->perms.mode = data->root_mode;
1361 inode = ffs_sb_make_inode(sb, NULL,
1362 &simple_dir_operations,
1363 &simple_dir_inode_operations,
1364 &data->perms);
1365 sb->s_root = d_make_root(inode);
1366 if (unlikely(!sb->s_root))
1367 return -ENOMEM;
1368
1369 /* EP0 file */
1370 if (unlikely(!ffs_sb_create_file(sb, "ep0", ffs,
1371 &ffs_ep0_operations)))
1372 return -ENOMEM;
1373
1374 return 0;
1375 }
1376
1377 static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
1378 {
1379 ENTER();
1380
1381 if (!opts || !*opts)
1382 return 0;
1383
1384 for (;;) {
1385 unsigned long value;
1386 char *eq, *comma;
1387
1388 /* Option limit */
1389 comma = strchr(opts, ',');
1390 if (comma)
1391 *comma = 0;
1392
1393 /* Value limit */
1394 eq = strchr(opts, '=');
1395 if (unlikely(!eq)) {
1396 pr_err("'=' missing in %s\n", opts);
1397 return -EINVAL;
1398 }
1399 *eq = 0;
1400
1401 /* Parse value */
1402 if (kstrtoul(eq + 1, 0, &value)) {
1403 pr_err("%s: invalid value: %s\n", opts, eq + 1);
1404 return -EINVAL;
1405 }
1406
1407 /* Interpret option */
1408 switch (eq - opts) {
1409 case 13:
1410 if (!memcmp(opts, "no_disconnect", 13))
1411 data->no_disconnect = !!value;
1412 else
1413 goto invalid;
1414 break;
1415 case 5:
1416 if (!memcmp(opts, "rmode", 5))
1417 data->root_mode = (value & 0555) | S_IFDIR;
1418 else if (!memcmp(opts, "fmode", 5))
1419 data->perms.mode = (value & 0666) | S_IFREG;
1420 else
1421 goto invalid;
1422 break;
1423
1424 case 4:
1425 if (!memcmp(opts, "mode", 4)) {
1426 data->root_mode = (value & 0555) | S_IFDIR;
1427 data->perms.mode = (value & 0666) | S_IFREG;
1428 } else {
1429 goto invalid;
1430 }
1431 break;
1432
1433 case 3:
1434 if (!memcmp(opts, "uid", 3)) {
1435 data->perms.uid = make_kuid(current_user_ns(), value);
1436 if (!uid_valid(data->perms.uid)) {
1437 pr_err("%s: unmapped value: %lu\n", opts, value);
1438 return -EINVAL;
1439 }
1440 } else if (!memcmp(opts, "gid", 3)) {
1441 data->perms.gid = make_kgid(current_user_ns(), value);
1442 if (!gid_valid(data->perms.gid)) {
1443 pr_err("%s: unmapped value: %lu\n", opts, value);
1444 return -EINVAL;
1445 }
1446 } else {
1447 goto invalid;
1448 }
1449 break;
1450
1451 default:
1452 invalid:
1453 pr_err("%s: invalid option\n", opts);
1454 return -EINVAL;
1455 }
1456
1457 /* Next iteration */
1458 if (!comma)
1459 break;
1460 opts = comma + 1;
1461 }
1462
1463 return 0;
1464 }
1465
1466 /* "mount -t functionfs dev_name /dev/function" ends up here */
1467
1468 static struct dentry *
1469 ffs_fs_mount(struct file_system_type *t, int flags,
1470 const char *dev_name, void *opts)
1471 {
1472 struct ffs_sb_fill_data data = {
1473 .perms = {
1474 .mode = S_IFREG | 0600,
1475 .uid = GLOBAL_ROOT_UID,
1476 .gid = GLOBAL_ROOT_GID,
1477 },
1478 .root_mode = S_IFDIR | 0500,
1479 .no_disconnect = false,
1480 };
1481 struct dentry *rv;
1482 int ret;
1483 void *ffs_dev;
1484 struct ffs_data *ffs;
1485
1486 ENTER();
1487
1488 ret = ffs_fs_parse_opts(&data, opts);
1489 if (unlikely(ret < 0))
1490 return ERR_PTR(ret);
1491
1492 ffs = ffs_data_new();
1493 if (unlikely(!ffs))
1494 return ERR_PTR(-ENOMEM);
1495 ffs->file_perms = data.perms;
1496 ffs->no_disconnect = data.no_disconnect;
1497
1498 ffs->dev_name = kstrdup(dev_name, GFP_KERNEL);
1499 if (unlikely(!ffs->dev_name)) {
1500 ffs_data_put(ffs);
1501 return ERR_PTR(-ENOMEM);
1502 }
1503
1504 ffs_dev = ffs_acquire_dev(dev_name);
1505 if (IS_ERR(ffs_dev)) {
1506 ffs_data_put(ffs);
1507 return ERR_CAST(ffs_dev);
1508 }
1509 ffs->private_data = ffs_dev;
1510 data.ffs_data = ffs;
1511
1512 rv = mount_nodev(t, flags, &data, ffs_sb_fill);
1513 if (IS_ERR(rv) && data.ffs_data) {
1514 ffs_release_dev(data.ffs_data);
1515 ffs_data_put(data.ffs_data);
1516 }
1517 return rv;
1518 }
1519
1520 static void
1521 ffs_fs_kill_sb(struct super_block *sb)
1522 {
1523 ENTER();
1524
1525 kill_litter_super(sb);
1526 if (sb->s_fs_info) {
1527 ffs_release_dev(sb->s_fs_info);
1528 ffs_data_closed(sb->s_fs_info);
1529 }
1530 }
1531
1532 static struct file_system_type ffs_fs_type = {
1533 .owner = THIS_MODULE,
1534 .name = "functionfs",
1535 .mount = ffs_fs_mount,
1536 .kill_sb = ffs_fs_kill_sb,
1537 };
1538 MODULE_ALIAS_FS("functionfs");
1539
1540
1541 /* Driver's main init/cleanup functions *************************************/
1542
1543 static int functionfs_init(void)
1544 {
1545 int ret;
1546
1547 ENTER();
1548
1549 ret = register_filesystem(&ffs_fs_type);
1550 if (likely(!ret))
1551 pr_info("file system registered\n");
1552 else
1553 pr_err("failed registering file system (%d)\n", ret);
1554
1555 return ret;
1556 }
1557
1558 static void functionfs_cleanup(void)
1559 {
1560 ENTER();
1561
1562 pr_info("unloading\n");
1563 unregister_filesystem(&ffs_fs_type);
1564 }
1565
1566
1567 /* ffs_data and ffs_function construction and destruction code **************/
1568
1569 static void ffs_data_clear(struct ffs_data *ffs);
1570 static void ffs_data_reset(struct ffs_data *ffs);
1571
1572 static void ffs_data_get(struct ffs_data *ffs)
1573 {
1574 ENTER();
1575
1576 atomic_inc(&ffs->ref);
1577 }
1578
1579 static void ffs_data_opened(struct ffs_data *ffs)
1580 {
1581 ENTER();
1582
1583 atomic_inc(&ffs->ref);
1584 if (atomic_add_return(1, &ffs->opened) == 1 &&
1585 ffs->state == FFS_DEACTIVATED) {
1586 ffs->state = FFS_CLOSING;
1587 ffs_data_reset(ffs);
1588 }
1589 }
1590
1591 static void ffs_data_put(struct ffs_data *ffs)
1592 {
1593 ENTER();
1594
1595 if (unlikely(atomic_dec_and_test(&ffs->ref))) {
1596 pr_info("%s(): freeing\n", __func__);
1597 ffs_data_clear(ffs);
1598 BUG_ON(waitqueue_active(&ffs->ev.waitq) ||
1599 waitqueue_active(&ffs->ep0req_completion.wait));
1600 kfree(ffs->dev_name);
1601 kfree(ffs);
1602 }
1603 }
1604
1605 static void ffs_data_closed(struct ffs_data *ffs)
1606 {
1607 ENTER();
1608
1609 if (atomic_dec_and_test(&ffs->opened)) {
1610 if (ffs->no_disconnect) {
1611 ffs->state = FFS_DEACTIVATED;
1612 if (ffs->epfiles) {
1613 ffs_epfiles_destroy(ffs->epfiles,
1614 ffs->eps_count);
1615 ffs->epfiles = NULL;
1616 }
1617 if (ffs->setup_state == FFS_SETUP_PENDING)
1618 __ffs_ep0_stall(ffs);
1619 } else {
1620 ffs->state = FFS_CLOSING;
1621 ffs_data_reset(ffs);
1622 }
1623 }
1624 if (atomic_read(&ffs->opened) < 0) {
1625 ffs->state = FFS_CLOSING;
1626 ffs_data_reset(ffs);
1627 }
1628
1629 ffs_data_put(ffs);
1630 }
1631
1632 static struct ffs_data *ffs_data_new(void)
1633 {
1634 struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
1635 if (unlikely(!ffs))
1636 return NULL;
1637
1638 ENTER();
1639
1640 atomic_set(&ffs->ref, 1);
1641 atomic_set(&ffs->opened, 0);
1642 ffs->state = FFS_READ_DESCRIPTORS;
1643 mutex_init(&ffs->mutex);
1644 spin_lock_init(&ffs->eps_lock);
1645 init_waitqueue_head(&ffs->ev.waitq);
1646 init_completion(&ffs->ep0req_completion);
1647
1648 /* XXX REVISIT need to update it in some places, or do we? */
1649 ffs->ev.can_stall = 1;
1650
1651 return ffs;
1652 }
1653
1654 static void ffs_data_clear(struct ffs_data *ffs)
1655 {
1656 ENTER();
1657
1658 ffs_closed(ffs);
1659
1660 BUG_ON(ffs->gadget);
1661
1662 if (ffs->epfiles)
1663 ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count);
1664
1665 if (ffs->ffs_eventfd)
1666 eventfd_ctx_put(ffs->ffs_eventfd);
1667
1668 kfree(ffs->raw_descs_data);
1669 kfree(ffs->raw_strings);
1670 kfree(ffs->stringtabs);
1671 }
1672
1673 static void ffs_data_reset(struct ffs_data *ffs)
1674 {
1675 ENTER();
1676
1677 ffs_data_clear(ffs);
1678
1679 ffs->epfiles = NULL;
1680 ffs->raw_descs_data = NULL;
1681 ffs->raw_descs = NULL;
1682 ffs->raw_strings = NULL;
1683 ffs->stringtabs = NULL;
1684
1685 ffs->raw_descs_length = 0;
1686 ffs->fs_descs_count = 0;
1687 ffs->hs_descs_count = 0;
1688 ffs->ss_descs_count = 0;
1689
1690 ffs->strings_count = 0;
1691 ffs->interfaces_count = 0;
1692 ffs->eps_count = 0;
1693
1694 ffs->ev.count = 0;
1695
1696 ffs->state = FFS_READ_DESCRIPTORS;
1697 ffs->setup_state = FFS_NO_SETUP;
1698 ffs->flags = 0;
1699 }
1700
1701
1702 static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
1703 {
1704 struct usb_gadget_strings **lang;
1705 int first_id;
1706
1707 ENTER();
1708
1709 if (WARN_ON(ffs->state != FFS_ACTIVE
1710 || test_and_set_bit(FFS_FL_BOUND, &ffs->flags)))
1711 return -EBADFD;
1712
1713 first_id = usb_string_ids_n(cdev, ffs->strings_count);
1714 if (unlikely(first_id < 0))
1715 return first_id;
1716
1717 ffs->ep0req = usb_ep_alloc_request(cdev->gadget->ep0, GFP_KERNEL);
1718 if (unlikely(!ffs->ep0req))
1719 return -ENOMEM;
1720 ffs->ep0req->complete = ffs_ep0_complete;
1721 ffs->ep0req->context = ffs;
1722
1723 lang = ffs->stringtabs;
1724 if (lang) {
1725 for (; *lang; ++lang) {
1726 struct usb_string *str = (*lang)->strings;
1727 int id = first_id;
1728 for (; str->s; ++id, ++str)
1729 str->id = id;
1730 }
1731 }
1732
1733 ffs->gadget = cdev->gadget;
1734 ffs_data_get(ffs);
1735 return 0;
1736 }
1737
1738 static void functionfs_unbind(struct ffs_data *ffs)
1739 {
1740 ENTER();
1741
1742 if (!WARN_ON(!ffs->gadget)) {
1743 usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req);
1744 ffs->ep0req = NULL;
1745 ffs->gadget = NULL;
1746 clear_bit(FFS_FL_BOUND, &ffs->flags);
1747 ffs_data_put(ffs);
1748 }
1749 }
1750
1751 static int ffs_epfiles_create(struct ffs_data *ffs)
1752 {
1753 struct ffs_epfile *epfile, *epfiles;
1754 unsigned i, count;
1755
1756 ENTER();
1757
1758 count = ffs->eps_count;
1759 epfiles = kcalloc(count, sizeof(*epfiles), GFP_KERNEL);
1760 if (!epfiles)
1761 return -ENOMEM;
1762
1763 epfile = epfiles;
1764 for (i = 1; i <= count; ++i, ++epfile) {
1765 epfile->ffs = ffs;
1766 mutex_init(&epfile->mutex);
1767 init_waitqueue_head(&epfile->wait);
1768 if (ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
1769 sprintf(epfile->name, "ep%02x", ffs->eps_addrmap[i]);
1770 else
1771 sprintf(epfile->name, "ep%u", i);
1772 epfile->dentry = ffs_sb_create_file(ffs->sb, epfile->name,
1773 epfile,
1774 &ffs_epfile_operations);
1775 if (unlikely(!epfile->dentry)) {
1776 ffs_epfiles_destroy(epfiles, i - 1);
1777 return -ENOMEM;
1778 }
1779 }
1780
1781 ffs->epfiles = epfiles;
1782 return 0;
1783 }
1784
1785 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count)
1786 {
1787 struct ffs_epfile *epfile = epfiles;
1788
1789 ENTER();
1790
1791 for (; count; --count, ++epfile) {
1792 BUG_ON(mutex_is_locked(&epfile->mutex) ||
1793 waitqueue_active(&epfile->wait));
1794 if (epfile->dentry) {
1795 d_delete(epfile->dentry);
1796 dput(epfile->dentry);
1797 epfile->dentry = NULL;
1798 }
1799 }
1800
1801 kfree(epfiles);
1802 }
1803
1804 static void ffs_func_eps_disable(struct ffs_function *func)
1805 {
1806 struct ffs_ep *ep = func->eps;
1807 struct ffs_epfile *epfile = func->ffs->epfiles;
1808 unsigned count = func->ffs->eps_count;
1809 unsigned long flags;
1810
1811 spin_lock_irqsave(&func->ffs->eps_lock, flags);
1812 do {
1813 /* pending requests get nuked */
1814 if (likely(ep->ep))
1815 usb_ep_disable(ep->ep);
1816 ++ep;
1817
1818 if (epfile) {
1819 epfile->ep = NULL;
1820 __ffs_epfile_read_buffer_free(epfile);
1821 ++epfile;
1822 }
1823 } while (--count);
1824 spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
1825 }
1826
1827 static int ffs_func_eps_enable(struct ffs_function *func)
1828 {
1829 struct ffs_data *ffs = func->ffs;
1830 struct ffs_ep *ep = func->eps;
1831 struct ffs_epfile *epfile = ffs->epfiles;
1832 unsigned count = ffs->eps_count;
1833 unsigned long flags;
1834 int ret = 0;
1835
1836 spin_lock_irqsave(&func->ffs->eps_lock, flags);
1837 do {
1838 struct usb_endpoint_descriptor *ds;
1839 struct usb_ss_ep_comp_descriptor *comp_desc = NULL;
1840 int needs_comp_desc = false;
1841 int desc_idx;
1842
1843 if (ffs->gadget->speed == USB_SPEED_SUPER) {
1844 desc_idx = 2;
1845 needs_comp_desc = true;
1846 } else if (ffs->gadget->speed == USB_SPEED_HIGH)
1847 desc_idx = 1;
1848 else
1849 desc_idx = 0;
1850
1851 /* fall-back to lower speed if desc missing for current speed */
1852 do {
1853 ds = ep->descs[desc_idx];
1854 } while (!ds && --desc_idx >= 0);
1855
1856 if (!ds) {
1857 ret = -EINVAL;
1858 break;
1859 }
1860
1861 ep->ep->driver_data = ep;
1862 ep->ep->desc = ds;
1863
1864 if (needs_comp_desc) {
1865 comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
1866 USB_DT_ENDPOINT_SIZE);
1867 ep->ep->maxburst = comp_desc->bMaxBurst + 1;
1868 ep->ep->comp_desc = comp_desc;
1869 }
1870
1871 ret = usb_ep_enable(ep->ep);
1872 if (likely(!ret)) {
1873 epfile->ep = ep;
1874 epfile->in = usb_endpoint_dir_in(ds);
1875 epfile->isoc = usb_endpoint_xfer_isoc(ds);
1876 } else {
1877 break;
1878 }
1879
1880 wake_up(&epfile->wait);
1881
1882 ++ep;
1883 ++epfile;
1884 } while (--count);
1885 spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
1886
1887 return ret;
1888 }
1889
1890
1891 /* Parsing and building descriptors and strings *****************************/
1892
1893 /*
1894 * This validates if data pointed by data is a valid USB descriptor as
1895 * well as record how many interfaces, endpoints and strings are
1896 * required by given configuration. Returns address after the
1897 * descriptor or NULL if data is invalid.
1898 */
1899
1900 enum ffs_entity_type {
1901 FFS_DESCRIPTOR, FFS_INTERFACE, FFS_STRING, FFS_ENDPOINT
1902 };
1903
1904 enum ffs_os_desc_type {
1905 FFS_OS_DESC, FFS_OS_DESC_EXT_COMPAT, FFS_OS_DESC_EXT_PROP
1906 };
1907
1908 typedef int (*ffs_entity_callback)(enum ffs_entity_type entity,
1909 u8 *valuep,
1910 struct usb_descriptor_header *desc,
1911 void *priv);
1912
1913 typedef int (*ffs_os_desc_callback)(enum ffs_os_desc_type entity,
1914 struct usb_os_desc_header *h, void *data,
1915 unsigned len, void *priv);
1916
1917 static int __must_check ffs_do_single_desc(char *data, unsigned len,
1918 ffs_entity_callback entity,
1919 void *priv)
1920 {
1921 struct usb_descriptor_header *_ds = (void *)data;
1922 u8 length;
1923 int ret;
1924
1925 ENTER();
1926
1927 /* At least two bytes are required: length and type */
1928 if (len < 2) {
1929 pr_vdebug("descriptor too short\n");
1930 return -EINVAL;
1931 }
1932
1933 /* If we have at least as many bytes as the descriptor takes? */
1934 length = _ds->bLength;
1935 if (len < length) {
1936 pr_vdebug("descriptor longer then available data\n");
1937 return -EINVAL;
1938 }
1939
1940 #define __entity_check_INTERFACE(val) 1
1941 #define __entity_check_STRING(val) (val)
1942 #define __entity_check_ENDPOINT(val) ((val) & USB_ENDPOINT_NUMBER_MASK)
1943 #define __entity(type, val) do { \
1944 pr_vdebug("entity " #type "(%02x)\n", (val)); \
1945 if (unlikely(!__entity_check_ ##type(val))) { \
1946 pr_vdebug("invalid entity's value\n"); \
1947 return -EINVAL; \
1948 } \
1949 ret = entity(FFS_ ##type, &val, _ds, priv); \
1950 if (unlikely(ret < 0)) { \
1951 pr_debug("entity " #type "(%02x); ret = %d\n", \
1952 (val), ret); \
1953 return ret; \
1954 } \
1955 } while (0)
1956
1957 /* Parse descriptor depending on type. */
1958 switch (_ds->bDescriptorType) {
1959 case USB_DT_DEVICE:
1960 case USB_DT_CONFIG:
1961 case USB_DT_STRING:
1962 case USB_DT_DEVICE_QUALIFIER:
1963 /* function can't have any of those */
1964 pr_vdebug("descriptor reserved for gadget: %d\n",
1965 _ds->bDescriptorType);
1966 return -EINVAL;
1967
1968 case USB_DT_INTERFACE: {
1969 struct usb_interface_descriptor *ds = (void *)_ds;
1970 pr_vdebug("interface descriptor\n");
1971 if (length != sizeof *ds)
1972 goto inv_length;
1973
1974 __entity(INTERFACE, ds->bInterfaceNumber);
1975 if (ds->iInterface)
1976 __entity(STRING, ds->iInterface);
1977 }
1978 break;
1979
1980 case USB_DT_ENDPOINT: {
1981 struct usb_endpoint_descriptor *ds = (void *)_ds;
1982 pr_vdebug("endpoint descriptor\n");
1983 if (length != USB_DT_ENDPOINT_SIZE &&
1984 length != USB_DT_ENDPOINT_AUDIO_SIZE)
1985 goto inv_length;
1986 __entity(ENDPOINT, ds->bEndpointAddress);
1987 }
1988 break;
1989
1990 case HID_DT_HID:
1991 pr_vdebug("hid descriptor\n");
1992 if (length != sizeof(struct hid_descriptor))
1993 goto inv_length;
1994 break;
1995
1996 case USB_DT_OTG:
1997 if (length != sizeof(struct usb_otg_descriptor))
1998 goto inv_length;
1999 break;
2000
2001 case USB_DT_INTERFACE_ASSOCIATION: {
2002 struct usb_interface_assoc_descriptor *ds = (void *)_ds;
2003 pr_vdebug("interface association descriptor\n");
2004 if (length != sizeof *ds)
2005 goto inv_length;
2006 if (ds->iFunction)
2007 __entity(STRING, ds->iFunction);
2008 }
2009 break;
2010
2011 case USB_DT_SS_ENDPOINT_COMP:
2012 pr_vdebug("EP SS companion descriptor\n");
2013 if (length != sizeof(struct usb_ss_ep_comp_descriptor))
2014 goto inv_length;
2015 break;
2016
2017 case USB_DT_OTHER_SPEED_CONFIG:
2018 case USB_DT_INTERFACE_POWER:
2019 case USB_DT_DEBUG:
2020 case USB_DT_SECURITY:
2021 case USB_DT_CS_RADIO_CONTROL:
2022 /* TODO */
2023 pr_vdebug("unimplemented descriptor: %d\n", _ds->bDescriptorType);
2024 return -EINVAL;
2025
2026 default:
2027 /* We should never be here */
2028 pr_vdebug("unknown descriptor: %d\n", _ds->bDescriptorType);
2029 return -EINVAL;
2030
2031 inv_length:
2032 pr_vdebug("invalid length: %d (descriptor %d)\n",
2033 _ds->bLength, _ds->bDescriptorType);
2034 return -EINVAL;
2035 }
2036
2037 #undef __entity
2038 #undef __entity_check_DESCRIPTOR
2039 #undef __entity_check_INTERFACE
2040 #undef __entity_check_STRING
2041 #undef __entity_check_ENDPOINT
2042
2043 return length;
2044 }
2045
2046 static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len,
2047 ffs_entity_callback entity, void *priv)
2048 {
2049 const unsigned _len = len;
2050 unsigned long num = 0;
2051
2052 ENTER();
2053
2054 for (;;) {
2055 int ret;
2056
2057 if (num == count)
2058 data = NULL;
2059
2060 /* Record "descriptor" entity */
2061 ret = entity(FFS_DESCRIPTOR, (u8 *)num, (void *)data, priv);
2062 if (unlikely(ret < 0)) {
2063 pr_debug("entity DESCRIPTOR(%02lx); ret = %d\n",
2064 num, ret);
2065 return ret;
2066 }
2067
2068 if (!data)
2069 return _len - len;
2070
2071 ret = ffs_do_single_desc(data, len, entity, priv);
2072 if (unlikely(ret < 0)) {
2073 pr_debug("%s returns %d\n", __func__, ret);
2074 return ret;
2075 }
2076
2077 len -= ret;
2078 data += ret;
2079 ++num;
2080 }
2081 }
2082
2083 static int __ffs_data_do_entity(enum ffs_entity_type type,
2084 u8 *valuep, struct usb_descriptor_header *desc,
2085 void *priv)
2086 {
2087 struct ffs_desc_helper *helper = priv;
2088 struct usb_endpoint_descriptor *d;
2089
2090 ENTER();
2091
2092 switch (type) {
2093 case FFS_DESCRIPTOR:
2094 break;
2095
2096 case FFS_INTERFACE:
2097 /*
2098 * Interfaces are indexed from zero so if we
2099 * encountered interface "n" then there are at least
2100 * "n+1" interfaces.
2101 */
2102 if (*valuep >= helper->interfaces_count)
2103 helper->interfaces_count = *valuep + 1;
2104 break;
2105
2106 case FFS_STRING:
2107 /*
2108 * Strings are indexed from 1 (0 is magic ;) reserved
2109 * for languages list or some such)
2110 */
2111 if (*valuep > helper->ffs->strings_count)
2112 helper->ffs->strings_count = *valuep;
2113 break;
2114
2115 case FFS_ENDPOINT:
2116 d = (void *)desc;
2117 helper->eps_count++;
2118 if (helper->eps_count >= 15)
2119 return -EINVAL;
2120 /* Check if descriptors for any speed were already parsed */
2121 if (!helper->ffs->eps_count && !helper->ffs->interfaces_count)
2122 helper->ffs->eps_addrmap[helper->eps_count] =
2123 d->bEndpointAddress;
2124 else if (helper->ffs->eps_addrmap[helper->eps_count] !=
2125 d->bEndpointAddress)
2126 return -EINVAL;
2127 break;
2128 }
2129
2130 return 0;
2131 }
2132
2133 static int __ffs_do_os_desc_header(enum ffs_os_desc_type *next_type,
2134 struct usb_os_desc_header *desc)
2135 {
2136 u16 bcd_version = le16_to_cpu(desc->bcdVersion);
2137 u16 w_index = le16_to_cpu(desc->wIndex);
2138
2139 if (bcd_version != 1) {
2140 pr_vdebug("unsupported os descriptors version: %d",
2141 bcd_version);
2142 return -EINVAL;
2143 }
2144 switch (w_index) {
2145 case 0x4:
2146 *next_type = FFS_OS_DESC_EXT_COMPAT;
2147 break;
2148 case 0x5:
2149 *next_type = FFS_OS_DESC_EXT_PROP;
2150 break;
2151 default:
2152 pr_vdebug("unsupported os descriptor type: %d", w_index);
2153 return -EINVAL;
2154 }
2155
2156 return sizeof(*desc);
2157 }
2158
2159 /*
2160 * Process all extended compatibility/extended property descriptors
2161 * of a feature descriptor
2162 */
2163 static int __must_check ffs_do_single_os_desc(char *data, unsigned len,
2164 enum ffs_os_desc_type type,
2165 u16 feature_count,
2166 ffs_os_desc_callback entity,
2167 void *priv,
2168 struct usb_os_desc_header *h)
2169 {
2170 int ret;
2171 const unsigned _len = len;
2172
2173 ENTER();
2174
2175 /* loop over all ext compat/ext prop descriptors */
2176 while (feature_count--) {
2177 ret = entity(type, h, data, len, priv);
2178 if (unlikely(ret < 0)) {
2179 pr_debug("bad OS descriptor, type: %d\n", type);
2180 return ret;
2181 }
2182 data += ret;
2183 len -= ret;
2184 }
2185 return _len - len;
2186 }
2187
2188 /* Process a number of complete Feature Descriptors (Ext Compat or Ext Prop) */
2189 static int __must_check ffs_do_os_descs(unsigned count,
2190 char *data, unsigned len,
2191 ffs_os_desc_callback entity, void *priv)
2192 {
2193 const unsigned _len = len;
2194 unsigned long num = 0;
2195
2196 ENTER();
2197
2198 for (num = 0; num < count; ++num) {
2199 int ret;
2200 enum ffs_os_desc_type type;
2201 u16 feature_count;
2202 struct usb_os_desc_header *desc = (void *)data;
2203
2204 if (len < sizeof(*desc))
2205 return -EINVAL;
2206
2207 /*
2208 * Record "descriptor" entity.
2209 * Process dwLength, bcdVersion, wIndex, get b/wCount.
2210 * Move the data pointer to the beginning of extended
2211 * compatibilities proper or extended properties proper
2212 * portions of the data
2213 */
2214 if (le32_to_cpu(desc->dwLength) > len)
2215 return -EINVAL;
2216
2217 ret = __ffs_do_os_desc_header(&type, desc);
2218 if (unlikely(ret < 0)) {
2219 pr_debug("entity OS_DESCRIPTOR(%02lx); ret = %d\n",
2220 num, ret);
2221 return ret;
2222 }
2223 /*
2224 * 16-bit hex "?? 00" Little Endian looks like 8-bit hex "??"
2225 */
2226 feature_count = le16_to_cpu(desc->wCount);
2227 if (type == FFS_OS_DESC_EXT_COMPAT &&
2228 (feature_count > 255 || desc->Reserved))
2229 return -EINVAL;
2230 len -= ret;
2231 data += ret;
2232
2233 /*
2234 * Process all function/property descriptors
2235 * of this Feature Descriptor
2236 */
2237 ret = ffs_do_single_os_desc(data, len, type,
2238 feature_count, entity, priv, desc);
2239 if (unlikely(ret < 0)) {
2240 pr_debug("%s returns %d\n", __func__, ret);
2241 return ret;
2242 }
2243
2244 len -= ret;
2245 data += ret;
2246 }
2247 return _len - len;
2248 }
2249
2250 /**
2251 * Validate contents of the buffer from userspace related to OS descriptors.
2252 */
2253 static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
2254 struct usb_os_desc_header *h, void *data,
2255 unsigned len, void *priv)
2256 {
2257 struct ffs_data *ffs = priv;
2258 u8 length;
2259
2260 ENTER();
2261
2262 switch (type) {
2263 case FFS_OS_DESC_EXT_COMPAT: {
2264 struct usb_ext_compat_desc *d = data;
2265 int i;
2266
2267 if (len < sizeof(*d) ||
2268 d->bFirstInterfaceNumber >= ffs->interfaces_count)
2269 return -EINVAL;
2270 if (d->Reserved1 != 1) {
2271 /*
2272 * According to the spec, Reserved1 must be set to 1
2273 * but older kernels incorrectly rejected non-zero
2274 * values. We fix it here to avoid returning EINVAL
2275 * in response to values we used to accept.
2276 */
2277 pr_debug("usb_ext_compat_desc::Reserved1 forced to 1\n");
2278 d->Reserved1 = 1;
2279 }
2280 for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
2281 if (d->Reserved2[i])
2282 return -EINVAL;
2283
2284 length = sizeof(struct usb_ext_compat_desc);
2285 }
2286 break;
2287 case FFS_OS_DESC_EXT_PROP: {
2288 struct usb_ext_prop_desc *d = data;
2289 u32 type, pdl;
2290 u16 pnl;
2291
2292 if (len < sizeof(*d) || h->interface >= ffs->interfaces_count)
2293 return -EINVAL;
2294 length = le32_to_cpu(d->dwSize);
2295 if (len < length)
2296 return -EINVAL;
2297 type = le32_to_cpu(d->dwPropertyDataType);
2298 if (type < USB_EXT_PROP_UNICODE ||
2299 type > USB_EXT_PROP_UNICODE_MULTI) {
2300 pr_vdebug("unsupported os descriptor property type: %d",
2301 type);
2302 return -EINVAL;
2303 }
2304 pnl = le16_to_cpu(d->wPropertyNameLength);
2305 if (length < 14 + pnl) {
2306 pr_vdebug("invalid os descriptor length: %d pnl:%d (descriptor %d)\n",
2307 length, pnl, type);
2308 return -EINVAL;
2309 }
2310 pdl = le32_to_cpu(*(u32 *)((u8 *)data + 10 + pnl));
2311 if (length != 14 + pnl + pdl) {
2312 pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n",
2313 length, pnl, pdl, type);
2314 return -EINVAL;
2315 }
2316 ++ffs->ms_os_descs_ext_prop_count;
2317 /* property name reported to the host as "WCHAR"s */
2318 ffs->ms_os_descs_ext_prop_name_len += pnl * 2;
2319 ffs->ms_os_descs_ext_prop_data_len += pdl;
2320 }
2321 break;
2322 default:
2323 pr_vdebug("unknown descriptor: %d\n", type);
2324 return -EINVAL;
2325 }
2326 return length;
2327 }
2328
2329 static int __ffs_data_got_descs(struct ffs_data *ffs,
2330 char *const _data, size_t len)
2331 {
2332 char *data = _data, *raw_descs;
2333 unsigned os_descs_count = 0, counts[3], flags;
2334 int ret = -EINVAL, i;
2335 struct ffs_desc_helper helper;
2336
2337 ENTER();
2338
2339 if (get_unaligned_le32(data + 4) != len)
2340 goto error;
2341
2342 switch (get_unaligned_le32(data)) {
2343 case FUNCTIONFS_DESCRIPTORS_MAGIC:
2344 flags = FUNCTIONFS_HAS_FS_DESC | FUNCTIONFS_HAS_HS_DESC;
2345 data += 8;
2346 len -= 8;
2347 break;
2348 case FUNCTIONFS_DESCRIPTORS_MAGIC_V2:
2349 flags = get_unaligned_le32(data + 8);
2350 ffs->user_flags = flags;
2351 if (flags & ~(FUNCTIONFS_HAS_FS_DESC |
2352 FUNCTIONFS_HAS_HS_DESC |
2353 FUNCTIONFS_HAS_SS_DESC |
2354 FUNCTIONFS_HAS_MS_OS_DESC |
2355 FUNCTIONFS_VIRTUAL_ADDR |
2356 FUNCTIONFS_EVENTFD |
2357 FUNCTIONFS_ALL_CTRL_RECIP |
2358 FUNCTIONFS_CONFIG0_SETUP)) {
2359 ret = -ENOSYS;
2360 goto error;
2361 }
2362 data += 12;
2363 len -= 12;
2364 break;
2365 default:
2366 goto error;
2367 }
2368
2369 if (flags & FUNCTIONFS_EVENTFD) {
2370 if (len < 4)
2371 goto error;
2372 ffs->ffs_eventfd =
2373 eventfd_ctx_fdget((int)get_unaligned_le32(data));
2374 if (IS_ERR(ffs->ffs_eventfd)) {
2375 ret = PTR_ERR(ffs->ffs_eventfd);
2376 ffs->ffs_eventfd = NULL;
2377 goto error;
2378 }
2379 data += 4;
2380 len -= 4;
2381 }
2382
2383 /* Read fs_count, hs_count and ss_count (if present) */
2384 for (i = 0; i < 3; ++i) {
2385 if (!(flags & (1 << i))) {
2386 counts[i] = 0;
2387 } else if (len < 4) {
2388 goto error;
2389 } else {
2390 counts[i] = get_unaligned_le32(data);
2391 data += 4;
2392 len -= 4;
2393 }
2394 }
2395 if (flags & (1 << i)) {
2396 if (len < 4) {
2397 goto error;
2398 }
2399 os_descs_count = get_unaligned_le32(data);
2400 data += 4;
2401 len -= 4;
2402 };
2403
2404 /* Read descriptors */
2405 raw_descs = data;
2406 helper.ffs = ffs;
2407 for (i = 0; i < 3; ++i) {
2408 if (!counts[i])
2409 continue;
2410 helper.interfaces_count = 0;
2411 helper.eps_count = 0;
2412 ret = ffs_do_descs(counts[i], data, len,
2413 __ffs_data_do_entity, &helper);
2414 if (ret < 0)
2415 goto error;
2416 if (!ffs->eps_count && !ffs->interfaces_count) {
2417 ffs->eps_count = helper.eps_count;
2418 ffs->interfaces_count = helper.interfaces_count;
2419 } else {
2420 if (ffs->eps_count != helper.eps_count) {
2421 ret = -EINVAL;
2422 goto error;
2423 }
2424 if (ffs->interfaces_count != helper.interfaces_count) {
2425 ret = -EINVAL;
2426 goto error;
2427 }
2428 }
2429 data += ret;
2430 len -= ret;
2431 }
2432 if (os_descs_count) {
2433 ret = ffs_do_os_descs(os_descs_count, data, len,
2434 __ffs_data_do_os_desc, ffs);
2435 if (ret < 0)
2436 goto error;
2437 data += ret;
2438 len -= ret;
2439 }
2440
2441 if (raw_descs == data || len) {
2442 ret = -EINVAL;
2443 goto error;
2444 }
2445
2446 ffs->raw_descs_data = _data;
2447 ffs->raw_descs = raw_descs;
2448 ffs->raw_descs_length = data - raw_descs;
2449 ffs->fs_descs_count = counts[0];
2450 ffs->hs_descs_count = counts[1];
2451 ffs->ss_descs_count = counts[2];
2452 ffs->ms_os_descs_count = os_descs_count;
2453
2454 return 0;
2455
2456 error:
2457 kfree(_data);
2458 return ret;
2459 }
2460
2461 static int __ffs_data_got_strings(struct ffs_data *ffs,
2462 char *const _data, size_t len)
2463 {
2464 u32 str_count, needed_count, lang_count;
2465 struct usb_gadget_strings **stringtabs, *t;
2466 const char *data = _data;
2467 struct usb_string *s;
2468
2469 ENTER();
2470
2471 if (unlikely(len < 16 ||
2472 get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
2473 get_unaligned_le32(data + 4) != len))
2474 goto error;
2475 str_count = get_unaligned_le32(data + 8);
2476 lang_count = get_unaligned_le32(data + 12);
2477
2478 /* if one is zero the other must be zero */
2479 if (unlikely(!str_count != !lang_count))
2480 goto error;
2481
2482 /* Do we have at least as many strings as descriptors need? */
2483 needed_count = ffs->strings_count;
2484 if (unlikely(str_count < needed_count))
2485 goto error;
2486
2487 /*
2488 * If we don't need any strings just return and free all
2489 * memory.
2490 */
2491 if (!needed_count) {
2492 kfree(_data);
2493 return 0;
2494 }
2495
2496 /* Allocate everything in one chunk so there's less maintenance. */
2497 {
2498 unsigned i = 0;
2499 vla_group(d);
2500 vla_item(d, struct usb_gadget_strings *, stringtabs,
2501 lang_count + 1);
2502 vla_item(d, struct usb_gadget_strings, stringtab, lang_count);
2503 vla_item(d, struct usb_string, strings,
2504 lang_count*(needed_count+1));
2505
2506 char *vlabuf = kmalloc(vla_group_size(d), GFP_KERNEL);
2507
2508 if (unlikely(!vlabuf)) {
2509 kfree(_data);
2510 return -ENOMEM;
2511 }
2512
2513 /* Initialize the VLA pointers */
2514 stringtabs = vla_ptr(vlabuf, d, stringtabs);
2515 t = vla_ptr(vlabuf, d, stringtab);
2516 i = lang_count;
2517 do {
2518 *stringtabs++ = t++;
2519 } while (--i);
2520 *stringtabs = NULL;
2521
2522 /* stringtabs = vlabuf = d_stringtabs for later kfree */
2523 stringtabs = vla_ptr(vlabuf, d, stringtabs);
2524 t = vla_ptr(vlabuf, d, stringtab);
2525 s = vla_ptr(vlabuf, d, strings);
2526 }
2527
2528 /* For each language */
2529 data += 16;
2530 len -= 16;
2531
2532 do { /* lang_count > 0 so we can use do-while */
2533 unsigned needed = needed_count;
2534
2535 if (unlikely(len < 3))
2536 goto error_free;
2537 t->language = get_unaligned_le16(data);
2538 t->strings = s;
2539 ++t;
2540
2541 data += 2;
2542 len -= 2;
2543
2544 /* For each string */
2545 do { /* str_count > 0 so we can use do-while */
2546 size_t length = strnlen(data, len);
2547
2548 if (unlikely(length == len))
2549 goto error_free;
2550
2551 /*
2552 * User may provide more strings then we need,
2553 * if that's the case we simply ignore the
2554 * rest
2555 */
2556 if (likely(needed)) {
2557 /*
2558 * s->id will be set while adding
2559 * function to configuration so for
2560 * now just leave garbage here.
2561 */
2562 s->s = data;
2563 --needed;
2564 ++s;
2565 }
2566
2567 data += length + 1;
2568 len -= length + 1;
2569 } while (--str_count);
2570
2571 s->id = 0; /* terminator */
2572 s->s = NULL;
2573 ++s;
2574
2575 } while (--lang_count);
2576
2577 /* Some garbage left? */
2578 if (unlikely(len))
2579 goto error_free;
2580
2581 /* Done! */
2582 ffs->stringtabs = stringtabs;
2583 ffs->raw_strings = _data;
2584
2585 return 0;
2586
2587 error_free:
2588 kfree(stringtabs);
2589 error:
2590 kfree(_data);
2591 return -EINVAL;
2592 }
2593
2594
2595 /* Events handling and management *******************************************/
2596
2597 static void __ffs_event_add(struct ffs_data *ffs,
2598 enum usb_functionfs_event_type type)
2599 {
2600 enum usb_functionfs_event_type rem_type1, rem_type2 = type;
2601 int neg = 0;
2602
2603 /*
2604 * Abort any unhandled setup
2605 *
2606 * We do not need to worry about some cmpxchg() changing value
2607 * of ffs->setup_state without holding the lock because when
2608 * state is FFS_SETUP_PENDING cmpxchg() in several places in
2609 * the source does nothing.
2610 */
2611 if (ffs->setup_state == FFS_SETUP_PENDING)
2612 ffs->setup_state = FFS_SETUP_CANCELLED;
2613
2614 /*
2615 * Logic of this function guarantees that there are at most four pending
2616 * evens on ffs->ev.types queue. This is important because the queue
2617 * has space for four elements only and __ffs_ep0_read_events function
2618 * depends on that limit as well. If more event types are added, those
2619 * limits have to be revisited or guaranteed to still hold.
2620 */
2621 switch (type) {
2622 case FUNCTIONFS_RESUME:
2623 rem_type2 = FUNCTIONFS_SUSPEND;
2624 /* FALL THROUGH */
2625 case FUNCTIONFS_SUSPEND:
2626 case FUNCTIONFS_SETUP:
2627 rem_type1 = type;
2628 /* Discard all similar events */
2629 break;
2630
2631 case FUNCTIONFS_BIND:
2632 case FUNCTIONFS_UNBIND:
2633 case FUNCTIONFS_DISABLE:
2634 case FUNCTIONFS_ENABLE:
2635 /* Discard everything other then power management. */
2636 rem_type1 = FUNCTIONFS_SUSPEND;
2637 rem_type2 = FUNCTIONFS_RESUME;
2638 neg = 1;
2639 break;
2640
2641 default:
2642 WARN(1, "%d: unknown event, this should not happen\n", type);
2643 return;
2644 }
2645
2646 {
2647 u8 *ev = ffs->ev.types, *out = ev;
2648 unsigned n = ffs->ev.count;
2649 for (; n; --n, ++ev)
2650 if ((*ev == rem_type1 || *ev == rem_type2) == neg)
2651 *out++ = *ev;
2652 else
2653 pr_vdebug("purging event %d\n", *ev);
2654 ffs->ev.count = out - ffs->ev.types;
2655 }
2656
2657 pr_vdebug("adding event %d\n", type);
2658 ffs->ev.types[ffs->ev.count++] = type;
2659 wake_up_locked(&ffs->ev.waitq);
2660 if (ffs->ffs_eventfd)
2661 eventfd_signal(ffs->ffs_eventfd, 1);
2662 }
2663
2664 static void ffs_event_add(struct ffs_data *ffs,
2665 enum usb_functionfs_event_type type)
2666 {
2667 unsigned long flags;
2668 spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
2669 __ffs_event_add(ffs, type);
2670 spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
2671 }
2672
2673 /* Bind/unbind USB function hooks *******************************************/
2674
2675 static int ffs_ep_addr2idx(struct ffs_data *ffs, u8 endpoint_address)
2676 {
2677 int i;
2678
2679 for (i = 1; i < ARRAY_SIZE(ffs->eps_addrmap); ++i)
2680 if (ffs->eps_addrmap[i] == endpoint_address)
2681 return i;
2682 return -ENOENT;
2683 }
2684
2685 static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep,
2686 struct usb_descriptor_header *desc,
2687 void *priv)
2688 {
2689 struct usb_endpoint_descriptor *ds = (void *)desc;
2690 struct ffs_function *func = priv;
2691 struct ffs_ep *ffs_ep;
2692 unsigned ep_desc_id;
2693 int idx;
2694 static const char *speed_names[] = { "full", "high", "super" };
2695
2696 if (type != FFS_DESCRIPTOR)
2697 return 0;
2698
2699 /*
2700 * If ss_descriptors is not NULL, we are reading super speed
2701 * descriptors; if hs_descriptors is not NULL, we are reading high
2702 * speed descriptors; otherwise, we are reading full speed
2703 * descriptors.
2704 */
2705 if (func->function.ss_descriptors) {
2706 ep_desc_id = 2;
2707 func->function.ss_descriptors[(long)valuep] = desc;
2708 } else if (func->function.hs_descriptors) {
2709 ep_desc_id = 1;
2710 func->function.hs_descriptors[(long)valuep] = desc;
2711 } else {
2712 ep_desc_id = 0;
2713 func->function.fs_descriptors[(long)valuep] = desc;
2714 }
2715
2716 if (!desc || desc->bDescriptorType != USB_DT_ENDPOINT)
2717 return 0;
2718
2719 idx = ffs_ep_addr2idx(func->ffs, ds->bEndpointAddress) - 1;
2720 if (idx < 0)
2721 return idx;
2722
2723 ffs_ep = func->eps + idx;
2724
2725 if (unlikely(ffs_ep->descs[ep_desc_id])) {
2726 pr_err("two %sspeed descriptors for EP %d\n",
2727 speed_names[ep_desc_id],
2728 ds->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
2729 return -EINVAL;
2730 }
2731 ffs_ep->descs[ep_desc_id] = ds;
2732
2733 ffs_dump_mem(": Original ep desc", ds, ds->bLength);
2734 if (ffs_ep->ep) {
2735 ds->bEndpointAddress = ffs_ep->descs[0]->bEndpointAddress;
2736 if (!ds->wMaxPacketSize)
2737 ds->wMaxPacketSize = ffs_ep->descs[0]->wMaxPacketSize;
2738 } else {
2739 struct usb_request *req;
2740 struct usb_ep *ep;
2741 u8 bEndpointAddress;
2742
2743 /*
2744 * We back up bEndpointAddress because autoconfig overwrites
2745 * it with physical endpoint address.
2746 */
2747 bEndpointAddress = ds->bEndpointAddress;
2748 pr_vdebug("autoconfig\n");
2749 ep = usb_ep_autoconfig(func->gadget, ds);
2750 if (unlikely(!ep))
2751 return -ENOTSUPP;
2752 ep->driver_data = func->eps + idx;
2753
2754 req = usb_ep_alloc_request(ep, GFP_KERNEL);
2755 if (unlikely(!req))
2756 return -ENOMEM;
2757
2758 ffs_ep->ep = ep;
2759 ffs_ep->req = req;
2760 func->eps_revmap[ds->bEndpointAddress &
2761 USB_ENDPOINT_NUMBER_MASK] = idx + 1;
2762 /*
2763 * If we use virtual address mapping, we restore
2764 * original bEndpointAddress value.
2765 */
2766 if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
2767 ds->bEndpointAddress = bEndpointAddress;
2768 }
2769 ffs_dump_mem(": Rewritten ep desc", ds, ds->bLength);
2770
2771 return 0;
2772 }
2773
2774 static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep,
2775 struct usb_descriptor_header *desc,
2776 void *priv)
2777 {
2778 struct ffs_function *func = priv;
2779 unsigned idx;
2780 u8 newValue;
2781
2782 switch (type) {
2783 default:
2784 case FFS_DESCRIPTOR:
2785 /* Handled in previous pass by __ffs_func_bind_do_descs() */
2786 return 0;
2787
2788 case FFS_INTERFACE:
2789 idx = *valuep;
2790 if (func->interfaces_nums[idx] < 0) {
2791 int id = usb_interface_id(func->conf, &func->function);
2792 if (unlikely(id < 0))
2793 return id;
2794 func->interfaces_nums[idx] = id;
2795 }
2796 newValue = func->interfaces_nums[idx];
2797 break;
2798
2799 case FFS_STRING:
2800 /* String' IDs are allocated when fsf_data is bound to cdev */
2801 newValue = func->ffs->stringtabs[0]->strings[*valuep - 1].id;
2802 break;
2803
2804 case FFS_ENDPOINT:
2805 /*
2806 * USB_DT_ENDPOINT are handled in
2807 * __ffs_func_bind_do_descs().
2808 */
2809 if (desc->bDescriptorType == USB_DT_ENDPOINT)
2810 return 0;
2811
2812 idx = (*valuep & USB_ENDPOINT_NUMBER_MASK) - 1;
2813 if (unlikely(!func->eps[idx].ep))
2814 return -EINVAL;
2815
2816 {
2817 struct usb_endpoint_descriptor **descs;
2818 descs = func->eps[idx].descs;
2819 newValue = descs[descs[0] ? 0 : 1]->bEndpointAddress;
2820 }
2821 break;
2822 }
2823
2824 pr_vdebug("%02x -> %02x\n", *valuep, newValue);
2825 *valuep = newValue;
2826 return 0;
2827 }
2828
2829 static int __ffs_func_bind_do_os_desc(enum ffs_os_desc_type type,
2830 struct usb_os_desc_header *h, void *data,
2831 unsigned len, void *priv)
2832 {
2833 struct ffs_function *func = priv;
2834 u8 length = 0;
2835
2836 switch (type) {
2837 case FFS_OS_DESC_EXT_COMPAT: {
2838 struct usb_ext_compat_desc *desc = data;
2839 struct usb_os_desc_table *t;
2840
2841 t = &func->function.os_desc_table[desc->bFirstInterfaceNumber];
2842 t->if_id = func->interfaces_nums[desc->bFirstInterfaceNumber];
2843 memcpy(t->os_desc->ext_compat_id, &desc->CompatibleID,
2844 ARRAY_SIZE(desc->CompatibleID) +
2845 ARRAY_SIZE(desc->SubCompatibleID));
2846 length = sizeof(*desc);
2847 }
2848 break;
2849 case FFS_OS_DESC_EXT_PROP: {
2850 struct usb_ext_prop_desc *desc = data;
2851 struct usb_os_desc_table *t;
2852 struct usb_os_desc_ext_prop *ext_prop;
2853 char *ext_prop_name;
2854 char *ext_prop_data;
2855
2856 t = &func->function.os_desc_table[h->interface];
2857 t->if_id = func->interfaces_nums[h->interface];
2858
2859 ext_prop = func->ffs->ms_os_descs_ext_prop_avail;
2860 func->ffs->ms_os_descs_ext_prop_avail += sizeof(*ext_prop);
2861
2862 ext_prop->type = le32_to_cpu(desc->dwPropertyDataType);
2863 ext_prop->name_len = le16_to_cpu(desc->wPropertyNameLength);
2864 ext_prop->data_len = le32_to_cpu(*(u32 *)
2865 usb_ext_prop_data_len_ptr(data, ext_prop->name_len));
2866 length = ext_prop->name_len + ext_prop->data_len + 14;
2867
2868 ext_prop_name = func->ffs->ms_os_descs_ext_prop_name_avail;
2869 func->ffs->ms_os_descs_ext_prop_name_avail +=
2870 ext_prop->name_len;
2871
2872 ext_prop_data = func->ffs->ms_os_descs_ext_prop_data_avail;
2873 func->ffs->ms_os_descs_ext_prop_data_avail +=
2874 ext_prop->data_len;
2875 memcpy(ext_prop_data,
2876 usb_ext_prop_data_ptr(data, ext_prop->name_len),
2877 ext_prop->data_len);
2878 /* unicode data reported to the host as "WCHAR"s */
2879 switch (ext_prop->type) {
2880 case USB_EXT_PROP_UNICODE:
2881 case USB_EXT_PROP_UNICODE_ENV:
2882 case USB_EXT_PROP_UNICODE_LINK:
2883 case USB_EXT_PROP_UNICODE_MULTI:
2884 ext_prop->data_len *= 2;
2885 break;
2886 }
2887 ext_prop->data = ext_prop_data;
2888
2889 memcpy(ext_prop_name, usb_ext_prop_name_ptr(data),
2890 ext_prop->name_len);
2891 /* property name reported to the host as "WCHAR"s */
2892 ext_prop->name_len *= 2;
2893 ext_prop->name = ext_prop_name;
2894
2895 t->os_desc->ext_prop_len +=
2896 ext_prop->name_len + ext_prop->data_len + 14;
2897 ++t->os_desc->ext_prop_count;
2898 list_add_tail(&ext_prop->entry, &t->os_desc->ext_prop);
2899 }
2900 break;
2901 default:
2902 pr_vdebug("unknown descriptor: %d\n", type);
2903 }
2904
2905 return length;
2906 }
2907
2908 static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f,
2909 struct usb_configuration *c)
2910 {
2911 struct ffs_function *func = ffs_func_from_usb(f);
2912 struct f_fs_opts *ffs_opts =
2913 container_of(f->fi, struct f_fs_opts, func_inst);
2914 int ret;
2915
2916 ENTER();
2917
2918 /*
2919 * Legacy gadget triggers binding in functionfs_ready_callback,
2920 * which already uses locking; taking the same lock here would
2921 * cause a deadlock.
2922 *
2923 * Configfs-enabled gadgets however do need ffs_dev_lock.
2924 */
2925 if (!ffs_opts->no_configfs)
2926 ffs_dev_lock();
2927 ret = ffs_opts->dev->desc_ready ? 0 : -ENODEV;
2928 func->ffs = ffs_opts->dev->ffs_data;
2929 if (!ffs_opts->no_configfs)
2930 ffs_dev_unlock();
2931 if (ret)
2932 return ERR_PTR(ret);
2933
2934 func->conf = c;
2935 func->gadget = c->cdev->gadget;
2936
2937 /*
2938 * in drivers/usb/gadget/configfs.c:configfs_composite_bind()
2939 * configurations are bound in sequence with list_for_each_entry,
2940 * in each configuration its functions are bound in sequence
2941 * with list_for_each_entry, so we assume no race condition
2942 * with regard to ffs_opts->bound access
2943 */
2944 if (!ffs_opts->refcnt) {
2945 ret = functionfs_bind(func->ffs, c->cdev);
2946 if (ret)
2947 return ERR_PTR(ret);
2948 }
2949 ffs_opts->refcnt++;
2950 func->function.strings = func->ffs->stringtabs;
2951
2952 return ffs_opts;
2953 }
2954
2955 static int _ffs_func_bind(struct usb_configuration *c,
2956 struct usb_function *f)
2957 {
2958 struct ffs_function *func = ffs_func_from_usb(f);
2959 struct ffs_data *ffs = func->ffs;
2960
2961 const int full = !!func->ffs->fs_descs_count;
2962 const int high = !!func->ffs->hs_descs_count;
2963 const int super = !!func->ffs->ss_descs_count;
2964
2965 int fs_len, hs_len, ss_len, ret, i;
2966 struct ffs_ep *eps_ptr;
2967
2968 /* Make it a single chunk, less management later on */
2969 vla_group(d);
2970 vla_item_with_sz(d, struct ffs_ep, eps, ffs->eps_count);
2971 vla_item_with_sz(d, struct usb_descriptor_header *, fs_descs,
2972 full ? ffs->fs_descs_count + 1 : 0);
2973 vla_item_with_sz(d, struct usb_descriptor_header *, hs_descs,
2974 high ? ffs->hs_descs_count + 1 : 0);
2975 vla_item_with_sz(d, struct usb_descriptor_header *, ss_descs,
2976 super ? ffs->ss_descs_count + 1 : 0);
2977 vla_item_with_sz(d, short, inums, ffs->interfaces_count);
2978 vla_item_with_sz(d, struct usb_os_desc_table, os_desc_table,
2979 c->cdev->use_os_string ? ffs->interfaces_count : 0);
2980 vla_item_with_sz(d, char[16], ext_compat,
2981 c->cdev->use_os_string ? ffs->interfaces_count : 0);
2982 vla_item_with_sz(d, struct usb_os_desc, os_desc,
2983 c->cdev->use_os_string ? ffs->interfaces_count : 0);
2984 vla_item_with_sz(d, struct usb_os_desc_ext_prop, ext_prop,
2985 ffs->ms_os_descs_ext_prop_count);
2986 vla_item_with_sz(d, char, ext_prop_name,
2987 ffs->ms_os_descs_ext_prop_name_len);
2988 vla_item_with_sz(d, char, ext_prop_data,
2989 ffs->ms_os_descs_ext_prop_data_len);
2990 vla_item_with_sz(d, char, raw_descs, ffs->raw_descs_length);
2991 char *vlabuf;
2992
2993 ENTER();
2994
2995 /* Has descriptors only for speeds gadget does not support */
2996 if (unlikely(!(full | high | super)))
2997 return -ENOTSUPP;
2998
2999 /* Allocate a single chunk, less management later on */
3000 vlabuf = kzalloc(vla_group_size(d), GFP_KERNEL);
3001 if (unlikely(!vlabuf))
3002 return -ENOMEM;
3003
3004 ffs->ms_os_descs_ext_prop_avail = vla_ptr(vlabuf, d, ext_prop);
3005 ffs->ms_os_descs_ext_prop_name_avail =
3006 vla_ptr(vlabuf, d, ext_prop_name);
3007 ffs->ms_os_descs_ext_prop_data_avail =
3008 vla_ptr(vlabuf, d, ext_prop_data);
3009
3010 /* Copy descriptors */
3011 memcpy(vla_ptr(vlabuf, d, raw_descs), ffs->raw_descs,
3012 ffs->raw_descs_length);
3013
3014 memset(vla_ptr(vlabuf, d, inums), 0xff, d_inums__sz);
3015 eps_ptr = vla_ptr(vlabuf, d, eps);
3016 for (i = 0; i < ffs->eps_count; i++)
3017 eps_ptr[i].num = -1;
3018
3019 /* Save pointers
3020 * d_eps == vlabuf, func->eps used to kfree vlabuf later
3021 */
3022 func->eps = vla_ptr(vlabuf, d, eps);
3023 func->interfaces_nums = vla_ptr(vlabuf, d, inums);
3024
3025 /*
3026 * Go through all the endpoint descriptors and allocate
3027 * endpoints first, so that later we can rewrite the endpoint
3028 * numbers without worrying that it may be described later on.
3029 */
3030 if (likely(full)) {
3031 func->function.fs_descriptors = vla_ptr(vlabuf, d, fs_descs);
3032 fs_len = ffs_do_descs(ffs->fs_descs_count,
3033 vla_ptr(vlabuf, d, raw_descs),
3034 d_raw_descs__sz,
3035 __ffs_func_bind_do_descs, func);
3036 if (unlikely(fs_len < 0)) {
3037 ret = fs_len;
3038 goto error;
3039 }
3040 } else {
3041 fs_len = 0;
3042 }
3043
3044 if (likely(high)) {
3045 func->function.hs_descriptors = vla_ptr(vlabuf, d, hs_descs);
3046 hs_len = ffs_do_descs(ffs->hs_descs_count,
3047 vla_ptr(vlabuf, d, raw_descs) + fs_len,
3048 d_raw_descs__sz - fs_len,
3049 __ffs_func_bind_do_descs, func);
3050 if (unlikely(hs_len < 0)) {
3051 ret = hs_len;
3052 goto error;
3053 }
3054 } else {
3055 hs_len = 0;
3056 }
3057
3058 if (likely(super)) {
3059 func->function.ss_descriptors = vla_ptr(vlabuf, d, ss_descs);
3060 ss_len = ffs_do_descs(ffs->ss_descs_count,
3061 vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len,
3062 d_raw_descs__sz - fs_len - hs_len,
3063 __ffs_func_bind_do_descs, func);
3064 if (unlikely(ss_len < 0)) {
3065 ret = ss_len;
3066 goto error;
3067 }
3068 } else {
3069 ss_len = 0;
3070 }
3071
3072 /*
3073 * Now handle interface numbers allocation and interface and
3074 * endpoint numbers rewriting. We can do that in one go
3075 * now.
3076 */
3077 ret = ffs_do_descs(ffs->fs_descs_count +
3078 (high ? ffs->hs_descs_count : 0) +
3079 (super ? ffs->ss_descs_count : 0),
3080 vla_ptr(vlabuf, d, raw_descs), d_raw_descs__sz,
3081 __ffs_func_bind_do_nums, func);
3082 if (unlikely(ret < 0))
3083 goto error;
3084
3085 func->function.os_desc_table = vla_ptr(vlabuf, d, os_desc_table);
3086 if (c->cdev->use_os_string) {
3087 for (i = 0; i < ffs->interfaces_count; ++i) {
3088 struct usb_os_desc *desc;
3089
3090 desc = func->function.os_desc_table[i].os_desc =
3091 vla_ptr(vlabuf, d, os_desc) +
3092 i * sizeof(struct usb_os_desc);
3093 desc->ext_compat_id =
3094 vla_ptr(vlabuf, d, ext_compat) + i * 16;
3095 INIT_LIST_HEAD(&desc->ext_prop);
3096 }
3097 ret = ffs_do_os_descs(ffs->ms_os_descs_count,
3098 vla_ptr(vlabuf, d, raw_descs) +
3099 fs_len + hs_len + ss_len,
3100 d_raw_descs__sz - fs_len - hs_len -
3101 ss_len,
3102 __ffs_func_bind_do_os_desc, func);
3103 if (unlikely(ret < 0))
3104 goto error;
3105 }
3106 func->function.os_desc_n =
3107 c->cdev->use_os_string ? ffs->interfaces_count : 0;
3108
3109 /* And we're done */
3110 ffs_event_add(ffs, FUNCTIONFS_BIND);
3111 return 0;
3112
3113 error:
3114 /* XXX Do we need to release all claimed endpoints here? */
3115 return ret;
3116 }
3117
3118 static int ffs_func_bind(struct usb_configuration *c,
3119 struct usb_function *f)
3120 {
3121 struct f_fs_opts *ffs_opts = ffs_do_functionfs_bind(f, c);
3122 struct ffs_function *func = ffs_func_from_usb(f);
3123 int ret;
3124
3125 if (IS_ERR(ffs_opts))
3126 return PTR_ERR(ffs_opts);
3127
3128 ret = _ffs_func_bind(c, f);
3129 if (ret && !--ffs_opts->refcnt)
3130 functionfs_unbind(func->ffs);
3131
3132 return ret;
3133 }
3134
3135
3136 /* Other USB function hooks *************************************************/
3137
3138 static void ffs_reset_work(struct work_struct *work)
3139 {
3140 struct ffs_data *ffs = container_of(work,
3141 struct ffs_data, reset_work);
3142 ffs_data_reset(ffs);
3143 }
3144
3145 static int ffs_func_set_alt(struct usb_function *f,
3146 unsigned interface, unsigned alt)
3147 {
3148 struct ffs_function *func = ffs_func_from_usb(f);
3149 struct ffs_data *ffs = func->ffs;
3150 int ret = 0, intf;
3151
3152 if (alt != (unsigned)-1) {
3153 intf = ffs_func_revmap_intf(func, interface);
3154 if (unlikely(intf < 0))
3155 return intf;
3156 }
3157
3158 if (ffs->func)
3159 ffs_func_eps_disable(ffs->func);
3160
3161 if (ffs->state == FFS_DEACTIVATED) {
3162 ffs->state = FFS_CLOSING;
3163 INIT_WORK(&ffs->reset_work, ffs_reset_work);
3164 schedule_work(&ffs->reset_work);
3165 return -ENODEV;
3166 }
3167
3168 if (ffs->state != FFS_ACTIVE)
3169 return -ENODEV;
3170
3171 if (alt == (unsigned)-1) {
3172 ffs->func = NULL;
3173 ffs_event_add(ffs, FUNCTIONFS_DISABLE);
3174 return 0;
3175 }
3176
3177 ffs->func = func;
3178 ret = ffs_func_eps_enable(func);
3179 if (likely(ret >= 0))
3180 ffs_event_add(ffs, FUNCTIONFS_ENABLE);
3181 return ret;
3182 }
3183
3184 static void ffs_func_disable(struct usb_function *f)
3185 {
3186 ffs_func_set_alt(f, 0, (unsigned)-1);
3187 }
3188
3189 static int ffs_func_setup(struct usb_function *f,
3190 const struct usb_ctrlrequest *creq)
3191 {
3192 struct ffs_function *func = ffs_func_from_usb(f);
3193 struct ffs_data *ffs = func->ffs;
3194 unsigned long flags;
3195 int ret;
3196
3197 ENTER();
3198
3199 pr_vdebug("creq->bRequestType = %02x\n", creq->bRequestType);
3200 pr_vdebug("creq->bRequest = %02x\n", creq->bRequest);
3201 pr_vdebug("creq->wValue = %04x\n", le16_to_cpu(creq->wValue));
3202 pr_vdebug("creq->wIndex = %04x\n", le16_to_cpu(creq->wIndex));
3203 pr_vdebug("creq->wLength = %04x\n", le16_to_cpu(creq->wLength));
3204
3205 /*
3206 * Most requests directed to interface go through here
3207 * (notable exceptions are set/get interface) so we need to
3208 * handle them. All other either handled by composite or
3209 * passed to usb_configuration->setup() (if one is set). No
3210 * matter, we will handle requests directed to endpoint here
3211 * as well (as it's straightforward). Other request recipient
3212 * types are only handled when the user flag FUNCTIONFS_ALL_CTRL_RECIP
3213 * is being used.
3214 */
3215 if (ffs->state != FFS_ACTIVE)
3216 return -ENODEV;
3217
3218 switch (creq->bRequestType & USB_RECIP_MASK) {
3219 case USB_RECIP_INTERFACE:
3220 ret = ffs_func_revmap_intf(func, le16_to_cpu(creq->wIndex));
3221 if (unlikely(ret < 0))
3222 return ret;
3223 break;
3224
3225 case USB_RECIP_ENDPOINT:
3226 ret = ffs_func_revmap_ep(func, le16_to_cpu(creq->wIndex));
3227 if (unlikely(ret < 0))
3228 return ret;
3229 if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
3230 ret = func->ffs->eps_addrmap[ret];
3231 break;
3232
3233 default:
3234 if (func->ffs->user_flags & FUNCTIONFS_ALL_CTRL_RECIP)
3235 ret = le16_to_cpu(creq->wIndex);
3236 else
3237 return -EOPNOTSUPP;
3238 }
3239
3240 spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
3241 ffs->ev.setup = *creq;
3242 ffs->ev.setup.wIndex = cpu_to_le16(ret);
3243 __ffs_event_add(ffs, FUNCTIONFS_SETUP);
3244 spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
3245
3246 return creq->wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0;
3247 }
3248
3249 static bool ffs_func_req_match(struct usb_function *f,
3250 const struct usb_ctrlrequest *creq,
3251 bool config0)
3252 {
3253 struct ffs_function *func = ffs_func_from_usb(f);
3254
3255 if (config0 && !(func->ffs->user_flags & FUNCTIONFS_CONFIG0_SETUP))
3256 return false;
3257
3258 switch (creq->bRequestType & USB_RECIP_MASK) {
3259 case USB_RECIP_INTERFACE:
3260 return (ffs_func_revmap_intf(func,
3261 le16_to_cpu(creq->wIndex)) >= 0);
3262 case USB_RECIP_ENDPOINT:
3263 return (ffs_func_revmap_ep(func,
3264 le16_to_cpu(creq->wIndex)) >= 0);
3265 default:
3266 return (bool) (func->ffs->user_flags &
3267 FUNCTIONFS_ALL_CTRL_RECIP);
3268 }
3269 }
3270
3271 static void ffs_func_suspend(struct usb_function *f)
3272 {
3273 ENTER();
3274 ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_SUSPEND);
3275 }
3276
3277 static void ffs_func_resume(struct usb_function *f)
3278 {
3279 ENTER();
3280 ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_RESUME);
3281 }
3282
3283
3284 /* Endpoint and interface numbers reverse mapping ***************************/
3285
3286 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num)
3287 {
3288 num = func->eps_revmap[num & USB_ENDPOINT_NUMBER_MASK];
3289 return num ? num : -EDOM;
3290 }
3291
3292 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf)
3293 {
3294 short *nums = func->interfaces_nums;
3295 unsigned count = func->ffs->interfaces_count;
3296
3297 for (; count; --count, ++nums) {
3298 if (*nums >= 0 && *nums == intf)
3299 return nums - func->interfaces_nums;
3300 }
3301
3302 return -EDOM;
3303 }
3304
3305
3306 /* Devices management *******************************************************/
3307
3308 static LIST_HEAD(ffs_devices);
3309
3310 static struct ffs_dev *_ffs_do_find_dev(const char *name)
3311 {
3312 struct ffs_dev *dev;
3313
3314 list_for_each_entry(dev, &ffs_devices, entry) {
3315 if (!dev->name || !name)
3316 continue;
3317 if (strcmp(dev->name, name) == 0)
3318 return dev;
3319 }
3320
3321 return NULL;
3322 }
3323
3324 /*
3325 * ffs_lock must be taken by the caller of this function
3326 */
3327 static struct ffs_dev *_ffs_get_single_dev(void)
3328 {
3329 struct ffs_dev *dev;
3330
3331 if (list_is_singular(&ffs_devices)) {
3332 dev = list_first_entry(&ffs_devices, struct ffs_dev, entry);
3333 if (dev->single)
3334 return dev;
3335 }
3336
3337 return NULL;
3338 }
3339
3340 /*
3341 * ffs_lock must be taken by the caller of this function
3342 */
3343 static struct ffs_dev *_ffs_find_dev(const char *name)
3344 {
3345 struct ffs_dev *dev;
3346
3347 dev = _ffs_get_single_dev();
3348 if (dev)
3349 return dev;
3350
3351 return _ffs_do_find_dev(name);
3352 }
3353
3354 /* Configfs support *********************************************************/
3355
3356 static inline struct f_fs_opts *to_ffs_opts(struct config_item *item)
3357 {
3358 return container_of(to_config_group(item), struct f_fs_opts,
3359 func_inst.group);
3360 }
3361
3362 static void ffs_attr_release(struct config_item *item)
3363 {
3364 struct f_fs_opts *opts = to_ffs_opts(item);
3365
3366 usb_put_function_instance(&opts->func_inst);
3367 }
3368
3369 static struct configfs_item_operations ffs_item_ops = {
3370 .release = ffs_attr_release,
3371 };
3372
3373 static struct config_item_type ffs_func_type = {
3374 .ct_item_ops = &ffs_item_ops,
3375 .ct_owner = THIS_MODULE,
3376 };
3377
3378
3379 /* Function registration interface ******************************************/
3380
3381 static void ffs_free_inst(struct usb_function_instance *f)
3382 {
3383 struct f_fs_opts *opts;
3384
3385 opts = to_f_fs_opts(f);
3386 ffs_dev_lock();
3387 _ffs_free_dev(opts->dev);
3388 ffs_dev_unlock();
3389 kfree(opts);
3390 }
3391
3392 #define MAX_INST_NAME_LEN 40
3393
3394 static int ffs_set_inst_name(struct usb_function_instance *fi, const char *name)
3395 {
3396 struct f_fs_opts *opts;
3397 char *ptr;
3398 const char *tmp;
3399 int name_len, ret;
3400
3401 name_len = strlen(name) + 1;
3402 if (name_len > MAX_INST_NAME_LEN)
3403 return -ENAMETOOLONG;
3404
3405 ptr = kstrndup(name, name_len, GFP_KERNEL);
3406 if (!ptr)
3407 return -ENOMEM;
3408
3409 opts = to_f_fs_opts(fi);
3410 tmp = NULL;
3411
3412 ffs_dev_lock();
3413
3414 tmp = opts->dev->name_allocated ? opts->dev->name : NULL;
3415 ret = _ffs_name_dev(opts->dev, ptr);
3416 if (ret) {
3417 kfree(ptr);
3418 ffs_dev_unlock();
3419 return ret;
3420 }
3421 opts->dev->name_allocated = true;
3422
3423 ffs_dev_unlock();
3424
3425 kfree(tmp);
3426
3427 return 0;
3428 }
3429
3430 static struct usb_function_instance *ffs_alloc_inst(void)
3431 {
3432 struct f_fs_opts *opts;
3433 struct ffs_dev *dev;
3434
3435 opts = kzalloc(sizeof(*opts), GFP_KERNEL);
3436 if (!opts)
3437 return ERR_PTR(-ENOMEM);
3438
3439 opts->func_inst.set_inst_name = ffs_set_inst_name;
3440 opts->func_inst.free_func_inst = ffs_free_inst;
3441 ffs_dev_lock();
3442 dev = _ffs_alloc_dev();
3443 ffs_dev_unlock();
3444 if (IS_ERR(dev)) {
3445 kfree(opts);
3446 return ERR_CAST(dev);
3447 }
3448 opts->dev = dev;
3449 dev->opts = opts;
3450
3451 config_group_init_type_name(&opts->func_inst.group, "",
3452 &ffs_func_type);
3453 return &opts->func_inst;
3454 }
3455
3456 static void ffs_free(struct usb_function *f)
3457 {
3458 kfree(ffs_func_from_usb(f));
3459 }
3460
3461 static void ffs_func_unbind(struct usb_configuration *c,
3462 struct usb_function *f)
3463 {
3464 struct ffs_function *func = ffs_func_from_usb(f);
3465 struct ffs_data *ffs = func->ffs;
3466 struct f_fs_opts *opts =
3467 container_of(f->fi, struct f_fs_opts, func_inst);
3468 struct ffs_ep *ep = func->eps;
3469 unsigned count = ffs->eps_count;
3470 unsigned long flags;
3471
3472 ENTER();
3473 if (ffs->func == func) {
3474 ffs_func_eps_disable(func);
3475 ffs->func = NULL;
3476 }
3477
3478 if (!--opts->refcnt)
3479 functionfs_unbind(ffs);
3480
3481 /* cleanup after autoconfig */
3482 spin_lock_irqsave(&func->ffs->eps_lock, flags);
3483 do {
3484 if (ep->ep && ep->req)
3485 usb_ep_free_request(ep->ep, ep->req);
3486 ep->req = NULL;
3487 ++ep;
3488 } while (--count);
3489 spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
3490 kfree(func->eps);
3491 func->eps = NULL;
3492 /*
3493 * eps, descriptors and interfaces_nums are allocated in the
3494 * same chunk so only one free is required.
3495 */
3496 func->function.fs_descriptors = NULL;
3497 func->function.hs_descriptors = NULL;
3498 func->function.ss_descriptors = NULL;
3499 func->interfaces_nums = NULL;
3500
3501 ffs_event_add(ffs, FUNCTIONFS_UNBIND);
3502 }
3503
3504 static struct usb_function *ffs_alloc(struct usb_function_instance *fi)
3505 {
3506 struct ffs_function *func;
3507
3508 ENTER();
3509
3510 func = kzalloc(sizeof(*func), GFP_KERNEL);
3511 if (unlikely(!func))
3512 return ERR_PTR(-ENOMEM);
3513
3514 func->function.name = "Function FS Gadget";
3515
3516 func->function.bind = ffs_func_bind;
3517 func->function.unbind = ffs_func_unbind;
3518 func->function.set_alt = ffs_func_set_alt;
3519 func->function.disable = ffs_func_disable;
3520 func->function.setup = ffs_func_setup;
3521 func->function.req_match = ffs_func_req_match;
3522 func->function.suspend = ffs_func_suspend;
3523 func->function.resume = ffs_func_resume;
3524 func->function.free_func = ffs_free;
3525
3526 return &func->function;
3527 }
3528
3529 /*
3530 * ffs_lock must be taken by the caller of this function
3531 */
3532 static struct ffs_dev *_ffs_alloc_dev(void)
3533 {
3534 struct ffs_dev *dev;
3535 int ret;
3536
3537 if (_ffs_get_single_dev())
3538 return ERR_PTR(-EBUSY);
3539
3540 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3541 if (!dev)
3542 return ERR_PTR(-ENOMEM);
3543
3544 if (list_empty(&ffs_devices)) {
3545 ret = functionfs_init();
3546 if (ret) {
3547 kfree(dev);
3548 return ERR_PTR(ret);
3549 }
3550 }
3551
3552 list_add(&dev->entry, &ffs_devices);
3553
3554 return dev;
3555 }
3556
3557 /*
3558 * ffs_lock must be taken by the caller of this function
3559 * The caller is responsible for "name" being available whenever f_fs needs it
3560 */
3561 static int _ffs_name_dev(struct ffs_dev *dev, const char *name)
3562 {
3563 struct ffs_dev *existing;
3564
3565 existing = _ffs_do_find_dev(name);
3566 if (existing)
3567 return -EBUSY;
3568
3569 dev->name = name;
3570
3571 return 0;
3572 }
3573
3574 /*
3575 * The caller is responsible for "name" being available whenever f_fs needs it
3576 */
3577 int ffs_name_dev(struct ffs_dev *dev, const char *name)
3578 {
3579 int ret;
3580
3581 ffs_dev_lock();
3582 ret = _ffs_name_dev(dev, name);
3583 ffs_dev_unlock();
3584
3585 return ret;
3586 }
3587 EXPORT_SYMBOL_GPL(ffs_name_dev);
3588
3589 int ffs_single_dev(struct ffs_dev *dev)
3590 {
3591 int ret;
3592
3593 ret = 0;
3594 ffs_dev_lock();
3595
3596 if (!list_is_singular(&ffs_devices))
3597 ret = -EBUSY;
3598 else
3599 dev->single = true;
3600
3601 ffs_dev_unlock();
3602 return ret;
3603 }
3604 EXPORT_SYMBOL_GPL(ffs_single_dev);
3605
3606 /*
3607 * ffs_lock must be taken by the caller of this function
3608 */
3609 static void _ffs_free_dev(struct ffs_dev *dev)
3610 {
3611 list_del(&dev->entry);
3612 if (dev->name_allocated)
3613 kfree(dev->name);
3614
3615 /* Clear the private_data pointer to stop incorrect dev access */
3616 if (dev->ffs_data)
3617 dev->ffs_data->private_data = NULL;
3618
3619 kfree(dev);
3620 if (list_empty(&ffs_devices))
3621 functionfs_cleanup();
3622 }
3623
3624 static void *ffs_acquire_dev(const char *dev_name)
3625 {
3626 struct ffs_dev *ffs_dev;
3627
3628 ENTER();
3629 ffs_dev_lock();
3630
3631 ffs_dev = _ffs_find_dev(dev_name);
3632 if (!ffs_dev)
3633 ffs_dev = ERR_PTR(-ENOENT);
3634 else if (ffs_dev->mounted)
3635 ffs_dev = ERR_PTR(-EBUSY);
3636 else if (ffs_dev->ffs_acquire_dev_callback &&
3637 ffs_dev->ffs_acquire_dev_callback(ffs_dev))
3638 ffs_dev = ERR_PTR(-ENOENT);
3639 else
3640 ffs_dev->mounted = true;
3641
3642 ffs_dev_unlock();
3643 return ffs_dev;
3644 }
3645
3646 static void ffs_release_dev(struct ffs_data *ffs_data)
3647 {
3648 struct ffs_dev *ffs_dev;
3649
3650 ENTER();
3651 ffs_dev_lock();
3652
3653 ffs_dev = ffs_data->private_data;
3654 if (ffs_dev) {
3655 ffs_dev->mounted = false;
3656
3657 if (ffs_dev->ffs_release_dev_callback)
3658 ffs_dev->ffs_release_dev_callback(ffs_dev);
3659 }
3660
3661 ffs_dev_unlock();
3662 }
3663
3664 static int ffs_ready(struct ffs_data *ffs)
3665 {
3666 struct ffs_dev *ffs_obj;
3667 int ret = 0;
3668
3669 ENTER();
3670 ffs_dev_lock();
3671
3672 ffs_obj = ffs->private_data;
3673 if (!ffs_obj) {
3674 ret = -EINVAL;
3675 goto done;
3676 }
3677 if (WARN_ON(ffs_obj->desc_ready)) {
3678 ret = -EBUSY;
3679 goto done;
3680 }
3681
3682 ffs_obj->desc_ready = true;
3683 ffs_obj->ffs_data = ffs;
3684
3685 if (ffs_obj->ffs_ready_callback) {
3686 ret = ffs_obj->ffs_ready_callback(ffs);
3687 if (ret)
3688 goto done;
3689 }
3690
3691 set_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags);
3692 done:
3693 ffs_dev_unlock();
3694 return ret;
3695 }
3696
3697 static void ffs_closed(struct ffs_data *ffs)
3698 {
3699 struct ffs_dev *ffs_obj;
3700 struct f_fs_opts *opts;
3701 struct config_item *ci;
3702
3703 ENTER();
3704 ffs_dev_lock();
3705
3706 ffs_obj = ffs->private_data;
3707 if (!ffs_obj)
3708 goto done;
3709
3710 ffs_obj->desc_ready = false;
3711 ffs_obj->ffs_data = NULL;
3712
3713 if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) &&
3714 ffs_obj->ffs_closed_callback)
3715 ffs_obj->ffs_closed_callback(ffs);
3716
3717 if (ffs_obj->opts)
3718 opts = ffs_obj->opts;
3719 else
3720 goto done;
3721
3722 if (opts->no_configfs || !opts->func_inst.group.cg_item.ci_parent
3723 || !atomic_read(&opts->func_inst.group.cg_item.ci_kref.refcount))
3724 goto done;
3725
3726 ci = opts->func_inst.group.cg_item.ci_parent->ci_parent;
3727 ffs_dev_unlock();
3728
3729 if (test_bit(FFS_FL_BOUND, &ffs->flags))
3730 unregister_gadget_item(ci);
3731 return;
3732 done:
3733 ffs_dev_unlock();
3734 }
3735
3736 /* Misc helper functions ****************************************************/
3737
3738 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
3739 {
3740 return nonblock
3741 ? likely(mutex_trylock(mutex)) ? 0 : -EAGAIN
3742 : mutex_lock_interruptible(mutex);
3743 }
3744
3745 static char *ffs_prepare_buffer(const char __user *buf, size_t len)
3746 {
3747 char *data;
3748
3749 if (unlikely(!len))
3750 return NULL;
3751
3752 data = kmalloc(len, GFP_KERNEL);
3753 if (unlikely(!data))
3754 return ERR_PTR(-ENOMEM);
3755
3756 if (unlikely(copy_from_user(data, buf, len))) {
3757 kfree(data);
3758 return ERR_PTR(-EFAULT);
3759 }
3760
3761 pr_vdebug("Buffer from user space:\n");
3762 ffs_dump_mem("", data, len);
3763
3764 return data;
3765 }
3766
3767 DECLARE_USB_FUNCTION_INIT(ffs, ffs_alloc_inst, ffs_alloc);
3768 MODULE_LICENSE("GPL");
3769 MODULE_AUTHOR("Michal Nazarewicz");
Linux with added FPC-III support