2 * f_fs.c -- user mode file system API for USB composite function controllers
4 * Copyright (C) 2010 Samsung Electronics
5 * Author: Michal Nazarewicz <mina86@mina86.com>
7 * Based on inode.c (GadgetFS) which was:
8 * Copyright (C) 2003-2004 David Brownell
9 * Copyright (C) 2003 Agilent Technologies
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
19 /* #define VERBOSE_DEBUG */
21 #include <linux/blkdev.h>
22 #include <linux/pagemap.h>
23 #include <linux/export.h>
24 #include <linux/hid.h>
25 #include <linux/module.h>
26 #include <asm/unaligned.h>
28 #include <linux/usb/composite.h>
29 #include <linux/usb/functionfs.h>
31 #include <linux/aio.h>
32 #include <linux/mmu_context.h>
33 #include <linux/poll.h>
34 #include <linux/eventfd.h>
38 #include "u_os_desc.h"
41 #define FUNCTIONFS_MAGIC 0xa647361 /* Chosen by a honest dice roll ;) */
43 /* Reference counter handling */
44 static void ffs_data_get(struct ffs_data
*ffs
);
45 static void ffs_data_put(struct ffs_data
*ffs
);
46 /* Creates new ffs_data object. */
47 static struct ffs_data
*__must_check
ffs_data_new(void) __attribute__((malloc
));
49 /* Opened counter handling. */
50 static void ffs_data_opened(struct ffs_data
*ffs
);
51 static void ffs_data_closed(struct ffs_data
*ffs
);
53 /* Called with ffs->mutex held; take over ownership of data. */
54 static int __must_check
55 __ffs_data_got_descs(struct ffs_data
*ffs
, char *data
, size_t len
);
56 static int __must_check
57 __ffs_data_got_strings(struct ffs_data
*ffs
, char *data
, size_t len
);
60 /* The function structure ***************************************************/
65 struct usb_configuration
*conf
;
66 struct usb_gadget
*gadget
;
71 short *interfaces_nums
;
73 struct usb_function function
;
77 static struct ffs_function
*ffs_func_from_usb(struct usb_function
*f
)
79 return container_of(f
, struct ffs_function
, function
);
83 static inline enum ffs_setup_state
84 ffs_setup_state_clear_cancelled(struct ffs_data
*ffs
)
86 return (enum ffs_setup_state
)
87 cmpxchg(&ffs
->setup_state
, FFS_SETUP_CANCELLED
, FFS_NO_SETUP
);
91 static void ffs_func_eps_disable(struct ffs_function
*func
);
92 static int __must_check
ffs_func_eps_enable(struct ffs_function
*func
);
94 static int ffs_func_bind(struct usb_configuration
*,
95 struct usb_function
*);
96 static int ffs_func_set_alt(struct usb_function
*, unsigned, unsigned);
97 static void ffs_func_disable(struct usb_function
*);
98 static int ffs_func_setup(struct usb_function
*,
99 const struct usb_ctrlrequest
*);
100 static void ffs_func_suspend(struct usb_function
*);
101 static void ffs_func_resume(struct usb_function
*);
104 static int ffs_func_revmap_ep(struct ffs_function
*func
, u8 num
);
105 static int ffs_func_revmap_intf(struct ffs_function
*func
, u8 intf
);
108 /* The endpoints structures *************************************************/
111 struct usb_ep
*ep
; /* P: ffs->eps_lock */
112 struct usb_request
*req
; /* P: epfile->mutex */
114 /* [0]: full speed, [1]: high speed, [2]: super speed */
115 struct usb_endpoint_descriptor
*descs
[3];
119 int status
; /* P: epfile->mutex */
123 /* Protects ep->ep and ep->req. */
125 wait_queue_head_t wait
;
127 struct ffs_data
*ffs
;
128 struct ffs_ep
*ep
; /* P: ffs->eps_lock */
130 struct dentry
*dentry
;
134 unsigned char in
; /* P: ffs->eps_lock */
135 unsigned char isoc
; /* P: ffs->eps_lock */
140 /* ffs_io_data structure ***************************************************/
147 const struct iovec
*iovec
;
148 unsigned long nr_segs
;
152 struct mm_struct
*mm
;
153 struct work_struct work
;
156 struct usb_request
*req
;
158 struct ffs_data
*ffs
;
161 struct ffs_desc_helper
{
162 struct ffs_data
*ffs
;
163 unsigned interfaces_count
;
167 static int __must_check
ffs_epfiles_create(struct ffs_data
*ffs
);
168 static void ffs_epfiles_destroy(struct ffs_epfile
*epfiles
, unsigned count
);
170 static struct dentry
*
171 ffs_sb_create_file(struct super_block
*sb
, const char *name
, void *data
,
172 const struct file_operations
*fops
);
174 /* Devices management *******************************************************/
176 DEFINE_MUTEX(ffs_lock
);
177 EXPORT_SYMBOL_GPL(ffs_lock
);
179 static struct ffs_dev
*_ffs_find_dev(const char *name
);
180 static struct ffs_dev
*_ffs_alloc_dev(void);
181 static int _ffs_name_dev(struct ffs_dev
*dev
, const char *name
);
182 static void _ffs_free_dev(struct ffs_dev
*dev
);
183 static void *ffs_acquire_dev(const char *dev_name
);
184 static void ffs_release_dev(struct ffs_data
*ffs_data
);
185 static int ffs_ready(struct ffs_data
*ffs
);
186 static void ffs_closed(struct ffs_data
*ffs
);
188 /* Misc helper functions ****************************************************/
190 static int ffs_mutex_lock(struct mutex
*mutex
, unsigned nonblock
)
191 __attribute__((warn_unused_result
, nonnull
));
192 static char *ffs_prepare_buffer(const char __user
*buf
, size_t len
)
193 __attribute__((warn_unused_result
, nonnull
));
196 /* Control file aka ep0 *****************************************************/
198 static void ffs_ep0_complete(struct usb_ep
*ep
, struct usb_request
*req
)
200 struct ffs_data
*ffs
= req
->context
;
202 complete_all(&ffs
->ep0req_completion
);
205 static int __ffs_ep0_queue_wait(struct ffs_data
*ffs
, char *data
, size_t len
)
207 struct usb_request
*req
= ffs
->ep0req
;
210 req
->zero
= len
< le16_to_cpu(ffs
->ev
.setup
.wLength
);
212 spin_unlock_irq(&ffs
->ev
.waitq
.lock
);
218 * UDC layer requires to provide a buffer even for ZLP, but should
219 * not use it at all. Let's provide some poisoned pointer to catch
220 * possible bug in the driver.
222 if (req
->buf
== NULL
)
223 req
->buf
= (void *)0xDEADBABE;
225 reinit_completion(&ffs
->ep0req_completion
);
227 ret
= usb_ep_queue(ffs
->gadget
->ep0
, req
, GFP_ATOMIC
);
228 if (unlikely(ret
< 0))
231 ret
= wait_for_completion_interruptible(&ffs
->ep0req_completion
);
233 usb_ep_dequeue(ffs
->gadget
->ep0
, req
);
237 ffs
->setup_state
= FFS_NO_SETUP
;
238 return req
->status
? req
->status
: req
->actual
;
241 static int __ffs_ep0_stall(struct ffs_data
*ffs
)
243 if (ffs
->ev
.can_stall
) {
244 pr_vdebug("ep0 stall\n");
245 usb_ep_set_halt(ffs
->gadget
->ep0
);
246 ffs
->setup_state
= FFS_NO_SETUP
;
249 pr_debug("bogus ep0 stall!\n");
254 static ssize_t
ffs_ep0_write(struct file
*file
, const char __user
*buf
,
255 size_t len
, loff_t
*ptr
)
257 struct ffs_data
*ffs
= file
->private_data
;
263 /* Fast check if setup was canceled */
264 if (ffs_setup_state_clear_cancelled(ffs
) == FFS_SETUP_CANCELLED
)
268 ret
= ffs_mutex_lock(&ffs
->mutex
, file
->f_flags
& O_NONBLOCK
);
269 if (unlikely(ret
< 0))
273 switch (ffs
->state
) {
274 case FFS_READ_DESCRIPTORS
:
275 case FFS_READ_STRINGS
:
277 if (unlikely(len
< 16)) {
282 data
= ffs_prepare_buffer(buf
, len
);
289 if (ffs
->state
== FFS_READ_DESCRIPTORS
) {
290 pr_info("read descriptors\n");
291 ret
= __ffs_data_got_descs(ffs
, data
, len
);
292 if (unlikely(ret
< 0))
295 ffs
->state
= FFS_READ_STRINGS
;
298 pr_info("read strings\n");
299 ret
= __ffs_data_got_strings(ffs
, data
, len
);
300 if (unlikely(ret
< 0))
303 ret
= ffs_epfiles_create(ffs
);
305 ffs
->state
= FFS_CLOSING
;
309 ffs
->state
= FFS_ACTIVE
;
310 mutex_unlock(&ffs
->mutex
);
312 ret
= ffs_ready(ffs
);
313 if (unlikely(ret
< 0)) {
314 ffs
->state
= FFS_CLOSING
;
318 set_bit(FFS_FL_CALL_CLOSED_CALLBACK
, &ffs
->flags
);
326 * We're called from user space, we can use _irq
327 * rather then _irqsave
329 spin_lock_irq(&ffs
->ev
.waitq
.lock
);
330 switch (ffs_setup_state_clear_cancelled(ffs
)) {
331 case FFS_SETUP_CANCELLED
:
339 case FFS_SETUP_PENDING
:
343 /* FFS_SETUP_PENDING */
344 if (!(ffs
->ev
.setup
.bRequestType
& USB_DIR_IN
)) {
345 spin_unlock_irq(&ffs
->ev
.waitq
.lock
);
346 ret
= __ffs_ep0_stall(ffs
);
350 /* FFS_SETUP_PENDING and not stall */
351 len
= min(len
, (size_t)le16_to_cpu(ffs
->ev
.setup
.wLength
));
353 spin_unlock_irq(&ffs
->ev
.waitq
.lock
);
355 data
= ffs_prepare_buffer(buf
, len
);
361 spin_lock_irq(&ffs
->ev
.waitq
.lock
);
364 * We are guaranteed to be still in FFS_ACTIVE state
365 * but the state of setup could have changed from
366 * FFS_SETUP_PENDING to FFS_SETUP_CANCELLED so we need
367 * to check for that. If that happened we copied data
368 * from user space in vain but it's unlikely.
370 * For sure we are not in FFS_NO_SETUP since this is
371 * the only place FFS_SETUP_PENDING -> FFS_NO_SETUP
372 * transition can be performed and it's protected by
375 if (ffs_setup_state_clear_cancelled(ffs
) ==
376 FFS_SETUP_CANCELLED
) {
379 spin_unlock_irq(&ffs
->ev
.waitq
.lock
);
381 /* unlocks spinlock */
382 ret
= __ffs_ep0_queue_wait(ffs
, data
, len
);
392 mutex_unlock(&ffs
->mutex
);
396 /* Called with ffs->ev.waitq.lock and ffs->mutex held, both released on exit. */
397 static ssize_t
__ffs_ep0_read_events(struct ffs_data
*ffs
, char __user
*buf
,
401 * n cannot be bigger than ffs->ev.count, which cannot be bigger than
402 * size of ffs->ev.types array (which is four) so that's how much space
405 struct usb_functionfs_event events
[ARRAY_SIZE(ffs
->ev
.types
)];
406 const size_t size
= n
* sizeof *events
;
409 memset(events
, 0, size
);
412 events
[i
].type
= ffs
->ev
.types
[i
];
413 if (events
[i
].type
== FUNCTIONFS_SETUP
) {
414 events
[i
].u
.setup
= ffs
->ev
.setup
;
415 ffs
->setup_state
= FFS_SETUP_PENDING
;
421 memmove(ffs
->ev
.types
, ffs
->ev
.types
+ n
,
422 ffs
->ev
.count
* sizeof *ffs
->ev
.types
);
424 spin_unlock_irq(&ffs
->ev
.waitq
.lock
);
425 mutex_unlock(&ffs
->mutex
);
427 return unlikely(__copy_to_user(buf
, events
, size
)) ? -EFAULT
: size
;
430 static ssize_t
ffs_ep0_read(struct file
*file
, char __user
*buf
,
431 size_t len
, loff_t
*ptr
)
433 struct ffs_data
*ffs
= file
->private_data
;
440 /* Fast check if setup was canceled */
441 if (ffs_setup_state_clear_cancelled(ffs
) == FFS_SETUP_CANCELLED
)
445 ret
= ffs_mutex_lock(&ffs
->mutex
, file
->f_flags
& O_NONBLOCK
);
446 if (unlikely(ret
< 0))
450 if (ffs
->state
!= FFS_ACTIVE
) {
456 * We're called from user space, we can use _irq rather then
459 spin_lock_irq(&ffs
->ev
.waitq
.lock
);
461 switch (ffs_setup_state_clear_cancelled(ffs
)) {
462 case FFS_SETUP_CANCELLED
:
467 n
= len
/ sizeof(struct usb_functionfs_event
);
473 if ((file
->f_flags
& O_NONBLOCK
) && !ffs
->ev
.count
) {
478 if (wait_event_interruptible_exclusive_locked_irq(ffs
->ev
.waitq
,
484 return __ffs_ep0_read_events(ffs
, buf
,
485 min(n
, (size_t)ffs
->ev
.count
));
487 case FFS_SETUP_PENDING
:
488 if (ffs
->ev
.setup
.bRequestType
& USB_DIR_IN
) {
489 spin_unlock_irq(&ffs
->ev
.waitq
.lock
);
490 ret
= __ffs_ep0_stall(ffs
);
494 len
= min(len
, (size_t)le16_to_cpu(ffs
->ev
.setup
.wLength
));
496 spin_unlock_irq(&ffs
->ev
.waitq
.lock
);
499 data
= kmalloc(len
, GFP_KERNEL
);
500 if (unlikely(!data
)) {
506 spin_lock_irq(&ffs
->ev
.waitq
.lock
);
508 /* See ffs_ep0_write() */
509 if (ffs_setup_state_clear_cancelled(ffs
) ==
510 FFS_SETUP_CANCELLED
) {
515 /* unlocks spinlock */
516 ret
= __ffs_ep0_queue_wait(ffs
, data
, len
);
517 if (likely(ret
> 0) && unlikely(__copy_to_user(buf
, data
, len
)))
526 spin_unlock_irq(&ffs
->ev
.waitq
.lock
);
528 mutex_unlock(&ffs
->mutex
);
533 static int ffs_ep0_open(struct inode
*inode
, struct file
*file
)
535 struct ffs_data
*ffs
= inode
->i_private
;
539 if (unlikely(ffs
->state
== FFS_CLOSING
))
542 file
->private_data
= ffs
;
543 ffs_data_opened(ffs
);
548 static int ffs_ep0_release(struct inode
*inode
, struct file
*file
)
550 struct ffs_data
*ffs
= file
->private_data
;
554 ffs_data_closed(ffs
);
559 static long ffs_ep0_ioctl(struct file
*file
, unsigned code
, unsigned long value
)
561 struct ffs_data
*ffs
= file
->private_data
;
562 struct usb_gadget
*gadget
= ffs
->gadget
;
567 if (code
== FUNCTIONFS_INTERFACE_REVMAP
) {
568 struct ffs_function
*func
= ffs
->func
;
569 ret
= func
? ffs_func_revmap_intf(func
, value
) : -ENODEV
;
570 } else if (gadget
&& gadget
->ops
->ioctl
) {
571 ret
= gadget
->ops
->ioctl(gadget
, code
, value
);
579 static unsigned int ffs_ep0_poll(struct file
*file
, poll_table
*wait
)
581 struct ffs_data
*ffs
= file
->private_data
;
582 unsigned int mask
= POLLWRNORM
;
585 poll_wait(file
, &ffs
->ev
.waitq
, wait
);
587 ret
= ffs_mutex_lock(&ffs
->mutex
, file
->f_flags
& O_NONBLOCK
);
588 if (unlikely(ret
< 0))
591 switch (ffs
->state
) {
592 case FFS_READ_DESCRIPTORS
:
593 case FFS_READ_STRINGS
:
598 switch (ffs
->setup_state
) {
604 case FFS_SETUP_PENDING
:
605 case FFS_SETUP_CANCELLED
:
606 mask
|= (POLLIN
| POLLOUT
);
611 case FFS_DEACTIVATED
:
615 mutex_unlock(&ffs
->mutex
);
620 static const struct file_operations ffs_ep0_operations
= {
623 .open
= ffs_ep0_open
,
624 .write
= ffs_ep0_write
,
625 .read
= ffs_ep0_read
,
626 .release
= ffs_ep0_release
,
627 .unlocked_ioctl
= ffs_ep0_ioctl
,
628 .poll
= ffs_ep0_poll
,
632 /* "Normal" endpoints operations ********************************************/
634 static void ffs_epfile_io_complete(struct usb_ep
*_ep
, struct usb_request
*req
)
637 if (likely(req
->context
)) {
638 struct ffs_ep
*ep
= _ep
->driver_data
;
639 ep
->status
= req
->status
? req
->status
: req
->actual
;
640 complete(req
->context
);
644 static void ffs_user_copy_worker(struct work_struct
*work
)
646 struct ffs_io_data
*io_data
= container_of(work
, struct ffs_io_data
,
648 int ret
= io_data
->req
->status
? io_data
->req
->status
:
649 io_data
->req
->actual
;
651 if (io_data
->read
&& ret
> 0) {
656 * Since req->length may be bigger than io_data->len (after
657 * being rounded up to maxpacketsize), we may end up with more
658 * data then user space has space for.
660 ret
= min_t(int, ret
, io_data
->len
);
663 for (i
= 0; i
< io_data
->nr_segs
; i
++) {
664 size_t len
= min_t(size_t, ret
- pos
,
665 io_data
->iovec
[i
].iov_len
);
668 if (unlikely(copy_to_user(io_data
->iovec
[i
].iov_base
,
669 &io_data
->buf
[pos
], len
))) {
675 unuse_mm(io_data
->mm
);
678 aio_complete(io_data
->kiocb
, ret
, ret
);
680 if (io_data
->ffs
->ffs_eventfd
&& !io_data
->kiocb
->ki_eventfd
)
681 eventfd_signal(io_data
->ffs
->ffs_eventfd
, 1);
683 usb_ep_free_request(io_data
->ep
, io_data
->req
);
685 io_data
->kiocb
->private = NULL
;
687 kfree(io_data
->iovec
);
692 static void ffs_epfile_async_io_complete(struct usb_ep
*_ep
,
693 struct usb_request
*req
)
695 struct ffs_io_data
*io_data
= req
->context
;
699 INIT_WORK(&io_data
->work
, ffs_user_copy_worker
);
700 schedule_work(&io_data
->work
);
703 static ssize_t
ffs_epfile_io(struct file
*file
, struct ffs_io_data
*io_data
)
705 struct ffs_epfile
*epfile
= file
->private_data
;
708 ssize_t ret
, data_len
= -EINVAL
;
711 /* Are we still active? */
712 if (WARN_ON(epfile
->ffs
->state
!= FFS_ACTIVE
)) {
717 /* Wait for endpoint to be enabled */
720 if (file
->f_flags
& O_NONBLOCK
) {
725 ret
= wait_event_interruptible(epfile
->wait
, (ep
= epfile
->ep
));
733 halt
= (!io_data
->read
== !epfile
->in
);
734 if (halt
&& epfile
->isoc
) {
739 /* Allocate & copy */
742 * if we _do_ wait above, the epfile->ffs->gadget might be NULL
743 * before the waiting completes, so do not assign to 'gadget' earlier
745 struct usb_gadget
*gadget
= epfile
->ffs
->gadget
;
747 spin_lock_irq(&epfile
->ffs
->eps_lock
);
748 /* In the meantime, endpoint got disabled or changed. */
749 if (epfile
->ep
!= ep
) {
750 spin_unlock_irq(&epfile
->ffs
->eps_lock
);
754 * Controller may require buffer size to be aligned to
755 * maxpacketsize of an out endpoint.
757 data_len
= io_data
->read
?
758 usb_ep_align_maybe(gadget
, ep
->ep
, io_data
->len
) :
760 spin_unlock_irq(&epfile
->ffs
->eps_lock
);
762 data
= kmalloc(data_len
, GFP_KERNEL
);
765 if (io_data
->aio
&& !io_data
->read
) {
768 for (i
= 0; i
< io_data
->nr_segs
; i
++) {
769 if (unlikely(copy_from_user(&data
[pos
],
770 io_data
->iovec
[i
].iov_base
,
771 io_data
->iovec
[i
].iov_len
))) {
775 pos
+= io_data
->iovec
[i
].iov_len
;
778 if (!io_data
->read
&&
779 unlikely(__copy_from_user(data
, io_data
->buf
,
787 /* We will be using request */
788 ret
= ffs_mutex_lock(&epfile
->mutex
, file
->f_flags
& O_NONBLOCK
);
792 spin_lock_irq(&epfile
->ffs
->eps_lock
);
794 if (epfile
->ep
!= ep
) {
795 /* In the meantime, endpoint got disabled or changed. */
797 spin_unlock_irq(&epfile
->ffs
->eps_lock
);
800 if (likely(epfile
->ep
== ep
) && !WARN_ON(!ep
->ep
))
801 usb_ep_set_halt(ep
->ep
);
802 spin_unlock_irq(&epfile
->ffs
->eps_lock
);
805 /* Fire the request */
806 struct usb_request
*req
;
809 * Sanity Check: even though data_len can't be used
810 * uninitialized at the time I write this comment, some
811 * compilers complain about this situation.
812 * In order to keep the code clean from warnings, data_len is
813 * being initialized to -EINVAL during its declaration, which
814 * means we can't rely on compiler anymore to warn no future
815 * changes won't result in data_len being used uninitialized.
816 * For such reason, we're adding this redundant sanity check
819 if (unlikely(data_len
== -EINVAL
)) {
820 WARN(1, "%s: data_len == -EINVAL\n", __func__
);
826 req
= usb_ep_alloc_request(ep
->ep
, GFP_KERNEL
);
831 req
->length
= data_len
;
834 io_data
->ep
= ep
->ep
;
836 io_data
->ffs
= epfile
->ffs
;
838 req
->context
= io_data
;
839 req
->complete
= ffs_epfile_async_io_complete
;
841 ret
= usb_ep_queue(ep
->ep
, req
, GFP_ATOMIC
);
843 usb_ep_free_request(ep
->ep
, req
);
848 spin_unlock_irq(&epfile
->ffs
->eps_lock
);
850 DECLARE_COMPLETION_ONSTACK(done
);
854 req
->length
= data_len
;
856 req
->context
= &done
;
857 req
->complete
= ffs_epfile_io_complete
;
859 ret
= usb_ep_queue(ep
->ep
, req
, GFP_ATOMIC
);
861 spin_unlock_irq(&epfile
->ffs
->eps_lock
);
863 if (unlikely(ret
< 0)) {
866 wait_for_completion_interruptible(&done
))) {
868 usb_ep_dequeue(ep
->ep
, req
);
871 * XXX We may end up silently droping data
872 * here. Since data_len (i.e. req->length) may
873 * be bigger than len (after being rounded up
874 * to maxpacketsize), we may end up with more
875 * data then user space has space for.
878 if (io_data
->read
&& ret
> 0) {
879 ret
= min_t(size_t, ret
, io_data
->len
);
881 if (unlikely(copy_to_user(io_data
->buf
,
890 mutex_unlock(&epfile
->mutex
);
894 spin_unlock_irq(&epfile
->ffs
->eps_lock
);
895 mutex_unlock(&epfile
->mutex
);
902 ffs_epfile_write(struct file
*file
, const char __user
*buf
, size_t len
,
905 struct ffs_io_data io_data
;
910 io_data
.read
= false;
911 io_data
.buf
= (char * __user
)buf
;
914 return ffs_epfile_io(file
, &io_data
);
918 ffs_epfile_read(struct file
*file
, char __user
*buf
, size_t len
, loff_t
*ptr
)
920 struct ffs_io_data io_data
;
929 return ffs_epfile_io(file
, &io_data
);
933 ffs_epfile_open(struct inode
*inode
, struct file
*file
)
935 struct ffs_epfile
*epfile
= inode
->i_private
;
939 if (WARN_ON(epfile
->ffs
->state
!= FFS_ACTIVE
))
942 file
->private_data
= epfile
;
943 ffs_data_opened(epfile
->ffs
);
948 static int ffs_aio_cancel(struct kiocb
*kiocb
)
950 struct ffs_io_data
*io_data
= kiocb
->private;
951 struct ffs_epfile
*epfile
= kiocb
->ki_filp
->private_data
;
956 spin_lock_irq(&epfile
->ffs
->eps_lock
);
958 if (likely(io_data
&& io_data
->ep
&& io_data
->req
))
959 value
= usb_ep_dequeue(io_data
->ep
, io_data
->req
);
963 spin_unlock_irq(&epfile
->ffs
->eps_lock
);
968 static ssize_t
ffs_epfile_aio_write(struct kiocb
*kiocb
,
969 const struct iovec
*iovec
,
970 unsigned long nr_segs
, loff_t loff
)
972 struct ffs_io_data
*io_data
;
976 io_data
= kmalloc(sizeof(*io_data
), GFP_KERNEL
);
977 if (unlikely(!io_data
))
981 io_data
->read
= false;
982 io_data
->kiocb
= kiocb
;
983 io_data
->iovec
= iovec
;
984 io_data
->nr_segs
= nr_segs
;
985 io_data
->len
= kiocb
->ki_nbytes
;
986 io_data
->mm
= current
->mm
;
988 kiocb
->private = io_data
;
990 kiocb_set_cancel_fn(kiocb
, ffs_aio_cancel
);
992 return ffs_epfile_io(kiocb
->ki_filp
, io_data
);
995 static ssize_t
ffs_epfile_aio_read(struct kiocb
*kiocb
,
996 const struct iovec
*iovec
,
997 unsigned long nr_segs
, loff_t loff
)
999 struct ffs_io_data
*io_data
;
1000 struct iovec
*iovec_copy
;
1004 iovec_copy
= kmalloc_array(nr_segs
, sizeof(*iovec_copy
), GFP_KERNEL
);
1005 if (unlikely(!iovec_copy
))
1008 memcpy(iovec_copy
, iovec
, sizeof(struct iovec
)*nr_segs
);
1010 io_data
= kmalloc(sizeof(*io_data
), GFP_KERNEL
);
1011 if (unlikely(!io_data
)) {
1016 io_data
->aio
= true;
1017 io_data
->read
= true;
1018 io_data
->kiocb
= kiocb
;
1019 io_data
->iovec
= iovec_copy
;
1020 io_data
->nr_segs
= nr_segs
;
1021 io_data
->len
= kiocb
->ki_nbytes
;
1022 io_data
->mm
= current
->mm
;
1024 kiocb
->private = io_data
;
1026 kiocb_set_cancel_fn(kiocb
, ffs_aio_cancel
);
1028 return ffs_epfile_io(kiocb
->ki_filp
, io_data
);
1032 ffs_epfile_release(struct inode
*inode
, struct file
*file
)
1034 struct ffs_epfile
*epfile
= inode
->i_private
;
1038 ffs_data_closed(epfile
->ffs
);
1043 static long ffs_epfile_ioctl(struct file
*file
, unsigned code
,
1044 unsigned long value
)
1046 struct ffs_epfile
*epfile
= file
->private_data
;
1051 if (WARN_ON(epfile
->ffs
->state
!= FFS_ACTIVE
))
1054 spin_lock_irq(&epfile
->ffs
->eps_lock
);
1055 if (likely(epfile
->ep
)) {
1057 case FUNCTIONFS_FIFO_STATUS
:
1058 ret
= usb_ep_fifo_status(epfile
->ep
->ep
);
1060 case FUNCTIONFS_FIFO_FLUSH
:
1061 usb_ep_fifo_flush(epfile
->ep
->ep
);
1064 case FUNCTIONFS_CLEAR_HALT
:
1065 ret
= usb_ep_clear_halt(epfile
->ep
->ep
);
1067 case FUNCTIONFS_ENDPOINT_REVMAP
:
1068 ret
= epfile
->ep
->num
;
1070 case FUNCTIONFS_ENDPOINT_DESC
:
1073 struct usb_endpoint_descriptor
*desc
;
1075 switch (epfile
->ffs
->gadget
->speed
) {
1076 case USB_SPEED_SUPER
:
1079 case USB_SPEED_HIGH
:
1085 desc
= epfile
->ep
->descs
[desc_idx
];
1087 spin_unlock_irq(&epfile
->ffs
->eps_lock
);
1088 ret
= copy_to_user((void *)value
, desc
, sizeof(*desc
));
1099 spin_unlock_irq(&epfile
->ffs
->eps_lock
);
1104 static const struct file_operations ffs_epfile_operations
= {
1105 .llseek
= no_llseek
,
1107 .open
= ffs_epfile_open
,
1108 .write
= ffs_epfile_write
,
1109 .read
= ffs_epfile_read
,
1110 .aio_write
= ffs_epfile_aio_write
,
1111 .aio_read
= ffs_epfile_aio_read
,
1112 .release
= ffs_epfile_release
,
1113 .unlocked_ioctl
= ffs_epfile_ioctl
,
1117 /* File system and super block operations ***********************************/
1120 * Mounting the file system creates a controller file, used first for
1121 * function configuration then later for event monitoring.
1124 static struct inode
*__must_check
1125 ffs_sb_make_inode(struct super_block
*sb
, void *data
,
1126 const struct file_operations
*fops
,
1127 const struct inode_operations
*iops
,
1128 struct ffs_file_perms
*perms
)
1130 struct inode
*inode
;
1134 inode
= new_inode(sb
);
1136 if (likely(inode
)) {
1137 struct timespec current_time
= CURRENT_TIME
;
1139 inode
->i_ino
= get_next_ino();
1140 inode
->i_mode
= perms
->mode
;
1141 inode
->i_uid
= perms
->uid
;
1142 inode
->i_gid
= perms
->gid
;
1143 inode
->i_atime
= current_time
;
1144 inode
->i_mtime
= current_time
;
1145 inode
->i_ctime
= current_time
;
1146 inode
->i_private
= data
;
1148 inode
->i_fop
= fops
;
1156 /* Create "regular" file */
1157 static struct dentry
*ffs_sb_create_file(struct super_block
*sb
,
1158 const char *name
, void *data
,
1159 const struct file_operations
*fops
)
1161 struct ffs_data
*ffs
= sb
->s_fs_info
;
1162 struct dentry
*dentry
;
1163 struct inode
*inode
;
1167 dentry
= d_alloc_name(sb
->s_root
, name
);
1168 if (unlikely(!dentry
))
1171 inode
= ffs_sb_make_inode(sb
, data
, fops
, NULL
, &ffs
->file_perms
);
1172 if (unlikely(!inode
)) {
1177 d_add(dentry
, inode
);
1182 static const struct super_operations ffs_sb_operations
= {
1183 .statfs
= simple_statfs
,
1184 .drop_inode
= generic_delete_inode
,
1187 struct ffs_sb_fill_data
{
1188 struct ffs_file_perms perms
;
1190 const char *dev_name
;
1192 struct ffs_data
*ffs_data
;
1195 static int ffs_sb_fill(struct super_block
*sb
, void *_data
, int silent
)
1197 struct ffs_sb_fill_data
*data
= _data
;
1198 struct inode
*inode
;
1199 struct ffs_data
*ffs
= data
->ffs_data
;
1204 data
->ffs_data
= NULL
;
1205 sb
->s_fs_info
= ffs
;
1206 sb
->s_blocksize
= PAGE_CACHE_SIZE
;
1207 sb
->s_blocksize_bits
= PAGE_CACHE_SHIFT
;
1208 sb
->s_magic
= FUNCTIONFS_MAGIC
;
1209 sb
->s_op
= &ffs_sb_operations
;
1210 sb
->s_time_gran
= 1;
1213 data
->perms
.mode
= data
->root_mode
;
1214 inode
= ffs_sb_make_inode(sb
, NULL
,
1215 &simple_dir_operations
,
1216 &simple_dir_inode_operations
,
1218 sb
->s_root
= d_make_root(inode
);
1219 if (unlikely(!sb
->s_root
))
1223 if (unlikely(!ffs_sb_create_file(sb
, "ep0", ffs
,
1224 &ffs_ep0_operations
)))
1230 static int ffs_fs_parse_opts(struct ffs_sb_fill_data
*data
, char *opts
)
1234 if (!opts
|| !*opts
)
1238 unsigned long value
;
1242 comma
= strchr(opts
, ',');
1247 eq
= strchr(opts
, '=');
1248 if (unlikely(!eq
)) {
1249 pr_err("'=' missing in %s\n", opts
);
1255 if (kstrtoul(eq
+ 1, 0, &value
)) {
1256 pr_err("%s: invalid value: %s\n", opts
, eq
+ 1);
1260 /* Interpret option */
1261 switch (eq
- opts
) {
1263 if (!memcmp(opts
, "no_disconnect", 13))
1264 data
->no_disconnect
= !!value
;
1269 if (!memcmp(opts
, "rmode", 5))
1270 data
->root_mode
= (value
& 0555) | S_IFDIR
;
1271 else if (!memcmp(opts
, "fmode", 5))
1272 data
->perms
.mode
= (value
& 0666) | S_IFREG
;
1278 if (!memcmp(opts
, "mode", 4)) {
1279 data
->root_mode
= (value
& 0555) | S_IFDIR
;
1280 data
->perms
.mode
= (value
& 0666) | S_IFREG
;
1287 if (!memcmp(opts
, "uid", 3)) {
1288 data
->perms
.uid
= make_kuid(current_user_ns(), value
);
1289 if (!uid_valid(data
->perms
.uid
)) {
1290 pr_err("%s: unmapped value: %lu\n", opts
, value
);
1293 } else if (!memcmp(opts
, "gid", 3)) {
1294 data
->perms
.gid
= make_kgid(current_user_ns(), value
);
1295 if (!gid_valid(data
->perms
.gid
)) {
1296 pr_err("%s: unmapped value: %lu\n", opts
, value
);
1306 pr_err("%s: invalid option\n", opts
);
1310 /* Next iteration */
1319 /* "mount -t functionfs dev_name /dev/function" ends up here */
1321 static struct dentry
*
1322 ffs_fs_mount(struct file_system_type
*t
, int flags
,
1323 const char *dev_name
, void *opts
)
1325 struct ffs_sb_fill_data data
= {
1327 .mode
= S_IFREG
| 0600,
1328 .uid
= GLOBAL_ROOT_UID
,
1329 .gid
= GLOBAL_ROOT_GID
,
1331 .root_mode
= S_IFDIR
| 0500,
1332 .no_disconnect
= false,
1337 struct ffs_data
*ffs
;
1341 ret
= ffs_fs_parse_opts(&data
, opts
);
1342 if (unlikely(ret
< 0))
1343 return ERR_PTR(ret
);
1345 ffs
= ffs_data_new();
1347 return ERR_PTR(-ENOMEM
);
1348 ffs
->file_perms
= data
.perms
;
1349 ffs
->no_disconnect
= data
.no_disconnect
;
1351 ffs
->dev_name
= kstrdup(dev_name
, GFP_KERNEL
);
1352 if (unlikely(!ffs
->dev_name
)) {
1354 return ERR_PTR(-ENOMEM
);
1357 ffs_dev
= ffs_acquire_dev(dev_name
);
1358 if (IS_ERR(ffs_dev
)) {
1360 return ERR_CAST(ffs_dev
);
1362 ffs
->private_data
= ffs_dev
;
1363 data
.ffs_data
= ffs
;
1365 rv
= mount_nodev(t
, flags
, &data
, ffs_sb_fill
);
1366 if (IS_ERR(rv
) && data
.ffs_data
) {
1367 ffs_release_dev(data
.ffs_data
);
1368 ffs_data_put(data
.ffs_data
);
1374 ffs_fs_kill_sb(struct super_block
*sb
)
1378 kill_litter_super(sb
);
1379 if (sb
->s_fs_info
) {
1380 ffs_release_dev(sb
->s_fs_info
);
1381 ffs_data_closed(sb
->s_fs_info
);
1382 ffs_data_put(sb
->s_fs_info
);
1386 static struct file_system_type ffs_fs_type
= {
1387 .owner
= THIS_MODULE
,
1388 .name
= "functionfs",
1389 .mount
= ffs_fs_mount
,
1390 .kill_sb
= ffs_fs_kill_sb
,
1392 MODULE_ALIAS_FS("functionfs");
1395 /* Driver's main init/cleanup functions *************************************/
1397 static int functionfs_init(void)
1403 ret
= register_filesystem(&ffs_fs_type
);
1405 pr_info("file system registered\n");
1407 pr_err("failed registering file system (%d)\n", ret
);
1412 static void functionfs_cleanup(void)
1416 pr_info("unloading\n");
1417 unregister_filesystem(&ffs_fs_type
);
1421 /* ffs_data and ffs_function construction and destruction code **************/
1423 static void ffs_data_clear(struct ffs_data
*ffs
);
1424 static void ffs_data_reset(struct ffs_data
*ffs
);
1426 static void ffs_data_get(struct ffs_data
*ffs
)
1430 atomic_inc(&ffs
->ref
);
1433 static void ffs_data_opened(struct ffs_data
*ffs
)
1437 atomic_inc(&ffs
->ref
);
1438 if (atomic_add_return(1, &ffs
->opened
) == 1 &&
1439 ffs
->state
== FFS_DEACTIVATED
) {
1440 ffs
->state
= FFS_CLOSING
;
1441 ffs_data_reset(ffs
);
1445 static void ffs_data_put(struct ffs_data
*ffs
)
1449 if (unlikely(atomic_dec_and_test(&ffs
->ref
))) {
1450 pr_info("%s(): freeing\n", __func__
);
1451 ffs_data_clear(ffs
);
1452 BUG_ON(waitqueue_active(&ffs
->ev
.waitq
) ||
1453 waitqueue_active(&ffs
->ep0req_completion
.wait
));
1454 kfree(ffs
->dev_name
);
1459 static void ffs_data_closed(struct ffs_data
*ffs
)
1463 if (atomic_dec_and_test(&ffs
->opened
)) {
1464 if (ffs
->no_disconnect
) {
1465 ffs
->state
= FFS_DEACTIVATED
;
1467 ffs_epfiles_destroy(ffs
->epfiles
,
1469 ffs
->epfiles
= NULL
;
1471 if (ffs
->setup_state
== FFS_SETUP_PENDING
)
1472 __ffs_ep0_stall(ffs
);
1474 ffs
->state
= FFS_CLOSING
;
1475 ffs_data_reset(ffs
);
1478 if (atomic_read(&ffs
->opened
) < 0) {
1479 ffs
->state
= FFS_CLOSING
;
1480 ffs_data_reset(ffs
);
1486 static struct ffs_data
*ffs_data_new(void)
1488 struct ffs_data
*ffs
= kzalloc(sizeof *ffs
, GFP_KERNEL
);
1494 atomic_set(&ffs
->ref
, 1);
1495 atomic_set(&ffs
->opened
, 0);
1496 ffs
->state
= FFS_READ_DESCRIPTORS
;
1497 mutex_init(&ffs
->mutex
);
1498 spin_lock_init(&ffs
->eps_lock
);
1499 init_waitqueue_head(&ffs
->ev
.waitq
);
1500 init_completion(&ffs
->ep0req_completion
);
1502 /* XXX REVISIT need to update it in some places, or do we? */
1503 ffs
->ev
.can_stall
= 1;
1508 static void ffs_data_clear(struct ffs_data
*ffs
)
1512 if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK
, &ffs
->flags
))
1515 BUG_ON(ffs
->gadget
);
1518 ffs_epfiles_destroy(ffs
->epfiles
, ffs
->eps_count
);
1520 if (ffs
->ffs_eventfd
)
1521 eventfd_ctx_put(ffs
->ffs_eventfd
);
1523 kfree(ffs
->raw_descs_data
);
1524 kfree(ffs
->raw_strings
);
1525 kfree(ffs
->stringtabs
);
1528 static void ffs_data_reset(struct ffs_data
*ffs
)
1532 ffs_data_clear(ffs
);
1534 ffs
->epfiles
= NULL
;
1535 ffs
->raw_descs_data
= NULL
;
1536 ffs
->raw_descs
= NULL
;
1537 ffs
->raw_strings
= NULL
;
1538 ffs
->stringtabs
= NULL
;
1540 ffs
->raw_descs_length
= 0;
1541 ffs
->fs_descs_count
= 0;
1542 ffs
->hs_descs_count
= 0;
1543 ffs
->ss_descs_count
= 0;
1545 ffs
->strings_count
= 0;
1546 ffs
->interfaces_count
= 0;
1551 ffs
->state
= FFS_READ_DESCRIPTORS
;
1552 ffs
->setup_state
= FFS_NO_SETUP
;
1557 static int functionfs_bind(struct ffs_data
*ffs
, struct usb_composite_dev
*cdev
)
1559 struct usb_gadget_strings
**lang
;
1564 if (WARN_ON(ffs
->state
!= FFS_ACTIVE
1565 || test_and_set_bit(FFS_FL_BOUND
, &ffs
->flags
)))
1568 first_id
= usb_string_ids_n(cdev
, ffs
->strings_count
);
1569 if (unlikely(first_id
< 0))
1572 ffs
->ep0req
= usb_ep_alloc_request(cdev
->gadget
->ep0
, GFP_KERNEL
);
1573 if (unlikely(!ffs
->ep0req
))
1575 ffs
->ep0req
->complete
= ffs_ep0_complete
;
1576 ffs
->ep0req
->context
= ffs
;
1578 lang
= ffs
->stringtabs
;
1580 for (; *lang
; ++lang
) {
1581 struct usb_string
*str
= (*lang
)->strings
;
1583 for (; str
->s
; ++id
, ++str
)
1588 ffs
->gadget
= cdev
->gadget
;
1593 static void functionfs_unbind(struct ffs_data
*ffs
)
1597 if (!WARN_ON(!ffs
->gadget
)) {
1598 usb_ep_free_request(ffs
->gadget
->ep0
, ffs
->ep0req
);
1601 clear_bit(FFS_FL_BOUND
, &ffs
->flags
);
1606 static int ffs_epfiles_create(struct ffs_data
*ffs
)
1608 struct ffs_epfile
*epfile
, *epfiles
;
1613 count
= ffs
->eps_count
;
1614 epfiles
= kcalloc(count
, sizeof(*epfiles
), GFP_KERNEL
);
1619 for (i
= 1; i
<= count
; ++i
, ++epfile
) {
1621 mutex_init(&epfile
->mutex
);
1622 init_waitqueue_head(&epfile
->wait
);
1623 if (ffs
->user_flags
& FUNCTIONFS_VIRTUAL_ADDR
)
1624 sprintf(epfile
->name
, "ep%02x", ffs
->eps_addrmap
[i
]);
1626 sprintf(epfile
->name
, "ep%u", i
);
1627 epfile
->dentry
= ffs_sb_create_file(ffs
->sb
, epfile
->name
,
1629 &ffs_epfile_operations
);
1630 if (unlikely(!epfile
->dentry
)) {
1631 ffs_epfiles_destroy(epfiles
, i
- 1);
1636 ffs
->epfiles
= epfiles
;
1640 static void ffs_epfiles_destroy(struct ffs_epfile
*epfiles
, unsigned count
)
1642 struct ffs_epfile
*epfile
= epfiles
;
1646 for (; count
; --count
, ++epfile
) {
1647 BUG_ON(mutex_is_locked(&epfile
->mutex
) ||
1648 waitqueue_active(&epfile
->wait
));
1649 if (epfile
->dentry
) {
1650 d_delete(epfile
->dentry
);
1651 dput(epfile
->dentry
);
1652 epfile
->dentry
= NULL
;
1659 static void ffs_func_eps_disable(struct ffs_function
*func
)
1661 struct ffs_ep
*ep
= func
->eps
;
1662 struct ffs_epfile
*epfile
= func
->ffs
->epfiles
;
1663 unsigned count
= func
->ffs
->eps_count
;
1664 unsigned long flags
;
1666 spin_lock_irqsave(&func
->ffs
->eps_lock
, flags
);
1668 /* pending requests get nuked */
1670 usb_ep_disable(ep
->ep
);
1678 spin_unlock_irqrestore(&func
->ffs
->eps_lock
, flags
);
1681 static int ffs_func_eps_enable(struct ffs_function
*func
)
1683 struct ffs_data
*ffs
= func
->ffs
;
1684 struct ffs_ep
*ep
= func
->eps
;
1685 struct ffs_epfile
*epfile
= ffs
->epfiles
;
1686 unsigned count
= ffs
->eps_count
;
1687 unsigned long flags
;
1690 spin_lock_irqsave(&func
->ffs
->eps_lock
, flags
);
1692 struct usb_endpoint_descriptor
*ds
;
1695 if (ffs
->gadget
->speed
== USB_SPEED_SUPER
)
1697 else if (ffs
->gadget
->speed
== USB_SPEED_HIGH
)
1702 /* fall-back to lower speed if desc missing for current speed */
1704 ds
= ep
->descs
[desc_idx
];
1705 } while (!ds
&& --desc_idx
>= 0);
1712 ep
->ep
->driver_data
= ep
;
1714 ret
= usb_ep_enable(ep
->ep
);
1717 epfile
->in
= usb_endpoint_dir_in(ds
);
1718 epfile
->isoc
= usb_endpoint_xfer_isoc(ds
);
1723 wake_up(&epfile
->wait
);
1728 spin_unlock_irqrestore(&func
->ffs
->eps_lock
, flags
);
1734 /* Parsing and building descriptors and strings *****************************/
1737 * This validates if data pointed by data is a valid USB descriptor as
1738 * well as record how many interfaces, endpoints and strings are
1739 * required by given configuration. Returns address after the
1740 * descriptor or NULL if data is invalid.
1743 enum ffs_entity_type
{
1744 FFS_DESCRIPTOR
, FFS_INTERFACE
, FFS_STRING
, FFS_ENDPOINT
1747 enum ffs_os_desc_type
{
1748 FFS_OS_DESC
, FFS_OS_DESC_EXT_COMPAT
, FFS_OS_DESC_EXT_PROP
1751 typedef int (*ffs_entity_callback
)(enum ffs_entity_type entity
,
1753 struct usb_descriptor_header
*desc
,
1756 typedef int (*ffs_os_desc_callback
)(enum ffs_os_desc_type entity
,
1757 struct usb_os_desc_header
*h
, void *data
,
1758 unsigned len
, void *priv
);
1760 static int __must_check
ffs_do_single_desc(char *data
, unsigned len
,
1761 ffs_entity_callback entity
,
1764 struct usb_descriptor_header
*_ds
= (void *)data
;
1770 /* At least two bytes are required: length and type */
1772 pr_vdebug("descriptor too short\n");
1776 /* If we have at least as many bytes as the descriptor takes? */
1777 length
= _ds
->bLength
;
1779 pr_vdebug("descriptor longer then available data\n");
1783 #define __entity_check_INTERFACE(val) 1
1784 #define __entity_check_STRING(val) (val)
1785 #define __entity_check_ENDPOINT(val) ((val) & USB_ENDPOINT_NUMBER_MASK)
1786 #define __entity(type, val) do { \
1787 pr_vdebug("entity " #type "(%02x)\n", (val)); \
1788 if (unlikely(!__entity_check_ ##type(val))) { \
1789 pr_vdebug("invalid entity's value\n"); \
1792 ret = entity(FFS_ ##type, &val, _ds, priv); \
1793 if (unlikely(ret < 0)) { \
1794 pr_debug("entity " #type "(%02x); ret = %d\n", \
1800 /* Parse descriptor depending on type. */
1801 switch (_ds
->bDescriptorType
) {
1805 case USB_DT_DEVICE_QUALIFIER
:
1806 /* function can't have any of those */
1807 pr_vdebug("descriptor reserved for gadget: %d\n",
1808 _ds
->bDescriptorType
);
1811 case USB_DT_INTERFACE
: {
1812 struct usb_interface_descriptor
*ds
= (void *)_ds
;
1813 pr_vdebug("interface descriptor\n");
1814 if (length
!= sizeof *ds
)
1817 __entity(INTERFACE
, ds
->bInterfaceNumber
);
1819 __entity(STRING
, ds
->iInterface
);
1823 case USB_DT_ENDPOINT
: {
1824 struct usb_endpoint_descriptor
*ds
= (void *)_ds
;
1825 pr_vdebug("endpoint descriptor\n");
1826 if (length
!= USB_DT_ENDPOINT_SIZE
&&
1827 length
!= USB_DT_ENDPOINT_AUDIO_SIZE
)
1829 __entity(ENDPOINT
, ds
->bEndpointAddress
);
1834 pr_vdebug("hid descriptor\n");
1835 if (length
!= sizeof(struct hid_descriptor
))
1840 if (length
!= sizeof(struct usb_otg_descriptor
))
1844 case USB_DT_INTERFACE_ASSOCIATION
: {
1845 struct usb_interface_assoc_descriptor
*ds
= (void *)_ds
;
1846 pr_vdebug("interface association descriptor\n");
1847 if (length
!= sizeof *ds
)
1850 __entity(STRING
, ds
->iFunction
);
1854 case USB_DT_SS_ENDPOINT_COMP
:
1855 pr_vdebug("EP SS companion descriptor\n");
1856 if (length
!= sizeof(struct usb_ss_ep_comp_descriptor
))
1860 case USB_DT_OTHER_SPEED_CONFIG
:
1861 case USB_DT_INTERFACE_POWER
:
1863 case USB_DT_SECURITY
:
1864 case USB_DT_CS_RADIO_CONTROL
:
1866 pr_vdebug("unimplemented descriptor: %d\n", _ds
->bDescriptorType
);
1870 /* We should never be here */
1871 pr_vdebug("unknown descriptor: %d\n", _ds
->bDescriptorType
);
1875 pr_vdebug("invalid length: %d (descriptor %d)\n",
1876 _ds
->bLength
, _ds
->bDescriptorType
);
1881 #undef __entity_check_DESCRIPTOR
1882 #undef __entity_check_INTERFACE
1883 #undef __entity_check_STRING
1884 #undef __entity_check_ENDPOINT
1889 static int __must_check
ffs_do_descs(unsigned count
, char *data
, unsigned len
,
1890 ffs_entity_callback entity
, void *priv
)
1892 const unsigned _len
= len
;
1893 unsigned long num
= 0;
1903 /* Record "descriptor" entity */
1904 ret
= entity(FFS_DESCRIPTOR
, (u8
*)num
, (void *)data
, priv
);
1905 if (unlikely(ret
< 0)) {
1906 pr_debug("entity DESCRIPTOR(%02lx); ret = %d\n",
1914 ret
= ffs_do_single_desc(data
, len
, entity
, priv
);
1915 if (unlikely(ret
< 0)) {
1916 pr_debug("%s returns %d\n", __func__
, ret
);
1926 static int __ffs_data_do_entity(enum ffs_entity_type type
,
1927 u8
*valuep
, struct usb_descriptor_header
*desc
,
1930 struct ffs_desc_helper
*helper
= priv
;
1931 struct usb_endpoint_descriptor
*d
;
1936 case FFS_DESCRIPTOR
:
1941 * Interfaces are indexed from zero so if we
1942 * encountered interface "n" then there are at least
1945 if (*valuep
>= helper
->interfaces_count
)
1946 helper
->interfaces_count
= *valuep
+ 1;
1951 * Strings are indexed from 1 (0 is magic ;) reserved
1952 * for languages list or some such)
1954 if (*valuep
> helper
->ffs
->strings_count
)
1955 helper
->ffs
->strings_count
= *valuep
;
1960 helper
->eps_count
++;
1961 if (helper
->eps_count
>= 15)
1963 /* Check if descriptors for any speed were already parsed */
1964 if (!helper
->ffs
->eps_count
&& !helper
->ffs
->interfaces_count
)
1965 helper
->ffs
->eps_addrmap
[helper
->eps_count
] =
1966 d
->bEndpointAddress
;
1967 else if (helper
->ffs
->eps_addrmap
[helper
->eps_count
] !=
1968 d
->bEndpointAddress
)
1976 static int __ffs_do_os_desc_header(enum ffs_os_desc_type
*next_type
,
1977 struct usb_os_desc_header
*desc
)
1979 u16 bcd_version
= le16_to_cpu(desc
->bcdVersion
);
1980 u16 w_index
= le16_to_cpu(desc
->wIndex
);
1982 if (bcd_version
!= 1) {
1983 pr_vdebug("unsupported os descriptors version: %d",
1989 *next_type
= FFS_OS_DESC_EXT_COMPAT
;
1992 *next_type
= FFS_OS_DESC_EXT_PROP
;
1995 pr_vdebug("unsupported os descriptor type: %d", w_index
);
1999 return sizeof(*desc
);
2003 * Process all extended compatibility/extended property descriptors
2004 * of a feature descriptor
2006 static int __must_check
ffs_do_single_os_desc(char *data
, unsigned len
,
2007 enum ffs_os_desc_type type
,
2009 ffs_os_desc_callback entity
,
2011 struct usb_os_desc_header
*h
)
2014 const unsigned _len
= len
;
2018 /* loop over all ext compat/ext prop descriptors */
2019 while (feature_count
--) {
2020 ret
= entity(type
, h
, data
, len
, priv
);
2021 if (unlikely(ret
< 0)) {
2022 pr_debug("bad OS descriptor, type: %d\n", type
);
2031 /* Process a number of complete Feature Descriptors (Ext Compat or Ext Prop) */
2032 static int __must_check
ffs_do_os_descs(unsigned count
,
2033 char *data
, unsigned len
,
2034 ffs_os_desc_callback entity
, void *priv
)
2036 const unsigned _len
= len
;
2037 unsigned long num
= 0;
2041 for (num
= 0; num
< count
; ++num
) {
2043 enum ffs_os_desc_type type
;
2045 struct usb_os_desc_header
*desc
= (void *)data
;
2047 if (len
< sizeof(*desc
))
2051 * Record "descriptor" entity.
2052 * Process dwLength, bcdVersion, wIndex, get b/wCount.
2053 * Move the data pointer to the beginning of extended
2054 * compatibilities proper or extended properties proper
2055 * portions of the data
2057 if (le32_to_cpu(desc
->dwLength
) > len
)
2060 ret
= __ffs_do_os_desc_header(&type
, desc
);
2061 if (unlikely(ret
< 0)) {
2062 pr_debug("entity OS_DESCRIPTOR(%02lx); ret = %d\n",
2067 * 16-bit hex "?? 00" Little Endian looks like 8-bit hex "??"
2069 feature_count
= le16_to_cpu(desc
->wCount
);
2070 if (type
== FFS_OS_DESC_EXT_COMPAT
&&
2071 (feature_count
> 255 || desc
->Reserved
))
2077 * Process all function/property descriptors
2078 * of this Feature Descriptor
2080 ret
= ffs_do_single_os_desc(data
, len
, type
,
2081 feature_count
, entity
, priv
, desc
);
2082 if (unlikely(ret
< 0)) {
2083 pr_debug("%s returns %d\n", __func__
, ret
);
2094 * Validate contents of the buffer from userspace related to OS descriptors.
2096 static int __ffs_data_do_os_desc(enum ffs_os_desc_type type
,
2097 struct usb_os_desc_header
*h
, void *data
,
2098 unsigned len
, void *priv
)
2100 struct ffs_data
*ffs
= priv
;
2106 case FFS_OS_DESC_EXT_COMPAT
: {
2107 struct usb_ext_compat_desc
*d
= data
;
2110 if (len
< sizeof(*d
) ||
2111 d
->bFirstInterfaceNumber
>= ffs
->interfaces_count
||
2114 for (i
= 0; i
< ARRAY_SIZE(d
->Reserved2
); ++i
)
2115 if (d
->Reserved2
[i
])
2118 length
= sizeof(struct usb_ext_compat_desc
);
2121 case FFS_OS_DESC_EXT_PROP
: {
2122 struct usb_ext_prop_desc
*d
= data
;
2126 if (len
< sizeof(*d
) || h
->interface
>= ffs
->interfaces_count
)
2128 length
= le32_to_cpu(d
->dwSize
);
2129 type
= le32_to_cpu(d
->dwPropertyDataType
);
2130 if (type
< USB_EXT_PROP_UNICODE
||
2131 type
> USB_EXT_PROP_UNICODE_MULTI
) {
2132 pr_vdebug("unsupported os descriptor property type: %d",
2136 pnl
= le16_to_cpu(d
->wPropertyNameLength
);
2137 pdl
= le32_to_cpu(*(u32
*)((u8
*)data
+ 10 + pnl
));
2138 if (length
!= 14 + pnl
+ pdl
) {
2139 pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n",
2140 length
, pnl
, pdl
, type
);
2143 ++ffs
->ms_os_descs_ext_prop_count
;
2144 /* property name reported to the host as "WCHAR"s */
2145 ffs
->ms_os_descs_ext_prop_name_len
+= pnl
* 2;
2146 ffs
->ms_os_descs_ext_prop_data_len
+= pdl
;
2150 pr_vdebug("unknown descriptor: %d\n", type
);
2156 static int __ffs_data_got_descs(struct ffs_data
*ffs
,
2157 char *const _data
, size_t len
)
2159 char *data
= _data
, *raw_descs
;
2160 unsigned os_descs_count
= 0, counts
[3], flags
;
2161 int ret
= -EINVAL
, i
;
2162 struct ffs_desc_helper helper
;
2166 if (get_unaligned_le32(data
+ 4) != len
)
2169 switch (get_unaligned_le32(data
)) {
2170 case FUNCTIONFS_DESCRIPTORS_MAGIC
:
2171 flags
= FUNCTIONFS_HAS_FS_DESC
| FUNCTIONFS_HAS_HS_DESC
;
2175 case FUNCTIONFS_DESCRIPTORS_MAGIC_V2
:
2176 flags
= get_unaligned_le32(data
+ 8);
2177 ffs
->user_flags
= flags
;
2178 if (flags
& ~(FUNCTIONFS_HAS_FS_DESC
|
2179 FUNCTIONFS_HAS_HS_DESC
|
2180 FUNCTIONFS_HAS_SS_DESC
|
2181 FUNCTIONFS_HAS_MS_OS_DESC
|
2182 FUNCTIONFS_VIRTUAL_ADDR
|
2183 FUNCTIONFS_EVENTFD
)) {
2194 if (flags
& FUNCTIONFS_EVENTFD
) {
2198 eventfd_ctx_fdget((int)get_unaligned_le32(data
));
2199 if (IS_ERR(ffs
->ffs_eventfd
)) {
2200 ret
= PTR_ERR(ffs
->ffs_eventfd
);
2201 ffs
->ffs_eventfd
= NULL
;
2208 /* Read fs_count, hs_count and ss_count (if present) */
2209 for (i
= 0; i
< 3; ++i
) {
2210 if (!(flags
& (1 << i
))) {
2212 } else if (len
< 4) {
2215 counts
[i
] = get_unaligned_le32(data
);
2220 if (flags
& (1 << i
)) {
2221 os_descs_count
= get_unaligned_le32(data
);
2226 /* Read descriptors */
2229 for (i
= 0; i
< 3; ++i
) {
2232 helper
.interfaces_count
= 0;
2233 helper
.eps_count
= 0;
2234 ret
= ffs_do_descs(counts
[i
], data
, len
,
2235 __ffs_data_do_entity
, &helper
);
2238 if (!ffs
->eps_count
&& !ffs
->interfaces_count
) {
2239 ffs
->eps_count
= helper
.eps_count
;
2240 ffs
->interfaces_count
= helper
.interfaces_count
;
2242 if (ffs
->eps_count
!= helper
.eps_count
) {
2246 if (ffs
->interfaces_count
!= helper
.interfaces_count
) {
2254 if (os_descs_count
) {
2255 ret
= ffs_do_os_descs(os_descs_count
, data
, len
,
2256 __ffs_data_do_os_desc
, ffs
);
2263 if (raw_descs
== data
|| len
) {
2268 ffs
->raw_descs_data
= _data
;
2269 ffs
->raw_descs
= raw_descs
;
2270 ffs
->raw_descs_length
= data
- raw_descs
;
2271 ffs
->fs_descs_count
= counts
[0];
2272 ffs
->hs_descs_count
= counts
[1];
2273 ffs
->ss_descs_count
= counts
[2];
2274 ffs
->ms_os_descs_count
= os_descs_count
;
2283 static int __ffs_data_got_strings(struct ffs_data
*ffs
,
2284 char *const _data
, size_t len
)
2286 u32 str_count
, needed_count
, lang_count
;
2287 struct usb_gadget_strings
**stringtabs
, *t
;
2288 struct usb_string
*strings
, *s
;
2289 const char *data
= _data
;
2293 if (unlikely(get_unaligned_le32(data
) != FUNCTIONFS_STRINGS_MAGIC
||
2294 get_unaligned_le32(data
+ 4) != len
))
2296 str_count
= get_unaligned_le32(data
+ 8);
2297 lang_count
= get_unaligned_le32(data
+ 12);
2299 /* if one is zero the other must be zero */
2300 if (unlikely(!str_count
!= !lang_count
))
2303 /* Do we have at least as many strings as descriptors need? */
2304 needed_count
= ffs
->strings_count
;
2305 if (unlikely(str_count
< needed_count
))
2309 * If we don't need any strings just return and free all
2312 if (!needed_count
) {
2317 /* Allocate everything in one chunk so there's less maintenance. */
2321 vla_item(d
, struct usb_gadget_strings
*, stringtabs
,
2323 vla_item(d
, struct usb_gadget_strings
, stringtab
, lang_count
);
2324 vla_item(d
, struct usb_string
, strings
,
2325 lang_count
*(needed_count
+1));
2327 char *vlabuf
= kmalloc(vla_group_size(d
), GFP_KERNEL
);
2329 if (unlikely(!vlabuf
)) {
2334 /* Initialize the VLA pointers */
2335 stringtabs
= vla_ptr(vlabuf
, d
, stringtabs
);
2336 t
= vla_ptr(vlabuf
, d
, stringtab
);
2339 *stringtabs
++ = t
++;
2343 /* stringtabs = vlabuf = d_stringtabs for later kfree */
2344 stringtabs
= vla_ptr(vlabuf
, d
, stringtabs
);
2345 t
= vla_ptr(vlabuf
, d
, stringtab
);
2346 s
= vla_ptr(vlabuf
, d
, strings
);
2350 /* For each language */
2354 do { /* lang_count > 0 so we can use do-while */
2355 unsigned needed
= needed_count
;
2357 if (unlikely(len
< 3))
2359 t
->language
= get_unaligned_le16(data
);
2366 /* For each string */
2367 do { /* str_count > 0 so we can use do-while */
2368 size_t length
= strnlen(data
, len
);
2370 if (unlikely(length
== len
))
2374 * User may provide more strings then we need,
2375 * if that's the case we simply ignore the
2378 if (likely(needed
)) {
2380 * s->id will be set while adding
2381 * function to configuration so for
2382 * now just leave garbage here.
2391 } while (--str_count
);
2393 s
->id
= 0; /* terminator */
2397 } while (--lang_count
);
2399 /* Some garbage left? */
2404 ffs
->stringtabs
= stringtabs
;
2405 ffs
->raw_strings
= _data
;
2417 /* Events handling and management *******************************************/
2419 static void __ffs_event_add(struct ffs_data
*ffs
,
2420 enum usb_functionfs_event_type type
)
2422 enum usb_functionfs_event_type rem_type1
, rem_type2
= type
;
2426 * Abort any unhandled setup
2428 * We do not need to worry about some cmpxchg() changing value
2429 * of ffs->setup_state without holding the lock because when
2430 * state is FFS_SETUP_PENDING cmpxchg() in several places in
2431 * the source does nothing.
2433 if (ffs
->setup_state
== FFS_SETUP_PENDING
)
2434 ffs
->setup_state
= FFS_SETUP_CANCELLED
;
2437 * Logic of this function guarantees that there are at most four pending
2438 * evens on ffs->ev.types queue. This is important because the queue
2439 * has space for four elements only and __ffs_ep0_read_events function
2440 * depends on that limit as well. If more event types are added, those
2441 * limits have to be revisited or guaranteed to still hold.
2444 case FUNCTIONFS_RESUME
:
2445 rem_type2
= FUNCTIONFS_SUSPEND
;
2447 case FUNCTIONFS_SUSPEND
:
2448 case FUNCTIONFS_SETUP
:
2450 /* Discard all similar events */
2453 case FUNCTIONFS_BIND
:
2454 case FUNCTIONFS_UNBIND
:
2455 case FUNCTIONFS_DISABLE
:
2456 case FUNCTIONFS_ENABLE
:
2457 /* Discard everything other then power management. */
2458 rem_type1
= FUNCTIONFS_SUSPEND
;
2459 rem_type2
= FUNCTIONFS_RESUME
;
2464 WARN(1, "%d: unknown event, this should not happen\n", type
);
2469 u8
*ev
= ffs
->ev
.types
, *out
= ev
;
2470 unsigned n
= ffs
->ev
.count
;
2471 for (; n
; --n
, ++ev
)
2472 if ((*ev
== rem_type1
|| *ev
== rem_type2
) == neg
)
2475 pr_vdebug("purging event %d\n", *ev
);
2476 ffs
->ev
.count
= out
- ffs
->ev
.types
;
2479 pr_vdebug("adding event %d\n", type
);
2480 ffs
->ev
.types
[ffs
->ev
.count
++] = type
;
2481 wake_up_locked(&ffs
->ev
.waitq
);
2482 if (ffs
->ffs_eventfd
)
2483 eventfd_signal(ffs
->ffs_eventfd
, 1);
2486 static void ffs_event_add(struct ffs_data
*ffs
,
2487 enum usb_functionfs_event_type type
)
2489 unsigned long flags
;
2490 spin_lock_irqsave(&ffs
->ev
.waitq
.lock
, flags
);
2491 __ffs_event_add(ffs
, type
);
2492 spin_unlock_irqrestore(&ffs
->ev
.waitq
.lock
, flags
);
2495 /* Bind/unbind USB function hooks *******************************************/
2497 static int ffs_ep_addr2idx(struct ffs_data
*ffs
, u8 endpoint_address
)
2501 for (i
= 1; i
< ARRAY_SIZE(ffs
->eps_addrmap
); ++i
)
2502 if (ffs
->eps_addrmap
[i
] == endpoint_address
)
2507 static int __ffs_func_bind_do_descs(enum ffs_entity_type type
, u8
*valuep
,
2508 struct usb_descriptor_header
*desc
,
2511 struct usb_endpoint_descriptor
*ds
= (void *)desc
;
2512 struct ffs_function
*func
= priv
;
2513 struct ffs_ep
*ffs_ep
;
2514 unsigned ep_desc_id
;
2516 static const char *speed_names
[] = { "full", "high", "super" };
2518 if (type
!= FFS_DESCRIPTOR
)
2522 * If ss_descriptors is not NULL, we are reading super speed
2523 * descriptors; if hs_descriptors is not NULL, we are reading high
2524 * speed descriptors; otherwise, we are reading full speed
2527 if (func
->function
.ss_descriptors
) {
2529 func
->function
.ss_descriptors
[(long)valuep
] = desc
;
2530 } else if (func
->function
.hs_descriptors
) {
2532 func
->function
.hs_descriptors
[(long)valuep
] = desc
;
2535 func
->function
.fs_descriptors
[(long)valuep
] = desc
;
2538 if (!desc
|| desc
->bDescriptorType
!= USB_DT_ENDPOINT
)
2541 idx
= ffs_ep_addr2idx(func
->ffs
, ds
->bEndpointAddress
) - 1;
2545 ffs_ep
= func
->eps
+ idx
;
2547 if (unlikely(ffs_ep
->descs
[ep_desc_id
])) {
2548 pr_err("two %sspeed descriptors for EP %d\n",
2549 speed_names
[ep_desc_id
],
2550 ds
->bEndpointAddress
& USB_ENDPOINT_NUMBER_MASK
);
2553 ffs_ep
->descs
[ep_desc_id
] = ds
;
2555 ffs_dump_mem(": Original ep desc", ds
, ds
->bLength
);
2557 ds
->bEndpointAddress
= ffs_ep
->descs
[0]->bEndpointAddress
;
2558 if (!ds
->wMaxPacketSize
)
2559 ds
->wMaxPacketSize
= ffs_ep
->descs
[0]->wMaxPacketSize
;
2561 struct usb_request
*req
;
2563 u8 bEndpointAddress
;
2566 * We back up bEndpointAddress because autoconfig overwrites
2567 * it with physical endpoint address.
2569 bEndpointAddress
= ds
->bEndpointAddress
;
2570 pr_vdebug("autoconfig\n");
2571 ep
= usb_ep_autoconfig(func
->gadget
, ds
);
2574 ep
->driver_data
= func
->eps
+ idx
;
2576 req
= usb_ep_alloc_request(ep
, GFP_KERNEL
);
2582 func
->eps_revmap
[ds
->bEndpointAddress
&
2583 USB_ENDPOINT_NUMBER_MASK
] = idx
+ 1;
2585 * If we use virtual address mapping, we restore
2586 * original bEndpointAddress value.
2588 if (func
->ffs
->user_flags
& FUNCTIONFS_VIRTUAL_ADDR
)
2589 ds
->bEndpointAddress
= bEndpointAddress
;
2591 ffs_dump_mem(": Rewritten ep desc", ds
, ds
->bLength
);
2596 static int __ffs_func_bind_do_nums(enum ffs_entity_type type
, u8
*valuep
,
2597 struct usb_descriptor_header
*desc
,
2600 struct ffs_function
*func
= priv
;
2606 case FFS_DESCRIPTOR
:
2607 /* Handled in previous pass by __ffs_func_bind_do_descs() */
2612 if (func
->interfaces_nums
[idx
] < 0) {
2613 int id
= usb_interface_id(func
->conf
, &func
->function
);
2614 if (unlikely(id
< 0))
2616 func
->interfaces_nums
[idx
] = id
;
2618 newValue
= func
->interfaces_nums
[idx
];
2622 /* String' IDs are allocated when fsf_data is bound to cdev */
2623 newValue
= func
->ffs
->stringtabs
[0]->strings
[*valuep
- 1].id
;
2628 * USB_DT_ENDPOINT are handled in
2629 * __ffs_func_bind_do_descs().
2631 if (desc
->bDescriptorType
== USB_DT_ENDPOINT
)
2634 idx
= (*valuep
& USB_ENDPOINT_NUMBER_MASK
) - 1;
2635 if (unlikely(!func
->eps
[idx
].ep
))
2639 struct usb_endpoint_descriptor
**descs
;
2640 descs
= func
->eps
[idx
].descs
;
2641 newValue
= descs
[descs
[0] ? 0 : 1]->bEndpointAddress
;
2646 pr_vdebug("%02x -> %02x\n", *valuep
, newValue
);
2651 static int __ffs_func_bind_do_os_desc(enum ffs_os_desc_type type
,
2652 struct usb_os_desc_header
*h
, void *data
,
2653 unsigned len
, void *priv
)
2655 struct ffs_function
*func
= priv
;
2659 case FFS_OS_DESC_EXT_COMPAT
: {
2660 struct usb_ext_compat_desc
*desc
= data
;
2661 struct usb_os_desc_table
*t
;
2663 t
= &func
->function
.os_desc_table
[desc
->bFirstInterfaceNumber
];
2664 t
->if_id
= func
->interfaces_nums
[desc
->bFirstInterfaceNumber
];
2665 memcpy(t
->os_desc
->ext_compat_id
, &desc
->CompatibleID
,
2666 ARRAY_SIZE(desc
->CompatibleID
) +
2667 ARRAY_SIZE(desc
->SubCompatibleID
));
2668 length
= sizeof(*desc
);
2671 case FFS_OS_DESC_EXT_PROP
: {
2672 struct usb_ext_prop_desc
*desc
= data
;
2673 struct usb_os_desc_table
*t
;
2674 struct usb_os_desc_ext_prop
*ext_prop
;
2675 char *ext_prop_name
;
2676 char *ext_prop_data
;
2678 t
= &func
->function
.os_desc_table
[h
->interface
];
2679 t
->if_id
= func
->interfaces_nums
[h
->interface
];
2681 ext_prop
= func
->ffs
->ms_os_descs_ext_prop_avail
;
2682 func
->ffs
->ms_os_descs_ext_prop_avail
+= sizeof(*ext_prop
);
2684 ext_prop
->type
= le32_to_cpu(desc
->dwPropertyDataType
);
2685 ext_prop
->name_len
= le16_to_cpu(desc
->wPropertyNameLength
);
2686 ext_prop
->data_len
= le32_to_cpu(*(u32
*)
2687 usb_ext_prop_data_len_ptr(data
, ext_prop
->name_len
));
2688 length
= ext_prop
->name_len
+ ext_prop
->data_len
+ 14;
2690 ext_prop_name
= func
->ffs
->ms_os_descs_ext_prop_name_avail
;
2691 func
->ffs
->ms_os_descs_ext_prop_name_avail
+=
2694 ext_prop_data
= func
->ffs
->ms_os_descs_ext_prop_data_avail
;
2695 func
->ffs
->ms_os_descs_ext_prop_data_avail
+=
2697 memcpy(ext_prop_data
,
2698 usb_ext_prop_data_ptr(data
, ext_prop
->name_len
),
2699 ext_prop
->data_len
);
2700 /* unicode data reported to the host as "WCHAR"s */
2701 switch (ext_prop
->type
) {
2702 case USB_EXT_PROP_UNICODE
:
2703 case USB_EXT_PROP_UNICODE_ENV
:
2704 case USB_EXT_PROP_UNICODE_LINK
:
2705 case USB_EXT_PROP_UNICODE_MULTI
:
2706 ext_prop
->data_len
*= 2;
2709 ext_prop
->data
= ext_prop_data
;
2711 memcpy(ext_prop_name
, usb_ext_prop_name_ptr(data
),
2712 ext_prop
->name_len
);
2713 /* property name reported to the host as "WCHAR"s */
2714 ext_prop
->name_len
*= 2;
2715 ext_prop
->name
= ext_prop_name
;
2717 t
->os_desc
->ext_prop_len
+=
2718 ext_prop
->name_len
+ ext_prop
->data_len
+ 14;
2719 ++t
->os_desc
->ext_prop_count
;
2720 list_add_tail(&ext_prop
->entry
, &t
->os_desc
->ext_prop
);
2724 pr_vdebug("unknown descriptor: %d\n", type
);
2730 static inline struct f_fs_opts
*ffs_do_functionfs_bind(struct usb_function
*f
,
2731 struct usb_configuration
*c
)
2733 struct ffs_function
*func
= ffs_func_from_usb(f
);
2734 struct f_fs_opts
*ffs_opts
=
2735 container_of(f
->fi
, struct f_fs_opts
, func_inst
);
2741 * Legacy gadget triggers binding in functionfs_ready_callback,
2742 * which already uses locking; taking the same lock here would
2745 * Configfs-enabled gadgets however do need ffs_dev_lock.
2747 if (!ffs_opts
->no_configfs
)
2749 ret
= ffs_opts
->dev
->desc_ready
? 0 : -ENODEV
;
2750 func
->ffs
= ffs_opts
->dev
->ffs_data
;
2751 if (!ffs_opts
->no_configfs
)
2754 return ERR_PTR(ret
);
2757 func
->gadget
= c
->cdev
->gadget
;
2760 * in drivers/usb/gadget/configfs.c:configfs_composite_bind()
2761 * configurations are bound in sequence with list_for_each_entry,
2762 * in each configuration its functions are bound in sequence
2763 * with list_for_each_entry, so we assume no race condition
2764 * with regard to ffs_opts->bound access
2766 if (!ffs_opts
->refcnt
) {
2767 ret
= functionfs_bind(func
->ffs
, c
->cdev
);
2769 return ERR_PTR(ret
);
2772 func
->function
.strings
= func
->ffs
->stringtabs
;
2777 static int _ffs_func_bind(struct usb_configuration
*c
,
2778 struct usb_function
*f
)
2780 struct ffs_function
*func
= ffs_func_from_usb(f
);
2781 struct ffs_data
*ffs
= func
->ffs
;
2783 const int full
= !!func
->ffs
->fs_descs_count
;
2784 const int high
= gadget_is_dualspeed(func
->gadget
) &&
2785 func
->ffs
->hs_descs_count
;
2786 const int super
= gadget_is_superspeed(func
->gadget
) &&
2787 func
->ffs
->ss_descs_count
;
2789 int fs_len
, hs_len
, ss_len
, ret
, i
;
2791 /* Make it a single chunk, less management later on */
2793 vla_item_with_sz(d
, struct ffs_ep
, eps
, ffs
->eps_count
);
2794 vla_item_with_sz(d
, struct usb_descriptor_header
*, fs_descs
,
2795 full
? ffs
->fs_descs_count
+ 1 : 0);
2796 vla_item_with_sz(d
, struct usb_descriptor_header
*, hs_descs
,
2797 high
? ffs
->hs_descs_count
+ 1 : 0);
2798 vla_item_with_sz(d
, struct usb_descriptor_header
*, ss_descs
,
2799 super
? ffs
->ss_descs_count
+ 1 : 0);
2800 vla_item_with_sz(d
, short, inums
, ffs
->interfaces_count
);
2801 vla_item_with_sz(d
, struct usb_os_desc_table
, os_desc_table
,
2802 c
->cdev
->use_os_string
? ffs
->interfaces_count
: 0);
2803 vla_item_with_sz(d
, char[16], ext_compat
,
2804 c
->cdev
->use_os_string
? ffs
->interfaces_count
: 0);
2805 vla_item_with_sz(d
, struct usb_os_desc
, os_desc
,
2806 c
->cdev
->use_os_string
? ffs
->interfaces_count
: 0);
2807 vla_item_with_sz(d
, struct usb_os_desc_ext_prop
, ext_prop
,
2808 ffs
->ms_os_descs_ext_prop_count
);
2809 vla_item_with_sz(d
, char, ext_prop_name
,
2810 ffs
->ms_os_descs_ext_prop_name_len
);
2811 vla_item_with_sz(d
, char, ext_prop_data
,
2812 ffs
->ms_os_descs_ext_prop_data_len
);
2813 vla_item_with_sz(d
, char, raw_descs
, ffs
->raw_descs_length
);
2818 /* Has descriptors only for speeds gadget does not support */
2819 if (unlikely(!(full
| high
| super
)))
2822 /* Allocate a single chunk, less management later on */
2823 vlabuf
= kzalloc(vla_group_size(d
), GFP_KERNEL
);
2824 if (unlikely(!vlabuf
))
2827 ffs
->ms_os_descs_ext_prop_avail
= vla_ptr(vlabuf
, d
, ext_prop
);
2828 ffs
->ms_os_descs_ext_prop_name_avail
=
2829 vla_ptr(vlabuf
, d
, ext_prop_name
);
2830 ffs
->ms_os_descs_ext_prop_data_avail
=
2831 vla_ptr(vlabuf
, d
, ext_prop_data
);
2833 /* Copy descriptors */
2834 memcpy(vla_ptr(vlabuf
, d
, raw_descs
), ffs
->raw_descs
,
2835 ffs
->raw_descs_length
);
2837 memset(vla_ptr(vlabuf
, d
, inums
), 0xff, d_inums__sz
);
2838 for (ret
= ffs
->eps_count
; ret
; --ret
) {
2841 ptr
= vla_ptr(vlabuf
, d
, eps
);
2846 * d_eps == vlabuf, func->eps used to kfree vlabuf later
2848 func
->eps
= vla_ptr(vlabuf
, d
, eps
);
2849 func
->interfaces_nums
= vla_ptr(vlabuf
, d
, inums
);
2852 * Go through all the endpoint descriptors and allocate
2853 * endpoints first, so that later we can rewrite the endpoint
2854 * numbers without worrying that it may be described later on.
2857 func
->function
.fs_descriptors
= vla_ptr(vlabuf
, d
, fs_descs
);
2858 fs_len
= ffs_do_descs(ffs
->fs_descs_count
,
2859 vla_ptr(vlabuf
, d
, raw_descs
),
2861 __ffs_func_bind_do_descs
, func
);
2862 if (unlikely(fs_len
< 0)) {
2871 func
->function
.hs_descriptors
= vla_ptr(vlabuf
, d
, hs_descs
);
2872 hs_len
= ffs_do_descs(ffs
->hs_descs_count
,
2873 vla_ptr(vlabuf
, d
, raw_descs
) + fs_len
,
2874 d_raw_descs__sz
- fs_len
,
2875 __ffs_func_bind_do_descs
, func
);
2876 if (unlikely(hs_len
< 0)) {
2884 if (likely(super
)) {
2885 func
->function
.ss_descriptors
= vla_ptr(vlabuf
, d
, ss_descs
);
2886 ss_len
= ffs_do_descs(ffs
->ss_descs_count
,
2887 vla_ptr(vlabuf
, d
, raw_descs
) + fs_len
+ hs_len
,
2888 d_raw_descs__sz
- fs_len
- hs_len
,
2889 __ffs_func_bind_do_descs
, func
);
2890 if (unlikely(ss_len
< 0)) {
2899 * Now handle interface numbers allocation and interface and
2900 * endpoint numbers rewriting. We can do that in one go
2903 ret
= ffs_do_descs(ffs
->fs_descs_count
+
2904 (high
? ffs
->hs_descs_count
: 0) +
2905 (super
? ffs
->ss_descs_count
: 0),
2906 vla_ptr(vlabuf
, d
, raw_descs
), d_raw_descs__sz
,
2907 __ffs_func_bind_do_nums
, func
);
2908 if (unlikely(ret
< 0))
2911 func
->function
.os_desc_table
= vla_ptr(vlabuf
, d
, os_desc_table
);
2912 if (c
->cdev
->use_os_string
)
2913 for (i
= 0; i
< ffs
->interfaces_count
; ++i
) {
2914 struct usb_os_desc
*desc
;
2916 desc
= func
->function
.os_desc_table
[i
].os_desc
=
2917 vla_ptr(vlabuf
, d
, os_desc
) +
2918 i
* sizeof(struct usb_os_desc
);
2919 desc
->ext_compat_id
=
2920 vla_ptr(vlabuf
, d
, ext_compat
) + i
* 16;
2921 INIT_LIST_HEAD(&desc
->ext_prop
);
2923 ret
= ffs_do_os_descs(ffs
->ms_os_descs_count
,
2924 vla_ptr(vlabuf
, d
, raw_descs
) +
2925 fs_len
+ hs_len
+ ss_len
,
2926 d_raw_descs__sz
- fs_len
- hs_len
- ss_len
,
2927 __ffs_func_bind_do_os_desc
, func
);
2928 if (unlikely(ret
< 0))
2930 func
->function
.os_desc_n
=
2931 c
->cdev
->use_os_string
? ffs
->interfaces_count
: 0;
2933 /* And we're done */
2934 ffs_event_add(ffs
, FUNCTIONFS_BIND
);
2938 /* XXX Do we need to release all claimed endpoints here? */
2942 static int ffs_func_bind(struct usb_configuration
*c
,
2943 struct usb_function
*f
)
2945 struct f_fs_opts
*ffs_opts
= ffs_do_functionfs_bind(f
, c
);
2947 if (IS_ERR(ffs_opts
))
2948 return PTR_ERR(ffs_opts
);
2950 return _ffs_func_bind(c
, f
);
2954 /* Other USB function hooks *************************************************/
2956 static void ffs_reset_work(struct work_struct
*work
)
2958 struct ffs_data
*ffs
= container_of(work
,
2959 struct ffs_data
, reset_work
);
2960 ffs_data_reset(ffs
);
2963 static int ffs_func_set_alt(struct usb_function
*f
,
2964 unsigned interface
, unsigned alt
)
2966 struct ffs_function
*func
= ffs_func_from_usb(f
);
2967 struct ffs_data
*ffs
= func
->ffs
;
2970 if (alt
!= (unsigned)-1) {
2971 intf
= ffs_func_revmap_intf(func
, interface
);
2972 if (unlikely(intf
< 0))
2977 ffs_func_eps_disable(ffs
->func
);
2979 if (ffs
->state
== FFS_DEACTIVATED
) {
2980 ffs
->state
= FFS_CLOSING
;
2981 INIT_WORK(&ffs
->reset_work
, ffs_reset_work
);
2982 schedule_work(&ffs
->reset_work
);
2986 if (ffs
->state
!= FFS_ACTIVE
)
2989 if (alt
== (unsigned)-1) {
2991 ffs_event_add(ffs
, FUNCTIONFS_DISABLE
);
2996 ret
= ffs_func_eps_enable(func
);
2997 if (likely(ret
>= 0))
2998 ffs_event_add(ffs
, FUNCTIONFS_ENABLE
);
3002 static void ffs_func_disable(struct usb_function
*f
)
3004 ffs_func_set_alt(f
, 0, (unsigned)-1);
3007 static int ffs_func_setup(struct usb_function
*f
,
3008 const struct usb_ctrlrequest
*creq
)
3010 struct ffs_function
*func
= ffs_func_from_usb(f
);
3011 struct ffs_data
*ffs
= func
->ffs
;
3012 unsigned long flags
;
3017 pr_vdebug("creq->bRequestType = %02x\n", creq
->bRequestType
);
3018 pr_vdebug("creq->bRequest = %02x\n", creq
->bRequest
);
3019 pr_vdebug("creq->wValue = %04x\n", le16_to_cpu(creq
->wValue
));
3020 pr_vdebug("creq->wIndex = %04x\n", le16_to_cpu(creq
->wIndex
));
3021 pr_vdebug("creq->wLength = %04x\n", le16_to_cpu(creq
->wLength
));
3024 * Most requests directed to interface go through here
3025 * (notable exceptions are set/get interface) so we need to
3026 * handle them. All other either handled by composite or
3027 * passed to usb_configuration->setup() (if one is set). No
3028 * matter, we will handle requests directed to endpoint here
3029 * as well (as it's straightforward) but what to do with any
3032 if (ffs
->state
!= FFS_ACTIVE
)
3035 switch (creq
->bRequestType
& USB_RECIP_MASK
) {
3036 case USB_RECIP_INTERFACE
:
3037 ret
= ffs_func_revmap_intf(func
, le16_to_cpu(creq
->wIndex
));
3038 if (unlikely(ret
< 0))
3042 case USB_RECIP_ENDPOINT
:
3043 ret
= ffs_func_revmap_ep(func
, le16_to_cpu(creq
->wIndex
));
3044 if (unlikely(ret
< 0))
3046 if (func
->ffs
->user_flags
& FUNCTIONFS_VIRTUAL_ADDR
)
3047 ret
= func
->ffs
->eps_addrmap
[ret
];
3054 spin_lock_irqsave(&ffs
->ev
.waitq
.lock
, flags
);
3055 ffs
->ev
.setup
= *creq
;
3056 ffs
->ev
.setup
.wIndex
= cpu_to_le16(ret
);
3057 __ffs_event_add(ffs
, FUNCTIONFS_SETUP
);
3058 spin_unlock_irqrestore(&ffs
->ev
.waitq
.lock
, flags
);
3063 static void ffs_func_suspend(struct usb_function
*f
)
3066 ffs_event_add(ffs_func_from_usb(f
)->ffs
, FUNCTIONFS_SUSPEND
);
3069 static void ffs_func_resume(struct usb_function
*f
)
3072 ffs_event_add(ffs_func_from_usb(f
)->ffs
, FUNCTIONFS_RESUME
);
3076 /* Endpoint and interface numbers reverse mapping ***************************/
3078 static int ffs_func_revmap_ep(struct ffs_function
*func
, u8 num
)
3080 num
= func
->eps_revmap
[num
& USB_ENDPOINT_NUMBER_MASK
];
3081 return num
? num
: -EDOM
;
3084 static int ffs_func_revmap_intf(struct ffs_function
*func
, u8 intf
)
3086 short *nums
= func
->interfaces_nums
;
3087 unsigned count
= func
->ffs
->interfaces_count
;
3089 for (; count
; --count
, ++nums
) {
3090 if (*nums
>= 0 && *nums
== intf
)
3091 return nums
- func
->interfaces_nums
;
3098 /* Devices management *******************************************************/
3100 static LIST_HEAD(ffs_devices
);
3102 static struct ffs_dev
*_ffs_do_find_dev(const char *name
)
3104 struct ffs_dev
*dev
;
3106 list_for_each_entry(dev
, &ffs_devices
, entry
) {
3107 if (!dev
->name
|| !name
)
3109 if (strcmp(dev
->name
, name
) == 0)
3117 * ffs_lock must be taken by the caller of this function
3119 static struct ffs_dev
*_ffs_get_single_dev(void)
3121 struct ffs_dev
*dev
;
3123 if (list_is_singular(&ffs_devices
)) {
3124 dev
= list_first_entry(&ffs_devices
, struct ffs_dev
, entry
);
3133 * ffs_lock must be taken by the caller of this function
3135 static struct ffs_dev
*_ffs_find_dev(const char *name
)
3137 struct ffs_dev
*dev
;
3139 dev
= _ffs_get_single_dev();
3143 return _ffs_do_find_dev(name
);
3146 /* Configfs support *********************************************************/
3148 static inline struct f_fs_opts
*to_ffs_opts(struct config_item
*item
)
3150 return container_of(to_config_group(item
), struct f_fs_opts
,
3154 static void ffs_attr_release(struct config_item
*item
)
3156 struct f_fs_opts
*opts
= to_ffs_opts(item
);
3158 usb_put_function_instance(&opts
->func_inst
);
3161 static struct configfs_item_operations ffs_item_ops
= {
3162 .release
= ffs_attr_release
,
3165 static struct config_item_type ffs_func_type
= {
3166 .ct_item_ops
= &ffs_item_ops
,
3167 .ct_owner
= THIS_MODULE
,
3171 /* Function registration interface ******************************************/
3173 static void ffs_free_inst(struct usb_function_instance
*f
)
3175 struct f_fs_opts
*opts
;
3177 opts
= to_f_fs_opts(f
);
3179 _ffs_free_dev(opts
->dev
);
3184 #define MAX_INST_NAME_LEN 40
3186 static int ffs_set_inst_name(struct usb_function_instance
*fi
, const char *name
)
3188 struct f_fs_opts
*opts
;
3193 name_len
= strlen(name
) + 1;
3194 if (name_len
> MAX_INST_NAME_LEN
)
3195 return -ENAMETOOLONG
;
3197 ptr
= kstrndup(name
, name_len
, GFP_KERNEL
);
3201 opts
= to_f_fs_opts(fi
);
3206 tmp
= opts
->dev
->name_allocated
? opts
->dev
->name
: NULL
;
3207 ret
= _ffs_name_dev(opts
->dev
, ptr
);
3213 opts
->dev
->name_allocated
= true;
3222 static struct usb_function_instance
*ffs_alloc_inst(void)
3224 struct f_fs_opts
*opts
;
3225 struct ffs_dev
*dev
;
3227 opts
= kzalloc(sizeof(*opts
), GFP_KERNEL
);
3229 return ERR_PTR(-ENOMEM
);
3231 opts
->func_inst
.set_inst_name
= ffs_set_inst_name
;
3232 opts
->func_inst
.free_func_inst
= ffs_free_inst
;
3234 dev
= _ffs_alloc_dev();
3238 return ERR_CAST(dev
);
3243 config_group_init_type_name(&opts
->func_inst
.group
, "",
3245 return &opts
->func_inst
;
3248 static void ffs_free(struct usb_function
*f
)
3250 kfree(ffs_func_from_usb(f
));
3253 static void ffs_func_unbind(struct usb_configuration
*c
,
3254 struct usb_function
*f
)
3256 struct ffs_function
*func
= ffs_func_from_usb(f
);
3257 struct ffs_data
*ffs
= func
->ffs
;
3258 struct f_fs_opts
*opts
=
3259 container_of(f
->fi
, struct f_fs_opts
, func_inst
);
3260 struct ffs_ep
*ep
= func
->eps
;
3261 unsigned count
= ffs
->eps_count
;
3262 unsigned long flags
;
3265 if (ffs
->func
== func
) {
3266 ffs_func_eps_disable(func
);
3270 if (!--opts
->refcnt
)
3271 functionfs_unbind(ffs
);
3273 /* cleanup after autoconfig */
3274 spin_lock_irqsave(&func
->ffs
->eps_lock
, flags
);
3276 if (ep
->ep
&& ep
->req
)
3277 usb_ep_free_request(ep
->ep
, ep
->req
);
3281 spin_unlock_irqrestore(&func
->ffs
->eps_lock
, flags
);
3285 * eps, descriptors and interfaces_nums are allocated in the
3286 * same chunk so only one free is required.
3288 func
->function
.fs_descriptors
= NULL
;
3289 func
->function
.hs_descriptors
= NULL
;
3290 func
->function
.ss_descriptors
= NULL
;
3291 func
->interfaces_nums
= NULL
;
3293 ffs_event_add(ffs
, FUNCTIONFS_UNBIND
);
3296 static struct usb_function
*ffs_alloc(struct usb_function_instance
*fi
)
3298 struct ffs_function
*func
;
3302 func
= kzalloc(sizeof(*func
), GFP_KERNEL
);
3303 if (unlikely(!func
))
3304 return ERR_PTR(-ENOMEM
);
3306 func
->function
.name
= "Function FS Gadget";
3308 func
->function
.bind
= ffs_func_bind
;
3309 func
->function
.unbind
= ffs_func_unbind
;
3310 func
->function
.set_alt
= ffs_func_set_alt
;
3311 func
->function
.disable
= ffs_func_disable
;
3312 func
->function
.setup
= ffs_func_setup
;
3313 func
->function
.suspend
= ffs_func_suspend
;
3314 func
->function
.resume
= ffs_func_resume
;
3315 func
->function
.free_func
= ffs_free
;
3317 return &func
->function
;
3321 * ffs_lock must be taken by the caller of this function
3323 static struct ffs_dev
*_ffs_alloc_dev(void)
3325 struct ffs_dev
*dev
;
3328 if (_ffs_get_single_dev())
3329 return ERR_PTR(-EBUSY
);
3331 dev
= kzalloc(sizeof(*dev
), GFP_KERNEL
);
3333 return ERR_PTR(-ENOMEM
);
3335 if (list_empty(&ffs_devices
)) {
3336 ret
= functionfs_init();
3339 return ERR_PTR(ret
);
3343 list_add(&dev
->entry
, &ffs_devices
);
3349 * ffs_lock must be taken by the caller of this function
3350 * The caller is responsible for "name" being available whenever f_fs needs it
3352 static int _ffs_name_dev(struct ffs_dev
*dev
, const char *name
)
3354 struct ffs_dev
*existing
;
3356 existing
= _ffs_do_find_dev(name
);
3366 * The caller is responsible for "name" being available whenever f_fs needs it
3368 int ffs_name_dev(struct ffs_dev
*dev
, const char *name
)
3373 ret
= _ffs_name_dev(dev
, name
);
3378 EXPORT_SYMBOL_GPL(ffs_name_dev
);
3380 int ffs_single_dev(struct ffs_dev
*dev
)
3387 if (!list_is_singular(&ffs_devices
))
3395 EXPORT_SYMBOL_GPL(ffs_single_dev
);
3398 * ffs_lock must be taken by the caller of this function
3400 static void _ffs_free_dev(struct ffs_dev
*dev
)
3402 list_del(&dev
->entry
);
3403 if (dev
->name_allocated
)
3406 if (list_empty(&ffs_devices
))
3407 functionfs_cleanup();
3410 static void *ffs_acquire_dev(const char *dev_name
)
3412 struct ffs_dev
*ffs_dev
;
3417 ffs_dev
= _ffs_find_dev(dev_name
);
3419 ffs_dev
= ERR_PTR(-ENOENT
);
3420 else if (ffs_dev
->mounted
)
3421 ffs_dev
= ERR_PTR(-EBUSY
);
3422 else if (ffs_dev
->ffs_acquire_dev_callback
&&
3423 ffs_dev
->ffs_acquire_dev_callback(ffs_dev
))
3424 ffs_dev
= ERR_PTR(-ENOENT
);
3426 ffs_dev
->mounted
= true;
3432 static void ffs_release_dev(struct ffs_data
*ffs_data
)
3434 struct ffs_dev
*ffs_dev
;
3439 ffs_dev
= ffs_data
->private_data
;
3441 ffs_dev
->mounted
= false;
3443 if (ffs_dev
->ffs_release_dev_callback
)
3444 ffs_dev
->ffs_release_dev_callback(ffs_dev
);
3450 static int ffs_ready(struct ffs_data
*ffs
)
3452 struct ffs_dev
*ffs_obj
;
3458 ffs_obj
= ffs
->private_data
;
3463 if (WARN_ON(ffs_obj
->desc_ready
)) {
3468 ffs_obj
->desc_ready
= true;
3469 ffs_obj
->ffs_data
= ffs
;
3471 if (ffs_obj
->ffs_ready_callback
)
3472 ret
= ffs_obj
->ffs_ready_callback(ffs
);
3479 static void ffs_closed(struct ffs_data
*ffs
)
3481 struct ffs_dev
*ffs_obj
;
3486 ffs_obj
= ffs
->private_data
;
3490 ffs_obj
->desc_ready
= false;
3492 if (ffs_obj
->ffs_closed_callback
)
3493 ffs_obj
->ffs_closed_callback(ffs
);
3495 if (!ffs_obj
->opts
|| ffs_obj
->opts
->no_configfs
3496 || !ffs_obj
->opts
->func_inst
.group
.cg_item
.ci_parent
)
3499 unregister_gadget_item(ffs_obj
->opts
->
3500 func_inst
.group
.cg_item
.ci_parent
->ci_parent
);
3505 /* Misc helper functions ****************************************************/
3507 static int ffs_mutex_lock(struct mutex
*mutex
, unsigned nonblock
)
3510 ? likely(mutex_trylock(mutex
)) ? 0 : -EAGAIN
3511 : mutex_lock_interruptible(mutex
);
3514 static char *ffs_prepare_buffer(const char __user
*buf
, size_t len
)
3521 data
= kmalloc(len
, GFP_KERNEL
);
3522 if (unlikely(!data
))
3523 return ERR_PTR(-ENOMEM
);
3525 if (unlikely(__copy_from_user(data
, buf
, len
))) {
3527 return ERR_PTR(-EFAULT
);
3530 pr_vdebug("Buffer from user space:\n");
3531 ffs_dump_mem("", data
, len
);
3536 DECLARE_USB_FUNCTION_INIT(ffs
, ffs_alloc_inst
, ffs_alloc
);
3537 MODULE_LICENSE("GPL");
3538 MODULE_AUTHOR("Michal Nazarewicz");