f_fs.c 55 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460
  1. /*
  2. * f_fs.c -- user mode file system API for USB composite function controllers
  3. *
  4. * Copyright (C) 2010 Samsung Electronics
  5. * Author: Michal Nazarewicz <mina86@mina86.com>
  6. *
  7. * Based on inode.c (GadgetFS) which was:
  8. * Copyright (C) 2003-2004 David Brownell
  9. * Copyright (C) 2003 Agilent Technologies
  10. *
  11. * This program is free software; you can redistribute it and/or modify
  12. * it under the terms of the GNU General Public License as published by
  13. * the Free Software Foundation; either version 2 of the License, or
  14. * (at your option) any later version.
  15. */
  16. /* #define DEBUG */
  17. /* #define VERBOSE_DEBUG */
  18. #include <linux/blkdev.h>
  19. #include <linux/pagemap.h>
  20. #include <linux/export.h>
  21. #include <linux/hid.h>
  22. #include <asm/unaligned.h>
  23. #include <linux/usb/composite.h>
  24. #include <linux/usb/functionfs.h>
  25. #define FUNCTIONFS_MAGIC 0xa647361 /* Chosen by a honest dice roll ;) */
  26. /* Debugging ****************************************************************/
  27. #ifdef VERBOSE_DEBUG
  28. #ifndef pr_vdebug
  29. # define pr_vdebug pr_debug
  30. #endif /* pr_vdebug */
  31. # define ffs_dump_mem(prefix, ptr, len) \
  32. print_hex_dump_bytes(pr_fmt(prefix ": "), DUMP_PREFIX_NONE, ptr, len)
  33. #else
  34. #ifndef pr_vdebug
  35. # define pr_vdebug(...) do { } while (0)
  36. #endif /* pr_vdebug */
  37. # define ffs_dump_mem(prefix, ptr, len) do { } while (0)
  38. #endif /* VERBOSE_DEBUG */
  39. #define ENTER() pr_vdebug("%s()\n", __func__)
  40. /* The data structure and setup file ****************************************/
  41. enum ffs_state {
  42. /*
  43. * Waiting for descriptors and strings.
  44. *
  45. * In this state no open(2), read(2) or write(2) on epfiles
  46. * may succeed (which should not be the problem as there
  47. * should be no such files opened in the first place).
  48. */
  49. FFS_READ_DESCRIPTORS,
  50. FFS_READ_STRINGS,
  51. /*
  52. * We've got descriptors and strings. We are or have called
  53. * functionfs_ready_callback(). functionfs_bind() may have
  54. * been called but we don't know.
  55. *
  56. * This is the only state in which operations on epfiles may
  57. * succeed.
  58. */
  59. FFS_ACTIVE,
  60. /*
  61. * All endpoints have been closed. This state is also set if
  62. * we encounter an unrecoverable error. The only
  63. * unrecoverable error is situation when after reading strings
  64. * from user space we fail to initialise epfiles or
  65. * functionfs_ready_callback() returns with error (<0).
  66. *
  67. * In this state no open(2), read(2) or write(2) (both on ep0
  68. * as well as epfile) may succeed (at this point epfiles are
  69. * unlinked and all closed so this is not a problem; ep0 is
  70. * also closed but ep0 file exists and so open(2) on ep0 must
  71. * fail).
  72. */
  73. FFS_CLOSING
  74. };
  75. enum ffs_setup_state {
  76. /* There is no setup request pending. */
  77. FFS_NO_SETUP,
  78. /*
  79. * User has read events and there was a setup request event
  80. * there. The next read/write on ep0 will handle the
  81. * request.
  82. */
  83. FFS_SETUP_PENDING,
  84. /*
  85. * There was event pending but before user space handled it
  86. * some other event was introduced which canceled existing
  87. * setup. If this state is set read/write on ep0 return
  88. * -EIDRM. This state is only set when adding event.
  89. */
  90. FFS_SETUP_CANCELED
  91. };
  92. struct ffs_epfile;
  93. struct ffs_function;
  94. struct ffs_data {
  95. struct usb_gadget *gadget;
  96. /*
  97. * Protect access read/write operations, only one read/write
  98. * at a time. As a consequence protects ep0req and company.
  99. * While setup request is being processed (queued) this is
  100. * held.
  101. */
  102. struct mutex mutex;
  103. /*
  104. * Protect access to endpoint related structures (basically
  105. * usb_ep_queue(), usb_ep_dequeue(), etc. calls) except for
  106. * endpoint zero.
  107. */
  108. spinlock_t eps_lock;
  109. /*
  110. * XXX REVISIT do we need our own request? Since we are not
  111. * handling setup requests immediately user space may be so
  112. * slow that another setup will be sent to the gadget but this
  113. * time not to us but another function and then there could be
  114. * a race. Is that the case? Or maybe we can use cdev->req
  115. * after all, maybe we just need some spinlock for that?
  116. */
  117. struct usb_request *ep0req; /* P: mutex */
  118. struct completion ep0req_completion; /* P: mutex */
  119. int ep0req_status; /* P: mutex */
  120. /* reference counter */
  121. atomic_t ref;
  122. /* how many files are opened (EP0 and others) */
  123. atomic_t opened;
  124. /* EP0 state */
  125. enum ffs_state state;
  126. /*
  127. * Possible transitions:
  128. * + FFS_NO_SETUP -> FFS_SETUP_PENDING -- P: ev.waitq.lock
  129. * happens only in ep0 read which is P: mutex
  130. * + FFS_SETUP_PENDING -> FFS_NO_SETUP -- P: ev.waitq.lock
  131. * happens only in ep0 i/o which is P: mutex
  132. * + FFS_SETUP_PENDING -> FFS_SETUP_CANCELED -- P: ev.waitq.lock
  133. * + FFS_SETUP_CANCELED -> FFS_NO_SETUP -- cmpxchg
  134. */
  135. enum ffs_setup_state setup_state;
  136. #define FFS_SETUP_STATE(ffs) \
  137. ((enum ffs_setup_state)cmpxchg(&(ffs)->setup_state, \
  138. FFS_SETUP_CANCELED, FFS_NO_SETUP))
  139. /* Events & such. */
  140. struct {
  141. u8 types[4];
  142. unsigned short count;
  143. /* XXX REVISIT need to update it in some places, or do we? */
  144. unsigned short can_stall;
  145. struct usb_ctrlrequest setup;
  146. wait_queue_head_t waitq;
  147. } ev; /* the whole structure, P: ev.waitq.lock */
  148. /* Flags */
  149. unsigned long flags;
  150. #define FFS_FL_CALL_CLOSED_CALLBACK 0
  151. #define FFS_FL_BOUND 1
  152. /* Active function */
  153. struct ffs_function *func;
  154. /*
  155. * Device name, write once when file system is mounted.
  156. * Intended for user to read if she wants.
  157. */
  158. const char *dev_name;
  159. /* Private data for our user (ie. gadget). Managed by user. */
  160. void *private_data;
  161. /* filled by __ffs_data_got_descs() */
  162. /*
  163. * Real descriptors are 16 bytes after raw_descs (so you need
  164. * to skip 16 bytes (ie. ffs->raw_descs + 16) to get to the
  165. * first full speed descriptor). raw_descs_length and
  166. * raw_fs_descs_length do not have those 16 bytes added.
  167. */
  168. const void *raw_descs;
  169. unsigned raw_descs_length;
  170. unsigned raw_fs_descs_length;
  171. unsigned fs_descs_count;
  172. unsigned hs_descs_count;
  173. unsigned short strings_count;
  174. unsigned short interfaces_count;
  175. unsigned short eps_count;
  176. unsigned short _pad1;
  177. /* filled by __ffs_data_got_strings() */
  178. /* ids in stringtabs are set in functionfs_bind() */
  179. const void *raw_strings;
  180. struct usb_gadget_strings **stringtabs;
  181. /*
  182. * File system's super block, write once when file system is
  183. * mounted.
  184. */
  185. struct super_block *sb;
  186. /* File permissions, written once when fs is mounted */
  187. struct ffs_file_perms {
  188. umode_t mode;
  189. kuid_t uid;
  190. kgid_t gid;
  191. } file_perms;
  192. /*
  193. * The endpoint files, filled by ffs_epfiles_create(),
  194. * destroyed by ffs_epfiles_destroy().
  195. */
  196. struct ffs_epfile *epfiles;
  197. };
  198. /* Reference counter handling */
  199. static void ffs_data_get(struct ffs_data *ffs);
  200. static void ffs_data_put(struct ffs_data *ffs);
  201. /* Creates new ffs_data object. */
  202. static struct ffs_data *__must_check ffs_data_new(void) __attribute__((malloc));
  203. /* Opened counter handling. */
  204. static void ffs_data_opened(struct ffs_data *ffs);
  205. static void ffs_data_closed(struct ffs_data *ffs);
  206. /* Called with ffs->mutex held; take over ownership of data. */
  207. static int __must_check
  208. __ffs_data_got_descs(struct ffs_data *ffs, char *data, size_t len);
  209. static int __must_check
  210. __ffs_data_got_strings(struct ffs_data *ffs, char *data, size_t len);
  211. /* The function structure ***************************************************/
  212. struct ffs_ep;
  213. struct ffs_function {
  214. struct usb_configuration *conf;
  215. struct usb_gadget *gadget;
  216. struct ffs_data *ffs;
  217. struct ffs_ep *eps;
  218. u8 eps_revmap[16];
  219. short *interfaces_nums;
  220. struct usb_function function;
  221. };
  222. static struct ffs_function *ffs_func_from_usb(struct usb_function *f)
  223. {
  224. return container_of(f, struct ffs_function, function);
  225. }
  226. static void ffs_func_free(struct ffs_function *func);
  227. static void ffs_func_eps_disable(struct ffs_function *func);
  228. static int __must_check ffs_func_eps_enable(struct ffs_function *func);
  229. static int ffs_func_bind(struct usb_configuration *,
  230. struct usb_function *);
  231. static void ffs_func_unbind(struct usb_configuration *,
  232. struct usb_function *);
  233. static int ffs_func_set_alt(struct usb_function *, unsigned, unsigned);
  234. static void ffs_func_disable(struct usb_function *);
  235. static int ffs_func_setup(struct usb_function *,
  236. const struct usb_ctrlrequest *);
  237. static void ffs_func_suspend(struct usb_function *);
  238. static void ffs_func_resume(struct usb_function *);
  239. static int ffs_func_revmap_ep(struct ffs_function *func, u8 num);
  240. static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf);
  241. /* The endpoints structures *************************************************/
  242. struct ffs_ep {
  243. struct usb_ep *ep; /* P: ffs->eps_lock */
  244. struct usb_request *req; /* P: epfile->mutex */
  245. /* [0]: full speed, [1]: high speed */
  246. struct usb_endpoint_descriptor *descs[2];
  247. u8 num;
  248. int status; /* P: epfile->mutex */
  249. };
  250. struct ffs_epfile {
  251. /* Protects ep->ep and ep->req. */
  252. struct mutex mutex;
  253. wait_queue_head_t wait;
  254. struct ffs_data *ffs;
  255. struct ffs_ep *ep; /* P: ffs->eps_lock */
  256. struct dentry *dentry;
  257. char name[5];
  258. unsigned char in; /* P: ffs->eps_lock */
  259. unsigned char isoc; /* P: ffs->eps_lock */
  260. unsigned char _pad;
  261. };
  262. static int __must_check ffs_epfiles_create(struct ffs_data *ffs);
  263. static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count);
  264. static struct inode *__must_check
  265. ffs_sb_create_file(struct super_block *sb, const char *name, void *data,
  266. const struct file_operations *fops,
  267. struct dentry **dentry_p);
  268. /* Misc helper functions ****************************************************/
  269. static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
  270. __attribute__((warn_unused_result, nonnull));
  271. static char *ffs_prepare_buffer(const char __user *buf, size_t len)
  272. __attribute__((warn_unused_result, nonnull));
  273. /* Control file aka ep0 *****************************************************/
  274. static void ffs_ep0_complete(struct usb_ep *ep, struct usb_request *req)
  275. {
  276. struct ffs_data *ffs = req->context;
  277. complete_all(&ffs->ep0req_completion);
  278. }
  279. static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)
  280. {
  281. struct usb_request *req = ffs->ep0req;
  282. int ret;
  283. req->zero = len < le16_to_cpu(ffs->ev.setup.wLength);
  284. spin_unlock_irq(&ffs->ev.waitq.lock);
  285. req->buf = data;
  286. req->length = len;
  287. /*
  288. * UDC layer requires to provide a buffer even for ZLP, but should
  289. * not use it at all. Let's provide some poisoned pointer to catch
  290. * possible bug in the driver.
  291. */
  292. if (req->buf == NULL)
  293. req->buf = (void *)0xDEADBABE;
  294. reinit_completion(&ffs->ep0req_completion);
  295. ret = usb_ep_queue(ffs->gadget->ep0, req, GFP_ATOMIC);
  296. if (unlikely(ret < 0))
  297. return ret;
  298. ret = wait_for_completion_interruptible(&ffs->ep0req_completion);
  299. if (unlikely(ret)) {
  300. usb_ep_dequeue(ffs->gadget->ep0, req);
  301. return -EINTR;
  302. }
  303. ffs->setup_state = FFS_NO_SETUP;
  304. return ffs->ep0req_status;
  305. }
  306. static int __ffs_ep0_stall(struct ffs_data *ffs)
  307. {
  308. if (ffs->ev.can_stall) {
  309. pr_vdebug("ep0 stall\n");
  310. usb_ep_set_halt(ffs->gadget->ep0);
  311. ffs->setup_state = FFS_NO_SETUP;
  312. return -EL2HLT;
  313. } else {
  314. pr_debug("bogus ep0 stall!\n");
  315. return -ESRCH;
  316. }
  317. }
  318. static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
  319. size_t len, loff_t *ptr)
  320. {
  321. struct ffs_data *ffs = file->private_data;
  322. ssize_t ret;
  323. char *data;
  324. ENTER();
  325. /* Fast check if setup was canceled */
  326. if (FFS_SETUP_STATE(ffs) == FFS_SETUP_CANCELED)
  327. return -EIDRM;
  328. /* Acquire mutex */
  329. ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
  330. if (unlikely(ret < 0))
  331. return ret;
  332. /* Check state */
  333. switch (ffs->state) {
  334. case FFS_READ_DESCRIPTORS:
  335. case FFS_READ_STRINGS:
  336. /* Copy data */
  337. if (unlikely(len < 16)) {
  338. ret = -EINVAL;
  339. break;
  340. }
  341. data = ffs_prepare_buffer(buf, len);
  342. if (IS_ERR(data)) {
  343. ret = PTR_ERR(data);
  344. break;
  345. }
  346. /* Handle data */
  347. if (ffs->state == FFS_READ_DESCRIPTORS) {
  348. pr_info("read descriptors\n");
  349. ret = __ffs_data_got_descs(ffs, data, len);
  350. if (unlikely(ret < 0))
  351. break;
  352. ffs->state = FFS_READ_STRINGS;
  353. ret = len;
  354. } else {
  355. pr_info("read strings\n");
  356. ret = __ffs_data_got_strings(ffs, data, len);
  357. if (unlikely(ret < 0))
  358. break;
  359. ret = ffs_epfiles_create(ffs);
  360. if (unlikely(ret)) {
  361. ffs->state = FFS_CLOSING;
  362. break;
  363. }
  364. ffs->state = FFS_ACTIVE;
  365. mutex_unlock(&ffs->mutex);
  366. ret = functionfs_ready_callback(ffs);
  367. if (unlikely(ret < 0)) {
  368. ffs->state = FFS_CLOSING;
  369. return ret;
  370. }
  371. set_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags);
  372. return len;
  373. }
  374. break;
  375. case FFS_ACTIVE:
  376. data = NULL;
  377. /*
  378. * We're called from user space, we can use _irq
  379. * rather then _irqsave
  380. */
  381. spin_lock_irq(&ffs->ev.waitq.lock);
  382. switch (FFS_SETUP_STATE(ffs)) {
  383. case FFS_SETUP_CANCELED:
  384. ret = -EIDRM;
  385. goto done_spin;
  386. case FFS_NO_SETUP:
  387. ret = -ESRCH;
  388. goto done_spin;
  389. case FFS_SETUP_PENDING:
  390. break;
  391. }
  392. /* FFS_SETUP_PENDING */
  393. if (!(ffs->ev.setup.bRequestType & USB_DIR_IN)) {
  394. spin_unlock_irq(&ffs->ev.waitq.lock);
  395. ret = __ffs_ep0_stall(ffs);
  396. break;
  397. }
  398. /* FFS_SETUP_PENDING and not stall */
  399. len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength));
  400. spin_unlock_irq(&ffs->ev.waitq.lock);
  401. data = ffs_prepare_buffer(buf, len);
  402. if (IS_ERR(data)) {
  403. ret = PTR_ERR(data);
  404. break;
  405. }
  406. spin_lock_irq(&ffs->ev.waitq.lock);
  407. /*
  408. * We are guaranteed to be still in FFS_ACTIVE state
  409. * but the state of setup could have changed from
  410. * FFS_SETUP_PENDING to FFS_SETUP_CANCELED so we need
  411. * to check for that. If that happened we copied data
  412. * from user space in vain but it's unlikely.
  413. *
  414. * For sure we are not in FFS_NO_SETUP since this is
  415. * the only place FFS_SETUP_PENDING -> FFS_NO_SETUP
  416. * transition can be performed and it's protected by
  417. * mutex.
  418. */
  419. if (FFS_SETUP_STATE(ffs) == FFS_SETUP_CANCELED) {
  420. ret = -EIDRM;
  421. done_spin:
  422. spin_unlock_irq(&ffs->ev.waitq.lock);
  423. } else {
  424. /* unlocks spinlock */
  425. ret = __ffs_ep0_queue_wait(ffs, data, len);
  426. }
  427. kfree(data);
  428. break;
  429. default:
  430. ret = -EBADFD;
  431. break;
  432. }
  433. mutex_unlock(&ffs->mutex);
  434. return ret;
  435. }
  436. static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
  437. size_t n)
  438. {
  439. /*
  440. * We are holding ffs->ev.waitq.lock and ffs->mutex and we need
  441. * to release them.
  442. */
  443. struct usb_functionfs_event events[n];
  444. unsigned i = 0;
  445. memset(events, 0, sizeof events);
  446. do {
  447. events[i].type = ffs->ev.types[i];
  448. if (events[i].type == FUNCTIONFS_SETUP) {
  449. events[i].u.setup = ffs->ev.setup;
  450. ffs->setup_state = FFS_SETUP_PENDING;
  451. }
  452. } while (++i < n);
  453. if (n < ffs->ev.count) {
  454. ffs->ev.count -= n;
  455. memmove(ffs->ev.types, ffs->ev.types + n,
  456. ffs->ev.count * sizeof *ffs->ev.types);
  457. } else {
  458. ffs->ev.count = 0;
  459. }
  460. spin_unlock_irq(&ffs->ev.waitq.lock);
  461. mutex_unlock(&ffs->mutex);
  462. return unlikely(__copy_to_user(buf, events, sizeof events))
  463. ? -EFAULT : sizeof events;
  464. }
  465. static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
  466. size_t len, loff_t *ptr)
  467. {
  468. struct ffs_data *ffs = file->private_data;
  469. char *data = NULL;
  470. size_t n;
  471. int ret;
  472. ENTER();
  473. /* Fast check if setup was canceled */
  474. if (FFS_SETUP_STATE(ffs) == FFS_SETUP_CANCELED)
  475. return -EIDRM;
  476. /* Acquire mutex */
  477. ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
  478. if (unlikely(ret < 0))
  479. return ret;
  480. /* Check state */
  481. if (ffs->state != FFS_ACTIVE) {
  482. ret = -EBADFD;
  483. goto done_mutex;
  484. }
  485. /*
  486. * We're called from user space, we can use _irq rather then
  487. * _irqsave
  488. */
  489. spin_lock_irq(&ffs->ev.waitq.lock);
  490. switch (FFS_SETUP_STATE(ffs)) {
  491. case FFS_SETUP_CANCELED:
  492. ret = -EIDRM;
  493. break;
  494. case FFS_NO_SETUP:
  495. n = len / sizeof(struct usb_functionfs_event);
  496. if (unlikely(!n)) {
  497. ret = -EINVAL;
  498. break;
  499. }
  500. if ((file->f_flags & O_NONBLOCK) && !ffs->ev.count) {
  501. ret = -EAGAIN;
  502. break;
  503. }
  504. if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq,
  505. ffs->ev.count)) {
  506. ret = -EINTR;
  507. break;
  508. }
  509. return __ffs_ep0_read_events(ffs, buf,
  510. min(n, (size_t)ffs->ev.count));
  511. case FFS_SETUP_PENDING:
  512. if (ffs->ev.setup.bRequestType & USB_DIR_IN) {
  513. spin_unlock_irq(&ffs->ev.waitq.lock);
  514. ret = __ffs_ep0_stall(ffs);
  515. goto done_mutex;
  516. }
  517. len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength));
  518. spin_unlock_irq(&ffs->ev.waitq.lock);
  519. if (likely(len)) {
  520. data = kmalloc(len, GFP_KERNEL);
  521. if (unlikely(!data)) {
  522. ret = -ENOMEM;
  523. goto done_mutex;
  524. }
  525. }
  526. spin_lock_irq(&ffs->ev.waitq.lock);
  527. /* See ffs_ep0_write() */
  528. if (FFS_SETUP_STATE(ffs) == FFS_SETUP_CANCELED) {
  529. ret = -EIDRM;
  530. break;
  531. }
  532. /* unlocks spinlock */
  533. ret = __ffs_ep0_queue_wait(ffs, data, len);
  534. if (likely(ret > 0) && unlikely(__copy_to_user(buf, data, len)))
  535. ret = -EFAULT;
  536. goto done_mutex;
  537. default:
  538. ret = -EBADFD;
  539. break;
  540. }
  541. spin_unlock_irq(&ffs->ev.waitq.lock);
  542. done_mutex:
  543. mutex_unlock(&ffs->mutex);
  544. kfree(data);
  545. return ret;
  546. }
  547. static int ffs_ep0_open(struct inode *inode, struct file *file)
  548. {
  549. struct ffs_data *ffs = inode->i_private;
  550. ENTER();
  551. if (unlikely(ffs->state == FFS_CLOSING))
  552. return -EBUSY;
  553. file->private_data = ffs;
  554. ffs_data_opened(ffs);
  555. return 0;
  556. }
  557. static int ffs_ep0_release(struct inode *inode, struct file *file)
  558. {
  559. struct ffs_data *ffs = file->private_data;
  560. ENTER();
  561. ffs_data_closed(ffs);
  562. return 0;
  563. }
  564. static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
  565. {
  566. struct ffs_data *ffs = file->private_data;
  567. struct usb_gadget *gadget = ffs->gadget;
  568. long ret;
  569. ENTER();
  570. if (code == FUNCTIONFS_INTERFACE_REVMAP) {
  571. struct ffs_function *func = ffs->func;
  572. ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV;
  573. } else if (gadget && gadget->ops->ioctl) {
  574. ret = gadget->ops->ioctl(gadget, code, value);
  575. } else {
  576. ret = -ENOTTY;
  577. }
  578. return ret;
  579. }
  580. static const struct file_operations ffs_ep0_operations = {
  581. .llseek = no_llseek,
  582. .open = ffs_ep0_open,
  583. .write = ffs_ep0_write,
  584. .read = ffs_ep0_read,
  585. .release = ffs_ep0_release,
  586. .unlocked_ioctl = ffs_ep0_ioctl,
  587. };
  588. /* "Normal" endpoints operations ********************************************/
  589. static void ffs_epfile_io_complete(struct usb_ep *_ep, struct usb_request *req)
  590. {
  591. ENTER();
  592. if (likely(req->context)) {
  593. struct ffs_ep *ep = _ep->driver_data;
  594. ep->status = req->status ? req->status : req->actual;
  595. complete(req->context);
  596. }
  597. }
  598. static ssize_t ffs_epfile_io(struct file *file,
  599. char __user *buf, size_t len, int read)
  600. {
  601. struct ffs_epfile *epfile = file->private_data;
  602. struct ffs_ep *ep;
  603. char *data = NULL;
  604. ssize_t ret;
  605. int halt;
  606. goto first_try;
  607. do {
  608. spin_unlock_irq(&epfile->ffs->eps_lock);
  609. mutex_unlock(&epfile->mutex);
  610. first_try:
  611. /* Are we still active? */
  612. if (WARN_ON(epfile->ffs->state != FFS_ACTIVE)) {
  613. ret = -ENODEV;
  614. goto error;
  615. }
  616. /* Wait for endpoint to be enabled */
  617. ep = epfile->ep;
  618. if (!ep) {
  619. if (file->f_flags & O_NONBLOCK) {
  620. ret = -EAGAIN;
  621. goto error;
  622. }
  623. if (wait_event_interruptible(epfile->wait,
  624. (ep = epfile->ep))) {
  625. ret = -EINTR;
  626. goto error;
  627. }
  628. }
  629. /* Do we halt? */
  630. halt = !read == !epfile->in;
  631. if (halt && epfile->isoc) {
  632. ret = -EINVAL;
  633. goto error;
  634. }
  635. /* Allocate & copy */
  636. if (!halt && !data) {
  637. data = kzalloc(len, GFP_KERNEL);
  638. if (unlikely(!data))
  639. return -ENOMEM;
  640. if (!read &&
  641. unlikely(__copy_from_user(data, buf, len))) {
  642. ret = -EFAULT;
  643. goto error;
  644. }
  645. }
  646. /* We will be using request */
  647. ret = ffs_mutex_lock(&epfile->mutex,
  648. file->f_flags & O_NONBLOCK);
  649. if (unlikely(ret))
  650. goto error;
  651. /*
  652. * We're called from user space, we can use _irq rather then
  653. * _irqsave
  654. */
  655. spin_lock_irq(&epfile->ffs->eps_lock);
  656. /*
  657. * While we were acquiring mutex endpoint got disabled
  658. * or changed?
  659. */
  660. } while (unlikely(epfile->ep != ep));
  661. /* Halt */
  662. if (unlikely(halt)) {
  663. if (likely(epfile->ep == ep) && !WARN_ON(!ep->ep))
  664. usb_ep_set_halt(ep->ep);
  665. spin_unlock_irq(&epfile->ffs->eps_lock);
  666. ret = -EBADMSG;
  667. } else {
  668. /* Fire the request */
  669. DECLARE_COMPLETION_ONSTACK(done);
  670. struct usb_request *req = ep->req;
  671. req->context = &done;
  672. req->complete = ffs_epfile_io_complete;
  673. req->buf = data;
  674. req->length = len;
  675. ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
  676. spin_unlock_irq(&epfile->ffs->eps_lock);
  677. if (unlikely(ret < 0)) {
  678. /* nop */
  679. } else if (unlikely(wait_for_completion_interruptible(&done))) {
  680. ret = -EINTR;
  681. usb_ep_dequeue(ep->ep, req);
  682. } else {
  683. ret = ep->status;
  684. if (read && ret > 0 &&
  685. unlikely(copy_to_user(buf, data, ret)))
  686. ret = -EFAULT;
  687. }
  688. }
  689. mutex_unlock(&epfile->mutex);
  690. error:
  691. kfree(data);
  692. return ret;
  693. }
  694. static ssize_t
  695. ffs_epfile_write(struct file *file, const char __user *buf, size_t len,
  696. loff_t *ptr)
  697. {
  698. ENTER();
  699. return ffs_epfile_io(file, (char __user *)buf, len, 0);
  700. }
  701. static ssize_t
  702. ffs_epfile_read(struct file *file, char __user *buf, size_t len, loff_t *ptr)
  703. {
  704. ENTER();
  705. return ffs_epfile_io(file, buf, len, 1);
  706. }
  707. static int
  708. ffs_epfile_open(struct inode *inode, struct file *file)
  709. {
  710. struct ffs_epfile *epfile = inode->i_private;
  711. ENTER();
  712. if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
  713. return -ENODEV;
  714. file->private_data = epfile;
  715. ffs_data_opened(epfile->ffs);
  716. return 0;
  717. }
  718. static int
  719. ffs_epfile_release(struct inode *inode, struct file *file)
  720. {
  721. struct ffs_epfile *epfile = inode->i_private;
  722. ENTER();
  723. ffs_data_closed(epfile->ffs);
  724. return 0;
  725. }
  726. static long ffs_epfile_ioctl(struct file *file, unsigned code,
  727. unsigned long value)
  728. {
  729. struct ffs_epfile *epfile = file->private_data;
  730. int ret;
  731. ENTER();
  732. if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
  733. return -ENODEV;
  734. spin_lock_irq(&epfile->ffs->eps_lock);
  735. if (likely(epfile->ep)) {
  736. switch (code) {
  737. case FUNCTIONFS_FIFO_STATUS:
  738. ret = usb_ep_fifo_status(epfile->ep->ep);
  739. break;
  740. case FUNCTIONFS_FIFO_FLUSH:
  741. usb_ep_fifo_flush(epfile->ep->ep);
  742. ret = 0;
  743. break;
  744. case FUNCTIONFS_CLEAR_HALT:
  745. ret = usb_ep_clear_halt(epfile->ep->ep);
  746. break;
  747. case FUNCTIONFS_ENDPOINT_REVMAP:
  748. ret = epfile->ep->num;
  749. break;
  750. default:
  751. ret = -ENOTTY;
  752. }
  753. } else {
  754. ret = -ENODEV;
  755. }
  756. spin_unlock_irq(&epfile->ffs->eps_lock);
  757. return ret;
  758. }
  759. static const struct file_operations ffs_epfile_operations = {
  760. .llseek = no_llseek,
  761. .open = ffs_epfile_open,
  762. .write = ffs_epfile_write,
  763. .read = ffs_epfile_read,
  764. .release = ffs_epfile_release,
  765. .unlocked_ioctl = ffs_epfile_ioctl,
  766. };
  767. /* File system and super block operations ***********************************/
  768. /*
  769. * Mounting the file system creates a controller file, used first for
  770. * function configuration then later for event monitoring.
  771. */
  772. static struct inode *__must_check
  773. ffs_sb_make_inode(struct super_block *sb, void *data,
  774. const struct file_operations *fops,
  775. const struct inode_operations *iops,
  776. struct ffs_file_perms *perms)
  777. {
  778. struct inode *inode;
  779. ENTER();
  780. inode = new_inode(sb);
  781. if (likely(inode)) {
  782. struct timespec current_time = CURRENT_TIME;
  783. inode->i_ino = get_next_ino();
  784. inode->i_mode = perms->mode;
  785. inode->i_uid = perms->uid;
  786. inode->i_gid = perms->gid;
  787. inode->i_atime = current_time;
  788. inode->i_mtime = current_time;
  789. inode->i_ctime = current_time;
  790. inode->i_private = data;
  791. if (fops)
  792. inode->i_fop = fops;
  793. if (iops)
  794. inode->i_op = iops;
  795. }
  796. return inode;
  797. }
  798. /* Create "regular" file */
  799. static struct inode *ffs_sb_create_file(struct super_block *sb,
  800. const char *name, void *data,
  801. const struct file_operations *fops,
  802. struct dentry **dentry_p)
  803. {
  804. struct ffs_data *ffs = sb->s_fs_info;
  805. struct dentry *dentry;
  806. struct inode *inode;
  807. ENTER();
  808. dentry = d_alloc_name(sb->s_root, name);
  809. if (unlikely(!dentry))
  810. return NULL;
  811. inode = ffs_sb_make_inode(sb, data, fops, NULL, &ffs->file_perms);
  812. if (unlikely(!inode)) {
  813. dput(dentry);
  814. return NULL;
  815. }
  816. d_add(dentry, inode);
  817. if (dentry_p)
  818. *dentry_p = dentry;
  819. return inode;
  820. }
  821. /* Super block */
  822. static const struct super_operations ffs_sb_operations = {
  823. .statfs = simple_statfs,
  824. .drop_inode = generic_delete_inode,
  825. };
  826. struct ffs_sb_fill_data {
  827. struct ffs_file_perms perms;
  828. umode_t root_mode;
  829. const char *dev_name;
  830. struct ffs_data *ffs_data;
  831. };
  832. static int ffs_sb_fill(struct super_block *sb, void *_data, int silent)
  833. {
  834. struct ffs_sb_fill_data *data = _data;
  835. struct inode *inode;
  836. struct ffs_data *ffs = data->ffs_data;
  837. ENTER();
  838. ffs->sb = sb;
  839. data->ffs_data = NULL;
  840. sb->s_fs_info = ffs;
  841. sb->s_blocksize = PAGE_CACHE_SIZE;
  842. sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
  843. sb->s_magic = FUNCTIONFS_MAGIC;
  844. sb->s_op = &ffs_sb_operations;
  845. sb->s_time_gran = 1;
  846. /* Root inode */
  847. data->perms.mode = data->root_mode;
  848. inode = ffs_sb_make_inode(sb, NULL,
  849. &simple_dir_operations,
  850. &simple_dir_inode_operations,
  851. &data->perms);
  852. sb->s_root = d_make_root(inode);
  853. if (unlikely(!sb->s_root))
  854. return -ENOMEM;
  855. /* EP0 file */
  856. if (unlikely(!ffs_sb_create_file(sb, "ep0", ffs,
  857. &ffs_ep0_operations, NULL)))
  858. return -ENOMEM;
  859. return 0;
  860. }
  861. static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
  862. {
  863. ENTER();
  864. if (!opts || !*opts)
  865. return 0;
  866. for (;;) {
  867. unsigned long value;
  868. char *eq, *comma;
  869. /* Option limit */
  870. comma = strchr(opts, ',');
  871. if (comma)
  872. *comma = 0;
  873. /* Value limit */
  874. eq = strchr(opts, '=');
  875. if (unlikely(!eq)) {
  876. pr_err("'=' missing in %s\n", opts);
  877. return -EINVAL;
  878. }
  879. *eq = 0;
  880. /* Parse value */
  881. if (kstrtoul(eq + 1, 0, &value)) {
  882. pr_err("%s: invalid value: %s\n", opts, eq + 1);
  883. return -EINVAL;
  884. }
  885. /* Interpret option */
  886. switch (eq - opts) {
  887. case 5:
  888. if (!memcmp(opts, "rmode", 5))
  889. data->root_mode = (value & 0555) | S_IFDIR;
  890. else if (!memcmp(opts, "fmode", 5))
  891. data->perms.mode = (value & 0666) | S_IFREG;
  892. else
  893. goto invalid;
  894. break;
  895. case 4:
  896. if (!memcmp(opts, "mode", 4)) {
  897. data->root_mode = (value & 0555) | S_IFDIR;
  898. data->perms.mode = (value & 0666) | S_IFREG;
  899. } else {
  900. goto invalid;
  901. }
  902. break;
  903. case 3:
  904. if (!memcmp(opts, "uid", 3)) {
  905. data->perms.uid = make_kuid(current_user_ns(), value);
  906. if (!uid_valid(data->perms.uid)) {
  907. pr_err("%s: unmapped value: %lu\n", opts, value);
  908. return -EINVAL;
  909. }
  910. } else if (!memcmp(opts, "gid", 3)) {
  911. data->perms.gid = make_kgid(current_user_ns(), value);
  912. if (!gid_valid(data->perms.gid)) {
  913. pr_err("%s: unmapped value: %lu\n", opts, value);
  914. return -EINVAL;
  915. }
  916. } else {
  917. goto invalid;
  918. }
  919. break;
  920. default:
  921. invalid:
  922. pr_err("%s: invalid option\n", opts);
  923. return -EINVAL;
  924. }
  925. /* Next iteration */
  926. if (!comma)
  927. break;
  928. opts = comma + 1;
  929. }
  930. return 0;
  931. }
  932. /* "mount -t functionfs dev_name /dev/function" ends up here */
  933. static struct dentry *
  934. ffs_fs_mount(struct file_system_type *t, int flags,
  935. const char *dev_name, void *opts)
  936. {
  937. struct ffs_sb_fill_data data = {
  938. .perms = {
  939. .mode = S_IFREG | 0600,
  940. .uid = GLOBAL_ROOT_UID,
  941. .gid = GLOBAL_ROOT_GID,
  942. },
  943. .root_mode = S_IFDIR | 0500,
  944. };
  945. struct dentry *rv;
  946. int ret;
  947. void *ffs_dev;
  948. struct ffs_data *ffs;
  949. ENTER();
  950. ret = ffs_fs_parse_opts(&data, opts);
  951. if (unlikely(ret < 0))
  952. return ERR_PTR(ret);
  953. ffs = ffs_data_new();
  954. if (unlikely(!ffs))
  955. return ERR_PTR(-ENOMEM);
  956. ffs->file_perms = data.perms;
  957. ffs->dev_name = kstrdup(dev_name, GFP_KERNEL);
  958. if (unlikely(!ffs->dev_name)) {
  959. ffs_data_put(ffs);
  960. return ERR_PTR(-ENOMEM);
  961. }
  962. ffs_dev = functionfs_acquire_dev_callback(dev_name);
  963. if (IS_ERR(ffs_dev)) {
  964. ffs_data_put(ffs);
  965. return ERR_CAST(ffs_dev);
  966. }
  967. ffs->private_data = ffs_dev;
  968. data.ffs_data = ffs;
  969. rv = mount_nodev(t, flags, &data, ffs_sb_fill);
  970. if (IS_ERR(rv) && data.ffs_data) {
  971. functionfs_release_dev_callback(data.ffs_data);
  972. ffs_data_put(data.ffs_data);
  973. }
  974. return rv;
  975. }
  976. static void
  977. ffs_fs_kill_sb(struct super_block *sb)
  978. {
  979. ENTER();
  980. kill_litter_super(sb);
  981. if (sb->s_fs_info) {
  982. functionfs_release_dev_callback(sb->s_fs_info);
  983. ffs_data_put(sb->s_fs_info);
  984. }
  985. }
  986. static struct file_system_type ffs_fs_type = {
  987. .owner = THIS_MODULE,
  988. .name = "functionfs",
  989. .mount = ffs_fs_mount,
  990. .kill_sb = ffs_fs_kill_sb,
  991. };
  992. MODULE_ALIAS_FS("functionfs");
  993. /* Driver's main init/cleanup functions *************************************/
  994. static int functionfs_init(void)
  995. {
  996. int ret;
  997. ENTER();
  998. ret = register_filesystem(&ffs_fs_type);
  999. if (likely(!ret))
  1000. pr_info("file system registered\n");
  1001. else
  1002. pr_err("failed registering file system (%d)\n", ret);
  1003. return ret;
  1004. }
  1005. static void functionfs_cleanup(void)
  1006. {
  1007. ENTER();
  1008. pr_info("unloading\n");
  1009. unregister_filesystem(&ffs_fs_type);
  1010. }
  1011. /* ffs_data and ffs_function construction and destruction code **************/
  1012. static void ffs_data_clear(struct ffs_data *ffs);
  1013. static void ffs_data_reset(struct ffs_data *ffs);
  1014. static void ffs_data_get(struct ffs_data *ffs)
  1015. {
  1016. ENTER();
  1017. atomic_inc(&ffs->ref);
  1018. }
  1019. static void ffs_data_opened(struct ffs_data *ffs)
  1020. {
  1021. ENTER();
  1022. atomic_inc(&ffs->ref);
  1023. atomic_inc(&ffs->opened);
  1024. }
  1025. static void ffs_data_put(struct ffs_data *ffs)
  1026. {
  1027. ENTER();
  1028. if (unlikely(atomic_dec_and_test(&ffs->ref))) {
  1029. pr_info("%s(): freeing\n", __func__);
  1030. ffs_data_clear(ffs);
  1031. BUG_ON(waitqueue_active(&ffs->ev.waitq) ||
  1032. waitqueue_active(&ffs->ep0req_completion.wait));
  1033. kfree(ffs->dev_name);
  1034. kfree(ffs);
  1035. }
  1036. }
  1037. static void ffs_data_closed(struct ffs_data *ffs)
  1038. {
  1039. ENTER();
  1040. if (atomic_dec_and_test(&ffs->opened)) {
  1041. ffs->state = FFS_CLOSING;
  1042. ffs_data_reset(ffs);
  1043. }
  1044. ffs_data_put(ffs);
  1045. }
  1046. static struct ffs_data *ffs_data_new(void)
  1047. {
  1048. struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
  1049. if (unlikely(!ffs))
  1050. return 0;
  1051. ENTER();
  1052. atomic_set(&ffs->ref, 1);
  1053. atomic_set(&ffs->opened, 0);
  1054. ffs->state = FFS_READ_DESCRIPTORS;
  1055. mutex_init(&ffs->mutex);
  1056. spin_lock_init(&ffs->eps_lock);
  1057. init_waitqueue_head(&ffs->ev.waitq);
  1058. init_completion(&ffs->ep0req_completion);
  1059. /* XXX REVISIT need to update it in some places, or do we? */
  1060. ffs->ev.can_stall = 1;
  1061. return ffs;
  1062. }
  1063. static void ffs_data_clear(struct ffs_data *ffs)
  1064. {
  1065. ENTER();
  1066. if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags))
  1067. functionfs_closed_callback(ffs);
  1068. BUG_ON(ffs->gadget);
  1069. if (ffs->epfiles)
  1070. ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count);
  1071. kfree(ffs->raw_descs);
  1072. kfree(ffs->raw_strings);
  1073. kfree(ffs->stringtabs);
  1074. }
  1075. static void ffs_data_reset(struct ffs_data *ffs)
  1076. {
  1077. ENTER();
  1078. ffs_data_clear(ffs);
  1079. ffs->epfiles = NULL;
  1080. ffs->raw_descs = NULL;
  1081. ffs->raw_strings = NULL;
  1082. ffs->stringtabs = NULL;
  1083. ffs->raw_descs_length = 0;
  1084. ffs->raw_fs_descs_length = 0;
  1085. ffs->fs_descs_count = 0;
  1086. ffs->hs_descs_count = 0;
  1087. ffs->strings_count = 0;
  1088. ffs->interfaces_count = 0;
  1089. ffs->eps_count = 0;
  1090. ffs->ev.count = 0;
  1091. ffs->state = FFS_READ_DESCRIPTORS;
  1092. ffs->setup_state = FFS_NO_SETUP;
  1093. ffs->flags = 0;
  1094. }
  1095. static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
  1096. {
  1097. struct usb_gadget_strings **lang;
  1098. int first_id;
  1099. ENTER();
  1100. if (WARN_ON(ffs->state != FFS_ACTIVE
  1101. || test_and_set_bit(FFS_FL_BOUND, &ffs->flags)))
  1102. return -EBADFD;
  1103. first_id = usb_string_ids_n(cdev, ffs->strings_count);
  1104. if (unlikely(first_id < 0))
  1105. return first_id;
  1106. ffs->ep0req = usb_ep_alloc_request(cdev->gadget->ep0, GFP_KERNEL);
  1107. if (unlikely(!ffs->ep0req))
  1108. return -ENOMEM;
  1109. ffs->ep0req->complete = ffs_ep0_complete;
  1110. ffs->ep0req->context = ffs;
  1111. lang = ffs->stringtabs;
  1112. for (lang = ffs->stringtabs; *lang; ++lang) {
  1113. struct usb_string *str = (*lang)->strings;
  1114. int id = first_id;
  1115. for (; str->s; ++id, ++str)
  1116. str->id = id;
  1117. }
  1118. ffs->gadget = cdev->gadget;
  1119. ffs_data_get(ffs);
  1120. return 0;
  1121. }
  1122. static void functionfs_unbind(struct ffs_data *ffs)
  1123. {
  1124. ENTER();
  1125. if (!WARN_ON(!ffs->gadget)) {
  1126. usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req);
  1127. ffs->ep0req = NULL;
  1128. ffs->gadget = NULL;
  1129. clear_bit(FFS_FL_BOUND, &ffs->flags);
  1130. ffs_data_put(ffs);
  1131. }
  1132. }
  1133. static int ffs_epfiles_create(struct ffs_data *ffs)
  1134. {
  1135. struct ffs_epfile *epfile, *epfiles;
  1136. unsigned i, count;
  1137. ENTER();
  1138. count = ffs->eps_count;
  1139. epfiles = kcalloc(count, sizeof(*epfiles), GFP_KERNEL);
  1140. if (!epfiles)
  1141. return -ENOMEM;
  1142. epfile = epfiles;
  1143. for (i = 1; i <= count; ++i, ++epfile) {
  1144. epfile->ffs = ffs;
  1145. mutex_init(&epfile->mutex);
  1146. init_waitqueue_head(&epfile->wait);
  1147. sprintf(epfiles->name, "ep%u", i);
  1148. if (!unlikely(ffs_sb_create_file(ffs->sb, epfiles->name, epfile,
  1149. &ffs_epfile_operations,
  1150. &epfile->dentry))) {
  1151. ffs_epfiles_destroy(epfiles, i - 1);
  1152. return -ENOMEM;
  1153. }
  1154. }
  1155. ffs->epfiles = epfiles;
  1156. return 0;
  1157. }
  1158. static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count)
  1159. {
  1160. struct ffs_epfile *epfile = epfiles;
  1161. ENTER();
  1162. for (; count; --count, ++epfile) {
  1163. BUG_ON(mutex_is_locked(&epfile->mutex) ||
  1164. waitqueue_active(&epfile->wait));
  1165. if (epfile->dentry) {
  1166. d_delete(epfile->dentry);
  1167. dput(epfile->dentry);
  1168. epfile->dentry = NULL;
  1169. }
  1170. }
  1171. kfree(epfiles);
  1172. }
  1173. static int functionfs_bind_config(struct usb_composite_dev *cdev,
  1174. struct usb_configuration *c,
  1175. struct ffs_data *ffs)
  1176. {
  1177. struct ffs_function *func;
  1178. int ret;
  1179. ENTER();
  1180. func = kzalloc(sizeof *func, GFP_KERNEL);
  1181. if (unlikely(!func))
  1182. return -ENOMEM;
  1183. func->function.name = "Function FS Gadget";
  1184. func->function.strings = ffs->stringtabs;
  1185. func->function.bind = ffs_func_bind;
  1186. func->function.unbind = ffs_func_unbind;
  1187. func->function.set_alt = ffs_func_set_alt;
  1188. func->function.disable = ffs_func_disable;
  1189. func->function.setup = ffs_func_setup;
  1190. func->function.suspend = ffs_func_suspend;
  1191. func->function.resume = ffs_func_resume;
  1192. func->conf = c;
  1193. func->gadget = cdev->gadget;
  1194. func->ffs = ffs;
  1195. ffs_data_get(ffs);
  1196. ret = usb_add_function(c, &func->function);
  1197. if (unlikely(ret))
  1198. ffs_func_free(func);
  1199. return ret;
  1200. }
  1201. static void ffs_func_free(struct ffs_function *func)
  1202. {
  1203. struct ffs_ep *ep = func->eps;
  1204. unsigned count = func->ffs->eps_count;
  1205. unsigned long flags;
  1206. ENTER();
  1207. /* cleanup after autoconfig */
  1208. spin_lock_irqsave(&func->ffs->eps_lock, flags);
  1209. do {
  1210. if (ep->ep && ep->req)
  1211. usb_ep_free_request(ep->ep, ep->req);
  1212. ep->req = NULL;
  1213. ++ep;
  1214. } while (--count);
  1215. spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
  1216. ffs_data_put(func->ffs);
  1217. kfree(func->eps);
  1218. /*
  1219. * eps and interfaces_nums are allocated in the same chunk so
  1220. * only one free is required. Descriptors are also allocated
  1221. * in the same chunk.
  1222. */
  1223. kfree(func);
  1224. }
  1225. static void ffs_func_eps_disable(struct ffs_function *func)
  1226. {
  1227. struct ffs_ep *ep = func->eps;
  1228. struct ffs_epfile *epfile = func->ffs->epfiles;
  1229. unsigned count = func->ffs->eps_count;
  1230. unsigned long flags;
  1231. spin_lock_irqsave(&func->ffs->eps_lock, flags);
  1232. do {
  1233. /* pending requests get nuked */
  1234. if (likely(ep->ep))
  1235. usb_ep_disable(ep->ep);
  1236. epfile->ep = NULL;
  1237. ++ep;
  1238. ++epfile;
  1239. } while (--count);
  1240. spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
  1241. }
  1242. static int ffs_func_eps_enable(struct ffs_function *func)
  1243. {
  1244. struct ffs_data *ffs = func->ffs;
  1245. struct ffs_ep *ep = func->eps;
  1246. struct ffs_epfile *epfile = ffs->epfiles;
  1247. unsigned count = ffs->eps_count;
  1248. unsigned long flags;
  1249. int ret = 0;
  1250. spin_lock_irqsave(&func->ffs->eps_lock, flags);
  1251. do {
  1252. struct usb_endpoint_descriptor *ds;
  1253. ds = ep->descs[ep->descs[1] ? 1 : 0];
  1254. ep->ep->driver_data = ep;
  1255. ep->ep->desc = ds;
  1256. ret = usb_ep_enable(ep->ep);
  1257. if (likely(!ret)) {
  1258. epfile->ep = ep;
  1259. epfile->in = usb_endpoint_dir_in(ds);
  1260. epfile->isoc = usb_endpoint_xfer_isoc(ds);
  1261. } else {
  1262. break;
  1263. }
  1264. wake_up(&epfile->wait);
  1265. ++ep;
  1266. ++epfile;
  1267. } while (--count);
  1268. spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
  1269. return ret;
  1270. }
  1271. /* Parsing and building descriptors and strings *****************************/
  1272. /*
  1273. * This validates if data pointed by data is a valid USB descriptor as
  1274. * well as record how many interfaces, endpoints and strings are
  1275. * required by given configuration. Returns address after the
  1276. * descriptor or NULL if data is invalid.
  1277. */
  1278. enum ffs_entity_type {
  1279. FFS_DESCRIPTOR, FFS_INTERFACE, FFS_STRING, FFS_ENDPOINT
  1280. };
  1281. typedef int (*ffs_entity_callback)(enum ffs_entity_type entity,
  1282. u8 *valuep,
  1283. struct usb_descriptor_header *desc,
  1284. void *priv);
  1285. static int __must_check ffs_do_desc(char *data, unsigned len,
  1286. ffs_entity_callback entity, void *priv)
  1287. {
  1288. struct usb_descriptor_header *_ds = (void *)data;
  1289. u8 length;
  1290. int ret;
  1291. ENTER();
  1292. /* At least two bytes are required: length and type */
  1293. if (len < 2) {
  1294. pr_vdebug("descriptor too short\n");
  1295. return -EINVAL;
  1296. }
  1297. /* If we have at least as many bytes as the descriptor takes? */
  1298. length = _ds->bLength;
  1299. if (len < length) {
  1300. pr_vdebug("descriptor longer then available data\n");
  1301. return -EINVAL;
  1302. }
  1303. #define __entity_check_INTERFACE(val) 1
  1304. #define __entity_check_STRING(val) (val)
  1305. #define __entity_check_ENDPOINT(val) ((val) & USB_ENDPOINT_NUMBER_MASK)
  1306. #define __entity(type, val) do { \
  1307. pr_vdebug("entity " #type "(%02x)\n", (val)); \
  1308. if (unlikely(!__entity_check_ ##type(val))) { \
  1309. pr_vdebug("invalid entity's value\n"); \
  1310. return -EINVAL; \
  1311. } \
  1312. ret = entity(FFS_ ##type, &val, _ds, priv); \
  1313. if (unlikely(ret < 0)) { \
  1314. pr_debug("entity " #type "(%02x); ret = %d\n", \
  1315. (val), ret); \
  1316. return ret; \
  1317. } \
  1318. } while (0)
  1319. /* Parse descriptor depending on type. */
  1320. switch (_ds->bDescriptorType) {
  1321. case USB_DT_DEVICE:
  1322. case USB_DT_CONFIG:
  1323. case USB_DT_STRING:
  1324. case USB_DT_DEVICE_QUALIFIER:
  1325. /* function can't have any of those */
  1326. pr_vdebug("descriptor reserved for gadget: %d\n",
  1327. _ds->bDescriptorType);
  1328. return -EINVAL;
  1329. case USB_DT_INTERFACE: {
  1330. struct usb_interface_descriptor *ds = (void *)_ds;
  1331. pr_vdebug("interface descriptor\n");
  1332. if (length != sizeof *ds)
  1333. goto inv_length;
  1334. __entity(INTERFACE, ds->bInterfaceNumber);
  1335. if (ds->iInterface)
  1336. __entity(STRING, ds->iInterface);
  1337. }
  1338. break;
  1339. case USB_DT_ENDPOINT: {
  1340. struct usb_endpoint_descriptor *ds = (void *)_ds;
  1341. pr_vdebug("endpoint descriptor\n");
  1342. if (length != USB_DT_ENDPOINT_SIZE &&
  1343. length != USB_DT_ENDPOINT_AUDIO_SIZE)
  1344. goto inv_length;
  1345. __entity(ENDPOINT, ds->bEndpointAddress);
  1346. }
  1347. break;
  1348. case HID_DT_HID:
  1349. pr_vdebug("hid descriptor\n");
  1350. if (length != sizeof(struct hid_descriptor))
  1351. goto inv_length;
  1352. break;
  1353. case USB_DT_OTG:
  1354. if (length != sizeof(struct usb_otg_descriptor))
  1355. goto inv_length;
  1356. break;
  1357. case USB_DT_INTERFACE_ASSOCIATION: {
  1358. struct usb_interface_assoc_descriptor *ds = (void *)_ds;
  1359. pr_vdebug("interface association descriptor\n");
  1360. if (length != sizeof *ds)
  1361. goto inv_length;
  1362. if (ds->iFunction)
  1363. __entity(STRING, ds->iFunction);
  1364. }
  1365. break;
  1366. case USB_DT_OTHER_SPEED_CONFIG:
  1367. case USB_DT_INTERFACE_POWER:
  1368. case USB_DT_DEBUG:
  1369. case USB_DT_SECURITY:
  1370. case USB_DT_CS_RADIO_CONTROL:
  1371. /* TODO */
  1372. pr_vdebug("unimplemented descriptor: %d\n", _ds->bDescriptorType);
  1373. return -EINVAL;
  1374. default:
  1375. /* We should never be here */
  1376. pr_vdebug("unknown descriptor: %d\n", _ds->bDescriptorType);
  1377. return -EINVAL;
  1378. inv_length:
  1379. pr_vdebug("invalid length: %d (descriptor %d)\n",
  1380. _ds->bLength, _ds->bDescriptorType);
  1381. return -EINVAL;
  1382. }
  1383. #undef __entity
  1384. #undef __entity_check_DESCRIPTOR
  1385. #undef __entity_check_INTERFACE
  1386. #undef __entity_check_STRING
  1387. #undef __entity_check_ENDPOINT
  1388. return length;
  1389. }
  1390. static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len,
  1391. ffs_entity_callback entity, void *priv)
  1392. {
  1393. const unsigned _len = len;
  1394. unsigned long num = 0;
  1395. ENTER();
  1396. for (;;) {
  1397. int ret;
  1398. if (num == count)
  1399. data = NULL;
  1400. /* Record "descriptor" entity */
  1401. ret = entity(FFS_DESCRIPTOR, (u8 *)num, (void *)data, priv);
  1402. if (unlikely(ret < 0)) {
  1403. pr_debug("entity DESCRIPTOR(%02lx); ret = %d\n",
  1404. num, ret);
  1405. return ret;
  1406. }
  1407. if (!data)
  1408. return _len - len;
  1409. ret = ffs_do_desc(data, len, entity, priv);
  1410. if (unlikely(ret < 0)) {
  1411. pr_debug("%s returns %d\n", __func__, ret);
  1412. return ret;
  1413. }
  1414. len -= ret;
  1415. data += ret;
  1416. ++num;
  1417. }
  1418. }
  1419. static int __ffs_data_do_entity(enum ffs_entity_type type,
  1420. u8 *valuep, struct usb_descriptor_header *desc,
  1421. void *priv)
  1422. {
  1423. struct ffs_data *ffs = priv;
  1424. ENTER();
  1425. switch (type) {
  1426. case FFS_DESCRIPTOR:
  1427. break;
  1428. case FFS_INTERFACE:
  1429. /*
  1430. * Interfaces are indexed from zero so if we
  1431. * encountered interface "n" then there are at least
  1432. * "n+1" interfaces.
  1433. */
  1434. if (*valuep >= ffs->interfaces_count)
  1435. ffs->interfaces_count = *valuep + 1;
  1436. break;
  1437. case FFS_STRING:
  1438. /*
  1439. * Strings are indexed from 1 (0 is magic ;) reserved
  1440. * for languages list or some such)
  1441. */
  1442. if (*valuep > ffs->strings_count)
  1443. ffs->strings_count = *valuep;
  1444. break;
  1445. case FFS_ENDPOINT:
  1446. /* Endpoints are indexed from 1 as well. */
  1447. if ((*valuep & USB_ENDPOINT_NUMBER_MASK) > ffs->eps_count)
  1448. ffs->eps_count = (*valuep & USB_ENDPOINT_NUMBER_MASK);
  1449. break;
  1450. }
  1451. return 0;
  1452. }
  1453. static int __ffs_data_got_descs(struct ffs_data *ffs,
  1454. char *const _data, size_t len)
  1455. {
  1456. unsigned fs_count, hs_count;
  1457. int fs_len, ret = -EINVAL;
  1458. char *data = _data;
  1459. ENTER();
  1460. if (unlikely(get_unaligned_le32(data) != FUNCTIONFS_DESCRIPTORS_MAGIC ||
  1461. get_unaligned_le32(data + 4) != len))
  1462. goto error;
  1463. fs_count = get_unaligned_le32(data + 8);
  1464. hs_count = get_unaligned_le32(data + 12);
  1465. if (!fs_count && !hs_count)
  1466. goto einval;
  1467. data += 16;
  1468. len -= 16;
  1469. if (likely(fs_count)) {
  1470. fs_len = ffs_do_descs(fs_count, data, len,
  1471. __ffs_data_do_entity, ffs);
  1472. if (unlikely(fs_len < 0)) {
  1473. ret = fs_len;
  1474. goto error;
  1475. }
  1476. data += fs_len;
  1477. len -= fs_len;
  1478. } else {
  1479. fs_len = 0;
  1480. }
  1481. if (likely(hs_count)) {
  1482. ret = ffs_do_descs(hs_count, data, len,
  1483. __ffs_data_do_entity, ffs);
  1484. if (unlikely(ret < 0))
  1485. goto error;
  1486. } else {
  1487. ret = 0;
  1488. }
  1489. if (unlikely(len != ret))
  1490. goto einval;
  1491. ffs->raw_fs_descs_length = fs_len;
  1492. ffs->raw_descs_length = fs_len + ret;
  1493. ffs->raw_descs = _data;
  1494. ffs->fs_descs_count = fs_count;
  1495. ffs->hs_descs_count = hs_count;
  1496. return 0;
  1497. einval:
  1498. ret = -EINVAL;
  1499. error:
  1500. kfree(_data);
  1501. return ret;
  1502. }
  1503. static int __ffs_data_got_strings(struct ffs_data *ffs,
  1504. char *const _data, size_t len)
  1505. {
  1506. u32 str_count, needed_count, lang_count;
  1507. struct usb_gadget_strings **stringtabs, *t;
  1508. struct usb_string *strings, *s;
  1509. const char *data = _data;
  1510. ENTER();
  1511. if (unlikely(get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
  1512. get_unaligned_le32(data + 4) != len))
  1513. goto error;
  1514. str_count = get_unaligned_le32(data + 8);
  1515. lang_count = get_unaligned_le32(data + 12);
  1516. /* if one is zero the other must be zero */
  1517. if (unlikely(!str_count != !lang_count))
  1518. goto error;
  1519. /* Do we have at least as many strings as descriptors need? */
  1520. needed_count = ffs->strings_count;
  1521. if (unlikely(str_count < needed_count))
  1522. goto error;
  1523. /*
  1524. * If we don't need any strings just return and free all
  1525. * memory.
  1526. */
  1527. if (!needed_count) {
  1528. kfree(_data);
  1529. return 0;
  1530. }
  1531. /* Allocate everything in one chunk so there's less maintenance. */
  1532. {
  1533. struct {
  1534. struct usb_gadget_strings *stringtabs[lang_count + 1];
  1535. struct usb_gadget_strings stringtab[lang_count];
  1536. struct usb_string strings[lang_count*(needed_count+1)];
  1537. } *d;
  1538. unsigned i = 0;
  1539. d = kmalloc(sizeof *d, GFP_KERNEL);
  1540. if (unlikely(!d)) {
  1541. kfree(_data);
  1542. return -ENOMEM;
  1543. }
  1544. stringtabs = d->stringtabs;
  1545. t = d->stringtab;
  1546. i = lang_count;
  1547. do {
  1548. *stringtabs++ = t++;
  1549. } while (--i);
  1550. *stringtabs = NULL;
  1551. stringtabs = d->stringtabs;
  1552. t = d->stringtab;
  1553. s = d->strings;
  1554. strings = s;
  1555. }
  1556. /* For each language */
  1557. data += 16;
  1558. len -= 16;
  1559. do { /* lang_count > 0 so we can use do-while */
  1560. unsigned needed = needed_count;
  1561. if (unlikely(len < 3))
  1562. goto error_free;
  1563. t->language = get_unaligned_le16(data);
  1564. t->strings = s;
  1565. ++t;
  1566. data += 2;
  1567. len -= 2;
  1568. /* For each string */
  1569. do { /* str_count > 0 so we can use do-while */
  1570. size_t length = strnlen(data, len);
  1571. if (unlikely(length == len))
  1572. goto error_free;
  1573. /*
  1574. * User may provide more strings then we need,
  1575. * if that's the case we simply ignore the
  1576. * rest
  1577. */
  1578. if (likely(needed)) {
  1579. /*
  1580. * s->id will be set while adding
  1581. * function to configuration so for
  1582. * now just leave garbage here.
  1583. */
  1584. s->s = data;
  1585. --needed;
  1586. ++s;
  1587. }
  1588. data += length + 1;
  1589. len -= length + 1;
  1590. } while (--str_count);
  1591. s->id = 0; /* terminator */
  1592. s->s = NULL;
  1593. ++s;
  1594. } while (--lang_count);
  1595. /* Some garbage left? */
  1596. if (unlikely(len))
  1597. goto error_free;
  1598. /* Done! */
  1599. ffs->stringtabs = stringtabs;
  1600. ffs->raw_strings = _data;
  1601. return 0;
  1602. error_free:
  1603. kfree(stringtabs);
  1604. error:
  1605. kfree(_data);
  1606. return -EINVAL;
  1607. }
  1608. /* Events handling and management *******************************************/
  1609. static void __ffs_event_add(struct ffs_data *ffs,
  1610. enum usb_functionfs_event_type type)
  1611. {
  1612. enum usb_functionfs_event_type rem_type1, rem_type2 = type;
  1613. int neg = 0;
  1614. /*
  1615. * Abort any unhandled setup
  1616. *
  1617. * We do not need to worry about some cmpxchg() changing value
  1618. * of ffs->setup_state without holding the lock because when
  1619. * state is FFS_SETUP_PENDING cmpxchg() in several places in
  1620. * the source does nothing.
  1621. */
  1622. if (ffs->setup_state == FFS_SETUP_PENDING)
  1623. ffs->setup_state = FFS_SETUP_CANCELED;
  1624. switch (type) {
  1625. case FUNCTIONFS_RESUME:
  1626. rem_type2 = FUNCTIONFS_SUSPEND;
  1627. /* FALL THROUGH */
  1628. case FUNCTIONFS_SUSPEND:
  1629. case FUNCTIONFS_SETUP:
  1630. rem_type1 = type;
  1631. /* Discard all similar events */
  1632. break;
  1633. case FUNCTIONFS_BIND:
  1634. case FUNCTIONFS_UNBIND:
  1635. case FUNCTIONFS_DISABLE:
  1636. case FUNCTIONFS_ENABLE:
  1637. /* Discard everything other then power management. */
  1638. rem_type1 = FUNCTIONFS_SUSPEND;
  1639. rem_type2 = FUNCTIONFS_RESUME;
  1640. neg = 1;
  1641. break;
  1642. default:
  1643. BUG();
  1644. }
  1645. {
  1646. u8 *ev = ffs->ev.types, *out = ev;
  1647. unsigned n = ffs->ev.count;
  1648. for (; n; --n, ++ev)
  1649. if ((*ev == rem_type1 || *ev == rem_type2) == neg)
  1650. *out++ = *ev;
  1651. else
  1652. pr_vdebug("purging event %d\n", *ev);
  1653. ffs->ev.count = out - ffs->ev.types;
  1654. }
  1655. pr_vdebug("adding event %d\n", type);
  1656. ffs->ev.types[ffs->ev.count++] = type;
  1657. wake_up_locked(&ffs->ev.waitq);
  1658. }
  1659. static void ffs_event_add(struct ffs_data *ffs,
  1660. enum usb_functionfs_event_type type)
  1661. {
  1662. unsigned long flags;
  1663. spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
  1664. __ffs_event_add(ffs, type);
  1665. spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
  1666. }
  1667. /* Bind/unbind USB function hooks *******************************************/
  1668. static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep,
  1669. struct usb_descriptor_header *desc,
  1670. void *priv)
  1671. {
  1672. struct usb_endpoint_descriptor *ds = (void *)desc;
  1673. struct ffs_function *func = priv;
  1674. struct ffs_ep *ffs_ep;
  1675. /*
  1676. * If hs_descriptors is not NULL then we are reading hs
  1677. * descriptors now
  1678. */
  1679. const int isHS = func->function.hs_descriptors != NULL;
  1680. unsigned idx;
  1681. if (type != FFS_DESCRIPTOR)
  1682. return 0;
  1683. if (isHS)
  1684. func->function.hs_descriptors[(long)valuep] = desc;
  1685. else
  1686. func->function.fs_descriptors[(long)valuep] = desc;
  1687. if (!desc || desc->bDescriptorType != USB_DT_ENDPOINT)
  1688. return 0;
  1689. idx = (ds->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK) - 1;
  1690. ffs_ep = func->eps + idx;
  1691. if (unlikely(ffs_ep->descs[isHS])) {
  1692. pr_vdebug("two %sspeed descriptors for EP %d\n",
  1693. isHS ? "high" : "full",
  1694. ds->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
  1695. return -EINVAL;
  1696. }
  1697. ffs_ep->descs[isHS] = ds;
  1698. ffs_dump_mem(": Original ep desc", ds, ds->bLength);
  1699. if (ffs_ep->ep) {
  1700. ds->bEndpointAddress = ffs_ep->descs[0]->bEndpointAddress;
  1701. if (!ds->wMaxPacketSize)
  1702. ds->wMaxPacketSize = ffs_ep->descs[0]->wMaxPacketSize;
  1703. } else {
  1704. struct usb_request *req;
  1705. struct usb_ep *ep;
  1706. pr_vdebug("autoconfig\n");
  1707. ep = usb_ep_autoconfig(func->gadget, ds);
  1708. if (unlikely(!ep))
  1709. return -ENOTSUPP;
  1710. ep->driver_data = func->eps + idx;
  1711. req = usb_ep_alloc_request(ep, GFP_KERNEL);
  1712. if (unlikely(!req))
  1713. return -ENOMEM;
  1714. ffs_ep->ep = ep;
  1715. ffs_ep->req = req;
  1716. func->eps_revmap[ds->bEndpointAddress &
  1717. USB_ENDPOINT_NUMBER_MASK] = idx + 1;
  1718. }
  1719. ffs_dump_mem(": Rewritten ep desc", ds, ds->bLength);
  1720. return 0;
  1721. }
  1722. static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep,
  1723. struct usb_descriptor_header *desc,
  1724. void *priv)
  1725. {
  1726. struct ffs_function *func = priv;
  1727. unsigned idx;
  1728. u8 newValue;
  1729. switch (type) {
  1730. default:
  1731. case FFS_DESCRIPTOR:
  1732. /* Handled in previous pass by __ffs_func_bind_do_descs() */
  1733. return 0;
  1734. case FFS_INTERFACE:
  1735. idx = *valuep;
  1736. if (func->interfaces_nums[idx] < 0) {
  1737. int id = usb_interface_id(func->conf, &func->function);
  1738. if (unlikely(id < 0))
  1739. return id;
  1740. func->interfaces_nums[idx] = id;
  1741. }
  1742. newValue = func->interfaces_nums[idx];
  1743. break;
  1744. case FFS_STRING:
  1745. /* String' IDs are allocated when fsf_data is bound to cdev */
  1746. newValue = func->ffs->stringtabs[0]->strings[*valuep - 1].id;
  1747. break;
  1748. case FFS_ENDPOINT:
  1749. /*
  1750. * USB_DT_ENDPOINT are handled in
  1751. * __ffs_func_bind_do_descs().
  1752. */
  1753. if (desc->bDescriptorType == USB_DT_ENDPOINT)
  1754. return 0;
  1755. idx = (*valuep & USB_ENDPOINT_NUMBER_MASK) - 1;
  1756. if (unlikely(!func->eps[idx].ep))
  1757. return -EINVAL;
  1758. {
  1759. struct usb_endpoint_descriptor **descs;
  1760. descs = func->eps[idx].descs;
  1761. newValue = descs[descs[0] ? 0 : 1]->bEndpointAddress;
  1762. }
  1763. break;
  1764. }
  1765. pr_vdebug("%02x -> %02x\n", *valuep, newValue);
  1766. *valuep = newValue;
  1767. return 0;
  1768. }
  1769. static int ffs_func_bind(struct usb_configuration *c,
  1770. struct usb_function *f)
  1771. {
  1772. struct ffs_function *func = ffs_func_from_usb(f);
  1773. struct ffs_data *ffs = func->ffs;
  1774. const int full = !!func->ffs->fs_descs_count;
  1775. const int high = gadget_is_dualspeed(func->gadget) &&
  1776. func->ffs->hs_descs_count;
  1777. int ret;
  1778. /* Make it a single chunk, less management later on */
  1779. struct {
  1780. struct ffs_ep eps[ffs->eps_count];
  1781. struct usb_descriptor_header
  1782. *fs_descs[full ? ffs->fs_descs_count + 1 : 0];
  1783. struct usb_descriptor_header
  1784. *hs_descs[high ? ffs->hs_descs_count + 1 : 0];
  1785. short inums[ffs->interfaces_count];
  1786. char raw_descs[high ? ffs->raw_descs_length
  1787. : ffs->raw_fs_descs_length];
  1788. } *data;
  1789. ENTER();
  1790. /* Only high speed but not supported by gadget? */
  1791. if (unlikely(!(full | high)))
  1792. return -ENOTSUPP;
  1793. /* Allocate */
  1794. data = kmalloc(sizeof *data, GFP_KERNEL);
  1795. if (unlikely(!data))
  1796. return -ENOMEM;
  1797. /* Zero */
  1798. memset(data->eps, 0, sizeof data->eps);
  1799. memcpy(data->raw_descs, ffs->raw_descs + 16, sizeof data->raw_descs);
  1800. memset(data->inums, 0xff, sizeof data->inums);
  1801. for (ret = ffs->eps_count; ret; --ret)
  1802. data->eps[ret].num = -1;
  1803. /* Save pointers */
  1804. func->eps = data->eps;
  1805. func->interfaces_nums = data->inums;
  1806. /*
  1807. * Go through all the endpoint descriptors and allocate
  1808. * endpoints first, so that later we can rewrite the endpoint
  1809. * numbers without worrying that it may be described later on.
  1810. */
  1811. if (likely(full)) {
  1812. func->function.fs_descriptors = data->fs_descs;
  1813. ret = ffs_do_descs(ffs->fs_descs_count,
  1814. data->raw_descs,
  1815. sizeof data->raw_descs,
  1816. __ffs_func_bind_do_descs, func);
  1817. if (unlikely(ret < 0))
  1818. goto error;
  1819. } else {
  1820. ret = 0;
  1821. }
  1822. if (likely(high)) {
  1823. func->function.hs_descriptors = data->hs_descs;
  1824. ret = ffs_do_descs(ffs->hs_descs_count,
  1825. data->raw_descs + ret,
  1826. (sizeof data->raw_descs) - ret,
  1827. __ffs_func_bind_do_descs, func);
  1828. if (unlikely(ret < 0))
  1829. goto error;
  1830. }
  1831. /*
  1832. * Now handle interface numbers allocation and interface and
  1833. * endpoint numbers rewriting. We can do that in one go
  1834. * now.
  1835. */
  1836. ret = ffs_do_descs(ffs->fs_descs_count +
  1837. (high ? ffs->hs_descs_count : 0),
  1838. data->raw_descs, sizeof data->raw_descs,
  1839. __ffs_func_bind_do_nums, func);
  1840. if (unlikely(ret < 0))
  1841. goto error;
  1842. /* And we're done */
  1843. ffs_event_add(ffs, FUNCTIONFS_BIND);
  1844. return 0;
  1845. error:
  1846. /* XXX Do we need to release all claimed endpoints here? */
  1847. return ret;
  1848. }
  1849. /* Other USB function hooks *************************************************/
  1850. static void ffs_func_unbind(struct usb_configuration *c,
  1851. struct usb_function *f)
  1852. {
  1853. struct ffs_function *func = ffs_func_from_usb(f);
  1854. struct ffs_data *ffs = func->ffs;
  1855. ENTER();
  1856. if (ffs->func == func) {
  1857. ffs_func_eps_disable(func);
  1858. ffs->func = NULL;
  1859. }
  1860. ffs_event_add(ffs, FUNCTIONFS_UNBIND);
  1861. ffs_func_free(func);
  1862. }
  1863. static int ffs_func_set_alt(struct usb_function *f,
  1864. unsigned interface, unsigned alt)
  1865. {
  1866. struct ffs_function *func = ffs_func_from_usb(f);
  1867. struct ffs_data *ffs = func->ffs;
  1868. int ret = 0, intf;
  1869. if (alt != (unsigned)-1) {
  1870. intf = ffs_func_revmap_intf(func, interface);
  1871. if (unlikely(intf < 0))
  1872. return intf;
  1873. }
  1874. if (ffs->func)
  1875. ffs_func_eps_disable(ffs->func);
  1876. if (ffs->state != FFS_ACTIVE)
  1877. return -ENODEV;
  1878. if (alt == (unsigned)-1) {
  1879. ffs->func = NULL;
  1880. ffs_event_add(ffs, FUNCTIONFS_DISABLE);
  1881. return 0;
  1882. }
  1883. ffs->func = func;
  1884. ret = ffs_func_eps_enable(func);
  1885. if (likely(ret >= 0))
  1886. ffs_event_add(ffs, FUNCTIONFS_ENABLE);
  1887. return ret;
  1888. }
  1889. static void ffs_func_disable(struct usb_function *f)
  1890. {
  1891. ffs_func_set_alt(f, 0, (unsigned)-1);
  1892. }
  1893. static int ffs_func_setup(struct usb_function *f,
  1894. const struct usb_ctrlrequest *creq)
  1895. {
  1896. struct ffs_function *func = ffs_func_from_usb(f);
  1897. struct ffs_data *ffs = func->ffs;
  1898. unsigned long flags;
  1899. int ret;
  1900. ENTER();
  1901. pr_vdebug("creq->bRequestType = %02x\n", creq->bRequestType);
  1902. pr_vdebug("creq->bRequest = %02x\n", creq->bRequest);
  1903. pr_vdebug("creq->wValue = %04x\n", le16_to_cpu(creq->wValue));
  1904. pr_vdebug("creq->wIndex = %04x\n", le16_to_cpu(creq->wIndex));
  1905. pr_vdebug("creq->wLength = %04x\n", le16_to_cpu(creq->wLength));
  1906. /*
  1907. * Most requests directed to interface go through here
  1908. * (notable exceptions are set/get interface) so we need to
  1909. * handle them. All other either handled by composite or
  1910. * passed to usb_configuration->setup() (if one is set). No
  1911. * matter, we will handle requests directed to endpoint here
  1912. * as well (as it's straightforward) but what to do with any
  1913. * other request?
  1914. */
  1915. if (ffs->state != FFS_ACTIVE)
  1916. return -ENODEV;
  1917. switch (creq->bRequestType & USB_RECIP_MASK) {
  1918. case USB_RECIP_INTERFACE:
  1919. ret = ffs_func_revmap_intf(func, le16_to_cpu(creq->wIndex));
  1920. if (unlikely(ret < 0))
  1921. return ret;
  1922. break;
  1923. case USB_RECIP_ENDPOINT:
  1924. ret = ffs_func_revmap_ep(func, le16_to_cpu(creq->wIndex));
  1925. if (unlikely(ret < 0))
  1926. return ret;
  1927. break;
  1928. default:
  1929. return -EOPNOTSUPP;
  1930. }
  1931. spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
  1932. ffs->ev.setup = *creq;
  1933. ffs->ev.setup.wIndex = cpu_to_le16(ret);
  1934. __ffs_event_add(ffs, FUNCTIONFS_SETUP);
  1935. spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
  1936. return 0;
  1937. }
  1938. static void ffs_func_suspend(struct usb_function *f)
  1939. {
  1940. ENTER();
  1941. ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_SUSPEND);
  1942. }
  1943. static void ffs_func_resume(struct usb_function *f)
  1944. {
  1945. ENTER();
  1946. ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_RESUME);
  1947. }
  1948. /* Endpoint and interface numbers reverse mapping ***************************/
  1949. static int ffs_func_revmap_ep(struct ffs_function *func, u8 num)
  1950. {
  1951. num = func->eps_revmap[num & USB_ENDPOINT_NUMBER_MASK];
  1952. return num ? num : -EDOM;
  1953. }
  1954. static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf)
  1955. {
  1956. short *nums = func->interfaces_nums;
  1957. unsigned count = func->ffs->interfaces_count;
  1958. for (; count; --count, ++nums) {
  1959. if (*nums >= 0 && *nums == intf)
  1960. return nums - func->interfaces_nums;
  1961. }
  1962. return -EDOM;
  1963. }
  1964. /* Misc helper functions ****************************************************/
  1965. static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
  1966. {
  1967. return nonblock
  1968. ? likely(mutex_trylock(mutex)) ? 0 : -EAGAIN
  1969. : mutex_lock_interruptible(mutex);
  1970. }
  1971. static char *ffs_prepare_buffer(const char __user *buf, size_t len)
  1972. {
  1973. char *data;
  1974. if (unlikely(!len))
  1975. return NULL;
  1976. data = kmalloc(len, GFP_KERNEL);
  1977. if (unlikely(!data))
  1978. return ERR_PTR(-ENOMEM);
  1979. if (unlikely(__copy_from_user(data, buf, len))) {
  1980. kfree(data);
  1981. return ERR_PTR(-EFAULT);
  1982. }
  1983. pr_vdebug("Buffer from user space:\n");
  1984. ffs_dump_mem("", data, len);
  1985. return data;
  1986. }