projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide
[deliverable/linux.git] / drivers / usb / gadget / function / f_fs.c
1 /*
2 * f_fs.c -- user mode file system API for USB composite function controllers
3 *
4 * Copyright (C) 2010 Samsung Electronics
5 * Author: Michal Nazarewicz <mina86@mina86.com>
6 *
7 * Based on inode.c (GadgetFS) which was:
8 * Copyright (C) 2003-2004 David Brownell
9 * Copyright (C) 2003 Agilent Technologies
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
15 */
16
17
18 /* #define DEBUG */
19 /* #define VERBOSE_DEBUG */
20
21 #include <linux/blkdev.h>
22 #include <linux/pagemap.h>
23 #include <linux/export.h>
24 #include <linux/hid.h>
25 #include <linux/module.h>
26 #include <linux/uio.h>
27 #include <asm/unaligned.h>
28
29 #include <linux/usb/composite.h>
30 #include <linux/usb/functionfs.h>
31
32 #include <linux/aio.h>
33 #include <linux/mmu_context.h>
34 #include <linux/poll.h>
35 #include <linux/eventfd.h>
36
37 #include "u_fs.h"
38 #include "u_f.h"
39 #include "u_os_desc.h"
40 #include "configfs.h"
41
42 #define FUNCTIONFS_MAGIC 0xa647361 /* Chosen by a honest dice roll ;) */
43
44 /* Reference counter handling */
45 static void ffs_data_get(struct ffs_data *ffs);
46 static void ffs_data_put(struct ffs_data *ffs);
47 /* Creates new ffs_data object. */
48 static struct ffs_data *__must_check ffs_data_new(void) __attribute__((malloc));
49
50 /* Opened counter handling. */
51 static void ffs_data_opened(struct ffs_data *ffs);
52 static void ffs_data_closed(struct ffs_data *ffs);
53
54 /* Called with ffs->mutex held; take over ownership of data. */
55 static int __must_check
56 __ffs_data_got_descs(struct ffs_data *ffs, char *data, size_t len);
57 static int __must_check
58 __ffs_data_got_strings(struct ffs_data *ffs, char *data, size_t len);
59
60
61 /* The function structure ***************************************************/
62
63 struct ffs_ep;
64
65 struct ffs_function {
66 struct usb_configuration *conf;
67 struct usb_gadget *gadget;
68 struct ffs_data *ffs;
69
70 struct ffs_ep *eps;
71 u8 eps_revmap[16];
72 short *interfaces_nums;
73
74 struct usb_function function;
75 };
76
77
78 static struct ffs_function *ffs_func_from_usb(struct usb_function *f)
79 {
80 return container_of(f, struct ffs_function, function);
81 }
82
83
84 static inline enum ffs_setup_state
85 ffs_setup_state_clear_cancelled(struct ffs_data *ffs)
86 {
87 return (enum ffs_setup_state)
88 cmpxchg(&ffs->setup_state, FFS_SETUP_CANCELLED, FFS_NO_SETUP);
89 }
90
91
92 static void ffs_func_eps_disable(struct ffs_function *func);
93 static int __must_check ffs_func_eps_enable(struct ffs_function *func);
94
95 static int ffs_func_bind(struct usb_configuration *,
96 struct usb_function *);
97 static int ffs_func_set_alt(struct usb_function *, unsigned, unsigned);
98 static void ffs_func_disable(struct usb_function *);
99 static int ffs_func_setup(struct usb_function *,
100 const struct usb_ctrlrequest *);
101 static void ffs_func_suspend(struct usb_function *);
102 static void ffs_func_resume(struct usb_function *);
103
104
105 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num);
106 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf);
107
108
109 /* The endpoints structures *************************************************/
110
111 struct ffs_ep {
112 struct usb_ep *ep; /* P: ffs->eps_lock */
113 struct usb_request *req; /* P: epfile->mutex */
114
115 /* [0]: full speed, [1]: high speed, [2]: super speed */
116 struct usb_endpoint_descriptor *descs[3];
117
118 u8 num;
119
120 int status; /* P: epfile->mutex */
121 };
122
123 struct ffs_epfile {
124 /* Protects ep->ep and ep->req. */
125 struct mutex mutex;
126 wait_queue_head_t wait;
127
128 struct ffs_data *ffs;
129 struct ffs_ep *ep; /* P: ffs->eps_lock */
130
131 struct dentry *dentry;
132
133 /*
134 * Buffer for holding data from partial reads which may happen since
135 * we’re rounding user read requests to a multiple of a max packet size.
136 */
137 struct ffs_buffer *read_buffer; /* P: epfile->mutex */
138
139 char name[5];
140
141 unsigned char in; /* P: ffs->eps_lock */
142 unsigned char isoc; /* P: ffs->eps_lock */
143
144 unsigned char _pad;
145 };
146
147 struct ffs_buffer {
148 size_t length;
149 char *data;
150 char storage[];
151 };
152
153 /* ffs_io_data structure ***************************************************/
154
155 struct ffs_io_data {
156 bool aio;
157 bool read;
158
159 struct kiocb *kiocb;
160 struct iov_iter data;
161 const void *to_free;
162 char *buf;
163
164 struct mm_struct *mm;
165 struct work_struct work;
166
167 struct usb_ep *ep;
168 struct usb_request *req;
169
170 struct ffs_data *ffs;
171 };
172
173 struct ffs_desc_helper {
174 struct ffs_data *ffs;
175 unsigned interfaces_count;
176 unsigned eps_count;
177 };
178
179 static int __must_check ffs_epfiles_create(struct ffs_data *ffs);
180 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count);
181
182 static struct dentry *
183 ffs_sb_create_file(struct super_block *sb, const char *name, void *data,
184 const struct file_operations *fops);
185
186 /* Devices management *******************************************************/
187
188 DEFINE_MUTEX(ffs_lock);
189 EXPORT_SYMBOL_GPL(ffs_lock);
190
191 static struct ffs_dev *_ffs_find_dev(const char *name);
192 static struct ffs_dev *_ffs_alloc_dev(void);
193 static int _ffs_name_dev(struct ffs_dev *dev, const char *name);
194 static void _ffs_free_dev(struct ffs_dev *dev);
195 static void *ffs_acquire_dev(const char *dev_name);
196 static void ffs_release_dev(struct ffs_data *ffs_data);
197 static int ffs_ready(struct ffs_data *ffs);
198 static void ffs_closed(struct ffs_data *ffs);
199
200 /* Misc helper functions ****************************************************/
201
202 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
203 __attribute__((warn_unused_result, nonnull));
204 static char *ffs_prepare_buffer(const char __user *buf, size_t len)
205 __attribute__((warn_unused_result, nonnull));
206
207
208 /* Control file aka ep0 *****************************************************/
209
210 static void ffs_ep0_complete(struct usb_ep *ep, struct usb_request *req)
211 {
212 struct ffs_data *ffs = req->context;
213
214 complete_all(&ffs->ep0req_completion);
215 }
216
217 static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)
218 {
219 struct usb_request *req = ffs->ep0req;
220 int ret;
221
222 req->zero = len < le16_to_cpu(ffs->ev.setup.wLength);
223
224 spin_unlock_irq(&ffs->ev.waitq.lock);
225
226 req->buf = data;
227 req->length = len;
228
229 /*
230 * UDC layer requires to provide a buffer even for ZLP, but should
231 * not use it at all. Let's provide some poisoned pointer to catch
232 * possible bug in the driver.
233 */
234 if (req->buf == NULL)
235 req->buf = (void *)0xDEADBABE;
236
237 reinit_completion(&ffs->ep0req_completion);
238
239 ret = usb_ep_queue(ffs->gadget->ep0, req, GFP_ATOMIC);
240 if (unlikely(ret < 0))
241 return ret;
242
243 ret = wait_for_completion_interruptible(&ffs->ep0req_completion);
244 if (unlikely(ret)) {
245 usb_ep_dequeue(ffs->gadget->ep0, req);
246 return -EINTR;
247 }
248
249 ffs->setup_state = FFS_NO_SETUP;
250 return req->status ? req->status : req->actual;
251 }
252
253 static int __ffs_ep0_stall(struct ffs_data *ffs)
254 {
255 if (ffs->ev.can_stall) {
256 pr_vdebug("ep0 stall\n");
257 usb_ep_set_halt(ffs->gadget->ep0);
258 ffs->setup_state = FFS_NO_SETUP;
259 return -EL2HLT;
260 } else {
261 pr_debug("bogus ep0 stall!\n");
262 return -ESRCH;
263 }
264 }
265
266 static ssize_t ffs_ep0_write(struct file *file, const char __user *buf,
267 size_t len, loff_t *ptr)
268 {
269 struct ffs_data *ffs = file->private_data;
270 ssize_t ret;
271 char *data;
272
273 ENTER();
274
275 /* Fast check if setup was canceled */
276 if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
277 return -EIDRM;
278
279 /* Acquire mutex */
280 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
281 if (unlikely(ret < 0))
282 return ret;
283
284 /* Check state */
285 switch (ffs->state) {
286 case FFS_READ_DESCRIPTORS:
287 case FFS_READ_STRINGS:
288 /* Copy data */
289 if (unlikely(len < 16)) {
290 ret = -EINVAL;
291 break;
292 }
293
294 data = ffs_prepare_buffer(buf, len);
295 if (IS_ERR(data)) {
296 ret = PTR_ERR(data);
297 break;
298 }
299
300 /* Handle data */
301 if (ffs->state == FFS_READ_DESCRIPTORS) {
302 pr_info("read descriptors\n");
303 ret = __ffs_data_got_descs(ffs, data, len);
304 if (unlikely(ret < 0))
305 break;
306
307 ffs->state = FFS_READ_STRINGS;
308 ret = len;
309 } else {
310 pr_info("read strings\n");
311 ret = __ffs_data_got_strings(ffs, data, len);
312 if (unlikely(ret < 0))
313 break;
314
315 ret = ffs_epfiles_create(ffs);
316 if (unlikely(ret)) {
317 ffs->state = FFS_CLOSING;
318 break;
319 }
320
321 ffs->state = FFS_ACTIVE;
322 mutex_unlock(&ffs->mutex);
323
324 ret = ffs_ready(ffs);
325 if (unlikely(ret < 0)) {
326 ffs->state = FFS_CLOSING;
327 return ret;
328 }
329
330 return len;
331 }
332 break;
333
334 case FFS_ACTIVE:
335 data = NULL;
336 /*
337 * We're called from user space, we can use _irq
338 * rather then _irqsave
339 */
340 spin_lock_irq(&ffs->ev.waitq.lock);
341 switch (ffs_setup_state_clear_cancelled(ffs)) {
342 case FFS_SETUP_CANCELLED:
343 ret = -EIDRM;
344 goto done_spin;
345
346 case FFS_NO_SETUP:
347 ret = -ESRCH;
348 goto done_spin;
349
350 case FFS_SETUP_PENDING:
351 break;
352 }
353
354 /* FFS_SETUP_PENDING */
355 if (!(ffs->ev.setup.bRequestType & USB_DIR_IN)) {
356 spin_unlock_irq(&ffs->ev.waitq.lock);
357 ret = __ffs_ep0_stall(ffs);
358 break;
359 }
360
361 /* FFS_SETUP_PENDING and not stall */
362 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength));
363
364 spin_unlock_irq(&ffs->ev.waitq.lock);
365
366 data = ffs_prepare_buffer(buf, len);
367 if (IS_ERR(data)) {
368 ret = PTR_ERR(data);
369 break;
370 }
371
372 spin_lock_irq(&ffs->ev.waitq.lock);
373
374 /*
375 * We are guaranteed to be still in FFS_ACTIVE state
376 * but the state of setup could have changed from
377 * FFS_SETUP_PENDING to FFS_SETUP_CANCELLED so we need
378 * to check for that. If that happened we copied data
379 * from user space in vain but it's unlikely.
380 *
381 * For sure we are not in FFS_NO_SETUP since this is
382 * the only place FFS_SETUP_PENDING -> FFS_NO_SETUP
383 * transition can be performed and it's protected by
384 * mutex.
385 */
386 if (ffs_setup_state_clear_cancelled(ffs) ==
387 FFS_SETUP_CANCELLED) {
388 ret = -EIDRM;
389 done_spin:
390 spin_unlock_irq(&ffs->ev.waitq.lock);
391 } else {
392 /* unlocks spinlock */
393 ret = __ffs_ep0_queue_wait(ffs, data, len);
394 }
395 kfree(data);
396 break;
397
398 default:
399 ret = -EBADFD;
400 break;
401 }
402
403 mutex_unlock(&ffs->mutex);
404 return ret;
405 }
406
407 /* Called with ffs->ev.waitq.lock and ffs->mutex held, both released on exit. */
408 static ssize_t __ffs_ep0_read_events(struct ffs_data *ffs, char __user *buf,
409 size_t n)
410 {
411 /*
412 * n cannot be bigger than ffs->ev.count, which cannot be bigger than
413 * size of ffs->ev.types array (which is four) so that's how much space
414 * we reserve.
415 */
416 struct usb_functionfs_event events[ARRAY_SIZE(ffs->ev.types)];
417 const size_t size = n * sizeof *events;
418 unsigned i = 0;
419
420 memset(events, 0, size);
421
422 do {
423 events[i].type = ffs->ev.types[i];
424 if (events[i].type == FUNCTIONFS_SETUP) {
425 events[i].u.setup = ffs->ev.setup;
426 ffs->setup_state = FFS_SETUP_PENDING;
427 }
428 } while (++i < n);
429
430 ffs->ev.count -= n;
431 if (ffs->ev.count)
432 memmove(ffs->ev.types, ffs->ev.types + n,
433 ffs->ev.count * sizeof *ffs->ev.types);
434
435 spin_unlock_irq(&ffs->ev.waitq.lock);
436 mutex_unlock(&ffs->mutex);
437
438 return unlikely(copy_to_user(buf, events, size)) ? -EFAULT : size;
439 }
440
441 static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
442 size_t len, loff_t *ptr)
443 {
444 struct ffs_data *ffs = file->private_data;
445 char *data = NULL;
446 size_t n;
447 int ret;
448
449 ENTER();
450
451 /* Fast check if setup was canceled */
452 if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
453 return -EIDRM;
454
455 /* Acquire mutex */
456 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
457 if (unlikely(ret < 0))
458 return ret;
459
460 /* Check state */
461 if (ffs->state != FFS_ACTIVE) {
462 ret = -EBADFD;
463 goto done_mutex;
464 }
465
466 /*
467 * We're called from user space, we can use _irq rather then
468 * _irqsave
469 */
470 spin_lock_irq(&ffs->ev.waitq.lock);
471
472 switch (ffs_setup_state_clear_cancelled(ffs)) {
473 case FFS_SETUP_CANCELLED:
474 ret = -EIDRM;
475 break;
476
477 case FFS_NO_SETUP:
478 n = len / sizeof(struct usb_functionfs_event);
479 if (unlikely(!n)) {
480 ret = -EINVAL;
481 break;
482 }
483
484 if ((file->f_flags & O_NONBLOCK) && !ffs->ev.count) {
485 ret = -EAGAIN;
486 break;
487 }
488
489 if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq,
490 ffs->ev.count)) {
491 ret = -EINTR;
492 break;
493 }
494
495 return __ffs_ep0_read_events(ffs, buf,
496 min(n, (size_t)ffs->ev.count));
497
498 case FFS_SETUP_PENDING:
499 if (ffs->ev.setup.bRequestType & USB_DIR_IN) {
500 spin_unlock_irq(&ffs->ev.waitq.lock);
501 ret = __ffs_ep0_stall(ffs);
502 goto done_mutex;
503 }
504
505 len = min(len, (size_t)le16_to_cpu(ffs->ev.setup.wLength));
506
507 spin_unlock_irq(&ffs->ev.waitq.lock);
508
509 if (likely(len)) {
510 data = kmalloc(len, GFP_KERNEL);
511 if (unlikely(!data)) {
512 ret = -ENOMEM;
513 goto done_mutex;
514 }
515 }
516
517 spin_lock_irq(&ffs->ev.waitq.lock);
518
519 /* See ffs_ep0_write() */
520 if (ffs_setup_state_clear_cancelled(ffs) ==
521 FFS_SETUP_CANCELLED) {
522 ret = -EIDRM;
523 break;
524 }
525
526 /* unlocks spinlock */
527 ret = __ffs_ep0_queue_wait(ffs, data, len);
528 if (likely(ret > 0) && unlikely(copy_to_user(buf, data, len)))
529 ret = -EFAULT;
530 goto done_mutex;
531
532 default:
533 ret = -EBADFD;
534 break;
535 }
536
537 spin_unlock_irq(&ffs->ev.waitq.lock);
538 done_mutex:
539 mutex_unlock(&ffs->mutex);
540 kfree(data);
541 return ret;
542 }
543
544 static int ffs_ep0_open(struct inode *inode, struct file *file)
545 {
546 struct ffs_data *ffs = inode->i_private;
547
548 ENTER();
549
550 if (unlikely(ffs->state == FFS_CLOSING))
551 return -EBUSY;
552
553 file->private_data = ffs;
554 ffs_data_opened(ffs);
555
556 return 0;
557 }
558
559 static int ffs_ep0_release(struct inode *inode, struct file *file)
560 {
561 struct ffs_data *ffs = file->private_data;
562
563 ENTER();
564
565 ffs_data_closed(ffs);
566
567 return 0;
568 }
569
570 static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
571 {
572 struct ffs_data *ffs = file->private_data;
573 struct usb_gadget *gadget = ffs->gadget;
574 long ret;
575
576 ENTER();
577
578 if (code == FUNCTIONFS_INTERFACE_REVMAP) {
579 struct ffs_function *func = ffs->func;
580 ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV;
581 } else if (gadget && gadget->ops->ioctl) {
582 ret = gadget->ops->ioctl(gadget, code, value);
583 } else {
584 ret = -ENOTTY;
585 }
586
587 return ret;
588 }
589
590 static unsigned int ffs_ep0_poll(struct file *file, poll_table *wait)
591 {
592 struct ffs_data *ffs = file->private_data;
593 unsigned int mask = POLLWRNORM;
594 int ret;
595
596 poll_wait(file, &ffs->ev.waitq, wait);
597
598 ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
599 if (unlikely(ret < 0))
600 return mask;
601
602 switch (ffs->state) {
603 case FFS_READ_DESCRIPTORS:
604 case FFS_READ_STRINGS:
605 mask |= POLLOUT;
606 break;
607
608 case FFS_ACTIVE:
609 switch (ffs->setup_state) {
610 case FFS_NO_SETUP:
611 if (ffs->ev.count)
612 mask |= POLLIN;
613 break;
614
615 case FFS_SETUP_PENDING:
616 case FFS_SETUP_CANCELLED:
617 mask |= (POLLIN | POLLOUT);
618 break;
619 }
620 case FFS_CLOSING:
621 break;
622 case FFS_DEACTIVATED:
623 break;
624 }
625
626 mutex_unlock(&ffs->mutex);
627
628 return mask;
629 }
630
631 static const struct file_operations ffs_ep0_operations = {
632 .llseek = no_llseek,
633
634 .open = ffs_ep0_open,
635 .write = ffs_ep0_write,
636 .read = ffs_ep0_read,
637 .release = ffs_ep0_release,
638 .unlocked_ioctl = ffs_ep0_ioctl,
639 .poll = ffs_ep0_poll,
640 };
641
642
643 /* "Normal" endpoints operations ********************************************/
644
645 static void ffs_epfile_io_complete(struct usb_ep *_ep, struct usb_request *req)
646 {
647 ENTER();
648 if (likely(req->context)) {
649 struct ffs_ep *ep = _ep->driver_data;
650 ep->status = req->status ? req->status : req->actual;
651 complete(req->context);
652 }
653 }
654
655 static ssize_t ffs_copy_to_iter(void *data, int data_len, struct iov_iter *iter)
656 {
657 ssize_t ret = copy_to_iter(data, data_len, iter);
658 if (likely(ret == data_len))
659 return ret;
660
661 if (unlikely(iov_iter_count(iter)))
662 return -EFAULT;
663
664 /*
665 * Dear user space developer!
666 *
667 * TL;DR: To stop getting below error message in your kernel log, change
668 * user space code using functionfs to align read buffers to a max
669 * packet size.
670 *
671 * Some UDCs (e.g. dwc3) require request sizes to be a multiple of a max
672 * packet size. When unaligned buffer is passed to functionfs, it
673 * internally uses a larger, aligned buffer so that such UDCs are happy.
674 *
675 * Unfortunately, this means that host may send more data than was
676 * requested in read(2) system call. f_fs doesn’t know what to do with
677 * that excess data so it simply drops it.
678 *
679 * Was the buffer aligned in the first place, no such problem would
680 * happen.
681 *
682 * Data may be dropped only in AIO reads. Synchronous reads are handled
683 * by splitting a request into multiple parts. This splitting may still
684 * be a problem though so it’s likely best to align the buffer
685 * regardless of it being AIO or not..
686 *
687 * This only affects OUT endpoints, i.e. reading data with a read(2),
688 * aio_read(2) etc. system calls. Writing data to an IN endpoint is not
689 * affected.
690 */
691 pr_err("functionfs read size %d > requested size %zd, dropping excess data. "
692 "Align read buffer size to max packet size to avoid the problem.\n",
693 data_len, ret);
694
695 return ret;
696 }
697
698 static void ffs_user_copy_worker(struct work_struct *work)
699 {
700 struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,
701 work);
702 int ret = io_data->req->status ? io_data->req->status :
703 io_data->req->actual;
704 bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD;
705
706 if (io_data->read && ret > 0) {
707 use_mm(io_data->mm);
708 ret = ffs_copy_to_iter(io_data->buf, ret, &io_data->data);
709 unuse_mm(io_data->mm);
710 }
711
712 io_data->kiocb->ki_complete(io_data->kiocb, ret, ret);
713
714 if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd)
715 eventfd_signal(io_data->ffs->ffs_eventfd, 1);
716
717 usb_ep_free_request(io_data->ep, io_data->req);
718
719 if (io_data->read)
720 kfree(io_data->to_free);
721 kfree(io_data->buf);
722 kfree(io_data);
723 }
724
725 static void ffs_epfile_async_io_complete(struct usb_ep *_ep,
726 struct usb_request *req)
727 {
728 struct ffs_io_data *io_data = req->context;
729
730 ENTER();
731
732 INIT_WORK(&io_data->work, ffs_user_copy_worker);
733 schedule_work(&io_data->work);
734 }
735
736 /* Assumes epfile->mutex is held. */
737 static ssize_t __ffs_epfile_read_buffered(struct ffs_epfile *epfile,
738 struct iov_iter *iter)
739 {
740 struct ffs_buffer *buf = epfile->read_buffer;
741 ssize_t ret;
742 if (!buf)
743 return 0;
744
745 ret = copy_to_iter(buf->data, buf->length, iter);
746 if (buf->length == ret) {
747 kfree(buf);
748 epfile->read_buffer = NULL;
749 } else if (unlikely(iov_iter_count(iter))) {
750 ret = -EFAULT;
751 } else {
752 buf->length -= ret;
753 buf->data += ret;
754 }
755 return ret;
756 }
757
758 /* Assumes epfile->mutex is held. */
759 static ssize_t __ffs_epfile_read_data(struct ffs_epfile *epfile,
760 void *data, int data_len,
761 struct iov_iter *iter)
762 {
763 struct ffs_buffer *buf;
764
765 ssize_t ret = copy_to_iter(data, data_len, iter);
766 if (likely(data_len == ret))
767 return ret;
768
769 if (unlikely(iov_iter_count(iter)))
770 return -EFAULT;
771
772 /* See ffs_copy_to_iter for more context. */
773 pr_warn("functionfs read size %d > requested size %zd, splitting request into multiple reads.",
774 data_len, ret);
775
776 data_len -= ret;
777 buf = kmalloc(sizeof(*buf) + data_len, GFP_KERNEL);
778 if (!buf)
779 return -ENOMEM;
780 buf->length = data_len;
781 buf->data = buf->storage;
782 memcpy(buf->storage, data + ret, data_len);
783 epfile->read_buffer = buf;
784
785 return ret;
786 }
787
788 static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
789 {
790 struct ffs_epfile *epfile = file->private_data;
791 struct usb_request *req;
792 struct ffs_ep *ep;
793 char *data = NULL;
794 ssize_t ret, data_len = -EINVAL;
795 int halt;
796
797 /* Are we still active? */
798 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
799 return -ENODEV;
800
801 /* Wait for endpoint to be enabled */
802 ep = epfile->ep;
803 if (!ep) {
804 if (file->f_flags & O_NONBLOCK)
805 return -EAGAIN;
806
807 ret = wait_event_interruptible(epfile->wait, (ep = epfile->ep));
808 if (ret)
809 return -EINTR;
810 }
811
812 /* Do we halt? */
813 halt = (!io_data->read == !epfile->in);
814 if (halt && epfile->isoc)
815 return -EINVAL;
816
817 /* We will be using request and read_buffer */
818 ret = ffs_mutex_lock(&epfile->mutex, file->f_flags & O_NONBLOCK);
819 if (unlikely(ret))
820 goto error;
821
822 /* Allocate & copy */
823 if (!halt) {
824 struct usb_gadget *gadget;
825
826 /*
827 * Do we have buffered data from previous partial read? Check
828 * that for synchronous case only because we do not have
829 * facility to ‘wake up’ a pending asynchronous read and push
830 * buffered data to it which we would need to make things behave
831 * consistently.
832 */
833 if (!io_data->aio && io_data->read) {
834 ret = __ffs_epfile_read_buffered(epfile, &io_data->data);
835 if (ret)
836 goto error_mutex;
837 }
838
839 /*
840 * if we _do_ wait above, the epfile->ffs->gadget might be NULL
841 * before the waiting completes, so do not assign to 'gadget'
842 * earlier
843 */
844 gadget = epfile->ffs->gadget;
845
846 spin_lock_irq(&epfile->ffs->eps_lock);
847 /* In the meantime, endpoint got disabled or changed. */
848 if (epfile->ep != ep) {
849 ret = -ESHUTDOWN;
850 goto error_lock;
851 }
852 data_len = iov_iter_count(&io_data->data);
853 /*
854 * Controller may require buffer size to be aligned to
855 * maxpacketsize of an out endpoint.
856 */
857 if (io_data->read)
858 data_len = usb_ep_align_maybe(gadget, ep->ep, data_len);
859 spin_unlock_irq(&epfile->ffs->eps_lock);
860
861 data = kmalloc(data_len, GFP_KERNEL);
862 if (unlikely(!data)) {
863 ret = -ENOMEM;
864 goto error_mutex;
865 }
866 if (!io_data->read &&
867 copy_from_iter(data, data_len, &io_data->data) != data_len) {
868 ret = -EFAULT;
869 goto error_mutex;
870 }
871 }
872
873 spin_lock_irq(&epfile->ffs->eps_lock);
874
875 if (epfile->ep != ep) {
876 /* In the meantime, endpoint got disabled or changed. */
877 ret = -ESHUTDOWN;
878 } else if (halt) {
879 /* Halt */
880 if (likely(epfile->ep == ep) && !WARN_ON(!ep->ep))
881 usb_ep_set_halt(ep->ep);
882 ret = -EBADMSG;
883 } else if (unlikely(data_len == -EINVAL)) {
884 /*
885 * Sanity Check: even though data_len can't be used
886 * uninitialized at the time I write this comment, some
887 * compilers complain about this situation.
888 * In order to keep the code clean from warnings, data_len is
889 * being initialized to -EINVAL during its declaration, which
890 * means we can't rely on compiler anymore to warn no future
891 * changes won't result in data_len being used uninitialized.
892 * For such reason, we're adding this redundant sanity check
893 * here.
894 */
895 WARN(1, "%s: data_len == -EINVAL\n", __func__);
896 ret = -EINVAL;
897 } else if (!io_data->aio) {
898 DECLARE_COMPLETION_ONSTACK(done);
899 bool interrupted = false;
900
901 req = ep->req;
902 req->buf = data;
903 req->length = data_len;
904
905 req->context = &done;
906 req->complete = ffs_epfile_io_complete;
907
908 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
909 if (unlikely(ret < 0))
910 goto error_lock;
911
912 spin_unlock_irq(&epfile->ffs->eps_lock);
913
914 if (unlikely(wait_for_completion_interruptible(&done))) {
915 /*
916 * To avoid race condition with ffs_epfile_io_complete,
917 * dequeue the request first then check
918 * status. usb_ep_dequeue API should guarantee no race
919 * condition with req->complete callback.
920 */
921 usb_ep_dequeue(ep->ep, req);
922 interrupted = ep->status < 0;
923 }
924
925 if (interrupted)
926 ret = -EINTR;
927 else if (io_data->read && ep->status > 0)
928 ret = __ffs_epfile_read_data(epfile, data, ep->status,
929 &io_data->data);
930 else
931 ret = ep->status;
932 goto error_mutex;
933 } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_KERNEL))) {
934 ret = -ENOMEM;
935 } else {
936 req->buf = data;
937 req->length = data_len;
938
939 io_data->buf = data;
940 io_data->ep = ep->ep;
941 io_data->req = req;
942 io_data->ffs = epfile->ffs;
943
944 req->context = io_data;
945 req->complete = ffs_epfile_async_io_complete;
946
947 ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
948 if (unlikely(ret)) {
949 usb_ep_free_request(ep->ep, req);
950 goto error_lock;
951 }
952
953 ret = -EIOCBQUEUED;
954 /*
955 * Do not kfree the buffer in this function. It will be freed
956 * by ffs_user_copy_worker.
957 */
958 data = NULL;
959 }
960
961 error_lock:
962 spin_unlock_irq(&epfile->ffs->eps_lock);
963 error_mutex:
964 mutex_unlock(&epfile->mutex);
965 error:
966 kfree(data);
967 return ret;
968 }
969
970 static int
971 ffs_epfile_open(struct inode *inode, struct file *file)
972 {
973 struct ffs_epfile *epfile = inode->i_private;
974
975 ENTER();
976
977 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
978 return -ENODEV;
979
980 file->private_data = epfile;
981 ffs_data_opened(epfile->ffs);
982
983 return 0;
984 }
985
986 static int ffs_aio_cancel(struct kiocb *kiocb)
987 {
988 struct ffs_io_data *io_data = kiocb->private;
989 struct ffs_epfile *epfile = kiocb->ki_filp->private_data;
990 int value;
991
992 ENTER();
993
994 spin_lock_irq(&epfile->ffs->eps_lock);
995
996 if (likely(io_data && io_data->ep && io_data->req))
997 value = usb_ep_dequeue(io_data->ep, io_data->req);
998 else
999 value = -EINVAL;
1000
1001 spin_unlock_irq(&epfile->ffs->eps_lock);
1002
1003 return value;
1004 }
1005
1006 static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
1007 {
1008 struct ffs_io_data io_data, *p = &io_data;
1009 ssize_t res;
1010
1011 ENTER();
1012
1013 if (!is_sync_kiocb(kiocb)) {
1014 p = kmalloc(sizeof(io_data), GFP_KERNEL);
1015 if (unlikely(!p))
1016 return -ENOMEM;
1017 p->aio = true;
1018 } else {
1019 p->aio = false;
1020 }
1021
1022 p->read = false;
1023 p->kiocb = kiocb;
1024 p->data = *from;
1025 p->mm = current->mm;
1026
1027 kiocb->private = p;
1028
1029 if (p->aio)
1030 kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
1031
1032 res = ffs_epfile_io(kiocb->ki_filp, p);
1033 if (res == -EIOCBQUEUED)
1034 return res;
1035 if (p->aio)
1036 kfree(p);
1037 else
1038 *from = p->data;
1039 return res;
1040 }
1041
1042 static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
1043 {
1044 struct ffs_io_data io_data, *p = &io_data;
1045 ssize_t res;
1046
1047 ENTER();
1048
1049 if (!is_sync_kiocb(kiocb)) {
1050 p = kmalloc(sizeof(io_data), GFP_KERNEL);
1051 if (unlikely(!p))
1052 return -ENOMEM;
1053 p->aio = true;
1054 } else {
1055 p->aio = false;
1056 }
1057
1058 p->read = true;
1059 p->kiocb = kiocb;
1060 if (p->aio) {
1061 p->to_free = dup_iter(&p->data, to, GFP_KERNEL);
1062 if (!p->to_free) {
1063 kfree(p);
1064 return -ENOMEM;
1065 }
1066 } else {
1067 p->data = *to;
1068 p->to_free = NULL;
1069 }
1070 p->mm = current->mm;
1071
1072 kiocb->private = p;
1073
1074 if (p->aio)
1075 kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
1076
1077 res = ffs_epfile_io(kiocb->ki_filp, p);
1078 if (res == -EIOCBQUEUED)
1079 return res;
1080
1081 if (p->aio) {
1082 kfree(p->to_free);
1083 kfree(p);
1084 } else {
1085 *to = p->data;
1086 }
1087 return res;
1088 }
1089
1090 static int
1091 ffs_epfile_release(struct inode *inode, struct file *file)
1092 {
1093 struct ffs_epfile *epfile = inode->i_private;
1094
1095 ENTER();
1096
1097 kfree(epfile->read_buffer);
1098 epfile->read_buffer = NULL;
1099 ffs_data_closed(epfile->ffs);
1100
1101 return 0;
1102 }
1103
1104 static long ffs_epfile_ioctl(struct file *file, unsigned code,
1105 unsigned long value)
1106 {
1107 struct ffs_epfile *epfile = file->private_data;
1108 int ret;
1109
1110 ENTER();
1111
1112 if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
1113 return -ENODEV;
1114
1115 spin_lock_irq(&epfile->ffs->eps_lock);
1116 if (likely(epfile->ep)) {
1117 switch (code) {
1118 case FUNCTIONFS_FIFO_STATUS:
1119 ret = usb_ep_fifo_status(epfile->ep->ep);
1120 break;
1121 case FUNCTIONFS_FIFO_FLUSH:
1122 usb_ep_fifo_flush(epfile->ep->ep);
1123 ret = 0;
1124 break;
1125 case FUNCTIONFS_CLEAR_HALT:
1126 ret = usb_ep_clear_halt(epfile->ep->ep);
1127 break;
1128 case FUNCTIONFS_ENDPOINT_REVMAP:
1129 ret = epfile->ep->num;
1130 break;
1131 case FUNCTIONFS_ENDPOINT_DESC:
1132 {
1133 int desc_idx;
1134 struct usb_endpoint_descriptor *desc;
1135
1136 switch (epfile->ffs->gadget->speed) {
1137 case USB_SPEED_SUPER:
1138 desc_idx = 2;
1139 break;
1140 case USB_SPEED_HIGH:
1141 desc_idx = 1;
1142 break;
1143 default:
1144 desc_idx = 0;
1145 }
1146 desc = epfile->ep->descs[desc_idx];
1147
1148 spin_unlock_irq(&epfile->ffs->eps_lock);
1149 ret = copy_to_user((void *)value, desc, sizeof(*desc));
1150 if (ret)
1151 ret = -EFAULT;
1152 return ret;
1153 }
1154 default:
1155 ret = -ENOTTY;
1156 }
1157 } else {
1158 ret = -ENODEV;
1159 }
1160 spin_unlock_irq(&epfile->ffs->eps_lock);
1161
1162 return ret;
1163 }
1164
1165 static const struct file_operations ffs_epfile_operations = {
1166 .llseek = no_llseek,
1167
1168 .open = ffs_epfile_open,
1169 .write_iter = ffs_epfile_write_iter,
1170 .read_iter = ffs_epfile_read_iter,
1171 .release = ffs_epfile_release,
1172 .unlocked_ioctl = ffs_epfile_ioctl,
1173 };
1174
1175
1176 /* File system and super block operations ***********************************/
1177
1178 /*
1179 * Mounting the file system creates a controller file, used first for
1180 * function configuration then later for event monitoring.
1181 */
1182
1183 static struct inode *__must_check
1184 ffs_sb_make_inode(struct super_block *sb, void *data,
1185 const struct file_operations *fops,
1186 const struct inode_operations *iops,
1187 struct ffs_file_perms *perms)
1188 {
1189 struct inode *inode;
1190
1191 ENTER();
1192
1193 inode = new_inode(sb);
1194
1195 if (likely(inode)) {
1196 struct timespec current_time = CURRENT_TIME;
1197
1198 inode->i_ino = get_next_ino();
1199 inode->i_mode = perms->mode;
1200 inode->i_uid = perms->uid;
1201 inode->i_gid = perms->gid;
1202 inode->i_atime = current_time;
1203 inode->i_mtime = current_time;
1204 inode->i_ctime = current_time;
1205 inode->i_private = data;
1206 if (fops)
1207 inode->i_fop = fops;
1208 if (iops)
1209 inode->i_op = iops;
1210 }
1211
1212 return inode;
1213 }
1214
1215 /* Create "regular" file */
1216 static struct dentry *ffs_sb_create_file(struct super_block *sb,
1217 const char *name, void *data,
1218 const struct file_operations *fops)
1219 {
1220 struct ffs_data *ffs = sb->s_fs_info;
1221 struct dentry *dentry;
1222 struct inode *inode;
1223
1224 ENTER();
1225
1226 dentry = d_alloc_name(sb->s_root, name);
1227 if (unlikely(!dentry))
1228 return NULL;
1229
1230 inode = ffs_sb_make_inode(sb, data, fops, NULL, &ffs->file_perms);
1231 if (unlikely(!inode)) {
1232 dput(dentry);
1233 return NULL;
1234 }
1235
1236 d_add(dentry, inode);
1237 return dentry;
1238 }
1239
1240 /* Super block */
1241 static const struct super_operations ffs_sb_operations = {
1242 .statfs = simple_statfs,
1243 .drop_inode = generic_delete_inode,
1244 };
1245
1246 struct ffs_sb_fill_data {
1247 struct ffs_file_perms perms;
1248 umode_t root_mode;
1249 const char *dev_name;
1250 bool no_disconnect;
1251 struct ffs_data *ffs_data;
1252 };
1253
1254 static int ffs_sb_fill(struct super_block *sb, void *_data, int silent)
1255 {
1256 struct ffs_sb_fill_data *data = _data;
1257 struct inode *inode;
1258 struct ffs_data *ffs = data->ffs_data;
1259
1260 ENTER();
1261
1262 ffs->sb = sb;
1263 data->ffs_data = NULL;
1264 sb->s_fs_info = ffs;
1265 sb->s_blocksize = PAGE_SIZE;
1266 sb->s_blocksize_bits = PAGE_SHIFT;
1267 sb->s_magic = FUNCTIONFS_MAGIC;
1268 sb->s_op = &ffs_sb_operations;
1269 sb->s_time_gran = 1;
1270
1271 /* Root inode */
1272 data->perms.mode = data->root_mode;
1273 inode = ffs_sb_make_inode(sb, NULL,
1274 &simple_dir_operations,
1275 &simple_dir_inode_operations,
1276 &data->perms);
1277 sb->s_root = d_make_root(inode);
1278 if (unlikely(!sb->s_root))
1279 return -ENOMEM;
1280
1281 /* EP0 file */
1282 if (unlikely(!ffs_sb_create_file(sb, "ep0", ffs,
1283 &ffs_ep0_operations)))
1284 return -ENOMEM;
1285
1286 return 0;
1287 }
1288
1289 static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
1290 {
1291 ENTER();
1292
1293 if (!opts || !*opts)
1294 return 0;
1295
1296 for (;;) {
1297 unsigned long value;
1298 char *eq, *comma;
1299
1300 /* Option limit */
1301 comma = strchr(opts, ',');
1302 if (comma)
1303 *comma = 0;
1304
1305 /* Value limit */
1306 eq = strchr(opts, '=');
1307 if (unlikely(!eq)) {
1308 pr_err("'=' missing in %s\n", opts);
1309 return -EINVAL;
1310 }
1311 *eq = 0;
1312
1313 /* Parse value */
1314 if (kstrtoul(eq + 1, 0, &value)) {
1315 pr_err("%s: invalid value: %s\n", opts, eq + 1);
1316 return -EINVAL;
1317 }
1318
1319 /* Interpret option */
1320 switch (eq - opts) {
1321 case 13:
1322 if (!memcmp(opts, "no_disconnect", 13))
1323 data->no_disconnect = !!value;
1324 else
1325 goto invalid;
1326 break;
1327 case 5:
1328 if (!memcmp(opts, "rmode", 5))
1329 data->root_mode = (value & 0555) | S_IFDIR;
1330 else if (!memcmp(opts, "fmode", 5))
1331 data->perms.mode = (value & 0666) | S_IFREG;
1332 else
1333 goto invalid;
1334 break;
1335
1336 case 4:
1337 if (!memcmp(opts, "mode", 4)) {
1338 data->root_mode = (value & 0555) | S_IFDIR;
1339 data->perms.mode = (value & 0666) | S_IFREG;
1340 } else {
1341 goto invalid;
1342 }
1343 break;
1344
1345 case 3:
1346 if (!memcmp(opts, "uid", 3)) {
1347 data->perms.uid = make_kuid(current_user_ns(), value);
1348 if (!uid_valid(data->perms.uid)) {
1349 pr_err("%s: unmapped value: %lu\n", opts, value);
1350 return -EINVAL;
1351 }
1352 } else if (!memcmp(opts, "gid", 3)) {
1353 data->perms.gid = make_kgid(current_user_ns(), value);
1354 if (!gid_valid(data->perms.gid)) {
1355 pr_err("%s: unmapped value: %lu\n", opts, value);
1356 return -EINVAL;
1357 }
1358 } else {
1359 goto invalid;
1360 }
1361 break;
1362
1363 default:
1364 invalid:
1365 pr_err("%s: invalid option\n", opts);
1366 return -EINVAL;
1367 }
1368
1369 /* Next iteration */
1370 if (!comma)
1371 break;
1372 opts = comma + 1;
1373 }
1374
1375 return 0;
1376 }
1377
1378 /* "mount -t functionfs dev_name /dev/function" ends up here */
1379
1380 static struct dentry *
1381 ffs_fs_mount(struct file_system_type *t, int flags,
1382 const char *dev_name, void *opts)
1383 {
1384 struct ffs_sb_fill_data data = {
1385 .perms = {
1386 .mode = S_IFREG | 0600,
1387 .uid = GLOBAL_ROOT_UID,
1388 .gid = GLOBAL_ROOT_GID,
1389 },
1390 .root_mode = S_IFDIR | 0500,
1391 .no_disconnect = false,
1392 };
1393 struct dentry *rv;
1394 int ret;
1395 void *ffs_dev;
1396 struct ffs_data *ffs;
1397
1398 ENTER();
1399
1400 ret = ffs_fs_parse_opts(&data, opts);
1401 if (unlikely(ret < 0))
1402 return ERR_PTR(ret);
1403
1404 ffs = ffs_data_new();
1405 if (unlikely(!ffs))
1406 return ERR_PTR(-ENOMEM);
1407 ffs->file_perms = data.perms;
1408 ffs->no_disconnect = data.no_disconnect;
1409
1410 ffs->dev_name = kstrdup(dev_name, GFP_KERNEL);
1411 if (unlikely(!ffs->dev_name)) {
1412 ffs_data_put(ffs);
1413 return ERR_PTR(-ENOMEM);
1414 }
1415
1416 ffs_dev = ffs_acquire_dev(dev_name);
1417 if (IS_ERR(ffs_dev)) {
1418 ffs_data_put(ffs);
1419 return ERR_CAST(ffs_dev);
1420 }
1421 ffs->private_data = ffs_dev;
1422 data.ffs_data = ffs;
1423
1424 rv = mount_nodev(t, flags, &data, ffs_sb_fill);
1425 if (IS_ERR(rv) && data.ffs_data) {
1426 ffs_release_dev(data.ffs_data);
1427 ffs_data_put(data.ffs_data);
1428 }
1429 return rv;
1430 }
1431
1432 static void
1433 ffs_fs_kill_sb(struct super_block *sb)
1434 {
1435 ENTER();
1436
1437 kill_litter_super(sb);
1438 if (sb->s_fs_info) {
1439 ffs_release_dev(sb->s_fs_info);
1440 ffs_data_closed(sb->s_fs_info);
1441 ffs_data_put(sb->s_fs_info);
1442 }
1443 }
1444
1445 static struct file_system_type ffs_fs_type = {
1446 .owner = THIS_MODULE,
1447 .name = "functionfs",
1448 .mount = ffs_fs_mount,
1449 .kill_sb = ffs_fs_kill_sb,
1450 };
1451 MODULE_ALIAS_FS("functionfs");
1452
1453
1454 /* Driver's main init/cleanup functions *************************************/
1455
1456 static int functionfs_init(void)
1457 {
1458 int ret;
1459
1460 ENTER();
1461
1462 ret = register_filesystem(&ffs_fs_type);
1463 if (likely(!ret))
1464 pr_info("file system registered\n");
1465 else
1466 pr_err("failed registering file system (%d)\n", ret);
1467
1468 return ret;
1469 }
1470
1471 static void functionfs_cleanup(void)
1472 {
1473 ENTER();
1474
1475 pr_info("unloading\n");
1476 unregister_filesystem(&ffs_fs_type);
1477 }
1478
1479
1480 /* ffs_data and ffs_function construction and destruction code **************/
1481
1482 static void ffs_data_clear(struct ffs_data *ffs);
1483 static void ffs_data_reset(struct ffs_data *ffs);
1484
1485 static void ffs_data_get(struct ffs_data *ffs)
1486 {
1487 ENTER();
1488
1489 atomic_inc(&ffs->ref);
1490 }
1491
1492 static void ffs_data_opened(struct ffs_data *ffs)
1493 {
1494 ENTER();
1495
1496 atomic_inc(&ffs->ref);
1497 if (atomic_add_return(1, &ffs->opened) == 1 &&
1498 ffs->state == FFS_DEACTIVATED) {
1499 ffs->state = FFS_CLOSING;
1500 ffs_data_reset(ffs);
1501 }
1502 }
1503
1504 static void ffs_data_put(struct ffs_data *ffs)
1505 {
1506 ENTER();
1507
1508 if (unlikely(atomic_dec_and_test(&ffs->ref))) {
1509 pr_info("%s(): freeing\n", __func__);
1510 ffs_data_clear(ffs);
1511 BUG_ON(waitqueue_active(&ffs->ev.waitq) ||
1512 waitqueue_active(&ffs->ep0req_completion.wait));
1513 kfree(ffs->dev_name);
1514 kfree(ffs);
1515 }
1516 }
1517
1518 static void ffs_data_closed(struct ffs_data *ffs)
1519 {
1520 ENTER();
1521
1522 if (atomic_dec_and_test(&ffs->opened)) {
1523 if (ffs->no_disconnect) {
1524 ffs->state = FFS_DEACTIVATED;
1525 if (ffs->epfiles) {
1526 ffs_epfiles_destroy(ffs->epfiles,
1527 ffs->eps_count);
1528 ffs->epfiles = NULL;
1529 }
1530 if (ffs->setup_state == FFS_SETUP_PENDING)
1531 __ffs_ep0_stall(ffs);
1532 } else {
1533 ffs->state = FFS_CLOSING;
1534 ffs_data_reset(ffs);
1535 }
1536 }
1537 if (atomic_read(&ffs->opened) < 0) {
1538 ffs->state = FFS_CLOSING;
1539 ffs_data_reset(ffs);
1540 }
1541
1542 ffs_data_put(ffs);
1543 }
1544
1545 static struct ffs_data *ffs_data_new(void)
1546 {
1547 struct ffs_data *ffs = kzalloc(sizeof *ffs, GFP_KERNEL);
1548 if (unlikely(!ffs))
1549 return NULL;
1550
1551 ENTER();
1552
1553 atomic_set(&ffs->ref, 1);
1554 atomic_set(&ffs->opened, 0);
1555 ffs->state = FFS_READ_DESCRIPTORS;
1556 mutex_init(&ffs->mutex);
1557 spin_lock_init(&ffs->eps_lock);
1558 init_waitqueue_head(&ffs->ev.waitq);
1559 init_completion(&ffs->ep0req_completion);
1560
1561 /* XXX REVISIT need to update it in some places, or do we? */
1562 ffs->ev.can_stall = 1;
1563
1564 return ffs;
1565 }
1566
1567 static void ffs_data_clear(struct ffs_data *ffs)
1568 {
1569 ENTER();
1570
1571 ffs_closed(ffs);
1572
1573 BUG_ON(ffs->gadget);
1574
1575 if (ffs->epfiles)
1576 ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count);
1577
1578 if (ffs->ffs_eventfd)
1579 eventfd_ctx_put(ffs->ffs_eventfd);
1580
1581 kfree(ffs->raw_descs_data);
1582 kfree(ffs->raw_strings);
1583 kfree(ffs->stringtabs);
1584 }
1585
1586 static void ffs_data_reset(struct ffs_data *ffs)
1587 {
1588 ENTER();
1589
1590 ffs_data_clear(ffs);
1591
1592 ffs->epfiles = NULL;
1593 ffs->raw_descs_data = NULL;
1594 ffs->raw_descs = NULL;
1595 ffs->raw_strings = NULL;
1596 ffs->stringtabs = NULL;
1597
1598 ffs->raw_descs_length = 0;
1599 ffs->fs_descs_count = 0;
1600 ffs->hs_descs_count = 0;
1601 ffs->ss_descs_count = 0;
1602
1603 ffs->strings_count = 0;
1604 ffs->interfaces_count = 0;
1605 ffs->eps_count = 0;
1606
1607 ffs->ev.count = 0;
1608
1609 ffs->state = FFS_READ_DESCRIPTORS;
1610 ffs->setup_state = FFS_NO_SETUP;
1611 ffs->flags = 0;
1612 }
1613
1614
1615 static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
1616 {
1617 struct usb_gadget_strings **lang;
1618 int first_id;
1619
1620 ENTER();
1621
1622 if (WARN_ON(ffs->state != FFS_ACTIVE
1623 || test_and_set_bit(FFS_FL_BOUND, &ffs->flags)))
1624 return -EBADFD;
1625
1626 first_id = usb_string_ids_n(cdev, ffs->strings_count);
1627 if (unlikely(first_id < 0))
1628 return first_id;
1629
1630 ffs->ep0req = usb_ep_alloc_request(cdev->gadget->ep0, GFP_KERNEL);
1631 if (unlikely(!ffs->ep0req))
1632 return -ENOMEM;
1633 ffs->ep0req->complete = ffs_ep0_complete;
1634 ffs->ep0req->context = ffs;
1635
1636 lang = ffs->stringtabs;
1637 if (lang) {
1638 for (; *lang; ++lang) {
1639 struct usb_string *str = (*lang)->strings;
1640 int id = first_id;
1641 for (; str->s; ++id, ++str)
1642 str->id = id;
1643 }
1644 }
1645
1646 ffs->gadget = cdev->gadget;
1647 ffs_data_get(ffs);
1648 return 0;
1649 }
1650
1651 static void functionfs_unbind(struct ffs_data *ffs)
1652 {
1653 ENTER();
1654
1655 if (!WARN_ON(!ffs->gadget)) {
1656 usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req);
1657 ffs->ep0req = NULL;
1658 ffs->gadget = NULL;
1659 clear_bit(FFS_FL_BOUND, &ffs->flags);
1660 ffs_data_put(ffs);
1661 }
1662 }
1663
1664 static int ffs_epfiles_create(struct ffs_data *ffs)
1665 {
1666 struct ffs_epfile *epfile, *epfiles;
1667 unsigned i, count;
1668
1669 ENTER();
1670
1671 count = ffs->eps_count;
1672 epfiles = kcalloc(count, sizeof(*epfiles), GFP_KERNEL);
1673 if (!epfiles)
1674 return -ENOMEM;
1675
1676 epfile = epfiles;
1677 for (i = 1; i <= count; ++i, ++epfile) {
1678 epfile->ffs = ffs;
1679 mutex_init(&epfile->mutex);
1680 init_waitqueue_head(&epfile->wait);
1681 if (ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
1682 sprintf(epfile->name, "ep%02x", ffs->eps_addrmap[i]);
1683 else
1684 sprintf(epfile->name, "ep%u", i);
1685 epfile->dentry = ffs_sb_create_file(ffs->sb, epfile->name,
1686 epfile,
1687 &ffs_epfile_operations);
1688 if (unlikely(!epfile->dentry)) {
1689 ffs_epfiles_destroy(epfiles, i - 1);
1690 return -ENOMEM;
1691 }
1692 }
1693
1694 ffs->epfiles = epfiles;
1695 return 0;
1696 }
1697
1698 static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count)
1699 {
1700 struct ffs_epfile *epfile = epfiles;
1701
1702 ENTER();
1703
1704 for (; count; --count, ++epfile) {
1705 BUG_ON(mutex_is_locked(&epfile->mutex) ||
1706 waitqueue_active(&epfile->wait));
1707 if (epfile->dentry) {
1708 d_delete(epfile->dentry);
1709 dput(epfile->dentry);
1710 epfile->dentry = NULL;
1711 }
1712 }
1713
1714 kfree(epfiles);
1715 }
1716
1717 static void ffs_func_eps_disable(struct ffs_function *func)
1718 {
1719 struct ffs_ep *ep = func->eps;
1720 struct ffs_epfile *epfile = func->ffs->epfiles;
1721 unsigned count = func->ffs->eps_count;
1722 unsigned long flags;
1723
1724 do {
1725 if (epfile)
1726 mutex_lock(&epfile->mutex);
1727 spin_lock_irqsave(&func->ffs->eps_lock, flags);
1728 /* pending requests get nuked */
1729 if (likely(ep->ep))
1730 usb_ep_disable(ep->ep);
1731 ++ep;
1732 spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
1733
1734 if (epfile) {
1735 epfile->ep = NULL;
1736 kfree(epfile->read_buffer);
1737 epfile->read_buffer = NULL;
1738 mutex_unlock(&epfile->mutex);
1739 ++epfile;
1740 }
1741 } while (--count);
1742 }
1743
1744 static int ffs_func_eps_enable(struct ffs_function *func)
1745 {
1746 struct ffs_data *ffs = func->ffs;
1747 struct ffs_ep *ep = func->eps;
1748 struct ffs_epfile *epfile = ffs->epfiles;
1749 unsigned count = ffs->eps_count;
1750 unsigned long flags;
1751 int ret = 0;
1752
1753 spin_lock_irqsave(&func->ffs->eps_lock, flags);
1754 do {
1755 struct usb_endpoint_descriptor *ds;
1756 int desc_idx;
1757
1758 if (ffs->gadget->speed == USB_SPEED_SUPER)
1759 desc_idx = 2;
1760 else if (ffs->gadget->speed == USB_SPEED_HIGH)
1761 desc_idx = 1;
1762 else
1763 desc_idx = 0;
1764
1765 /* fall-back to lower speed if desc missing for current speed */
1766 do {
1767 ds = ep->descs[desc_idx];
1768 } while (!ds && --desc_idx >= 0);
1769
1770 if (!ds) {
1771 ret = -EINVAL;
1772 break;
1773 }
1774
1775 ep->ep->driver_data = ep;
1776 ep->ep->desc = ds;
1777 ret = usb_ep_enable(ep->ep);
1778 if (likely(!ret)) {
1779 epfile->ep = ep;
1780 epfile->in = usb_endpoint_dir_in(ds);
1781 epfile->isoc = usb_endpoint_xfer_isoc(ds);
1782 } else {
1783 break;
1784 }
1785
1786 wake_up(&epfile->wait);
1787
1788 ++ep;
1789 ++epfile;
1790 } while (--count);
1791 spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
1792
1793 return ret;
1794 }
1795
1796
1797 /* Parsing and building descriptors and strings *****************************/
1798
1799 /*
1800 * This validates if data pointed by data is a valid USB descriptor as
1801 * well as record how many interfaces, endpoints and strings are
1802 * required by given configuration. Returns address after the
1803 * descriptor or NULL if data is invalid.
1804 */
1805
1806 enum ffs_entity_type {
1807 FFS_DESCRIPTOR, FFS_INTERFACE, FFS_STRING, FFS_ENDPOINT
1808 };
1809
1810 enum ffs_os_desc_type {
1811 FFS_OS_DESC, FFS_OS_DESC_EXT_COMPAT, FFS_OS_DESC_EXT_PROP
1812 };
1813
1814 typedef int (*ffs_entity_callback)(enum ffs_entity_type entity,
1815 u8 *valuep,
1816 struct usb_descriptor_header *desc,
1817 void *priv);
1818
1819 typedef int (*ffs_os_desc_callback)(enum ffs_os_desc_type entity,
1820 struct usb_os_desc_header *h, void *data,
1821 unsigned len, void *priv);
1822
1823 static int __must_check ffs_do_single_desc(char *data, unsigned len,
1824 ffs_entity_callback entity,
1825 void *priv)
1826 {
1827 struct usb_descriptor_header *_ds = (void *)data;
1828 u8 length;
1829 int ret;
1830
1831 ENTER();
1832
1833 /* At least two bytes are required: length and type */
1834 if (len < 2) {
1835 pr_vdebug("descriptor too short\n");
1836 return -EINVAL;
1837 }
1838
1839 /* If we have at least as many bytes as the descriptor takes? */
1840 length = _ds->bLength;
1841 if (len < length) {
1842 pr_vdebug("descriptor longer then available data\n");
1843 return -EINVAL;
1844 }
1845
1846 #define __entity_check_INTERFACE(val) 1
1847 #define __entity_check_STRING(val) (val)
1848 #define __entity_check_ENDPOINT(val) ((val) & USB_ENDPOINT_NUMBER_MASK)
1849 #define __entity(type, val) do { \
1850 pr_vdebug("entity " #type "(%02x)\n", (val)); \
1851 if (unlikely(!__entity_check_ ##type(val))) { \
1852 pr_vdebug("invalid entity's value\n"); \
1853 return -EINVAL; \
1854 } \
1855 ret = entity(FFS_ ##type, &val, _ds, priv); \
1856 if (unlikely(ret < 0)) { \
1857 pr_debug("entity " #type "(%02x); ret = %d\n", \
1858 (val), ret); \
1859 return ret; \
1860 } \
1861 } while (0)
1862
1863 /* Parse descriptor depending on type. */
1864 switch (_ds->bDescriptorType) {
1865 case USB_DT_DEVICE:
1866 case USB_DT_CONFIG:
1867 case USB_DT_STRING:
1868 case USB_DT_DEVICE_QUALIFIER:
1869 /* function can't have any of those */
1870 pr_vdebug("descriptor reserved for gadget: %d\n",
1871 _ds->bDescriptorType);
1872 return -EINVAL;
1873
1874 case USB_DT_INTERFACE: {
1875 struct usb_interface_descriptor *ds = (void *)_ds;
1876 pr_vdebug("interface descriptor\n");
1877 if (length != sizeof *ds)
1878 goto inv_length;
1879
1880 __entity(INTERFACE, ds->bInterfaceNumber);
1881 if (ds->iInterface)
1882 __entity(STRING, ds->iInterface);
1883 }
1884 break;
1885
1886 case USB_DT_ENDPOINT: {
1887 struct usb_endpoint_descriptor *ds = (void *)_ds;
1888 pr_vdebug("endpoint descriptor\n");
1889 if (length != USB_DT_ENDPOINT_SIZE &&
1890 length != USB_DT_ENDPOINT_AUDIO_SIZE)
1891 goto inv_length;
1892 __entity(ENDPOINT, ds->bEndpointAddress);
1893 }
1894 break;
1895
1896 case HID_DT_HID:
1897 pr_vdebug("hid descriptor\n");
1898 if (length != sizeof(struct hid_descriptor))
1899 goto inv_length;
1900 break;
1901
1902 case USB_DT_OTG:
1903 if (length != sizeof(struct usb_otg_descriptor))
1904 goto inv_length;
1905 break;
1906
1907 case USB_DT_INTERFACE_ASSOCIATION: {
1908 struct usb_interface_assoc_descriptor *ds = (void *)_ds;
1909 pr_vdebug("interface association descriptor\n");
1910 if (length != sizeof *ds)
1911 goto inv_length;
1912 if (ds->iFunction)
1913 __entity(STRING, ds->iFunction);
1914 }
1915 break;
1916
1917 case USB_DT_SS_ENDPOINT_COMP:
1918 pr_vdebug("EP SS companion descriptor\n");
1919 if (length != sizeof(struct usb_ss_ep_comp_descriptor))
1920 goto inv_length;
1921 break;
1922
1923 case USB_DT_OTHER_SPEED_CONFIG:
1924 case USB_DT_INTERFACE_POWER:
1925 case USB_DT_DEBUG:
1926 case USB_DT_SECURITY:
1927 case USB_DT_CS_RADIO_CONTROL:
1928 /* TODO */
1929 pr_vdebug("unimplemented descriptor: %d\n", _ds->bDescriptorType);
1930 return -EINVAL;
1931
1932 default:
1933 /* We should never be here */
1934 pr_vdebug("unknown descriptor: %d\n", _ds->bDescriptorType);
1935 return -EINVAL;
1936
1937 inv_length:
1938 pr_vdebug("invalid length: %d (descriptor %d)\n",
1939 _ds->bLength, _ds->bDescriptorType);
1940 return -EINVAL;
1941 }
1942
1943 #undef __entity
1944 #undef __entity_check_DESCRIPTOR
1945 #undef __entity_check_INTERFACE
1946 #undef __entity_check_STRING
1947 #undef __entity_check_ENDPOINT
1948
1949 return length;
1950 }
1951
1952 static int __must_check ffs_do_descs(unsigned count, char *data, unsigned len,
1953 ffs_entity_callback entity, void *priv)
1954 {
1955 const unsigned _len = len;
1956 unsigned long num = 0;
1957
1958 ENTER();
1959
1960 for (;;) {
1961 int ret;
1962
1963 if (num == count)
1964 data = NULL;
1965
1966 /* Record "descriptor" entity */
1967 ret = entity(FFS_DESCRIPTOR, (u8 *)num, (void *)data, priv);
1968 if (unlikely(ret < 0)) {
1969 pr_debug("entity DESCRIPTOR(%02lx); ret = %d\n",
1970 num, ret);
1971 return ret;
1972 }
1973
1974 if (!data)
1975 return _len - len;
1976
1977 ret = ffs_do_single_desc(data, len, entity, priv);
1978 if (unlikely(ret < 0)) {
1979 pr_debug("%s returns %d\n", __func__, ret);
1980 return ret;
1981 }
1982
1983 len -= ret;
1984 data += ret;
1985 ++num;
1986 }
1987 }
1988
1989 static int __ffs_data_do_entity(enum ffs_entity_type type,
1990 u8 *valuep, struct usb_descriptor_header *desc,
1991 void *priv)
1992 {
1993 struct ffs_desc_helper *helper = priv;
1994 struct usb_endpoint_descriptor *d;
1995
1996 ENTER();
1997
1998 switch (type) {
1999 case FFS_DESCRIPTOR:
2000 break;
2001
2002 case FFS_INTERFACE:
2003 /*
2004 * Interfaces are indexed from zero so if we
2005 * encountered interface "n" then there are at least
2006 * "n+1" interfaces.
2007 */
2008 if (*valuep >= helper->interfaces_count)
2009 helper->interfaces_count = *valuep + 1;
2010 break;
2011
2012 case FFS_STRING:
2013 /*
2014 * Strings are indexed from 1 (0 is magic ;) reserved
2015 * for languages list or some such)
2016 */
2017 if (*valuep > helper->ffs->strings_count)
2018 helper->ffs->strings_count = *valuep;
2019 break;
2020
2021 case FFS_ENDPOINT:
2022 d = (void *)desc;
2023 helper->eps_count++;
2024 if (helper->eps_count >= 15)
2025 return -EINVAL;
2026 /* Check if descriptors for any speed were already parsed */
2027 if (!helper->ffs->eps_count && !helper->ffs->interfaces_count)
2028 helper->ffs->eps_addrmap[helper->eps_count] =
2029 d->bEndpointAddress;
2030 else if (helper->ffs->eps_addrmap[helper->eps_count] !=
2031 d->bEndpointAddress)
2032 return -EINVAL;
2033 break;
2034 }
2035
2036 return 0;
2037 }
2038
2039 static int __ffs_do_os_desc_header(enum ffs_os_desc_type *next_type,
2040 struct usb_os_desc_header *desc)
2041 {
2042 u16 bcd_version = le16_to_cpu(desc->bcdVersion);
2043 u16 w_index = le16_to_cpu(desc->wIndex);
2044
2045 if (bcd_version != 1) {
2046 pr_vdebug("unsupported os descriptors version: %d",
2047 bcd_version);
2048 return -EINVAL;
2049 }
2050 switch (w_index) {
2051 case 0x4:
2052 *next_type = FFS_OS_DESC_EXT_COMPAT;
2053 break;
2054 case 0x5:
2055 *next_type = FFS_OS_DESC_EXT_PROP;
2056 break;
2057 default:
2058 pr_vdebug("unsupported os descriptor type: %d", w_index);
2059 return -EINVAL;
2060 }
2061
2062 return sizeof(*desc);
2063 }
2064
2065 /*
2066 * Process all extended compatibility/extended property descriptors
2067 * of a feature descriptor
2068 */
2069 static int __must_check ffs_do_single_os_desc(char *data, unsigned len,
2070 enum ffs_os_desc_type type,
2071 u16 feature_count,
2072 ffs_os_desc_callback entity,
2073 void *priv,
2074 struct usb_os_desc_header *h)
2075 {
2076 int ret;
2077 const unsigned _len = len;
2078
2079 ENTER();
2080
2081 /* loop over all ext compat/ext prop descriptors */
2082 while (feature_count--) {
2083 ret = entity(type, h, data, len, priv);
2084 if (unlikely(ret < 0)) {
2085 pr_debug("bad OS descriptor, type: %d\n", type);
2086 return ret;
2087 }
2088 data += ret;
2089 len -= ret;
2090 }
2091 return _len - len;
2092 }
2093
2094 /* Process a number of complete Feature Descriptors (Ext Compat or Ext Prop) */
2095 static int __must_check ffs_do_os_descs(unsigned count,
2096 char *data, unsigned len,
2097 ffs_os_desc_callback entity, void *priv)
2098 {
2099 const unsigned _len = len;
2100 unsigned long num = 0;
2101
2102 ENTER();
2103
2104 for (num = 0; num < count; ++num) {
2105 int ret;
2106 enum ffs_os_desc_type type;
2107 u16 feature_count;
2108 struct usb_os_desc_header *desc = (void *)data;
2109
2110 if (len < sizeof(*desc))
2111 return -EINVAL;
2112
2113 /*
2114 * Record "descriptor" entity.
2115 * Process dwLength, bcdVersion, wIndex, get b/wCount.
2116 * Move the data pointer to the beginning of extended
2117 * compatibilities proper or extended properties proper
2118 * portions of the data
2119 */
2120 if (le32_to_cpu(desc->dwLength) > len)
2121 return -EINVAL;
2122
2123 ret = __ffs_do_os_desc_header(&type, desc);
2124 if (unlikely(ret < 0)) {
2125 pr_debug("entity OS_DESCRIPTOR(%02lx); ret = %d\n",
2126 num, ret);
2127 return ret;
2128 }
2129 /*
2130 * 16-bit hex "?? 00" Little Endian looks like 8-bit hex "??"
2131 */
2132 feature_count = le16_to_cpu(desc->wCount);
2133 if (type == FFS_OS_DESC_EXT_COMPAT &&
2134 (feature_count > 255 || desc->Reserved))
2135 return -EINVAL;
2136 len -= ret;
2137 data += ret;
2138
2139 /*
2140 * Process all function/property descriptors
2141 * of this Feature Descriptor
2142 */
2143 ret = ffs_do_single_os_desc(data, len, type,
2144 feature_count, entity, priv, desc);
2145 if (unlikely(ret < 0)) {
2146 pr_debug("%s returns %d\n", __func__, ret);
2147 return ret;
2148 }
2149
2150 len -= ret;
2151 data += ret;
2152 }
2153 return _len - len;
2154 }
2155
2156 /**
2157 * Validate contents of the buffer from userspace related to OS descriptors.
2158 */
2159 static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
2160 struct usb_os_desc_header *h, void *data,
2161 unsigned len, void *priv)
2162 {
2163 struct ffs_data *ffs = priv;
2164 u8 length;
2165
2166 ENTER();
2167
2168 switch (type) {
2169 case FFS_OS_DESC_EXT_COMPAT: {
2170 struct usb_ext_compat_desc *d = data;
2171 int i;
2172
2173 if (len < sizeof(*d) ||
2174 d->bFirstInterfaceNumber >= ffs->interfaces_count ||
2175 !d->Reserved1)
2176 return -EINVAL;
2177 for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
2178 if (d->Reserved2[i])
2179 return -EINVAL;
2180
2181 length = sizeof(struct usb_ext_compat_desc);
2182 }
2183 break;
2184 case FFS_OS_DESC_EXT_PROP: {
2185 struct usb_ext_prop_desc *d = data;
2186 u32 type, pdl;
2187 u16 pnl;
2188
2189 if (len < sizeof(*d) || h->interface >= ffs->interfaces_count)
2190 return -EINVAL;
2191 length = le32_to_cpu(d->dwSize);
2192 type = le32_to_cpu(d->dwPropertyDataType);
2193 if (type < USB_EXT_PROP_UNICODE ||
2194 type > USB_EXT_PROP_UNICODE_MULTI) {
2195 pr_vdebug("unsupported os descriptor property type: %d",
2196 type);
2197 return -EINVAL;
2198 }
2199 pnl = le16_to_cpu(d->wPropertyNameLength);
2200 pdl = le32_to_cpu(*(u32 *)((u8 *)data + 10 + pnl));
2201 if (length != 14 + pnl + pdl) {
2202 pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n",
2203 length, pnl, pdl, type);
2204 return -EINVAL;
2205 }
2206 ++ffs->ms_os_descs_ext_prop_count;
2207 /* property name reported to the host as "WCHAR"s */
2208 ffs->ms_os_descs_ext_prop_name_len += pnl * 2;
2209 ffs->ms_os_descs_ext_prop_data_len += pdl;
2210 }
2211 break;
2212 default:
2213 pr_vdebug("unknown descriptor: %d\n", type);
2214 return -EINVAL;
2215 }
2216 return length;
2217 }
2218
2219 static int __ffs_data_got_descs(struct ffs_data *ffs,
2220 char *const _data, size_t len)
2221 {
2222 char *data = _data, *raw_descs;
2223 unsigned os_descs_count = 0, counts[3], flags;
2224 int ret = -EINVAL, i;
2225 struct ffs_desc_helper helper;
2226
2227 ENTER();
2228
2229 if (get_unaligned_le32(data + 4) != len)
2230 goto error;
2231
2232 switch (get_unaligned_le32(data)) {
2233 case FUNCTIONFS_DESCRIPTORS_MAGIC:
2234 flags = FUNCTIONFS_HAS_FS_DESC | FUNCTIONFS_HAS_HS_DESC;
2235 data += 8;
2236 len -= 8;
2237 break;
2238 case FUNCTIONFS_DESCRIPTORS_MAGIC_V2:
2239 flags = get_unaligned_le32(data + 8);
2240 ffs->user_flags = flags;
2241 if (flags & ~(FUNCTIONFS_HAS_FS_DESC |
2242 FUNCTIONFS_HAS_HS_DESC |
2243 FUNCTIONFS_HAS_SS_DESC |
2244 FUNCTIONFS_HAS_MS_OS_DESC |
2245 FUNCTIONFS_VIRTUAL_ADDR |
2246 FUNCTIONFS_EVENTFD)) {
2247 ret = -ENOSYS;
2248 goto error;
2249 }
2250 data += 12;
2251 len -= 12;
2252 break;
2253 default:
2254 goto error;
2255 }
2256
2257 if (flags & FUNCTIONFS_EVENTFD) {
2258 if (len < 4)
2259 goto error;
2260 ffs->ffs_eventfd =
2261 eventfd_ctx_fdget((int)get_unaligned_le32(data));
2262 if (IS_ERR(ffs->ffs_eventfd)) {
2263 ret = PTR_ERR(ffs->ffs_eventfd);
2264 ffs->ffs_eventfd = NULL;
2265 goto error;
2266 }
2267 data += 4;
2268 len -= 4;
2269 }
2270
2271 /* Read fs_count, hs_count and ss_count (if present) */
2272 for (i = 0; i < 3; ++i) {
2273 if (!(flags & (1 << i))) {
2274 counts[i] = 0;
2275 } else if (len < 4) {
2276 goto error;
2277 } else {
2278 counts[i] = get_unaligned_le32(data);
2279 data += 4;
2280 len -= 4;
2281 }
2282 }
2283 if (flags & (1 << i)) {
2284 os_descs_count = get_unaligned_le32(data);
2285 data += 4;
2286 len -= 4;
2287 };
2288
2289 /* Read descriptors */
2290 raw_descs = data;
2291 helper.ffs = ffs;
2292 for (i = 0; i < 3; ++i) {
2293 if (!counts[i])
2294 continue;
2295 helper.interfaces_count = 0;
2296 helper.eps_count = 0;
2297 ret = ffs_do_descs(counts[i], data, len,
2298 __ffs_data_do_entity, &helper);
2299 if (ret < 0)
2300 goto error;
2301 if (!ffs->eps_count && !ffs->interfaces_count) {
2302 ffs->eps_count = helper.eps_count;
2303 ffs->interfaces_count = helper.interfaces_count;
2304 } else {
2305 if (ffs->eps_count != helper.eps_count) {
2306 ret = -EINVAL;
2307 goto error;
2308 }
2309 if (ffs->interfaces_count != helper.interfaces_count) {
2310 ret = -EINVAL;
2311 goto error;
2312 }
2313 }
2314 data += ret;
2315 len -= ret;
2316 }
2317 if (os_descs_count) {
2318 ret = ffs_do_os_descs(os_descs_count, data, len,
2319 __ffs_data_do_os_desc, ffs);
2320 if (ret < 0)
2321 goto error;
2322 data += ret;
2323 len -= ret;
2324 }
2325
2326 if (raw_descs == data || len) {
2327 ret = -EINVAL;
2328 goto error;
2329 }
2330
2331 ffs->raw_descs_data = _data;
2332 ffs->raw_descs = raw_descs;
2333 ffs->raw_descs_length = data - raw_descs;
2334 ffs->fs_descs_count = counts[0];
2335 ffs->hs_descs_count = counts[1];
2336 ffs->ss_descs_count = counts[2];
2337 ffs->ms_os_descs_count = os_descs_count;
2338
2339 return 0;
2340
2341 error:
2342 kfree(_data);
2343 return ret;
2344 }
2345
2346 static int __ffs_data_got_strings(struct ffs_data *ffs,
2347 char *const _data, size_t len)
2348 {
2349 u32 str_count, needed_count, lang_count;
2350 struct usb_gadget_strings **stringtabs, *t;
2351 const char *data = _data;
2352 struct usb_string *s;
2353
2354 ENTER();
2355
2356 if (unlikely(get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
2357 get_unaligned_le32(data + 4) != len))
2358 goto error;
2359 str_count = get_unaligned_le32(data + 8);
2360 lang_count = get_unaligned_le32(data + 12);
2361
2362 /* if one is zero the other must be zero */
2363 if (unlikely(!str_count != !lang_count))
2364 goto error;
2365
2366 /* Do we have at least as many strings as descriptors need? */
2367 needed_count = ffs->strings_count;
2368 if (unlikely(str_count < needed_count))
2369 goto error;
2370
2371 /*
2372 * If we don't need any strings just return and free all
2373 * memory.
2374 */
2375 if (!needed_count) {
2376 kfree(_data);
2377 return 0;
2378 }
2379
2380 /* Allocate everything in one chunk so there's less maintenance. */
2381 {
2382 unsigned i = 0;
2383 vla_group(d);
2384 vla_item(d, struct usb_gadget_strings *, stringtabs,
2385 lang_count + 1);
2386 vla_item(d, struct usb_gadget_strings, stringtab, lang_count);
2387 vla_item(d, struct usb_string, strings,
2388 lang_count*(needed_count+1));
2389
2390 char *vlabuf = kmalloc(vla_group_size(d), GFP_KERNEL);
2391
2392 if (unlikely(!vlabuf)) {
2393 kfree(_data);
2394 return -ENOMEM;
2395 }
2396
2397 /* Initialize the VLA pointers */
2398 stringtabs = vla_ptr(vlabuf, d, stringtabs);
2399 t = vla_ptr(vlabuf, d, stringtab);
2400 i = lang_count;
2401 do {
2402 *stringtabs++ = t++;
2403 } while (--i);
2404 *stringtabs = NULL;
2405
2406 /* stringtabs = vlabuf = d_stringtabs for later kfree */
2407 stringtabs = vla_ptr(vlabuf, d, stringtabs);
2408 t = vla_ptr(vlabuf, d, stringtab);
2409 s = vla_ptr(vlabuf, d, strings);
2410 }
2411
2412 /* For each language */
2413 data += 16;
2414 len -= 16;
2415
2416 do { /* lang_count > 0 so we can use do-while */
2417 unsigned needed = needed_count;
2418
2419 if (unlikely(len < 3))
2420 goto error_free;
2421 t->language = get_unaligned_le16(data);
2422 t->strings = s;
2423 ++t;
2424
2425 data += 2;
2426 len -= 2;
2427
2428 /* For each string */
2429 do { /* str_count > 0 so we can use do-while */
2430 size_t length = strnlen(data, len);
2431
2432 if (unlikely(length == len))
2433 goto error_free;
2434
2435 /*
2436 * User may provide more strings then we need,
2437 * if that's the case we simply ignore the
2438 * rest
2439 */
2440 if (likely(needed)) {
2441 /*
2442 * s->id will be set while adding
2443 * function to configuration so for
2444 * now just leave garbage here.
2445 */
2446 s->s = data;
2447 --needed;
2448 ++s;
2449 }
2450
2451 data += length + 1;
2452 len -= length + 1;
2453 } while (--str_count);
2454
2455 s->id = 0; /* terminator */
2456 s->s = NULL;
2457 ++s;
2458
2459 } while (--lang_count);
2460
2461 /* Some garbage left? */
2462 if (unlikely(len))
2463 goto error_free;
2464
2465 /* Done! */
2466 ffs->stringtabs = stringtabs;
2467 ffs->raw_strings = _data;
2468
2469 return 0;
2470
2471 error_free:
2472 kfree(stringtabs);
2473 error:
2474 kfree(_data);
2475 return -EINVAL;
2476 }
2477
2478
2479 /* Events handling and management *******************************************/
2480
2481 static void __ffs_event_add(struct ffs_data *ffs,
2482 enum usb_functionfs_event_type type)
2483 {
2484 enum usb_functionfs_event_type rem_type1, rem_type2 = type;
2485 int neg = 0;
2486
2487 /*
2488 * Abort any unhandled setup
2489 *
2490 * We do not need to worry about some cmpxchg() changing value
2491 * of ffs->setup_state without holding the lock because when
2492 * state is FFS_SETUP_PENDING cmpxchg() in several places in
2493 * the source does nothing.
2494 */
2495 if (ffs->setup_state == FFS_SETUP_PENDING)
2496 ffs->setup_state = FFS_SETUP_CANCELLED;
2497
2498 /*
2499 * Logic of this function guarantees that there are at most four pending
2500 * evens on ffs->ev.types queue. This is important because the queue
2501 * has space for four elements only and __ffs_ep0_read_events function
2502 * depends on that limit as well. If more event types are added, those
2503 * limits have to be revisited or guaranteed to still hold.
2504 */
2505 switch (type) {
2506 case FUNCTIONFS_RESUME:
2507 rem_type2 = FUNCTIONFS_SUSPEND;
2508 /* FALL THROUGH */
2509 case FUNCTIONFS_SUSPEND:
2510 case FUNCTIONFS_SETUP:
2511 rem_type1 = type;
2512 /* Discard all similar events */
2513 break;
2514
2515 case FUNCTIONFS_BIND:
2516 case FUNCTIONFS_UNBIND:
2517 case FUNCTIONFS_DISABLE:
2518 case FUNCTIONFS_ENABLE:
2519 /* Discard everything other then power management. */
2520 rem_type1 = FUNCTIONFS_SUSPEND;
2521 rem_type2 = FUNCTIONFS_RESUME;
2522 neg = 1;
2523 break;
2524
2525 default:
2526 WARN(1, "%d: unknown event, this should not happen\n", type);
2527 return;
2528 }
2529
2530 {
2531 u8 *ev = ffs->ev.types, *out = ev;
2532 unsigned n = ffs->ev.count;
2533 for (; n; --n, ++ev)
2534 if ((*ev == rem_type1 || *ev == rem_type2) == neg)
2535 *out++ = *ev;
2536 else
2537 pr_vdebug("purging event %d\n", *ev);
2538 ffs->ev.count = out - ffs->ev.types;
2539 }
2540
2541 pr_vdebug("adding event %d\n", type);
2542 ffs->ev.types[ffs->ev.count++] = type;
2543 wake_up_locked(&ffs->ev.waitq);
2544 if (ffs->ffs_eventfd)
2545 eventfd_signal(ffs->ffs_eventfd, 1);
2546 }
2547
2548 static void ffs_event_add(struct ffs_data *ffs,
2549 enum usb_functionfs_event_type type)
2550 {
2551 unsigned long flags;
2552 spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
2553 __ffs_event_add(ffs, type);
2554 spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
2555 }
2556
2557 /* Bind/unbind USB function hooks *******************************************/
2558
2559 static int ffs_ep_addr2idx(struct ffs_data *ffs, u8 endpoint_address)
2560 {
2561 int i;
2562
2563 for (i = 1; i < ARRAY_SIZE(ffs->eps_addrmap); ++i)
2564 if (ffs->eps_addrmap[i] == endpoint_address)
2565 return i;
2566 return -ENOENT;
2567 }
2568
2569 static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep,
2570 struct usb_descriptor_header *desc,
2571 void *priv)
2572 {
2573 struct usb_endpoint_descriptor *ds = (void *)desc;
2574 struct ffs_function *func = priv;
2575 struct ffs_ep *ffs_ep;
2576 unsigned ep_desc_id;
2577 int idx;
2578 static const char *speed_names[] = { "full", "high", "super" };
2579
2580 if (type != FFS_DESCRIPTOR)
2581 return 0;
2582
2583 /*
2584 * If ss_descriptors is not NULL, we are reading super speed
2585 * descriptors; if hs_descriptors is not NULL, we are reading high
2586 * speed descriptors; otherwise, we are reading full speed
2587 * descriptors.
2588 */
2589 if (func->function.ss_descriptors) {
2590 ep_desc_id = 2;
2591 func->function.ss_descriptors[(long)valuep] = desc;
2592 } else if (func->function.hs_descriptors) {
2593 ep_desc_id = 1;
2594 func->function.hs_descriptors[(long)valuep] = desc;
2595 } else {
2596 ep_desc_id = 0;
2597 func->function.fs_descriptors[(long)valuep] = desc;
2598 }
2599
2600 if (!desc || desc->bDescriptorType != USB_DT_ENDPOINT)
2601 return 0;
2602
2603 idx = ffs_ep_addr2idx(func->ffs, ds->bEndpointAddress) - 1;
2604 if (idx < 0)
2605 return idx;
2606
2607 ffs_ep = func->eps + idx;
2608
2609 if (unlikely(ffs_ep->descs[ep_desc_id])) {
2610 pr_err("two %sspeed descriptors for EP %d\n",
2611 speed_names[ep_desc_id],
2612 ds->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
2613 return -EINVAL;
2614 }
2615 ffs_ep->descs[ep_desc_id] = ds;
2616
2617 ffs_dump_mem(": Original ep desc", ds, ds->bLength);
2618 if (ffs_ep->ep) {
2619 ds->bEndpointAddress = ffs_ep->descs[0]->bEndpointAddress;
2620 if (!ds->wMaxPacketSize)
2621 ds->wMaxPacketSize = ffs_ep->descs[0]->wMaxPacketSize;
2622 } else {
2623 struct usb_request *req;
2624 struct usb_ep *ep;
2625 u8 bEndpointAddress;
2626
2627 /*
2628 * We back up bEndpointAddress because autoconfig overwrites
2629 * it with physical endpoint address.
2630 */
2631 bEndpointAddress = ds->bEndpointAddress;
2632 pr_vdebug("autoconfig\n");
2633 ep = usb_ep_autoconfig(func->gadget, ds);
2634 if (unlikely(!ep))
2635 return -ENOTSUPP;
2636 ep->driver_data = func->eps + idx;
2637
2638 req = usb_ep_alloc_request(ep, GFP_KERNEL);
2639 if (unlikely(!req))
2640 return -ENOMEM;
2641
2642 ffs_ep->ep = ep;
2643 ffs_ep->req = req;
2644 func->eps_revmap[ds->bEndpointAddress &
2645 USB_ENDPOINT_NUMBER_MASK] = idx + 1;
2646 /*
2647 * If we use virtual address mapping, we restore
2648 * original bEndpointAddress value.
2649 */
2650 if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
2651 ds->bEndpointAddress = bEndpointAddress;
2652 }
2653 ffs_dump_mem(": Rewritten ep desc", ds, ds->bLength);
2654
2655 return 0;
2656 }
2657
2658 static int __ffs_func_bind_do_nums(enum ffs_entity_type type, u8 *valuep,
2659 struct usb_descriptor_header *desc,
2660 void *priv)
2661 {
2662 struct ffs_function *func = priv;
2663 unsigned idx;
2664 u8 newValue;
2665
2666 switch (type) {
2667 default:
2668 case FFS_DESCRIPTOR:
2669 /* Handled in previous pass by __ffs_func_bind_do_descs() */
2670 return 0;
2671
2672 case FFS_INTERFACE:
2673 idx = *valuep;
2674 if (func->interfaces_nums[idx] < 0) {
2675 int id = usb_interface_id(func->conf, &func->function);
2676 if (unlikely(id < 0))
2677 return id;
2678 func->interfaces_nums[idx] = id;
2679 }
2680 newValue = func->interfaces_nums[idx];
2681 break;
2682
2683 case FFS_STRING:
2684 /* String' IDs are allocated when fsf_data is bound to cdev */
2685 newValue = func->ffs->stringtabs[0]->strings[*valuep - 1].id;
2686 break;
2687
2688 case FFS_ENDPOINT:
2689 /*
2690 * USB_DT_ENDPOINT are handled in
2691 * __ffs_func_bind_do_descs().
2692 */
2693 if (desc->bDescriptorType == USB_DT_ENDPOINT)
2694 return 0;
2695
2696 idx = (*valuep & USB_ENDPOINT_NUMBER_MASK) - 1;
2697 if (unlikely(!func->eps[idx].ep))
2698 return -EINVAL;
2699
2700 {
2701 struct usb_endpoint_descriptor **descs;
2702 descs = func->eps[idx].descs;
2703 newValue = descs[descs[0] ? 0 : 1]->bEndpointAddress;
2704 }
2705 break;
2706 }
2707
2708 pr_vdebug("%02x -> %02x\n", *valuep, newValue);
2709 *valuep = newValue;
2710 return 0;
2711 }
2712
2713 static int __ffs_func_bind_do_os_desc(enum ffs_os_desc_type type,
2714 struct usb_os_desc_header *h, void *data,
2715 unsigned len, void *priv)
2716 {
2717 struct ffs_function *func = priv;
2718 u8 length = 0;
2719
2720 switch (type) {
2721 case FFS_OS_DESC_EXT_COMPAT: {
2722 struct usb_ext_compat_desc *desc = data;
2723 struct usb_os_desc_table *t;
2724
2725 t = &func->function.os_desc_table[desc->bFirstInterfaceNumber];
2726 t->if_id = func->interfaces_nums[desc->bFirstInterfaceNumber];
2727 memcpy(t->os_desc->ext_compat_id, &desc->CompatibleID,
2728 ARRAY_SIZE(desc->CompatibleID) +
2729 ARRAY_SIZE(desc->SubCompatibleID));
2730 length = sizeof(*desc);
2731 }
2732 break;
2733 case FFS_OS_DESC_EXT_PROP: {
2734 struct usb_ext_prop_desc *desc = data;
2735 struct usb_os_desc_table *t;
2736 struct usb_os_desc_ext_prop *ext_prop;
2737 char *ext_prop_name;
2738 char *ext_prop_data;
2739
2740 t = &func->function.os_desc_table[h->interface];
2741 t->if_id = func->interfaces_nums[h->interface];
2742
2743 ext_prop = func->ffs->ms_os_descs_ext_prop_avail;
2744 func->ffs->ms_os_descs_ext_prop_avail += sizeof(*ext_prop);
2745
2746 ext_prop->type = le32_to_cpu(desc->dwPropertyDataType);
2747 ext_prop->name_len = le16_to_cpu(desc->wPropertyNameLength);
2748 ext_prop->data_len = le32_to_cpu(*(u32 *)
2749 usb_ext_prop_data_len_ptr(data, ext_prop->name_len));
2750 length = ext_prop->name_len + ext_prop->data_len + 14;
2751
2752 ext_prop_name = func->ffs->ms_os_descs_ext_prop_name_avail;
2753 func->ffs->ms_os_descs_ext_prop_name_avail +=
2754 ext_prop->name_len;
2755
2756 ext_prop_data = func->ffs->ms_os_descs_ext_prop_data_avail;
2757 func->ffs->ms_os_descs_ext_prop_data_avail +=
2758 ext_prop->data_len;
2759 memcpy(ext_prop_data,
2760 usb_ext_prop_data_ptr(data, ext_prop->name_len),
2761 ext_prop->data_len);
2762 /* unicode data reported to the host as "WCHAR"s */
2763 switch (ext_prop->type) {
2764 case USB_EXT_PROP_UNICODE:
2765 case USB_EXT_PROP_UNICODE_ENV:
2766 case USB_EXT_PROP_UNICODE_LINK:
2767 case USB_EXT_PROP_UNICODE_MULTI:
2768 ext_prop->data_len *= 2;
2769 break;
2770 }
2771 ext_prop->data = ext_prop_data;
2772
2773 memcpy(ext_prop_name, usb_ext_prop_name_ptr(data),
2774 ext_prop->name_len);
2775 /* property name reported to the host as "WCHAR"s */
2776 ext_prop->name_len *= 2;
2777 ext_prop->name = ext_prop_name;
2778
2779 t->os_desc->ext_prop_len +=
2780 ext_prop->name_len + ext_prop->data_len + 14;
2781 ++t->os_desc->ext_prop_count;
2782 list_add_tail(&ext_prop->entry, &t->os_desc->ext_prop);
2783 }
2784 break;
2785 default:
2786 pr_vdebug("unknown descriptor: %d\n", type);
2787 }
2788
2789 return length;
2790 }
2791
2792 static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f,
2793 struct usb_configuration *c)
2794 {
2795 struct ffs_function *func = ffs_func_from_usb(f);
2796 struct f_fs_opts *ffs_opts =
2797 container_of(f->fi, struct f_fs_opts, func_inst);
2798 int ret;
2799
2800 ENTER();
2801
2802 /*
2803 * Legacy gadget triggers binding in functionfs_ready_callback,
2804 * which already uses locking; taking the same lock here would
2805 * cause a deadlock.
2806 *
2807 * Configfs-enabled gadgets however do need ffs_dev_lock.
2808 */
2809 if (!ffs_opts->no_configfs)
2810 ffs_dev_lock();
2811 ret = ffs_opts->dev->desc_ready ? 0 : -ENODEV;
2812 func->ffs = ffs_opts->dev->ffs_data;
2813 if (!ffs_opts->no_configfs)
2814 ffs_dev_unlock();
2815 if (ret)
2816 return ERR_PTR(ret);
2817
2818 func->conf = c;
2819 func->gadget = c->cdev->gadget;
2820
2821 /*
2822 * in drivers/usb/gadget/configfs.c:configfs_composite_bind()
2823 * configurations are bound in sequence with list_for_each_entry,
2824 * in each configuration its functions are bound in sequence
2825 * with list_for_each_entry, so we assume no race condition
2826 * with regard to ffs_opts->bound access
2827 */
2828 if (!ffs_opts->refcnt) {
2829 ret = functionfs_bind(func->ffs, c->cdev);
2830 if (ret)
2831 return ERR_PTR(ret);
2832 }
2833 ffs_opts->refcnt++;
2834 func->function.strings = func->ffs->stringtabs;
2835
2836 return ffs_opts;
2837 }
2838
2839 static int _ffs_func_bind(struct usb_configuration *c,
2840 struct usb_function *f)
2841 {
2842 struct ffs_function *func = ffs_func_from_usb(f);
2843 struct ffs_data *ffs = func->ffs;
2844
2845 const int full = !!func->ffs->fs_descs_count;
2846 const int high = gadget_is_dualspeed(func->gadget) &&
2847 func->ffs->hs_descs_count;
2848 const int super = gadget_is_superspeed(func->gadget) &&
2849 func->ffs->ss_descs_count;
2850
2851 int fs_len, hs_len, ss_len, ret, i;
2852 struct ffs_ep *eps_ptr;
2853
2854 /* Make it a single chunk, less management later on */
2855 vla_group(d);
2856 vla_item_with_sz(d, struct ffs_ep, eps, ffs->eps_count);
2857 vla_item_with_sz(d, struct usb_descriptor_header *, fs_descs,
2858 full ? ffs->fs_descs_count + 1 : 0);
2859 vla_item_with_sz(d, struct usb_descriptor_header *, hs_descs,
2860 high ? ffs->hs_descs_count + 1 : 0);
2861 vla_item_with_sz(d, struct usb_descriptor_header *, ss_descs,
2862 super ? ffs->ss_descs_count + 1 : 0);
2863 vla_item_with_sz(d, short, inums, ffs->interfaces_count);
2864 vla_item_with_sz(d, struct usb_os_desc_table, os_desc_table,
2865 c->cdev->use_os_string ? ffs->interfaces_count : 0);
2866 vla_item_with_sz(d, char[16], ext_compat,
2867 c->cdev->use_os_string ? ffs->interfaces_count : 0);
2868 vla_item_with_sz(d, struct usb_os_desc, os_desc,
2869 c->cdev->use_os_string ? ffs->interfaces_count : 0);
2870 vla_item_with_sz(d, struct usb_os_desc_ext_prop, ext_prop,
2871 ffs->ms_os_descs_ext_prop_count);
2872 vla_item_with_sz(d, char, ext_prop_name,
2873 ffs->ms_os_descs_ext_prop_name_len);
2874 vla_item_with_sz(d, char, ext_prop_data,
2875 ffs->ms_os_descs_ext_prop_data_len);
2876 vla_item_with_sz(d, char, raw_descs, ffs->raw_descs_length);
2877 char *vlabuf;
2878
2879 ENTER();
2880
2881 /* Has descriptors only for speeds gadget does not support */
2882 if (unlikely(!(full | high | super)))
2883 return -ENOTSUPP;
2884
2885 /* Allocate a single chunk, less management later on */
2886 vlabuf = kzalloc(vla_group_size(d), GFP_KERNEL);
2887 if (unlikely(!vlabuf))
2888 return -ENOMEM;
2889
2890 ffs->ms_os_descs_ext_prop_avail = vla_ptr(vlabuf, d, ext_prop);
2891 ffs->ms_os_descs_ext_prop_name_avail =
2892 vla_ptr(vlabuf, d, ext_prop_name);
2893 ffs->ms_os_descs_ext_prop_data_avail =
2894 vla_ptr(vlabuf, d, ext_prop_data);
2895
2896 /* Copy descriptors */
2897 memcpy(vla_ptr(vlabuf, d, raw_descs), ffs->raw_descs,
2898 ffs->raw_descs_length);
2899
2900 memset(vla_ptr(vlabuf, d, inums), 0xff, d_inums__sz);
2901 eps_ptr = vla_ptr(vlabuf, d, eps);
2902 for (i = 0; i < ffs->eps_count; i++)
2903 eps_ptr[i].num = -1;
2904
2905 /* Save pointers
2906 * d_eps == vlabuf, func->eps used to kfree vlabuf later
2907 */
2908 func->eps = vla_ptr(vlabuf, d, eps);
2909 func->interfaces_nums = vla_ptr(vlabuf, d, inums);
2910
2911 /*
2912 * Go through all the endpoint descriptors and allocate
2913 * endpoints first, so that later we can rewrite the endpoint
2914 * numbers without worrying that it may be described later on.
2915 */
2916 if (likely(full)) {
2917 func->function.fs_descriptors = vla_ptr(vlabuf, d, fs_descs);
2918 fs_len = ffs_do_descs(ffs->fs_descs_count,
2919 vla_ptr(vlabuf, d, raw_descs),
2920 d_raw_descs__sz,
2921 __ffs_func_bind_do_descs, func);
2922 if (unlikely(fs_len < 0)) {
2923 ret = fs_len;
2924 goto error;
2925 }
2926 } else {
2927 fs_len = 0;
2928 }
2929
2930 if (likely(high)) {
2931 func->function.hs_descriptors = vla_ptr(vlabuf, d, hs_descs);
2932 hs_len = ffs_do_descs(ffs->hs_descs_count,
2933 vla_ptr(vlabuf, d, raw_descs) + fs_len,
2934 d_raw_descs__sz - fs_len,
2935 __ffs_func_bind_do_descs, func);
2936 if (unlikely(hs_len < 0)) {
2937 ret = hs_len;
2938 goto error;
2939 }
2940 } else {
2941 hs_len = 0;
2942 }
2943
2944 if (likely(super)) {
2945 func->function.ss_descriptors = vla_ptr(vlabuf, d, ss_descs);
2946 ss_len = ffs_do_descs(ffs->ss_descs_count,
2947 vla_ptr(vlabuf, d, raw_descs) + fs_len + hs_len,
2948 d_raw_descs__sz - fs_len - hs_len,
2949 __ffs_func_bind_do_descs, func);
2950 if (unlikely(ss_len < 0)) {
2951 ret = ss_len;
2952 goto error;
2953 }
2954 } else {
2955 ss_len = 0;
2956 }
2957
2958 /*
2959 * Now handle interface numbers allocation and interface and
2960 * endpoint numbers rewriting. We can do that in one go
2961 * now.
2962 */
2963 ret = ffs_do_descs(ffs->fs_descs_count +
2964 (high ? ffs->hs_descs_count : 0) +
2965 (super ? ffs->ss_descs_count : 0),
2966 vla_ptr(vlabuf, d, raw_descs), d_raw_descs__sz,
2967 __ffs_func_bind_do_nums, func);
2968 if (unlikely(ret < 0))
2969 goto error;
2970
2971 func->function.os_desc_table = vla_ptr(vlabuf, d, os_desc_table);
2972 if (c->cdev->use_os_string) {
2973 for (i = 0; i < ffs->interfaces_count; ++i) {
2974 struct usb_os_desc *desc;
2975
2976 desc = func->function.os_desc_table[i].os_desc =
2977 vla_ptr(vlabuf, d, os_desc) +
2978 i * sizeof(struct usb_os_desc);
2979 desc->ext_compat_id =
2980 vla_ptr(vlabuf, d, ext_compat) + i * 16;
2981 INIT_LIST_HEAD(&desc->ext_prop);
2982 }
2983 ret = ffs_do_os_descs(ffs->ms_os_descs_count,
2984 vla_ptr(vlabuf, d, raw_descs) +
2985 fs_len + hs_len + ss_len,
2986 d_raw_descs__sz - fs_len - hs_len -
2987 ss_len,
2988 __ffs_func_bind_do_os_desc, func);
2989 if (unlikely(ret < 0))
2990 goto error;
2991 }
2992 func->function.os_desc_n =
2993 c->cdev->use_os_string ? ffs->interfaces_count : 0;
2994
2995 /* And we're done */
2996 ffs_event_add(ffs, FUNCTIONFS_BIND);
2997 return 0;
2998
2999 error:
3000 /* XXX Do we need to release all claimed endpoints here? */
3001 return ret;
3002 }
3003
3004 static int ffs_func_bind(struct usb_configuration *c,
3005 struct usb_function *f)
3006 {
3007 struct f_fs_opts *ffs_opts = ffs_do_functionfs_bind(f, c);
3008 struct ffs_function *func = ffs_func_from_usb(f);
3009 int ret;
3010
3011 if (IS_ERR(ffs_opts))
3012 return PTR_ERR(ffs_opts);
3013
3014 ret = _ffs_func_bind(c, f);
3015 if (ret && !--ffs_opts->refcnt)
3016 functionfs_unbind(func->ffs);
3017
3018 return ret;
3019 }
3020
3021
3022 /* Other USB function hooks *************************************************/
3023
3024 static void ffs_reset_work(struct work_struct *work)
3025 {
3026 struct ffs_data *ffs = container_of(work,
3027 struct ffs_data, reset_work);
3028 ffs_data_reset(ffs);
3029 }
3030
3031 static int ffs_func_set_alt(struct usb_function *f,
3032 unsigned interface, unsigned alt)
3033 {
3034 struct ffs_function *func = ffs_func_from_usb(f);
3035 struct ffs_data *ffs = func->ffs;
3036 int ret = 0, intf;
3037
3038 if (alt != (unsigned)-1) {
3039 intf = ffs_func_revmap_intf(func, interface);
3040 if (unlikely(intf < 0))
3041 return intf;
3042 }
3043
3044 if (ffs->func)
3045 ffs_func_eps_disable(ffs->func);
3046
3047 if (ffs->state == FFS_DEACTIVATED) {
3048 ffs->state = FFS_CLOSING;
3049 INIT_WORK(&ffs->reset_work, ffs_reset_work);
3050 schedule_work(&ffs->reset_work);
3051 return -ENODEV;
3052 }
3053
3054 if (ffs->state != FFS_ACTIVE)
3055 return -ENODEV;
3056
3057 if (alt == (unsigned)-1) {
3058 ffs->func = NULL;
3059 ffs_event_add(ffs, FUNCTIONFS_DISABLE);
3060 return 0;
3061 }
3062
3063 ffs->func = func;
3064 ret = ffs_func_eps_enable(func);
3065 if (likely(ret >= 0))
3066 ffs_event_add(ffs, FUNCTIONFS_ENABLE);
3067 return ret;
3068 }
3069
3070 static void ffs_func_disable(struct usb_function *f)
3071 {
3072 ffs_func_set_alt(f, 0, (unsigned)-1);
3073 }
3074
3075 static int ffs_func_setup(struct usb_function *f,
3076 const struct usb_ctrlrequest *creq)
3077 {
3078 struct ffs_function *func = ffs_func_from_usb(f);
3079 struct ffs_data *ffs = func->ffs;
3080 unsigned long flags;
3081 int ret;
3082
3083 ENTER();
3084
3085 pr_vdebug("creq->bRequestType = %02x\n", creq->bRequestType);
3086 pr_vdebug("creq->bRequest = %02x\n", creq->bRequest);
3087 pr_vdebug("creq->wValue = %04x\n", le16_to_cpu(creq->wValue));
3088 pr_vdebug("creq->wIndex = %04x\n", le16_to_cpu(creq->wIndex));
3089 pr_vdebug("creq->wLength = %04x\n", le16_to_cpu(creq->wLength));
3090
3091 /*
3092 * Most requests directed to interface go through here
3093 * (notable exceptions are set/get interface) so we need to
3094 * handle them. All other either handled by composite or
3095 * passed to usb_configuration->setup() (if one is set). No
3096 * matter, we will handle requests directed to endpoint here
3097 * as well (as it's straightforward) but what to do with any
3098 * other request?
3099 */
3100 if (ffs->state != FFS_ACTIVE)
3101 return -ENODEV;
3102
3103 switch (creq->bRequestType & USB_RECIP_MASK) {
3104 case USB_RECIP_INTERFACE:
3105 ret = ffs_func_revmap_intf(func, le16_to_cpu(creq->wIndex));
3106 if (unlikely(ret < 0))
3107 return ret;
3108 break;
3109
3110 case USB_RECIP_ENDPOINT:
3111 ret = ffs_func_revmap_ep(func, le16_to_cpu(creq->wIndex));
3112 if (unlikely(ret < 0))
3113 return ret;
3114 if (func->ffs->user_flags & FUNCTIONFS_VIRTUAL_ADDR)
3115 ret = func->ffs->eps_addrmap[ret];
3116 break;
3117
3118 default:
3119 return -EOPNOTSUPP;
3120 }
3121
3122 spin_lock_irqsave(&ffs->ev.waitq.lock, flags);
3123 ffs->ev.setup = *creq;
3124 ffs->ev.setup.wIndex = cpu_to_le16(ret);
3125 __ffs_event_add(ffs, FUNCTIONFS_SETUP);
3126 spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
3127
3128 return 0;
3129 }
3130
3131 static void ffs_func_suspend(struct usb_function *f)
3132 {
3133 ENTER();
3134 ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_SUSPEND);
3135 }
3136
3137 static void ffs_func_resume(struct usb_function *f)
3138 {
3139 ENTER();
3140 ffs_event_add(ffs_func_from_usb(f)->ffs, FUNCTIONFS_RESUME);
3141 }
3142
3143
3144 /* Endpoint and interface numbers reverse mapping ***************************/
3145
3146 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num)
3147 {
3148 num = func->eps_revmap[num & USB_ENDPOINT_NUMBER_MASK];
3149 return num ? num : -EDOM;
3150 }
3151
3152 static int ffs_func_revmap_intf(struct ffs_function *func, u8 intf)
3153 {
3154 short *nums = func->interfaces_nums;
3155 unsigned count = func->ffs->interfaces_count;
3156
3157 for (; count; --count, ++nums) {
3158 if (*nums >= 0 && *nums == intf)
3159 return nums - func->interfaces_nums;
3160 }
3161
3162 return -EDOM;
3163 }
3164
3165
3166 /* Devices management *******************************************************/
3167
3168 static LIST_HEAD(ffs_devices);
3169
3170 static struct ffs_dev *_ffs_do_find_dev(const char *name)
3171 {
3172 struct ffs_dev *dev;
3173
3174 list_for_each_entry(dev, &ffs_devices, entry) {
3175 if (!dev->name || !name)
3176 continue;
3177 if (strcmp(dev->name, name) == 0)
3178 return dev;
3179 }
3180
3181 return NULL;
3182 }
3183
3184 /*
3185 * ffs_lock must be taken by the caller of this function
3186 */
3187 static struct ffs_dev *_ffs_get_single_dev(void)
3188 {
3189 struct ffs_dev *dev;
3190
3191 if (list_is_singular(&ffs_devices)) {
3192 dev = list_first_entry(&ffs_devices, struct ffs_dev, entry);
3193 if (dev->single)
3194 return dev;
3195 }
3196
3197 return NULL;
3198 }
3199
3200 /*
3201 * ffs_lock must be taken by the caller of this function
3202 */
3203 static struct ffs_dev *_ffs_find_dev(const char *name)
3204 {
3205 struct ffs_dev *dev;
3206
3207 dev = _ffs_get_single_dev();
3208 if (dev)
3209 return dev;
3210
3211 return _ffs_do_find_dev(name);
3212 }
3213
3214 /* Configfs support *********************************************************/
3215
3216 static inline struct f_fs_opts *to_ffs_opts(struct config_item *item)
3217 {
3218 return container_of(to_config_group(item), struct f_fs_opts,
3219 func_inst.group);
3220 }
3221
3222 static void ffs_attr_release(struct config_item *item)
3223 {
3224 struct f_fs_opts *opts = to_ffs_opts(item);
3225
3226 usb_put_function_instance(&opts->func_inst);
3227 }
3228
3229 static struct configfs_item_operations ffs_item_ops = {
3230 .release = ffs_attr_release,
3231 };
3232
3233 static struct config_item_type ffs_func_type = {
3234 .ct_item_ops = &ffs_item_ops,
3235 .ct_owner = THIS_MODULE,
3236 };
3237
3238
3239 /* Function registration interface ******************************************/
3240
3241 static void ffs_free_inst(struct usb_function_instance *f)
3242 {
3243 struct f_fs_opts *opts;
3244
3245 opts = to_f_fs_opts(f);
3246 ffs_dev_lock();
3247 _ffs_free_dev(opts->dev);
3248 ffs_dev_unlock();
3249 kfree(opts);
3250 }
3251
3252 #define MAX_INST_NAME_LEN 40
3253
3254 static int ffs_set_inst_name(struct usb_function_instance *fi, const char *name)
3255 {
3256 struct f_fs_opts *opts;
3257 char *ptr;
3258 const char *tmp;
3259 int name_len, ret;
3260
3261 name_len = strlen(name) + 1;
3262 if (name_len > MAX_INST_NAME_LEN)
3263 return -ENAMETOOLONG;
3264
3265 ptr = kstrndup(name, name_len, GFP_KERNEL);
3266 if (!ptr)
3267 return -ENOMEM;
3268
3269 opts = to_f_fs_opts(fi);
3270 tmp = NULL;
3271
3272 ffs_dev_lock();
3273
3274 tmp = opts->dev->name_allocated ? opts->dev->name : NULL;
3275 ret = _ffs_name_dev(opts->dev, ptr);
3276 if (ret) {
3277 kfree(ptr);
3278 ffs_dev_unlock();
3279 return ret;
3280 }
3281 opts->dev->name_allocated = true;
3282
3283 ffs_dev_unlock();
3284
3285 kfree(tmp);
3286
3287 return 0;
3288 }
3289
3290 static struct usb_function_instance *ffs_alloc_inst(void)
3291 {
3292 struct f_fs_opts *opts;
3293 struct ffs_dev *dev;
3294
3295 opts = kzalloc(sizeof(*opts), GFP_KERNEL);
3296 if (!opts)
3297 return ERR_PTR(-ENOMEM);
3298
3299 opts->func_inst.set_inst_name = ffs_set_inst_name;
3300 opts->func_inst.free_func_inst = ffs_free_inst;
3301 ffs_dev_lock();
3302 dev = _ffs_alloc_dev();
3303 ffs_dev_unlock();
3304 if (IS_ERR(dev)) {
3305 kfree(opts);
3306 return ERR_CAST(dev);
3307 }
3308 opts->dev = dev;
3309 dev->opts = opts;
3310
3311 config_group_init_type_name(&opts->func_inst.group, "",
3312 &ffs_func_type);
3313 return &opts->func_inst;
3314 }
3315
3316 static void ffs_free(struct usb_function *f)
3317 {
3318 kfree(ffs_func_from_usb(f));
3319 }
3320
3321 static void ffs_func_unbind(struct usb_configuration *c,
3322 struct usb_function *f)
3323 {
3324 struct ffs_function *func = ffs_func_from_usb(f);
3325 struct ffs_data *ffs = func->ffs;
3326 struct f_fs_opts *opts =
3327 container_of(f->fi, struct f_fs_opts, func_inst);
3328 struct ffs_ep *ep = func->eps;
3329 unsigned count = ffs->eps_count;
3330 unsigned long flags;
3331
3332 ENTER();
3333 if (ffs->func == func) {
3334 ffs_func_eps_disable(func);
3335 ffs->func = NULL;
3336 }
3337
3338 if (!--opts->refcnt)
3339 functionfs_unbind(ffs);
3340
3341 /* cleanup after autoconfig */
3342 spin_lock_irqsave(&func->ffs->eps_lock, flags);
3343 do {
3344 if (ep->ep && ep->req)
3345 usb_ep_free_request(ep->ep, ep->req);
3346 ep->req = NULL;
3347 ++ep;
3348 } while (--count);
3349 spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
3350 kfree(func->eps);
3351 func->eps = NULL;
3352 /*
3353 * eps, descriptors and interfaces_nums are allocated in the
3354 * same chunk so only one free is required.
3355 */
3356 func->function.fs_descriptors = NULL;
3357 func->function.hs_descriptors = NULL;
3358 func->function.ss_descriptors = NULL;
3359 func->interfaces_nums = NULL;
3360
3361 ffs_event_add(ffs, FUNCTIONFS_UNBIND);
3362 }
3363
3364 static struct usb_function *ffs_alloc(struct usb_function_instance *fi)
3365 {
3366 struct ffs_function *func;
3367
3368 ENTER();
3369
3370 func = kzalloc(sizeof(*func), GFP_KERNEL);
3371 if (unlikely(!func))
3372 return ERR_PTR(-ENOMEM);
3373
3374 func->function.name = "Function FS Gadget";
3375
3376 func->function.bind = ffs_func_bind;
3377 func->function.unbind = ffs_func_unbind;
3378 func->function.set_alt = ffs_func_set_alt;
3379 func->function.disable = ffs_func_disable;
3380 func->function.setup = ffs_func_setup;
3381 func->function.suspend = ffs_func_suspend;
3382 func->function.resume = ffs_func_resume;
3383 func->function.free_func = ffs_free;
3384
3385 return &func->function;
3386 }
3387
3388 /*
3389 * ffs_lock must be taken by the caller of this function
3390 */
3391 static struct ffs_dev *_ffs_alloc_dev(void)
3392 {
3393 struct ffs_dev *dev;
3394 int ret;
3395
3396 if (_ffs_get_single_dev())
3397 return ERR_PTR(-EBUSY);
3398
3399 dev = kzalloc(sizeof(*dev), GFP_KERNEL);
3400 if (!dev)
3401 return ERR_PTR(-ENOMEM);
3402
3403 if (list_empty(&ffs_devices)) {
3404 ret = functionfs_init();
3405 if (ret) {
3406 kfree(dev);
3407 return ERR_PTR(ret);
3408 }
3409 }
3410
3411 list_add(&dev->entry, &ffs_devices);
3412
3413 return dev;
3414 }
3415
3416 /*
3417 * ffs_lock must be taken by the caller of this function
3418 * The caller is responsible for "name" being available whenever f_fs needs it
3419 */
3420 static int _ffs_name_dev(struct ffs_dev *dev, const char *name)
3421 {
3422 struct ffs_dev *existing;
3423
3424 existing = _ffs_do_find_dev(name);
3425 if (existing)
3426 return -EBUSY;
3427
3428 dev->name = name;
3429
3430 return 0;
3431 }
3432
3433 /*
3434 * The caller is responsible for "name" being available whenever f_fs needs it
3435 */
3436 int ffs_name_dev(struct ffs_dev *dev, const char *name)
3437 {
3438 int ret;
3439
3440 ffs_dev_lock();
3441 ret = _ffs_name_dev(dev, name);
3442 ffs_dev_unlock();
3443
3444 return ret;
3445 }
3446 EXPORT_SYMBOL_GPL(ffs_name_dev);
3447
3448 int ffs_single_dev(struct ffs_dev *dev)
3449 {
3450 int ret;
3451
3452 ret = 0;
3453 ffs_dev_lock();
3454
3455 if (!list_is_singular(&ffs_devices))
3456 ret = -EBUSY;
3457 else
3458 dev->single = true;
3459
3460 ffs_dev_unlock();
3461 return ret;
3462 }
3463 EXPORT_SYMBOL_GPL(ffs_single_dev);
3464
3465 /*
3466 * ffs_lock must be taken by the caller of this function
3467 */
3468 static void _ffs_free_dev(struct ffs_dev *dev)
3469 {
3470 list_del(&dev->entry);
3471 if (dev->name_allocated)
3472 kfree(dev->name);
3473 kfree(dev);
3474 if (list_empty(&ffs_devices))
3475 functionfs_cleanup();
3476 }
3477
3478 static void *ffs_acquire_dev(const char *dev_name)
3479 {
3480 struct ffs_dev *ffs_dev;
3481
3482 ENTER();
3483 ffs_dev_lock();
3484
3485 ffs_dev = _ffs_find_dev(dev_name);
3486 if (!ffs_dev)
3487 ffs_dev = ERR_PTR(-ENOENT);
3488 else if (ffs_dev->mounted)
3489 ffs_dev = ERR_PTR(-EBUSY);
3490 else if (ffs_dev->ffs_acquire_dev_callback &&
3491 ffs_dev->ffs_acquire_dev_callback(ffs_dev))
3492 ffs_dev = ERR_PTR(-ENOENT);
3493 else
3494 ffs_dev->mounted = true;
3495
3496 ffs_dev_unlock();
3497 return ffs_dev;
3498 }
3499
3500 static void ffs_release_dev(struct ffs_data *ffs_data)
3501 {
3502 struct ffs_dev *ffs_dev;
3503
3504 ENTER();
3505 ffs_dev_lock();
3506
3507 ffs_dev = ffs_data->private_data;
3508 if (ffs_dev) {
3509 ffs_dev->mounted = false;
3510
3511 if (ffs_dev->ffs_release_dev_callback)
3512 ffs_dev->ffs_release_dev_callback(ffs_dev);
3513 }
3514
3515 ffs_dev_unlock();
3516 }
3517
3518 static int ffs_ready(struct ffs_data *ffs)
3519 {
3520 struct ffs_dev *ffs_obj;
3521 int ret = 0;
3522
3523 ENTER();
3524 ffs_dev_lock();
3525
3526 ffs_obj = ffs->private_data;
3527 if (!ffs_obj) {
3528 ret = -EINVAL;
3529 goto done;
3530 }
3531 if (WARN_ON(ffs_obj->desc_ready)) {
3532 ret = -EBUSY;
3533 goto done;
3534 }
3535
3536 ffs_obj->desc_ready = true;
3537 ffs_obj->ffs_data = ffs;
3538
3539 if (ffs_obj->ffs_ready_callback) {
3540 ret = ffs_obj->ffs_ready_callback(ffs);
3541 if (ret)
3542 goto done;
3543 }
3544
3545 set_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags);
3546 done:
3547 ffs_dev_unlock();
3548 return ret;
3549 }
3550
3551 static void ffs_closed(struct ffs_data *ffs)
3552 {
3553 struct ffs_dev *ffs_obj;
3554 struct f_fs_opts *opts;
3555
3556 ENTER();
3557 ffs_dev_lock();
3558
3559 ffs_obj = ffs->private_data;
3560 if (!ffs_obj)
3561 goto done;
3562
3563 ffs_obj->desc_ready = false;
3564
3565 if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) &&
3566 ffs_obj->ffs_closed_callback)
3567 ffs_obj->ffs_closed_callback(ffs);
3568
3569 if (ffs_obj->opts)
3570 opts = ffs_obj->opts;
3571 else
3572 goto done;
3573
3574 if (opts->no_configfs || !opts->func_inst.group.cg_item.ci_parent
3575 || !atomic_read(&opts->func_inst.group.cg_item.ci_kref.refcount))
3576 goto done;
3577
3578 unregister_gadget_item(ffs_obj->opts->
3579 func_inst.group.cg_item.ci_parent->ci_parent);
3580 done:
3581 ffs_dev_unlock();
3582 }
3583
3584 /* Misc helper functions ****************************************************/
3585
3586 static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock)
3587 {
3588 return nonblock
3589 ? likely(mutex_trylock(mutex)) ? 0 : -EAGAIN
3590 : mutex_lock_interruptible(mutex);
3591 }
3592
3593 static char *ffs_prepare_buffer(const char __user *buf, size_t len)
3594 {
3595 char *data;
3596
3597 if (unlikely(!len))
3598 return NULL;
3599
3600 data = kmalloc(len, GFP_KERNEL);
3601 if (unlikely(!data))
3602 return ERR_PTR(-ENOMEM);
3603
3604 if (unlikely(copy_from_user(data, buf, len))) {
3605 kfree(data);
3606 return ERR_PTR(-EFAULT);
3607 }
3608
3609 pr_vdebug("Buffer from user space:\n");
3610 ffs_dump_mem("", data, len);
3611
3612 return data;
3613 }
3614
3615 DECLARE_USB_FUNCTION_INIT(ffs, ffs_alloc_inst, ffs_alloc);
3616 MODULE_LICENSE("GPL");
3617 MODULE_AUTHOR("Michal Nazarewicz");
Linux kernel - Deliverables
This page took 0.152162 seconds and 6 git commands to generate.