1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21#include <linux/blkdev.h>
22#include <linux/pagemap.h>
23#include <linux/export.h>
24#include <linux/hid.h>
25#include <linux/module.h>
26#include <linux/uio.h>
27#include <asm/unaligned.h>
28
29#include <linux/usb/composite.h>
30#include <linux/usb/functionfs.h>
31
32#include <linux/aio.h>
33#include <linux/mmu_context.h>
34#include <linux/poll.h>
35#include <linux/eventfd.h>
36
37#include "u_fs.h"
38#include "u_f.h"
39#include "u_os_desc.h"
40#include "configfs.h"
41
42#define FUNCTIONFS_MAGIC 0xa647361
43
44
45static void ffs_data_get(struct ffs_data *ffs);
46static void ffs_data_put(struct ffs_data *ffs);
47
48static struct ffs_data *__must_check ffs_data_new(void) __attribute__((malloc));
49
50
51static void ffs_data_opened(struct ffs_data *ffs);
52static void ffs_data_closed(struct ffs_data *ffs);
53
54
55static int __must_check
56__ffs_data_got_descs(struct ffs_data *ffs, char *data, size_t len);
57static int __must_check
58__ffs_data_got_strings(struct ffs_data *ffs, char *data, size_t len);
59
60
61
62
63struct ffs_ep;
64
65struct ffs_function {
66 struct usb_configuration *conf;
67 struct usb_gadget *gadget;
68 struct ffs_data *ffs;
69
70 struct ffs_ep *eps;
71 u8 eps_revmap[16];
72 short *interfaces_nums;
73
74 struct usb_function function;
75};
76
77
78static struct ffs_function *ffs_func_from_usb(struct usb_function *f)
79{
80 return container_of(f, struct ffs_function, function);
81}
82
83
84static inline enum ffs_setup_state
85ffs_setup_state_clear_cancelled(struct ffs_data *ffs)
86{
87 return (enum ffs_setup_state)
88 cmpxchg(&ffs->setup_state, FFS_SETUP_CANCELLED, FFS_NO_SETUP);
89}
90
91
92static void ffs_func_eps_disable(struct ffs_function *func);
93static int __must_check ffs_func_eps_enable(struct ffs_function *func);
94
95static int ffs_func_bind(struct usb_configuration *,
96 struct usb_function *);
97static int ffs_func_set_alt(struct usb_function *, unsigned, unsigned);
98static void ffs_func_disable(struct usb_function *);
99static int ffs_func_setup(struct usb_function *,
100 const struct usb_ctrlrequest *);
101static void ffs_func_suspend(struct usb_function *);
102static void ffs_func_resume(struct usb_function *);
103
104
105static int ffs_func_revmap_ep(struct ffs_function *func, u8 num);
106static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf);
107
108
109
110
111struct ffs_ep {
112 struct usb_ep *ep;
113 struct usb_request *req;
114
115
116 struct usb_endpoint_descriptor *descs[3];
117
118 u8 num;
119
120 int status;
121};
122
123struct ffs_epfile {
124
125 struct mutex mutex;
126 wait_queue_head_t wait;
127
128 struct ffs_data *ffs;
129 struct ffs_ep *ep;
130
131 struct dentry *dentry;
132
133
134
135
136
137 struct ffs_buffer *read_buffer;
138
139 char name[5];
140
141 unsigned char in;
142 unsigned char isoc;
143
144 unsigned char _pad;
145};
146
147struct ffs_buffer {
148 size_t length;
149 char *data;
150 char storage[];
151};
152
153
154
155struct ffs_io_data {
156 bool aio;
157 bool read;
158
159 struct kiocb *kiocb;
160 struct iov_iter data;
161 const void *to_free;
162 char *buf;
163
164 struct mm_struct *mm;
165 struct work_struct work;
166
167 struct usb_ep *ep;
168 struct usb_request *req;
169
170 struct ffs_data *ffs;
171};
172
173struct ffs_desc_helper {
174 struct ffs_data *ffs;
175 unsigned interfaces_count;
176 unsigned eps_count;
177};
178
179static int __must_check ffs_epfiles_create(struct ffs_data *ffs);
180static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count);
181
182static struct dentry *
183ffs_sb_create_file(struct super_block *sb, const char *name, void *data,
184 const struct file_operations *fops);
185
186
187
188DEFINE_MUTEX(ffs_lock);
189EXPORT_SYMBOL_GPL(ffs_lock);
190
191static struct ffs_dev *_ffs_find_dev(const char *name);
192static struct ffs_dev *_ffs_alloc_dev(void);
193static int _ffs_name_dev(struct ffs_dev *dev, const char *name);
194static void _ffs_free_dev(struct ffs_dev *dev);
195static void *ffs_acquire_dev(const char *dev_name);
196static void ffs_release_dev(struct ffs_data *ffs_data);
197static int ffs_ready(struct ffs_data *ffs);
198static void ffs_closed(struct ffs_data *ffs);
199
200
201
202static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
203 __attribute__((warn_unused_result, nonnull));
204static char *ffs_prepare_buffer(const char __user *buf, size_t len)
205 __attribute__((warn_unused_result, nonnull));
206
207
208
209
210static void ffs_ep0_complete(struct usb_ep *ep, struct usb_request *req)
211{
212 struct ffs_data *ffs = req->context;
213
214 complete_all(&ffs->ep0req_completion);
215}
216
217static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)
218{
219 struct usb_request *req = ffs->ep0req;
220 int ret;
221
222 req->zero = len < le16_to_cpu(ffs->ev.setup.wLength);
223
224 spin_unlock_irq(&ffs->ev.waitq.lock);
225
226 req->buf = data;
227 req->length = len;
228
229
230
231
232
233
234 if (req->buf == NULL)
235 req->buf = (void *)0xDEADBABE;
236
237 reinit_completion(&ffs->ep0req_completion);
238
239 ret = usb_ep_queue(ffs->gadget->ep0, req, GFP_ATOMIC);
240 if (unlikely(ret < 0))
241 return ret;
242
243 ret = wait_for_completion_interruptible(&ffs->ep0req_completion);
244 if (unlikely(ret)) {
245 usb_ep_dequeue(ffs->gadget->ep0, req);
246 return -EINTR;
247 }
248
249 ffs->setup_state = FFS_NO_SETUP;
250 return req->status ? req->status : req->actual;
251}
252
253static int __ffs_ep0_stall(struct ffs_data *ffs)
254{
255 if (ffs->ev.can_stall) {
256 pr_vdebug("ep0 stall\n");
257 usb_ep_set_halt(ffs->gadget->ep0);
258 ffs->setup_state = FFS_NO_SETUP;
259 return -EL2HLT;
260 } else {
261 pr_debug("bogus ep0 stall!\n");
262 return -ESRCH;
263 }
264}
265
266static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
267 size_t len, loff_t *ptr)
268{
269 struct ffs_data *ffs = file->private_data;
270 ssize_t ret;
271 char *data;
272
273 ENTER();
274
275
276 if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
277 return -EIDRM;
278
279
280 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
281 if (unlikely(ret < 0))
282 return ret;
283
284
285 switch (ffs->state) {
286 case FFS_READ_DESCRIPTORS:
287 case FFS_READ_STRINGS:
288
289 if (unlikely(len < 16)) {
290 ret = -EINVAL;
291 break;
292 }
293
294 data = ffs_prepare_buffer(buf, len);
295 if (IS_ERR(data)) {
296 ret = PTR_ERR(data);
297 break;
298 }
299
300
301 if (ffs->state == FFS_READ_DESCRIPTORS) {
302 pr_info("read descriptors\n");
303 ret = __ffs_data_got_descs(ffs, data, len);
304 if (unlikely(ret < 0))
305 break;
306
307 ffs->state = FFS_READ_STRINGS;
308 ret = len;
309 } else {
310 pr_info("read strings\n");
311 ret = __ffs_data_got_strings(ffs, data, len);
312 if (unlikely(ret < 0))
313 break;
314
315 ret = ffs_epfiles_create(ffs);
316 if (unlikely(ret)) {
317 ffs->state = FFS_CLOSING;
318 break;
319 }
320
321 ffs->state = FFS_ACTIVE;
322 mutex_unlock(&ffs->mutex);
323
324 ret = ffs_ready(ffs);
325 if (unlikely(ret < 0)) {
326 ffs->state = FFS_CLOSING;
327 return ret;
328 }
329
330 return len;
331 }
332 break;
333
334 case FFS_ACTIVE:
335 data = NULL;
336
337
338
339
340 spin_lock_irq(&ffs->ev.waitq.lock);
341 switch (ffs_setup_state_clear_cancelled(ffs)) {
342 case FFS_SETUP_CANCELLED:
343 ret = -EIDRM;
344 goto done_spin;
345
346 case FFS_NO_SETUP:
347 ret = -ESRCH;
348 goto done_spin;
349
350 case FFS_SETUP_PENDING:
351 break;
352 }
353
354
355 if (!(ffs->ev.setup.bRequestType & USB_DIR_IN)) {
356 spin_unlock_irq(&ffs->ev.waitq.lock);
357 ret = __ffs_ep0_stall(ffs);
358 break;
359 }
360
361
362 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength));
363
364 spin_unlock_irq(&ffs->ev.waitq.lock);
365
366 data = ffs_prepare_buffer(buf, len);
367 if (IS_ERR(data)) {
368 ret = PTR_ERR(data);
369 break;
370 }
371
372 spin_lock_irq(&ffs->ev.waitq.lock);
373
374
375
376
377
378
379
380
381
382
383
384
385
386 if (ffs_setup_state_clear_cancelled(ffs) ==
387 FFS_SETUP_CANCELLED) {
388 ret = -EIDRM;
389done_spin:
390 spin_unlock_irq(&ffs->ev.waitq.lock);
391 } else {
392
393 ret = __ffs_ep0_queue_wait(ffs, data, len);
394 }
395 kfree(data);
396 break;
397
398 default:
399 ret = -EBADFD;
400 break;
401 }
402
403 mutex_unlock(&ffs->mutex);
404 return ret;
405}
406
407
408static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
409 size_t n)
410{
411
412
413
414
415
416 struct usb_functionfs_event events[ARRAY_SIZE(ffs->ev.types)];
417 const size_t size = n * sizeof *events;
418 unsigned i = 0;
419
420 memset(events, 0, size);
421
422 do {
423 events[i].type = ffs->ev.types[i];
424 if (events[i].type == FUNCTIONFS_SETUP) {
425 events[i].u.setup = ffs->ev.setup;
426 ffs->setup_state = FFS_SETUP_PENDING;
427 }
428 } while (++i < n);
429
430 ffs->ev.count -= n;
431 if (ffs->ev.count)
432 memmove(ffs->ev.types, ffs->ev.types + n,
433 ffs->ev.count * sizeof *ffs->ev.types);
434
435 spin_unlock_irq(&ffs->ev.waitq.lock);
436 mutex_unlock(&ffs->mutex);
437
438 return unlikely(copy_to_user(buf, events, size)) ? -EFAULT : size;
439}
440
441static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
442 size_t len, loff_t *ptr)
443{
444 struct ffs_data *ffs = file->private_data;
445 char *data = NULL;
446 size_t n;
447 int ret;
448
449 ENTER();
450
451
452 if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
453 return -EIDRM;
454
455
456 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
457 if (unlikely(ret < 0))
458 return ret;
459
460
461 if (ffs->state != FFS_ACTIVE) {
462 ret = -EBADFD;
463 goto done_mutex;
464 }
465
466
467
468
469
470 spin_lock_irq(&ffs->ev.waitq.lock);
471
472 switch (ffs_setup_state_clear_cancelled(ffs)) {
473 case FFS_SETUP_CANCELLED:
474 ret = -EIDRM;
475 break;
476
477 case FFS_NO_SETUP:
478 n = len / sizeof(struct usb_functionfs_event);
479 if (unlikely(!n)) {
480 ret = -EINVAL;
481 break;
482 }
483
484 if ((file->f_flags & O_NONBLOCK) && !ffs->ev.count) {
485 ret = -EAGAIN;
486 break;
487 }
488
489 if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq,
490 ffs->ev.count)) {
491 ret = -EINTR;
492 break;
493 }
494
495 return __ffs_ep0_read_events(ffs, buf,
496 min(n, (size_t)ffs->ev.count));
497
498 case FFS_SETUP_PENDING:
499 if (ffs->ev.setup.bRequestType & USB_DIR_IN) {
500 spin_unlock_irq(&ffs->ev.waitq.lock);
501 ret = __ffs_ep0_stall(ffs);
502 goto done_mutex;
503 }
504
505 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength));
506
507 spin_unlock_irq(&ffs->ev.waitq.lock);
508
509 if (likely(len)) {
510 data = kmalloc(len, GFP_KERNEL);
511 if (unlikely(!data)) {
512 ret = -ENOMEM;
513 goto done_mutex;
514 }
515 }
516
517 spin_lock_irq(&ffs->ev.waitq.lock);
518
519
520 if (ffs_setup_state_clear_cancelled(ffs) ==
521 FFS_SETUP_CANCELLED) {
522 ret = -EIDRM;
523 break;
524 }
525
526
527 ret = __ffs_ep0_queue_wait(ffs, data, len);
528 if (likely(ret > 0) && unlikely(copy_to_user(buf, data, len)))
529 ret = -EFAULT;
530 goto done_mutex;
531
532 default:
533 ret = -EBADFD;
534 break;
535 }
536
537 spin_unlock_irq(&ffs->ev.waitq.lock);
538done_mutex:
539 mutex_unlock(&ffs->mutex);
540 kfree(data);
541 return ret;
542}
543
544static int ffs_ep0_open(struct inode *inode, struct file *file)
545{
546 struct ffs_data *ffs = inode->i_private;
547
548 ENTER();
549
550 if (unlikely(ffs->state == FFS_CLOSING))
551 return -EBUSY;
552
553 file->private_data = ffs;
554 ffs_data_opened(ffs);
555
556 return 0;
557}
558
559static int ffs_ep0_release(struct inode *inode, struct file *file)
560{
561 struct ffs_data *ffs = file->private_data;
562
563 ENTER();
564
565 ffs_data_closed(ffs);
566
567 return 0;
568}
569
570static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
571{
572 struct ffs_data *ffs = file->private_data;
573 struct usb_gadget *gadget = ffs->gadget;
574 long ret;
575
576 ENTER();
577
578 if (code == FUNCTIONFS_INTERFACE_REVMAP) {
579 struct ffs_function *func = ffs->func;
580 ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV;
581 } else if (gadget && gadget->ops->ioctl) {
582 ret = gadget->ops->ioctl(gadget, code, value);
583 } else {
584 ret = -ENOTTY;
585 }
586
587 return ret;
588}
589
590static unsigned int ffs_ep0_poll(struct file *file, poll_table *wait)
591{
592 struct ffs_data *ffs = file->private_data;
593 unsigned int mask = POLLWRNORM;
594 int ret;
595
596 poll_wait(file, &ffs->ev.waitq, wait);
597
598 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
599 if (unlikely(ret < 0))
600 return mask;
601
602 switch (ffs->state) {
603 case FFS_READ_DESCRIPTORS:
604 case FFS_READ_STRINGS:
605 mask |= POLLOUT;
606 break;
607
608 case FFS_ACTIVE:
609 switch (ffs->setup_state) {
610 case FFS_NO_SETUP:
611 if (ffs->ev.count)
612 mask |= POLLIN;
613 break;
614
615 case FFS_SETUP_PENDING:
616 case FFS_SETUP_CANCELLED:
617 mask |= (POLLIN | POLLOUT);
618 break;
619 }
620 case FFS_CLOSING:
621 break;
622 case FFS_DEACTIVATED:
623 break;
624 }
625
626 mutex_unlock(&ffs->mutex);
627
628 return mask;
629}
630
631static const struct file_operations ffs_ep0_operations = {
632 .llseek = no_llseek,
633
634 .open = ffs_ep0_open,
635 .write = ffs_ep0_write,
636 .read = ffs_ep0_read,
637 .release = ffs_ep0_release,
638 .unlocked_ioctl = ffs_ep0_ioctl,
639 .poll = ffs_ep0_poll,
640};
641
642
643
644
645static void ffs_epfile_io_complete(struct usb_ep *_ep, struct usb_request *req)
646{
647 ENTER();
648 if (likely(req->context)) {
649 struct ffs_ep *ep = _ep->driver_data;
650 ep->status = req->status ? req->status : req->actual;
651 complete(req->context);
652 }
653}
654
655static ssize_t ffs_copy_to_iter(void *data, int data_len, struct iov_iter *iter)
656{
657 ssize_t ret = copy_to_iter(data, data_len, iter);
658 if (likely(ret == data_len))
659 return ret;
660
661 if (unlikely(iov_iter_count(iter)))
662 return -EFAULT;
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691 pr_err("functionfs read size %d > requested size %zd, dropping excess data. "
692 "Align read buffer size to max packet size to avoid the problem.\n",
693 data_len, ret);
694
695 return ret;
696}
697
698static void ffs_user_copy_worker(struct work_struct *work)
699{
700 struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,
701 work);
702 int ret = io_data->req->status ? io_data->req->status :
703 io_data->req->actual;
704 bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD;
705
706 if (io_data->read && ret > 0) {
707 use_mm(io_data->mm);
708 ret = ffs_copy_to_iter(io_data->buf, ret, &io_data->data);
709 unuse_mm(io_data->mm);
710 }
711
712 io_data->kiocb->ki_complete(io_data->kiocb, ret, ret);
713
714 if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd)
715 eventfd_signal(io_data->ffs->ffs_eventfd, 1);
716
717 usb_ep_free_request(io_data->ep, io_data->req);
718
719 if (io_data->read)
720 kfree(io_data->to_free);
721 kfree(io_data->buf);
722 kfree(io_data);
723}
724
725static void ffs_epfile_async_io_complete(struct usb_ep *_ep,
726 struct usb_request *req)
727{
728 struct ffs_io_data *io_data = req->context;
729
730 ENTER();
731
732 INIT_WORK(&io_data->work, ffs_user_copy_worker);
733 schedule_work(&io_data->work);
734}
735
736
737static ssize_t __ffs_epfile_read_buffered(struct ffs_epfile *epfile,
738 struct iov_iter *iter)
739{
740 struct ffs_buffer *buf = epfile->read_buffer;
741 ssize_t ret;
742 if (!buf)
743 return 0;
744
745 ret = copy_to_iter(buf->data, buf->length, iter);
746 if (buf->length == ret) {
747 kfree(buf);
748 epfile->read_buffer = NULL;
749 } else if (unlikely(iov_iter_count(iter))) {
750 ret = -EFAULT;
751 } else {
752 buf->length -= ret;
753 buf->data += ret;
754 }
755 return ret;
756}
757
758
759static ssize_t __ffs_epfile_read_data(struct ffs_epfile *epfile,
760 void *data, int data_len,
761 struct iov_iter *iter)
762{
763 struct ffs_buffer *buf;
764
765 ssize_t ret = copy_to_iter(data, data_len, iter);
766 if (likely(data_len == ret))
767 return ret;
768
769 if (unlikely(iov_iter_count(iter)))
770 return -EFAULT;
771
772
773 pr_warn("functionfs read size %d > requested size %zd, splitting request into multiple reads.",
774 data_len, ret);
775
776 data_len -= ret;
777 buf = kmalloc(sizeof(*buf) + data_len, GFP_KERNEL);
778 if (!buf)
779 return -ENOMEM;
780 buf->length = data_len;
781 buf->data = buf->storage;
782 memcpy(buf->storage, data + ret, data_len);
783 epfile->read_buffer = buf;
784
785 return ret;
786}
787
788static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
789{
790 struct ffs_epfile *epfile = file->private_data;
791 struct usb_request *req;
792 struct ffs_ep *ep;
793 char *data = NULL;
794 ssize_t ret, data_len = -EINVAL;
795 int halt;
796
797
798 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
799 return -ENODEV;
800
801
802 ep = epfile->ep;
803 if (!ep) {
804 if (file->f_flags & O_NONBLOCK)
805 return -EAGAIN;
806
807 ret = wait_event_interruptible(epfile->wait, (ep = epfile->ep));
808 if (ret)
809 return -EINTR;
810 }
811
812
813 halt = (!io_data->read == !epfile->in);
814 if (halt && epfile->isoc)
815 return -EINVAL;
816
817
818 ret = ffs_mutex_lock(&epfile->mutex, file->f_flags & O_NONBLOCK);
819 if (unlikely(ret))
820 goto error;
821
822
823 if (!halt) {
824 struct usb_gadget *gadget;
825
826
827
828
829
830
831
832
833 if (!io_data->aio && io_data->read) {
834 ret = __ffs_epfile_read_buffered(epfile, &io_data->data);
835 if (ret)
836 goto error_mutex;
837 }
838
839
840
841
842
843
844 gadget = epfile->ffs->gadget;
845
846 spin_lock_irq(&epfile->ffs->eps_lock);
847
848 if (epfile->ep != ep) {
849 ret = -ESHUTDOWN;
850 goto error_lock;
851 }
852 data_len = iov_iter_count(&io_data->data);
853
854
855
856
857 if (io_data->read)
858 data_len = usb_ep_align_maybe(gadget, ep->ep, data_len);
859 spin_unlock_irq(&epfile->ffs->eps_lock);
860
861 data = kmalloc(data_len, GFP_KERNEL);
862 if (unlikely(!data)) {
863 ret = -ENOMEM;
864 goto error_mutex;
865 }
866 if (!io_data->read &&
867 copy_from_iter(data, data_len, &io_data->data) != data_len) {
868 ret = -EFAULT;
869 goto error_mutex;
870 }
871 }
872
873 spin_lock_irq(&epfile->ffs->eps_lock);
874
875 if (epfile->ep != ep) {
876
877 ret = -ESHUTDOWN;
878 } else if (halt) {
879
880 if (likely(epfile->ep == ep) && !WARN_ON(!ep->ep))
881 usb_ep_set_halt(ep->ep);
882 ret = -EBADMSG;
883 } else if (unlikely(data_len == -EINVAL)) {
884
885
886
887
888
889
890
891
892
893
894
895 WARN(1, "%s: data_len == -EINVAL\n", __func__);
896 ret = -EINVAL;
897 } else if (!io_data->aio) {
898 DECLARE_COMPLETION_ONSTACK(done);
899 bool interrupted = false;
900
901 req = ep->req;
902 req->buf = data;
903 req->length = data_len;
904
905 req->context = &done;
906 req->complete = ffs_epfile_io_complete;
907
908 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
909 if (unlikely(ret < 0))
910 goto error_lock;
911
912 spin_unlock_irq(&epfile->ffs->eps_lock);
913
914 if (unlikely(wait_for_completion_interruptible(&done))) {
915
916
917
918
919
920
921 usb_ep_dequeue(ep->ep, req);
922 interrupted = ep->status < 0;
923 }
924
925 if (interrupted)
926 ret = -EINTR;
927 else if (io_data->read && ep->status > 0)
928 ret = __ffs_epfile_read_data(epfile, data, ep->status,
929 &io_data->data);
930 else
931 ret = ep->status;
932 goto error_mutex;
933 } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_KERNEL))) {
934 ret = -ENOMEM;
935 } else {
936 req->buf = data;
937 req->length = data_len;
938
939 io_data->buf = data;
940 io_data->ep = ep->ep;
941 io_data->req = req;
942 io_data->ffs = epfile->ffs;
943
944 req->context = io_data;
945 req->complete = ffs_epfile_async_io_complete;
946
947 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
948 if (unlikely(ret)) {
949 usb_ep_free_request(ep->ep, req);
950 goto error_lock;
951 }
952
953 ret = -EIOCBQUEUED;
954
955
956
957
958 data = NULL;
959 }
960
961error_lock:
962 spin_unlock_irq(&epfile->ffs->eps_lock);
963error_mutex:
964 mutex_unlock(&epfile->mutex);
965error:
966 kfree(data);
967 return ret;
968}
969
970static int
971ffs_epfile_open(struct inode *inode, struct file *file)
972{
973 struct ffs_epfile *epfile = inode->i_private;
974
975 ENTER();
976
977 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
978 return -ENODEV;
979
980 file->private_data = epfile;
981 ffs_data_opened(epfile->ffs);
982
983 return 0;
984}
985
986static int ffs_aio_cancel(struct kiocb *kiocb)
987{
988 struct ffs_io_data *io_data = kiocb->private;
989 struct ffs_epfile *epfile = kiocb->ki_filp->private_data;
990 int value;
991
992 ENTER();
993
994 spin_lock_irq(&epfile->ffs->eps_lock);
995
996 if (likely(io_data && io_data->ep && io_data->req))
997 value = usb_ep_dequeue(io_data->ep, io_data->req);
998 else
999 value = -EINVAL;
1000
1001 spin_unlock_irq(&epfile->ffs->eps_lock);
1002
1003 return value;
1004}
1005
1006static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
1007{
1008 struct ffs_io_data io_data, *p = &io_data;
1009 ssize_t res;
1010
1011 ENTER();
1012
1013 if (!is_sync_kiocb(kiocb)) {
1014 p = kmalloc(sizeof(io_data), GFP_KERNEL);
1015 if (unlikely(!p))
1016 return -ENOMEM;
1017 p->aio = true;
1018 } else {
1019 p->aio = false;
1020 }
1021
1022 p->read = false;
1023 p->kiocb = kiocb;
1024 p->data = *from;
1025 p->mm = current->mm;
1026
1027 kiocb->private = p;
1028
1029 if (p->aio)
1030 kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
1031
1032 res = ffs_epfile_io(kiocb->ki_filp, p);
1033 if (res == -EIOCBQUEUED)
1034 return res;
1035 if (p->aio)
1036 kfree(p);
1037 else
1038 *from = p->data;
1039 return res;
1040}
1041
1042static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
1043{
1044 struct ffs_io_data io_data, *p = &io_data;
1045 ssize_t res;
1046
1047 ENTER();
1048
1049 if (!is_sync_kiocb(kiocb)) {
1050 p = kmalloc(sizeof(io_data), GFP_KERNEL);
1051 if (unlikely(!p))
1052 return -ENOMEM;
1053 p->aio = true;
1054 } else {
1055 p->aio = false;
1056 }
1057
1058 p->read = true;
1059 p->kiocb = kiocb;
1060 if (p->aio) {
1061 p->to_free = dup_iter(&p->data, to, GFP_KERNEL);
1062 if (!p->to_free) {
1063 kfree(p);
1064 return -ENOMEM;
1065 }
1066 } else {
1067 p->data = *to;
1068 p->to_free = NULL;
1069 }
1070 p->mm = current->mm;
1071
1072 kiocb->private = p;
1073
1074 if (p->aio)
1075 kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
1076
1077 res = ffs_epfile_io(kiocb->ki_filp, p);
1078 if (res == -EIOCBQUEUED)
1079 return res;
1080
1081 if (p->aio) {
1082 kfree(p->to_free);
1083 kfree(p);
1084 } else {
1085 *to = p->data;
1086 }
1087 return res;
1088}
1089
1090static int
1091ffs_epfile_release(struct inode *inode, struct file *file)
1092{
1093 struct ffs_epfile *epfile = inode->i_private;
1094
1095 ENTER();
1096
1097 kfree(epfile->read_buffer);
1098 epfile->read_buffer = NULL;
1099 ffs_data_closed(epfile->ffs);
1100
1101 return 0;
1102}
1103
1104static long ffs_epfile_ioctl(struct file *file, unsigned code,
1105 unsigned long value)
1106{
1107 struct ffs_epfile *epfile = file->private_data;
1108 int ret;
1109
1110 ENTER();
1111
1112 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
1113 return -ENODEV;
1114
1115 spin_lock_irq(&epfile->ffs->eps_lock);
1116 if (likely(epfile->ep)) {
1117 switch (code) {
1118 case FUNCTIONFS_FIFO_STATUS:
1119 ret = usb_ep_fifo_status(epfile->ep->ep);
1120 break;
1121 case FUNCTIONFS_FIFO_FLUSH:
1122 usb_ep_fifo_flush(epfile->ep->ep);
1123 ret = 0;
1124 break;
1125 case FUNCTIONFS_CLEAR_HALT:
1126 ret = usb_ep_clear_halt(epfile->ep->ep);
1127 break;
1128 case FUNCTIONFS_ENDPOINT_REVMAP:
1129 ret = epfile->ep->num;
1130 break;
1131 case FUNCTIONFS_ENDPOINT_DESC:
1132 {
1133 int desc_idx;
1134 struct usb_endpoint_descriptor *desc;
1135
1136 switch (epfile->ffs->gadget->speed) {
1137 case USB_SPEED_SUPER:
1138 desc_idx = 2;
1139 break;
1140 case USB_SPEED_HIGH:
1141 desc_idx = 1;
1142 break;
1143 default:
1144 desc_idx = 0;
1145 }
1146 desc = epfile->ep->descs[desc_idx];
1147
1148 spin_unlock_irq(&epfile->ffs->eps_lock);
1149 ret = copy_to_user((void *)value, desc, sizeof(*desc));
1150 if (ret)
1151 ret = -EFAULT;
1152 return ret;
1153 }
1154 default:
1155 ret = -ENOTTY;
1156 }
1157 } else {
1158 ret = -ENODEV;
1159 }
1160 spin_unlock_irq(&epfile->ffs->eps_lock);
1161
1162 return ret;
1163}
1164
1165static const struct file_operations ffs_epfile_operations = {
1166 .llseek = no_llseek,
1167
1168 .open = ffs_epfile_open,
1169 .write_iter = ffs_epfile_write_iter,
1170 .read_iter = ffs_epfile_read_iter,
1171 .release = ffs_epfile_release,
1172 .unlocked_ioctl = ffs_epfile_ioctl,
1173};
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183static struct inode *__must_check
1184ffs_sb_make_inode(struct super_block *sb, void *data,
1185 const struct file_operations *fops,
1186 const struct inode_operations *iops,
1187 struct ffs_file_perms *perms)
1188{
1189 struct inode *inode;
1190
1191 ENTER();
1192
1193 inode = new_inode(sb);
1194
1195 if (likely(inode)) {
1196 struct timespec current_time = CURRENT_TIME;
1197
1198 inode->i_ino = get_next_ino();
1199 inode->i_mode = perms->mode;
1200 inode->i_uid = perms->uid;
1201 inode->i_gid = perms->gid;
1202 inode->i_atime = current_time;
1203 inode->i_mtime = current_time;
1204 inode->i_ctime = current_time;
1205 inode->i_private = data;
1206 if (fops)
1207 inode->i_fop = fops;
1208 if (iops)
1209 inode->i_op = iops;
1210 }
1211
1212 return inode;
1213}
1214
1215
1216static struct dentry *ffs_sb_create_file(struct super_block *sb,
1217 const char *name, void *data,
1218 const struct file_operations *fops)
1219{
1220 struct ffs_data *ffs = sb->s_fs_info;
1221 struct dentry *dentry;
1222 struct inode *inode;
1223
1224 ENTER();
1225
1226 dentry = d_alloc_name(sb->s_root, name);
1227 if (unlikely(!dentry))
1228 return NULL;
1229
1230 inode = ffs_sb_make_inode(sb, data, fops, NULL, &ffs->file_perms);
1231 if (unlikely(!inode)) {
1232 dput(dentry);
1233 return NULL;
1234 }
1235
1236 d_add(dentry, inode);
1237 return dentry;
1238}
1239
1240
1241static const struct super_operations ffs_sb_operations = {
1242 .statfs = simple_statfs,
1243 .drop_inode = generic_delete_inode,
1244};
1245
1246struct ffs_sb_fill_data {
1247 struct ffs_file_perms perms;
1248 umode_t root_mode;
1249 const char *dev_name;
1250 bool no_disconnect;
1251 struct ffs_data *ffs_data;
1252};
1253
1254static int ffs_sb_fill(struct super_block *sb, void *_data, int silent)
1255{
1256 struct ffs_sb_fill_data *data = _data;
1257 struct inode *inode;
1258 struct ffs_data *ffs = data->ffs_data;
1259
1260 ENTER();
1261
1262 ffs->sb = sb;
1263 data->ffs_data = NULL;
1264 sb->s_fs_info = ffs;
1265 sb->s_blocksize = PAGE_SIZE;
1266 sb->s_blocksize_bits = PAGE_SHIFT;
1267 sb->s_magic = FUNCTIONFS_MAGIC;
1268 sb->s_op = &ffs_sb_operations;
1269 sb->s_time_gran = 1;
1270
1271
1272 data->perms.mode = data->root_mode;
1273 inode = ffs_sb_make_inode(sb, NULL,
1274 &simple_dir_operations,
1275 &simple_dir_inode_operations,
1276 &data->perms);
1277 sb->s_root = d_make_root(inode);
1278 if (unlikely(!sb->s_root))
1279 return -ENOMEM;
1280
1281
1282 if (unlikely(!ffs_sb_create_file(sb, "ep0", ffs,
1283 &ffs_ep0_operations)))
1284 return -ENOMEM;
1285
1286 return 0;
1287}
1288
1289static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
1290{
1291 ENTER();
1292
1293 if (!opts || !*opts)
1294 return 0;
1295
1296 for (;;) {
1297 unsigned long value;
1298 char *eq, *comma;
1299
1300
1301 comma = strchr(opts, ',');
1302 if (comma)
1303 *comma = 0;
1304
1305
1306 eq = strchr(opts, '=');
1307 if (unlikely(!eq)) {
1308 pr_err("'=' missing in %s\n", opts);
1309 return -EINVAL;
1310 }
1311 *eq = 0;
1312
1313
1314 if (kstrtoul(eq + 1, 0, &value)) {
1315 pr_err("%s: invalid value: %s\n", opts, eq + 1);
1316 return -EINVAL;
1317 }
1318
1319
1320 switch (eq - opts) {
1321 case 13:
1322 if (!memcmp(opts, "no_disconnect", 13))
1323 data->no_disconnect = !!value;
1324 else
1325 goto invalid;
1326 break;
1327 case 5:
1328 if (!memcmp(opts, "rmode", 5))
1329 data->root_mode = (value & 0555) | S_IFDIR;
1330 else if (!memcmp(opts, "fmode", 5))
1331 data->perms.mode = (value & 0666) | S_IFREG;
1332 else
1333 goto invalid;
1334 break;
1335
1336 case 4:
1337 if (!memcmp(opts, "mode", 4)) {
1338 data->root_mode = (value & 0555) | S_IFDIR;
1339 data->perms.mode = (value & 0666) | S_IFREG;
1340 } else {
1341 goto invalid;
1342 }
1343 break;
1344
1345 case 3:
1346 if (!memcmp(opts, "uid", 3)) {
1347 data->perms.uid = make_kuid(current_user_ns(), value);
1348 if (!uid_valid(data->perms.uid)) {
1349 pr_err("%s: unmapped value: %lu\n", opts, value);
1350 return -EINVAL;
1351 }
1352 } else if (!memcmp(opts, "gid", 3)) {
1353 data->perms.gid = make_kgid(current_user_ns(), value);
1354 if (!gid_valid(data->perms.gid)) {
1355 pr_err("%s: unmapped value: %lu\n", opts, value);
1356 return -EINVAL;
1357 }
1358 } else {
1359 goto invalid;
1360 }
1361 break;
1362
1363 default:
1364invalid:
1365 pr_err("%s: invalid option\n", opts);
1366 return -EINVAL;
1367 }
1368
1369
1370 if (!comma)
1371 break;
1372 opts = comma + 1;
1373 }
1374
1375 return 0;
1376}
1377
1378
1379
1380static struct dentry *
1381ffs_fs_mount(struct file_system_type *t, int flags,
1382 const char *dev_name, void *opts)
1383{
1384 struct ffs_sb_fill_data data = {
1385 .perms = {
1386 .mode = S_IFREG | 0600,
1387 .uid = GLOBAL_ROOT_UID,
1388 .gid = GLOBAL_ROOT_GID,
1389 },
1390 .root_mode = S_IFDIR | 0500,
1391 .no_disconnect = false,
1392 };
1393 struct dentry *rv;
1394 int ret;
1395 void *ffs_dev;
1396 struct ffs_data *ffs;
1397
1398 ENTER();
1399
1400 ret = ffs_fs_parse_opts(&data, opts);
1401 if (unlikely(ret < 0))
1402 return ERR_PTR(ret);
1403
1404 ffs = ffs_data_new();
1405 if (unlikely(!ffs))
1406 return ERR_PTR(-ENOMEM);
1407 ffs->file_perms = data.perms;
1408 ffs->no_disconnect = data.no_disconnect;
1409
1410 ffs->dev_name = kstrdup(dev_name, GFP_KERNEL);
1411 if (unlikely(!ffs->dev_name)) {
1412 ffs_data_put(ffs);
1413 return ERR_PTR(-ENOMEM);
1414 }
1415
1416 ffs_dev = ffs_acquire_dev(dev_name);
1417 if (IS_ERR(ffs_dev)) {
1418 ffs_data_put(ffs);
1419 return ERR_CAST(ffs_dev);
1420 }
1421 ffs->private_data = ffs_dev;
1422 data.ffs_data = ffs;
1423
1424 rv = mount_nodev(t, flags, &data, ffs_sb_fill);
1425 if (IS_ERR(rv) && data.ffs_data) {
1426 ffs_release_dev(data.ffs_data);
1427 ffs_data_put(data.ffs_data);
1428 }
1429 return rv;
1430}
1431
1432static void
1433ffs_fs_kill_sb(struct super_block *sb)
1434{
1435 ENTER();
1436
1437 kill_litter_super(sb);
1438 if (sb->s_fs_info) {
1439 ffs_release_dev(sb->s_fs_info);
1440 ffs_data_closed(sb->s_fs_info);
1441 ffs_data_put(sb->s_fs_info);
1442 }
1443}
1444
1445static struct file_system_type ffs_fs_type = {
1446 .owner = THIS_MODULE,
1447 .name = "functionfs",
1448 .mount = ffs_fs_mount,
1449 .kill_sb = ffs_fs_kill_sb,
1450};
1451MODULE_ALIAS_FS("functionfs");
1452
1453
1454
1455
1456static int functionfs_init(void)
1457{
1458 int ret;
1459
1460 ENTER();
1461
1462 ret = register_filesystem(&ffs_fs_type);
1463 if (likely(!ret))
1464 pr_info("file system registered\n");
1465 else
1466 pr_err("failed registering file system (%d)\n", ret);
1467
1468 return ret;
1469}
1470
1471static void functionfs_cleanup(void)
1472{
1473 ENTER();
1474
1475 pr_info("unloading\n");
1476 unregister_filesystem(&ffs_fs_type);
1477}
1478
1479
1480
1481
1482static void ffs_data_clear(struct ffs_data *ffs);
1483static void ffs_data_reset(struct ffs_data *ffs);
1484
1485static void ffs_data_get(struct ffs_data *ffs)
1486{
1487 ENTER();
1488
1489 atomic_inc(&ffs->ref);
1490}
1491
1492static void ffs_data_opened(struct ffs_data *ffs)
1493{
1494 ENTER();
1495
1496 atomic_inc(&ffs->ref);
1497 if (atomic_add_return(1, &ffs->opened) == 1 &&
1498 ffs->state == FFS_DEACTIVATED) {
1499 ffs->state = FFS_CLOSING;
1500 ffs_data_reset(ffs);
1501 }
1502}
1503
1504static void ffs_data_put(struct ffs_data *ffs)
1505{
1506 ENTER();
1507
1508 if (unlikely(atomic_dec_and_test(&ffs->ref))) {
1509 pr_info("%s(): freeing\n", __func__);
1510 ffs_data_clear(ffs);
1511 BUG_ON(waitqueue_active(&ffs->ev.waitq) ||
1512 waitqueue_active(&ffs->ep0req_completion.wait));
1513 kfree(ffs->dev_name);
1514 kfree(ffs);
1515 }
1516}
1517
1518static void ffs_data_closed(struct ffs_data *ffs)
1519{
1520 ENTER();
1521
1522 if (atomic_dec_and_test(&ffs->opened)) {
1523 if (ffs->no_disconnect) {
1524 ffs->state = FFS_DEACTIVATED;
1525 if (ffs->epfiles) {
1526 ffs_epfiles_destroy(ffs->epfiles,
1527 ffs->eps_count);
1528 ffs->epfiles = NULL;
1529 }
1530 if (ffs->setup_state == FFS_SETUP_PENDING)
1531 __ffs_ep0_stall(ffs);
1532 } else {
1533 ffs->state = FFS_CLOSING;
1534 ffs_data_reset(ffs);
1535 }
1536 }
1537 if (atomic_read(&ffs->opened) < 0) {
1538 ffs->state = FFS_CLOSING;
1539 ffs_data_reset(ffs);
1540 }
1541
1542 ffs_data_put(ffs);
1543}
1544
1545static struct ffs_data *ffs_data_new(void)
1546{
1547 struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
1548 if (unlikely(!ffs))
1549 return NULL;
1550
1551 ENTER();
1552
1553 atomic_set(&ffs->ref, 1);
1554 atomic_set(&ffs->opened, 0);
1555 ffs->state = FFS_READ_DESCRIPTORS;
1556 mutex_init(&ffs->mutex);
1557 spin_lock_init(&ffs->eps_lock);
1558 init_waitqueue_head(&ffs->ev.waitq);
1559 init_completion(&ffs->ep0req_completion);
1560
1561
1562 ffs->ev.can_stall = 1;
1563
1564 return ffs;
1565}
1566
1567static void ffs_data_clear(struct ffs_data *ffs)
1568{
1569 ENTER();
1570
1571 ffs_closed(ffs);
1572
1573 BUG_ON(ffs->gadget);
1574
1575 if (ffs->epfiles)
1576 ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count);
1577
1578 if (ffs->ffs_eventfd)
1579 eventfd_ctx_put(ffs->ffs_eventfd);
1580
1581 kfree(ffs->raw_descs_data);
1582 kfree(ffs->raw_strings);
1583 kfree(ffs->stringtabs);
1584}
1585
1586static void ffs_data_reset(struct ffs_data *ffs)
1587{
1588 ENTER();
1589
1590 ffs_data_clear(ffs);
1591
1592 ffs->epfiles = NULL;
1593 ffs->raw_descs_data = NULL;
1594 ffs->raw_descs = NULL;
1595 ffs->raw_strings = NULL;
1596 ffs->stringtabs = NULL;
1597
1598 ffs->raw_descs_length = 0;
1599 ffs->fs_descs_count = 0;
1600 ffs->hs_descs_count = 0;
1601 ffs->ss_descs_count = 0;
1602
1603 ffs->strings_count = 0;
1604 ffs->interfaces_count = 0;
1605 ffs->eps_count = 0;
1606
1607 ffs->ev.count = 0;
1608
1609 ffs->state = FFS_READ_DESCRIPTORS;
1610 ffs->setup_state = FFS_NO_SETUP;
1611 ffs->flags = 0;
1612}
1613
1614
1615static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
1616{
1617 struct usb_gadget_strings **lang;
1618 int first_id;
1619
1620 ENTER();
1621
1622 if (WARN_ON(ffs->state != FFS_ACTIVE
1623 || test_and_set_bit(FFS_FL_BOUND, &ffs->flags)))
1624 return -EBADFD;
1625
1626 first_id = usb_string_ids_n(cdev, ffs->strings_count);
1627 if (unlikely(first_id < 0))
1628 return first_id;
1629
1630 ffs->ep0req = usb_ep_alloc_request(cdev->gadget->ep0, GFP_KERNEL);
1631 if (unlikely(!ffs->ep0req))
1632 return -ENOMEM;
1633 ffs->ep0req->complete = ffs_ep0_complete;
1634 ffs->ep0req->context = ffs;
1635
1636 lang = ffs->stringtabs;
1637 if (lang) {
1638 for (; *lang; ++lang) {
1639 struct usb_string *str = (*lang)->strings;
1640 int id = first_id;
1641 for (; str->s; ++id, ++str)
1642 str->id = id;
1643 }
1644 }
1645
1646 ffs->gadget = cdev->gadget;
1647 ffs_data_get(ffs);
1648 return 0;
1649}
1650
1651static void functionfs_unbind(struct ffs_data *ffs)
1652{
1653 ENTER();
1654
1655 if (!WARN_ON(!ffs->gadget)) {
1656 usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req);
1657 ffs->ep0req = NULL;
1658 ffs->gadget = NULL;
1659 clear_bit(FFS_FL_BOUND, &ffs->flags);
1660 ffs_data_put(ffs);
1661 }
1662}
1663
1664static int ffs_epfiles_create(struct ffs_data *ffs)
1665{
1666 struct ffs_epfile *epfile, *epfiles;
1667 unsigned i, count;
1668
1669 ENTER();
1670
1671 count = ffs->eps_count;
1672 epfiles = kcalloc(count, sizeof(*epfiles), GFP_KERNEL);
1673 if (!epfiles)
1674 return -ENOMEM;
1675
1676 epfile = epfiles;
1677 for (i = 1; i <= count; ++i, ++epfile) {
1678 epfile->ffs = ffs;
1679 mutex_init(&epfile->mutex);
1680 init_waitqueue_head(&epfile->wait);
1681 if (ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
1682 sprintf(epfile->name, "ep%02x", ffs->eps_addrmap[i]);
1683 else
1684 sprintf(epfile->name, "ep%u", i);
1685 epfile->dentry = ffs_sb_create_file(ffs->sb, epfile->name,
1686 epfile,
1687 &ffs_epfile_operations);
1688 if (unlikely(!epfile->dentry)) {
1689 ffs_epfiles_destroy(epfiles, i - 1);
1690 return -ENOMEM;
1691 }
1692 }
1693
1694 ffs->epfiles = epfiles;
1695 return 0;
1696}
1697
1698static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count)
1699{
1700 struct ffs_epfile *epfile = epfiles;
1701
1702 ENTER();
1703
1704 for (; count; --count, ++epfile) {
1705 BUG_ON(mutex_is_locked(&epfile->mutex) ||
1706 waitqueue_active(&epfile->wait));
1707 if (epfile->dentry) {
1708 d_delete(epfile->dentry);
1709 dput(epfile->dentry);
1710 epfile->dentry = NULL;
1711 }
1712 }
1713
1714 kfree(epfiles);
1715}
1716
1717static void ffs_func_eps_disable(struct ffs_function *func)
1718{
1719 struct ffs_ep *ep = func->eps;
1720 struct ffs_epfile *epfile = func->ffs->epfiles;
1721 unsigned count = func->ffs->eps_count;
1722 unsigned long flags;
1723
1724 do {
1725 if (epfile)
1726 mutex_lock(&epfile->mutex);
1727 spin_lock_irqsave(&func->ffs->eps_lock, flags);
1728
1729 if (likely(ep->ep))
1730 usb_ep_disable(ep->ep);
1731 ++ep;
1732 spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
1733
1734 if (epfile) {
1735 epfile->ep = NULL;
1736 kfree(epfile->read_buffer);
1737 epfile->read_buffer = NULL;
1738 mutex_unlock(&epfile->mutex);
1739 ++epfile;
1740 }
1741 } while (--count);
1742}
1743
1744static int ffs_func_eps_enable(struct ffs_function *func)
1745{
1746 struct ffs_data *ffs = func->ffs;
1747 struct ffs_ep *ep = func->eps;
1748 struct ffs_epfile *epfile = ffs->epfiles;
1749 unsigned count = ffs->eps_count;
1750 unsigned long flags;
1751 int ret = 0;
1752
1753 spin_lock_irqsave(&func->ffs->eps_lock, flags);
1754 do {
1755 struct usb_endpoint_descriptor *ds;
1756 int desc_idx;
1757
1758 if (ffs->gadget->speed == USB_SPEED_SUPER)
1759 desc_idx = 2;
1760 else if (ffs->gadget->speed == USB_SPEED_HIGH)
1761 desc_idx = 1;
1762 else
1763 desc_idx = 0;
1764
1765
1766 do {
1767 ds = ep->descs[desc_idx];
1768 } while (!ds && --desc_idx >= 0);
1769
1770 if (!ds) {
1771 ret = -EINVAL;
1772 break;
1773 }
1774
1775 ep->ep->driver_data = ep;
1776 ep->ep->desc = ds;
1777 ret = usb_ep_enable(ep->ep);
1778 if (likely(!ret)) {
1779 epfile->ep = ep;
1780 epfile->in = usb_endpoint_dir_in(ds);
1781 epfile->isoc = usb_endpoint_xfer_isoc(ds);
1782 } else {
1783 break;
1784 }
1785
1786 wake_up(&epfile->wait);
1787
1788 ++ep;
1789 ++epfile;
1790 } while (--count);
1791 spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
1792
1793 return ret;
1794}
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806enum ffs_entity_type {
1807 FFS_DESCRIPTOR, FFS_INTERFACE, FFS_STRING, FFS_ENDPOINT
1808};
1809
1810enum ffs_os_desc_type {
1811 FFS_OS_DESC, FFS_OS_DESC_EXT_COMPAT, FFS_OS_DESC_EXT_PROP
1812};
1813
1814typedef int (*ffs_entity_callback)(enum ffs_entity_type entity,
1815 u8 *valuep,
1816 struct usb_descriptor_header *desc,
1817 void *priv);
1818
1819typedef int (*ffs_os_desc_callback)(enum ffs_os_desc_type entity,
1820 struct usb_os_desc_header *h, void *data,
1821 unsigned len, void *priv);
1822
1823static int __must_check ffs_do_single_desc(char *data, unsigned len,
1824 ffs_entity_callback entity,
1825 void *priv)
1826{
1827 struct usb_descriptor_header *_ds = (void *)data;
1828 u8 length;
1829 int ret;
1830
1831 ENTER();
1832
1833
1834 if (len < 2) {
1835 pr_vdebug("descriptor too short\n");
1836 return -EINVAL;
1837 }
1838
1839
1840 length = _ds->bLength;
1841 if (len < length) {
1842 pr_vdebug("descriptor longer then available data\n");
1843 return -EINVAL;
1844 }
1845
1846#define __entity_check_INTERFACE(val) 1
1847#define __entity_check_STRING(val) (val)
1848#define __entity_check_ENDPOINT(val) ((val) & USB_ENDPOINT_NUMBER_MASK)
1849#define __entity(type, val) do { \
1850 pr_vdebug("entity " #type "(%02x)\n", (val)); \
1851 if (unlikely(!__entity_check_ ##type(val))) { \
1852 pr_vdebug("invalid entity's value\n"); \
1853 return -EINVAL; \
1854 } \
1855 ret = entity(FFS_ ##type, &val, _ds, priv); \
1856 if (unlikely(ret < 0)) { \
1857 pr_debug("entity " #type "(%02x); ret = %d\n", \
1858 (val), ret); \
1859 return ret; \
1860 } \
1861 } while (0)
1862
1863
1864 switch (_ds->bDescriptorType) {
1865 case USB_DT_DEVICE:
1866 case USB_DT_CONFIG:
1867 case USB_DT_STRING:
1868 case USB_DT_DEVICE_QUALIFIER:
1869
1870 pr_vdebug("descriptor reserved for gadget: %d\n",
1871 _ds->bDescriptorType);
1872 return -EINVAL;
1873
1874 case USB_DT_INTERFACE: {
1875 struct usb_interface_descriptor *ds = (void *)_ds;
1876 pr_vdebug("interface descriptor\n");
1877 if (length != sizeof *ds)
1878 goto inv_length;
1879
1880 __entity(INTERFACE, ds->bInterfaceNumber);
1881 if (ds->iInterface)
1882 __entity(STRING, ds->iInterface);
1883 }
1884 break;
1885
1886 case USB_DT_ENDPOINT: {
1887 struct usb_endpoint_descriptor *ds = (void *)_ds;
1888 pr_vdebug("endpoint descriptor\n");
1889 if (length != USB_DT_ENDPOINT_SIZE &&
1890 length != USB_DT_ENDPOINT_AUDIO_SIZE)
1891 goto inv_length;
1892 __entity(ENDPOINT, ds->bEndpointAddress);
1893 }
1894 break;
1895
1896 case HID_DT_HID:
1897 pr_vdebug("hid descriptor\n");
1898 if (length != sizeof(struct hid_descriptor))
1899 goto inv_length;
1900 break;
1901
1902 case USB_DT_OTG:
1903 if (length != sizeof(struct usb_otg_descriptor))
1904 goto inv_length;
1905 break;
1906
1907 case USB_DT_INTERFACE_ASSOCIATION: {
1908 struct usb_interface_assoc_descriptor *ds = (void *)_ds;
1909 pr_vdebug("interface association descriptor\n");
1910 if (length != sizeof *ds)
1911 goto inv_length;
1912 if (ds->iFunction)
1913 __entity(STRING, ds->iFunction);
1914 }
1915 break;
1916
1917 case USB_DT_SS_ENDPOINT_COMP:
1918 pr_vdebug("EP SS companion descriptor\n");
1919 if (length != sizeof(struct usb_ss_ep_comp_descriptor))
1920 goto inv_length;
1921 break;
1922
1923 case USB_DT_OTHER_SPEED_CONFIG:
1924 case USB_DT_INTERFACE_POWER:
1925 case USB_DT_DEBUG:
1926 case USB_DT_SECURITY:
1927 case USB_DT_CS_RADIO_CONTROL:
1928
1929 pr_vdebug("unimplemented descriptor: %d\n", _ds->bDescriptorType);
1930 return -EINVAL;
1931
1932 default:
1933
1934 pr_vdebug("unknown descriptor: %d\n", _ds->bDescriptorType);
1935 return -EINVAL;
1936
1937inv_length:
1938 pr_vdebug("invalid length: %d (descriptor %d)\n",
1939 _ds->bLength, _ds->bDescriptorType);
1940 return -EINVAL;
1941 }
1942
1943#undef __entity
1944#undef __entity_check_DESCRIPTOR
1945#undef __entity_check_INTERFACE
1946#undef __entity_check_STRING
1947#undef __entity_check_ENDPOINT
1948
1949 return length;
1950}
1951
1952static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len,
1953 ffs_entity_callback entity, void *priv)
1954{
1955 const unsigned _len = len;
1956 unsigned long num = 0;
1957
1958 ENTER();
1959
1960 for (;;) {
1961 int ret;
1962
1963 if (num == count)
1964 data = NULL;
1965
1966
1967 ret = entity(FFS_DESCRIPTOR, (u8 *)num, (void *)data, priv);
1968 if (unlikely(ret < 0)) {
1969 pr_debug("entity DESCRIPTOR(%02lx); ret = %d\n",
1970 num, ret);
1971 return ret;
1972 }
1973
1974 if (!data)
1975 return _len - len;
1976
1977 ret = ffs_do_single_desc(data, len, entity, priv);
1978 if (unlikely(ret < 0)) {
1979 pr_debug("%s returns %d\n", __func__, ret);
1980 return ret;
1981 }
1982
1983 len -= ret;
1984 data += ret;
1985 ++num;
1986 }
1987}
1988
1989static int __ffs_data_do_entity(enum ffs_entity_type type,
1990 u8 *valuep, struct usb_descriptor_header *desc,
1991 void *priv)
1992{
1993 struct ffs_desc_helper *helper = priv;
1994 struct usb_endpoint_descriptor *d;
1995
1996 ENTER();
1997
1998 switch (type) {
1999 case FFS_DESCRIPTOR:
2000 break;
2001
2002 case FFS_INTERFACE:
2003
2004
2005
2006
2007
2008 if (*valuep >= helper->interfaces_count)
2009 helper->interfaces_count = *valuep + 1;
2010 break;
2011
2012 case FFS_STRING:
2013
2014
2015
2016
2017 if (*valuep > helper->ffs->strings_count)
2018 helper->ffs->strings_count = *valuep;
2019 break;
2020
2021 case FFS_ENDPOINT:
2022 d = (void *)desc;
2023 helper->eps_count++;
2024 if (helper->eps_count >= 15)
2025 return -EINVAL;
2026
2027 if (!helper->ffs->eps_count && !helper->ffs->interfaces_count)
2028 helper->ffs->eps_addrmap[helper->eps_count] =
2029 d->bEndpointAddress;
2030 else if (helper->ffs->eps_addrmap[helper->eps_count] !=
2031 d->bEndpointAddress)
2032 return -EINVAL;
2033 break;
2034 }
2035
2036 return 0;
2037}
2038
2039static int __ffs_do_os_desc_header(enum ffs_os_desc_type *next_type,
2040 struct usb_os_desc_header *desc)
2041{
2042 u16 bcd_version = le16_to_cpu(desc->bcdVersion);
2043 u16 w_index = le16_to_cpu(desc->wIndex);
2044
2045 if (bcd_version != 1) {
2046 pr_vdebug("unsupported os descriptors version: %d",
2047 bcd_version);
2048 return -EINVAL;
2049 }
2050 switch (w_index) {
2051 case 0x4:
2052 *next_type = FFS_OS_DESC_EXT_COMPAT;
2053 break;
2054 case 0x5:
2055 *next_type = FFS_OS_DESC_EXT_PROP;
2056 break;
2057 default:
2058 pr_vdebug("unsupported os descriptor type: %d", w_index);
2059 return -EINVAL;
2060 }
2061
2062 return sizeof(*desc);
2063}
2064
2065
2066
2067
2068
2069static int __must_check ffs_do_single_os_desc(char *data, unsigned len,
2070 enum ffs_os_desc_type type,
2071 u16 feature_count,
2072 ffs_os_desc_callback entity,
2073 void *priv,
2074 struct usb_os_desc_header *h)
2075{
2076 int ret;
2077 const unsigned _len = len;
2078
2079 ENTER();
2080
2081
2082 while (feature_count--) {
2083 ret = entity(type, h, data, len, priv);
2084 if (unlikely(ret < 0)) {
2085 pr_debug("bad OS descriptor, type: %d\n", type);
2086 return ret;
2087 }
2088 data += ret;
2089 len -= ret;
2090 }
2091 return _len - len;
2092}
2093
2094
2095static int __must_check ffs_do_os_descs(unsigned count,
2096 char *data, unsigned len,
2097 ffs_os_desc_callback entity, void *priv)
2098{
2099 const unsigned _len = len;
2100 unsigned long num = 0;
2101
2102 ENTER();
2103
2104 for (num = 0; num < count; ++num) {
2105 int ret;
2106 enum ffs_os_desc_type type;
2107 u16 feature_count;
2108 struct usb_os_desc_header *desc = (void *)data;
2109
2110 if (len < sizeof(*desc))
2111 return -EINVAL;
2112
2113
2114
2115
2116
2117
2118
2119
2120 if (le32_to_cpu(desc->dwLength) > len)
2121 return -EINVAL;
2122
2123 ret = __ffs_do_os_desc_header(&type, desc);
2124 if (unlikely(ret < 0)) {
2125 pr_debug("entity OS_DESCRIPTOR(%02lx); ret = %d\n",
2126 num, ret);
2127 return ret;
2128 }
2129
2130
2131
2132 feature_count = le16_to_cpu(desc->wCount);
2133 if (type == FFS_OS_DESC_EXT_COMPAT &&
2134 (feature_count > 255 || desc->Reserved))
2135 return -EINVAL;
2136 len -= ret;
2137 data += ret;
2138
2139
2140
2141
2142
2143 ret = ffs_do_single_os_desc(data, len, type,
2144 feature_count, entity, priv, desc);
2145 if (unlikely(ret < 0)) {
2146 pr_debug("%s returns %d\n", __func__, ret);
2147 return ret;
2148 }
2149
2150 len -= ret;
2151 data += ret;
2152 }
2153 return _len - len;
2154}
2155
2156
2157
2158
2159static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
2160 struct usb_os_desc_header *h, void *data,
2161 unsigned len, void *priv)
2162{
2163 struct ffs_data *ffs = priv;
2164 u8 length;
2165
2166 ENTER();
2167
2168 switch (type) {
2169 case FFS_OS_DESC_EXT_COMPAT: {
2170 struct usb_ext_compat_desc *d = data;
2171 int i;
2172
2173 if (len < sizeof(*d) ||
2174 d->bFirstInterfaceNumber >= ffs->interfaces_count ||
2175 !d->Reserved1)
2176 return -EINVAL;
2177 for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
2178 if (d->Reserved2[i])
2179 return -EINVAL;
2180
2181 length = sizeof(struct usb_ext_compat_desc);
2182 }
2183 break;
2184 case FFS_OS_DESC_EXT_PROP: {
2185 struct usb_ext_prop_desc *d = data;
2186 u32 type, pdl;
2187 u16 pnl;
2188
2189 if (len < sizeof(*d) || h->interface >= ffs->interfaces_count)
2190 return -EINVAL;
2191 length = le32_to_cpu(d->dwSize);
2192 type = le32_to_cpu(d->dwPropertyDataType);
2193 if (type < USB_EXT_PROP_UNICODE ||
2194 type > USB_EXT_PROP_UNICODE_MULTI) {
2195 pr_vdebug("unsupported os descriptor property type: %d",
2196 type);
2197 return -EINVAL;
2198 }
2199 pnl = le16_to_cpu(d->wPropertyNameLength);
2200 pdl = le32_to_cpu(*(u32 *)((u8 *)data + 10 + pnl));
2201 if (length != 14 + pnl + pdl) {
2202 pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n",
2203 length, pnl, pdl, type);
2204 return -EINVAL;
2205 }
2206 ++ffs->ms_os_descs_ext_prop_count;
2207
2208 ffs->ms_os_descs_ext_prop_name_len += pnl * 2;
2209 ffs->ms_os_descs_ext_prop_data_len += pdl;
2210 }
2211 break;
2212 default:
2213 pr_vdebug("unknown descriptor: %d\n", type);
2214 return -EINVAL;
2215 }
2216 return length;
2217}
2218
2219static int __ffs_data_got_descs(struct ffs_data *ffs,
2220 char *const _data, size_t len)
2221{
2222 char *data = _data, *raw_descs;
2223 unsigned os_descs_count = 0, counts[3], flags;
2224 int ret = -EINVAL, i;
2225 struct ffs_desc_helper helper;
2226
2227 ENTER();
2228
2229 if (get_unaligned_le32(data + 4) != len)
2230 goto error;
2231
2232 switch (get_unaligned_le32(data)) {
2233 case FUNCTIONFS_DESCRIPTORS_MAGIC:
2234 flags = FUNCTIONFS_HAS_FS_DESC | FUNCTIONFS_HAS_HS_DESC;
2235 data += 8;
2236 len -= 8;
2237 break;
2238 case FUNCTIONFS_DESCRIPTORS_MAGIC_V2:
2239 flags = get_unaligned_le32(data + 8);
2240 ffs->user_flags = flags;
2241 if (flags & ~(FUNCTIONFS_HAS_FS_DESC |
2242 FUNCTIONFS_HAS_HS_DESC |
2243 FUNCTIONFS_HAS_SS_DESC |
2244 FUNCTIONFS_HAS_MS_OS_DESC |
2245 FUNCTIONFS_VIRTUAL_ADDR |
2246 FUNCTIONFS_EVENTFD)) {
2247 ret = -ENOSYS;
2248 goto error;
2249 }
2250 data += 12;
2251 len -= 12;
2252 break;
2253 default:
2254 goto error;
2255 }
2256
2257 if (flags & FUNCTIONFS_EVENTFD) {
2258 if (len < 4)
2259 goto error;
2260 ffs->ffs_eventfd =
2261 eventfd_ctx_fdget((int)get_unaligned_le32(data));
2262 if (IS_ERR(ffs->ffs_eventfd)) {
2263 ret = PTR_ERR(ffs->ffs_eventfd);
2264 ffs->ffs_eventfd = NULL;
2265 goto error;
2266 }
2267 data += 4;
2268 len -= 4;
2269 }
2270
2271
2272 for (i = 0; i < 3; ++i) {
2273 if (!(flags & (1 << i))) {
2274 counts[i] = 0;
2275 } else if (len < 4) {
2276 goto error;
2277 } else {
2278 counts[i] = get_unaligned_le32(data);
2279 data += 4;
2280 len -= 4;
2281 }
2282 }
2283 if (flags & (1 << i)) {
2284 os_descs_count = get_unaligned_le32(data);
2285 data += 4;
2286 len -= 4;
2287 };
2288
2289
2290 raw_descs = data;
2291 helper.ffs = ffs;
2292 for (i = 0; i < 3; ++i) {
2293 if (!counts[i])
2294 continue;
2295 helper.interfaces_count = 0;
2296 helper.eps_count = 0;
2297 ret = ffs_do_descs(counts[i], data, len,
2298 __ffs_data_do_entity, &helper);
2299 if (ret < 0)
2300 goto error;
2301 if (!ffs->eps_count && !ffs->interfaces_count) {
2302 ffs->eps_count = helper.eps_count;
2303 ffs->interfaces_count = helper.interfaces_count;
2304 } else {
2305 if (ffs->eps_count != helper.eps_count) {
2306 ret = -EINVAL;
2307 goto error;
2308 }
2309 if (ffs->interfaces_count != helper.interfaces_count) {
2310 ret = -EINVAL;
2311 goto error;
2312 }
2313 }
2314 data += ret;
2315 len -= ret;
2316 }
2317 if (os_descs_count) {
2318 ret = ffs_do_os_descs(os_descs_count, data, len,
2319 __ffs_data_do_os_desc, ffs);
2320 if (ret < 0)
2321 goto error;
2322 data += ret;
2323 len -= ret;
2324 }
2325
2326 if (raw_descs == data || len) {
2327 ret = -EINVAL;
2328 goto error;
2329 }
2330
2331 ffs->raw_descs_data = _data;
2332 ffs->raw_descs = raw_descs;
2333 ffs->raw_descs_length = data - raw_descs;
2334 ffs->fs_descs_count = counts[0];
2335 ffs->hs_descs_count = counts[1];
2336 ffs->ss_descs_count = counts[2];
2337 ffs->ms_os_descs_count = os_descs_count;
2338
2339 return 0;
2340
2341error:
2342 kfree(_data);
2343 return ret;
2344}
2345
2346static int __ffs_data_got_strings(struct ffs_data *ffs,
2347 char *const _data, size_t len)
2348{
2349 u32 str_count, needed_count, lang_count;
2350 struct usb_gadget_strings **stringtabs, *t;
2351 const char *data = _data;
2352 struct usb_string *s;
2353
2354 ENTER();
2355
2356 if (unlikely(get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
2357 get_unaligned_le32(data + 4) != len))
2358 goto error;
2359 str_count = get_unaligned_le32(data + 8);
2360 lang_count = get_unaligned_le32(data + 12);
2361
2362
2363 if (unlikely(!str_count != !lang_count))
2364 goto error;
2365
2366
2367 needed_count = ffs->strings_count;
2368 if (unlikely(str_count < needed_count))
2369 goto error;
2370
2371
2372
2373
2374
2375 if (!needed_count) {
2376 kfree(_data);
2377 return 0;
2378 }
2379
2380
2381 {
2382 unsigned i = 0;
2383 vla_group(d);
2384 vla_item(d, struct usb_gadget_strings *, stringtabs,
2385 lang_count + 1);
2386 vla_item(d, struct usb_gadget_strings, stringtab, lang_count);
2387 vla_item(d, struct usb_string, strings,
2388 lang_count*(needed_count+1));
2389
2390 char *vlabuf = kmalloc(vla_group_size(d), GFP_KERNEL);
2391
2392 if (unlikely(!vlabuf)) {
2393 kfree(_data);
2394 return -ENOMEM;
2395 }
2396
2397
2398 stringtabs = vla_ptr(vlabuf, d, stringtabs);
2399 t = vla_ptr(vlabuf, d, stringtab);
2400 i = lang_count;
2401 do {
2402 *stringtabs++ = t++;
2403 } while (--i);
2404 *stringtabs = NULL;
2405
2406
2407 stringtabs = vla_ptr(vlabuf, d, stringtabs);
2408 t = vla_ptr(vlabuf, d, stringtab);
2409 s = vla_ptr(vlabuf, d, strings);
2410 }
2411
2412
2413 data += 16;
2414 len -= 16;
2415
2416 do {
2417 unsigned needed = needed_count;
2418
2419 if (unlikely(len < 3))
2420 goto error_free;
2421 t->language = get_unaligned_le16(data);
2422 t->strings = s;
2423 ++t;
2424
2425 data += 2;
2426 len -= 2;
2427
2428
2429 do {
2430 size_t length = strnlen(data, len);
2431
2432 if (unlikely(length == len))
2433 goto error_free;
2434
2435
2436
2437
2438
2439
2440 if (likely(needed)) {
2441
2442
2443
2444
2445
2446 s->s = data;
2447 --needed;
2448 ++s;
2449 }
2450
2451 data += length + 1;
2452 len -= length + 1;
2453 } while (--str_count);
2454
2455 s->id = 0;
2456 s->s = NULL;
2457 ++s;
2458
2459 } while (--lang_count);
2460
2461
2462 if (unlikely(len))
2463 goto error_free;
2464
2465
2466 ffs->stringtabs = stringtabs;
2467 ffs->raw_strings = _data;
2468
2469 return 0;
2470
2471error_free:
2472 kfree(stringtabs);
2473error:
2474 kfree(_data);
2475 return -EINVAL;
2476}
2477
2478
2479
2480
2481static void __ffs_event_add(struct ffs_data *ffs,
2482 enum usb_functionfs_event_type type)
2483{
2484 enum usb_functionfs_event_type rem_type1, rem_type2 = type;
2485 int neg = 0;
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495 if (ffs->setup_state == FFS_SETUP_PENDING)
2496 ffs->setup_state = FFS_SETUP_CANCELLED;
2497
2498
2499
2500
2501
2502
2503
2504
2505 switch (type) {
2506 case FUNCTIONFS_RESUME:
2507 rem_type2 = FUNCTIONFS_SUSPEND;
2508
2509 case FUNCTIONFS_SUSPEND:
2510 case FUNCTIONFS_SETUP:
2511 rem_type1 = type;
2512
2513 break;
2514
2515 case FUNCTIONFS_BIND:
2516 case FUNCTIONFS_UNBIND:
2517 case FUNCTIONFS_DISABLE:
2518 case FUNCTIONFS_ENABLE:
2519
2520 rem_type1 = FUNCTIONFS_SUSPEND;
2521 rem_type2 = FUNCTIONFS_RESUME;
2522 neg = 1;
2523 break;
2524
2525 default:
2526 WARN(1, "%d: unknown event, this should not happen\n", type);
2527 return;
2528 }
2529
2530 {
2531 u8 *ev = ffs->ev.types, *out = ev;
2532 unsigned n = ffs->ev.count;
2533 for (; n; --n, ++ev)
2534 if ((*ev == rem_type1 || *ev == rem_type2) == neg)
2535 *out++ = *ev;
2536 else
2537 pr_vdebug("purging event %d\n", *ev);
2538 ffs->ev.count = out - ffs->ev.types;
2539 }
2540
2541 pr_vdebug("adding event %d\n", type);
2542 ffs->ev.types[ffs->ev.count++] = type;
2543 wake_up_locked(&ffs->ev.waitq);
2544 if (ffs->ffs_eventfd)
2545 eventfd_signal(ffs->ffs_eventfd, 1);
2546}
2547
2548static void ffs_event_add(struct ffs_data *ffs,
2549 enum usb_functionfs_event_type type)
2550{
2551 unsigned long flags;
2552 spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
2553 __ffs_event_add(ffs, type);
2554 spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
2555}
2556
2557
2558
2559static int ffs_ep_addr2idx(struct ffs_data *ffs, u8 endpoint_address)
2560{
2561 int i;
2562
2563 for (i = 1; i < ARRAY_SIZE(ffs->eps_addrmap); ++i)
2564 if (ffs->eps_addrmap[i] == endpoint_address)
2565 return i;
2566 return -ENOENT;
2567}
2568
2569static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep,
2570 struct usb_descriptor_header *desc,
2571 void *priv)
2572{
2573 struct usb_endpoint_descriptor *ds = (void *)desc;
2574 struct ffs_function *func = priv;
2575 struct ffs_ep *ffs_ep;
2576 unsigned ep_desc_id;
2577 int idx;
2578 static const char *speed_names[] = { "full", "high", "super" };
2579
2580 if (type != FFS_DESCRIPTOR)
2581 return 0;
2582
2583
2584
2585
2586
2587
2588
2589 if (func->function.ss_descriptors) {
2590 ep_desc_id = 2;
2591 func->function.ss_descriptors[(long)valuep] = desc;
2592 } else if (func->function.hs_descriptors) {
2593 ep_desc_id = 1;
2594 func->function.hs_descriptors[(long)valuep] = desc;
2595 } else {
2596 ep_desc_id = 0;
2597 func->function.fs_descriptors[(long)valuep] = desc;
2598 }
2599
2600 if (!desc || desc->bDescriptorType != USB_DT_ENDPOINT)
2601 return 0;
2602
2603 idx = ffs_ep_addr2idx(func->ffs, ds->bEndpointAddress) - 1;
2604 if (idx < 0)
2605 return idx;
2606
2607 ffs_ep = func->eps + idx;
2608
2609 if (unlikely(ffs_ep->descs[ep_desc_id])) {
2610 pr_err("two %sspeed descriptors for EP %d\n",
2611 speed_names[ep_desc_id],
2612 ds->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
2613 return -EINVAL;
2614 }
2615 ffs_ep->descs[ep_desc_id] = ds;
2616
2617 ffs_dump_mem(": Original ep desc", ds, ds->bLength);
2618 if (ffs_ep->ep) {
2619 ds->bEndpointAddress = ffs_ep->descs[0]->bEndpointAddress;
2620 if (!ds->wMaxPacketSize)
2621 ds->wMaxPacketSize = ffs_ep->descs[0]->wMaxPacketSize;
2622 } else {
2623 struct usb_request *req;
2624 struct usb_ep *ep;
2625 u8 bEndpointAddress;
2626
2627
2628
2629
2630
2631 bEndpointAddress = ds->bEndpointAddress;
2632 pr_vdebug("autoconfig\n");
2633 ep = usb_ep_autoconfig(func->gadget, ds);
2634 if (unlikely(!ep))
2635 return -ENOTSUPP;
2636 ep->driver_data = func->eps + idx;
2637
2638 req = usb_ep_alloc_request(ep, GFP_KERNEL);
2639 if (unlikely(!req))
2640 return -ENOMEM;
2641
2642 ffs_ep->ep = ep;
2643 ffs_ep->req = req;
2644 func->eps_revmap[ds->bEndpointAddress &
2645 USB_ENDPOINT_NUMBER_MASK] = idx + 1;
2646
2647
2648
2649
2650 if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
2651 ds->bEndpointAddress = bEndpointAddress;
2652 }
2653 ffs_dump_mem(": Rewritten ep desc", ds, ds->bLength);
2654
2655 return 0;
2656}
2657
2658static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep,
2659 struct usb_descriptor_header *desc,
2660 void *priv)
2661{
2662 struct ffs_function *func = priv;
2663 unsigned idx;
2664 u8 newValue;
2665
2666 switch (type) {
2667 default:
2668 case FFS_DESCRIPTOR:
2669
2670 return 0;
2671
2672 case FFS_INTERFACE:
2673 idx = *valuep;
2674 if (func->interfaces_nums[idx] < 0) {
2675 int id = usb_interface_id(func->conf, &func->function);
2676 if (unlikely(id < 0))
2677 return id;
2678 func->interfaces_nums[idx] = id;
2679 }
2680 newValue = func->interfaces_nums[idx];
2681 break;
2682
2683 case FFS_STRING:
2684
2685 newValue = func->ffs->stringtabs[0]->strings[*valuep - 1].id;
2686 break;
2687
2688 case FFS_ENDPOINT:
2689
2690
2691
2692
2693 if (desc->bDescriptorType == USB_DT_ENDPOINT)
2694 return 0;
2695
2696 idx = (*valuep & USB_ENDPOINT_NUMBER_MASK) - 1;
2697 if (unlikely(!func->eps[idx].ep))
2698 return -EINVAL;
2699
2700 {
2701 struct usb_endpoint_descriptor **descs;
2702 descs = func->eps[idx].descs;
2703 newValue = descs[descs[0] ? 0 : 1]->bEndpointAddress;
2704 }
2705 break;
2706 }
2707
2708 pr_vdebug("%02x -> %02x\n", *valuep, newValue);
2709 *valuep = newValue;
2710 return 0;
2711}
2712
2713static int __ffs_func_bind_do_os_desc(enum ffs_os_desc_type type,
2714 struct usb_os_desc_header *h, void *data,
2715 unsigned len, void *priv)
2716{
2717 struct ffs_function *func = priv;
2718 u8 length = 0;
2719
2720 switch (type) {
2721 case FFS_OS_DESC_EXT_COMPAT: {
2722 struct usb_ext_compat_desc *desc = data;
2723 struct usb_os_desc_table *t;
2724
2725 t = &func->function.os_desc_table[desc->bFirstInterfaceNumber];
2726 t->if_id = func->interfaces_nums[desc->bFirstInterfaceNumber];
2727 memcpy(t->os_desc->ext_compat_id, &desc->CompatibleID,
2728 ARRAY_SIZE(desc->CompatibleID) +
2729 ARRAY_SIZE(desc->SubCompatibleID));
2730 length = sizeof(*desc);
2731 }
2732 break;
2733 case FFS_OS_DESC_EXT_PROP: {
2734 struct usb_ext_prop_desc *desc = data;
2735 struct usb_os_desc_table *t;
2736 struct usb_os_desc_ext_prop *ext_prop;
2737 char *ext_prop_name;
2738 char *ext_prop_data;
2739
2740 t = &func->function.os_desc_table[h->interface];
2741 t->if_id = func->interfaces_nums[h->interface];
2742
2743 ext_prop = func->ffs->ms_os_descs_ext_prop_avail;
2744 func->ffs->ms_os_descs_ext_prop_avail += sizeof(*ext_prop);
2745
2746 ext_prop->type = le32_to_cpu(desc->dwPropertyDataType);
2747 ext_prop->name_len = le16_to_cpu(desc->wPropertyNameLength);
2748 ext_prop->data_len = le32_to_cpu(*(u32 *)
2749 usb_ext_prop_data_len_ptr(data, ext_prop->name_len));
2750 length = ext_prop->name_len + ext_prop->data_len + 14;
2751
2752 ext_prop_name = func->ffs->ms_os_descs_ext_prop_name_avail;
2753 func->ffs->ms_os_descs_ext_prop_name_avail +=
2754 ext_prop->name_len;
2755
2756 ext_prop_data = func->ffs->ms_os_descs_ext_prop_data_avail;
2757 func->ffs->ms_os_descs_ext_prop_data_avail +=
2758 ext_prop->data_len;
2759 memcpy(ext_prop_data,
2760 usb_ext_prop_data_ptr(data, ext_prop->name_len),
2761 ext_prop->data_len);
2762
2763 switch (ext_prop->type) {
2764 case USB_EXT_PROP_UNICODE:
2765 case USB_EXT_PROP_UNICODE_ENV:
2766 case USB_EXT_PROP_UNICODE_LINK:
2767 case USB_EXT_PROP_UNICODE_MULTI:
2768 ext_prop->data_len *= 2;
2769 break;
2770 }
2771 ext_prop->data = ext_prop_data;
2772
2773 memcpy(ext_prop_name, usb_ext_prop_name_ptr(data),
2774 ext_prop->name_len);
2775
2776 ext_prop->name_len *= 2;
2777 ext_prop->name = ext_prop_name;
2778
2779 t->os_desc->ext_prop_len +=
2780 ext_prop->name_len + ext_prop->data_len + 14;
2781 ++t->os_desc->ext_prop_count;
2782 list_add_tail(&ext_prop->entry, &t->os_desc->ext_prop);
2783 }
2784 break;
2785 default:
2786 pr_vdebug("unknown descriptor: %d\n", type);
2787 }
2788
2789 return length;
2790}
2791
2792static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f,
2793 struct usb_configuration *c)
2794{
2795 struct ffs_function *func = ffs_func_from_usb(f);
2796 struct f_fs_opts *ffs_opts =
2797 container_of(f->fi, struct f_fs_opts, func_inst);
2798 int ret;
2799
2800 ENTER();
2801
2802
2803
2804
2805
2806
2807
2808
2809 if (!ffs_opts->no_configfs)
2810 ffs_dev_lock();
2811 ret = ffs_opts->dev->desc_ready ? 0 : -ENODEV;
2812 func->ffs = ffs_opts->dev->ffs_data;
2813 if (!ffs_opts->no_configfs)
2814 ffs_dev_unlock();
2815 if (ret)
2816 return ERR_PTR(ret);
2817
2818 func->conf = c;
2819 func->gadget = c->cdev->gadget;
2820
2821
2822
2823
2824
2825
2826
2827
2828 if (!ffs_opts->refcnt) {
2829 ret = functionfs_bind(func->ffs, c->cdev);
2830 if (ret)
2831 return ERR_PTR(ret);
2832 }
2833 ffs_opts->refcnt++;
2834 func->function.strings = func->ffs->stringtabs;
2835
2836 return ffs_opts;
2837}
2838
2839static int _ffs_func_bind(struct usb_configuration *c,
2840 struct usb_function *f)
2841{
2842 struct ffs_function *func = ffs_func_from_usb(f);
2843 struct ffs_data *ffs = func->ffs;
2844
2845 const int full = !!func->ffs->fs_descs_count;
2846 const int high = gadget_is_dualspeed(func->gadget) &&
2847 func->ffs->hs_descs_count;
2848 const int super = gadget_is_superspeed(func->gadget) &&
2849 func->ffs->ss_descs_count;
2850
2851 int fs_len, hs_len, ss_len, ret, i;
2852 struct ffs_ep *eps_ptr;
2853
2854
2855 vla_group(d);
2856 vla_item_with_sz(d, struct ffs_ep, eps, ffs->eps_count);
2857 vla_item_with_sz(d, struct usb_descriptor_header *, fs_descs,
2858 full ? ffs->fs_descs_count + 1 : 0);
2859 vla_item_with_sz(d, struct usb_descriptor_header *, hs_descs,
2860 high ? ffs->hs_descs_count + 1 : 0);
2861 vla_item_with_sz(d, struct usb_descriptor_header *, ss_descs,
2862 super ? ffs->ss_descs_count + 1 : 0);
2863 vla_item_with_sz(d, short, inums, ffs->interfaces_count);
2864 vla_item_with_sz(d, struct usb_os_desc_table, os_desc_table,
2865 c->cdev->use_os_string ? ffs->interfaces_count : 0);
2866 vla_item_with_sz(d, char[16], ext_compat,
2867 c->cdev->use_os_string ? ffs->interfaces_count : 0);
2868 vla_item_with_sz(d, struct usb_os_desc, os_desc,
2869 c->cdev->use_os_string ? ffs->interfaces_count : 0);
2870 vla_item_with_sz(d, struct usb_os_desc_ext_prop, ext_prop,
2871 ffs->ms_os_descs_ext_prop_count);
2872 vla_item_with_sz(d, char, ext_prop_name,
2873 ffs->ms_os_descs_ext_prop_name_len);
2874 vla_item_with_sz(d, char, ext_prop_data,
2875 ffs->ms_os_descs_ext_prop_data_len);
2876 vla_item_with_sz(d, char, raw_descs, ffs->raw_descs_length);
2877 char *vlabuf;
2878
2879 ENTER();
2880
2881
2882 if (unlikely(!(full | high | super)))
2883 return -ENOTSUPP;
2884
2885
2886 vlabuf = kzalloc(vla_group_size(d), GFP_KERNEL);
2887 if (unlikely(!vlabuf))
2888 return -ENOMEM;
2889
2890 ffs->ms_os_descs_ext_prop_avail = vla_ptr(vlabuf, d, ext_prop);
2891 ffs->ms_os_descs_ext_prop_name_avail =
2892 vla_ptr(vlabuf, d, ext_prop_name);
2893 ffs->ms_os_descs_ext_prop_data_avail =
2894 vla_ptr(vlabuf, d, ext_prop_data);
2895
2896
2897 memcpy(vla_ptr(vlabuf, d, raw_descs), ffs->raw_descs,
2898 ffs->raw_descs_length);
2899
2900 memset(vla_ptr(vlabuf, d, inums), 0xff, d_inums__sz);
2901 eps_ptr = vla_ptr(vlabuf, d, eps);
2902 for (i = 0; i < ffs->eps_count; i++)
2903 eps_ptr[i].num = -1;
2904
2905
2906
2907
2908 func->eps = vla_ptr(vlabuf, d, eps);
2909 func->interfaces_nums = vla_ptr(vlabuf, d, inums);
2910
2911
2912
2913
2914
2915
2916 if (likely(full)) {
2917 func->function.fs_descriptors = vla_ptr(vlabuf, d, fs_descs);
2918 fs_len = ffs_do_descs(ffs->fs_descs_count,
2919 vla_ptr(vlabuf, d, raw_descs),
2920 d_raw_descs__sz,
2921 __ffs_func_bind_do_descs, func);
2922 if (unlikely(fs_len < 0)) {
2923 ret = fs_len;
2924 goto error;
2925 }
2926 } else {
2927 fs_len = 0;
2928 }
2929
2930 if (likely(high)) {
2931 func->function.hs_descriptors = vla_ptr(vlabuf, d, hs_descs);
2932 hs_len = ffs_do_descs(ffs->hs_descs_count,
2933 vla_ptr(vlabuf, d, raw_descs) + fs_len,
2934 d_raw_descs__sz - fs_len,
2935 __ffs_func_bind_do_descs, func);
2936 if (unlikely(hs_len < 0)) {
2937 ret = hs_len;
2938 goto error;
2939 }
2940 } else {
2941 hs_len = 0;
2942 }
2943
2944 if (likely(super)) {
2945 func->function.ss_descriptors = vla_ptr(vlabuf, d, ss_descs);
2946 ss_len = ffs_do_descs(ffs->ss_descs_count,
2947 vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len,
2948 d_raw_descs__sz - fs_len - hs_len,
2949 __ffs_func_bind_do_descs, func);
2950 if (unlikely(ss_len < 0)) {
2951 ret = ss_len;
2952 goto error;
2953 }
2954 } else {
2955 ss_len = 0;
2956 }
2957
2958
2959
2960
2961
2962
2963 ret = ffs_do_descs(ffs->fs_descs_count +
2964 (high ? ffs->hs_descs_count : 0) +
2965 (super ? ffs->ss_descs_count : 0),
2966 vla_ptr(vlabuf, d, raw_descs), d_raw_descs__sz,
2967 __ffs_func_bind_do_nums, func);
2968 if (unlikely(ret < 0))
2969 goto error;
2970
2971 func->function.os_desc_table = vla_ptr(vlabuf, d, os_desc_table);
2972 if (c->cdev->use_os_string) {
2973 for (i = 0; i < ffs->interfaces_count; ++i) {
2974 struct usb_os_desc *desc;
2975
2976 desc = func->function.os_desc_table[i].os_desc =
2977 vla_ptr(vlabuf, d, os_desc) +
2978 i * sizeof(struct usb_os_desc);
2979 desc->ext_compat_id =
2980 vla_ptr(vlabuf, d, ext_compat) + i * 16;
2981 INIT_LIST_HEAD(&desc->ext_prop);
2982 }
2983 ret = ffs_do_os_descs(ffs->ms_os_descs_count,
2984 vla_ptr(vlabuf, d, raw_descs) +
2985 fs_len + hs_len + ss_len,
2986 d_raw_descs__sz - fs_len - hs_len -
2987 ss_len,
2988 __ffs_func_bind_do_os_desc, func);
2989 if (unlikely(ret < 0))
2990 goto error;
2991 }
2992 func->function.os_desc_n =
2993 c->cdev->use_os_string ? ffs->interfaces_count : 0;
2994
2995
2996 ffs_event_add(ffs, FUNCTIONFS_BIND);
2997 return 0;
2998
2999error:
3000
3001 return ret;
3002}
3003
3004static int ffs_func_bind(struct usb_configuration *c,
3005 struct usb_function *f)
3006{
3007 struct f_fs_opts *ffs_opts = ffs_do_functionfs_bind(f, c);
3008 struct ffs_function *func = ffs_func_from_usb(f);
3009 int ret;
3010
3011 if (IS_ERR(ffs_opts))
3012 return PTR_ERR(ffs_opts);
3013
3014 ret = _ffs_func_bind(c, f);
3015 if (ret && !--ffs_opts->refcnt)
3016 functionfs_unbind(func->ffs);
3017
3018 return ret;
3019}
3020
3021
3022
3023
3024static void ffs_reset_work(struct work_struct *work)
3025{
3026 struct ffs_data *ffs = container_of(work,
3027 struct ffs_data, reset_work);
3028 ffs_data_reset(ffs);
3029}
3030
3031static int ffs_func_set_alt(struct usb_function *f,
3032 unsigned interface, unsigned alt)
3033{
3034 struct ffs_function *func = ffs_func_from_usb(f);
3035 struct ffs_data *ffs = func->ffs;
3036 int ret = 0, intf;
3037
3038 if (alt != (unsigned)-1) {
3039 intf = ffs_func_revmap_intf(func, interface);
3040 if (unlikely(intf < 0))
3041 return intf;
3042 }
3043
3044 if (ffs->func)
3045 ffs_func_eps_disable(ffs->func);
3046
3047 if (ffs->state == FFS_DEACTIVATED) {
3048 ffs->state = FFS_CLOSING;
3049 INIT_WORK(&ffs->reset_work, ffs_reset_work);
3050 schedule_work(&ffs->reset_work);
3051 return -ENODEV;
3052 }
3053
3054 if (ffs->state != FFS_ACTIVE)
3055 return -ENODEV;
3056
3057 if (alt == (unsigned)-1) {
3058 ffs->func = NULL;
3059 ffs_event_add(ffs, FUNCTIONFS_DISABLE);
3060 return 0;
3061 }
3062
3063 ffs->func = func;
3064 ret = ffs_func_eps_enable(func);
3065 if (likely(ret >= 0))
3066 ffs_event_add(ffs, FUNCTIONFS_ENABLE);
3067 return ret;
3068}
3069
3070static void ffs_func_disable(struct usb_function *f)
3071{
3072 ffs_func_set_alt(f, 0, (unsigned)-1);
3073}
3074
3075static int ffs_func_setup(struct usb_function *f,
3076 const struct usb_ctrlrequest *creq)
3077{
3078 struct ffs_function *func = ffs_func_from_usb(f);
3079 struct ffs_data *ffs = func->ffs;
3080 unsigned long flags;
3081 int ret;
3082
3083 ENTER();
3084
3085 pr_vdebug("creq->bRequestType = %02x\n", creq->bRequestType);
3086 pr_vdebug("creq->bRequest = %02x\n", creq->bRequest);
3087 pr_vdebug("creq->wValue = %04x\n", le16_to_cpu(creq->wValue));
3088 pr_vdebug("creq->wIndex = %04x\n", le16_to_cpu(creq->wIndex));
3089 pr_vdebug("creq->wLength = %04x\n", le16_to_cpu(creq->wLength));
3090
3091
3092
3093
3094
3095
3096
3097
3098
3099
3100 if (ffs->state != FFS_ACTIVE)
3101 return -ENODEV;
3102
3103 switch (creq->bRequestType & USB_RECIP_MASK) {
3104 case USB_RECIP_INTERFACE:
3105 ret = ffs_func_revmap_intf(func, le16_to_cpu(creq->wIndex));
3106 if (unlikely(ret < 0))
3107 return ret;
3108 break;
3109
3110 case USB_RECIP_ENDPOINT:
3111 ret = ffs_func_revmap_ep(func, le16_to_cpu(creq->wIndex));
3112 if (unlikely(ret < 0))
3113 return ret;
3114 if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
3115 ret = func->ffs->eps_addrmap[ret];
3116 break;
3117
3118 default:
3119 return -EOPNOTSUPP;
3120 }
3121
3122 spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
3123 ffs->ev.setup = *creq;
3124 ffs->ev.setup.wIndex = cpu_to_le16(ret);
3125 __ffs_event_add(ffs, FUNCTIONFS_SETUP);
3126 spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
3127
3128 return 0;
3129}
3130
3131static void ffs_func_suspend(struct usb_function *f)
3132{
3133 ENTER();
3134 ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_SUSPEND);
3135}
3136
3137static void ffs_func_resume(struct usb_function *f)
3138{
3139 ENTER();
3140 ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_RESUME);
3141}
3142
3143
3144
3145
3146static int ffs_func_revmap_ep(struct ffs_function *func, u8 num)
3147{
3148 num = func->eps_revmap[num & USB_ENDPOINT_NUMBER_MASK];
3149 return num ? num : -EDOM;
3150}
3151
3152static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf)
3153{
3154 short *nums = func->interfaces_nums;
3155 unsigned count = func->ffs->interfaces_count;
3156
3157 for (; count; --count, ++nums) {
3158 if (*nums >= 0 && *nums == intf)
3159 return nums - func->interfaces_nums;
3160 }
3161
3162 return -EDOM;
3163}
3164
3165
3166
3167
3168static LIST_HEAD(ffs_devices);
3169
3170static struct ffs_dev *_ffs_do_find_dev(const char *name)
3171{
3172 struct ffs_dev *dev;
3173
3174 list_for_each_entry(dev, &ffs_devices, entry) {
3175 if (!dev->name || !name)
3176 continue;
3177 if (strcmp(dev->name, name) == 0)
3178 return dev;
3179 }
3180
3181 return NULL;
3182}
3183
3184
3185
3186
3187static struct ffs_dev *_ffs_get_single_dev(void)
3188{
3189 struct ffs_dev *dev;
3190
3191 if (list_is_singular(&ffs_devices)) {
3192 dev = list_first_entry(&ffs_devices, struct ffs_dev, entry);
3193 if (dev->single)
3194 return dev;
3195 }
3196
3197 return NULL;
3198}
3199
3200
3201
3202
3203static struct ffs_dev *_ffs_find_dev(const char *name)
3204{
3205 struct ffs_dev *dev;
3206
3207 dev = _ffs_get_single_dev();
3208 if (dev)
3209 return dev;
3210
3211 return _ffs_do_find_dev(name);
3212}
3213
3214
3215
3216static inline struct f_fs_opts *to_ffs_opts(struct config_item *item)
3217{
3218 return container_of(to_config_group(item), struct f_fs_opts,
3219 func_inst.group);
3220}
3221
3222static void ffs_attr_release(struct config_item *item)
3223{
3224 struct f_fs_opts *opts = to_ffs_opts(item);
3225
3226 usb_put_function_instance(&opts->func_inst);
3227}
3228
3229static struct configfs_item_operations ffs_item_ops = {
3230 .release = ffs_attr_release,
3231};
3232
3233static struct config_item_type ffs_func_type = {
3234 .ct_item_ops = &ffs_item_ops,
3235 .ct_owner = THIS_MODULE,
3236};
3237
3238
3239
3240
3241static void ffs_free_inst(struct usb_function_instance *f)
3242{
3243 struct f_fs_opts *opts;
3244
3245 opts = to_f_fs_opts(f);
3246 ffs_dev_lock();
3247 _ffs_free_dev(opts->dev);
3248 ffs_dev_unlock();
3249 kfree(opts);
3250}
3251
3252#define MAX_INST_NAME_LEN 40
3253
3254static int ffs_set_inst_name(struct usb_function_instance *fi, const char *name)
3255{
3256 struct f_fs_opts *opts;
3257 char *ptr;
3258 const char *tmp;
3259 int name_len, ret;
3260
3261 name_len = strlen(name) + 1;
3262 if (name_len > MAX_INST_NAME_LEN)
3263 return -ENAMETOOLONG;
3264
3265 ptr = kstrndup(name, name_len, GFP_KERNEL);
3266 if (!ptr)
3267 return -ENOMEM;
3268
3269 opts = to_f_fs_opts(fi);
3270 tmp = NULL;
3271
3272 ffs_dev_lock();
3273
3274 tmp = opts->dev->name_allocated ? opts->dev->name : NULL;
3275 ret = _ffs_name_dev(opts->dev, ptr);
3276 if (ret) {
3277 kfree(ptr);
3278 ffs_dev_unlock();
3279 return ret;
3280 }
3281 opts->dev->name_allocated = true;
3282
3283 ffs_dev_unlock();
3284
3285 kfree(tmp);
3286
3287 return 0;
3288}
3289
3290static struct usb_function_instance *ffs_alloc_inst(void)
3291{
3292 struct f_fs_opts *opts;
3293 struct ffs_dev *dev;
3294
3295 opts = kzalloc(sizeof(*opts), GFP_KERNEL);
3296 if (!opts)
3297 return ERR_PTR(-ENOMEM);
3298
3299 opts->func_inst.set_inst_name = ffs_set_inst_name;
3300 opts->func_inst.free_func_inst = ffs_free_inst;
3301 ffs_dev_lock();
3302 dev = _ffs_alloc_dev();
3303 ffs_dev_unlock();
3304 if (IS_ERR(dev)) {
3305 kfree(opts);
3306 return ERR_CAST(dev);
3307 }
3308 opts->dev = dev;
3309 dev->opts = opts;
3310
3311 config_group_init_type_name(&opts->func_inst.group, "",
3312 &ffs_func_type);
3313 return &opts->func_inst;
3314}
3315
3316static void ffs_free(struct usb_function *f)
3317{
3318 kfree(ffs_func_from_usb(f));
3319}
3320
3321static void ffs_func_unbind(struct usb_configuration *c,
3322 struct usb_function *f)
3323{
3324 struct ffs_function *func = ffs_func_from_usb(f);
3325 struct ffs_data *ffs = func->ffs;
3326 struct f_fs_opts *opts =
3327 container_of(f->fi, struct f_fs_opts, func_inst);
3328 struct ffs_ep *ep = func->eps;
3329 unsigned count = ffs->eps_count;
3330 unsigned long flags;
3331
3332 ENTER();
3333 if (ffs->func == func) {
3334 ffs_func_eps_disable(func);
3335 ffs->func = NULL;
3336 }
3337
3338 if (!--opts->refcnt)
3339 functionfs_unbind(ffs);
3340
3341
3342 spin_lock_irqsave(&func->ffs->eps_lock, flags);
3343 do {
3344 if (ep->ep && ep->req)
3345 usb_ep_free_request(ep->ep, ep->req);
3346 ep->req = NULL;
3347 ++ep;
3348 } while (--count);
3349 spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
3350 kfree(func->eps);
3351 func->eps = NULL;
3352
3353
3354
3355
3356 func->function.fs_descriptors = NULL;
3357 func->function.hs_descriptors = NULL;
3358 func->function.ss_descriptors = NULL;
3359 func->interfaces_nums = NULL;
3360
3361 ffs_event_add(ffs, FUNCTIONFS_UNBIND);
3362}
3363
3364static struct usb_function *ffs_alloc(struct usb_function_instance *fi)
3365{
3366 struct ffs_function *func;
3367
3368 ENTER();
3369
3370 func = kzalloc(sizeof(*func), GFP_KERNEL);
3371 if (unlikely(!func))
3372 return ERR_PTR(-ENOMEM);
3373
3374 func->function.name = "Function FS Gadget";
3375
3376 func->function.bind = ffs_func_bind;
3377 func->function.unbind = ffs_func_unbind;
3378 func->function.set_alt = ffs_func_set_alt;
3379 func->function.disable = ffs_func_disable;
3380 func->function.setup = ffs_func_setup;
3381 func->function.suspend = ffs_func_suspend;
3382 func->function.resume = ffs_func_resume;
3383 func->function.free_func = ffs_free;
3384
3385 return &func->function;
3386}
3387
3388
3389
3390
3391static struct ffs_dev *_ffs_alloc_dev(void)
3392{
3393 struct ffs_dev *dev;
3394 int ret;
3395
3396 if (_ffs_get_single_dev())
3397 return ERR_PTR(-EBUSY);
3398
3399 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3400 if (!dev)
3401 return ERR_PTR(-ENOMEM);
3402
3403 if (list_empty(&ffs_devices)) {
3404 ret = functionfs_init();
3405 if (ret) {
3406 kfree(dev);
3407 return ERR_PTR(ret);
3408 }
3409 }
3410
3411 list_add(&dev->entry, &ffs_devices);
3412
3413 return dev;
3414}
3415
3416
3417
3418
3419
3420static int _ffs_name_dev(struct ffs_dev *dev, const char *name)
3421{
3422 struct ffs_dev *existing;
3423
3424 existing = _ffs_do_find_dev(name);
3425 if (existing)
3426 return -EBUSY;
3427
3428 dev->name = name;
3429
3430 return 0;
3431}
3432
3433
3434
3435
3436int ffs_name_dev(struct ffs_dev *dev, const char *name)
3437{
3438 int ret;
3439
3440 ffs_dev_lock();
3441 ret = _ffs_name_dev(dev, name);
3442 ffs_dev_unlock();
3443
3444 return ret;
3445}
3446EXPORT_SYMBOL_GPL(ffs_name_dev);
3447
3448int ffs_single_dev(struct ffs_dev *dev)
3449{
3450 int ret;
3451
3452 ret = 0;
3453 ffs_dev_lock();
3454
3455 if (!list_is_singular(&ffs_devices))
3456 ret = -EBUSY;
3457 else
3458 dev->single = true;
3459
3460 ffs_dev_unlock();
3461 return ret;
3462}
3463EXPORT_SYMBOL_GPL(ffs_single_dev);
3464
3465
3466
3467
3468static void _ffs_free_dev(struct ffs_dev *dev)
3469{
3470 list_del(&dev->entry);
3471 if (dev->name_allocated)
3472 kfree(dev->name);
3473 kfree(dev);
3474 if (list_empty(&ffs_devices))
3475 functionfs_cleanup();
3476}
3477
3478static void *ffs_acquire_dev(const char *dev_name)
3479{
3480 struct ffs_dev *ffs_dev;
3481
3482 ENTER();
3483 ffs_dev_lock();
3484
3485 ffs_dev = _ffs_find_dev(dev_name);
3486 if (!ffs_dev)
3487 ffs_dev = ERR_PTR(-ENOENT);
3488 else if (ffs_dev->mounted)
3489 ffs_dev = ERR_PTR(-EBUSY);
3490 else if (ffs_dev->ffs_acquire_dev_callback &&
3491 ffs_dev->ffs_acquire_dev_callback(ffs_dev))
3492 ffs_dev = ERR_PTR(-ENOENT);
3493 else
3494 ffs_dev->mounted = true;
3495
3496 ffs_dev_unlock();
3497 return ffs_dev;
3498}
3499
3500static void ffs_release_dev(struct ffs_data *ffs_data)
3501{
3502 struct ffs_dev *ffs_dev;
3503
3504 ENTER();
3505 ffs_dev_lock();
3506
3507 ffs_dev = ffs_data->private_data;
3508 if (ffs_dev) {
3509 ffs_dev->mounted = false;
3510
3511 if (ffs_dev->ffs_release_dev_callback)
3512 ffs_dev->ffs_release_dev_callback(ffs_dev);
3513 }
3514
3515 ffs_dev_unlock();
3516}
3517
3518static int ffs_ready(struct ffs_data *ffs)
3519{
3520 struct ffs_dev *ffs_obj;
3521 int ret = 0;
3522
3523 ENTER();
3524 ffs_dev_lock();
3525
3526 ffs_obj = ffs->private_data;
3527 if (!ffs_obj) {
3528 ret = -EINVAL;
3529 goto done;
3530 }
3531 if (WARN_ON(ffs_obj->desc_ready)) {
3532 ret = -EBUSY;
3533 goto done;
3534 }
3535
3536 ffs_obj->desc_ready = true;
3537 ffs_obj->ffs_data = ffs;
3538
3539 if (ffs_obj->ffs_ready_callback) {
3540 ret = ffs_obj->ffs_ready_callback(ffs);
3541 if (ret)
3542 goto done;
3543 }
3544
3545 set_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags);
3546done:
3547 ffs_dev_unlock();
3548 return ret;
3549}
3550
3551static void ffs_closed(struct ffs_data *ffs)
3552{
3553 struct ffs_dev *ffs_obj;
3554 struct f_fs_opts *opts;
3555
3556 ENTER();
3557 ffs_dev_lock();
3558
3559 ffs_obj = ffs->private_data;
3560 if (!ffs_obj)
3561 goto done;
3562
3563 ffs_obj->desc_ready = false;
3564
3565 if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) &&
3566 ffs_obj->ffs_closed_callback)
3567 ffs_obj->ffs_closed_callback(ffs);
3568
3569 if (ffs_obj->opts)
3570 opts = ffs_obj->opts;
3571 else
3572 goto done;
3573
3574 if (opts->no_configfs || !opts->func_inst.group.cg_item.ci_parent
3575 || !atomic_read(&opts->func_inst.group.cg_item.ci_kref.refcount))
3576 goto done;
3577
3578 unregister_gadget_item(ffs_obj->opts->
3579 func_inst.group.cg_item.ci_parent->ci_parent);
3580done:
3581 ffs_dev_unlock();
3582}
3583
3584
3585
3586static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
3587{
3588 return nonblock
3589 ? likely(mutex_trylock(mutex)) ? 0 : -EAGAIN
3590 : mutex_lock_interruptible(mutex);
3591}
3592
3593static char *ffs_prepare_buffer(const char __user *buf, size_t len)
3594{
3595 char *data;
3596
3597 if (unlikely(!len))
3598 return NULL;
3599
3600 data = kmalloc(len, GFP_KERNEL);
3601 if (unlikely(!data))
3602 return ERR_PTR(-ENOMEM);
3603
3604 if (unlikely(copy_from_user(data, buf, len))) {
3605 kfree(data);
3606 return ERR_PTR(-EFAULT);
3607 }
3608
3609 pr_vdebug("Buffer from user space:\n");
3610 ffs_dump_mem("", data, len);
3611
3612 return data;
3613}
3614
3615DECLARE_USB_FUNCTION_INIT(ffs, ffs_alloc_inst, ffs_alloc);
3616MODULE_LICENSE("GPL");
3617MODULE_AUTHOR("Michal Nazarewicz");
3618